I found this script for deleting accounts below which works a treat.However I work expect after a inventory update for Local User Accounts section in device record to be cleard also. But it still showing the delete accounts. Is there something I can add to the script or do to ensure this part of the device record get reset.# Get a list of all user accountsuser_list=$(dscl . -list /Users | grep -v '^_')# Specify the admin account(s) that you want to excludeexcluded_users=("admin1" "admin2" "root" "management account")# Loop through the user list and delete user profiles except admin accountsfor user in $user_list; doif [[ ! " ${excluded_users[@]} " =~ " ${user} " ]]; thenif [[ "$user" != "Shared" ]]; then # Exclude 'Shared' userecho "Deleting user profile for: $user"sudo sysadminctl -deleteUser "/Users/$user"sudo rm -rf "/Users/$user"fifidone

I'm working in a K-12 environment and we restrict certain apps on student laptops, such as Music, News, Stocks, Messages, Home, TV, etc.This is being managed through a Configuration Profile, rather than in Restricted Software.While this works for blocking those apps from launching, we're experiencing pop-ups informing the users that they don't have permissions to run app extensions within these apps when those extensions run on their own.Examples include: NewsToday2, MailCacheDelete, MusicCacheExtension, TVCacheExtension,MessagesCacheExtension, HomeExtensionAny idea on how to disable these intermittent pop-ups? Devices are 2020 M1 MacBook Airs, running on 13.4. 

I am not having problems finding the JAMF Tools, but I am having an issue with providing administrative access to someone on my team.  They can login to the account.jamf.com but it doesn't show them as part of our organization. It shows they need to join an organization.

Does anyone have a way to restore defaults for keyboard and screenshot shortcuts? I perform a method that can be placed in self-service, but I am open to all possible solutions. We have testing software that changes the defaults to both of these areas, and upon exiting the testing software, the defaults are not restored. macOS version 13.6.1 and higher. 

Hi,Our fleet has just jumped from Catalina to Monterey and our users are struggling to locate the screen mirroring "Show in menu Bar" tickbox.  Ideally I would just like a script to enable this or our users. I have trieddefaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist ScreenMirroring -int 18but it doesn't seem to work.weirdly sound and bluetooth work though which are controlled inside the same plist. e.g: defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Sound -int 18anyone got any ideas how the ScreenMirroring preference can be set via terminal script? Cheers, ES

Hi folks, I just wanted to share a restart method I've written that can be easily embedded into any bash script. It leverages CocoaDialog (you'll need to change the path variable for your installation location) to create a countdown progress bar and forks a restart script via a launchdaemon, so you can include it at the end of a JSS policy and the policy will be able to complete and upload policy logs to the JSS. I prefer this over other methods of initiating restarts because the timing can be precisely controlled and it provides a better UI for the user. Hopefully some of you find this useful or it sparks some ideas. This method of echoing a script and launchdaemon to the /tmp folder has many other uses, allowing you to fork scripts/launchdaemons for one-time use which will disappear on reboot without needing to package anything. #!/bin/bash cocoaDialogPath="/etc/CocoaDialog/CocoaDialog.app/Contents/MacOS/CocoaDialog" rebootSeconds=300 restartTitle="Software Update Completed"

DO we have any option to enable the SSO using the kerberos jamf auto login with mindmanager application ? we have user based licence and just want to automate to login with there email ID SSo to be enabled when user open the application it should authenticate and login auto or atlease ask the password for the user account ?looking for the document and steps

There's been a bit of chatter in the Jamf community regarding the deprecation notice that would remove the ability to set a static password for the PreStage local admin account and how it relates to LAPS.  We hear your feedback and this deprecation is on hold.   Admins will continue to have the ability to set a static password for the PreStage account Workflows that require a static password for the PreStage account will remain unaffected LAPS will not be on by default for the PreStage account More information to follow in an upcoming blog post.  

Dear Team, Our organization have 80+ bounded devices, those devices need to be migrated to jamf without losing user data.if any have steps to perform, pls share the steps follow.

I am completely new to Jamf pro and I need to set up 30 iMacs for a music suite. I did get help in setting up the prestage enrollment settings and successfully set up a Mac with auto-enrollment. The issue is that I can't remember what I set the local administrator account password as, under 'Account Settings; in the prestage enrollments section. So I have now changed this but it isn't reflecting through on the Mac.  Would I need to wipe the Mac or remove it from MDM and add it again for the local administrator account to be added?  Thanks

I had some questions about the JC login page. It seems inconsistent in when it is shown. This is causing some issues when we are doing onboarding as some people see the JC login screen and some people see the local login page. I see it consistently immediately after logging out, but if i logout then shutdown and go to login again I am only presented with the local login screen

We’ve started seeing messages on students iPads in the classroom settings pane that „teacher and student certificates have expired“ and that classes cannot be joined. No idea where those certificates come from though. Any suggestions? TIA

Ok, I resisted posting this for a while, but I've finally given up and am throwing in the towel, in the hopes that someone who is/has experienced what I'm facing found a solution.As part of our hardening process, we follow many of the recommendations provided in the CIS Benchmark guides. One of them is the subject of this title - enabling the "Require an administrator password to access system-wide preferences" checkbox under the Advanced section of Security & Privacy. The CIS guide, even the current ones, recommend using a scripted method, something like/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist /usr/bin/defaults write /tmp/system.preferences.plist shared -bool false /usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plistI was using this all throughout macOS Catalina and Big Sur, and even, I think for earlier versions of Monterey. But somewhere along the line, this just stopped working. I can

I've been working on creation of a .mobileconfig to sign and upload as Configuration Profile in order to manage a few settings that I typically manage with a script.One in particular is the <key>com.apple.keyboard.fnState</key> that is in .GlobalPreferences. This is a boolean key that either toggles the Keyboard > Keyboard Shortcuts > Function Keys setting on or off:(this makes it easier to send a particular few Apple Scripts via Remote Desktop in the classroom). This is a setting that I easily can set with a defaults write script, which works well. Still, I'm using this as a gateway to try to figure out how to better manage some other settings that may be useful in configuring classrooms.There are many settings that I've been able to configure by uploading custom XML, and many others that I haven't had success with. Now, I'm attempting to use the older mcxtoprofile python script by timsutton. In the README, I started to learn more about use of "always" vs "

I’m having a strange issue that started within the last week or so. Some laptops are not receiving some configuration profiles. Two profiles in particular (maybe more but this is the first I have noticed), and not every laptop is affected. One is for Jamf Connect. It’s an uploaded profile straight from the Jamf Connect Configuration app. The other is for the Root3 support app.I have tried different versions of each profile, one using the built-in Jamf Connect schemas and one with the upload. I have tried the same with the Root3 app, one using their JSON schema and one with the plist.Neither will push down to some devices. Hardware doesn’t make a difference, and neither does os. It’s happening on Monterey and Big Sur, and intel or Apple processors.I am at a loss. Logs for both say failed on the device inventory page and pending on the profile pages.We’re on Jamf Pro Cloud.Is anyone else having issues?

I have no doubt that this has been discussed before but I can't seem to find any discussions relevant to my scenario. In the event that a user locks themselves out from their machine, how can I push a policy to reset the local account password or even create a new account when the user is unable to login and the administrator is unable to get hands on the machine?

In the past we've had something way back that I could use to set the screen resolution of a Mac Mini that was connected to a VGA splitter so I could run it to the local monitor and the projector. The Mac couldn't really tell what was attached to it and set the resolution higher than the projector could handle. A login policy with the script worked great. I haven't used it in a while, but the issue I have now is a bit different. I have an iMac at the teaching station now, and it connects to the projector with the dongle out the back. By default the displays don't mirror, and again may not set the correct resolution for the projectors display. Is there something new I'm missing that I can use to set both mirroring and then both display resolutions properly with a login policy? The settings stick for a user once they set it, but it's per user so it has to happen at each login. There has never been a command line option just built into the OS for this (to my

Hello guys, we have users where the Network AD password gets out of sync with the mac when the user changes the password every 3 months or so. We have a Self Service action that updates their network password with their mac log-in password however users do not use that very often. The macs are file vaulted, how do you guys sync the network passwords with the mac log-in passwords? Is there an easier way to do that? 

ok so I am trying to make our device enrollment as seemless as possible for our workstations guys but I am not certain what the best possible options are. Does anyone have experience with pre-stage enrollment? Trying to make this as white glove as possible and its frustrating because I know there is a better way than what we have going I just dont know enough about the configuration options for the platform to be able to maker the changes we need. Any tips or pointers would be greatly appreciated.

Hi there,I'm working on a script to wipe out student mobile accounts from our lab machines.These machines are AD-bound, provisioning options are set to create mobile account at login with no confirmation.Here's the script I'm running. As you can see, very simple because all our student accounts contain the "." character (e.g. john.doe) -- # list all users with the "." character in their namesUSERS=$( dscl . ls /Users | grep -e "\." )# echo usersecho Deleting the following users: $USERS# delete users/usr/bin/dscl . delete /Users/"$USERS"echo User accounts deleted# delete home folders/bin/rm -rf /Users/"$USERS"echo User home folders deleted The script successfully removes my test student account, but then I'm unable to re-add the student to the device from the login screen after a reboot, which will prevent students from being able to use the computers.Any ideas where I could get more information on what is broken?Alternatively, if there's a smarter way I should be doing this, I'm also o

With the software updates that JAMF has implemented does this help install the latest iOS updates for all devices and bypass the users lockscreen code? 

Hello Jamf Nation! Jamf Pro 11.3.0 Beta is now available. We have many new features and refinements available, including Computer Users UI Update for Laps and ADDE for Computers. Please view the release notes for further information. How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Forum, click "Join this group Hub" to gain access. Email beta@jamf.com with questions. The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!

I have to ask why are we removing this ability, Im the IT guy who wears multiple hats at work, the support person, the server guy and the network guy. Removing the ability for IT admins to set a Prestage Admin account and password is just going to create headaches for the EDU IT admin. I dont think it should be forced on every one and would work better if it was a toggle switch that you can enable or opt into. https://learn.jamf.com/bundle/jamf-pro-release-notes-current/page/Deprecations_and_Removals.htmlFunctionality to specify the local administrator account for computers in a PreStage enrollment—In an upcoming release, the ability to specify or modify a local administrator account password in a PreStage enrollment for computers will be removed from Jamf Pro (estimated removal date: March 2024). 

I'm trying to configure Jamf Pro to enforce the company requirement that devices are encrypted. Created a Configuration Profile that has Security and Privacy > FileValut > Enable FileVault enabled, but have also set Event to prompt FileVault enablement > At Login and Allow user to bypass FileVault prompts at login > Require after 3 attempts. However, when testing the Configuration Profile against my MacBook - which has FileVault turned off - I am not being prompted to enable FileVault.I have repeatedly logged out/in, shutdown/started my laptop but at no time have I been prompted to enable FileVault. While my user account is a Standard user, I have tried logging in as the Admin user but still don't get prompted to enable FileVault.What am I missing?

Hello, My organization is deploying a new WiFi system/SSID. I created a configuration profile with the certificate payload and the WiFi payload. I am having trouble configuring it to connect to our SSID. The issue I am running into is that the device connect successfully the very first time, but every time the device tries to reconnect to the Wifi, it just hangs and is unable to connect. We do not want to use the "Use Per-Connection Password" option, since that requires that credentials be entered every single time the device reconnects to the SSID. We want it setup where the user has to put in their username/password credentials, but just once. I've gotten set up where they have to enter it in every time, but we want to avoid that since our devices are usually assigned to a specific person. We are using PEAP authentication with AD accounts. I am using the $USERNAME variable for the username field. Any help would be appreciated.