In our environment, we have one device which we trying to do DEP enrolment but its failing with below error for specific user ID. if we try same device with different credentials the enrolment works flawlessly."Enrolling with management server failed Unexpected error MDMResponseStatus: 500"Even we tried user initiated enrolment but does not work as well with the specific user ID. it fails with attached error.The device is mapped correctly in ABM as the enrolment works fine with different user.Thank you.

We have around 10 smart groups we use for our 3rd party updates. All the smart groups are set to use the Criteria "Patch Reporting Software Title" then we point it to the Patch Management we have setup for that specific software and we use "Less Than" and pick our version. For some reason our Adobe Reader group isn't reading the devices correctly. We're currently deploying version 23.003.20269, but this smart is listing devices that have already been updated to 23.003.20269. None of the other smart groups are doing this. Not sure what's going on.  

Hello, What would be the best way to prevent users from downloading software/applications from the internet. We have the appstore blocked in the restricted software section but I am worried they can download some software/apps from Chrome or Safari with DMG files?What would be the best practice to prevent this?Thanks 

Does anyone have a working Extension Attribute to read if the Root account is enabled? The one I was using does not appear to work anymore, and none of the commands I am seeing on the internet are working either. This is what I was using.  #!/bin/bash rootCheck=$(dscl . read /Users/root | grep AuthenticationAuthority > /dev/null 2>&1 ; echo $?) if [ "${rootCheck}" == 1 ]; then echo "<result>Disabled</result>" else echo "<result>Enabled</result>"\\ fi   

As part of our organization's requirements, we need students to input Admin credentials when they first launch the application. To streamline this process and reduce the burden on our technology department, I'm exploring options to automate the initial setup. Specifically, I wonder if there's a way to implement a post-script that includes the ADMIN USERNAME AND PASSWORD, allowing our students to use the application without manual intervention. I understand the importance of security and confidentiality, so I'd appreciate any guidance on implementing this in a secure and compliant manner. If there are alternative approaches or best practices to achieve this goal, please share your insights. Thank you for your time and assistance in advancing this matter. I'm eager to find a solution that balances ease of use for our students with the necessary security measures.

Hello NationI started to optimize a few things in our PreStages. Better said, i started with testing for our new PreStage.Following problem for me:After my prestage with jamf connect notify script (wich installs everyhing an user need) I need to start instantly after the desktop appears to user the device compliance registration steps for the user. In the past I have done this normally with a script and a policy which runs after the macbook is enrolled. The problem with this is that in most cases the script do not start always after the desktop appears. Although not with the login trigger in the policy. So my first idea was to do exactly the same but with an launchagent or deamon. So i created a package with an LaunchAgent which should run the script atload. This works fine, but the script doesnt do all the steps.Because I want keep everything small, I decided to create the launchagent which open only the selfservice policy at load. I dont know why, but this doent really look

I hope you're doing well. I'm currently working on a project within our organization that requires students to input admin credentials when they first launch an application. To simplify this process and reduce the workload on our technology department, I'm exploring options to automate the initial credential input.Specifically, I'm looking for a way to streamline the admin login process when students launch the application for the first time. I'd like to avoid manual input of credentials and make this more efficient for both students and our IT team.Has anyone here encountered a similar requirement, and if so, how did you address it? Are there any tools, scripts, or best practices that can help automate this admin credential input during application launch?

Hi Jamf team, Our Automated Device Enrollment Instance server token expired. I followed this steps to renew ityoutu.be/HBV9VoRzajM however, every time I try to upload the key it gives me " the file received was not valid" error I can't see any difference between last year token name and this year except the date. I don't understand why it throws error.I would be appreciated if you could help me in this matterMany thanks  

We use a script to rename our Macs along the lines of DA-%SERIALNUMBER%For the last year or so, around half of our estate (I expect those using our campus network) regularly renames itself along the line of DA-FVFHF4BGQ05F (6), the suffix number incrementally increases and we have some devices with hostnames that end (533) or greater. This obviously looks a total mess.I don't fully understand why this happens, nor how to prevent it - I presume it relates to the device wanting to avoid a duplicate name on the network, which in our case would only be itself, so it's confusing why it happens at all.  WIndows isn't affected in the same way. I suspect the ultimate fix would be something at network level, but wonder if anyone knew the root cause, or had dealt with this via macOS config and/or Jamf?

When our users change their SSO password, JAMFs pops a message that the passwords are now out of sync and to enter your "local password" in order to sync. When that local is really their previous SSO password. This is confusing all our users since we rolled this out. Is this wording able to be changed? Thank you.

Is there any industry standard documentation on the XML format of app level configuration options or is that something I get from the third party vendor of the app in the form of a schema that their developers make available?

Hi there, When opening the Jamf Pro portal on the notification section (blizzard) I noticed I get the message: Device Count ExceededThere is an link: Purchase additional devices here but when browsing to the link from the Jamf Pro portal to this address: https://www.jamf.com/jamf-nation/my/renewal I get a 404 error: The URL requested does not exist.Contact support or your Jamf Buddy to report the broken link. Only from the Dashboard I can see the software licenses. But I don't think this is the issue I'm looking for. I'll attach some screenshots perhaps anyone knows how I can solve this issue. I don't think this will effect further enrolling devices but I just want to get this fixed and get the notification solved/gone. Hope to hear from you, Kind regards, / Bart

So I created a static group for the purpose of sending out targeted messages when needed. The idea being, if I have a need to send a message to a bunch of iPhones or iPads, I could put them in this group and send the message out. That's just background on why I created the group.After I was done with the group task, I pulled up the group membership to remove all the devices from the group, and I don't see any way to do that. I can "view" the group but there's no way to select all or a portion of them and remove them from the group. In other words, there's no check box next to the member devices or an "select all" option.I see how I can search for a member and then remove that member from the group but seriously that can't be the way it works right? I have to delete them individually by searching? Seems like it would make a lot more sense to be able to select the "view" option, see the list of members, and just uncheck the ones you want from the results a la cart so to speak.What am I m

We have several hundred field workers with iPhones and iPads. Our mobile apps are set to auto update when updates are available. When in the field, and away from WIFI, often times, the app updates will take a considerable amount of time to finish, during which the app is unavailable to use.Is it possible to have app updates only happen when connected to WIFI? That way, updates would never happen in the field and disrupt the use of certain apps. I would like to retain the ability to deploy and install new apps even when the people are away from WIFI. So if it is possible to only UPDATE apps over WIFI, would that prevent them from RECEIVING and installing new apps in the field?Thanks,Rob

Hi All,We need to disable all safari extensions through Jamf Pro except few. I have achieved for google chrome using plist but not for safari.If anyone has done this, please let me know.

Hello,I'm new to managing devices (iOS) in Jamf Pro. I'm looking for a set of best practices when it comes to setting up devices, including restrictions, settings etc. We have just a few iPhones in the company but I want to make sure they are properly secured and managed. Any advice is much appreciated! Thanks. 

Guys,We are migrating to Intune from Jamf. And our end users are standard users and for the installation of MDM profile it's prompting for administrator credentials. So I tried making the standard users as an admin using shell script and as soon as they enrolled into Intune once again using another shell script to convert them to standard users. But that's not working when I tried it in my Mac as username should be add in sudoers file. Even unable to create an admin account too getting the below message. Kindly advice. 

Hi Folks,I'm trying to find a way to update our extension attribute every 5 minutes, but only one specific, so i don't want to mess with the inventory collection.I figured my best bet is to create a script that does the same as it does now for the EA, but instead of just doing a <results> echo, writing it directly using the APII still need to redo my JAMF 400 since i found the whole API thing so confusing, but i think i have the idea down.would this be effective/would you do it differently?-credentials-grab serial number from system profiler-use serial to grab the computer ID using the API (so "https://***.jamfcloud.com/JSSResource/computers/serialnumber/$serial_number")-execute the script (in this case, it checks the IP for a specific interface)-writes the value using the API by using the previously fetched ID (i think this should go via the computer then, not clear if there's a better way?)as you might be able to tell, i kind of know what to do but still feel lost, tips/hi

TeamWe have planned to enroll Yubikey for our Mac population.We have pre-configured Keys: customized PIN + PUK.When the user lock his smartcard logging into his session, Mac os is not asikng him to insert his PUK code.This is done in windows using deployed "Yubikey Mini Driver". I see no such app for mac os.This a major roadblock for the project. Any idea heroes ?

Hi, I've created a 802.1x Ethernet configuration profile and deployed to a couple of test devices.I can get 802.1x to connect going into Network - Ethernet Connection - Details - 802.1x - select Configuration Profile for Network and clicking connect. It auths via TLS and connects but i would like this to happen automatically, we cannot expect our users to manually go in and connect everytime.Does anyone know how i get this to connect automatically? TIA.

Although it is common for Major OS upgrades to disable the Jamf Connect login window, I've noticed that when installing the Apple Studio Display software update, on reboot the Jamf Connect login window is missing.  Is this a bug in its update logic for OS updates, where it still thinks one is happening and stays disabled? I've noticed that authchanger will not restore the screen, but if I let the machine sit long enough, it seems to recover. Again, making me suspicious this is something to do with it's OS update/temp disable logic.I'm seen this on OS 12 and 13, and currently Ventura 13.3.1 with Jamf Connect 2.23.Is there a log I should be looking at to see what Jamf Connect thinks is going on?

Would like to have advice.i know i can do "sudo jamf policy -event" to trigger policy in jamf pro. but if i want to manual trigger one 'confiugration file', how to do that?ThanksChris 

Hello all,With some help from our community I've been using Dockutil for our elementary classes for a while (hint: I need help again). However, while I'm waiting and hoping for someone to enlighten me on how to apply dock changes using based on the Active Directory group membership of the logged in user, I figured I'd open up the conversation a bit and ask what methods you all are using and prefer to offer dock configurations to end users. My challenge is of course that as a PreK-12 school, we have very young users.An alternative solution I'm thinking of is offering Dock Configurations via Self-Service using Jamf's built in Dock Policy. Apple has made it increasingly difficult for admins to administer (while making things safer to be fair). I still miss the remote desktop solution that was once part of the suite of tools. Here's hoping ARD continues to live (and work). 

Hello everyone. So I'm a bit confused about the subject. We're doing a refresh of staff computers this year. M1 MacBook Airs. Until recently they did not have the ability to use this feature due to hardware limitations. Many of them were looking forward to using this feature. A teacher and I were doing some testing on a machine I ordered just for that purpose. When she tried using a popup appeared saying something like "you can't use Universal Control because your account doesn't have 2FA configured.Of course our Managed ID's have 2FA so I did a bit of searching and came to find out that Managed ID users are unable to use UC. I did a quick search of JAMF Nation and found out there is a profile setting, under restricted,  that allows you to enable UC. My question is does this just work with non-managed ID's?I'm really disappointed that Apple would do something like this. We purchase the same hardware as consumers do. Use the same software, have 2FA configured. Not only is UC not su

I'm aware that JAMF has the "Wipe Computer" MDM command, but for security reasons, this doesn't go far enough. After the MDM wipe is complete, the device is still usable since it just deletes all the data and does a reinstall of the OS. I'd like to know if there's a method to remotely wipe the entire drive of a machine like what you can do in Disk Utility. That way if a device is stolen I can render it completely nonfunctional.