Happy birthday, Jamf! On June 10th you turned 21! But it’s not just your birthday this month. It’s also Charlie Root’s 30th birthday today! If it weren’t for Charlie, probably none of us would be here right now. Who’s Charlie Root?   Digital spelunking I consider myself an amateur digital spelunker and enjoy digging around the visible and hidden files of macOS to see what I can find. Apple has hidden some iconic Easter eggs in macOS over the years. Some are well-known. Easter eggs are those delightful undocumented software features that you might stumble upon accidentally or if you’re paying a little extra attention. They’ve come and gone over different versions of macOS, but Ventura still has a few to uncover. Look closely at the Maps icon and you’ll find the intersection of the 280 freeway and North Wolfe Road in Cupertino. In the upper right corner is Apple’s headquarters, the ring-shaped Apple Park.   Navigate to System > Library > CoreServices. Right-click CoreT

Wanted to share this, finally able to deploy Finale 25.5.0.259 via jamf.This does not handle the licensing part however. This is still a bit rough around the edges, bit functional for me. Two packages & one script Package One Package that copies these files to the target computer, I used tmp MacDiskInstaller25.5.0259.dmg silentInstallerChoices.plist silenInstallerChoices.plist was downloaded from https://makemusic.zendesk.com/hc/en-us/articles/115007423647-Commands-to-silently-install-Finale-unattended-installer-#installMac Package Two Install Finale 25.5 on a machine, you don't have to launch or license it, Capture / Make a package of " userssharedGIFF_SAMPLE" Install script Modified from https://makemusic.zendesk.com/hc/en-us/articles/115007423647-Commands-to-silently-install-Finale-unattended-installer-#installMac #!/bin/bash hdiutil attach "/tmp/MacDiskInstaller_25.5.0.259.dmg" sleep 30 sudo installer -verbose -pkg /Volumes/Finale/Install Finale.pkg -target /

For whatever reason, there was a day when the macadmins slack was particularly goofy & there was a call for poems. I posted this Haiku: I have a problem.Use regular expression.I have two problems. I can't take credit for the joke above, only for formulating it as a haiku. The origin goes back into the lore of computing. Here's a good summary: https://arstechnica.com/information-technology/2014/05/what-is-meant-by-now-you-have-two-problems/ The regular expression syntax is an amazing human achievement. (Really!) The addition of regex values in Jamf Pro Smart Groups (which I have used a lot) probably made the idea of using them even more appealing. Eventually, most macadmins encounter a situation where they believe regex may be the answer to their problem. Often, it has something to do with date / time stamps, or, version strings. However, there are good ways of handling version string comparisons WITHOUT writing your own regex. You should take advantage of them. Don't introduce

Asana application does not have a .pkg file inside the .DMG? any suggestion  Here is the download link: https://asana.com/download 

If anyone needs it for scoping this regex will include all computers _not_ supported by macOS Ventura. So when new models are released you won't have to update the regex.^(iMac[1-9],\\d|iMac1[0-7],\\d|Macmini[1-7],\\d|MacPro[1-6],\\d|MacBook[1-9],\\d|MacBookAir[1-7],\\d|MacBookPro[1-9],\\d|MacBookPro(10|11|12|13),[0-5])

I have deployed a Jamf Protect plan to one of our computers. Following the instructions here: https://learn.jamf.com/bundle/jamf-protect-evaluation-guide/page/Threat_Prevention_with_Jamf_Protect.htmlI run the program and it gets blocked. However, we I run any of the tests at https://www.wicar.org/test-malware.html there is no detection from Jamf Pro.  What is the limitation of Jamf Protect and how much does it do to protect against malware, viruses, etc. For comparison, we currently use Sophos and that passes every test we have tried.

Preface: Maybe I'm missing something obvious... For DEP deployments, we have an Enrollment Complete policy that waits until a user is logged in to throw up a splash page and custom triggers our big config policy to then do the configuring we want, then it reboots, etc. Here's the logic in the Enrollment Complete script that confirms the user is logged in before kicking off the config: #!/bin/bash until [[ $LoggedInUser != "_mbsetupuser" && $LoggedInUser != "loginwindow" ]]; do LoggedInUser=$(defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName) sleep 1 done echo "$LoggedInUser has logged in, beginning configuration..." The issue is that the login process begins immediately after the Create User screen, thereby updating LoggedInUser to pass the until loop. This would be fine, but following Create User is the Choose a Time Zone screen. So sometimes, if a user doesn't pick a Time Zone quickly enough, the splash

I want to get a recovery key for an individual device. I went to Jamf resources and watched a video on how to get a recovery key, but I did not find this item in my management.I have Filevault enabled in my configuration profile and I have Recovery Key Redirection enabled.Please tell me what I need to configure so that I can watch the recovery keys just like in the videoWhen I enter management, I do not have an item with an Individual key

Hi All,This is a short Bundle ID reference for managing Notifications in Big Sur (if you want to turn them off in a student lab etc.)  These are the ones I've disabled this year on Big Sur 11.5.2.  You may wish to add your own to this thread if you think others might benefit.Notification Center bundle ID's for installed programs can be found at:~/Library/Preferences/com.apple.ncprefs.plistmacOS Big Sur - Default App - Bundle IDsBookscom.apple.iBooksXCalendarcom.apple.iCalFaceTimecom.apple.FaceTimeGamescom.apple.gamecenterGarageBandcom.apple.garageband10Homecom.apple.HomeiMoviecom.apple.iMovieAppMailcom.apple.mailMapscom.apple.MapsMessagescom.apple.MobileSMSPhotoscom.apple.PhotosReminderscom.apple.remindersSafaricom.apple.SafariScreen Timecom.apple.ScreenTimeNotificationsSmartCard Pairingcom.apple.ctkbindWalletcom.apple.Passbook  New to Mac / Tours (Still testing)com.apple.apd.touristd 3rd Party App - Bundle IDsCreative Cloudcom.adobe.acc.AdobeCreativeCloudGoogl

Hello,We have a problem with only a few devices. We cant push/install the microsoft teams app.There is an error in JAMF School:Bag Load Failed / Bag Load Failed / Das Zertifikat für diesen Server ist ungültig. Eventuell wird eine Verbindung mit einem Server hergestellt, der vorgibt, „bag.itunes.apple.com“ zu sein und vertrauliche Daten gefährdet. / Der Vorgang konnte nicht abgeschlossen werden. (kCFErrorDomainCFNetwork-Fehler -1202.)We couldnt find any information about this error?Thank you very much in advance for every hint.regards 

Hello!I registered 11 new iPads with JamfSchool.After that I wanted to install 8 apps. 5 of the 8 apps installed without any problems.But for "Stop Motion", "Book Creatoer" and "IMovie" I got the message:"This app is not yet in scope for this device, please wait for the update to finish".Which update should I wait for and what happens now?Its iOS 16.1.1Best Regards,Ralph

Who's the best Jamf employee you know? Let me tell you who I KNOW is! Her name is Kat Garbis and she is by far and away the most influential, amazing, intelligent, and greatest MENTOR a customer could have! If you havent met Ms Jamd Diva Kat Garbis, come see us present again at this years JNUC in Austin, its going to be a Rodeo and a HALF!! How We Transformed Our Existing Setup to Zero-Touch and ZTNA Dan Lawrence (formerly known as PC Tech Guy) is back as a Mac Endpoint Manager for MedMutual.This session will walk you through:- Rebuilding an existing infrastructure- Creating a zero-touch experience for technology- An action plan to accommodate a hybrid work environment- Leveraging Zero Trust Network Access (ZTNA) and building it into our infrastructure- Creating the ultimate out-of-box experience for end users both on- and off-site@jamfkat 

We have had a policy setup for the past two years that has worked with out fail on 10.13 this no longer works. Has anyone had the same issue and found a fix? Institutional key with management account.

I used this process to rekey/ key escrow all my Macs on High Sierra and Mojave, and it seems to be working fine. https://github.com/homebysix/jss-filevault-reissue I am seeing some strange behavior, however. Someone told me they were asked to Rekey/Escrow multiple times. Upon checking the policy logs, I can see a few users were asked to Rekey again a few weeks after they've initially Rekeyed. I can't seem to find any similarities between the computers that this is happening to.Has anyone experienced this? Its almost like the key goes bad or gets corrupted.

has anyone created a policy that creates an individual recovery key on a mac laptop that is currently enrolled, encrypted and without a recovery key listed in it's inventory information under MANAGEMENT --> FILEVAULT 2? what exactly happens? does anything happen to the current users that are filevault enabled? inventory shows the laptop as encrypted but no individual recovery key, so I'm thinking that i can create the individual recovery key with a policy using the Disk Encryption payload

Im in the process of moving over to Jamf Pro from Jamf Now (formally Bushel). All of the laptops are encrypted with Jamf Now and their recovery keys escrowed there, but i want to be able to escrow those keys in Jamf Pro. I have having a particularly hard time escrowing reissued keys with 10.13 + laptops and haven't found any solutions online. What's up with that?? Has Jamf created an actual way to do this or has anyone here had luck reissuing keys for laptops running High Sierra?

What are people using on High Sierra to repair invalid or unknown individual FileVault keys? We were using the fde-rekey package (https://github.com/square/fde-rekey) but the developer has no plans to support APFS. We used fde-rekey because we didn't want to prompt our users with a password popup using the jss-filevault-reissue script (https://github.com/homebysix/jss-filevault-reissue) but if that is the only option on High Sierra, we may have no choice. I haven't discovered any other options.

I know this has been discussed before, but wanted a fresh take on it as it seems old methods are no longer supported. We have numerous users who have enabled FileVault via System Preferences, and not by Jamf, therefore we don't know what their personal recovery keys are. What is the best way...if there's a way...to redirect these keys to the Jamf server? I've tried the config profile to escrow the key to the JamfPro server, but it doesn't seem to work even though the profile successfully installs. I look in the computer's management tab, and the key is still unknown. Any of you wonderful folks have an idea? Thanks!

Hello everyone, Occasionally, we have a Mac enroll with an unknown or invalid FIleVault 2 recovery key (an example is when a Mac is encrypted before MDM enrollment). We currently use a script that prompts the user for their password, and then rotates and re-archives the key. Script: https://github.com/homebysix/jss-filevault-reissue I have just learned that in Catalina, Apple has removed the ability to pass the username/password to the fdesetup tool. The script notes this at the bottom of the page: "This script will not work on macOS Catalina due to the inability to pass user authentication information to the fdesetup tool." Does anyone have a solution to ensure the FileVault2 recovery key is escrowed to the JSS in Catalina?

I have a smart group that looks for invalid FV keys to determine if the key needs to be redirected to JSS: Based on that, it'll run the following script (https://github.com/JAMFSupport/FileVault2_Scripts/blob/master/reissueKey.sh): #!/bin/bash #################################################################################################### # # Copyright (c) 2017, JAMF Software, LLC. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. #

Hi folks, Does anyone have scripts available for Sierra and HighSierra that will enable a local user for FilveVault 2 - prompting them to enter their password, then confirm, then error if the passwords don't match, and proceed if they do. Thanks

Has anyone got FV2 Key Rotation working through policy for 10.13? I understand that the management account needs to be enabled for FV2 for this to work but that policy also fails for me..

I am looking for proper workflows to enable FileVault with Big Sur. Are there any new changes in 10.26 regarding FileVault configuration (current process seems very archaic) I currently use the FileVault process form the Jamf Admin's Guide and that works with 10.15 and so far with macOS 11 Another concern is escrowing filevault keys that may not have been escrowed in jamf, the Jamf FileVault escrow script works in 10.15 but not in any tests with macOS 11, is there an update to this?

Hello @elliotjordan and others! Elliot I have been using your Filevault reissue script with success, however I have one machine in particular that keeps erroring out:Running script reissue_filevault_recovery_key.sh...Script exit code: 11Script result: Alerting user washburb about incoming password prompt...Prompting washburb for their Mac password...Successfully prompted for Mac password.Issuing new recovery key...[WARNING] fdesetup exited with return code: 11.Adding personal recovery key.Error running script: return code was 11.I am a little fuzzy on what "authentication" the error is referring to as it seems like they are putting their password in correctly. There is a profile set up on their machine to redirect keys to the JSS. Any insight on where to look in this case? Strangely, I also see that there is a key in the JSS for this user, but I am thinking that it is no longer valid at this point. Any insight would be much apprecitated.

Hi, Can someone provide a plist that can be used as a baseline for UBlocker Origin extension whitelisting? It has been a huge struggle to put one together. essentially, we are trying to push only whitelisting of URLs for the extension in chrome.