Hello,PROBLEM: most of our MBP pop solely use wireless network and are never getting alerted when PW is about to expire. WHAT I HAVE FOUND: On a domain joined machine on our corp wired network, the machine is in a state where it is able to get to AD where it can poll password expiration for users. This is not the case when the device is on our corp wireless. The machine is not getting network access until AFTER a user logs in. I deliver an 802.1x configuration profile to the device with trusted certificates and I am to understand that this profile (which was built using Apple Configurator) installs using a "user" context rather than "system". If delivered in the "system" context, then the device can use the machine certificate for logon. Everything I have seen suggests you must hack the .mobileconfig file (shown here https://ntsystems.it/post/joining-wifi-before-login-on-mac-os-x-108). I tried this several times several ways and have had no luck getting the wireless network to c

Hello! I сan't erase all content on macOS Ventura, I tested PreStage (cleaned the test mac several times), and it looks like I didn’t delete the profiles from the test device at some point. And now i can’t erase all content from the test device. I tried to add the device again through User-initiated enrollment, but it shows up as UNMANAGED, and I can’t delete profiles or wipe the device.Please tell me how to clean the device.

Hello, I've searched around and found no article or setting for a way to setup a profile on jamf to either disable Guided Access, Enable it or at least create a passcode for guided access. Would anyone know how this is done or if it is impossible. I essentially have over 500 devices begin managed and most like guided access but prefer to have 1 single passcode that so that others cannot change the passcode.Kind Regards,

Is there a way to run a report to see all the apps we have on the iOS Devices?

I'd like to find a way to allow users to change the following things, either without a password or using their own, instead of needing admin rights.Power settings, like how long before turning off the display on battery or power adapterNetwork settings, like changing wi-fi networks Auto-Join settingPrinting settings, like updating Options and Supplies (this only started asking for an admin password since I think Ventura)Privacy and Security, like adding an app to Accessibility.Does anybody know a good way to do this? I wish the config profiles were a bit more like GPOs in this regard because I suspect I need a script instead of a checkbox.

We seem to be running into an issue with Secure Tokens. Searching has made me realize this is something most people are having difficulty with but it's usually with the Admin account not having a token but ours is sometimes the other way around.Long story short a second admin account that was added during the enrollment stage was getting the token then other users logging into the device would not get a token, now really showing itself with updates and the users getting a "You need to be an owner" error.So I created a script to run from Self Service that just prompts the user for their password then runs the command and passes the credentials of the Admin with the secure token. However, it always errors out saying the users password is incorrect but when I test and run the same thing from the terminal on the test device it works fine. Is there something I'm missing here? Does apple do something to restrict this kind of access from a script?   #!/bin/bash # Prompt the us

Hi, i need to give access to allow our it techs to edit the user and location fields in jamf pro.i just cant find the correct checkboxes in the priviledges in jamf pro user accounts and groups... anyone...

I have an issue with registering macbooks in Company Portal.Everything is setup as described in the tech paper for device compliance:https://learn.jamf.com/bundle/technical-paper-microsoft-intune-current/page/Integrating_with_Microsoft_Intune_to_Enforce_Compliance_on_Computers_Managed_by_Jamf_Pro.htmlAll worked fine for months:While enrolling a device Self service opened the Policy for (Microsoft device compliance payload --> register computers with azure active directory)This opened Company portal and registered the device.Unfortunately it now fails everytime. The user can log in successfully but gets a "couldn't add your device" error"I have no idea where to search, since all settings involved haven't been altered.Underneath is the log I get from  Company Portal.Any ideas what to search for and where?I already created a ticket towards Jamf.2023-10-12 08:42:52.912 | telemetry | 35658 | TelemetryManager.swift: 173 (sendEvent(featureArea:type:eventTitle:duration:result:target:lo

Hey all,Just wanted to check if anyone was seeing looping restarts after attempting upgrade from 10.15-13.6We use firmware passwords and I figured this was part of the issue, so ive since removed them, however i have about 5-10 that attempted the update themselves, and now are caught in this rebooting loop. Ive reinstalled 13.6 on them from both the recovery and from a boot usb drive as well as internet recovery...with the same result. Im attempting to now try to move one to sonoma to see if that resolves it.Ive done PRAM resets...pmu resets, i did a revive from configurator. Ive done everything except wipe them fully...which i guess is the next step.Ive also done safe booting with shift held down. Not sure what the cause is, but it's really annoying.

I am trying to get Nudge rolled out to our users. So far it has been pretty good, although the setup documentation leaves a lot to be desired.I am wondering how we can customize the LaunchAgent so that it doesn't popup every 30 minutes (default) but instead maybe 6 hours apart. Do I need another Configuration Profile for the Launch Agent itself? Do I need to change my current configuration profile? I read through the documentation 10+ times and didn't get my answer.  

Anyone have any luck packaging and deploying the unreal editor? I can package the epic game launcher fine on its own, but error out on dmg creation if the editor is included. Also tried as two separate packages and again fail on dmg creation.  It will roll up in pkg with out error at creation, but being over 8GB the PKG created is not complete and will error on install. The size of the editor makes it desirable to have deployable from jamf rather then having to install individually.  Any input that can be provided is greatly appreciated!

Just putting this out to share since deploying software via Jamf apps have been very flakey for me lately. I am by no means a scripting expert so feel free to make changes or offer any refinement, so far it does what I want it to do, downloads the universal zip file for VS Code, Unzips it, moves it to Applications, trusts the app, and then deletes the install folder for the secure temp folder. #!/bin/sh pkgfile="VSCode-darwin-universal.zip" tmpDir=$(/usr/bin/mktemp -d "/tmp/VSCode-install.XXXXXX") logfile="/Library/Logs/VSCodeInstallScript.log" url=' https://code.visualstudio.com/sha/download?build=stable&os=darwin-universal' /bin/echo "--" >> ${logfile} /bin/echo "`date`: Downloading latest version." >> ${logfile} /usr/bin/curl -L -o ${tmpDir}/${pkgfile} ${url} /bin/echo "`date`: Installing..." >> ${logfile} cd ${tmpDir} tar xvfz VSCode-darwin-universal.zip /bin/sleep 5 mv "${tmpDir}/Visual Studio Code.app" "/Applications/Visual Studio Code.app" /bin/echo

Hello all,Has anyone managed to configure Powerpoint preferences for users?Specifically I'd like to be able to uncheck the 'Always start Presenter view with two displays' box for users.We're in an office 365 environment.Thanks all

Hello, I have a situation when one of our builds deployed, it add custom app(NetworkFilterApp) to Application Folder, when attempted to uninstall or remove , seeks admin credentials to remove app, Can it be possible to supress Admin credentials  screen and continue with app removal .Any Jamf profile configuration supports this ? Kindly provide pointers 

Background: Had a student not return a macbook during turn in. I remotely locked their laptop as I have done other times with the lock feature. When going back to the machine this summer to get it ready for next student, I realized I never unlocked. Went into JSS to look for it, and code is not where it should be. IE, it has been erased. (palm slap) I have read that a fix for this is to go to apple store or apple tech to have them reset firmware password. I am not sure of this as I have been able to find a clear answer on here or online. Any ideas or guidance?

I want to have 31 iMacs join our local domain. I'm certain this is a config profile, but not 100% sure on how to configure this. Any insight is appreciated. Thanks!

The company was purchased by another company. The new company didn't have Okta so I've been deploying Okta for them, but we still have the old Okta. We've been using Jamf Pro, Connect, Private Access and Protect at the old company for a while now. The problem is that I need to migrate Jamf Connect from the old Okta to the new Okta. The new company uses a different string for username. Old was firstInitLastName and the new is firstname.lastname.Jamf Private Access seems pretty straight forward. Just reconnect it to the new Okta and they authenticate against the new Okta, same as the Jamf Pro for the admins and as I've been able to do with our other applications. What's the best way to migrate all the Mac users from one Okta to another without users needing to recreate a new local user?

Has anyone had any experience in deploying Fortinet's FortiClient to computers? I get a DMG from our on-prem controller but that doesn't install when I use Jamf Pro to install onto client machines

My Google-foo is failing me.  Although my script works to trigger the Jamf helper window - I get 'posix_spawn(): 2: No such file or directory' <-- And as far as I can tell it's because i'm trying to call launchctl -but - can't figure it out.  Is this an error I should be concerned about?JHELPER="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" LOGGED_IN_USER=$(stat -f%Su /dev/console) LOGGED_IN_UID=$(id -u "$LOGGED_IN_USER") echo $LOGGED_IN_USER WELCOME=$("$JHELPER" -windowType utility -windowPosition lr -heading "Urgent message from Mac Desktop Services." -alignDescription natural -description "An urgent OS update is needed on your system. Please run sofware update at the end of the day (Apple Menu --> System Settings --> General - Software Update) and install Ventura macOS 13 updates to bring your system to 13.6 if it is not already. Please do not click Upgrade to Sonoma, only updates for macOS 13 Ventura " -button1 "Go to u

Buen día, por favor alguien sabe cómo aplicar bloqueo de pantalla, al cerrar la tapa y abrir ya tenga el bloqueo para ingresar password, esto desde jamf pro. Saludos!!

Hi folksI know, its maybe more an Apple topic as a jamf topic. But hopefully is here someone who has experience with this.So I just started to configure in the Apple Business Manager and Entra the Federated Authentication and the Directory sync. I was able to configure everything. My idea was to test this with one testuser (created through me) which will be also have an private apple id.When I am in the last step to enable the federated Authentication, I see an info, that i have 155 username conflicts. So I just stopped with this and have not enabled it for nowDirectory Sync is already enabled.In the Azure App I have only me and my testuser which I would like to test first, before enabling it for all.So anyone an idea what I have missed or done wrong. I need to test this first, document it and then I need to inform also all of the 155 user they are in the conflict.As i was reading the apple documentation, I saw this:Apple Push Notification service (APNs)APNs certificates are most

I normally run this script when trying to log into multiple computers via Apple Remote Desktop:osascript -e 'tell application "System Events"' -e 'keystroke "username"' -e 'keystroke tab' -e 'delay 0.5' -e 'keystroke "password"' -e 'delay 0.5' -e 'keystroke return' -e 'keystroke return' -e 'keystroke return' -e 'keystroke return' -e 'end tell'When I try to run this script on computers running Mojave I get the error:execution error: System Events got an error: osascript is not allowed to send keystrokes. (1002)

I am new to Jamf School. I would appreciate some assistance with some general questions. I successfully uploaded our asset tags into Jamf School to match serial numbers:Can I customize the search function so I can search using Asset Tag? Currently when I am in Users and trying to assign a device to a User I need to have the serial number and I would prefer to use the Asset Tag. When in Device Groups I am trying to add Members and the Asset Tag is not listed only the Serial number and again I would like to be able to add by asset tag. How do I change that?When I assign a device to a User it says Successfully Assigned, but the Devices assigned to the User still says 0. I am not having any luck finding solutions in the Jamf School Documentation or videos. Any help would be appreciated. 

Hi Everyone,Our users all have two teams clients a 'Microsoft Teams' and a 'Microsoft Teams Classic' which seems to have installed overnight (I suspect MS auto update). We use company portal to enroll the devices into Intune and enforce device compliancy, the Classic client works fine but the 'new' teams client doesn't show the device as compliant and thus fails to authenticate. for the moment it isn't causing an issue as users are using the classic client, I'm just curious if anyone else has seen this issue and has a fix? Many thanks!  

Hi there, We have a Jamf Mac devices seems to be getting a lot of Jamf Connect notification along with IdP password does not match local account password and jamf connect login sign in window is greyed out. Any suggestions? I think we have pushed connect version to the newest at first but then rolled back.