Hi, someone is selling Mac book pro in fb marketplace and the price is very reasonable and in my price range. Seller added a note saying that the device is jamf locked. I really don’t know what jamf means and Is it okay to buy the jamf locked Mac and is there away to unlock the Mac?

Hello,I am dealing with this issue where a user has these icons on their managed iPad. I am not sure if they are apps or shortcuts but nothing happens when I tap on them. Anyone have an idea of what they are and how I can remove them without having to wipe the device? Thanks in advance.

Since the new version of JAMF Pro has been released we are having issues with categories.2 main issues:When we create a new policy the policy does not display correctly in self-service - shows fine in Admin UIUpdating an existing policy with different category does not update in self-service - shows fine in Admin UI Wanted to see if this was happening for others before raising a support ticket. 

If you are using a decrypt string like the one below, you will encounter an error on macOS Ventura when attempting to decrypt. See below:#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -aes256 -d -a -A -S "${2}" -k "${3}" }bad decrypt4370875948:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/evp/evp_enc.c:521: SOLUTION:You will need to add "-md md5" to your enc string. This will work across macOS versions 13 back through at least 10.12.#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } 

I was able to do the pre-requisite for Falcon, The install appears to be fine however the script to license doesn't appear to be working and i know why i use a script from the older version and i guess the structure has changed does anyone have the license script for falcon Here is the log detailsScript result: Executing Policy Install CrowdStike Falcon SensorDownloading FalconSensorMacOS.MaverickGyr.pkg...Downloading https://use1-jcds.services.jamfcloud.com//download/0e4976be1fe242abb3ce80e8556253bd/FalconSensorMacOS.MaverickGyr.pkg?token=cdf519ed75c141bea4937d44500440715ar4dxxmrcbdr8m9y5e95veg10tvlnij...Verifying package integrity...Installing FalconSensorMacOS.MaverickGyr.pkg...Successfully installed FalconSensorMacOS.MaverickGyr.pkg.Running script License Falcon...Script exit code: 0Script result: /Library/Application Support/JAMF/tmp/License Falcon: line 2: /Library/CS/falconctl: No such file or directory

So here's something weird - I have a Mac running 13.3, it enrolls just fine - get through the setup screens and to the desktop and DEPNotify launches, and my policies run.  I upgrade to 13.3.1, erase and reinstall because I'm testing...and the machine gets stuck at the Time Zone screen during setup.  Meanwhile, the system is enrolled in Jamf Pro, all the policies run successfully...it just never progresses past that screen and to the desktop.  Wipe, install 13.3...and it works.  Anyone else having anything odd going on with 13.3.1 enrollments?

Hello there, does anyone have experience integrating CI/CD tools with Jamf Pro on prem? Thinking of tools like Jenkins, Bitbucket etc. Specifically looking to establish if it is even possible to interface between Jamf and the CI/CD application, and if so, is there a guide to go about establishing the integration?Thanks in advance.

Is it possible to use the API to install a configuration profile on to a device? We have a network profile that has to be manually installed by our techs as they're setting up the machines. If I can run a policy that has a script that runs an API call to install it that would cut down on some workload. The profile is scoped to domain membership of the device, and it can't be an automatic install since right now the AD cert inside the profile only lasts 1 year and we need to let techs remove it in Self Service and reinstall it to get a new one every year (don't get me started on this, this is being worked on already). I looked at /v1/mdm/commands but got "[ ]" returned when I ran it. And /v2/mdm/commands gives me a 400 error.

tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like i[Pad]OS where all configuration profiles and certificates are scoped to the whole machine."Managed Users"A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways:First user created by Setup Assistant when machine is first set up via automated device enrollmentA user with administrator rights initiates a user enrollment via an enrollment URL or renewing the automated device enrollment with a profiles commandMobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM.For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High SierraFor a configuration profile or a certificate to be issued to a single user account on a Mac, the user must be a "managed user" as of macOS Cat

https://drive.google.com/file/d/1WZhtbPMK88QitcWT2uZjIvURhi_IjNHC/view?usp=sharing Has anyone else seen this? (You might need to replay it a couple times to catch it, focus on the 03:0... in the release date of last row and second from the top - for best result download the video and loop it.) On a static window at just the right size, characters will swap with ellipses if they're at the edge of the column. This probably happens in other places in the UI as well... Not a huge deal to be sure but a little distracting. Not as frustrating as if you're the type that likes to view a lot of inventory items by default so you always have to scroll far far to the right to add a device to a scope. Not as frustrating as having buttons at the bottom right of the UI when there's wasted empty space at the top of the window. Not as frustrating as when you're on the go and someone needs a FileVault Recovery Key and you discover you can't figure out a way to get to that information

Hi, on our Mac that were enrolled through prestage enrollment the login items for the Viscosity client disappear every time after restart.On user-enrolled Macs this problem doesn't occur. Does anyone have an idea what could be a fix for this? Thanks.

Hi,I'm trying to update a user's site using the Jamf Pro API, though I can't find anything on this in the documentation.I managed to successfully overwrite the list with another one, or a single site. Though I don't know what I can do tu specifically remove one site. If I could avoid filtering the current list in XML to remove the said site from the string and then re-push it, that'll be great. Because this solution seems.. Barbaric.

Anyone deployed RedSky MyE911 with JAMF? RedSky E911 is a cloud-based emergency call routing service that helps organizations comply with E911 regulations Kari's Law and RAY BAUM'S Act. Both are separate pieces of legislation that were passed in the United States with the goal of improving public safety and emergency response.I believe a configuration profile will be needed to allow access to system events. Not too sure if I will need to get the Team Identifier or Bundle ID.Also, looking for a way to automatically input the host address https://anywhere.e911cloud.com/ so users won't have to manually input it.If anyone already has this set up and don't mind sharing, that would be awesome.

Recently, a customer inquired about whether macOS can block AirPrint via a configuration profile. Unfortunately for the customer, the allowAirPrint restriction is iOS only (https://jamf.it/jpRgP). Because it can't be blocked, I decided to look into how to Jamf Protect could be used to report on print usage in macOS.    Jamf Protect Jamf Protect offers the following for generating alerts on a macOS endpoint: Threat Prevention Analytics Unified Logs Telemetry Device Controls Threat Prevention and Device Controls are out of scope for this use case, so let’s take a look at Telemetry, Unified Logs, and Analytics.    Jamf Protect Telemetry Telemetry is a new feature in Jamf Protect that allows customers to send audit events generated on their macOS devices to their SIEM of choice. Telemetry currently uses the BSM implementation in macOS, so I can use the pre-existing binaries that I would normally use to analyze the logs locally.    Running sudo praudit -sx /d

Hi guysI am out of ideas, I'm hoping someone here can help me.We use Global Protect in our company, and have set up the jamfconnector to retrieve the certificates.We have an ADCS configuration profile, which has been working fine up until now. Newly enrolled computers aren't getting their certificates anymore. When I go to check this in 'management' for that computer, I get the error 'Failed to inject certificates into the profile'. Any ideas where the issue could be? Connection to the jamfconnector and issueing server should still be ok. Thanks!Valérie

Just ran into this for the first time when trying to boot an M1 Pro into Recovery mode-- laptop was just reset using "Erase all content and settings" and has macOS 13.2.1 installed. I was intending to update the macOS to the latest by reinstalling the operating system from the Recovery console-- but alas, I ran into this "Recovery lock" blocker for the first time. So, with a little research, I find that the password should be cached in Jamf Pro, and I look it up-- a freaking 39-character password??? And when you type it in slowly on the computer in question, it doesn't show up as you type. Is this all the default behavior Apple has created? What a fricken pain in the butt.I don't see the need for this overbearing security roadblock. All my users are local admins and living remote, and in eight years of managing Macs with Jamf, I have not regretted that once. Everyone's remote now, and they need to be able to do some troubleshooting, Jamf Pro helps us keep the drives encrypted, no auto-

I have a policy to push some new printers we installed after login and startup . I have tested and it seems to be working. On this one specific user her laptop has not "checked in" or had an inventory update since early march. I have tried restarting multiple times to see if the policy pushes but I see nothing in the logs. Why hasn't the laptop checked in or had an inventory update since March? Could that be part of the issue as to why the policy is not pushing?Thanks 

Hello,We would like to enable FileVault when preparing our Macs, during the enrollment prestage.We would like to know the best way to do this knowing that:- We have a support team that pre-configures the computers.- During the enrollment of the computers, a management account is automatically created with a random password and a local administrator account.- During enrollment, Jamf Connect is installed.- Once the computer is enrolled, our support team logs in to the local admin account to install applications and do some different settings according to the targets.- Once finished, the end user will come to pick up his computer or the computer will be sent to the user.Today, we are beginning to deploy Filevault through a configuration profile with encryption at logout.Thank you for your help.

Looking to do a binding to a LDAP server. I can get the base binding with this commanddsconfigldap -a lookup.example.com -n lookupThe problem I'm running into is that I can't find a programatic way to set the LDAP Mapping to RFC2307 with the associated search base suffix.Can do it manually in the LDAPv3 settings in the Directory Utility UI no problem.

Hi everyone, I was looking at the various Jamf training & certs, and the X00 certs are geared for Jamf Pro, and the X70 certs are mainly security/Jamf Protect. Are there any training/certs for Jamf School or Connect?

Ever since updating our student iPads to iOS ver. 16 or later their iPads no longer "Automatically join Classroom classes without prompting" as configured in Jamf Pro under configuration profiles > restrictions > functionality. Instead of joining classroom classes automatically student iPads now show as offline in the Apple Classroom app until the teacher selects a student and clicks connect, at which time student iPads receive a notification to join the class and students have an option of either accepting or declining the invitation. Obviously this is a huge issue because students can decline the invitation and not join the class. I find it a little strange that a Jamf Pro configuration profile stopped working after an iOS update but it doesn't surprise me at all since Apple is notorious for releasing updates before giving developers time to update things on their end.Has anyone else experienced this?

Gather the data you need — on-demand — while eliminating the need for short-term Extension AttributesBackgroundFor long-term needs, Jamf Pro Computer Extension Attributes are indispensable, but during software pilots, you only occasionally need potential vendor data from endpoints and creating multiple EAs you’ll only use temporarily can lead to database bloat.Continue reading …

Head of security has asked me to investigate whether its possible to restrict the use of usb keys and firewire drives on company macs. Anyone got any ideas or had any exposure in this area? Of course can't fully disable them because of keyboards & mice (saw a script for this). I'm assuming some sort of 3rd party product in the end might be the best solution.

Hello, I'm unnable to use the automatic login after filevault (FDEautologin). Every time I reboot, the user as to authenticate twice, once for filevault and once for jamf connect. I know it use to work in previous version of connect we had installed. Though today I cant seem to understand why it's not working. Does the "Require Network Authhentication" needs to be disable for this to work ? As this part of the documentation suggests.But then it's seems rather stupid to have jamf connect and Okta in order to secure the user's connection, and you end up disabling the network connection.... What am I missing here ?

I'm trying to disable "Prevent Cross-Site Tracking" in Safari for a group of iOS student iPads and cannot find the setting in configuration profiles.  Apologies if it's under my nose.