I'm trying to configure Jamf Pro to enforce the company requirement that devices are encrypted. Created a Configuration Profile that has Security and Privacy > FileValut > Enable FileVault enabled, but have also set Event to prompt FileVault enablement > At Login and Allow user to bypass FileVault prompts at login > Require after 3 attempts. However, when testing the Configuration Profile against my MacBook - which has FileVault turned off - I am not being prompted to enable FileVault.I have repeatedly logged out/in, shutdown/started my laptop but at no time have I been prompted to enable FileVault. While my user account is a Standard user, I have tried logging in as the Admin user but still don't get prompted to enable FileVault.What am I missing?

Hello, My organization is deploying a new WiFi system/SSID. I created a configuration profile with the certificate payload and the WiFi payload. I am having trouble configuring it to connect to our SSID. The issue I am running into is that the device connect successfully the very first time, but every time the device tries to reconnect to the Wifi, it just hangs and is unable to connect. We do not want to use the "Use Per-Connection Password" option, since that requires that credentials be entered every single time the device reconnects to the SSID. We want it setup where the user has to put in their username/password credentials, but just once. I've gotten set up where they have to enter it in every time, but we want to avoid that since our devices are usually assigned to a specific person. We are using PEAP authentication with AD accounts. I am using the $USERNAME variable for the username field. Any help would be appreciated.

Hello Jamf experts, We have a weird issue that just started occurring which we're not sure if it's because of a recent update to our Jamf Cloud instance because we hadn't added new Macs over the past few months. Anyway, we have a Configuration Profile that generates and deploys a SCEP certificate along with the Wi-Fi profile that uses the certificate. All's been well until recently when we provisioned a new Macbook Pro and it just refuses to install any Configuration Profile at all (we check in the Macbook's History > Policy Logs page in Jamf). After a lot of troubleshooting which included a check on the firewall to see if anything is being blocked (there isn't) we stumbled upon the fact that when the SCEP is applied, the Macbook immediately switches to and connects to that Wi-Fi and then it fails to proceed. When I exclude the deployment of SCEP, everything works as before. Now the question is, how can I make it so that the SCEP is deployed last? I know we can d

Hi community!I need some advice regarding software installation by policy.As useres are allowed to administer their device, they also are able to uninstall packages.How can I assure, that if a software is unsinstalled, the policy will run again and reinstall it?I'm worrying if I set a policy to Ongoing or Once a day, the software will be tried to install no matter if it's present or not.

We currently don't allow end users to use iCloud. When a user gets a new phone, we use verizon content transfer to transfer the users info to the new phone. It hasn't been working great lately. Just wondering if anyone has any recommendations. Thanks.

Jamf Pro 11.2 introduces dark mode, a manual update option for App Installers, and Jamf Remote Assist session logs. Be sure to check out the Jamf Pro release notes for all of the exciting new features and enhancements.   Thank you for your continued support and feedback!

Hi,I am trying to install Snapgene, which requires the license install script to be executed as the logged in user as described here: https://support.snapgene.com/hc/en-us/articles/10304162065172-Command-Line-Installation-and-ActivationMy first attempt was simply to index using Composer, install Snapgene, execute script, build package with composer. Didn't work.When I execute the script locally everything works as expected, whoever as soon as I try to deploy it using Jamf Pro it won't. I then tried to follow https://scriptingosx.com/2020/08/running-a-command-as-another-user/ to no avail. The license won't be installed. Is there another way, I'm not aware of, which would execute the script locally so everything works as expected?

Hello!What is everyone's take on recommended execution frequency for app updates such as Google Chrome when using installomator?I see everywhere online states to do Recurring check-in as a trigger and execution frequency as ongoing. Wouldn't it make more sense to set the frequency to something like once a week?  That way logs aren't being flooded constantly by installomator reporting the app is already up to date?

Just for better understanding:I have a configuration policy run on user level for Outlook configuration.But I only want it to run on DEP enrolled devices (Smart Computer Group "Enrollment").How would I assign the policy?Will it run if assigned to the computer group and left "Specific Users" without configuration?If I assign it to the computer group an d "All users" it is assigned to all devices, which shouldn't happen!

Hi Guys, anybody can help me to go-through the AutoPKG.How it's work and step-by-step process to create packages and deployment to target machines.

Leverage a client-side LaunchDaemon, script and .plist trio to determine computer health, based on the Mac’s ability to execute an inventory update policy Background In the spring of 2022, I renewed my Utah’s driver license and noted it wouldn’t expire for six years. When I obtained my Ohio’s driver license last Halloween, I was tickled with the option for an eight-year expiration: “Yes, please!” When I enrolled a Mac in our Dev lane yesterday, I was also pleased that its Jamf Pro-related certificates won’t expire for more than three years. (Although, by the time you’re reading this, that box has probably already been nuked-and-paved. Thrice.) If we base a Mac’s compliance solely on the presence of valid MDM certificates, we’re probably allowing too many computers access to sensitive data However, if at next week’s traffic stop the police officer simply confirmed I had a valid driver’s license and sent me on my way with a warning to “slow down” — never double-checking what I’ve actu

Hi,I'm currently experiencing an issue regarding pushing out ibooks to our student iPads. Out of the 400 students we pushed the books out to, only 30 have received them. I'm aware that books can only be distributed to Apple IDs and all students have MAIDs created in ASM and synced over to jamf school, and the ibook licences were purchased in ASM.Looking at the users where the process failed, the status for each student reads, 'The VPP user can not be found, please try to invite the user again'. However, looking at each students' profile, their service token status reads as associated and valid.As a side note, some staff members are having the same issue. Other staff members are having different error messages which reads one of the following:'Device owner is not associated, current status is Registered. Service token status: Invitation sent''The device’s user has not been sent a volume purchasing user registration invitation. Service token status: Associated'Any help regarding these is

I've been using a script I found on Jamf nation to remove student profiles. I've been using it for over year and never had issues until recently. What's strange is it works fine on some devices (Ventura and sonoma), but on some devices it doesn't work at all. The problem devices do not have file vault enabled. They are all supervised and managed.Here's what I'm using#!/bin/bash # Get a list of all user accounts user_list=$(dscl . -list /Users | grep -v '^_') # Specify the admin account(s) that you want to exclude excluded_users=("root" "account1" "account2" "account3" "account4" "account4" "account5") # Loop through the user list and delete user profiles except admin accounts for user in $user_list; do if [[ ! " ${excluded_users[@]} " =~ " ${user} " ]]; then if [[ "$user" != "Shared" ]]; then # Exclude 'Shared' user echo "Deleting user profile for: $user" sudo dscl . -delete "/Users/$user" sudo rm -rf "/Users/$user" fi f

I've been working on improving our Jamf Self Service and how we offer applications to our users and set up their initial computer.Some of our users have had their machines migrated to Jamf from other MDMs or they were set up before we had some of our current Jamf practices in place. This means that even though someone may have Office installed on their computer, they will still see those individual apps for Word, Excel, etc in their Self Service store and they are available for installation.Is there any way to change this other than having them uninstall and reinstall using the self service applications? I'd like to find a way for these previously installed apps to be "recognized" by Jamf so they don't allow people to install a second copy over top of them. I'm worried someone is going to click install on one of these and it's going to break their app because of conflicting versions or editions.

We have been using Oomnitza to pull inventory records from Jamf for a while. Unfortunately it seems like this stopped working suddenly when we upgraded to Jamf 11. We have tried the following: 1. Enabling the user to have the SSO edit option. 2. Creating a new user specific for this. 3. Creating a full permission user to access the integration. 4. Changing the password for the integration user. nothing seems to be working. Is there an API change with Jamf 11? 

I passed the exam and received my badge, work is looking for a paper certificate. How long if at all does a cert show up on your profile so you can print it out.

I am having trouble figuring out the ideal way to accomplish this goal:   Our campuses use UDP addresses to launch video announcements streams through VLC player. Up until now we had been putting bookmarks in Jamf Self-service with the udp address to pretty good results, but management wants to for us to deploy desktop shortcuts to achieve the same thing.    A shell script like below would accomplish the goal, but we have terminal.app locked out to all end-users.   #!/bin/bashopen "udp://@192.168.0.1:1234"   I could make an .app to run that command through Automator, drop it in the /Applications folder or another directory, and have a script use the "ln" command to make an alias on the user's desktop, but is there not something similar to .webloc that could be used for a UDP address that's an all-in-one type solution?    I feel like there is a very simple solution to this staring me in the face but I am being unintentionally obtuse.... help?

Hello! We've been using Installomator for automatically installing and updating some apps. It has been working well for us so far. One thing I was curious about is if there is a way for Installomator to write to the plist file of the app that it is working on. From what I could tell thru their github, I don't think there is and currently I am planning to just use config profiles to manage the plist files. But if there's a better way or if I could do it using the same Installomator script that would be nice.For context, the apps in question are Firefox, Chrome, and Zoom.Any advice would be appreciated or if anyone would be willing to give me some insight on how they do it.Thanks!-Frank S.

Hi Everyone. I'm running into an interesting issue (maybe?) with Jamf Connect and Ventura. I have my workflow setup and it is deploying correctly to my test machine. After initial login, the local and IdP account mapping/creation works and everything else seems fine. What's interesting is when I reboot my laptop: I get the local account login which accepts my IdP credentials, then it takes me to the Jamf Connect login screen where I have to sign into my IdP account twice (Once to log in and then second time to verify the password). It's like I have to unlock locally before Jamf Connect can take over. Has anyone run into this issue? I feel like I'm missing something simple...FWIW:I have my login agent delivered through the Jamf-provided pkg, not via config profile.The laptop in question has Jamf Connect deployed via workflow, not PreStage Enrollment.

Hi all,We've had a few users in our org come to the Help Desk that have Macs signed in to iCloud with a MAID – these users are also automatically signed in to the App Store by default with their MAID as well. Pretty sure this is expected behavior of macOS. The problem, however, is that when a user is signed in to the MAS with a MAID, there is no option to sign out. I don't know why this is, but I certainly understand how and why it can be frustrating.That said, I've created a script that takes care of it. The TLDR is that it does the following, in order:Downloads and installs Homebrew.Installs the mas/mas-cli binary.Runs the "mas signout" commandScript ends.Apologies for not at all understanding how Github works, but here's a link to the script: https://github.com/teezyyoxo/choate-scripts/blob/main/MASbrewpls.shI welcome any feedback as I am only still learning :)Last tested this on an 14" MacBook Pro (M3 Pro) about two weeks ago and it worked with no incident.Hope it he

Hi All,I've seen several older posts in the community regarding this issue:Running through setup assist, creating a computer account results in failure with the standard " account could not be created with name and password" message. Has anyone come up with a solid workaround or fix for this? Things I've tried per community recommendations:- Removing any configuration profiles involving password policy, filevault, lockscreen. (currently have 0 config profiles)-Toggle on/off Location Services & Information Transfer in General/Setup Assistant Options- Creating a local administrator account before setup assistant (undesirable for workflow, but tried anyway) Any other tips or tricks I can try?New Jamf Admin, so apologies for any ignorance.

Hey Guys,One of my users recently changed his password on JAMF Connect. We are currently syncing all our passwords with Azure AAD. No issues with resetting it with Azure but when prompted to change his password for the local user (to match with his AAD) he unfortunately forgot the password. The user now is logged out from his device.Is there a way to reset the Local Password for the user from an Admin perspective? so that it can match with the AAD one?Or if we can simply remove the disk encryption (FileVault) in order to recover some data folders from the user profile?Thank You

Hello Jamf Community, I previously posted this a couple weeks ago but still am struggling to figure out exactly how to get it working. I am trying to create a script that will prompt a user with a popup box on which application they'd like to uninstall (only apps we deem approved). For example, a popup would come up and ask someone "Select an app you'd like to uninstall" with a list of apps such as, Google Chrome, Firefox, Adobe, etc. Currently I have script that I feel is about 90% of the way there but still can't figure out how to get it completely working. I'll post it below. Also, if there's any easier way to do this, please do let me know as well! Any help is greatly appreciated! There may be some unnecessary lines in the script just FYI. Here's the script: #!/bin/bash # Parameters app1="$4" app2="$5" app3="$6" app4="$7" app5="$8" appList="$4 $5 $6 $7 $8" uninstallApp="choose from list every paragraph of \\"$appList\\" with title \\"Application Uni

Dark mode is live and its epic!Nice job devs!

Hi all,   It took a week or two, but I've finally figured this app out. I was inspired by this old thread, and kept hitting a brick wall when it came to using my own photos. So the TLDR, I: Can confirm that the app reads both PNG and JPG/JPEG files Can confirm that the  Set up a basic HTTPS server in IIS on a Win11 virtual machine that is always online Worked with my NetAdmin to get a fully signed SSL certificate – this is required as all testing prior to this point resulted in failure. A self-signed cert WILL NOT work (confirmed). Set the MIME type for .csv to text/plain. Unsure if this is actually necessary, but the demo .csv opens in a browser like any other text file does – mine kept downloading by default at first. Opens like the demo file after changing the MIME type. The point of my troubleshooting was to try and mimic the demo configuration as closely as possible to avoid inconsistencies. Added my Playlist.csv and photos to the site's wwwroot. Double check