Hello,We employ Jamf in a facility where a large majority of our computers are offline / do not have access to the internet.  So far, we've had no issues with our Jamf Pro deployment by following this guide to make sure that the necessary traffic is able to get through: https://learn.jamf.com/en-US/bundle/technical-articles/page/Permitting_InboundOutbound_Traffic_with_Jamf_Cloud.htmlWe're hitting a snag in our rollout of Jamf Protect, where the only machines that are able to maintain a connection are the machines with internet access. We've added *.protect.jamfcloud.com to our whitelist, but still no luck.Any ideas on what else may need to be whitelisted in our firewall for our offline machines to be able to communicate with Jamf Protect correctly?Thanks in advance!

Hi everyone,I realized recently that during our pre-stage the Office 365 package was not installing during pre-stage. I mainly noticed this while trying to setup dock master as the only thing showing up as "?"'s was the Office apps since they had not installed before signing into the Macbook. Unfortunately, it does not fix after they finally install. Can someone explain to me if these Office packages need to be signed or if I am doing something incorrectly? I am simply grabbing the package from Microsoft and uploading to JAMF then assigning in the Pre-Stage enrollment packages. We have a total of 5 packages we install as part of the Enrollment Packages. Any help would be greatly appreciated, thank you!

Hi All,  Apologies here I am new to JAMF Pro so forgive me if I have missed something obvious:I have followed this guide here:https://trainingcatalog.jamf.com/update-macos-1/372407This is about doing a mass update of the OS. I have followed all the guides and document under Remote Commands - Update OS version and built in apps - Target version - latest version based on device eligibility - download and install the update, and restart computers after installation.Is this not supposed to then update the computer automatically? Without the users interaction?Looked into this as well and followed this but still nothing.https://resources.jamf.com/documents/technical-papers/Deploying-macOS-Upgrades-with-Jamf-Pro.pdfThanks

Does anyone know how to create a configuration profile to make sure users are have the preference setting to load CCD on Logon ?  We have users that have unchecked the preference and need to make sure the CCD app loads on logon in order to do the updates. This is especially important on Ventura.Thank you for any advice 

Hey community, hope you're all doing greatI need your advice regarding a script I use locally on my laptop, but have some difficulties so deploy to all the other employees.Context :We're using Pritunl as VPN. It's a pain for everyone to log in 1Password (our password manager), search for their VPN credentials, and type them in to connect to Pritunl.I use a simple script which links the VPN profile to the credentials in 1password ("op" is 1password's cli).In use, I just have to click on the .command, it executes and open a popup for touchID (used to access 1password's content), gets the credentials with the name "vpn-companyname" and connect to Pritunl with this info.What would you recommend to do to deploy it to all the employees through jamf ?I tried to package it with Jamf composer, but Composer keeps the absolute path /Users/myusername/Desktop/VPNshortcut.command and creates it on the laptops I push the policy/package to... Which creates a new directory/user, so it's a bit of a mess

I am trying to capture how DEP works in Jamf. For that I am using Parallels Desktop to run a virtual Mac OS Ventura 13.4.During the Setup assistant, it is stuck in the remote management and it is not moving for the next page.I can go back, reset and start without DEP. When the device assigned to Jamf, it is not moving to next page.Is there anything I am missing out.

Does the partner device management connector token in in tune also apply to iOS devices, i only hear macOS, but most of my fleet is iOS, in the device compliance in jamf pro it does have iOS and iPadOS.

Hello everyone We have this problem that no macOS software update is available/visible in system preferences when the mac client is connected to corprorate network.if I want to download a macOS InstallAssistent.pkg directly from Apple (like this: https://swcdn.apple.com/content/downloads/63/49/032-84910A_3SSTBN1HDA/h89vitwfbzt54jcbwpfwkmrn12smedicny/InstallAssistant.pkg). Then it works without any problem.But Software Update arent visible/available in system preferences.When Connected to Internet directly (No Corprate network), the updates are then available in system preferences.AFAIK, there is no firewall rule blocking the connection. And yes we have also a proxy that could be causing this problem.The proxy-team claims that Apple servers are already listed in Allowlist and the proxy cant be a problem, as the download of a macOS package works.Does anyone have any idea how to narrow down this problem? What am I missing? 

Hi,We are testing the Device Compliance options in JAmf to forward the compliance state to Microsoft Intune.While registering their device, users will see a list of account to choose from.Is there a yway to limit the list to only the company domain? Thanks!

Before we were able to roll out a profile that prevents students from turning on "Find My Mac", it looks like we have some students that turned this on. I have 2 computers from students who recently left the school and I can't erase the hard drive. I tried from recovery mode and entered the bypass code stored in Jamf, doesn't work. Also tried to send a command from the Jamf pro server but get an error. Will attach the error messages if anyone can advise? 

We are just switching to Jamf Connect using Google logins.  As we are testing we are having our laptops require a login (not Jamf Connect) and then instead of a normal login, the laptop then shows the Jamf Connect / Google login.  At this point we can login using our Google login accounts as expected.If we reboot or shut down the laptop, we have to do the initial login again (not Jamf Connnect), and it takes us to the Jamf Connect/Google login.Any ideas?  Thanks - Tim

Hi Folks, I am unable to get a log flush via API to work. Ideally going by the Classic API and Jamf recipe it should be something like this: curl --request DELETE \\--url https://yourserver.jamfcloud.com/JSSResource/logflush/policy/interval/0but I get an error! <html><head><title>Status page</title></head><body style="font-family: sans-serif;"><p style="font-size: 1.2em;font-weight: bold;margin: 1em 0px;">Unauthorized</p><p>The request requires user authentication</p><p>You can get technical details <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2">here</a>.<br>Please continue your visit at our <a href="/">home page</a>.</p></body></html> Here is my complete script jamfUrl="https://jss.url.com:8443"# Login Credentialsusername="username"password='mypassword' # Bearer Token Function. Get jamf's API token, extract the toke

Hi all,It would be great to receive assistance with Jamf Pro since I am new to it.I was required by the security team to define the following:1. Disable Remote Login and don't allow users to activate it2. Disable Remote Management and don't allow users to activate it3. Put a screen saver on and require a password afterwardMy search for these settings did not yield any results in Configuration Profiles.Thanks 

After enrolling computers in Jamf Pro, some of them are no longer able to connect with the local user. The password is rejected.It is possible to connect with the admin session created by Jamf (PreStage).It's not a password problem, the ssh connection with the local user works, but it's impossible to open the session. Reset password from admin session created by Jamf :Error: Password reset failed Password reset from Recovery : Error: Unable to verify authentication information because directory server does not support requested authentication methodThis is a big problem.

Hello all, We allow our users to use AirDrop in our environment. I know Ventura has changed from System Preferences to System Settings. They also seem to change the Air Drop setting. It was previously a setting by its self and is now bundled together with Handoff so its AirDrop and Handoff.The problem is I can not get machines on Ventura to be discovered through Air Drop and the AirDrop and Handoff setting is grey out and says (These settings are controlled by a profile.)My Config profile allows Airdrop in both Media and Sharing Services. I have also allowed Handoff through the Restrictions --> Functionality screen.Even with those settings, I can not get AirDrop and Handoff to be configurable from the client side.Any thoughts??

I sporadically have users experience an issue where they attempt to update their password via Jamf Connect and it appears to work, but the next time they reboot and log in, the FileVault login does not accept their new nor their old password. This leaves them up a creek and the only option is to use the recovery key to get them back in. And in at least a couple of cases, we don't have the recovery key (they are "legacy" machines and FileVault was enabled well before we had Jamf in place so the keys were never escrowed) so the only option is to rebuild. I'm still working on the least intrusive way of enabling a local admin account for FV and enforcing LAPS on it. Anyone else see an issue like this and have an idea of what tree I should bark up?

Hi, We have 2 JSS's behind a load balancer. I have set the Remote IP Valve setting in Apache Tomcat Settings. When the computer runs a jamf policy (every 15 minutes), the IP address (not reported IP Address) always comes back as the load balancer address. If I run a jamf log on the computer, the IP address comes back as the proper IP address. What's up with that? Is there a way to fix this (without running a jamf log in a policy on an ongoing basis)?

Hey all!What are the implications, if any, of moving an imaged and in-use machine from one Prestage Enrollment to another? Our scenario:We have ~900 laptops all built with one of three prestage enrollments. Each new PE was setup over time with slightly more settings for our environment and only net-new machines were ever enrolled in the latest PE, so we have have a large mixture of each in our company. We have now built a 4th and if we reimage a machine the biggest pain is going into the PE scopes, unchecking it's old PE, then rechecking it in the new PE. We reimage 4-5 laptops per day so searching for the serial and doing this for each one would get tedious.Our hope is that we could uncheck all machines from the scopes in the three old PE's and just check all machines in the new one. That way they whenever we reimage them (either tomorrow or two years from now) they will image with the newest PE. Will unchecking those machines and rechecking them in the new one do anything?

Seeing an odd issue with one device in the JSS. This device in our JSS that has two entries. One is current, the other has not 'checked in' since March. I can select and delete the currently active device through the console no problem. However, the older entry, when I click on the device name, goes to a new page and says "The page you requested could not be found". I need to be able to delete both entries. Anyone know of a way to delete this stale, false record? Perhaps a MySQL command or similar?

Hi Team,Hope everyone had a great weekend.I have a question related to Patch Management. So I was able add my current package (Ver.108.0.1) to the Definition tab as well as I was able to add some machines to my scope as a 'TEST' along with the target version of the program that I want installed. I was wondering if there's anything else that I need in order to get these machines updated or do I just give them time and they will populate on their own? Here are some screenshots of what I've done so far. - I'm sure there's an answer somewhere on here, but I can't seem to find it. - Thanks. 

So I use to have a script that downloaded PIA VPN but now when I run a curl command on terminal using ' curl https://www.privateinternetaccess.com/installer/x/download_installer_osx 'it just shows the website in plain text rather than an app can anyone offer any insights what is the best way to go about this?

I'm working on setting up our Jamf processes, and while navigating the AppConfig Generator for Jamf Reset I noticed they have a checkbox for Disallow Proximity Setup. This would be nice to have (one less tap when turning around devices), but when I attempt to use AppConfig Generator it throws an Internal Server Error. And this ability to disallow it isn't documented in the Jamf Reset Configuration Guide (which looks like it needs someone to do a find-and-replace for all the references to Jamf Setup). Does this configuration key exist, and if so would someone enlighten me? :)

Good morning,After modifying profiles (to apply a defined wallpaper or install Web Clips) the update does not take place on the whole group ... The versions of the profiles are the same, but the "visual" version " which is on the Ipad is different ... (same version of IOS)Anyone had the same issue?Thanks to the communityThierry 

Hello community,we are using SSO via Microsoft Asher® AD.Now, we changed our Cisco Webex® to SSO, too. On our Windows Clients, SSO for Cisco Webex® is working, but not on our Mac® clients.I configured a configuration profile and a plist in Jamf Pro® for SSO with "Single Sing-On Extensions SSO for the Mircrosoft Office® applications is working well, but not for Cisco Webex® . The (Microsoft® ) logon screen is coming up, but the user credentials (the users email address and his password) are not automated filled. (When the user is starting an office application, like for example Excel®, the credentials will be filled in automatically).The application "Company Portal.app" is already installed on the Mac® client and the client is registered in MS Intune®.Is there anyone who can help me for setting up SSO for Cisco Webex® ?Thank you for your time and answer andkind regards,Michael

In one of the recent Defender version updates, Microsoft changed the syntax used for the mdatp command line tool. We script this to determine Mac AV data via Extension Attributes.This link has the release notes for Defender for Mac: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnewThis link is a good reference for the command line options: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-resources#configuring-from-the-command-lineBelow are some of the scripts we use to build these attributes in case anyone is looking for the updated syntax. The first one is interesting since the definitions date used to be exported in epoch time and is now in a human-readable format.#!/bin/sh # If Microsoft ATP is installed, then get ATP definitions date if [ -f "/usr/local/bin/mdatp" ]; then result=`sudo mdatp health --field definitions_updated` dateresult=`date -j -f "%b %d, %Y at %H:%M:%S %p"