We are having a terrible time with filevault and want to find out if there was some kind of definitive guide to its implementation.  Right now we are binding and using AD accounts (Implementing Connect in 2024.  Would love to hear if this would help our situation) to login.  When a user changes their password it seems like we need to disable filevault, to reset the password and then reenable filevault otherwise the changing the password through system prefs doesn’t work.  And end users can’t disable filevault this because they aren’t local administrators. Questions and issues I have:Are we supposed to use a policy or a configuration profile in Jamf Pro to enable it?  Pros and cons?We have shared Macbooks that we need to be able to logged into by new users on a regular basis.  How do we enable that new user to automatically get access to a filevault encrypted drive? Based on this should we be using an institutional key or a personal key, or does that n

I'm trying to create a smart group to check to see if the anyconnect compliance module is a specific version. Our network group is in the process of updating our ISE Compliance on the backend. We're assisting with providing devices so it can be done in waves. On the windows side of things, they have he ability to grab the compliance module version to verify. I'd like to do the same for the Mac side, so when it's updated on the backend, we can confirm it's running the correct version. I've went through the different criteria's and can't seem to find one that fits it. Just checking to see if anybody has any ideas on gathering this info to be able to verify it.

Just doing an industry survey. Those NOT in education, do you lock the wallpaper for your users? 

Hi Folks,I need some assistance. I have been trying to onboard M1/M2 through prestage enrolment and it's failing due to rosetta2 not being available as some apps not getting installed properly. Can anyone suggest to me step by step process on how to install rosetta2 on those macs before any other application?  Thanks,Rish

I think I know the answer already but wanted to give it a shot here. I have a machine purchased in June 2023 from a employee that departed the company in November. On the last day part of the procedure is an IT team member will Jamf lock the device note the code and then get the machine back from the former employee.Seems after the machine was returned a team member thought they already unlocked it and completed a wipe and then deleted the machine record from Jamf. Well now its on a Jamf lock screen and the 6 digit code isnt working or the person wrote it down wrong. It is still in ABM but I am not sure how to unlock it since its out of Jamf, even if it were still in Jamf idk how one would unlock it without the 6 digit code. I tried DFU revive but that didnt go anywhere.Wondering if anyone has any thoughts or just release it out of MDM and e-waste?

Maximum of how many device we can enroll into Jamf now?

I have a group of about 200 devices I need to remove from management. I know I can do a bulk delete, but this appears to leave the profiles (and wireless certificate) on the devices. If I unenroll a device, this removes the profiles. There is a bulk delete, but I can't seem to find a bulk unenroll. Am I missing something or is this not possible? I can't just delete these devices and leave our wireless certificate on the device, so I have to remove them from management. Cheers,Chris.

HiWhen the new year starts, I want to know the easiest or best practice for iPad devices in school. I want to easily delete data and have them fresh with the required apps they need for the new school year. Please advise what your best practices and methodology are. Hopefully, this can be easily done through JamF school.@

Hiwe need the most important Infos from the User but we miss at the export the SerialNumber. This means that I have to combine the data from the categorie „Devices“ and the „user", which is very cumbersome.Export from categories "Users" Columns UserFirstNameUserLastNameUsernameEmailManaged Apple IDGroupsDevicesIt will be very well, if we could export with the SerialNumber and not if the user have a Device 1 or not 0.UserFirstNameUserLastNameUsernameEmailManaged Apple IDGroupsSerialNumberOr have anyone an idea, where I can extract/export the Infos (see the upper chart)Thanks for help!Peter

looking to the community for recommendations on keeping tabs on Apple updates. My org is strict about keeping things up to the latest version within 30 days. What sites/ RSS feeds, etc do you use to track upcoming updates?

I've read multiple posts here about machines not checking in with the JSS anymore.We have multiple machines that are not checking in anymore with our cloud JSS.I've tried many things written in previous posts. These are the commands I've tried and the results:Command: sudo jamf enroll -promptResult: Downloading required CA Certificate(s)...Restoring JAMF.keychain since an error occurred.Error submitting enrollment status to the JSS: Security Error - A security error has occurred.There was an error.     Error enrolling computer: Unable to establish trust with the JSS - Unable to add the certificates to the System keychain...Command: sudo profiles renew -type enrollmentResult: Error: Renewing DEP enrollment failed: (null) (NSCocoaErrorDomain:4099)When computers are connected to our education network I connect to them with ssh. This is how I tried these commands. I prefer to do it like this (when renewing through Jamf doesn't work), because I don't have to disturb

We have been using an EA to find Macs that have Find My enabled. It worked in Monterey and Ventura, but now in Sonoma it is coming up with blank results. Anyone have ideas how to correct it?#!/bin/bash # iCloud_FindMyMac.sh # Purpose: to see if machine is enrolled in Find My Mac plistBud="/usr/libexec/PlistBuddy" loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) if [[ -e "/Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist" ]]; then #FindMyMac=`$plistBud -c "print :Accounts:0:Services:11:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist` FindMyMac=`$plistBud -c "print :Accounts:0:Services:" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist | grep FIND_MY_MAC -C1 | grep Enabled | awk '{print $3}'` else FindMyMac="Not Enabled" fi echo "<result>$FindMyMac</result>"

Safari17.1.2VenturaAuto-17.1.2

Hello dear community,We have some iPads that are not updated via the Jamf interface. The iPad OS version displayed in Jamf does not match the one on the iPad at school.The iPad cannot be reset and no longer receives any commands.For some reason, the certificate has not been updated.I will probably have to reset all the iPads manually.Does anyone have any idea how this can happen?

Hi all,I did an export of a SIS to Jamf School, which worked fine and the students and teachers now all have an account within JSS. How can I sync those users so they also exist as Apple School Manager accounts/Managed AppleIDs? I know it has something to do with the SFTP function, but couldn't quite figure it out.Thx!!

Safari 17.2.1 - Ventura

We have an issue regarding the latest Safari Update. It shows up in the Inventory "Software Updates" Part of the Clients but there is no Option to install it in the Software Update System Preferences on the Client site. There is no Safari Update listed. We use the following Configuration Profile to manage Software Updates: ########## <dict><key>PayloadDescription</key><string>Configures restrictions</string><key>PayloadDisplayName</key><string>Restrictions</string><key>PayloadIdentifier</key><string>com.github.erikberglund.ProfileCreator.abc</string><key>PayloadType</key><string>com.apple.applicationaccess</string><key>PayloadUUID</key><string>abc</string><key>PayloadVersion</key><integer>1</integer><key>enforcedSoftwareUpdateMajorOSDeferredInstallDelay</key><integer>90</integer><key>forceDelayedMajorSoftware

Dumb question I know, but I can’t find a straight forward answer for some reason

I m trying to find out Global protect VPN Connection status and have to enforce users to get authenticate

Hi Guys im config the jamf radar and i need to add some websites to exception group we blocked for all users how can able do that 

Looking through the documentation, I couldn't find a way to easily remove the ConnectWise Control Client. Created the script below to help anyone who uses the app. Please add your control client's unique id where the "x's" are.   #!/bin/bash # Brandon Woods # August 2021 # This script uninstalls the Connectwise/Screen Connect client. No reboot required. # Unload Connectwise LaunchAgents sudo launchctl unload /Library/LaunchAgents/connectwisecontrol-xxxxxxxxxxxxxxxx-onlogin.plist sudo launchctl unload /Library/LaunchAgents/connectwisecontrol-xxxxxxxxxxxxxxxx-prelogin.plist # Remove Connectwise LauchAgents sudo rm -v /Library/LaunchAgents/connectwisecontrol-xxxxxxxxxxxxxxxx-onlogin.plist sudo rm -v /Library/LaunchAgents/connectwisecontrol-xxxxxxxxxxxxxxxx-prelogin.plist # Quit Connectwise Application sudo killall ScreenConnect Client # Remove Connectwise Application sudo rm -rv /opt/connectwisecontrol-xxxxxxxxxxxxxxxx.app # Check for remanants of Connectwise Lau

Just got a "thanks, but no thanks" email after interviewing for a Jamf-related dream job, so I'm wallowing tonight in my disappointing year of looking for a new position. Don't mind me.About me: Got my Jamf Certified Expert (Jamf 400) late in 2022 (also Jamf 370). Last three years Jamf administrator for 5000+ devices (500 MacBooks, rest mobile devices), 10 years of IT experience overall. Have an extensive GitHub with many examples of Mac/Jamf code. A dozen other IT certifications. Working on a Masters in IT.What I was looking for: I work in the public sector, so I'm likely underpaid for what I do ($65k-$70k). Trying to find a new, better paying job working with Jamf or another Apple MDM -- and more importantly, new challenges.

We've been testing Jamf's return to service and Remote Wipe  mass action commands on our iPads and we run into some kind of bug where apps that are set to "auto-deploy" are being installed and removed multiple times during enrollment. This takes what should be a process that takes a few minutes to 20 minutes. I'm not sure if We've boinker something up in the scoping or if this is just a by-product of handling this through MDM. I don't notice the same behavior if we do a recovery mode wipe of the device through Finder.    

I am testing the JAMF Safe Internet, and so far it is good.. except I need it to do something that I'm not sure it can do, or I'm not configuring it correctly.My Pre-K through 2nd students only need to access allowed websites. So if I block everything, and then put in custom rules for the allowed domains, that should work, right?Not the results I'm seeing. Things are still getting blocked by the default rules, which should be overridden by the custom allow rules?

Anyone know how to implement these from Apple?   https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update   Any working advice would be appreciated please. Not sure if these commands are to be used in a config profile, that's my guess, but I have been unsuccessful so far. There are command and response, not sure how all this gets implemented. Please advise. Thank you ;-)