I've getting reports of people that have upgraded from an older OS (anything from 10.14.x on up to 12.x) to Ventura, but it seems like a significant portion of them put in their credentials at the FV screen but never get a desktop.  The progress bar seems to halt around 3/4 of the way through.  The support technicians noticed it's a lot of the Intel Macs vs the M series, but I haven't been able to confirm it.  Further, it seems like it may be related to a login script and home drive mapping in AD for their accounts.  Typically we can clear that and have them reboot on the corporate network.  The issue becomes when users are remote and can't get to an office building. The accounts have all been AD mobile accounts.  Typically when I'm working on those devices I will convert them to local accounts and then use Kerberos Extensions to handle the AD relationship.   Curious if others have run into this?  I haven't been able to reproduce it on

Working with Internal Services and Jamf Safe Internet Earlier in the year, we released our education-focused security tool, Jamf Safe Internet, which focuses on keeping students and teachers safe online. As the adoption of Jamf Safe Internet increases, so do the use cases. A common use case that has become clear in the months since release is the ability to connect to internal services, such as file servers (for storing data), web servers (for platforms like Moodle) as well as a host of others.  Due to the way that Jamf Safe Internet is designed to push all DNS requests to the DoH Gateway in our Security Cloud to evaluate domains against allow/block & security policies (fig1), education institutes aren’t able to access internal services without some advanced configuration.  fig 1 - basic diagram of Jamf Safe Internet flow In order to better understand why we need to add the advanced configuration to our Jamf Safe Internet deployment, you will require a basic knowledge of

I download the O365 package from https://macadmins.software/ and then by installer command and -showChoicesXML flag I built an XML file and opened the XML file and made the value 0 for OneNote app so that it should not get installed on my mac when installing. Now if I am running the installer command with -applyChoiceChangesXML flag with the path of XML file and office package path, it is telling me below. installer: Package name is Microsoft 365 and Office for Mac installer: choices file '/Users/asif/Desktop/office.xml' either could not be found or was malformed.%What could be the cause behind it?My path for XML file and office package is correct as I copied and pasted in terminal.

I have a list of requirements/desires that have been handed to me from management and I want to make them happen. No clue how, though.-Set Scrolling to Classic (down is down, up is up)-Set default to Home Folder, not recent items-Show Hard Disks on desktop-Show Connected Servers-Show filename extensions-Set Accent Color-Set Desktop Wallpaper-Always Show Scrollbars-Warn before emptying trash-Dark mode selected by defaultAny advice or direction would be appreciated! Thanks!

I'm hoping someone here can answer my question. I'm building an app to work with our JAMF mobile environment and I want to collect the "Device Ownership Type" from the device general information. Unfortunately, I'm unable to gather which column this really is.

A Jamf Pro Computer Extension Attribute which returns enterprise-domain Apple IDsBackgroundLike most organizations, we want the best — most secure — experience for our users. So, naturally, we’ve investigated leveraging Managed Apple IDs.While Managed Apple IDs come with some fairly signification limitations, my personal favorite has to be:Allows browsing but not purchasing, paid or free in: App StoreHowever, the promise of a Shared iPad is quite alluring.The RubI also suspect “the rub” for most organizations who wish to federate their domain is Apple’s unwillingness to inform the enterprise which of their users will be impacted before federation is enabled:… but you can’t see their actual personal Apple ID.Continue reading …

Jamf Composer was used to build a simple packagepackage deposits an .app into /Applications. Tested and verified it works locallyUsed Jamf Composer and a Apple issued cert to sign the pkgUsed the IntuneWrapper to create an .intunemac file for IntuneFile was accepted by Intune and policy successfully createdErrors when trying to deploy.I’ve since been able to successfully build, sign, wrap and deploy using terminal however I would like to figure out what went wrong with the Composer build as I see the need for much more complicated packages in the future.Because I removed the policy that was failing and rebuilt a successful one I no longer have the error code Intune spit back for this post. There was no useful error message, just the error code close to, but not exactly, 0x87D13BA2. I stress this was not the exact error code as I was unable to find the exact code ANYWHERE, not even from Microsoft documentation of error codes.I post this hoping someone has run into this issue before and

We are trying to deploy the Forescout connector on a Mac machine through a Jamf policy, which requires us to deploy a .pkg file, a script, and most importantly, the folder containing the Forescout agent on the desktop. This folder includes the launch daemon and a few other commands. However, we are encountering errors and are not able to successfully deploy the folder. Can you advise us on how to proceed?

Hi there. I read somewhere that  GitHub Santa  can be integrated with Jamf Pro. If this is indeed true, can someone point me in the right direction to get started? And yes, I see the documentation included with the app, but was asking for more Jamf specific instructions as I am fairly new to MacOS Jamf configs. Thanks.

Hey JAMF-er's. This is probably an easy one but I'm still not super versed in scripting. I've cobbled together an script that Makes calls the Classic API to get the position, building, and asset tag information from a computer record. Here are the lines I am using to accomplish this:position=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/position/text()")location=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/building/text()")asset=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/general/asset_tag/text()")It all works as intended, but s there a way to combine these lines so it's not authenticating to the server 3 times to

Hello Jamf Nation! We recently released Jamf Protect 4.1.0. This release includes the following changes and improvements: Telemetry enhancements for collecting performance metrics, BIOS/EFI data, and diagnostic/crash files. These enhancements aid in meeting compliance requirements and improve incident response and IT troubleshooting workflows. A new diagnostics command for the Protect command line tool (Protectctl). Updates to existing Insights and the addition of two new insights to verify device compliance: 2.3.1.2 Ensure AirPlay Receiver Is Disabled and 2.6.1.2 Ensure Location Services is in the Menu Bar. Improvements to file quarantine and scanning functions to resolve a known conflict with some third-party security tools. Product Documentation  For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Protect team

Hi guys. New on the tool, and I am pretty amazed about it.The thing is that some client it is asking us to monitoring web content that the macOS users browsing.I know that is possible to configurate a profile to create white and blacklists of websites and all that (never do it, but I know is there).What we would like to know if is possible to get logs of the browsing from the users, so then implement blacklist or whitelists of websites.Thank you!

We use AD in our enviornment, but we have many local users with admin rights. Now that our use of Casper has become more robust. We want to take the local admin users and turn them into standard users. Any suggestions as to the best way to do this?

Does anyone know if there's a way with Jamf to capture, or view, who enrolled a device via the user initiated web portal (https:jamfserver.com/enroll)? My Jamf instance has SSO enabled, so manually enrolling a device requires a company login, so I'd love to be able to view what user initiated an enrollment of a device. If I look at Jamf's change management log, that info doesn't seem to be captured -  only the name of device, the device ID, and the site it was enrolled in are captured there. I also briefly looked at the Jamf Pro server logs and a machine enrolled ~90 minutes ago doesn't show up in the logs by name, serial, or ID#. There isn't anything in the computer record in Jamf, that I can see, that stores this info either - the MDM Capable User is just the first user account created on the machine, not necessarily the person who enrolled it; and when enrolling devices a person can assign the machine to an alterative user, so the user set in Jamf isn't necessarily wh

This policy trigger is already being run: root 731 0.0 0.1 660664 10948 ?? Ss 8:25PM 0:00.42 /usr/sbin/jamf policy -randomDelaySeconds 300 I saw a policy fail for user based over seas, so I remoted into her computer, flushed the log for that policy and manually triggered sudo jamf policy ... but keep getting the above error, what does that indicate?

hi. i found a way to show device-names on the lock-screen, but way too small. Is it also possible to add the device-name to the wallpaper - without individual wallpapers for each device. zuludesk has implemented that feature. you can define a payload within the screen-layout section. maybe i didn´t find that feature yet, so please, help me. Thx in advance,Roland

Is there a way in Jamf Pro to block the widgets that iOS 15 insists on putting on the home screen with a newly setup iPad?  I've got everything else blocked that I want from the home screen of our student iPads but I cannot figure out for the life of me how to block those default widgets with iOS 15.

Is it possible to make a bulk update to uncheck Allow Jamf Pro to perform management tasks? I'm now trying to utilize MUT V6 for the computer names, but I'm wondering whether Mut can assist or if there is something else I can use.

When attempting to run software update on M1 macs currently at 13.0 or above, the admin password is not accepted.End users do not have admin rights on our machines.  The same admin account is on every mac, both Intel and Silicon.  The admin password works all around except for updating Ventura.Currently, we have machines on 13.0, 13.1, and 13.2.  When end users run the 13.2.1 update from Software Update they are prompted for admin credentials.  If I enter the local admin password it shakes like it is incorrect even though the same password works for other things that need elevation.  This only happens on the Silicon macs.I have read other threads talking about erase install script for updating from Monterey to Ventura but we have no issues with that process.  We only have issues for machines already running Ventura and needing to do a supplemental update like 13.2 or 13.2.1.Can anyone provide some insight?

Trying to deploy the Safe Exam Browser on our student MacBook Airs and I am having some issues getting the configuration to stay. I was originally creating the package(.pkg) using Composer, but when the students download the package from Self Service the settings are reverted back to the defaults. When I created it as a DMG and check the boxes to Fill user templates and existing home directories the settings come down as they should, but the end user is being prompted for a keychain password. However, it is not wanting the keychain password of the currently logged in user. It wants the keychain password of the user account I was logged in with when the package was created. Has anyone recently deployed the Safe Exam browser successfully? The only post I can find is where someone says they have done it, but they don't outline how they were able to do this. In theory I could use the pkg that I first created and then use a script to copy the .seb configuration file the machines,

Hello,As a part of the security compliance, we have all our JAMF enrolled Mac devices enabled with FileVault encryption. However, it is noticed on MacOS Ventura that with FileVault encryption enabled we are unable to login with any secondary or mobile account.The login is only working fine with the primary account login.As a workaround we can disable FileVault encryption by adding the systems into the exclusion list, but that can be a threat to the devices. Can anyone please help with any suggestion on this? Does the FileVault encryption policy require any extra payloads pre/post-defined? Thanks in advance.

Hi All, I'm in the process of moving from JAMF Now to Pro. Currently have around 100 computers on JAMF Now and their FileVault key are store in the JAMF NOW Cloud. How can I migrate those recovery keys to Jamf Pro using profiles/policy script. I know that i could go on the host computer. Switch off filevault. Remove computer on JAMF Now. Enroll into JAMF Pro and use a policy/script to escrow key to JAMF Pro cloud. But thats very involved. Is there any other workflows that allow me to be more hands off.

After the macOS 13.3.1(a) Security Update is installed the sw_vers tool on the Mac will report the macOS BuildVersion is 22E772610a. Unfortunately the Operating System Build version shown in the computer record by Jamf Pro (at least versions prior to 10.46) will continue to show 22E261 which is the same as an unpatched 13.3.1 install. This means a Smart Group using the Operating System Build criteria can't be used to identify Macs that have the update. To determine the actual build version so you can create a working Smart Group requires creating an Extension Attribute to query the sw_vers tool directly:  #!/bin/sh # EA - Get macOS Build Version result=$(/usr/bin/sw_vers -buildVersion) echo "<result>$result</result>"   Once that EA is active you can use it as criteria in a Smart Group with the operator "is like" and the value "22E772610a" 

Bit of an annoying problem and was curious if anyone had an elegant method to crack it. Admin wants multiple sites to open by default when Safari is launched. It's easy enough to make a default homepage. I have a custom JSON schema in a config profile for that. I was wondering if anyone knew how to direct Safari to open a 2nd tab as well? I can't figure it out.

@mm2270 I seem to recall you building some great API scripts previously...hoping you can help me figure out what is wrong here...Im trying to run a script that calls the remove mdm profile button api and had found this... however its giving me an error when I run it even if I try in one line typing the variables directly in: #!/bin/bash ## account with computer create and read (JSS Objects), Send Computer Unmanage Command (JSS Actions) uname="$4" pwd="$5" if [ "$6" != "" ];then server="$6" else ## get current Jamf server server=$(defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url) fi ## ensure the server URL ends with a / strLen=$((${#server}-1)) lastChar="${server:$strLen:1}" if [ ! "$lastChar" = "/" ];then server="${server}/" fi ## get unique identifier for machine udid=$(system_profiler SPHardwareDataType | awk '/UUID/ { print $3; }') ## get c