We have a PreStage set up for the techs to assign computers to (we have more than one PreStage)They need access to the PreStage for computer/Device assignment.Unfortunately they need to have update access to the PreStages in order to do this.And you know what happens when techs get update access that lets them change everything, they change everything.Is there any way to lock the PreStage down but still give techs ability to assign a computer/device to a PreStage?

Hello Nation!Trying to see what's the best way these days to script Zoom installs and automatic updates for it without bothering staff with updates. Thanks in advance!-FS

Just this week, we are noticing that many Macs, but not all of them, are not able to print via our Windows print server. Nothing has changed on our Mac side.We are printing via PaperCut, so using SMB on a printer installed via JAMF and no changes to the setup.Macs not joined to the domain and not using the AD Username as the machine or profile name in many cases, but likely in many others.I can add PaperCut LPD to the print server and print via LPD - but no authentication, so the job gets stuck with no way to get it to print from Papercut, unless the users profile on the Mac is named the same as their AD username.The issue looks very similar to this one:https://community.jamf.com/t5/jamf-pro/mac-printing-issue-after-microsoft-windows-print-server-update/m-p/246842However, we don't have the server updates referenced in the thread or PaperCut advisory.Affected systems are running Monterey, Big Sur, and Catalina.One Mac that was able to print, stopped printing immediately after upgrading

Hello,We signed up for a cloud RADIUS solution for our WiFi auth through portnox.com, and then set up the environment to use SCEP and push out these profiles to our MacBooks.  Everything worked great and successfully pushed to most all of my devices (and the WiFi works great for them) however two of my devices keep throwing this very unhelpful error, and I can't for the life of me figure out what's causing it. It feels like the issue is at the device itself, however there is nothing special about either of these devices compared to the others (same profiles, same polices, etc. same OS version (Ventura).    The error simply says "Unable to obtain certificate from SCEP server at "scep-eus.portnox.com".   <InternalError:1>.   These devices are connected to the same network environment as the others, so it's nothing related to the corporate firewall blocking access, and they have the same issues when they take their laptops home.&nbsp

Hello EveryoneWhen I select a group in Software Update payload, and select Download, Install and Restart install option with Latest version based on Device eligibility, the device does download and install however it will not restart the computer.The local IT team has to touch each computer to click the Sys Pref > General > Software Update > Restart. All computers are on at least 13.4.xCurrent Jamf Pro ver 10.50.0Anyone else having same issues or know the fix

We have about 200 employees with all 100% WFH. On paper, I think our patching numbers looks good relative to our user count each week, but my boss isn't buying it as optics are funneled all through Slack and each week, we have about 3 - 5 people complain an app broke during patch. My boss also gets hit up with anecdotal issues of someone complaining to him something broke during patching, and all of that is coming to me. We are using just policy based scripts with smart Groups, instead of leveraging Patch Management, Installer, and 3rd party tools. My question is what does a healthy patching environment look like in terms of statistics? Do you have complaints each week that an app broke? What percentage just fixed an app themselves without reporting or complaining? What are you using to patch our heavy hitters: Zoom, Chrome, and Slack?

 Hello All i wanted to ask if this looks right, is this the correct way to restrict the Mac os senoma beta software? 

We have recently implemented a new pre stage which includes jamf connect. Its been working great. However had some machines that don't seem to be enrolling correctly. As there is no jamf long in the console.I have wiped the machines and deleted them in jamf but this hasn't helped.Thanks 

Any AppleScript people out there that can help me figure out why the "open location" part of the script is failing to open to the URL?This works:osascript -e "tell application \\"$browser\\" to activate"This does not work:osascript -e "tell application \\"$browser\\" to activate open location "https://www.yahoo.com""  loggedInUser=$(echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ && ! /loginwindow/ {print $3}') # identify default browser defaultBrowser=$(plutil -p /Users/$loggedInUser/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, "\\""); print arr[2]}') if [ "$defaultBrowser" = "com.google.chrome" ]; then browser="Google Chrome" elif [ "$defaultBrowser" = "com.apple.safari" ]; then browser="Safari" elif [ "$defaultBrowser" = "org.mozilla.firefox" ]; then browser="Firefox" elif [ "$defaultBrowser" = "com.microsoft.edgemac" ]; then brows

Hello,Would it be possible to deploy the Company Portal without having the users to log in to the app?I have a Jamf Connect setup where you authenticate with your Microsoft Account and Jamf Connect to sync the password locally. Would it be possible to use Jamf Connect to automatically fill in the account for the Company Portal?

 Hello,Our new Anti-Ransomware product needs a way to shut mac systems down.Something like ‘echo <password> | sudo –S shutdown –h now ‘ deployed via ssh would probably do the job; However we are using LAPS script by Phil Redfern (root password is also stored as an extension attribute).The question is how to get the LAPS password out of Jamf – the Anti-Ransomware product uses PowerShell?Any ideas?Thanks, Regards, JK

Hi,I'm very much a novice when it comes to launch daemons and the instruction on this page have me flummoxed https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-schedule-scan?view=o365-worldwideUnder the sub heading "Load your file" it has <your file name.plist> I cannot find any reference to this "Your file name.plist" Any assistance with this would be greatly appreciated. ThanksMatt

Hi all, we are just about to configure SYM and was wondering if anyone had the dimensions for the welcome banner, other images and icons etc so we can prepare these before we start the install. TIA

 Greetings, Goal:I have been trying different GitHub workflows created to automate the process setting and locking a desktop background image on a macOS computer. Problem Statement:My core issue is after I use a workflow to install the image on the test computer. I cannot find a workflow to set that stored image file as a desktop background that works for me.  Two examples: Example #1 Published this year for Intune. Not jamf pro but the workflows for scripts and configuration profiles should be MDM agnostic. Step one: Use a script to download the wallpaper. This works. Step two: use a .mobleconfig to set the wallpaper. This does not work for me and there are no readable logs so I am having difficulty debugging the problem with workflow. All I see on the test computer is the screen flash when the configuration profile is saved and after that, the desktop image stays the same.  Example: 2Armin Briegels desktoppr workflow. Last updated 05/

There's this SSO plugin that offers platform-wide SSO on a Mac. It works great. https://learn.microsoft.com/en-us/azure/active-directory/develop/apple-sso-pluginBased on this blog from July, the extension should work for the login window starting with Ventura, but I can't find anything recent on how to actually make this work. https://techcommunity.microsoft.com/t5/endpoint-management-blog/microsoft-simplifies-endpoint-manager-enrollment-for-apple/ba-p/3570319 Anyone else tried this or seen any other information on how to deploy this feature? 

Hi there,Does anyone know of an extension attribute or a way to reference devices' current set login mechanism. This is to run authchanger policies whenever jamf connect isn't the set login mechanism i.e after macOS upgrades and every other state we've not yet encountered but could potentially revert the login mechanism back to macOS default.

I had a smart group set up that I used for years, but I can no longer find it and I need to recreate it.I enroll iPads before students come in to pick them up. When they arrive, I show them how to do one of two things 1) sign into an existing personal Apple ID account or 2) set up a new Apple ID account using their school email address. I'm working with several kids at a time but I usually don't keep track of who shows up because I had a smart group set up that would keep track of who signed into their iPad. This is how I knew who still needed to pick up a device. Now that this smart group somehow disappeared, I've had to rely on a spreadsheet and basically take attendance with each group so I know who has been set up.I've been having difficulty recreating this smart group so I'd like some help. I have new students from different graduating classes receiving different model iPads, so none of those criteria types would narrow down. The iTunes Store Account criteria of 'Active' woul

I was searching around and looking for a possible way to start removing/limiting what users can install/do on there own. I run everything on JamF and I wanted to start cracking down on this as our windows machines are pretty locked down on what a local user can do. (Removes Local Admin.)(Replace USERNAME with the user's name that you’d like to remove from admin.)dseditgroup -o edit -d USERNAME -t user admin —----------------------------------------------------(One user per machine.)#!/bin/sh LoggedInUser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) dseditgroup -o edit -d $LoggedInUser -t user admin—----------------------------------------------------(Change Standard Member -D to Admin Account -A.)dseditgroup -o edit -a $LoggedInUser -t user admin I found and formatted/referenced these scripts and I was wondering if this is still what is used for 2019+ MBP's. Mainly the new M1/M2 devices before

Hello, I've got a third-party vendor that builds a private internal app for us. They're switching their developer tools and asked if JAMF is able to push progressive web apps. I don't know how to answer that as I'm not sure what that means. Does anyone have an answer to this question or do you need more info?

Hi All,I was wondering how my fellow admins handle this dangerous allowance if someone is a full admin. Some context is that you create a package and we scope by username however there is the option to change the default to "All mobile devices" instead of the default "Specific Mobile" devices. How are you guys handling this change control on this? I have heard of people using "Sites" to make sure that apps live in sites but this still doesn't prevent someone from 'mistakenly" scoping to all mobile devices.

Hello All I am trying to setup BYOD for mobile devices, we only need to push a password requirement to these phones. i have user enrollment enabled but I have a question regarding managed apple id's. Will the users need to have a managed apple id in order to enroll their personal phones? Preferably wed like it to not be required as we dont think every user has a managed apple id Also how can i capture which user is tied to the phone once they are enrolled. I am following this guide here https://docs.jamf.com/technical-papers/jamf-pro/byod/10.17.0/User_Enrollment_Experience_for_Personally_Owned_Mobile_Devices.html Thank you for your help

I've recently create a 2 configuration profiles (user level & computer level) to lock down certain features per our security & compliance needs. I scoped the profiles to a device group which contains devices running 10.8 and 10.9. Yesterday i received a list containing devices to be excluded from the user level profile (preference pane restrictions) so made the changes clicked distribute to all. Which brings me to my issue... The restrictions are still being applied I see this in my JSS under the Management tab... Remove Configuration Profile CMC User Policies Profile with identifier '750C5D23-D748-48AA-B0EA-D0CB9E8427CB' not found. <MDMClientError:89> On 1 of the devices I ran... profiles -P which returned this... _computerlevel [1] attribute: profileIdentifier: _computerlevel [2] attribute: profileIdentifier: _computerlevel [3] attribute: profileIdentifier: _computerlevel [4] attribute: profileIdentifier: shanpo [5] attribute: profileIdentifier: 7

Hi folks,Does anyone know a way to enforce the screensaver after 20 minutes of inactivity and require password to unlock in Ventura?I've been trying through a script but it doesn't seem to work, and end-users are still able to change the settings through System Settings.Thank you!

Hi all, Many of our users have less than 12 gb of free space remaining on HDD. Thus, no OS upgrade is possible and SSD performance is impacted.Is there a way to display a popup to concerned users to make a data cleanup ?Thanks

Hello,I am new to JAMF and still learning how to use the application. I was trying to set up a Macbook M1 for a user in our organization and now I'm unable to find the local account password for the Macbook. The steps are listed below:1. I completed the standard setup process for my MacBook, which required me to create a local admin account.2. After that, I connected the MacBook to my organization's network.3. Then, I enrolled the MacBook in Jamf using the Jamfcloud enroll feature.4. However, since Jamf is now managing the local admin password, I am unable to locate it on the Jamf platform. Can someone kindly advise me on how to retrieve the password for the local account of my MacBook on Jamf?