We are rolling our Jamf Remote Assist and trying to wipe out some legacy Screen Sharing settings we set a while back. I want to disable the ability for our team to use the built in Screen Sharing app to remote into user's computers for support. Looking for a way to script the changes necessary or maybe delete a plist etc? My original code I found on jamfnation years ago to set this up is below:  /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users otheruser,Administrator -access -on -privs -all/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all 

Hello Jamf Community,Is there a maximum value for the Integer type of extension attributes?If it exists, what is the maximum value?What happens if you set a value that exceeds the maximum value?Where can I find information about the maximum value?

I implemented the login banner (placed PolicyBanner.rtf in /Library/Security). However, it shows only on logout and not at login. How do I show it only on login? Is there an option to log out if not accepted?

I'm not actually having a problem with something but I was playing around with being able to find a substring from the output of a variable. I can't get this to give me the expected result. #!/bin/zsh proc=$(system_profiler SPHardwareDataType | grep "Chip:" | /usr/bin/awk '{print $2,$3,$4}') echo $proc if [ "$proc" = *"M2"* ]; then echo "M2 processor installed" else echo "unknown" fi The correct result should be "M2 processor installed". I get "unknown".  I looked up how to do this and found this site: https://linuxize.com/post/how-to-check-if-string-contains-substring-in-bash/ After reading that site I changed my conditional statement to match the syntax in the article. #!/bin/zsh proc=$(system_profiler SPHardwareDataType | grep "Chip:" | /usr/bin/awk '{print $2,$3,$4}') echo "$proc" if [[ "$proc" = *"M2"* ]]; then echo "M2 Processor installed" else echo "unknown" fi This works. The only change I made was to use "[[ ]]" instead of "[ ]". I have written a lot of conditi

Hi!Our middle schoolers are 1 to 1 w/ iPads and are able to add apps from Self Service and delete apps not needed. This helps them to self-manage free space on their devicesIs there a way using an app configuration to prevent deletion of one specific app?we already have this box UNCHECKED but it does not prevent the app from being deleted (🫤): “Allow users to remove app (iOS 14 or later) Allows the user to remove this app from a device. The app is not removed from the App Catalog in Jamf Pro.”Thanks!sandy 

While we wait to hear from the vendor, has anybody deployed the Amplify browser extension for Edge and Chrome?  I did find a chat in here to add Nexthink and just modified it to use the code for amplify, but it didn't add the extension. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ExtensionSettings</key> <dict> <key>bmpbcphgifhfkfjioddeenggdpffbgek</key> <dict> <key>installation_mode</key> <string>force_installed</string> <key>update_url</key> <string>https://clients2.google.com/service/update2/crx</string> </dict> </dict> </dict> </plist>

Vulnerability may exist everywhere the shebang '#!/bin/zsh' is being used sans '--no-rcs' Background While the description for CVE-2024-27301 accurately references Jordy Witteman’s macOS Support App, the vulnerability may exist everywhere the shebang #!/bin/zsh is being used sans --no-rcs. Continue reading …

I'm curious as to how many people in this community are using Jamf Protect? If so, are you using it stand alone? Do you supplement it with anything?

We are testing out Jamf Protect and also leverage Microsoft ATP (Microsoft Defender and ATP) currently. Is there any concerns for performance issues with both of these solutions running side by side? 

Was able to do the following while exploring Microsoft Entra Github login option.Has anyone encountered this? Any solutions out there to prevent? 

I need to migrate a user from iPhone A to iPhone B.Both phones are managed and supervised through Pre-Stage Enrollment and both run iOS 16.x.I have tried making a backup of A using Apple Configurator. However restoring to B from Configurator fails consistently.Quick Start appears to run very quickly but does not seem to transfer apps or data. Will they appear after the user logs into iCloud?Is a full migration even possible at all? I see q's from over a year ago, but can't find any migration guidelines from Jamf.Thanks! 

Guys, anybody here done a sustainable software restriction for their environment?I followed some tips here, from old threads, and it basically rotated around the concept of restricting the "installer" app. I understand that blocking software per title would have been the best course, but I just don't see it being sustainable as there could be non-mainstream software that we haven't heard of and they end up getting installed without resistance. To further, we just don't know how much we can restrict per tenant/account, please correct me if I am mistaken.With restricting the "installer" app, I noticed that you can still install apps from Self Service without issues, provided that the said apps came from Jamf catalog or Apple store. If you upload a package and have a policy to install it, then add it on Self Service, the restrictions will kick in. This has been the challenge for us since we have software that are not in the built-in catalogs so we have to install them via policy: Sentinel

Hello,I am trying to configure a profile to lock users laptop screen soon as they close the laptop lid, any help on how to do that?

Hello, I have a lot of mac apps in self service, but some set to install automatically that are used by everyone in the company. This works fine on devices that have gone through automated device enrollment, but when enrolling via user (either URL or email) it does not install these apps. It does get the self service portal, can download some from there, getting the mdm profile, required policies etc. Just not installing apps automatically. Am I missing something? Does this need to be enabled elsewhere?

I've read a previous post that stated to reset the PRAM/NVRAM, which did not work. Here's the error:Things we have tried.Reset NVRAM/PRAMUn-assigned from ABM then Re-assiged. Once completed, renewed the DEP token Enabled Debug Mode,  replicated the issue for about 15-20 minutes. Disabled debug mode and then download the Jamf Pro Server log. Uploaded to Jamf support caseJamf support stated there was an APNs mismatch, but we confirmed afterwards there was not.Ran First-Aid within macOS RecoveryFully wiped the disk and cleanly installed macOSIn Jamf Pro, un-assigned the machine from PreStage, save changes, wait 10-15 minutes and then assigned it back.Jamf support is now trying to say it's an issue with Apple and to contact Apple.Not sure what to do at this point, but I'd appreciate any help.

We have a public application and an enterprise application on the public App store. Both can be navigated to directly by URL, the only difference is that the public application can also be searched for by name in the app store. However, in JAMF Now, only the public application comes up. We can search for that app by id or name and the search works. But entering the id or name of the enterprise listing does not work. We're not using Apple Business Manager or any other private distribution channel - the listing is public, just not searchable because the app does not allow for self-enrollment by the public, but rather is only accessible to users at our company's corporate customers. This is relatively new, but Apple is now forcing all new enterprise-targeted apps down this path, so it seems critical to support. How can I distribute an enterprise app store listing in JAMF Now?

Hey y'all! I'm currently testing out the Jamf Pro Cloud Software Update Beta feature. I allowed 3 deferrals on the install of a minor update. I did this in case of users, unbeknownst to IT, were using the computers at this time. However, I'm wondering the following: in case no one is at the computer to "defer", do the updates just not happen?

Hello Community,if anyone needs to show the last time machine backup date as an extension attribute, I wrote the following code which is working fine with OSX 12.3 and higher.It also works when more then one backup volume is configured, it shows the most recent backup date among all backup volumes.The response is in the format yyyy-mm-dd hh:mm:ss______________________#!/bin/sh# time machine can have several backup destinations. We loop through all of them and get the most recent backup# we use plutil, because PlistBuddy automatically makes date-format conversions that we don't want# plutil option raw is available only with MacOS 12.3 onwards# we check the correctness of the plist with PlistBuddy, because plutil throws an error and aborts the code when the plist is not well formated or the entry doe not exist# scripted by valentin burgissersuccess=falseentry="$(/usr/libexec/PlistBuddy -c "Print Destinations" /Library/Preferences/com.apple.TimeMachine.plist)"if [[ ${entry} != "" ]]thende

Jamf Setup and Jamf Reset 3.2.0 are now available!New versions of Jamf Setup and Jamf Reset apps were released today (3.2.0), and are available for download from Apple Business Manager or Apple School Manager. Check out the details below on what's new. Removal of Basic Authentication:As communicated in the 3.0.0 release notes in May 2021, Basic Authentication was deprecated from Jamf Setup and Jamf Reset.In the new 3.2.0 versions, the Legacy Compatibility AppConfig key was removed, which previously allowed customers to continue use of basic authentication with older versions of the apps (com.jamf.config.legacy-compatibility).If you have not yet switched to OAuth, please follow our documentation to do so prior to deploying the new apps in your environment. Single Login Preview Workflow Updates:In order to simplify the next user’s login experience, in Jamf Reset 3.2.0, the success screen seen after logout now provides a link to the Jamf Setup app.To address a product issue wher

Hello together,Is there a possibility with Jamf Parent to extend the allowed website, I mean if you as a teacher could also decide to visit more than just the deposited homepage, for example, or is that how it is meant to be?For example, if the teachers open the page https://antolin.westermann.de/, then this link must be stored and if the teachers want to open another tab on the same page, then the process must be cancelled and a new link must be copied again. https://antolin.westermann.de/all/booknewest.jspI thought it might be easier if the teachers could decide whether only this one page could be used or whether the children could open several tabskind regardsNorbert

HiI have seen a number of post on here around people woes with customising docks using dockutil and the reliablitiy off it.I have been trying to use outset https://github.com/macadmins/outset to help with getting it lauch better. I have got my dockutil script into the login once folder but nothing happens.Has anyone doing something smiliar and shed any light where I might be going wrong.Thanks

Hey all,Is it possible, preferably without using the API, to get a list of Jamf groups for a user based on the account they used to sign into Self Service?Our field techs have 2 users ID's in JSS; one is a standard user account, the other an elevated permissions account. The techs are all members of a JSS static group (Field Techs)I have a Self Service policy that runs a script.  The script captures the user ID of the person signed into Self Service. If someone signs in with a standard user account, the script behaves in a particular way.  If they sign in using the elevated account, the script modifies its behavior to enable certain options for the field techs.The goal there was to modify the script behavior based on whether it was a standard account or elevated account that signed in, so that if a non-Field tech user signed in they would see a limited version of the script functions.My problem is that techs tend to sign in with their standard user account more often than the

We are now being tasked by Security Dept to use the DUO MFA app on Mac's. So far so good and it actually works through trial(s) and error(s).Does anyone know how to push this out via JAMF? I'm sure it is a script. If anyone is having trouble installing DUO MFA on your MBP, please reach out to me and I can help you. 

Hi, I've come across the installomator and seems like a decent piece of kit I could use to achieve what I want.  However, i'm newbie to Jamf and installomator so if anyone has experience on how I can go about setting this and getting it up and running would be much appreciated.

The below link from Global protect helped in configuring the Jamf Deployment. https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-jamf/deploy-the-globalprotect-mobile-app-using-jamf