Hey,I have a script that removes local admins from Mac, without the need to restart the Mac and it works great. I would like to solve the issue of updating existing apps without the need for admin privileges.for example: if Slack pushes an important update, users need me immediately in order to access Slack.Any ideas on how can I solve this issue? adding here the script I use:#!/bin/shadminUsers=$(dscl . -read Groups/admin GroupMembership | cut -c 18-)for user in $adminUsersdoif [ "$user" != "root" ] && [ "$user" != "Administrator" ] && [ "$user" != "administrator" ] && [ "$user" != "jss_mgmt" ]thendseditgroup -o edit -d $user -t user adminif [ $? = 0 ]; thenecho "Removed user $user from admin group";pkill -U "$user" -9 -f "/Applications/*"pkill -U "$user" -9 -f "/System/Library/*"pkill -U "$user" -9 -f "/Library/*"fielseecho "Admin user $user left alone"fidone

Hi All So we are moving away to sign our own tomcat boxes that run windows behind a loadbalaner rather than linux so sorting out the new internal certs to take over from when the SSL terminates at the balancer.As it seems the resulting jks file is just copied over to other servers after following this article.. https://learn.jamf.com/bundle/technical-articles/page/Enabling_SSL_on_Tomcat_with_a_Public_Certificate.html I have only ever done signing for IIS and winboxes, there seems to be no way in specifying the multi SAN, ie the servers themselves as well as the main URL that i specify, is this not needed for tomcat certs i always assumed you needed to list the local servers, or because we have a external cert terminating at the loadbalancer with the same domain url do we just need the URL domain only on the local cert to continue the 'journey' sorry for the word 'soup'

5.4.1 (58698.1027) was released yesterday (28 Oct 20). Patch Management for our JAMF instance doesn't show this. It only shows the 5.4.0 update which was released on the 26th. It says that's the latest version. That's wrong. 5.4.1 is the latest version. 5.4.1 is installed on 60 machines and right now those are being reported as Unknown versions. What's up with that? How does JAMF update their patch management for latest versions?

Hi all, We're trying to use dockutil to remove some apps and add a few behind DEPNotify at first boot using this script. It's not working - anyone have any ideas why? I realized I could have used $3 for current user after I wrote it... go figure. #!/bin/sh # determines current user currentUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' ) #kill preference cache killall cfprefsd # layout begins sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Calendar' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Contacts' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Mail' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Maps' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'iTunes' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Reminders' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Podcasts' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'TV' sudo -u "$currentUser" /usr/local/

Someone at my company set up integration to get Jamf Pro notifications sent to a Slack channel. That channel had been working fine (about a year now, I'm guessing) until the person who set up the integration went on vacation. Now the channel hasn't updated in several days and I've been tasked with getting it working again. All other Slack channels are working normally.I am minimally familiar with JAMF. I did find in the JAMF console, under Settings > System > User accounts and groups, a username and email address used to send the JamfPro notifications to Slack, but don't see anything there that would indicate something is wrong.Can someone point me in the direction of where I should be looking to figure out what went wrong? Thanks!

I am playing with the above settings in a config profile. However, I see that I cannot change the arrangement after sending the config to a device. Is there a way to set the Home Screen/dock as a default and then allow the user to adjust it as he/she wants?

Hi,In the olden days I would use dsconfigAD -groups to allow specific AD group members to log in as admins (e.g. Music Lab Staff are Admins on the Music Lab Macs) this would run as a policy on all Macs in the Music group. There doesn't seem to be a way to do this neatly with Jamf Connect & Okta, the Admin Group grants those users Admin on all Macs.What is the best way to achieve this using Jamf Connect with Okta?My current thinking is that the Domain Admins group remains we create additional Groups in Okta (e.g. Music Admins) with their own Admin Client ID and a separate Jamf Connect Login Config Profile for each Smart Group e.g. Jamf Connect Login Music profile allows members of Domain Admins and Music Admins to log in with admin privs but members of Computer Science Admins can log in but get a standard account.Am I overthinking this, is there an easier way? 

I'm trying to create a webclip that will be able to include the serial number. IEhttp://www.someurl.com/?=[Serial Number]

I'd really love to use my newly learned API knowledge in scripts that would be immensely helpful. The main use would be for a policy to run a script that collects all kinds of various system information and saves that info in various text files and then those zip files are zipped up into a single .zip file. I got that part figured out. The part that's tripping me up is how to use the fileuploads in script form. If I run the following command manually in terminal, it works fine.    curl -sku USERNAME:PASSWORD https://jss.company.com/JSSResource/fileuploads/computers/id/100 -X POST -F name=@/PATH/TO/FILE   The problem is that in order to run this in a script, I have to input the username and password - a huge no-no. I figure there's gotta be a way to encrypt the password for the script.  I've found lots of articles that explain how to run commands on my local admin Mac to create the encrypted PW. The problem is once I have that info, then what

During setup of a new mobile IOS device, I am prompted for the region or country. The answer is always the same- United States for us. Is there any way to set a default country or region instead of scrolling through 10 pages of options? I've looked through the pre stage enrollment settings and didn't see anything. Thanks in advance,Robert

Hello All,How can I find the URL to download a package from URL using by curl command, I opened the URL to download Google Chrome installer for mac and then stop it download through GUI and copied the URL and opened the terminal and putted the command curl -o URL of GC source, it is giving me error saying zsh: parse error near &Any idea how to find the correct URL for curl?

Welcome to the new centralized Jamf Release Info space. This will be your one-stop shop for news about Jamf Pro and Jamf Connect releases. We encourage you to continue visiting the Jamf Nation Community Product forums to connect with fellow community members.   In Release Info, you will find: Release announcements Jamf Pro cloud upgrade schedule Jamf Pro Release Notes video Jamf Pro knowledge quiz We recommend you post in the comment section on a Release Announcement to communicate about the update and any questions, comments, or celebrations you may have.

I'm testing out the Remote Wipe command for a computer ahead of needing to wipe a handful of remote devices in the near future.I've triggered the command on a test device I have at hand; I enabled 'Remove Activation Lock' as the device is actviation lock enabled, and I set a wipe passcode of 123456. The test Macbook almost instantly shut down and device logs in Jamf show that the command was successfully deployed. However the device is now stuck in a loop of prompting me to enter a user account password in order to unlock the hard drive (filevault is enabled). When i enter the user password the device shuts down, boots back up after a moment, then I'm re-prompted to enter a user password. I've gone through this loop a dozen times now.When I enter an incorrect password, or the wipe passcode, the pop-up doesn't accept the password.  I can still boot the device into recovery mode and wipe the device via Disk Utility, but this is not the ideal solution for my situation.This

As we all know Jamf introduced us new LAPS solution. I have created EA to read local admin password. In order using actively LAPS auto deploy must be enabled. You can read this jamf article for how to enable Jamf LAPS -> https://community.jamf.com/t5/tech-thoughts/how-to-securely-manage-local-admin-passwords-with-jamf-pro-and/ba-p/289969. #!/bin/bash # Reading JAMF Laps password # Author: A. Collins username="api username" password="password" url="your jamf url" localadmin="local admin account that deployed in prestage" serialnn=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformSerialNumber/{print $4}') #Variable declarations bearerToken="" tokenExpirationEpoch="0" getBearerToken() { response=$(curl -s -u "$username":"$password" "$url"/api/v1/auth/token -X POST) bearerToken=$(echo "$response" | plutil -extract token raw -) tokenExpiration=$(echo "$response" | plutil -extract expires raw - | awk -F . '{print $1}') tokenExpirationEpoch=$(date -j

Hello,We have some students that we want to be blocked in a given app. We would also like to have some way to disable the single app mode from the device itself to allow Technician/Teachers/Specialist/Parent to perform basic task on the device (web search / apps backup / etc..).I know guided access can allow a passcode to disable the restriction but this is not configurable in jamf. Access to jamf to disable single app mode for the iPads is not an options.

Is there a way to disable users from changing the computer name. We have students that are constantly changing the computer names. 

Hi Everyone, My default browser right now is Chrome. but I don't have a problem with that. However, the following screen appears in some of the users I have installed Company Portal. When it approves this, it redirects to a page and asks the user to login to Microsoft. This happens randomly and is very disturbing for us. Does anyone know why this is happening and how to fix it? 

Hello Jamf Nation... Question regarding BYOD options in JAMF Pro: We are a financial services company with a strong focus internally on security for our customers.  We are working on beefing up our cell phone policy.  Here's what we're looking at:-Allowing BYOD devices - we need to be able to limit screenshots from apps containing sensitive corporate information.  Android devices are able to do this by creating a separate work profile.  -Denying BYOD and distributing corporate-owned cell phones -  This will be the easier option for the company, but not so much for end-users.  We could just lock down screenshots on this period.  I am trying to find a way to implement screenshots on just the corporate apps.  JAMF support told me it's possible, but I'm not sure they were correct.  They said something about using the screenshot blocking with app restrictions, but it looks to me like those two settings are mutually exclusive,

Hello, I went and looked through all similar threads but didn't find any experiencing my issue.  I tested the 'Wipe" feature on my Macbook before performing the command on a user who locked himself out of his Mac and forgot his password and had some questions about the process.  When you hit Wipe, it prompts to enter a remote wipe passcode, and there is a box above that says "Clear Activation Lock".  I left that box unchecked and just entered 123456 for the PIN.  But when I sent the command it just nuked my machine and reset/reformatted my Mac, it didnt ask for a PIN code or display any message.  Is this PIN not needed when you do not check the Clear Activation Lock box?  And also, should I be checking the Clear Activation Lock?  And my last question is after the factory reset, the device now shows 'unmanaged' in Jamf Pro but on Jamf Pro's website it claims that the Wipe will not unenroll the device.  So theoretically if I had done this on a

Hello, we are testing Jamf Connect, and one issue we run into is after you change your AAD password, a Jamf notification will show in the MacOS notifications stating your passwords are not in sync. However, a lot of us use Focus Mode and do not see the popup, and user's will often ignore their notifications because you get so many of them throughout the day. How can we force that Jamf password sync notification to automatically open after Jamf detects passwords are out of sync, instead of being a passive, ignored notification? Thanks!

Hi,since iOS 16.2 Apple changed the Airdrop option from "Everyone" to "Everyone for 10 Minutes".We use Jamf Pro in a huge educational enviroment with the Classrom-App. The problem is that teachers can´t send documents to students after the 10 minutes have elapsed. So every student has to change the setting again after the time period which is not practicable.Any hints to fix that problem or any workarounds?thx,Markus

Hi allHoping someone can assist with this. We are running PaperCut MF and have the print client on our Macs. When a user sends a job to print they get the pop up confirmation with the correct pricing information and the job comes out of the printer, but in the job log of the printer in PaperCut, we see the user that printed the job was service-jamf-scripts and not the actual user that sent the job.Has anyone else seen this or point me in the right direction to start investigating? Thanks, John

Hi All,Has anybody have reports of 13.4.1 upgrade fail when trying to upgrade via software upgrade?We have reports from users when it tries to begin the download and fails ...I have seen Apple Dev bug - Can't upgrade to Ventura 13.4.1 | Apple Developer Forums .. Rk

I use Apple Configurator and Imazing Profile Editor to create configuration profiles.If a configuration profile was pushed out with "Prevent users from removing this profile" as true, can JAMF still remove this profile?  Isn't this just so users can't remove it locally on the workstation but the MDM server still can ?Also If pushing out the same configuration profile with same Payload ID to a workstation that already has it, won't the profile just be overwritten with the newer one?   Or do I need to remove it first and then push it out again if I make changes.I know I can just push out another restrictive profile but I like to keep the profiles to a minimum.Just curious on what exactly would happen.  Appreciate any feedback.

Hello All,How preference domain in my config profile understand where the corrosponding plist is kept? I can keep under /Library/Preferences, or /library/Manage Preference etcBut question is how Jamf is able to understand where is the plist kept to write on it?