We create a local user account for administrative tasks as part of our imaging. What we're seeing is that we'll receive a unit with some issues where we need to use that account, and the password won't work. This is not very common, but it is happening sometimes. We'd like to create an Extension Attribute that checks that account and validate if the expected password works, and if not, scope a policy to that smart group to reset it. I did see one slightly complex script here:http://www.yourownlinux.com/2015/08/how-to-check-if-username-and-password-are-valid-using-bash-script.html But it doesn't appear to work any more since the shadow hash is now under /var/db/dslocal/nodes/Default/users/<USERNAME>.plist Before I start working through that I wanted to check if anyone has any other suggestions/solutions. Thanks

Created this for myself and thought I would share. It should match all devices which will be unsupported by macOS Sonoma upon release. The benefit of matching unsupported instead of the other way around is that it should not need updated when new devices come out. If you need a smart group for supported devices instead then simply swap the operator to "does not match regex."To use, create a smart group named something like "macOS 14 Sonoma Unsupported Devices" with the following criteria:Model Identifier matches regex ^(iMac[1-9],\\d|iMac1[0-8],\\d|Macmini[1-7],\\d|MacPro[1-6],\\d|MacBook([1-9]|10),\\d|MacBookAir[1-7],\\d|MacBookPro[1-9],\\d|MacBookPro1[0-4],\\d)$  

We are a K12 private school. Our high school and middle school students are all using iPads to complete their schoolwork. Lately, we've had students come into our tech office that is having trouble taking and/or submitting tests. It turns out that quite a few have iPads at the lower limits of battery activating "low power mode", which stops background app refreshing causing them to be unable to continue their testing. Is there a way to disable Low Power Mode in Jamf Pro?

Hello,I have few iPad who get lock by activation lock, I would like to grab the code from command line ...I found that site https://github.com/dnikles/removeActivationLock who explain how to do ... but the Phyton part is not working when you have the SSO on console activated.. is there a direct API call we can do with the current version?

 Our current Nudge configuration. The Nudge button "Update Now" is only opening the MacOS Sonoma Installer application that requires admin credentials. It won't open the Self Service update policy that we have. We need the Self Service update because it doesn't require Admin credentials. The regular Sonoma app installer update just started requiring admin creds as of today for our Org so we can't use it anymore.  Anyone have the actionbuttonpath field working to open Self Service in Nudge?

As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I crea

I have a computer that is already in use, which just won't register correctly in Jamf. It's registered in DEP and assigned to Jamf Pro. In Jamf Pro, the serial number doesn't show up in device search. When I trigger the re-enrollement with the user ("sudo profiles renew -type enrollment") the enrollment-flow starts as expected.However, at the end it stops with an error message "Install profile failedYour computer is already enrolled in an MDM server and can only be enrolled in one MDM server at a time". In Jamf the serial number now shows up as "DEP - [SERIAL_NO]". The username in Jamf pro is not populated (though it was collected in the flow).Also, the `jamf` binary is not installed.In the user's System Settings, only 3 profiles are listed. They have names I don't recognize, but I can't remove them. However, it is stated that "This mac is supervised and managed by: Archipunt", so it might be old profiles from our MDM (the computer is bought in 2020, and we were using Jamf Pro bef

My company is about to deploy a bunch of machines. We have set up several prestage enrollments for the computers to be set to the proper building, department, etc. Is there a way to assign machines in bulk to a prestage with something like a csv file?

How do we set up a curfew from 9pm to 6am on student M1 MBA Macbook airs running Ventura or Sonoma?

Warning: I'm just learning how to script using The Odin Project. This is a crude, but so far is effective way of checking to see if my users are on a particular wifi network, and switch them over to another as needed.Problem: We're moving away from having static admin accounts deployed on our devices and are trialing the creation of just-in-time admin accounts when servicing a computer.For this to work, wifi needs to be enabled at the MacOS login screen (NoMAD 1.5). This is achieved by pushing out a computer level config profile with a wifi payload, Wifi A. So far so good. Wifi A is heavily restricted and does not allow general internet access.However, after the user logs in, they will then have access to our normal enterprise wifi - Wifi B.How can I then ensure that my users are always connected to Wifi B upon logging in? I decided to create a launch agent that runs every 60 seconds and checks for the currently connected wifi network. If the user is found

I have a policy in Self Service that deletes a "Temp" local user account and then recreates it. We use this for lending out laptops to students so that we can delete and re-add the account every time it is returned so that we can re-lend it out with a fresh account. I would like to apply a new policy that forces the "Temp" account user to reset their password once upon first login after the account has been recreated via self service. I was planning on using the command: pwpolicy -u "$LOGGEDINUSER" -setpolicy "newPasswordRequired=1"If I scope this command in policy to a smart group that looks for the Temp local account and then runs once per user at login will this accomplish what I need? The trick is I don't want this command to run when any other accounts login and only want it to run once when the Temp account logs in for the first time after being re-created and then only again when the account is removed and recreated and logged into for the first time once again. If I use a

Anyone have a script or extension attribute to pull this info, I am looking for the type of display connected i.e. Cinema, thunderbolt, other?

I have a team of people using Final Cut Pro. This team is very sensitive to updates to FCP and their tools (as it should be) so I need a way I can make FCP available to them in Self Service - and when they want/need to update they can in self service.I am sure other admin face this. Anyone have a "recipe" I can follow?

We are deploying Cisco Anyconnect with Umbrella on our fleet of 1000+ machines. Our secops team has dictated that the firewall must be set to block all incoming connections. We cannot get Umbrella to show protected with this firewall setting enabled. When we turn it off, Umbrella works great, but incoming connections are allowed. Has anyone got it working WITH the incoming connections blocked?

Hello All,Need a help on base64 encoding for Nudge for icondarkpath iconlight path screenshotdrakpath and screenshotlightpathif I use a .jpg or png and use base64 command to generate a base64 code then what I should do with these big string generated by base64 CLI? Should I paste the big string in the path in my config profile instead of the path of .jpg or png file on end point(Mac) ? Or I should do something else? Please guide me, I dont push the .png/.jpg on mac through a JAMF policy.

Both our cloud hosted Production and Dev instances are having errors with SSO starting today.  Anyone else experiencing this issue?  I just submitted a ticket into Jamf Support.  Checked with our web team and nothing has changed on their end.  They dug into the logs and came up with this:Finally was able to find a message in the Shibboleth IdP logs.  Based on the SAML metadata, the request from the service must be signed but it is not.  This is a setting at the Jamf service and my guess is that it was changed.

I try to add shared mailboxes on a managed iPhone in the Outlook App. The Exchange is hybrid On Premises and M365. But the Shared Mailbox option is missing on my devices.If the devices are unmanaged or managed by Intune, the option appears.Is there a config parameter missing to enable the function in Jamf Pro?

We are trying to modify our com.google.chrome.plist to allow two extensions to be installed by end users.  We block all extensions in our .plist file by using the "*" wildcard under "ExtensionInstallBlocklist", and have now added the "ExtensionInstallAllowlist" policy with a string containing the two extension ID's.  The chrome://policy page shows that both of the policies are OK so they are being recognized and should be working, however, when installing those two extensions they still say they are blocked by the administrator.  The Chrome policy description page shows that blocking all extensions and allowing specified ones is the way to only allow just certain extensions.  Is there something I'm missing here?Here is our plist, website url's have been removed:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>B

Hi All,We have been working on setting up Device compliance with EntraID for a while and had everything in place to begin rolling it out this week, everything was working as expected with devices being marked with the correct compliance.  As of Friday all of our test devices were marked as non-compliant and registering devices now seems to take significantly longer than usual, almost as if it's waiting for a 24hr sync before the devices are marked as registered in Intune and marked as non-compliant.  This seems to coincide with the timing of our update to Jamf Pro 11.Devices and users are in the correct groups and everything still appears normal from a setup perspective.Has anyone else had similar issues?Thanks,Ryan

Hi,If the devices are enrolled via UI method, the activation lock is not working on the devices to unlock them.Jamf informed us If the activation lock has been enabled THEN enrolled into Jamf Pro the activation bypass code will show but will not work in this case. The only way to get that machine unlocked is going to apple What should be the workaround apart from reaching out to Apple?

Hello i am in the process of mass deploying Checkpoint endpoint agent via jamf, how to enable full disk access via JAMF in system preference. Thank you in advance. 

Hello,I am testing Account driven BYOD enrollment, but am running into an issue. The iOS device is enrolled with a Managed Apple ID and the Corporate account shows in Settings. Everything appears to be OK until Self Service installs and I receive the following error in Self Service:"ERROR__ALERT_TITLEThere was an error enrolling your device: ENROLLMENT_STATUS_-FAIL.Please Contact your IT Administrator"Once I clear the error, Self Service is empty and no assigned apps are there. So it does not appear to be registering with the MAID for some reason. I look under Users>VPP Invitations where I have a test invitation to automatically register users with MAIDs and skip invitations. But the the Usage, it shows the test user status as "Invitation Incomplete."Can anyone point me in the right direction to clear this up?Any assistance is appreciated.

I've recently started as an Apple Admin and we use the Google Suite as much as we can. Gmail, Docs, Sheets, Drive, etc. We also manage our iOS devices with JAMF Pro, but we use Google's MDM for BYOD devices (access to Drive and Gmail on personal devices). The problem with this is that if someone wanted to access any of those things on a company owned device (one managed by JAMF Pro) they couldn't, because 2 MDMs can't control the same device. I'm wondering if anyone else out there has this same setup and what they are doing to get the best of both worlds; security for BYOD devices if someone "goes rogue" and we need to remove access to everything as well as all the great features JAMF Pro can offer for our company owned devices. Thanks!

Anyone integrating their JSS with Aruba ClearPass?Pros / Cons ?Ty!-Lionel

I have followed the Microsoft SSO Plugin guide here: https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-with-intune?tabs=prereq-jamf-pro%2Ccreate-profile-jamf-pro but appear to be getting errors when Jamf tries to apply the profile. The error i get is:"Profile Installation Failed / The payload type “com.apple.extensiblesso” is not permitted to be installed for the system in multi-user mode." Is this something that just isnt possible with a shared iPad or is there a bit of extra config I need?