Hi all, I have several users how are getting a pop up wanting them to register with jamf aad. It gives a pop wanting them to sign in and then grant key chain access, but the users have done this at first log in, and I have managed it clear cache's etc to get the mac back to to this fresh state and sign back into the SSO and register it in keychain. Nothing works and the pop up's still happen. User's can force quit the pop up, but it will re-appear within an hour. I have added their machines to the exception list of the policy to notify them to register, but this didn't stop it, and they are showing as configured in the intune portal and compliant, so I cannot find any reason for this pop up to keep appearing. It's not stopping the users doing their jobs, but it is very annoying. Double so for me as it's not even happening to everyone! Has anyone seen this issue and if so do you have a fix? users are running latest ventura, but we aren't using the most up to date jamf pro

I've recently got Jamf Connect up and running in our educational institution's lab machines, and while it's working smoothly logging in with Google IDP for the most part I've had a few encounters now with a mysterious error when students are logging into machines they already have a pre-existing local account on.The users' network password authenticates fine, but then instead of logging in it puts up a password box which just says "Verify", and while I'm aware that this is meant to be because the users' network and local accounts are out of sync and it needs the old local account password to verify the users' identity, the verify password box rejects everything ... old passwords and new. It leaves the user completely unable to login to the device.I've experienced this today with a student who logged into that device completely fine on Friday, and has come back on Monday morning to find this happening on the device. Neither the network or local password have changed over the weekend, so

An under-the-hood look at Setup Your Mac for Jamf Pro Admins prior to production implementationIntroductionApple’s Automated Device Enrollment helps streamline Mobile Device Management (MDM) enrollment and device Supervision during activation, enabling IT to manage enterprise devices with “zero touch.”Setup Your Mac aims to simplify initial device configuration by leveraging swiftDialog and Jamf Pro Policy Custom Events to allow end-users to self-complete Mac setup post-enrollment.Continue reading …

Hi there,we are experiencing more and more problems with our students changing settings on our iPads in order to mess them up for the following classes.Examples of this include:- changing operating language and keyboard settings (e.g. into Mandarin or Russian, so that the students may not even find the way back to dissolving the language settings)- activating guided access so that the iPad is basically in lockdown for future classmates- changing background graphics or sound settings- ... I have tried to restrict as many options in the payload settings in the respective profiles, but I cannot seem to restrict more of the access to the settings portion.Is there any workaround here?Thanks already in advance for any helpful tips!Max PS: ideally, the students could still be able to access the Wi-Fi networks to switch between two different Wi-Fis that we have installed.

Awhile ago I created a local JSS user that was solely for the purpose of using its credentials in scripts to perform actions via the API, namely updating the value for specific extension attributes within a computer record. I want this user to be as limited as possible since its credentials may be exposed in clear text in scripts. In 9.62 this was working fine with the user only having create, read, and update privileges for computer objects. This broke when updating to 9.81. Is anyone doing something similar and can verify what privileges are needed? I tried adding delete for computer objects, as well as CRUD for computer extension attributes, but still no luck. Here is the command I'm running and the associated output, which you can see states "Not authorized for a user PUT": curl -k -v -u username:password https://jss.url:8443/JSSResource/computers/name/TaggartJ-M0L5A /subset/extensionattributes -T /tmp/ea.xml -X PUT * Hostname was NOT found in DNS cache % Total % Rece

I'd love to be able to have a script to update the password for our local admin account on all devices. I know some people here were able to get this working, but that thread is a few OSes old and I assume based on the age that it's no longer applicable.

One picture says it all: 

Today Slack released version 4.0 (https://slack.com/release-notes/mac]) that finally allows Mac admins to easily control the auto-update functionality via plist and Configuration Profile in Jamf. (Woo!) After chatting with support briefly you can disable auto-updates by running: defaults write com.tinyspeck.slackmacgap SlackNoAutoUpdates -bool YES

Is the Jamf Protect Dashboard inaccessible for anyone else right now? I cannot login, getting unexpected error. When logged in, getting slow loading times & "unexpected error" pop-up at the bottom of the window.This is occurring across 3 separate environments for me, Jamf support has claimed nothing but I'm interested if anyone else has experienced this today.

Hello all, My boss wants me to setup device auto enrollment in JAMF and i have never done anything like this before if anyone can please guide me that would be amazing, he told me that we will need to upload jamf connect as a pkg file but when i tried doing that it says "upload failed, package undefined" 

Hello there,I would like to recover locally if a Mac has or hasn't escrowed its FV key through an extension Attribute to build a counter Security checks for further actions. Is there any file status that I could specifically target or any script out there that would allow to do this please ?Thanks all!   

Hi All,Anyone who got a solution for this problem? We have units who do not check in anymore and we get an error "Device Signature Failed" when we run commands like sudo jamf policy.Devices were bought from Apple and we have Apple Business Manager set up so that all the new equipment are already onboarded to JAMF.Profile removal is disabled so that users cannot remove the MDM profile, but this backfired on a troubleshooting perspective since we can't remove the faulty profile and re-enroll the device. Re-enrolling via self enrollment (email with a link) fails as wellCommand sudo profiles renew -type enrollment does nothing is reformat and re-enrollment the only route now?

Hi there,Last year we introduced Google Workspace Federated Managed Apple IDs into our environment to negate the use of personal Apple IDs. Dealing with activation locks were particularly tedious on those personal Apple ID linked devices so we opted for making use of Managed Apple IDs since they do not have Find My functionality associated with them. Logically this should resolve the activation lock issue and also allow users to make use of some iCloud related functions.The behaviour we saw as a result was a 70% uptick of devices triggering activation lock that when formatted both through Jamf Pro or directly in-OS using the erase or format functions. The difference with these activation locks is that they ask for the last iCloud signin used but do not have the hint i.e "s*****z@icloud.com" and since Managed Apple IDs don't support Find My the devices cannot be unlocked even if we use the Managed Apple ID credentials.Most logical response then would be to use the activation lock bypass

Hi Team, I am trying to get the JAMF Connect information through Google App Script there is an issue is there to get the information into the Google Sheet.I want the same into the Power Automate to get only the JAMF connect -Display Name. Appscript for your reference function fetchJamfComputersData() { var sheetName = "JamfComputers"; var sheet = getOrCreateSheet(sheetName); if (!sheet) { Logger.log("Failed to access or create the sheet."); return; } var jamfProUrl = "https://URL/JSSResource/computers/subset/basic"; var jamfConnectUrl = "https://URL/JSSResource/jamfConnectDirectoryBindings"; var headers = { "Authorization": "Bearer Token_Information", "Accept": "application/json" }; try { var jamfProData = fetchData(jamfProUrl, headers); var jamfConnectData = fetchData(jamfConnectUrl, headers); var computers = jamfProData.computers; if (computers && computers.length > 0) { var output = [];

Hi All,I have noticed a strange issue after upgrading to 12.4. Post upgrade, automatically the device's registration status has been changed to "Unregistered". I tried registering the device from self-service portal and it got registered. However, compliance information is not getting updated in AAD and due to that unable to access office resources. I did force update of sending Intune integration logs from Jamf Pro --> Device's history --> "macOS Intune Integration Logs" and it's sending the update to Intune. Somehow the compliance is not getting changed.As part of troubleshooting deleted both the entries from AAD and re-registered the device but still the compliance is not getting updated. Any help is much appreciated.

Hello. Our Sonoma testing has been good, for the most part, but I was curious if there's a Jamf config profile that can help resolve this Print Center pop-up. It occurs every single time I try to print.

I thought I had the password syncing working in Jamf Connect with Google but it seems I don't.When I log in to the Mac via Jamf Connect Google I click the Connect button on Jamf Connect Menubar and I get this error.Yes, the cert deployed via Jamf Pro is set to Allow all app access. I have also tested running this command in terminal via @rabbitt LDAPTLS_IDENTITY="LDAP Client" ldapsearch -uLLL -w USERPASSWORDGOESHERE -D 'USERNAME@GOOGLEDOMAIN.EXT' -H ldaps://ldap.google.com -b 'dc=USERNAME@GOOGLEDOMAIN.EXT'I get this error when running this with my username and password replaced above.I have re-created the LDAP cert in Google over 4 times and Yes it's turned on. Is there anything else I'm missing to make this work?

Hi all, I want to implement MacOS LAPS by Joshua D Miller. However i want so that the MacOS LAPS only consist of characters and numbers (up to 17 characters as well).How do i do this?I managed to create a policy to install the MacOS LAPS package in jamf pro (cloud). I install the swift binary package of MacOS LAPS. and I create another policy (that run weekly) to reset the password    

Hi all,I am managing all of our company macs through Jamf however the pre-stage enrollment was previously set up by someone no longer in the company so I don't know what the password is for the local admin account. 1. Is there a way to view the already set passwordor2. If I change what is in the password boxes, will it then sync and change the password for the local accounts on the machines already enrolled?Thanks

Has anyone experienced an issue with any applications repeatedly getting uninstalled from their Mac? We have a user whose zoom keeps getting uninstalled repeatedly. 

Apple released macOS 14.1 today. On my Macs running Sonoma, this update is being deferred by our minor macOS update deferral profile. On Macs that have not yet been upgraded to Sonoma, macOS 14.1 is showing up in Software Update to install. Before today, Sonoma was being deferred. Why would 14.1 not be deferred? For a Mac running Ventura, any version of Sonoma should be considered to be a major macOS upgrade. Is there an adjustment that I need to make?

Hi there. In order to keep our extension attributes up-to-date, we have added a recon policy, to run once daily, with a script called as follows; #!/bin/sh /usr/local/bin/jamf recon exit 0 When I run this script locally on macs, the recon command updates the extension attributes correctly, populating the database with the expected results, but when it runs as a policy, all the results are cleared out leaving no information in the extension attribute fields. Can anyone help to shed light on this or advise how I can force an update to the extension attributes? Thanks

I'm trying to run a VERY simple script that mounts a folder based on user login - open "smb://server/staffhome$/$(whoami)"This works perfectly in terminal but when putting it as a process to execute on login it keeps on being unable to find the location?

Im getting ready to go-live with FV2 and PRKs this fall. Doing final testing and documentation now.I had a FV2 Mac ‘on-ice’ for a few weeks for testing. It was shut down and left alone on purpose to test a few things. When I booted it up, I noticed the PRK escrowed in Jamf did NOT match the PRK on the laptop (I am testing a Smart Group to report this, which was accurate). Questions about this observation:-Did the act of leaving the Mac dormant for a long time cause the PRKS to get out-of-sync?-Do escrowed PRKs automatically rotate over time?-Does the act of viewing the PRK in Jamf Pro cause the PRK to rotate?-If I would have let the Mac sit a while to run a recon, check for policies etc, would the escrowed PRK get set on the Mac eventually?

Heya folks. I had a previous post about Adobe CC with a lot of helpful feedback. I've gotten to a point where I was able to succesfully deploy and download applications via Mac Apps (Hooray!) but for individual Adobe products such as Photoshop and Illustrator, this was not working in that once installed the credentials I used to sign in was not recognized as being an Education account and I was granted only a trial.Whereas when I create a package via Adobe CC Admin portal, pick my apps and install, when I log into after an install this way, Adobe recognizes my credential. So, after setting up my distribution point with Jamf Cloud and creating a package with the .pkg from the latest package build in Adobe Admin, I pushed it down to Self-Service with a policy.I see Adobe CC in self-service and i go to install it and it takes about 8 to 10 minutes before it ultimately fails. When I go to the details in Jamf, all I get is...Installation failed. The installer reported: installer: Package na