We are about to make a major push into encrypting our Macs with FileVault 2, starting with 10.8.x devices and moving down to 10.7. I've followed the whitepaper on Administering FileVault 2 on Mountain Lion and have it working OK in the lab, but I did notice that if a user reboots his/her Mac and does *not* enter in their password (using Current or Next User setting) to begin the FileVault process, that the machine simply reboots. FileVault 2 encryption never beings, and because the policy set to run only "once per computer", it never runs again. I am wondering if there's away around this. Specifically, how can I configure the policy to reapply itself on machines that are not encrypting or that are not encrypted? Is setting the Execution Frequency to "Ongoing" the proper course of action? Is there anyway to remove / hide the "Cancel" button when the user is prompted to encrypt? thanks,mike

One of our enrollment technicians has come across an error where scoped apps won't install. The error message that is under the failed command is "Couldn't communicate with a helper application" Its an iPad and it's trying to install the Gmail app. See the attached screenshot. What could cause this? What can be done to prevent it?

There is a user who has an unencrypted internal drive. His jamf profile should be requiring him to enable FileVault. However, we he restarts or logs out of his device, he is not prompted for FileVault to be enabled. He is already enrolled in jamf but the "Install Configuration Profile Disk Encryption" is stuck as pending. I've tried sending a blank push. Is there a way to push this policy so they are encrypted without having to unenroll and re-enroll their MacBook? They are on an Intel Mac.

Jamf Nation- The privacy of our customers' data is of the utmost importance to us. Yesterday, we learned of an issue in the Jamf Nation Feature Request portal related to the exposure of limited user data. This was limited to Jamf Nation user data, did not include password data, and did not impact any other products or user data outside of Jamf Nation. This issue is now resolved. We will provide updates as they become available and we complete our investigation. Thank you for your continued patience in this matter and we apologize for the inconvenience that this has caused. Jake BernardyVice President, Global Customer Success @ Jamf

Just had to rebuild the installer package for the Cisco Secure Client. Dumped the choices and attempted to deploy. The deployment would not install. Turns out the dump from installer of the choices xml file is malformed. I was able to put together a working xml from my 4.10 package. We are only installing the VPN module but all the others are there to enable. Here are the contents<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><array><dict><key>attributeSetting</key><integer>1</integer><key>choiceAttribute</key><string>selected</string><key>choiceIdentifier</key><string>choice_vpn</string></dict><dict><key>attributeSetting</key><integer>0</integer><key>choiceAttribute</key><string>selected</string><key>choiceI

With injection add-ins for Outlook being removed in May we would like to know what Outlook Add-ins users may of installed. Is there a Jamf EA or script to find this out

Hi everyone, Have you ever tried to update a PreStage Enrollment through the v2 API?I'm trying to create a python script that will update the customPackageIds of said PreStage Enrollment when certain packages have a new version available. This always gives me error 500, internal server error, I think. It would be something like this: import requests payload = { "customPackageIds": "110" } headers = { 'Accept': 'application/json', 'Authorization': 'Bearer XYZ', 'Content-Type': 'application/json', } response = requests.put('https://XYZ/api/v2/computer-prestages/3', json=payload, headers=headers) This is my first time doing something like that with python and JSON and I would gladly use python-jss for this but as far as I know it can't handle PreStage Enrollments. What's your take on this?

Hi Guys,I've been trying to add remote desktop bookmarks from https://soundmacguy.wordpress.com/2020/06/14/managing-microsoft-remote-desktop-10-bookmarks-with-handy-jamf-scripts/comment-page-1/?unapproved=15565&moderation-hash=52675532c055e57029dc4ae44a7da447#comment-15565 and when i run the script i get this error below Executing Policy Add Remote Desktop H&LRunning script msrd10-add-remotedesktop...Script exit code: 132Script result: User: staff is logged in...Username specified, Creating bookmark for: sysnet Domain not specified, username will not be prefixed... Creating bookmark: H&L /Library/Application Support/JAMF/tmp/msrd10-add-remotedesktop: line 98: 7252 Illegal instruction: 4 sudo -u "${loggedInUser}" "${msrd}" --script bookmark write $(uuidgen) --hostname "${hostname}" --friendlyname "${friendlyname}" --resolution "${resolution}" --group "${group}" --username "${username}" ${extraArgs} 2> /dev/nullError running script: return code was 132.&nbsp

create a policy, on the left pane enable the Restart Options. From there set if you want set it to restart immediately with or without a user logged in. i understand the above can be used to configure the policy but how to call that policy ? sudo jamf policy restart ?

Greatly inspired by this thread, I re-wrote a Ventura-ready script prompting the end user to enable Screen Recording for a given app. The Privacy & Security window will open automatically and the popup/gif loops until the user grants access.In my company, the script is deployed at the end of the enrollment so the support team doesn't forget to enable screen recording for Google Chrome. This way, the user won't have to restart his browser the first time he wants to share his screen to somebody.Script : enable_screen_recording.shExtension Attribute (Optional) : enable_screen_recording_ea.shRequirement : IBM NotifierBlog post (French) : Autoriser l’enregistrement de l’écran (TCC/PPPC) à l’aide d’un popup tutorielIf you test the script in your Terminal, give it full disk access so it can read the TCC.db file.

Hey everyone, We are testing jamf connect and we are noticing that upon 1 restart we see the jamf connect login window upon 2nd restart the window disappears not sure what is wrong but upon 1 restart the authchanger should kick in but it is not it is kicking in on the 2nd restart. 

Hi Everyone,First time posting here so please forgive any lapses in etiquette! I've recently inherited a Jamf estate at my work place and whilst I've recently been trying to deploy a .pkg out, keep running in to this particular error message and I don't have the skills/knowledge to resolve it so was hoping that one of the gurus here could lend a hand. Payment would be in eternal gratitude.My Error Message:Downloading myApp.pkg...Downloading https://euc1-jcds.services.jamfcloud.com//download/9c26e394fec944e1a7dde6f5aa5e7537/myApp.pkg...Error: Package was not successfully downloaded. 400The network connection was interrupted while downloading the package from https://euc1-jcds.services.jamfcloud.com//download/9c26e394fec944e1a7dde6f5aa5e7537/myApp.pkg. Attempting to reconnect...Downloading myApp.pkg...Downloading https://euc1-jcds.services.jamfcloud.com//download/9c26e394fec944e1a7dde6f5aa5e7537/myApp.pkg...Error: Package was not successfully downloaded. 400Error: myApp.pkg is not availa

For those of you using Jamf Cloud instances, I'm curious if you've ever run into issues with policies downloading large ( > 5GB) files when using the "Each computer's default" distribution point rather than the "Cloud" distribution point. I have one policy using "default" for a .pkg file over 12GB that works fine, but another with a 8.25GB .pkg file that kept failing until I switched it to "cloud distribution". The error message was "Error: The package is not found on the server" even after re-uploading the file.For our Jamf Pro instance, we have no File Share Distribution Points, and use AWS for our Cloud Distribution Point. We have the "Use as principal distribution point" check box ticked for the Cloud distro, so my understanding it that is shouldn't matter whether the distribution point option in a policy is set to "default" or "Cloud" because either one should still be pulling from AWS. But for some reason as yet unknown to me, it does make a difference for second policy a

Greetings. Looking to the Nation to see if anyone has this issue and a resolution. We are in the process of removing existing separate installs of Cisco AnyConnect and Umbrella roaming client and installing a bundle package with just VPN and Umbrella client. The uninstall Policy to remove works, but the end user will get a popup to respond ok to the following: "vpnagentd" wants to access to control Finder. Allowing control will provide access to documents and data in Finder to perform actions within that app".  I've been working with a PPPC but no luck yet. Thanks. in advance 

Hi there, Recently we purchased a number of iPads for our elementary school students. We have 20 iPads available for students to use and 1 teacher’s iPad with a single Apple ID used by all teachers. The students’ iPads do not have an Apple ID and or not configured as shared iPads. We would like to utilize Apple Classroom on the teachers iPad where Apple Classroom is properly installed (we pushed this with Jamf School). However, on the teachers iPad, when we manually create a new class and click on ‘add students’ the expected four-digit pincode does not appear.I also attempted to install Apple classroom on the students iPads, to see if it would work without an Apple id and with another profile installed via Jamf School. Weirdly enough, I did receive a four-digit pin. Quite strange! Has anyone else experienced this issue and managed to resolve this? Thank you in advance! Model: iPad 9th generationiPad-OS: 17.4MDM: Jamf school Kind regardsAn elementary school in B

Hello,As an intro to myself and my level of Jamf/scripting - I am a 200 level tech who took the 300 and did not pass. lolWhat I am trying to do is get notifications sent from Jamf connect when someone 'requests admin privileges' to be sent to a Microsoft Teams channel.The Mac admin guru at my workplace set this up: https://snelson.us/2024/02/setup-your-mac-1-14-0-under-the-hood/ it is a way to auto setup a Mac and it also includes a Teams channel set up guide using Webhook (an app within teams) to notify us when someone has completed the "setup your Mac" portion of their first time set up.I would like to do something similar to this but again just for when someone clicks on requesting to become an admin on Jamf connect. I have the script for setup your Mac but I think this will require an agent and obviously its own script. Is there anyone out their willing to help me out with this? I might need my hand held a lot through this process to be honest lol. Thanks in advance!

I created a policy to install a package (minecraft education). I put startup and login as the triggers. When I check the logs i see the message below "Installation failed. The package could not be verified"Any ideas how to fix this error? Thanks  

I'm trying to install network printers without binding my Macs to AD.  I'm using Jamf Connect for passwords and for network drives.  Those work great.  It's the printers that I'm getting hung up on.I created a policy that adds the printers and the drivers.  The printer will install, I just can't print to it.  The printer hangs in a "printer is in use" message.  Here is the script that I'm using. lpadmin -p Ricoh_Second_Floor -E -o printer-is-shared=false -v smb://Printer IP/Printer Name -P "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/Resources/Generic.ppd" -o ColorModel=RGB -o ColorDevice=True -o auth-info-required=negotiate

Has anyone tried getting their advance search from the API in json rather than xml?  When I do this, the computer groups will only return 1 group in JSON but when I get XML, all groups are listed.  Anyone know how to get all groups as well?

Hello,We have enabled Device Compliance in Jamf.Everything went well.The enrollment of the devices, the computers appear well in Azure AD as compliant based on the Jamf compliance smart group, if I change the criteria of the Compliance smart group, it goes well into non-compliant in Azure AD, etc.But the problem I'm having now is when I create a conditional access policy in Azure AD and check "Require device to be marked as compliant", it even impacts computers marked as compliant in Azure AD.For example, I created a policy that blocks the ability to authenticate on Adobe applications for non-compliant computers, this affects compliant devices.As soon as I uncheck "Require device to be marked as compliant", it unlocks the situation (on non-compliant computers too...normal).Do I need to configure anything else?Thank you for your help 

I am testing Software Updates (Beta) in my environment, and I am seeing mixed results. So, I started with a Monterey 12.6.6 and sent a request to update it to 12.6.7 which was successful.  Then I send another request to update the same machine to 12.6.8, locked the machine and left it overnight.  The machine did not update.  I researched and checked for anything I could find to see if the machine got the instructions.  I looked at the install.log and nothing stands out.   I ran the update command again, still no update.  Can anyone tell me if there is a certain time frame that it waits or a location or command at the machine can be checked.  Any help or information would be greatful.

I’m struggling with wifi on the Jamf Connect Login page.We use two networks - ENT and DEV. ENT is Enterprise, DEV is PSK.ENT is for all users to login to and gives access to printers, fileshares, etc. Users need to login to this network with their network username and password.DEV is more of a backup being pushed out via config profile, auto-join disabled. I can confirm the computers I'm testing on have this profile.Jamf Connect Login lets you connect to DEV if you know the password.You log in through JCL, and once you hit the desktop you need a printer so you swap over to ENT.You log out for the day.Now the JCL page needs the password for DEV again, even though it knew it before, and it's being pushed out by a config profile, and it hasn't been Forgotten by the user.Can I force JCL to use a specific wifi network, or feed it connection info or something? This seems like it's broken or something.

Hello,We have recently got this situation. Little bit about our infra. We have On Prem AD and Azure AD. We have MAC which are managed by Intune.We recently setup our Azure AD and On Prem AD Sync, we started to see an issue where if a person reset there password then on MAC they start to get prompt for there on prem file server mapped network drive for password. Even if they key in Password it do not work and it keep prompting. Only solution which work is where users must remove any credentials that’s saved in their Keychain related to they on prem file server.. Once the saved password(s) are deleted for On prem file server, reboot their MacBook. Once it’s booted and signed in, the system would prompt them to enter their updated credentials the next time they open their network folder.Unfortunately this is not a good user experience so asking if JAMF has any solution or any other solution that might work.,

My company users Global Protect to keep all of us connected when we're not in the office. For the most part, Global Protect works well. The way we're setup is if GP is not connected we have no internet access. This results in any policies that I setup to run at startup to fail. The Jamf log will show "Connection failure: The Internet connection appears to be offline." I asked one of our firewall guys to add an exception to allow Macs to connect to the Jamf Pro server whether GP is connected or not. This doesn't appear to be working so I want to get some advice on an idea that I have. I want to create a launch agent to ensure that an inventory is ran right after the user is logged in. Also, after my zero touch provisioning process is finished, and the user reboots, I want the first policy that runs after the user logs in to be the one I have setup to check to make sure that all of the apps that should have installed through ZTP did install and then install any that are missing. The way

Hey Nation!I created a config profile for Microsoft AutoUpdate to automatically update apps in the current update channel with notifications disabled. For the most part, it seems to work just fine. However I had reports from a couple of users that they were seeing this popupI even tried creating my own plist as shown in this Nation post https://community.jamf.com/t5/jamf-pro/microsoft-autoupdate-app-notifications-settings/m-p/234536#M222449Has anyone ever had this happen even when disabling the notifications? Any help would be appreciatedThanks!-Frank S.