Hello! We are in the process of implementing Cisco ISE in our environment. We are at the very beginning stages and are doing some information gathering for how we will configure ISE for all of our separate device types.We are using the "Essentials" session licenses for Cisco ISE so we are not able to integrate MDM capabilities directly into ISE and will instead be using certificate-based authentication against ISE to allow MDM devices onto the network. We would be using ADCS to pass out the certificates to the devices but were unsure how this would exactly work to pass local certs from our ADCS server to non-domain joined devices. I've seen this doc: https://learn.jamf.com/bundle/technical-articles/page/Integrating_Jamf_Pro_with_Cisco_ISE_3-1.html but just wanted to make sure that the processes in that doc are allowed with our basic license level and also if this doc is hitting the areas that are in question for me. What are other people doing to get the c

Hello Everyone,As per our company standards we need to disable the Safari profiles and Password Syncing with iCloud on macOS Sonoma, we have tried with some plist but that didn't work and does anyone has plist to block or disable the Safari profiles to iCloud. Attaching the screenshot for reference. 

We successfully upgraded our on-prem environment to 11.0.1 last week and have noticed an odd issue with a number of machines showing no values for any extension attributes. Out of about 2000 current machines, it only appears to have affected about 180 or so. Manually running a recon on the machines has fixed most of them and I created a policy to just run recon as a process (not from maintenance) adn that seems to be slowly whittling them down and getting most of them back. Anyone else seen anything like this?

With the rollout of Jamf Pro 11, my cloud tenant updated without issue. However after using the new updates for a few days, I'm becoming slightly annoyed by the change in color palettes.  Policy status (the 6% below) are brighter color palettes.  The Patch Management Statuses colors are what appear to be the pre-Jamf Pro 11 color palette.  It's semantics, I know, but when my dashboard is full of policies and Statuses that I use for at-a-glance updates, it's very noticeable. I know this isn't where you post feedback, but I know Jamf watches the forums. 

Can someone explain the Profile Identifier and how to find it?

Hi all,We're trying to hide the "Your screen is being observed" message on the lock screen while using ARD. This message also appears when using a DisplayLink dock:We've tried the command below, but it doesn't affect the lock screen:/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -config -clientopts -setmenuextra -menuextra noIs it possible to hide this?

Hi, So finally getting rid of an old Xserve, the data is being moved to new Windows Servers. Does anybody have a script that I can run on Snow Leopard Server that can tell me all the files and folders with over 256 characters as this will cause issues with the Robocopy. Thanks

We have folder restrictions on student's laptops. Anyone knows the location to this Photoshop PSCustomHook that I can whitelist?

My school is facing a management issue where many students are using Google Chrome's extensions feature to download VPN software. Is it possible to disable the installation of extensions from the Web Store on all student computers using Jamf Pro? Also, is there a way to disable the Chrome auto update? 

Going to upload the new device token and getting an error message "The File received is not valid".  Anyone got any ideas?  Sync is now failing due to downloading a new Token.

Wondering if anyone has come across this before; I've done a fair bit of searching, but haven't found anything. I’m trying to make a signed package for Jamf Connect Notify with a cert made against the Jamf CA (need to shoot off a support ticket for that one, but that can wait), but Composer crashes with it, and I’ve isolated it to the following:If I make the package in Packages, import and then try to convert it to source in Composer, Composer crashes at the end of itIf I make the package but edit the postinstall script to be #!/bin/sh prior to building, it will import/convert fine, but if I then edit it in Composer to be zsh, it crashes immediately upon saving.It seems that Composer cannot handle #!/bin/zsh at all - I've tested this with versions from 10.48 through to 11.0.1, with the behaviour repeating. Has anyone else come across this behaviour before? Very frustrating, as it's holding up getting the Notify panes tested. (M2 MBA, Sonoma 14.1, Composer 10.48 through 1

I have been working on deploying Connect Fonts and wanted to share my experience.Extensis has tools for installing the plugins.https://help.extensis.com/hc/en-us/articles/6290207443227sudo "/Applications/Connect Fonts.app/Contents/Resources/plugin-installer" [ --install-all | --uninstall-all|--uninstall-obsolete]And more info here.https://help.extensis.com/hc/en-us/articles/5628781808027-Remotely-deploying-Connect-Fonts-Desktop-Mac The problem is even after running the plugin-installer command through Jamf, the users were still getting prompted to install the plugins. And since our users are not admins they are not able to install them. Further the users were greeted with a startup wizard part of which prompts them to install plugins. Also Extensis suggests a method of packaging up their software in their knowledge base. This DOES NOT work since the app and the plugins within the app are quarantined from the DMG they provide. Here's the script I came up with.#!/bin/bash#

We have a Lightspeed Rocket Appliance and Mobile Filtering setup. We have had issues that when an IOS update is applied it breaks the Mobile Filter and the only way to re-instate it is to reopen the Lighspeed Mobile Filter App. We have everything setup correctly and push the App out via Jamf. Lightspeed support confirmed that today which really makes it useless for the amount of devices we have as its a K through 12 enviroment. Lightspeed has a new product called Relay that is cloud based and independent of the school network. Anyone using this product?

HI there,We've been using a script to set the computer name on devices in the format of 'fullname-model'. This script has been working fine up until Sonoma where it breaks by not providing the full name variable. The only script that seems to work at the moment is one that pulls the username instead but this is not ideal for our environment due to some historic devices having usernames completely unrelated to the user.Is anyone using a script that is able to pull full name from a source that works on Monterey, Ventura and Sonoma in the 'fullName-model' format?This is what we have now#!/bin/bash userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }') echo $userName model=$(system_profiler SPHardwareDataType | grep "Model Name:" | sed 's/.*://' | tr -d " \\t\\n\\r") echo $model serialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') echo $serialNumber name=$userName-$model-$serialNumber echo $name scutil --set HostName "${name}" scutil --set LocalHostN

Today we released Jamf Connect 2.29.0. This release includes the following changes and improvements: The Jamf Connect menu bar app's user agent header string now includes the user's platform for Okta and Google. Additionally, the Jamf Connect login window and Jamf Connect Configuration also provide user agent strings that include the user's platform. [PI113140] The Open in Browser checkbox cannot be deselected while the Launch Browser (LaunchBrowser) setting is enabled. [PI113143] The Jamf Connect login window will no longer display a black screen when a new user logs in for the first time.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Connect team

I work for a school district and we use JAMF Pro to manage our fleet of M1 Macs and iPads. I'm currently using MacOS 13.5.2 on an M1 Mac with a Magic Keyboard. When at the log in page, if you quickly press the Touch ID key three times, an accessibility shortcuts panel appears where you can enable and disable settings. I'm trying to stop this box from appearing and having the options be toggled on or off. Disabling accessibility entirely within JAMF via a configuration profile doesn't stop students from being able to quickly press Touch ID three times to bring up the accessibility shortcuts box. I'm wondering if anyone knows of a work around to stop this from happening?Unchecking every option under Accessibility  > Shortcuts has no effect and neither does disabling keyboard shortcuts (which were already disabled). Any help would be greatly appreciated!Thanks

Can anyone tell me the benefit of going with Jamf's Cloud solution over On-Premise? I keep seeing plenty of issues with cloud based setups but haven't seen anyone running into these issues with on-premise.

Has anyone else seen "Unsupported InstallAction for majorOS update" in their management history? We're seeing a lot 13.5 -13.6 of clients showing that message for failed commands. We're using the new software updates experience, and also using SUPERMAN v4. Right now super is failing MDM workflows, and I think the two are related. super logs seem to indicate at least some successful MDM commands, but the actual update fails. Those logs look like:Thu Nov 02 10:17:36 MD-CLIENTNAME super[99878]: MDM: Successful macOS update/upgrade command request.Thu Nov 02 10:17:36 MD-CLIENTNAME super[99878]: Verbose Mode: Function install_macos_mdm: install_macos_mdm_api_error is: FALSEThu Nov 02 10:18:06 MD-CLIENTNAME super[99878]: MDM: Received push command "ScheduleOSUpdateScan", checking back after Jamf Pro's mandatory 5 minute delay...Thu Nov 02 10:18:06 MD-CLIENTNAME super[99878]: Verbose Mode: Function install_macos_mdm: install_macos_mdm_start_error is: FALSEThu Nov 02 10:23:18 MD-CLIENTNAM

What is incremental flushing? Why do I have to do it? Description of incremental flushing:To help with this also, perform incremental flushing. You will start one year and working your way back to a week. The process will be repeated 5-6 times and each flush time will differ depending on how much data there is within that time frame. - What is incremental flushing? Why do I have to do it?  

Hello guys, I wanted to let you know that we are currently in the process of deploying the Kerberos Single Sign-on Extension profile. However, we have encountered a situation where some local macOS accounts do not match their corresponding AD accounts. For instance, the macOS local account is named "doe" while the AD account is named "jdoe". I am concerned whether this will cause any issues during the rollout of Kerberos Single Sign-on Extension. I have conducted a test with a user named "test" whose AD username also happens to be "test", and it worked without any problems as they match. Nevertheless, I remain worried about potential complications arising from mismatched account names

Looking for a programmatic way of accomplishing this. I know historically this has been a complicated issue but I'm wondering if in the year of our Lord 2023 there have been any clever advances. Thank you allRyan

Hi Everyone,Fairly new to JAMF here. I have all our campus Ipads in Apple School Manager. They are linked to JAMF now. I see the Serial Number in JAMF. I make sure it is checked and the ipad does not pick up remote management despite erasing it a couple of times already. Is there a step I am missing?

Dear all,I have some enrolled devices with Jamf Pro and with a managed Apple ID with problems to synchronize with iCloud Drive. It says that Mac can not synchronize with iCloud Drive.I have not activated any restriction in Jamf for this purpose. And it appeared suddenly and only in specific computers.How can I manage options to be applied to each managed Apple ID. No options from Apple Business Manager, but possible to act from Jamf Pro?Thanks!!!!

The script I run to enable Remote Login and Remote Management has been the following:#!/bin/sh # enable remote management for ardadmin /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users adminuser -access -on -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -restart -agent -menu #enable remote login for ardadmin sudo /usr/sbin/systemsetup -setremotelogin on sudo dseditgroup -o edit -a adminuser -t user com.apple.access_ssh exit 0We just upgraded many of our computers to macOS Ventura.  I've noticed with macOS Ventura that when tryin

Hi Guys, working on a project where i need to force install certain extensions in Edge. They Keys are there and I have tried configuring using profile creator, JAMF JSON and BIll's JSON. No luck. Edge sees that its managed and allowed extensions install no problem. Blocked extensions are blocked, but those that should be force installed are not working. reaching out asking am I missing a recent change and if anyone has these working? TIA