Has anyone experienced an enrolled device, utilizing JAMF Connect, just *changing* the local password, even when no password change was initiated?Our users enroll devices with JAMF Connect and Google IdP. It creates a local account with the same password as their email. If they change their password to their Google account, JAMF Connect will yell at them to change the local password to match the new Google password- which is exactly how it's supposed to work.I have a bizarre situation that has occurred 3 separate times (once even to me) where the local password just changes on its own and locks the user out of their device. When I have the user login on a different device with their email password (which should be the password for the local account), they are successful, so it's not an issue of them typing their password incorrectly.I have assisted two people through the recovery process at this point. Even on the root level in recovery mode, it rejects that known password. Our only sa

I would like to have JAMF keep record of lease dates for all of our devices. I am planning to manually enter each lease date directly onto each device record. My question is if there is an easy way to be alerted when a device has this lease date removed (ex. when wiped) so that I know it needs to be added back. The relevant information I would need in these reports are the lease date and serial number. If there is any scripting to be done, I would love if I can be pointed in the right direction. Once I can get this set up, I will set up reports that will let me know when lease dates are nearly up.If there is another more useful way to ensure these lease dates stay on permanently, please let me know

Hi everyone!I've been spending so much time on this so I hope to find an answer in the Jamf community.Was anyone able to find a way to set a custom screensaver (a folder with 3 pictures in a loop) that works with macOS Ventura?I've got close to have it working with the below script, but I still need to manually go into System Settings - Screen Saver and choose "Classic", because it defaults to Ventura and I cannot find a way to fix this.Any help would be extremely appreciated!  #!/bin/sh ## get current user user=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' ) ## configure screensaver framework /usr/bin/sudo -u "$user" /usr/bin/defaults -currentHost write com.apple.screensaver moduleDict -dict moduleName -string "iLifeSlideshows" path -string "/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex" type -int 0 ## set key items for screensaver /usr/bin/sudo -u "$user" /usr/bin/defaults -currentHost write com.apple.scre

Hello all,We're working on forcing updates on our fleet and it seems the best way to do this reliably or at least with some feedback is via the managed-software-updates API (POST .../api/v1/managed-software-updates/plans. This at least provides us with variable options, including groups via single machines (which we use to test), as well as feedback as to what's happening to the machinesGET .../api/v1/managed-software-updates/plans?page=0&page-size=20&sort=planUuid%3Aasc' However I have a few questions: Using:"updateAction": "DOWNLOAD_INSTALL"and"versionType": "LATEST_MAJOR"my test machine has been stuck at "state" : "SchedulingOSUpdate"What can I expect as a next step, either for me the Jamf admin or on the user side? Why is it stuck at "Scheduling"?For a few machines I have:"state" : "PlanFailed""errorReasons" : [ "APPLE_SILICON_NO_ESCROW_KEY" ]Is this solvable? I also have:"state" : "PlanFailed""errorReasons" : [ "EXISTING_PLAN_FOR_DEVICE_IN_PRO

Hey all, I'm primarily a Windows admin, so bear with me on this one. I have an EDU client looking to install Creative Cloud apps via JAMF Cloud and am trying to figure out the proper way to push it to the machines. I am following the steps outlined here: https://docs.jamf.com/technical-papers/jamf-pro/adobe-creative-cloud/9.0/Deploying_Adobe_Creative_Cloud_for_Enterprise.html https://www.jamf.com/jamf-nation/articles/593/deploying-adobe-creative-cloud-packages But where I get hung up on is the manifest file. I created the installer package from the Adobe admin console, and it downloads as a zip with the "Build" and "Exceptions" folders, as well as the ".DS_Store", and "<name>.ccp" files. What is the Package actually looking for me to upload here? Do I need to capture or package anything separately? Seems like I'm chasing a red herring while looking through the folder structure for the proper file. Again, sorry for the igno

Hi,We are looking into the following scenarios: 1. Leverage a script or a jamf config where if someone attempts x amount of times of fail login attempts on a macbook, it lockouts out the machine. 2. We leverage OKTA IdP and Jamf Connect. How can we leverage this so password policies for lockouts are being enforced. Apple Builtin seems to leverage brute force which is varied for lockouts 

Does anyone have a solution installing the Creative Cloud Installer?We are finding that the first time our users open the application it attempts to update and immediately prompts the user for administrator credentials.  We are downloading the app package as an Adobe Self-Service package that allows users to install and update the Adobe apps without admin rights however the initial update of the Creative Cloud Installer requires admin rights.Any ideas?

Hi there, need assistance in scripting as have modified a script to download the creative cloud cleaner tool to /tmp/ and to run then delete after it has run. I am wanting this to run before the installer will run the Latest version of Adobe products as there are some Macs with two versions already installed:#!/bin/shVendorDMG="AdobeCreativeCloudCleanerTool.dmg"curl https://swupmf.adobe.com/webfeed/CleanerTool/mac/$VendorDMG -o /tmp/$VendorDMG# Mount the DMG Installer filehdiutil attach /tmp/$VendorDMG -nobrowse#Copy App to tmpsudo cp -pPR /Volumes/CleanerTool/Adobe\\ Creative\\ Cloud\\ Cleaner\\ Tool.app /tmp/#Run creative tool appecho "Running the CC Cleaner app with 'removeAll=All' option"/tmp/Adobe\\ Creative\\ Cloud\\ Cleaner\\ Tool.app/Contents/MacOS/Adobe\\ Creative\\ Cloud\\ Cleaner\\ Tool --removeAll=All --eulaAccepted=1#delete appsudo rm -rf /tmp/Adobe\\ Creative\\ Cloud\\ Cleaner\\ Tool.app# Unmount the DMG Installer filehdiutil detach -force /volumes/cleanerTool# Delete the

We are using Jamf Connect with Azure AAD. Our configuration is hybrid and I have all the correct settings I can find in various documents and previous posts. I've even rebuilt the configuration using Jamf Connect Configuration and get tokens while testing. Not sure what i'm doing wrong. I tried a version bump to version 2.21.0 and still have the same behavior.Anyone ran into this error when trying to connect using Jamf Connect Bar? This is happening on both Ventura and Monterey. 

With the Jamfs App Installers there is an option to "Install supporting configuration profiles". Jamf note that its not possible to see or modify those configuration profiles, however is it documented what each supporting profile is doing?For example if I want to deploy Microsoft Defender there are several profiles required is Jamf creating all of these? ie System extensions and full disk access?

Team,I am looking for a solid process that works for deploying a .pkg application via Casper which requires an .INI settings file to be ran along side. The .INI file contains the settings needed for the application to point to the correct server when installation completes. The application in question is Carbon Black.

Has anyone managed to find any documentation on the new onboarding in Jamf Pro 11? I’m looking to revisit our onboarding workflows but I cannot find any documentation.

Smtp-server send test message and I get test message.  All email notifications is enabled in profile, but I don't receive to email notifications.Why?  

Hi all,I'm trying to determine whether or not this is an Apple issue or a Jamf Pro issue. Here's what happens:During a PreStage enrollment, after entering credentials to do the enrollment, the machine will reboot to the login screen. There is no user present except the Jamf management user. After a wipe and macOS reinstall, it will work.I have also noticed that also intermittently, after wiping the Mac during the "Activate Mac" part, the error "An activation server cannot be found" will appear. Try to activate again a minute later, and it works. I've checked Apple's system status page when this happens and haven't noticed anything down at the time.It seems like these two events are related, but I haven't proven that conclusively. Has anyone else encountered this?

During Enrollment of a Sonoma MacBook, after Remote Management starts and our required Credentials are entered, it Skips creating the Local User Account. It goes straight to a Log-in Screen instead. We do push a hidden Admin Account via Script during Enrollment. I can Log-in with said hidden Admin Account at that new Log-in screen. We only see this issue with macOS 14.x (Sonoma). We can manually Enroll a Sonoma machine without issue. Only during Enrollment of a Sonoma system is it an issue.  For our current Setup, we need the ability to Create Local Users still.  Anyone else see this issue?  

Hello,I search if somebody knows where these informations are written in the mac. I don't find command line or path to import it. My purpose is to create an extension attribute in JamfPro with these data.If somebody could help me. :-)

Hi Everyone,I used takingmoose's JSON file (link: JSON file) to deploy Google Extensions with no problem two weeks ago.Suddenly, it's not working anymore. The Configuration Profile log shows completed, and I can see it from the Profiles list on Mac. But nothing is being added to Chrome. I tried on different Macs (new provisioned or existing ones). No luck. I also created different Configuration Profiles with other user's JSON files with no luck.I also have a Configuration Profile to disable Chrome print Preview, and it works fine. It's just this Extension profile not working at all.Any Suggestion? Thank you.Jack

Hi all, Updates of MacOS via Jamf have pretty much been broken for some time and is very apparent from the hundreds of posts about this on various forums. It is very much hit or miss whether the deployment of updates works across the estate causing a headache for admins who need to ensure devices are updated. Unfortunately Jamf 10 does not yet support all the new features that Sonoma has to offer (scheduled for Jamf 11 from what i've read) in particular the ability to enforce software updates by a certain date and time and users get additional information in System Settings when an update is requested and when it's enforced.  Has anyone been able to create a configuration profile to enforce updates by a deadline with the behaviour that Sonoma has to offer?.

Opened up a case with Jamf support, they are seeing this pop up . Check your devices, especially any new device enrolled into your Tenant.  I have tried all the previous possible commands to fix and none of them worked. 

Hi all. In order to comply with a content restriction I need to be able to enforce a blacklist for 10 or so websites. I currently have these websites listed in the Content Filter section in a Configuration Profile. I'm currently using the "Built In: Limit Adult Content" filter and adding the websites we blacklist.  I'm experiencing a problem where websites and content that our end users need to access is getting caught by the built in filter and therein becoming a barrier to how the iPads are used. I'm not seeing a quick way to only be able to blacklist websites without employing the built in filter. Does anyone know a way around this without using the "Built-in: Specific Websites Only" option and adding all of the websites that our end users would access?  

Hello. I wanted to setup some EAs for CrowdStrike, regarding the Version / agentID / customerID. The command to put in Terminal to gather this info is:sudo /Applications/Falcon.app/Contents/Resources/falconctl stats agent_infoI want to get this info into an EA, if possible. There was a script someone posted earlier this year, but it is not working for me for some reason. It was in this thread. When I deploy it via Jamf, the field for the EA remains blank. Although if I run the script directly from my Mac, it displays the customerID stat just fine.Any help is appreciated.

Today we are releasing Jamf Pro 10.50. Highlights of this release include: Compatibility with macOS, iOS, iPadOS, and tvOS based on testing with the latest Apple beta releases Same Day support for new configuration profile keys SSOe improvements to macOS Device Compliance registrationThe JamfAAD on managed computers now has improved support for single sign-on extension (SSOe) in environments integrated with Microsoft Intune. This simplifies the registration process by reducing the number of prompts displayed to end users.   For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro.   Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated based on your hosted data region below. Review this guide if you need a

I thought I would try to create a VM to test erase-install OS updates. I setup a VM enrolled it in JAMF, I had to do a few things, because it didn't enroll everything correctly. I'm not, trying to test erase-install, but it says, I'm not a volume owner. Any ideas or is it not possible via the VM using UTM?

In our Computers - PreStage Enrollments, it shows 63 devices. One of them is the target device. The Jamf Connect and Jamf Connect Login are scoped to all devices and usersAuto assign new devices is checked. Make MDM Profile Mandatory is checked. Automatically advance through Setup Assistant is on.If I click Computers - Search, it only shows 61 devices. Trying to limit the company data I share, but please let me know if I need to include any more information.VERSION10.50.0-t1693149930MANAGEDComputers - 61It's a latest M2 Max MacBook Pro, it did successfully enroll before a few months ago but can't now. All our server and content tokens are current, even recently updated.The device was unassigned and reassigned to Jamf in ABM. What else needs to be done? There shouldn't need to be any intervention by the remote user. Please tell me all the things I should check on our end to get this laptop to properly enroll. He's already wiped it since last syncing everything on our Jamf

I am the JAMF admin for my employer. When a Mac needs to be remotely wiped, marked as stolen, prompted to be updated etc such request come through me.I found a Mac a few months ago, that had been inactive for several months, had a name that differs from the convention set by the enrollment profile etc. No record could be found of it in the hardware database that we use for just about everything else in the company. Usually such devices are regarded as stolen/lost in transit etc. I was never informed that a device belonging to someone external to the company had a mac added to JAMF.I sent the command to LOCK it with a message to state my name and email address with a request to contact me to verify ownership. An external business partner contacted me yesterday looking for the unlock code. I had no reason to doubt he was indeed genuine. I shared with him what could only have been one or other of the two unlock 6 digit lock codes.He attempted them, but now he appears to be locked out of t