What's the best method for Mac computer authentication for 802.1x wired connections?  Is the Jamf ADCS connector needed for proper implementation?  Can user authentication via PEAP not be used instead of certificates?

Since the most recent versions of Xcode are often a bit "buggy", the faculty that teach in our Computer Science labs prefer to run a slightly older version of Xcode. This adds some challenges to deploying Xcode as the APP store route using VPP can only install the most recent version of an app.In case anyone else has the same need, here is the method that I've come up with. This is working for me using Xcode 13.2.1 on MacOS 12.3 Monterey and Jamf Pro version 10.37.2.I hope this helps others navigate this challenge ... 1) Setup a "test" mac with similar hardware and the same MacOS that is DEP enrolled in Jamf just like your target macs. (You probably already have this as it's incredibly useful for so many things!)2) Get a Apple Developer's account  (I believe a free account will work)3) Download the version of Xcode  you want. (Only certain versions of Xcode will work on certain MacOSs so get the right version!)4) Xcode is delivered in an Apple specific package format whi

Customer Education is back again with our next Jamf Pro Release Notes video! Join us for an overview of some of the new features and enhancements that are available in Jamf Pro 10.48. We hope this resource continues to provide additional details to support your use of the features in this release. You can even take the quiz below to gauge your understanding of the update!     Thank you all for the continued feedback as we look to improve each video. Feel free to leave a comment and let us know what you liked and how we can make it even better next time. And do not forget to test your knowledge with the quiz!

Hi,  I created a smart group to get the list of devices inactive > 180 days, but then there lot of devices ready for deployment and after exclusion we identified 150 devices whose license we can safely removeBut the issue is to how to create a smart group or static group by importing the data from excel ?

Hello, I'm trying to install JAMF Pro (10.47) in multi-contexte JSS environment under Linux (Debian) on premise, by following scrupulously  this documentation, https://learn.jamf.com/fr-FR/bundle/jamf-pro-install-guide-linux-current/page/Multi-Context_Jamf_Pro_Environments.html#concept-7325 , without success for the moment. For a unique context it's ok,  but as soon as I put a second context, the file "context".war in the good directory (/opt/tomcat/webapps for me), java cpu process begin to increase  very strongly (until 500%) during several minutes and after tomcat "crashes" I have checked the log file but I have seen  "nothing special"( but I'm not a tomcat expert)There are some few "severe" messages likeSEVERE [localhost-startStop-1] se.jiderhamn.classloader.leak.prevention.JULLogger.error org.apache.commons.logging.LogFactory.release(java.lang.ClassLoader)SEVERE [Catalina-startStop-1] org.apache.catalina.startup.HostConfig.deployWARs Er

Send the Wipe command from Jamf Pro to a Managed MacBook Pro running Catalina yesterday. The MacBook immediately booted to the lock symbol but the 6-digit code did and still does not work. The Management history on the MacBook's Inventory shows the 6-digit code that was sent to be correct, but the lock screen does not accept it. The MacBook is now in a horrible halfway house of not yet wiped but unable to proceed further. Boot to Recovery mode does not work, but takes me to the lock screen. Jamf History shows the command has been successfully sent so I cannot cancel it. Has anyone else experienced this before?

Hi, we're currently running our mac's with automatic install scripts via jamf.Our users don't have admin privilegues. When they update Slack (which is simply a new installation of the most recent client), it always shows the dialogue mentioned in the subject or attached screenshot on every app start, until someone types in admin creds.If you click on cancel, the app still starts. But the pop-up on every start is still anoying. I do get an output from terminal saying: May 10 11:58:30 Slack[21065]: DEPRECATED USE in libdispatch client: dispatch source activated with no event handler set; set a breakpoint on _dispatch_bug_deprecated to debug May 10 11:58:30 SecurityAgent[21094]: objc[21094]: Class TKTokenRefImpl is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff9712afa8) and /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent (0x10522fce8). One of the two will be used. Whi

My organization sometimes has users open up tickets whenever I a new minimum OS version in our Nudge configuration profile due to the software update window never loading its contents, thus not allowing users to update and badgering them with Nudge notifications. I've created a kickstart policy that runs sudo launchctl kickstart -k system/com.apple.softwareupdated; softwareupdate -l This has fixed the issue of software update not loading its contents, but I was wondering if it was possible to trigger this policy whenever I make changes to the Nudge configuration profile. This way the kickstart command would run after changes are saved in the configuration profile.

Hello we have slack policy in JAMF we just started to use the universal version of slack to all users since they both with m1 and intel some users are reporting that the slack app is unable to open or it crashes i am having issues figuring out a fix for this does anyone have an idea? 

We currently have the JIM server working in our DMZ and are possibly looking into ADCS.  Could the ADCS be installed on the same JIM server in the DMZ?

Looking for a solution (can include 3rd party solutions) where we can pull macOS student lab usage over various periods of time from Jamf Pro (Cloud Hosted).Jamf Pro web is limited to looking at log in history of each machine individually which makes data mining very labor intensive. Also looked in to Jamf / PowerBI and didn't see the data field (unless I over looked it).Reached out to Jamf support, and they only knew of the web ui / individual machine method.

Hi All, So we've seen this issue for years, and I've asked Jamf, and Apple's GSX support about it, and gotten non-answers, so I'm curious what others might be doing.If you look up a new purchase, still within the 1y warranty (or purchased with AppleCare and within the AC warranty), you'll get a PO Date and a Warranty Expiration Date from GSX. If you look up an old purchase, but purchased with AppleCare, you'll get the PO Date, and Warranty Expiration Date in the past. BUT. If you look up an old purchase that wasn't purchased with AppleCare, you'll get a PO Date, and a blank Warranty Expiration Date. I've asked Jamf and GSX Support "can we infer anything from this?" as in "Can we assume if the Warranty Expiration Date is blank, then the warranty expiration was one year from the PO Date?" and not gotten any answer. Is anyone already making this assumption and just filling in that info themselves? 

Hello,We have a problem with a local account password that seems to no longer work for some unknown reason. During prestage enrollment, we create a local admin account (other than the management account). When created, a temporary password is assigned so that our support team can finish preparing the computer. Once our support team has finished intervening on the preparation of the computer, they execute a script via the self-service to change the password with a password that few people know. Below is the script we use to modify the password with openssl encryption.  #!/bin/bash function DecryptString() { # Usage: ~$ DecryptString "Encrypted String" "Salt" "Passphrase" echo "${1}" | /usr/bin/openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } LocalCurrentPassword=$(DecryptString "${5}" "${6}" "${7}") LocalNewPassword=$(DecryptString "${8}" "${9}" "${10}") sysadminctl -adminUser "$4" -adminPassword $LocalCurrentPassword -resetPasswordFor

Hey everyone,  Is there a way to disable the Profiles pane in Ventura macOS? I don't want non-DEP Mac users to mess around with it and remove the MDM profile.Thoughts?  

Does anyone know why some jamf profiles / policies, when a GET is run on the api will have their payload identifiers change?Example, running a check on a profile two times yields two different identifiers, though no changes have been made: <key>PayloadIdentifier</key><string>52776B4A-EC1C-478B-AC03-016F6D6589EE</string><key>PayloadIdentifier</key><string>F195DE3B-58AF-430C-B69D-A8E8C2606F80</string>

I am not a huge Firefox user, but, there are so many things that are great about it & about how it's made that I sometimes get sad it isn't as popular as it used to be especially given the fact that Google & Google Chrome (which are destroying the internet...) have no real competition. Here is a quick example...Firefox publishes a URL to get information about updates & releases which returns a simple JSON object: % curl -LsS https://product-details.mozilla.org/1.0/firefox_versions.json { "FIREFOX_AURORA": "", "FIREFOX_DEVEDITION": "101.0b9", "FIREFOX_ESR": "91.9.1esr", "FIREFOX_ESR_NEXT": "", "FIREFOX_NIGHTLY": "102.0a1", "FIREFOX_PINEBUILD": "", "LAST_MERGE_DATE": "2022-05-02", "LAST_RELEASE_DATE": "2022-05-03", "LAST_SOFTFREEZE_DATE": "2022-04-28", "LATEST_FIREFOX_DEVEL_VERSION": "101.0b9", "LATEST_FIREFOX_OLDER_VERSION": "3.6.28", "LATEST_FIREFOX_RELEASED_DEVEL_VERSION": "101.0b9", "LATEST_FIREFOX_VERSION": "

Hi All,I am struggling with WebClips. I had no issue getting Webclips to work for Self Service, but I am now trying to push them to our fleet of Shared iOS devices.  I have built out a WebClip Profile with the URL.  I also added com.apple.webapp (and com.apple.webapp.managed) to Only Some Apps Allowed within our App Restrictions policy.  I then added the webclip to the Home Screen Layout and scoped all of this to a department.  All my other apps are installing fine, but the Webclips don't appear at all.  What could I be doing wrong here?Any help would be appreciated. ThanksDan

Hi all,  Referring to this macOS installer script.macOSUpgrade/macOSUpgrade.sh at master · kc9wwh/macOSUpgrade · GitHub  This script works fine for Intel Macbook upgrading to macOS Monterey 12.0.1.  But it does not work with Apple Silicon Macbook 😞  When attempting, I get the following error:Error: failed to authorize for installation. Provide a password with --stdinpass or --passprompt.By using the agreetolicense option, you are agreeing that you have run this tool with the license only option and have read and agreed to the terms.If you do not agree, press CTRL-C and cancel this process immediately.Investigating further, I run the following in a M1 Mabook's terminal./Applications/Install\\ macOS\\ Monterey.app/Contents/Resources/startosinstall --agreetolicense --nointeraction --forcequitappsError: A method of password entry is required.Usage: startosinstall.....The error suggests I need to supply admin username and password via --user, an admin user t

Hey,I have a script that removes local admins from Mac, without the need to restart the Mac and it works great. I would like to solve the issue of updating existing apps without the need for admin privileges.for example: if Slack pushes an important update, users need me immediately in order to access Slack.Any ideas on how can I solve this issue? adding here the script I use:#!/bin/shadminUsers=$(dscl . -read Groups/admin GroupMembership | cut -c 18-)for user in $adminUsersdoif [ "$user" != "root" ] && [ "$user" != "Administrator" ] && [ "$user" != "administrator" ] && [ "$user" != "jss_mgmt" ]thendseditgroup -o edit -d $user -t user adminif [ $? = 0 ]; thenecho "Removed user $user from admin group";pkill -U "$user" -9 -f "/Applications/*"pkill -U "$user" -9 -f "/System/Library/*"pkill -U "$user" -9 -f "/Library/*"fielseecho "Admin user $user left alone"fidone

Hi All So we are moving away to sign our own tomcat boxes that run windows behind a loadbalaner rather than linux so sorting out the new internal certs to take over from when the SSL terminates at the balancer.As it seems the resulting jks file is just copied over to other servers after following this article.. https://learn.jamf.com/bundle/technical-articles/page/Enabling_SSL_on_Tomcat_with_a_Public_Certificate.html I have only ever done signing for IIS and winboxes, there seems to be no way in specifying the multi SAN, ie the servers themselves as well as the main URL that i specify, is this not needed for tomcat certs i always assumed you needed to list the local servers, or because we have a external cert terminating at the loadbalancer with the same domain url do we just need the URL domain only on the local cert to continue the 'journey' sorry for the word 'soup'

5.4.1 (58698.1027) was released yesterday (28 Oct 20). Patch Management for our JAMF instance doesn't show this. It only shows the 5.4.0 update which was released on the 26th. It says that's the latest version. That's wrong. 5.4.1 is the latest version. 5.4.1 is installed on 60 machines and right now those are being reported as Unknown versions. What's up with that? How does JAMF update their patch management for latest versions?

Hi all, We're trying to use dockutil to remove some apps and add a few behind DEPNotify at first boot using this script. It's not working - anyone have any ideas why? I realized I could have used $3 for current user after I wrote it... go figure. #!/bin/sh # determines current user currentUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' ) #kill preference cache killall cfprefsd # layout begins sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Calendar' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Contacts' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Mail' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Maps' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'iTunes' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Reminders' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'Podcasts' sudo -u "$currentUser" /usr/local/bin/dockutil --remove 'TV' sudo -u "$currentUser" /usr/local/

Someone at my company set up integration to get Jamf Pro notifications sent to a Slack channel. That channel had been working fine (about a year now, I'm guessing) until the person who set up the integration went on vacation. Now the channel hasn't updated in several days and I've been tasked with getting it working again. All other Slack channels are working normally.I am minimally familiar with JAMF. I did find in the JAMF console, under Settings > System > User accounts and groups, a username and email address used to send the JamfPro notifications to Slack, but don't see anything there that would indicate something is wrong.Can someone point me in the direction of where I should be looking to figure out what went wrong? Thanks!

I am playing with the above settings in a config profile. However, I see that I cannot change the arrangement after sending the config to a device. Is there a way to set the Home Screen/dock as a default and then allow the user to adjust it as he/she wants?

Hi,In the olden days I would use dsconfigAD -groups to allow specific AD group members to log in as admins (e.g. Music Lab Staff are Admins on the Music Lab Macs) this would run as a policy on all Macs in the Music group. There doesn't seem to be a way to do this neatly with Jamf Connect & Okta, the Admin Group grants those users Admin on all Macs.What is the best way to achieve this using Jamf Connect with Okta?My current thinking is that the Domain Admins group remains we create additional Groups in Okta (e.g. Music Admins) with their own Admin Client ID and a separate Jamf Connect Login Config Profile for each Smart Group e.g. Jamf Connect Login Music profile allows members of Domain Admins and Music Admins to log in with admin privs but members of Computer Science Admins can log in but get a standard account.Am I overthinking this, is there an easier way?