We have a Lightspeed Rocket Appliance and Mobile Filtering setup. We have had issues that when an IOS update is applied it breaks the Mobile Filter and the only way to re-instate it is to reopen the Lighspeed Mobile Filter App. We have everything setup correctly and push the App out via Jamf. Lightspeed support confirmed that today which really makes it useless for the amount of devices we have as its a K through 12 enviroment. Lightspeed has a new product called Relay that is cloud based and independent of the school network. Anyone using this product?

HI there,We've been using a script to set the computer name on devices in the format of 'fullname-model'. This script has been working fine up until Sonoma where it breaks by not providing the full name variable. The only script that seems to work at the moment is one that pulls the username instead but this is not ideal for our environment due to some historic devices having usernames completely unrelated to the user.Is anyone using a script that is able to pull full name from a source that works on Monterey, Ventura and Sonoma in the 'fullName-model' format?This is what we have now#!/bin/bash userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }') echo $userName model=$(system_profiler SPHardwareDataType | grep "Model Name:" | sed 's/.*://' | tr -d " \\t\\n\\r") echo $model serialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') echo $serialNumber name=$userName-$model-$serialNumber echo $name scutil --set HostName "${name}" scutil --set LocalHostN

Today we released Jamf Connect 2.29.0. This release includes the following changes and improvements: The Jamf Connect menu bar app's user agent header string now includes the user's platform for Okta and Google. Additionally, the Jamf Connect login window and Jamf Connect Configuration also provide user agent strings that include the user's platform. [PI113140] The Open in Browser checkbox cannot be deselected while the Launch Browser (LaunchBrowser) setting is enabled. [PI113143] The Jamf Connect login window will no longer display a black screen when a new user logs in for the first time.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Connect team

I work for a school district and we use JAMF Pro to manage our fleet of M1 Macs and iPads. I'm currently using MacOS 13.5.2 on an M1 Mac with a Magic Keyboard. When at the log in page, if you quickly press the Touch ID key three times, an accessibility shortcuts panel appears where you can enable and disable settings. I'm trying to stop this box from appearing and having the options be toggled on or off. Disabling accessibility entirely within JAMF via a configuration profile doesn't stop students from being able to quickly press Touch ID three times to bring up the accessibility shortcuts box. I'm wondering if anyone knows of a work around to stop this from happening?Unchecking every option under Accessibility  > Shortcuts has no effect and neither does disabling keyboard shortcuts (which were already disabled). Any help would be greatly appreciated!Thanks

Can anyone tell me the benefit of going with Jamf's Cloud solution over On-Premise? I keep seeing plenty of issues with cloud based setups but haven't seen anyone running into these issues with on-premise.

Has anyone else seen "Unsupported InstallAction for majorOS update" in their management history? We're seeing a lot 13.5 -13.6 of clients showing that message for failed commands. We're using the new software updates experience, and also using SUPERMAN v4. Right now super is failing MDM workflows, and I think the two are related. super logs seem to indicate at least some successful MDM commands, but the actual update fails. Those logs look like:Thu Nov 02 10:17:36 MD-CLIENTNAME super[99878]: MDM: Successful macOS update/upgrade command request.Thu Nov 02 10:17:36 MD-CLIENTNAME super[99878]: Verbose Mode: Function install_macos_mdm: install_macos_mdm_api_error is: FALSEThu Nov 02 10:18:06 MD-CLIENTNAME super[99878]: MDM: Received push command "ScheduleOSUpdateScan", checking back after Jamf Pro's mandatory 5 minute delay...Thu Nov 02 10:18:06 MD-CLIENTNAME super[99878]: Verbose Mode: Function install_macos_mdm: install_macos_mdm_start_error is: FALSEThu Nov 02 10:23:18 MD-CLIENTNAM

What is incremental flushing? Why do I have to do it? Description of incremental flushing:To help with this also, perform incremental flushing. You will start one year and working your way back to a week. The process will be repeated 5-6 times and each flush time will differ depending on how much data there is within that time frame. - What is incremental flushing? Why do I have to do it?  

Hello guys, I wanted to let you know that we are currently in the process of deploying the Kerberos Single Sign-on Extension profile. However, we have encountered a situation where some local macOS accounts do not match their corresponding AD accounts. For instance, the macOS local account is named "doe" while the AD account is named "jdoe". I am concerned whether this will cause any issues during the rollout of Kerberos Single Sign-on Extension. I have conducted a test with a user named "test" whose AD username also happens to be "test", and it worked without any problems as they match. Nevertheless, I remain worried about potential complications arising from mismatched account names

Looking for a programmatic way of accomplishing this. I know historically this has been a complicated issue but I'm wondering if in the year of our Lord 2023 there have been any clever advances. Thank you allRyan

Hi Everyone,Fairly new to JAMF here. I have all our campus Ipads in Apple School Manager. They are linked to JAMF now. I see the Serial Number in JAMF. I make sure it is checked and the ipad does not pick up remote management despite erasing it a couple of times already. Is there a step I am missing?

Dear all,I have some enrolled devices with Jamf Pro and with a managed Apple ID with problems to synchronize with iCloud Drive. It says that Mac can not synchronize with iCloud Drive.I have not activated any restriction in Jamf for this purpose. And it appeared suddenly and only in specific computers.How can I manage options to be applied to each managed Apple ID. No options from Apple Business Manager, but possible to act from Jamf Pro?Thanks!!!!

The script I run to enable Remote Login and Remote Management has been the following:#!/bin/sh # enable remote management for ardadmin /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users adminuser -access -on -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -restart -agent -menu #enable remote login for ardadmin sudo /usr/sbin/systemsetup -setremotelogin on sudo dseditgroup -o edit -a adminuser -t user com.apple.access_ssh exit 0We just upgraded many of our computers to macOS Ventura.  I've noticed with macOS Ventura that when tryin

Hi Guys, working on a project where i need to force install certain extensions in Edge. They Keys are there and I have tried configuring using profile creator, JAMF JSON and BIll's JSON. No luck. Edge sees that its managed and allowed extensions install no problem. Blocked extensions are blocked, but those that should be force installed are not working. reaching out asking am I missing a recent change and if anyone has these working? TIA

We create a local user account for administrative tasks as part of our imaging. What we're seeing is that we'll receive a unit with some issues where we need to use that account, and the password won't work. This is not very common, but it is happening sometimes. We'd like to create an Extension Attribute that checks that account and validate if the expected password works, and if not, scope a policy to that smart group to reset it. I did see one slightly complex script here:http://www.yourownlinux.com/2015/08/how-to-check-if-username-and-password-are-valid-using-bash-script.html But it doesn't appear to work any more since the shadow hash is now under /var/db/dslocal/nodes/Default/users/<USERNAME>.plist Before I start working through that I wanted to check if anyone has any other suggestions/solutions. Thanks

Created this for myself and thought I would share. It should match all devices which will be unsupported by macOS Sonoma upon release. The benefit of matching unsupported instead of the other way around is that it should not need updated when new devices come out. If you need a smart group for supported devices instead then simply swap the operator to "does not match regex."To use, create a smart group named something like "macOS 14 Sonoma Unsupported Devices" with the following criteria:Model Identifier matches regex ^(iMac[1-9],\\d|iMac1[0-8],\\d|Macmini[1-7],\\d|MacPro[1-6],\\d|MacBook([1-9]|10),\\d|MacBookAir[1-7],\\d|MacBookPro[1-9],\\d|MacBookPro1[0-4],\\d)$  

We are a K12 private school. Our high school and middle school students are all using iPads to complete their schoolwork. Lately, we've had students come into our tech office that is having trouble taking and/or submitting tests. It turns out that quite a few have iPads at the lower limits of battery activating "low power mode", which stops background app refreshing causing them to be unable to continue their testing. Is there a way to disable Low Power Mode in Jamf Pro?

Hello,I have few iPad who get lock by activation lock, I would like to grab the code from command line ...I found that site https://github.com/dnikles/removeActivationLock who explain how to do ... but the Phyton part is not working when you have the SSO on console activated.. is there a direct API call we can do with the current version?

 Our current Nudge configuration. The Nudge button "Update Now" is only opening the MacOS Sonoma Installer application that requires admin credentials. It won't open the Self Service update policy that we have. We need the Self Service update because it doesn't require Admin credentials. The regular Sonoma app installer update just started requiring admin creds as of today for our Org so we can't use it anymore.  Anyone have the actionbuttonpath field working to open Self Service in Nudge?

As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I crea

I have a computer that is already in use, which just won't register correctly in Jamf. It's registered in DEP and assigned to Jamf Pro. In Jamf Pro, the serial number doesn't show up in device search. When I trigger the re-enrollement with the user ("sudo profiles renew -type enrollment") the enrollment-flow starts as expected.However, at the end it stops with an error message "Install profile failedYour computer is already enrolled in an MDM server and can only be enrolled in one MDM server at a time". In Jamf the serial number now shows up as "DEP - [SERIAL_NO]". The username in Jamf pro is not populated (though it was collected in the flow).Also, the `jamf` binary is not installed.In the user's System Settings, only 3 profiles are listed. They have names I don't recognize, but I can't remove them. However, it is stated that "This mac is supervised and managed by: Archipunt", so it might be old profiles from our MDM (the computer is bought in 2020, and we were using Jamf Pro bef

My company is about to deploy a bunch of machines. We have set up several prestage enrollments for the computers to be set to the proper building, department, etc. Is there a way to assign machines in bulk to a prestage with something like a csv file?

How do we set up a curfew from 9pm to 6am on student M1 MBA Macbook airs running Ventura or Sonoma?

Hello.  This is more of a Microsoft question, but i'm not having luck down that route yet. We want Jamf Cloud to manage all of our institutionally owned iPads with MDM.  We want Intune to manage all user-owned Apple devices with Application Protection Policies.  The problem is, users only have 1 account.  So if they sign into a corporate iPad, they get a mix of both Jamf MDM configuration profiles and Intune application protection policies on their corporate device.  We want the Intune Application Protection Policies to ONLY apply when a user signs in on a personally owned device, and not a Jamf managed device. I don't know if that is possible since scoping an Application Protection Policy is based on AD group.  If their ID is in that group then they get Intune App.  I don't see any other criteria to filter out a device if it is Jamf MDM managed. Has anyone run into this or found a solution? Thanks

Warning: I'm just learning how to script using The Odin Project. This is a crude, but so far is effective way of checking to see if my users are on a particular wifi network, and switch them over to another as needed.Problem: We're moving away from having static admin accounts deployed on our devices and are trialing the creation of just-in-time admin accounts when servicing a computer.For this to work, wifi needs to be enabled at the MacOS login screen (NoMAD 1.5). This is achieved by pushing out a computer level config profile with a wifi payload, Wifi A. So far so good. Wifi A is heavily restricted and does not allow general internet access.However, after the user logs in, they will then have access to our normal enterprise wifi - Wifi B.How can I then ensure that my users are always connected to Wifi B upon logging in? I decided to create a launch agent that runs every 60 seconds and checks for the currently connected wifi network. If the user is found

I have a policy in Self Service that deletes a "Temp" local user account and then recreates it. We use this for lending out laptops to students so that we can delete and re-add the account every time it is returned so that we can re-lend it out with a fresh account. I would like to apply a new policy that forces the "Temp" account user to reset their password once upon first login after the account has been recreated via self service. I was planning on using the command: pwpolicy -u "$LOGGEDINUSER" -setpolicy "newPasswordRequired=1"If I scope this command in policy to a smart group that looks for the Temp local account and then runs once per user at login will this accomplish what I need? The trick is I don't want this command to run when any other accounts login and only want it to run once when the Temp account logs in for the first time after being re-created and then only again when the account is removed and recreated and logged into for the first time once again. If I use a