Hey folks!I've been setting up LAPS for my organization and we've hit a little snag. We can't enter the LAPS password into administrative prompts until after we log into the account for the first time, then it forces a password reset. Afterwards we can use what we set as the password and it'll work. Does anyone have any ideas on what could be going on?

Hello Everyone,        We have started rolling out JAMF Teacher in our district and have run into an issue with iCloud Drive.  We are using JAMF Pro to manage if that helps.  The original issue was each time a teacher would use JAMF Teacher to restrict Apps, it would disable iCloud Drive and Notability, which we use heavily in our district, would lose all its synched notes.  We restrict the ability for the students to manage their Apple ID and see the iCloud settings through Configuration Policies, and when JAMF Teacher restrictions were removed, it would not turn iCloud Drive back on.  We discovered that adding iCloud Drive to the safe-list of JAMF Teacher Apps that could not be removed helped but we are still seeing this same issue on a handful of iPads each day.  The solution is to remove the Configuration Policy and go into iCloud and it automatically turns everything back on as soon as we go into the Settings.  Is anyone else

Hi, I'm trying to upgrade Cisco Client from 5.1.1.42 to 5.1.3.62 and seem to be having some issues.  I followed the below article with no luck.  When deploying the policy via Jamf, it will failhttps://support.umbrella.com/hc/en-us/articles/23515921165844-How-to-deploy-Cisco-Secure-Client-via-JAMF-MacOSI also followed the below and can get the client to install if I double click on package on my test device, but when I upload it to Jamf, the policy is stuck on pending.https://community.jamf.com/t5/jamf-pro/build-a-package-for-cisco-secure-client-5-replacing-umbrella/m-p/308231Anybody had any luck in upgrading?Thanks

I am in the process of testing the privilege elevation feature in Jamf Connect 2.34.0. Everything seems to be working well, except I am noticing that after a period of time if I attempt to elevate nothing happens. If I run the command :sudo defaults delete com.jamf.connect.state TimeTamperingDetectedI am able to elevate again. So it appears something is incorrectly triggering the timetamperingdetected and preventing me from elevating again. The configuration is set to 40 elevations/month for my testing, but I'm wondering if there is an issue with this setting and I should just remove it entirely? Has anyone else had any issues with this?

My organization uses Duo and we use their Mac Login app. I frequently have to reinstall it following macOS updates and find this to be a hassle.Is this how it is with all MFA solutions that are installed in macOS? I only have experience with Duo and would appreciate it if others would share their experiences and recommendations if they have an MFA solution that doesn't require as much maintenance following macOS updates.

has anyone setup through a policy  the installation of the PaperCut Print Deploy Client.pkg  to a lab of computers and had the printer successfully install on the Macs?

I have some apps that need a to run a scrip after the install and have been unable to figure out how to trigger them to run after the install of the App or how to show up in Self service.  one of the App's is VPN client and the script will add  the two VPN portals we use  the other will uninstall VPN. The other app win installed asks for a FQDN as part of the setup anyway to software i can use to create a new package 

Trying to figure out a script that can delete all of the Default Keychains - local items - accesstokens. Would appreciate any assistants. Kind of new to scripting.#!/bin/bash# Function to list access tokenslist_access_tokens() {    security find-generic-password -a $USER -s "OAuth Access Token" -g 2>&1 | grep "acct" | cut -d '"' -f 4}# Main functionmain() {    echo "Access Tokens found in Keychain:"    list_access_tokens     echo "Enter the name of the access token you want to remove (or type 'exit' to quit):"    read access_token_name    if [ "$access_token_name" == "exit" ]; then        echo "Exiting..."        exit 0    fi    # Check if the access token exists    if security find-generic-password -a $USER -s "OAuth Access Token" -l "$access_token_name" >/dev/null 2&g

Today we are releasing Jamf Pro 11.5. Highlights include: Enabling LAPS in the Jamf Pro InterfaceFunctionality for the local administrator password solution (LAPS) is available in the Jamf Pro interface. This enhancement allows you to define settings for the managed local administrator accounts configured in user-initiated enrollment settings and PreStage enrollments that were previously available in the Jamf Pro API only. Packages Page RedesignThe Packages settings page has been redesigned with new functionality and an updated layout that matches the design of Jamf Pro 11. In addition to various accessibility improvements including larger font sizes and reduced clutter, the update features a floating progress bar that displays the upload progress of a package and download functionality for previously uploaded packages directly from the Jamf Cloud Distribution Service (JCDS).   For additional information on what's included in this release, review the release notes via the Jamf

So, here's a thing:Have you ever wished your users didn't try to use Migration Assistant? Maybe you have something better (Alectrona Migrator, Druva - that's what I used to use & it was the best...) But, maybe, you just want to stop them. Yes, you can use Restricted Software. But, maybe, for some reason, the internet has led you here & you don't use Jamf, or, you don't want to use Restricted Software. Ta da. #!/bin/sh # write out blocking script /bin/cat << 'EOF' > /opt/blk.migr.asst.sh #!/bin/sh if /usr/bin/pgrep -ail 'Migration Assistant' then /usr/bin/osascript -e "display dialog \\"Migration Assistant is blocked on this computer. Please contact your administrator for help.\\" buttons {\\"OK\\"} default button 1 with title \\"Migration Assistant Blocked\\" with icon file \\"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:AlertStopIcon.icns\\"" /usr/bin/pkill -ail 'Migration Assistant' fi EOF /bin/chmod 755 /opt/blk.migr.asst.sh /usr/sbin/ch

I changed my password via Jamf Connect yesterday, but when the prompt to sync passwords appeared it did not accept my previous password, giving me the "Your local password is incorrect" message. Rebooting showed that I needed my previous password to log in to FV. Once at the desktop, logging into Jamf Connect used my new password but still would not accept the old one when trying to sync passwords. Based on this Jamf Nation thread (https://www.jamf.com/jamf-nation/discussions/35744/jamf-connect-login-with-okta-local-password-issues), I manually changed my local password using the diskutil apfs changePassphrase command. This worked in that my FV password now matches my Jamf Connect password, but after the FV login I now get a Jamf login screen, where the old password is required. When I get to the desktop, Jamf Connect works with the new password as before, but still prompts to sync passwords. I've tried multiple passwords to no avail. As a result, I cannot complete a login to Ja

On 31 May 2024, Jamf will retire the following App Installers software titles from the Jamf App Catalog. Jamf recommends disabling any App Installers deployments for the impacted software titles as they will no longer receive updates after 31 May 2024. For instructions on creating new deployments, see App Installers in the Jamf Pro Documentation.For a complete list of software titles that are available as App Installers, as well as retired software titles, see App Installers Software Titles in the Jamf App Catalog.   Retired Software Title Replacement Software Title Adobe Animate 2022 Adobe Animate 2023 or 2024 Adobe Audition 2022 Adobe Audition 2023 or 2024 Adobe Bridge 2022 Adobe Bridge 2023 or 2024 Adobe Character Animator 2022 Adobe Character Animator 2023 or 2024 Adobe Illustrator 2022 Adobe Illustrator 2023 or 2024 Adobe InCopy 2022 Adobe InCopy 2023 or 2024 Adobe InDesign 2022 Adobe InDesign 2023 or 2024 Adobe Media Encode

We're transitioning over to a new printing system and I need to remove printers on all macOS machines. The printers are all named by site, for example Miami HP 504, Dallas HP 653 etc.  What's a good way to delete the printers in bulk by using the site names? I have a script that works for one site at a time. I don't want to just remove all printers as there may be personal printers installed. 

Does anyone have a solution to limit "User-Initiated Enrollment Process" to specific LDAP groups?

Hello communityI just started to testing prestage enrollment with jamf connect configuration for standard useraccounts (non admin).Enrollment working fine, like our enrollment for the admin user. But we have the behaviour on the macbooks, that the keyboard layout changes to default (ABC) after each restart of the macbook. All keyboard layouts that are not necessary were deleted in the user setup steps (before connecting to wlan). After the MacBook has restarted after on of our policy the keyboard is set to default ABC.Someone has an idea how this can be solved. My problem is, that we have differen offices in different countries with different keyboards, so pushing a configuration will be not as much easy :)THX in advanceBRJ

Hi all. We're testing out Jamf Connect here for an eventual rollout to all our Macs a little later this year. One of the things I'm looking at is the recently added privilege escalation process Jamf added to Connect. It seems to work pretty well, and makes it easy for an end user to ask for temp admin. I have it set to only allow a set number of escalations per month per the documentation. But one question I had was, what happens if a user uses up their monthly allotment, and I decide I'd like to reset the counter for that month for that user or device, or extend an additional privilege escalation to them? It doesn't seem like there's a way to do this. I've been looking for something that tells Jamf Connect that they've used their allotted privilege escalations, either in Jamf Pro or on the device. I suspect since Jamf Connect can be MDM agnostic this is held somewhere within the device itself or within the Jamf Connect application. But I've yet to find any information on how this work

We're currently testing out the Microsoft Enterprise SSO plug-in (without Platform SSO) for macOS and have run into an odd problem.  Everything works perfectly, but if the user opens the Company Portal application it tries to get them to enroll the device into Intune.  This makes for an awkward scenario where the user is guided to download the Intune management config, see it fail to install, and then back out until they can say "Postpone."  Not a great experience, and telling people to just not open the app doesn't really work at scale.  Is there any way to suppress this Intune enrollment prompt from the Company Portal app when we deploy it for the Microsoft Enterprise SSO?   NOTE: We're not currently using Intune for device management outside some testing, and we do not have Device Compliance integration set up just yet. It's on our roadmap, but hasn't been a high priority.  We can probably move it up if it is an assumed prereq for the Microsoft Ent

ok so I have very little knowledge about Jamf Pro.  I am more of a Windows engineer. However we have to support Mac users at work..even though I don't have any access to JAMF PRo.The scenario is that the user is insisting that they didn't change there password but can't logon.They are at home my understanding is that he 100% is tying his password wrong.He thinks the system has somehow changed his password.Is this impossible? 

Anyone else get a very google vibe that Jamfs "Software Updates" workflow is still in beta never mind it's been the "production" solution for OS updates for over 6 months now?      

Background While we're waiting for @NightFlight's Extention Attribute Execution Frequency feature request to be implimented, here's my two cents, which was inspired by @brad's approach for only occasionally capturing the status of a computer's Recovery HD. Approach As one of the first steps of an Extension Attribute script, you pass the name of the Extension Attribute and the desired execution frequency (in days) to a client-side function. A client-side plist stores the epoch and the result. During subsequent inventory updates, if the current epoch is less than the given frequency, it just reads the previous result from the plist instead of executing the entire Extension Attribute script. For example, I have an EA for “Model Name”; how many times do you need to run that Extension Attribute? (Once per quarter? Once per year? Certainly not every time.) Results Early tests show an overall inventory collection that is 1.6x faster, using the following as a gauge before and after:

hi,We use SPARK email software.With APPLE volume purchasing we have deployed the app with JAMF and the APP STORE.When SPARK makes an update and it appears in the App Store, JAMF downloads the update but cannot deploy it on the client workstations because it systematically asks for the workstation's admin code.How can I automate these updates?cordially

What are the ways to manage software updates for non-supervised mobile devices? We have several hundred mobile devices enrolled using the UI method and would like to keep their iOS versions up-to-date. I understand that the "Update iOS Version" remote command only works on ADE/Supervised devices. Is there a way to manage software updates for non-supervised mobile devices?

I am testing a reset local user password Policy in case a user forgets his macbook login password. I see this as a trigger option: "Startup - When a computer starts up. A startup script that checks for policies must be configured in Jamf Pro for this to work"What kind of Startup Script would I need for this policy to take effect? This may come up in the future and would like to have this available for a real situation. OTW, the trigger is Recurring Check-in but it doesn't seem to check-in after I reboot ans wait 15 minutes. I don't believe Recurring Check-In will happen until after the user logs in. This won't help if I can't reset the password through Policy. Any help/advice is always greatly appreciated. 

We have an odd behavior in our environment for some of our machines.  If you try to shutdown/restart using the GUI method - it hangs.  What happens in you see the background and the mouse cursor...and it just stays there.  Screen never goes black and doesn't shutdown/restart.  So because it's stuck you can still SSH into the machine and run commands.  So I wrote a script to kill processes to try to figure out which process might be hung.  While I didn't figure out which process is causing this I did learn that if you kill the following processes(AppleUserHIDDrivers, IOUserBluetoothSerialDriver, IOUserDockChannelSerial) four times it will kernel panic your machine.  Tweaked the script to avoid processes that will kill the remote session...but it doesn't seem any process I kill causes it to move forward and shutdown/reboot. Anyone experience anything like this?        

 We have a user who's time zone is set wrong..if we try to change it we can't as it is greyed out."This setting has been configured by a profile"I assume this is a JAMF Profile?