I have some apps that need a to run a scrip after the install and have been unable to figure out how to trigger them to run after the install of the App or how to show up in Self service.  one of the App's is VPN client and the script will add  the two VPN portals we use  the other will uninstall VPN. The other app win installed asks for a FQDN as part of the setup anyway to software i can use to create a new package 

Trying to figure out a script that can delete all of the Default Keychains - local items - accesstokens. Would appreciate any assistants. Kind of new to scripting.#!/bin/bash# Function to list access tokenslist_access_tokens() {    security find-generic-password -a $USER -s "OAuth Access Token" -g 2>&1 | grep "acct" | cut -d '"' -f 4}# Main functionmain() {    echo "Access Tokens found in Keychain:"    list_access_tokens     echo "Enter the name of the access token you want to remove (or type 'exit' to quit):"    read access_token_name    if [ "$access_token_name" == "exit" ]; then        echo "Exiting..."        exit 0    fi    # Check if the access token exists    if security find-generic-password -a $USER -s "OAuth Access Token" -l "$access_token_name" >/dev/null 2&g

Today we are releasing Jamf Pro 11.5. Highlights include: Enabling LAPS in the Jamf Pro InterfaceFunctionality for the local administrator password solution (LAPS) is available in the Jamf Pro interface. This enhancement allows you to define settings for the managed local administrator accounts configured in user-initiated enrollment settings and PreStage enrollments that were previously available in the Jamf Pro API only. Packages Page RedesignThe Packages settings page has been redesigned with new functionality and an updated layout that matches the design of Jamf Pro 11. In addition to various accessibility improvements including larger font sizes and reduced clutter, the update features a floating progress bar that displays the upload progress of a package and download functionality for previously uploaded packages directly from the Jamf Cloud Distribution Service (JCDS).   For additional information on what's included in this release, review the release notes via the Jamf

So, here's a thing:Have you ever wished your users didn't try to use Migration Assistant? Maybe you have something better (Alectrona Migrator, Druva - that's what I used to use & it was the best...) But, maybe, you just want to stop them. Yes, you can use Restricted Software. But, maybe, for some reason, the internet has led you here & you don't use Jamf, or, you don't want to use Restricted Software. Ta da. #!/bin/sh # write out blocking script /bin/cat << 'EOF' > /opt/blk.migr.asst.sh #!/bin/sh if /usr/bin/pgrep -ail 'Migration Assistant' then /usr/bin/osascript -e "display dialog \\"Migration Assistant is blocked on this computer. Please contact your administrator for help.\\" buttons {\\"OK\\"} default button 1 with title \\"Migration Assistant Blocked\\" with icon file \\"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:AlertStopIcon.icns\\"" /usr/bin/pkill -ail 'Migration Assistant' fi EOF /bin/chmod 755 /opt/blk.migr.asst.sh /usr/sbin/ch

I changed my password via Jamf Connect yesterday, but when the prompt to sync passwords appeared it did not accept my previous password, giving me the "Your local password is incorrect" message. Rebooting showed that I needed my previous password to log in to FV. Once at the desktop, logging into Jamf Connect used my new password but still would not accept the old one when trying to sync passwords. Based on this Jamf Nation thread (https://www.jamf.com/jamf-nation/discussions/35744/jamf-connect-login-with-okta-local-password-issues), I manually changed my local password using the diskutil apfs changePassphrase command. This worked in that my FV password now matches my Jamf Connect password, but after the FV login I now get a Jamf login screen, where the old password is required. When I get to the desktop, Jamf Connect works with the new password as before, but still prompts to sync passwords. I've tried multiple passwords to no avail. As a result, I cannot complete a login to Ja

On 31 May 2024, Jamf will retire the following App Installers software titles from the Jamf App Catalog. Jamf recommends disabling any App Installers deployments for the impacted software titles as they will no longer receive updates after 31 May 2024. For instructions on creating new deployments, see App Installers in the Jamf Pro Documentation.For a complete list of software titles that are available as App Installers, as well as retired software titles, see App Installers Software Titles in the Jamf App Catalog.   Retired Software Title Replacement Software Title Adobe Animate 2022 Adobe Animate 2023 or 2024 Adobe Audition 2022 Adobe Audition 2023 or 2024 Adobe Bridge 2022 Adobe Bridge 2023 or 2024 Adobe Character Animator 2022 Adobe Character Animator 2023 or 2024 Adobe Illustrator 2022 Adobe Illustrator 2023 or 2024 Adobe InCopy 2022 Adobe InCopy 2023 or 2024 Adobe InDesign 2022 Adobe InDesign 2023 or 2024 Adobe Media Encode

We're transitioning over to a new printing system and I need to remove printers on all macOS machines. The printers are all named by site, for example Miami HP 504, Dallas HP 653 etc.  What's a good way to delete the printers in bulk by using the site names? I have a script that works for one site at a time. I don't want to just remove all printers as there may be personal printers installed. 

Does anyone have a solution to limit "User-Initiated Enrollment Process" to specific LDAP groups?

Hello communityI just started to testing prestage enrollment with jamf connect configuration for standard useraccounts (non admin).Enrollment working fine, like our enrollment for the admin user. But we have the behaviour on the macbooks, that the keyboard layout changes to default (ABC) after each restart of the macbook. All keyboard layouts that are not necessary were deleted in the user setup steps (before connecting to wlan). After the MacBook has restarted after on of our policy the keyboard is set to default ABC.Someone has an idea how this can be solved. My problem is, that we have differen offices in different countries with different keyboards, so pushing a configuration will be not as much easy :)THX in advanceBRJ

Hi all. We're testing out Jamf Connect here for an eventual rollout to all our Macs a little later this year. One of the things I'm looking at is the recently added privilege escalation process Jamf added to Connect. It seems to work pretty well, and makes it easy for an end user to ask for temp admin. I have it set to only allow a set number of escalations per month per the documentation. But one question I had was, what happens if a user uses up their monthly allotment, and I decide I'd like to reset the counter for that month for that user or device, or extend an additional privilege escalation to them? It doesn't seem like there's a way to do this. I've been looking for something that tells Jamf Connect that they've used their allotted privilege escalations, either in Jamf Pro or on the device. I suspect since Jamf Connect can be MDM agnostic this is held somewhere within the device itself or within the Jamf Connect application. But I've yet to find any information on how this work

We're currently testing out the Microsoft Enterprise SSO plug-in (without Platform SSO) for macOS and have run into an odd problem.  Everything works perfectly, but if the user opens the Company Portal application it tries to get them to enroll the device into Intune.  This makes for an awkward scenario where the user is guided to download the Intune management config, see it fail to install, and then back out until they can say "Postpone."  Not a great experience, and telling people to just not open the app doesn't really work at scale.  Is there any way to suppress this Intune enrollment prompt from the Company Portal app when we deploy it for the Microsoft Enterprise SSO?   NOTE: We're not currently using Intune for device management outside some testing, and we do not have Device Compliance integration set up just yet. It's on our roadmap, but hasn't been a high priority.  We can probably move it up if it is an assumed prereq for the Microsoft Ent

ok so I have very little knowledge about Jamf Pro.  I am more of a Windows engineer. However we have to support Mac users at work..even though I don't have any access to JAMF PRo.The scenario is that the user is insisting that they didn't change there password but can't logon.They are at home my understanding is that he 100% is tying his password wrong.He thinks the system has somehow changed his password.Is this impossible? 

Anyone else get a very google vibe that Jamfs "Software Updates" workflow is still in beta never mind it's been the "production" solution for OS updates for over 6 months now?      

Background While we're waiting for @NightFlight's Extention Attribute Execution Frequency feature request to be implimented, here's my two cents, which was inspired by @brad's approach for only occasionally capturing the status of a computer's Recovery HD. Approach As one of the first steps of an Extension Attribute script, you pass the name of the Extension Attribute and the desired execution frequency (in days) to a client-side function. A client-side plist stores the epoch and the result. During subsequent inventory updates, if the current epoch is less than the given frequency, it just reads the previous result from the plist instead of executing the entire Extension Attribute script. For example, I have an EA for “Model Name”; how many times do you need to run that Extension Attribute? (Once per quarter? Once per year? Certainly not every time.) Results Early tests show an overall inventory collection that is 1.6x faster, using the following as a gauge before and after:

hi,We use SPARK email software.With APPLE volume purchasing we have deployed the app with JAMF and the APP STORE.When SPARK makes an update and it appears in the App Store, JAMF downloads the update but cannot deploy it on the client workstations because it systematically asks for the workstation's admin code.How can I automate these updates?cordially

What are the ways to manage software updates for non-supervised mobile devices? We have several hundred mobile devices enrolled using the UI method and would like to keep their iOS versions up-to-date. I understand that the "Update iOS Version" remote command only works on ADE/Supervised devices. Is there a way to manage software updates for non-supervised mobile devices?

I am testing a reset local user password Policy in case a user forgets his macbook login password. I see this as a trigger option: "Startup - When a computer starts up. A startup script that checks for policies must be configured in Jamf Pro for this to work"What kind of Startup Script would I need for this policy to take effect? This may come up in the future and would like to have this available for a real situation. OTW, the trigger is Recurring Check-in but it doesn't seem to check-in after I reboot ans wait 15 minutes. I don't believe Recurring Check-In will happen until after the user logs in. This won't help if I can't reset the password through Policy. Any help/advice is always greatly appreciated. 

We have an odd behavior in our environment for some of our machines.  If you try to shutdown/restart using the GUI method - it hangs.  What happens in you see the background and the mouse cursor...and it just stays there.  Screen never goes black and doesn't shutdown/restart.  So because it's stuck you can still SSH into the machine and run commands.  So I wrote a script to kill processes to try to figure out which process might be hung.  While I didn't figure out which process is causing this I did learn that if you kill the following processes(AppleUserHIDDrivers, IOUserBluetoothSerialDriver, IOUserDockChannelSerial) four times it will kernel panic your machine.  Tweaked the script to avoid processes that will kill the remote session...but it doesn't seem any process I kill causes it to move forward and shutdown/reboot. Anyone experience anything like this?        

 We have a user who's time zone is set wrong..if we try to change it we can't as it is greyed out."This setting has been configured by a profile"I assume this is a JAMF Profile?

Hi, just trialing Jamf Protect alongside our subscription of Jamf Pro and have linked the two together via API Client and imported the Default Plan and added my laptop to the scope, but it doesn't appear to have actually installed Jamf Protect. What am I missing/doing wrong?I also note that I cannot select the option Automatically deploy the Jamf Protect PKG with plans option under Jamf Pro > Settings > Jamf Apps > Jamf Protect.

I would like to know if JAMF Pro supports "Privileged identity management (PIM)".   After logging into the Jamf Admin website, we would like to require our IT users to PIM before doing certain actions.  For example, before viewing a FileVault Recover Key. I know that in Microsoft Azure console/webpage, our company requests us to PIM before doing "admin" task.

Is it possible to use a pre-downloaded version of Sonoma and install it for standard users by using Nudge?My workflow at the moment is I am using Nudge without the erase and install script, because I am using a policy I run beforehand with only a single command line to fetch full installer in the processes and files tab. Nudge then opens system settings -> softwareupdate, but it looks like it is re-downloading even though there is a 'install macOS Sonoma' in the applications folder. Maybe I am missing something. I have watched several videos and read thru the wikis for Nudge and the erase and install script, but I can't find anything saying for sure there is way to do this for standard users.

We are going all online for the ACT this year and we have to use Pearson's TestNav app in order for the students to test on their school-issued Macbook Airs. They are running MacOS Ventura (or Sonoma for those who upgraded before we had the chance to block updates).The TestNav documentation says that we need to disable all of the notifications for the students while they're taking tests. I haven't been able to find a reliable way to do this. I found some scripts but they may be outdated because they keep throwing errors. Does anyone have a solution to this? I need to send a command through Jamf Pro to all of the student Macbooks to turn off notifications before the test then send another command to re-enable them after the test. Would forcing them into Focus mode do the trick?Here's the script I found. I modified it slightly by replacing "unload" with "bootout" using the syntax I found here:https://joelsenders.wordpress.com/2019/03/14/dear-launchctl-were-all-using-you-wrong/Both old an

I recently had to configure Zscaler for my environment and I figured I would share incase it helps anyone.Prior to 3.9 Zscaler was configured with a script, the JAMF documentation is eh and the got the script they provide from someones GitHub repo.[Guide] Zscaler Client Connector Deployment with JAMF Pro for MacOS - Connectors / Client Connector - ZenithWith 3.9 Zscaler is now configured with a configuration profile, which at the time of writing is documented for intune and not JAMF. Zscaler has advised they will update their JAMF Documentation, but as of 6 weeks and they still have not updated their documentation. The intune docuemtantation is simple enough to use with JAMF. Deploying Zscaler Client Connector with Microsoft Intune for macOS | ZscalerThe Zscaler app can be provided in 2 ways. The non-managed app which will not respect any configuration profiles, and a deployable .pkg which is what you want to use. Build the policy to deploy the package as usual, nothing screw

How to stop all adobe products when installing a new version of adobe 2019