Hi All,I am just thinking if there is a way to manage macOS Virtual Machines hosted on AWS by Jamf Pro?Also, what all the possible way to have macOS VMs and its management by Jamf pro?Thanks,Piyush Verma

Good Morning jamf Nation, We are rolling out SentinelOne agent to Macs. I have the policy set, but I need some assistance with "pre-approving" the SentinelOne Agent kernel extension. The S1 setup guide gives a parameter to enter in the policy: Kext Bundle ID: com.sentinelone.sentinel-kext Developer ID: 4AYE5J54KN I just don't know where to put the parameter. I tried copying and pasting it into Execute Command under Files and Processes, but that change doesn't 'approve' the agent. Based on the log file, it looks like it's trying to run the parameter, but then fails? Any ideas?

I've been tasked with setting up AD Certificates for Macs and after working a bit on it I now have it working where the computer gets a config profile installed that then requests from AD a certificate. Everything is working fine, but now I am at the point where I am not sure what needs to be done when the certificate expires 1-year from now. I need some type of workflow for renewing these as it will be impossible to keep track of all the expiration dates. After doing some searching on JN, there are some posts a few years old where users recommend scripting this, but there was no one that could get it working. There is also a feature request to have the JSS auto renew, but that is from 2013 and I don't think that will happen. If anyone is out there who has put together a workflow for getting this to work I would love to hear about it.

I find the progress... circle(?) doesn't give users much feedback as to where a self service policy is at in terms of completion, other than just waiting for it to stop and a quick done over the button. It would be great if the policies could have an actual progress bar, even if it's not super precise. Would anyone else find this useful?

We've been noticing a good amount of students downloading and launching .app files from their Desktop and Downloads folders. Is there a good way to prevent .app files from launching from these folders? I have been using Restricted Software, but it is a large amount of work to up keep. I am now messing with Configuration Profiles with Application Restrictions, but it doesn't seem to be working as I hoped. Right now I have ~/Users/Desktop and ~/Users/Downloads in the Disallow Folder. Nothing is currently set in Allow Apps or Allowed Folder. With these settings it seems as if every app no matter the location is being blocked. Are the Allow Apps or Allowed Folder options required when messing with these settings? My main goal is to prevent applications from running in a users Desktop or Downloads folder. This seems to be the typical location that students have been saving/running from. We are running 9.6.1 of the JSS. Thank you in advance!

Hi Everyone, I'm reaching out in the need of assistance. I'm currently working on the migration of 300 AD bound macs. The scenario is the following: -All 300 Macs are joined to old domain with network accounts and need to be migrated to the new domain without deleting their user data and making sure it has the correct permissions. -Currently their is no FileVault enabled. -I've been looking into scripts or some sort of automation that could help me un-join from the old domain, re-join to the new domain and move the user's profile with the same naming convention over to the new domain. Any help on this would be greatly appreciate it, as I would like to publish this script on self service to do this on all the Macs that need to be migrated. I'm no expert in JAMF, but I understand the concepts and have been using it for a while now. So detailed explanation would be greatly appreciate it. Thanks for everyone's time on this threat, thanks in advanced. Please feel free to have any

Hi,Is there a way to make OSX auto-trust Microsoft Remote Desktop Connection (to specific addresses) regardless of certificate in JAMF? I know the client can hit view certificate and click always trust but is there a way to automate this or have a policy that always allows this?Thanks

Hi Everyone,I want to be able to block USB Storage devices via JAMF does anyone know if this is possible with JAMF?I can see there's a restriction setting when creating a config profile but this is now depreciated... Thanks in advance for any advice!

Hi all,Looking for advice with my 'Off-boarding Script'Description:This script (below) is crafted for system administrators utilizing Jamf Pro to facilitate the remote off-boarding of Mac devices that end users have purchased. It performs several functions to ensure the device is no longer managed or configured for enterprise use. The script automates the removal of management settings, promotes the current user to admin, creates backup accounts, and eliminates no longer necessary accounts and management software. Furthermore, it updates the device's details in Jamf Pro's inventory, sends essential information to a Google Sheet, and concludes by removing the Jamf management framework, making the process as hands-off as possible. #!/bin/bash # Functions removePolicyBanner() { if [ -e "/Library/Security/PolicyBanner.rtfd" ]; then echo "Found PolicyBanner... Removing PolicyBanner" rm -rf "/Library/Security/PolicyBanner.rtfd" else echo "No PolicyBanne

My 30-day deferral of Sonoma in my Jamf Pro Restrictions profile should have lapsed by now (October 26th marked ~30 days since Sonoma dropped, right?), but my Macs that are scoped to a 30-day deferral still dont see Sonoma in the SU Settings pane on Ventura 13.6.x or softwareupdate cli tools. Any thoughts on this? Anyone else experienced this?

I'm experimenting with patch management and I've set one up to be available via self service. My only problem so far is that the name I've set in Jamf Pro is not matching in self service. I'm not sure where it's pulling this name from, except for maybe the repository from Jamf. Has anyone else seen this? 

Hi fellow admins,It's the first time I have to update our iPad inventory since the release of Version11.0.1-t1698068630 and I'm encountering a problem:It applies changes to the information, such as username, but won't remove the iPads I had deleted from the list. There are no error message concerning the .csv upload. I've tried several times, with different browsers to no avail.Is it a known issue and is there a workaround?Thank you Suzane

I created a free tool to get the LAPS password for a Mac. This is designed for IT admins or Helpdesk staff.Check it out here https://github.com/kylejericson/Jamf-LAPS-Bootstrapper  

I created a custom patch title for Egnyte Connect, but for some reason, it still won't pull info to start patching. I have checked Macs and the custom extension attribute has run and gotten a value for a few Macs.  

All, I've been searching for a way to remove Office 365 which included Word, Excel, PowerPoint, Outlook, OneDrive, Teams and MAU from macOS.I'd came across these two script office-2016-removal-script and post by sbirdsley.Below is their script that I've add Teams and OneDrive, Let me know if I'm missing anything. #!/bin/bash USERNAME=$(ls -l /dev/console | awk '{print $3}') if [[ $EUID -ne 0 ]]; then echo -e " ROOT PRIVILEDGES NEEDED! You have to run this script as root. Aborting... " exit 1 else echo -e " ################################### Office 365 for Mac uninstaller ################################### " sleep 4 echo -e " ------------- WARNING ------------- Your Outlook data will be wiped. Press CTRL+C in 5 seconds to ABORT ----------------------------------- " sleep 6 # commands out of the official guide from microsoft # source https://support.office.com/en-us/article/Uninstall-Office

Is there any way to manage Screen Time/Downtime settings through JamfPro. I work at a school with a 1-1 MacBook Air program and our we want to set the computers to be unavailable during late night hours. I used to be able to manage this with a parental control config profile, but those don't seem to work under Ventura/Sonoma. Has anyone figured out a way to setup downtime hours on MacOS through Jamf Pro? Thanks!

Hello Everyone,As part of providing solution to a use case, we wanted to prevent user to create new profile in Safari 17. As per attached image, is there any setting in MDM using which we can disable this 'Start using Profiles' button  ? Thanks in advance ! 

I'm testing RealVNC Server for some of our users.When I install the Server App it asks for a bunch of approvals for pppc settings things like Accessibilty, and Screen Recording and when I look in there I see that these have been given to vncagentI used the PPPC utility to get the info for Identifier and Code Requirement and made the settings in a Jamf Configuration profile but it didn't seem to effect the computer as when I install it still prompts me for those settings.So, I created a configuration profile with PPPC Utility, and used the upload feature in Jamf Pro configuration profiles area.  That profile looks the same as mine but again still not working on the client as I still get promptedHere's screen shots of the Configuration Profile in Jamf  Any ideas on what might be the issue?  

I've setup the latest integration between Jamf Pro & inTune for Device Compliance.This is working as I can see the device in Azure as showing as compliant when I check the users devices.When I create a conditional access policy to grant access to compliant devices and one of these compliant devices tries to connect, the conditional access policy is showing as "Not Satisfied" "Require compliant device".Has anyone setup the jamf & inTune device compliance and have conditional access policies in place which are reporting that the mac device is indeed compliant, more than likely a issue with Microsoft but just want to check at least someone in the world has all this interaction working correctly & successfully with conditional access policies ? 

Happy Monday All!My organization has about 40 TVs scattered across 21 locations all over the Upper Midwest (Minnesota, Illinois, Iowa, Missouri, North Dakota and Wisconsin). TVs are generally used in the common areas of our locations to display video content for customers and in employee break rooms.Less then a dozen of the TVs were purchased through our business account with Apple and show up in ABM and JAMF. The other 30 or so TVs were purchased from various 3rd party retailers and of course do not show up in ABM or JAMF.We've recently learned that employees at our locations have been signing into their personal AppleIDs on the TVs and signing into their personal Netflix/Hulu/HBO accounts. We want to prevent this and standardize the video content experience at each location. (We have a solution in place for the content part.)So my question is this--how can I add all of these rouge 3rd party purchased TVs to JAMF? I am hoping that it can be done remotely and that I do not have t

Hello everyone,I'm new to Jamf and Jamf Protect, and I'm experiencing some difficulties creating profiles to ensure compliance with the CIS benchmark. While I've managed to make some profiles, there are specific baseline policies that I'm uncertain about. I want to enhance the security of Mac devices and enable the necessary roles. Can you please assist me with this?Thank you!

Hi, Bit of a noob here. I'm deploying a PKG via Self Service which works fine. I then want to run a "defaults write" command afterwards to set a default for the app. In my policy I added the app and then a script to run the command. Both show as successful but on the system I see no evidence of the defaults command actually doing anything. If I run the command via terminal it does what I expect. Any clues as to what I am doing wrong? Thanks

Hello, With Sonoma releasing soon, I wanted to dive into the new Software Updates feature. However, I am worried about enabling this feature and having pending updates messed up. Is there a way to see what these "in-flight updates" are for specifically? The guide below has the following warning. It seems like if I enable Software Updates Beta, I would have to re-deploy these updates, but since it is unclear what these updates are, I hesitate to enable it and ruin any pending updates I am not aware of. "Warning: Enabling the (Beta) managed software updates feature will cancel any in-flight updates. In-flight updates include any update commands that have been deployed from Jamf Pro but have not yet completed on the end user device. You can re-deploy these updates with the new experience."Any one know where I can find out specifically what these in-flight updates are for? (Beta) Updating macOS Using Managed Software Updates 

I have had two 14-inch M1 MacBook Pros run into issues applying minor updates. One was going from 13.5.2 to 13.6 and the other was 12.6.9 to 12.7.1. The Ventura machine never made it to 13.6, but the Monterey machine did manage to finish updating to 12.7.1. The authenticated restart allowed it to even check-in/inventory with Jamf.In both cases it appears that something went wrong and the result is that video doesn't work. The video cuts out as soon as your try to go past the initial startup chime and Apple logo. Holding the power key down displays the messages to get into startup options, but loading startup options is the last thing you see before it disappears. It seems like there is something wrong with the iBoot, but I am not sure what I can do about that.The only thing that works is to DFU revive the machine and go directly into recovery. If you select the SSD as a startup disk the issue returns and you have to DFU all over again. At that point you share the disk and get their dat

Hi All! I've recently run into the issue of users receiving an admin popup when trying to print. Of course I've found the solution of adding the users to the printer admin group. My main question is two-fold. 1. Is there a better way to do this, without adding them to the printer admin group? I've found some information around creating a custom CUPS policy that allows regular users to have more rights around printing, but haven't researched exactly what's going to be needed here, as it seemed like it was going to be very complex and time intensive to make work correctly.2. What risks are present from adding users to the printer admin group? The info I found regarding the CUPS policy pointed towards users being able to add and remove printers, meaning they can run printer install packages as root. This info i found was a little dated and I am not sure how much of that info may have changed in the meantime with recent OSes.Any help is greatly appreciated!