hi all,is there a way to enforce the setting "Private Address" turned off?We actually have a Cisco ISE in our internal network that uses mac address to detect if it is an iPhone (we push mac addresses in a specific group) and then moves the iPhones to another network. Since Private Address is on, it transmits to the network controller a different MAC address and breaks our rule.

 Hi everyone,I'm looking for some help and/or critique on the script below. I would like to mention that I'm still pretty new to scripting and use shellcheck and explainshell pretty heavily. If anyone has any other resources I could add to my arsenal, it would also be much appreciated.Now that the PSA is out of the way, I want the script to check if the policy banner has been modified or deleted and if so, display a message and run the policy -event policybanner. #!/bin/bash loggedInUser=$(stat -f%Su /dev/console) # Path to the file you want to monitor file_path="/Users/$loggedInUser/Library/Security/PolicyBanner.rtfd" # Get the initial modification time of the file initial_mtime=$(stat -f %m "$file_path") #changes permissions of after the packages is installed chmod -R o+rx /Library/Security/PolicyBanner.rtfd while true; do # Sleep for a short duration (e.g., 1 second) sleep 1 # Get the current modification time of the file current_mtime=$(stat -f %m "$

I need some help fixing an issue.  During testing of Jamf Compliance Editor we applied a configuration for the login window to show username and password, versus the normal choice of being able to select the username.  However, we have one user, who was erroneously enrolled, and we deleted that policy instead of removing the MacBook from the scope (rendering the policy still applied but unable to be removed from scope).  Once the policy was deleted, we are unable to set the login screen back to defaults.  I have attempted to create the policy again in Jamf Compliance Editor and apply to the MacBook, and while the logs show it applied, removing it does not restore the ability for the login screen to show the users.  Is there something else I should be doing to restore the login screen icons? Is there a terminal command that can be run?  Note that all of the other policies for Jamf Compliance have been removed successfully from the MacBook by removing t

Hello, help would be appreciated with some configuration / inventory items in JAMF Pro. Im a bit of a newbie with JAMF.I am looking to do the following:1. Inventory script(s) that return whether (1) "AutoFill Password and Passkeys" is enabled and (2) "Use Password and Passkeys from Keychain" is enabled.2. A configuration item or script that would force enable the above settings Thanks!

Hello,I am attempting to configure the Single Sign-On Extension Config Profile, but opening it up I am immediately at a loss for how to do so.What is the difference between the Payload Type SSO and Kerberos?Are there instructions somewhere for how to configure both? Depending on which we choose to use? Any guidance on how to configure this is greatly appreciated. Infrastructure information:We are hosting Jamf Pro on premises.Our Mac Computers are bound to AD.

I circulate MacBooks in a library context, so multiple users use the same machine throughout the day. I'm required to have my MacBooks disk encrypted, and I need my users to be able to login to these MacBooks wirelessly with their Active Directory accounts. But I think FileVault prevents users from authenticating to the network before they login to the MacBook, is that right? Is it possible for users to login to wifi before they login to the FileVault-enabled MacBook?

Does anyone have, or can anyone advise on how to create, a manifest file for installing the Python 3.12.1?Pretty new to macOS administration, and very new to Jamf Pro, but would like to be able to deploy the Python 3.12.1 package through Self Service but not been able to get it to work. I'm presuming it is because I've not declared a manifest file, and using Composer reports a whole load of Deleted Files and Modified Files which I think are unique to my machine configuration and even the Files For Package seems to include a whole load of irrelevant files.Any help will be gratefully received.

I have created a weblink through devices > content management > Configuration profiles. This link I believe to have set it up to deploy to all devices. Unfortunately i am only seeing it completed on 44 devices. How would i go about having it sent to all?In my scope it is set under target all mobile devices. the pop up shows "redistribution options" "there are 49 devices with this profile installed. "  i chose automatically update but it doesn't deploy to all 1900 devices.

Hi All,I will be taking Jamf 300 training and certification in a couple of weeks and it would be really helpful if anyone could give some tips for that.

Our school division is pushing for Filevault 2 on all Macs.  I'm tasked to figure out how to deploy this if it is feasible.  Our school division uses Active Directory.  I have so far tested enabling Filevault with a Configuration Profile configured as follows:I have also turned off automatic login while FileVault is on as per https://support.apple.com/en-vn/HT207431.sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YESI have tested this with Catalina, Big Sur and Ventura Beta, I haven't got around to Monterey yet.  What I have found in Catalina and Big Sur is that only the Filevault users are listed and there is no username and password prompt for new users.  Ventura Beta does have a username and password prompt but even with automatic login turned off the computer does not connect to Wifi until someone logs in.This would be fine if it was a one-to-one computer deployment but I need to deploy this to lab computers and lapt

Hello everyone and thanks in advance. I'm just looking for a little guidance in what avenue to pursue for upgrading my fleet and keeping everyone on the same page moving forward. Jamf Pro seems to have a few different methods for doing this. Documentation found here shows using Smart Groups and Mass Actions to upgrade devices. That's a simple enough method and I would love for it to be that easy. My experience with the Mass Action "Update OS version and built-in apps" is that it is a black box that I have no idea of whether or not it is working. With a >12gb download, it's a little aggravating to just fire off the command and hope that as long it ends up in the History > Management Commands > Completed list, that it worked properly and the computer will... update itself at some point? Option 2 seems to be that a lot of people are using scripts like the ever-popular erase-install to handle upgrades. Is this because the Mass Actions don't work? People would rather

When upgrading from 14.2 to 14.2.1, I lose my ability to see my printers in local applications (Preview, Word, etc.). The printers show up in System Settings but when I run the applications, it acts like it is not there and I have to manually re-add them again. I have 1400+ devices so trying to remote into each one and add it manually is not ideal and the end users do not know how to add the printer manually to our new printing system. We just went from admin users to standard users in our environment. Any suggestions?

Can someone tell us if any student forgot the pin how to recoger the iPad if not have WiFi, the adapter can work if we set up a special check on the Jamf School Profile or could be this another check I see:Allow devices to start up in recovery mode using an unpaired device connected via Lightning cable iOS 14.5 or later Thank you

Hello,I appeared for Jamf 100 exam on 19th August 2023. I am now looking for my course completion certificate and invoice of the purchase so that I can claim reimbursement. I have already dropped an email to "training@jamf.com" .May I know by when can I expect my certificate and purchase invoice?

I am concerned.I only recently discovered that if someone changes their password outside of Jamf that they need to log in with their old password and then sync the new password.The catch is that we have a Windows and Mac environment and depending on which class a student is in, they could be using one for one class and the other for the next. This means they could be changing their password on either machine or on their phones and not directly through Jamf.We use Entra (previously Azure) and I don't know if there is some better way to sync or some way to assist students who may get stuck and I'm a little worried.Does anyone have any help or advice? I am happy to explain better if this wasn't good.

Hello everyone,We've been using Jamf for half a year now, and we got most of it working with scripts and other hacks, but one thing we still struggle with is updates.We have 2 issues with software updates, 1. how to force install them without user interaction.2. how to prevent Major updates like Ventura before they are approved.And I'll explain.1. I've tested a few scripts and methods that I found/created, but apple has made our lives harder requiring user authentication for major updates, and does not install updates that require restart at all, just downloads them.Has anyone managed to force update install and restart from Jamf via script? or is this locked now and must involve user interaction? 2. I've seen countless posts saying: "block InstallAssistant, and defer updates for 90 days" I don't know how no one mentioned this, or thought of it, but that will not apply only to the update you're thinking of, it applies to every update.For example, let's say I want to block Ventura

Howdy folks!  I am looking to add a few native apple apps back to my devices (I was a little too restrictive in my initial set-up) but now that I am adjusting my config profiles to include these apps (specifically Clock and Translate) they aren't showing up. . . is that because I haven't purchased them and scoped them to my devices? I would have thought that just by adding them into App Usage section of the payload (and home screen layout) it would add them in. I tried adding them manually into the Mobile apps section, but when I scope them to the device its prompting for the user to sign in with an AppleID. I looked for them in my Apple Business Manager Account, but I can't find the native apps listed in there at all. Am I missing a key step here? Do these apps live elsewhere in the restrictions and I'm missing it?   

How does Jamf Connect detect that I have a network connection? We are starting to implement an always on VPN solution and I believe it is interfering with Jamf Connects' ability to confirm a valid network connection.I have confirmed that I am connected to a wifi network, for some reason though Jamf Connect doesn't think I'm connected and will provide the Local Login option.  The message on screen is "Your Mac is not connected to a network. Try using local login.". Depending on how Jamf Connect is determining a valid network connection we might be able to whitelist or exclude it from the VPN solution.

Hello,I clicked "Unregister" in JamfSchool on an iPad as a test. Now the device in JamfSchool displays: "The device is no longer managed! The management profile was removed from the device on Tue Jan 9 19:15:30 2024. The device can only be managed again after it has been re-registered."The question for me now is how I can register the iPad again without using Configurator 2. Or does this only work with Configurator 2? But that would mean that I would have to connect the device to a Mac via USB.Ralph 

I am using api/v1/device-enrollments/{id}/devices to get devices our Apple Business Manager (ABM) has assigned to Jamf.  Example use case is to be sure devices active in Jamf aren't released from ABM.The problem is that you, process wise, remove a device from ABM then wipe it then remove it from Jamf so it can create false positive alerts during that process. eg you alert that a device was released from ABM during the decom process.What I am looking for is if there is some record that shows the date a device was removed from the device enrollments so I can not alert until after a few days or weeks.ABM has no APIs so I can't do that through them.I could locally cache last date a SN was seen in ABM but that is a pain.

Good morning, We have a shared iPad with button on/off broken, then we can't make a DFU. Student forgot the pincode and restarted the iPad, then it not have WiFi to control by Jamf portal, we can't do a DFU because on/off is broken and warranty want to disable FindMy iPad because it's enabled on all shared iPads. Anyone have an idea to apply?Thank you very much

We use JAMF and Microsoft to integrate device compliance for many of our devices. However, in the last two weeks, we have observed that some devices randomly lose the 'Microsoft Intune' field in Azure and become non-compliant. When we check the company portal, the compliance managed by JAMF is also missing.Due to the lack of compliance, these devices start to show conditional access errors. We can fix this quickly by running the azure registration policy again, but we don't know the root cause of this problem. For example, one device had to be re-registered three times in two weeks. Others only once, and some never.We did find this MS known issue with Intune and macOS:Known issues with Microsoft Intune - Intune | Microsoft LearnCould this be the cause of our problem, or is there something else I might have overlooked?

I saw a blog post mentioning a new tool Addigy is rolling out to try to work through broken/stuck MDM on managed devices.  The premise sounds promising, and only bring it up here since they plan to offer an open version that can be leveraged with other (aka Jamf) MDM's. https://addigy.com/blog/addigy-new-mdm-watchdog-agent-how-to-resolve-mdm-issues-with-macos/?utm_source=press-release&utm_medium=referral&utm_campaign=mdm-watchdog-press-announcement-05.24.2023

Dear Jamf Pro Support Team,I hope this message finds you well. My name is Somnath and I am a user of Jamf Pro currently working on the integration of our system with the Jamf SaaS App.I am currently facing an issue when attempting to update a user's password through the Swagger interface. The error message received is: "You cannot change information in an LDAP account or change the password."Api URL:https://somnathrode.jamfcloud.com/classicapi/doc/#/accounts/updateUserById Upon further investigation, it appears that the Swagger API does not currently support the updating of user passwords through an admin user. As part of our administrative requirements, we need to perform password updates via the API using administrative privileges.Could you kindly assist in providing the necessary API endpoint or guidance on how we can achieve password updates for users with administrative credentials?Your support in resolving this matter is highly appreciated. If there are specific details required

Hello again! I have a new issue!Despite our prestage enrollment through the configurator saying to skip Siri and Apple ID, it's doing it anyways. I was told about iMazing and creating a profile with that. I did so and selected skip on everything. It's still happening.These are shared computers. When a new user sits down and logs in with the Jamf Connect SSO it creates an account for them and then takes them through these setup steps. I want to skip these. I either set up the iMazing profile wrong something else.Could anyone help?