I am trying to add JAMF script variables to my script, the scripts function is to check user home folders and if it had not been modified in an X amount of days it will delete the folder. I want to be able to change the amount of days depending on the deployment location. Would I simply just need to add $4 to the area where the variable would be input?#!/bin/bash# Set the number of days to 90days=90 (<----- This would just change to days=$4, then in JAMF I would set the amount of days in the first variable section. # Set the excluded usersexcluded_users=("macadmin" "shared" "Shared" "admin")# Get current date in secondsnow=$(date +%s)# Iterate over all users home folderfor dir in /Users/*; do# Check if the folder is a directory and not one of the excluded usersif [ -d "$dir" ] && [[ ! " ${excluded_users[@]} " =~ " $(basename "$dir") " ]]; then# Get the last modified date of the folderlast_modified=$(stat -f "%m" "$dir")# Calculate the difference between the last mo

Just wondering if anyone has configured the Lansweeper agent for deployment on OSX yet. I tried to use Composer to capture the dmg install, but I'm not seeing the device agent checking in. I fear that it has copied the config of the Composer machine and that is how it is reporting. Here is the documentation on the package if anyone can think of hints: https://www.lansweeper.com/knowledgebase/silently-installing-lsagent-on-a-windows-linux-or-mac-computer/

The Standard Account on managed Mac get changed to Admin Account without any change done from Jamf Admin.User do not have a way to get default admin password to make changes to his account.And, I've already run a script to change the standard account to admin and next day again the account got changed to admin.Not sure what changes took place or what might have caused this change.It would be much appreciated if I can get some input on this.

Looking to use Active Directory groups to populate smart user groups. We currently have SSO and Azure AD as a Cloud Identity Provider setup. Do I also need to add an LDAP server? Thank you.Kevin 

Hello,I have a user whose computer has "Chrome" and "Slack" listed as separate storage drives. While both Chrome and Slack on running on their machine, Jamf is continuing to list their computer as "unencrypted" since neither the Chrome or Slack "drives" are encrypted. They have also complained that when they update their computer, they have to "reinstall" Chrome and Slack, though I am not sure how relevant that fact is. In any case, this is the only user who has this problem, and we have the same configuration profile running on the same model with different employees without this issue. I'm not even sure how I would recreate this problem on a separate machine, so any advice is appreciated.

So a bit of a weird one, we have a normal MDM control on chrome preferences (com.google.chrome), which is normal stuff, but then as we allow google account sign in.  when someone from a 3rd party who is using a goole workspace account now in the about chrome box its changed from managed by your browser is managed, to this browser is managed by xxxxxxx (third party) has anyone had this before, just working on how its going to impact our settings or if thats just an errant message?

I wanted to create a smart group that contains computers that have two different configuration profiles installed. That is, both of them, not one or the other.I created a smart group with the criteria:configuration profile identifier is XYZ-and- configuration profile identifier is ABCNo results. I know for a fact that with have 100+ computers with both installed, mine included. Tried both identifies separately and found all correct matches. But as soon as I add more than one to the criteria, it does not work. Is this expected or am I doing something wrong?Thanks  

Hi Jamf Nation Guru, We managed to block extensions in Chrome and Edge on our Macs by configuring custom settings in JamfPro.However, we couldn't find a similar solution for Safari. Have you had any success with blocking extensions on this browser? Thanks

Hello everyone!Need to know something about Intune integration with Jamf. What part, Jamf or Intune, will be the master service when you do it? Can it be any of it depending on how you choose to set it up? Or is it always Jamf?Do you need to install a Intune app on the Apple devices? I heard that if a device (iPhone or iPad) is too old it will make the device unusable because of a loop in the Intune app. Or can you skip it?Do you still use School/Business Manager connected to Jamf and not Intune?Right now I'm gathering so much information about this that's impossible. Later on in the fall we will convert our platform from eDirectory to AD and integrate Intune with Jamf. We'd like it to result the best possible way.

Wondering if anyone has a work around for this issue we're encountering.If I set up a new user in Okta and set a temp password and the user has never logged into a machine it pops up a window and walks them through setting a new password and MFA, however once that user exists on the machine and they forget their password if I reset the password and specify a temp password the temp password doesn't allow them to log in at all

I have been asked to block peer-to-peer sites on the devices campus-wide. Is web content filtering on macOS devices possible? What would be the best way to do it, if possible?

Super quick question you guys may know...  I'm having trouble finding documentation on this, but I ran into a JAMF nation post that suggested that JAMF Lock Commands can be issued to devices that are no longer checking in with our JAMF instance or have expired MDM profiles because it leverages APNS and just needs an internet connection (connection to my specific instance is not required, based on the post). So, some of these devices that are in still my instance and had profiles that expired months/years ago, would in theory, be able to be locked by the JAMF command. Is this true? Can I lock devices even if I seemingly have no other management over them? This doesn't seem right... in my experience with JAMF, once the MDM profile is expired it's basically gone from my management abilities until it's re-enrolled.

Need help with "JAMF Connect pulling wrong username when trying to change password". I have a user who is unable to change her password every time when her password is nearing expiration. When she opens Jamf Connect and clicks change password she puts in her old password and then her new one and immediately is presented with this error (screenshot attached).This is not the right username and it has omitted the C in her last name.  We don't see this account anywhere...not in AD, not in Okta our IDP.  Her local account is correct.  We cannot find out why it keeps pulling up this name.  We have removed the MDM profile and deleted Jamf Connect and re enrolled her machine..  We have set up an entirely new Macbook and it is doing the same thing.  We know that Jamf pulls from Okta our IDP but her account is right in Okta and AD.  If anyone knows why this is happening,  please let me know. 

Hey all! I used to be able to create Mac Admin events in the event board but it seems I no longer can do this. How do I add a local Mac admin event?Edit: I actually just noticed on this page that there are actual user group pages. How does one create a local group there? Specifically the Greater Philly Mac Admins :)Thanks!

We have started to move all of our macs from Jamf School to Pro and we have run into a few odd issues. Just curious if any organizations have done Jamf School to Pro migrations on macbooks? How smooth is the process? Is it easier just to backup and reimage and then do an enrollment in Jamf Pro?

Hello!In the Jamf Connect documentation it suggests that some scenarios require scoping a config profile solely during enrollment:Best Practice: Jamf recommends maintaining settings that only should be used during enrollment in a separate configuration profile. This allows you to remove the settings after enrollment without impacting other Jamf Connect settings.My question is this:What's the best way to scope machines into a config profile only during enrollment then immediately remove them from that after? Background: we use prestage enrollments and have an "enrollment only" configuration profile for the Notify Screen to install necessary apps, but that requires resetting the authchanger. We do so in the config profile, but one it's enrolled we no longer want to run the config profile with that authchanger reset. Thank you!

Any suggestions for troubleshooting computers that are checking in on a regular basis but not running policies (or collecting inventory?) I have looked at the jamf.log and I see a boat load of network change triggers, but no policy triggers. It appears the LD is not loaded either. Anyone else have this issue and any suggestion on how to fix? Right now, about 3% of my fleet is having this issue.

Hi all!Those of you in a K-12 setting, how have you handled subscriptions within iOS apps? I have an app that is going to be installed on 8 iPads that needs a monthly subscription, and previously I had created individual Apple ID's to create the subscription with but I was wondering if anyone has a more practical solution. Thanks!

My Big Sur workflow was great.Erase and Reinstall the OS either using Recovery or StartOSInstall, leave it to do it's thing, restart at the end of the build script and users can log in.I tried the same process on Monterey and every time it restarts after installing its config profiles.I had to do:  sudo profiles renew -type enrollment sudo jamf policy  for the EnrolmentComplete triggered policy to kick in.Has anyone got a fix for this?

We recently started to deploy apps based on location instead of sharing the apps from one single location. We have notice in several locations that when we go to a specific device under manage apps. Certain apps say "pending or installing" In the actual device the app in grayed out and it says "waiting". This does not happen to all the devices but enough to be notice. Is never the same app. We have already done the following: -make sure we have enough licences -gone under apps for that location in jamf and resync licences,retry installing on missing,delete deferred items.We contacted support and after a few emails back and forth they tell us to check our network. The thing is that the moment I long press the app that says "waiting" and cancel download and reinstall the app from jamf school it downloads and installs the app. They suggest that that is the only way around this situation but you are talking about 200 devices with around 20 apps each with the same issue. Wondering if anyone

Hi,I uploaded dmg file to Jamf Pro -> Package for Libre Office. Created new Policy with the DMG file and enabled it for Self Service. And Scope only for those computers that should be able to install it.In Jamf Policy Logs it shows that´s installed, but when checking on the machines. Libre office is not there, what is going wrong ?How can I find more information why this installation fails ?[STEP 1 of 4]Executing Policy Libre Office 7.5.3 for Intel Mac[STEP 2 of 4]Downloading.. (URL...)Verifying DMG...Verifying package integrity...Installing LibreOffice_7.5.3_MacOS_x86-64.dmg...Closing package...[STEP 3 of 4][STEP 4 of 4] 

Hey there, I edited a /bin/bash script that automatically checks the devices uptime and tells the user to restart his computer after 2weeks uptime (with the help of https://www.jamf.com/jamf-nation/discussions/17336/user-has-not-restarted-in-x-number-of-days) The following part generates the ""jamf" wants access to control "system events"" message for end users: #!/bin/bash # Discover logged in user user=`stat -f%Su /dev/console` #Execute code as logged in user (instead of root) sudo -u $user /usr/bin/osascript <<-EOF tell application "System Events" activate set question to display dialog "The device has not been restared for [...]" with title "RESTART YOUR COMPUTER" buttons {"Shut Down", "Restart", "Cancel"} ¬ cancel button "Cancel" with icon caution set answer to button returned of question if answer is equal to "Shut Down" then tell application "System Events" shut down end tell end if if answer is equal to "Restart" t

Is there a way to suppress these annoying Screen Sharing dialog boxes. No, Screen Sharing, we don't have FQDN set up for many thousands Macs. #makeItStop

After a reboot, my Macs are not connecting to a wired network connection until a user with physical access logs in. After the user logs out the machine remains connected to the network until the next reboot. It causes issues because we have a couple of machines that are only used occasionally so, after reboots occur, they can go quite a while without checking into Jamf until someone logs into them.Is this expected behavior? Are there any MacOS settings I can change to prevent this?

I have an Extension Attribute that reports back the expiration date of a PIV Authentication certificate on a Yubikey.When inventory runs and a user has their Yubikey inserted it reports <result>YYYY-MM-DD</result>.This works very well. If the user does not have a Yubikey inserted when inventory runs the EA does not report any result back to the server.My issue is the EA then ends up being blank. I would prefer it to keep the old results if no result was reported.Is this the expected behavior?