My org's NetSec guy wants to do a "Mock Ransomware drill" and wants to have a way to shtudown all of our Mac/Apple Computers/Devices ASAP through Jamf. I know you can initiate a shutdown of Mobile Devices as a mass action command, but it doesn't appear that the same functionality exists for MacOS Computers.  Does anyone have any ideas on the best way to achieve this? I know a policy could be created to force a shutdown, but is there a way to force all computers to check-in for policies immediately? I've experimented with the Lock Device MDM command, it does restart the computer into a locked mode but it appears to still have network functionality. I'm guessing if we're trying to stop the malware from spreading across our network that isn't going to do much? 

We have 5 different brands and each brand has its own Entra ID, I was wondering if we could setup JAMF Connect PreStage enrollment tied with the specific IdP.Only one Entra ID worked and that is because the SSO on JAMF Pro has been configured and linked to that Microsoft tenant. I'm really confused. Help is much appreciated.

Is it possible to restrict what kind of account can sign into Google apps on 1-1 iPads? What we're seeing is students signing in with both their personal google account and their 1-1 G-Suite for Education account and they are using their personal account to create Google Classrooms where they can chat with each other....

Hi all. Hope everyone is having a great Friday. We're relatively new to Jamf Pro, and brand new to iOS. We are deploying some iPads which I have setup with Apple Configurator 2 and ABM and tied those to Jamf Pro. Things are looking good with restricting the App Store, and whitelisting only approved apps. We use Google Workplace, so we are deploying all the Google Apps. We'd like to restrict these iPads to only be able to login with the corporate Google accounts. I am able to do this on the Mac side with Chrome Managed Browsers to prevent personal accounts from logging in to Chrome. Is there any way similar to this to accomplish this on the iOS side with Google Workplace or Jamf Pro? I believe I've seen that the school district does something similar on my son's school iPad, so I believe it's possible. Thanks all!

Hello, I have an iPad that is used as a permanent Time Clock in single app mode. I am hoping to find a way to make it restart automatically on a weekly basis. Does anyone know what the JAMF API script would be to do so? Thanks!

We are trying to install Unity Hub to an iMac Lab that has standard users. We created the Unity Package using Composer and created a Policy in Jamf Pro. When anyone launches the app we get the below message attachment.I realize there are a few post opened for this but we can not seem to grant the correct rights to bypass this message.We have tried the following:Created the app with rights to Applications set to Owner: Root Group: AdminSet Permissions to Apply to Owner and Group to Applications and All Enclosed ItemsCreated the app with rights to Applications set to Owner: Root Group: WheelTried changing rights to Application/Unity/Hub/Editor  Get Info - Sharing & Permissions changed from Read to Read/Write.We also tried using a Patch Management to update from 3.6.0 to 3.6.0 (which has not run yet). Has anyone had success in installing Unity Hub to a standard Mac user without continuously being prompted with helper?   

Of 19 computers in Jamf Protect, 3 are showing as not connected in over a month even though they have the latest Threat Version and Protect Version. Jamf Pro shows them recently signed in and I can see that some have updated to Sonoma in the last few days so they must have restarted. Any ideas on why this might be happening and how I can fix it would be appreciated.

Not really sure what the point of having a pure white and blinding GUI is but I can't seem to find where to turn on Dark Mode with the new v11 update.Also find the new GUI to be very difficult to use with everything looking the exact same. 

Greetings,Curious if anyone has run into this scenario;We are using JSS cloud, devices enrolled in Apple School Manager and assigned to the JSS, scoped to a Prestage Configuration that bypasses all steps in Apple Setup except Location Services, Registration & FileVault.  We're also using an Enrollment Customization Configuration.  We do not create a local admin account in our PrestageThis Prestage is the only one in use and has not changed in years. While setting up a new or freshly-erased-with-new-os Mac:Start the computer, which initiates Apple Setup.Step through the screens to the Remote Management screen.Let the JSS enrollment complete.At the Account Setup screen, Shut the computer off.The scenario here is that a setup tech could finish up for the day and rather than continue setup, shut the computer down, or let it go to sleep.  I've only been able to replicate if the computer is shut down.Restart the computer.At this point, the computer boots to a log

Hey all,  I want your input on our current provisioning workflow, cuz I think it needs to be adjusted somehow  Through prestage enrollment, we create our managed administrator account and choose the type of local user account as "Admin" .. the end-user account gets a secure token but not our managed administrator's one cuz we don't login with it as a first account. We use a script that the end user has to run from Self Service to grant the secure token to our managed administrator account . What do you think? is there something we can do to skip running that script from self service and grant a securetoken to our managed administrator account? Any tips are very appreciated

Today we are releasing a maintenance version of Jamf Pro. Jamf Pro 11.1.1 fixes the following product issues: Jamf Pro Server: Security Issues [PI115207] Updated a third-party library to resolve a known vulnerability (CVE-2023-34055). Jamf Pro Server [PI111014] [PI109336] Enrollment for computers no longer fails when user-initiated enrollment and PreStage enrollment settings are configured with identical management account credentials. [PI111120] The user account creation step of Setup Assistant for macOS is no longer incorrectly skipped when a PreStage enrollment is configured to skip the "Transfer Information" and "Location Services" steps. [PI111481] [PI103338] The user account creation step of Setup Assistant for macOS is no longer incorrectly skipped when a PreStage enrollment is configured to both create a management account and enable FileVault. [PI113195] The user account creation step of Setup Assistant for macOS is no longer incorrectly skipped on computers with macOS 14

Hello Jamf Nation! Jamf Pro 11.2.0 Beta 2 is now released. Now with Dark Mode!! There are also many additional features and fixes, please view the release notes for further information. How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Forum, click "Join this group Hub" to gain access. Email beta@jamf.com with questions. The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!  

Hi there, I'm working on a policy that should be able to deploy a launchdaemon plist to all machines. The below script I found here https://communithttps://community.jamf.com/t5/jamf-pro/remote-management-active-extension-attempt/m-p/119717y.jamf.com/t5/jamf-pro/remote-management-active-extension-attempt/m-p/119717    #!/bin/bash cat << 'EOF' > /Library/Scripts/jamf-Restart.sh #!/bin/bash sudo killall jamf sleep 10 sudo jamf policy EOF chmod 644 /Library/Scripts/jamf-Restart.sh chown root:wheel /Library/Scripts/jamf-Restart.sh cat << EOF > /Library/LaunchDaemons/jamf-Restart.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>jamf.restart</string> <key>ProgramArguments</key> <array> <string>sh</string> <string&

Hi ! I use Jamf Compliance editor and recently the "Upload" feature doesn't upload anymore the configuration profiles. It used to work very well until like 2 weeks ago.Scripts and extension attributes are uploaded without any issue though.JCE doesn't raise any alerts when uploading. But I can see in the change log in JAMF that only scripts and extension attributes are uploaded, no mention of configuration profiles.API roles and permissions seems fine, at least as per the documentation.Any idea ?

I am able to add the Apple clock app to self service, but because I cannot assign a license to it, it won’t download on the managed iPads.I tried “buying” licenses from Apple School Manager, but I can’t get licenses for a system app.

Hi There I know there have been discussions regards this already, however, none of these seems to be working for us. Having looked at this article with Google https://support.google.com/chrome/a/answer/7591084?hl=en it appears that they have changed their code/process as this is no longer working. Also the UpdateDefault key is no longer listed on chromium.org/administrators/policy-list-3. My question is, how to force users to have the most up to date version of Chrome? I see Patch Management may work, but this requires pkgs and i am worried it would remove user profiles etc if reinstalled etc. Any advise best way to force users to update chrome? Thanks

We've decided to move our scoped policies and conf. profiles to smartgroups, as we realized this will save a lot of work in the long run. I don't seem to find an efficient way to do this, at the moment i have to go through every single policy and conf profile and change the scope manually, which isn't even the bad part, the worse is that i can't find a way to list all the policies scoped to one department.When the policy is scoped to a few departments, it can't be found anymore in the search, it shows "2 computer groups, 2 departments" or something like that and that excludes the keyword from the search.Any help/ideas would be highly appreciated.

I ran into an issue where a Supervised, Managed phone became unmanaged during iCloud restore via Quick Start. Once the phone reaches the home screen, Self-Service doesn't install, and the phone doesn't check in with Jamf. I believe at least one of the config profiles is missing.I *think* what is happening is that the iCloud restore brings down the config profiles from the old phone that replace the ones PreStage enrollment installed, and since it's from a different device, they can't or don't apply.The workaround I found was to manually re-enroll the phone via the enrollment URL, as doing so downloads and re-installs the config profiles. As far as I can tell, after the workaround, the phone is fully managed and never lost its supervised state.While I have a workaround, this isn't ideal for remote users and isn't close to the zero-touch deployment we aim for. Does anyone know what is the best practice here? Surely there must be a correct way to use core Jamf Pro features like PreStage E

Does anyone know how to allow IP Cameras to display on an iOS device? This is through an app the app opens but no connection to the Cameras. Security setting somewhere that I need to allow this.

Hello Everyone,  I have a question how can i have it setup where a user logins through jamf connect and after login their computer in jamf pro automatically encrypts for example my test mac computer has filevault enabled but it is currently not encrypted in jamf pro 

Found the solution to my problem - How to lock classroom pane/options with a custom profile in JAMF explained in first comment We are looking into deploying Classroom for our teachers and students next year. We would be doing Teacher Managed classes. (macOS devices, teacher and student). By default, students can change settings that include them being able to leave the class, and requires student approval to lock etc... Which is never going to work. JAMF has a couple wonderful configuration profile setting under Restrictions - Functionality. However they ONLY work with Prestage Enrolled devices, not those enrolled via QuickAdd. I have tested and confirmed that with a clean install of 10.14.4 and QuickAdd that the configuration indeed does nothing. Students can still change settings and require permissions etc. Allow Classroom to perform AirPlay and View Screen without prompting, Allow Classroom to lock the device without prompting,Require teacher permission to leave Classroom unm

Hey all, I made a thing to save my eyes (and hopefully yours): https://userstyles.org/styles/170527/jamf-pro-dark-modeGitHub Source Please read the installation notes carefully to activate the style. Tested pretty extensively in Chrome; works in Firefox too. Unfortunately Safari is not possible at the moment until Stylish (or someone else) submits an app for Mojave / Safari 12. While Safari can load custom CSS via Preferences > Advanced, Jamf's CSS has some 'global' declarations in the first few lines for typefaces and I can't easily work around that AFAIK. This is my first attempt to do anything remotely approaching 'front end web development' in over a decade. If I've missed anything obvious or made an amateurish / inefficient CSS gaffe, please let me know here and/or make code suggestions at my github repo. I've uploaded some screenshots here to whet your appetite.

Welcome to Part 3 of our discussion of Certificates, SCEP, and 802.1x. In our previous post we took a look at how Active Directory Certificate Services works. In our final part in this series, we will explore SCEP and 802.1x. What is SCEP? SCEP = Simple Certificate Enrollment Protocol What does SCEP do? SCEP is a certificate management protocol that helps IT administrators issue certificates automatically. SCEP is used by a Windows Server Role called NDES or offered as a service by a third-party Certification Authority (CA). What is NDES? NDES = Network Device Enrollment Service NDES is a Windows Server Role Service which works with the Active Directory Certificate Services Role to distribute certificates via SCEP. What does NDES do? NDES allows software on routers and other network devices (e.g., Macs and iPads) running without domain credentials to obtain certificates based on the Simple Certificate Enrollment Protocol (SCEP). How does NDES work? NDES uses the Micr

Hey Everyone, I noticed when we get to this part of the login for Jamf Connect we get this error message below.   Would anyone know how we can get rid of it? 

Hi, Totally fed up with the constant updates of Flash player plug in. Does anyone have a deployable method to remove it from my lab Macs? I know there is the manager in the Utilities folder, and you can uninstall it with that. But this does not look scriptable to me. And I need a deployable method as there are about 300 Macs with it on. As usual, any help will be greatly appreciated.