In some of my workflows, I check the return code from a policy that is executed before continuing. If the policy fails, it will attempt to run the policy again, etc. Here are a couple of examples of how I check the return code: # Example 1: for ((i=0; i<=3; i++)); do if /usr/local/jamf/bin/jamf policy -event "$event"; then echo "Success" break else echo "Failure" fi done # Example 2: /usr/local/jamf/bin/jamf policy -event "$event" [ "$?" != "0" ] && echo "Error" I have been using these techniques for quite a while with no issue, but just recently the policies that check the return code of a policy are reporting failure code 1 even though they appear to complete successfully in every other way. E.g. they show having completed successfully in Jamf Pro, the packages/scripts run by the policies complete without error, etc. I have even tried running some of my policies manually from the command line and checking the return code as in

Hi,I'm having an issue with a specific User-initiated enrollment does not complete fully on a MacBook Air.After enrollment the MacBook's serial number shows up in Jamf Pro console, but does not have any associated data/reports. For example, OS has null value, last Update has null value, etc.Running "sudo jamf recon" or "sudo jamf policy" on the client returns:The file /Library/Preferences/com.jamfsoftware.jamf.plist does not exist. Use the createConf verb to create it.I have tried creating the com.jamfsoftware.jamf.plist file successfully but then get further errors relating to security.This Mac was previously successfully enrolled with Ventura, 13.5 installed. The drive has been wiped (twice) and the record was deleted from Jamf Pro before re-enrollemnt.The model is MacBook Air Intel, Retina running Mojave. 10.14 has been re-installed (twice), with same results both times.Thanks for any guidance.

On our Ventura devices we have are having difficulty with filevault preventing users from logging in when not connected to the network.  If the device has a wireless or wifi connection, a AD account can log in with no issue.  As soon as it is disconnected, and try to log in with the same AD account, we get a login progress bar that stops around 60-70% and goes not further..  If we connect a network then try to login again, it logs right in.  If we disable filevault, the user can log in on or off the network with no issue.Is this normal? How do we get around it?We did not have this problem with previous OS versions.Thanks for any assistance

Our ServiceNow Asset Management team is having an issue with devices that have been "retired" on their end.  The previous JAMF admin has those retired Macs set as unmanaged within JAMF.  The issue is the unmanaged Macs are still populating software within ServiceNow even though some of them haven't been online for 2+ years.  The asset management team wants me to clear all of the software data in JAMF so that any online mac reports back so their data is current.  I don't think that's possible and even if it was, that sounds like a bad idea to me.  Am I right in thinking that?

Hi all. I'm fairly new to JAMF and I'm looking for a away to automatically push a managed Chrome app over the unmanaged version on iPads.Here's where I'm at... All iPads currently have the unmanaged version of Chrome. I created a new Chrome in Mobile Device Apps with the enrollment token in App Configuration. I want to push this new version to the iPads. However, since they already have Chrome, it doesn't push it. I tried excluding the original Chrome from the app list but that didn't apply. If I list it in Self-Service, a user can re-install and then it applies, however, I'm trying to do this en masse. 

Hello,II have renewed the push certificate MDM on Jamf but when I send a mass command to renew the MDM profile on all the computers in my smart group and I look at the computers, the command still pending on all computers. If anyone has any idea where this might be coming from.

Has anyone been able to get mice to have right-click enabled by default? We are running lab machines with new users logging in all the time and would prefer they not have to enable that for themselves each time. I have seen (and tried) various solutions here on Jamf (scripts run in a policy) but have not been able to get it to work. I am interested if anyone has had any success while running Monterey.Thanks-

Hello all,I've been using Dockutil to set the Dock for our elementary students and in it's current form it's based on user (because we had grade level login accounts, which we've since gotten ride of). I need to change our script so that it applies Dock settings based on the user's group (for example: class of 2037, class of 2036, class of 2035). I could break my head trying to figure it out but I'm hoping someone on here might know exactly what to do. Here's the current script:#!/bin/bash #We need to wait for the dock to actually start until [[ $(pgrep Dock) ]]; do wait done #Get the current logged in user that we'll be modifying if [ ! -z "$3" ]; then user=$3 else user=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) fi #Set variables du="/usr/local/bin/dockutil" userHome="/Users/$user" networkHome="smb://server.com/Students$/$user" #Function for applying dock configuration createBaseDock() { #Remove

I've seen this error randomly over various versions of macOS when triggering recon manually. In the past I was able to clear it up by removing the Backup folder, but now I can't even do that because it says operation not permitted.The search for mobile device data at path /Users/x/Library/Application Support/MobileSync/Backup failed:Error Domain=NSCocoaErrorDomain Code=257 "The file “Backup” couldn’t be opened because you don’t have permission to view it." UserInfo={NSUserStringVariant=(    Folder), NSURL=file:///Users/x/Library/Application%20Support/MobileSync/Backup, NSFilePath=/Users/x/Library/Application Support/MobileSync/Backup, NSUnderlyingError=0x7f98254d1220 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}Any idea what is going on here and what the solution is? Been seeing it for a while so hoping it is a known issue.Thanks!

Hi All, has anyone been able to force private mode for Safari/WebClips (non-full screen)? I also checked new profile settings in Apple Configurator 2 and found nothing. We need to perform purchase transactions but don't want to retain any shopping cart/personal information from previous sessions. I know we're not on the latest JSS version, but will upgrade if this is fixed. iOS 9.3.2JSS 9.9AC2 2.2.1

I am seeing recon hang on some machines.Anybody else seeing this?It hangs at "Gatekeeper status: App Store and identified developers"

Two Particular Apps, plenty of licenses, short of nuking the ipad, is there anything I can look at in JAMF itself? Message as follows:No licence was found for app “com.google.chrome.ios“.

I'm encountering a bit of a roadblock with Jamf Connect and I'm hoping someone here might have some insight. I've been trying to kill a Kerberos process using the process ID, but it's not working as expected. I try to kill this process using sudo kill 1234, where 1234 is the Process ID. However, when I do this, it doesn't seem to work. The process is still running. I've also tried sudo kill-9 1234 but that didn't help either. Any help or guidance would be greatly appreciated.

Hey guys. We're currently using Mosyle to manager a few (>100) iPads. But the way we're looking to use them is hitting serious snags with Mosyle.So I'm hoping someone can inform me if this is a Mosyle limitation of an Apple limitation (ie - Can Jamf Pro do this?)The simple scenario:We want to be able to use a cart full of iPads and assign them all a single, generic Apple account. This way, we don't have to create an account for each device but we still retain the ability to manage and configure the device. Our users can just pick up the device and it's ready to go (no lock screen/PIN).Mosyle seems to struggle with this when it comes to deploying Apps to the iPads. Here's how I understand it: I add/configure/push the app from Mosyle. It's assigned to a specific user (this way we get the app to all the iPads using the one account). Mosyle acknowledges this, and as soon as the User logs into an Ipad, the app is then pushed to that specific iPad. But this is where is gets sketchy. It se

Hey all, hopefully something quick that I'm missing! Setup:Laptop is setup out of box with non-network-matching usernameMachine is manually enrolled in our Jamf instanceAfter Jamf Connect login, network account is merged with originally setup local account Everything seems to work as expected, but upon reboot the user is required to log into the standard Mac login followed immediately by the Jamf Connect login. With our Prestage Enrolled machines the standard mac login will send the information through to the Jamf Connect credentials request so no user has to type the username or password in twice. We're hopping to get the same for the manual enrollment + account merge. I suspect it has to do with the local username and the network username not matching? Account merger mentions it adds an alias to the local username but I'm not sure if that's sufficient to pass through so the Jamf Connect login window does not appear. Thanks for any insight or help!

Hey all,We have some users that don't get added to our Prestage Enrollment (ABM problem, not a Jamf issue), so they create local accounts then need to manually enroll via the url.After the manual enrollment we have their machine install Jamf Connect but on their next reboot we'd like them to log in with Jamf Connect and force them to create a new user without the option to migrate the user they've already been using. (Yes, this will create an additional account on the machine but it's much easier for us to have them use their Okta account rather than their personal account.)Unfortunately no matter what settings we use in the Config Profile, the option always opens for them to Migrate their local account:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OIDCProvider</key> <string>Okta</string> <key&

We have had an ongoing issue with the previous users apps loading after a wipe, however now we are seeing numerous devices stuck loading these apps.. We have left devices sitting over the weekend and the apps are still in the installing state. The previous users apps installing was annoyance but this is now making them unusable.  

  Jamf Pro 10.50 introduces compatibility for macOS Sonoma, iOS 17, iPadOS 17, and tvOS 17. We’re excited to share many of these new features and enhancements ahead of Apple’s upcoming operating system releases. We hope this video resource continues to provide additional details to support your use of the features in this release. Thank you for your continued support and feedback!

In our environment, we have one device which we trying to do DEP enrolment but its failing with below error for specific user ID. if we try same device with different credentials the enrolment works flawlessly."Enrolling with management server failed Unexpected error MDMResponseStatus: 500"Even we tried user initiated enrolment but does not work as well with the specific user ID. it fails with attached error.The device is mapped correctly in ABM as the enrolment works fine with different user.Thank you.

We have around 10 smart groups we use for our 3rd party updates. All the smart groups are set to use the Criteria "Patch Reporting Software Title" then we point it to the Patch Management we have setup for that specific software and we use "Less Than" and pick our version. For some reason our Adobe Reader group isn't reading the devices correctly. We're currently deploying version 23.003.20269, but this smart is listing devices that have already been updated to 23.003.20269. None of the other smart groups are doing this. Not sure what's going on.  

Hello, What would be the best way to prevent users from downloading software/applications from the internet. We have the appstore blocked in the restricted software section but I am worried they can download some software/apps from Chrome or Safari with DMG files?What would be the best practice to prevent this?Thanks 

Does anyone have a working Extension Attribute to read if the Root account is enabled? The one I was using does not appear to work anymore, and none of the commands I am seeing on the internet are working either. This is what I was using.  #!/bin/bash rootCheck=$(dscl . read /Users/root | grep AuthenticationAuthority > /dev/null 2>&1 ; echo $?) if [ "${rootCheck}" == 1 ]; then echo "<result>Disabled</result>" else echo "<result>Enabled</result>"\\ fi   

As part of our organization's requirements, we need students to input Admin credentials when they first launch the application. To streamline this process and reduce the burden on our technology department, I'm exploring options to automate the initial setup. Specifically, I wonder if there's a way to implement a post-script that includes the ADMIN USERNAME AND PASSWORD, allowing our students to use the application without manual intervention. I understand the importance of security and confidentiality, so I'd appreciate any guidance on implementing this in a secure and compliant manner. If there are alternative approaches or best practices to achieve this goal, please share your insights. Thank you for your time and assistance in advancing this matter. I'm eager to find a solution that balances ease of use for our students with the necessary security measures.

Hello NationI started to optimize a few things in our PreStages. Better said, i started with testing for our new PreStage.Following problem for me:After my prestage with jamf connect notify script (wich installs everyhing an user need) I need to start instantly after the desktop appears to user the device compliance registration steps for the user. In the past I have done this normally with a script and a policy which runs after the macbook is enrolled. The problem with this is that in most cases the script do not start always after the desktop appears. Although not with the login trigger in the policy. So my first idea was to do exactly the same but with an launchagent or deamon. So i created a package with an LaunchAgent which should run the script atload. This works fine, but the script doesnt do all the steps.Because I want keep everything small, I decided to create the launchagent which open only the selfservice policy at load. I dont know why, but this doent really look

I hope you're doing well. I'm currently working on a project within our organization that requires students to input admin credentials when they first launch an application. To simplify this process and reduce the workload on our technology department, I'm exploring options to automate the initial credential input.Specifically, I'm looking for a way to streamline the admin login process when students launch the application for the first time. I'd like to avoid manual input of credentials and make this more efficient for both students and our IT team.Has anyone here encountered a similar requirement, and if so, how did you address it? Are there any tools, scripts, or best practices that can help automate this admin credential input during application launch?