We’re excited to share the new endpoint security-focused Jamf 170 Course! The 170 is an introductory certification course focused on Jamf Protect, macOS security features, mobile device management, and best practices to keep your fleet safe. This course is self-paced, available online, and the content is free to all. The 170 provides foundational knowledge for Jamf’s advanced instructor-led security counterpart, the Jamf 370 Course.   Keeping computers secure and safeguarding user data is no small ask. Jamf Protect provides the toolset to identify malicious activities, source analytics, and leverage MITRE ATT&CK framework intelligence. Even if you’ve been managing Apple devices for a while, and just now joining the security space, this can be a lot to take in. That’s why we designed the 170 to help you build a framework to understand and employ the features of Jamf Protect from the ground up. This course is contains 11 lessons separated into 3 sections.   Providing contex

Need a way change your Jamf Management Account in a automated way?Check this out:https://www.ericsontech.com/2023/04/change-jamf-management-account.html 

Hi all, We have this script in place to merge or override favourite servers on our clients;#!/Library/Frameworks/Python.framework/Versions/2.7/bin/python # change the above path to your own python if you don't have Munki installed """ Merges add_servers into current favorites and removes remove_servers. Run as root to update all users or as normal user to update just that user. """ import os import getpass import subprocess import uuid import Foundation favorites_path = "/Users/{user}/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.FavoriteServers.sfl2" # add these servers if they don't exist already # use a tuple: ("<name>", "<path>") to set a name for the favorite. # otherwise just use a string and the path will be used as the name add_servers = (("My Name", "smb://server.example.com/share"), "vnc://server.example.com") # remove these servers if they exist. Use a wildcard (*) at the end to remove all shares # does not support ("&l

Afternoon Jamf nation I looking for people who have successfully built a custom dock using this method here https://community.jamf.com/t5/jamf-pro/build-a-custom-macos-dock/m-p/264565Its sort of working, it only seems to be building the dock the second time the same users logs in. Any suggustion on how I can fix this behavouir as I need the dock to be created for every user that logs in when they log in. As this will eventually be deployed to a lab.ThanksTom

I've enrolled our school's fleet of iPads and am currently in progress doing the same to our Macs using Apple Configurator 2. The devices populate correctly in ASM and then I assign them to Jamf Pro, but when I try a test case of Apple Classroom with a teacher Mac and student iPad (assigned as such in ASM with Managed Apple IDs) I see some unusual behavior. The ability to lock students into apps is completely grayed out, as well as the Lock and Mute features. After some troubleshooting with Jamf, I've tried stripped-down PreStage Enrollment profiles on completely wiped devices to ensure no profiles were causing issues, added and re-added the devices to ASM several times, wiped the Mac completely and reinstalled OS, etc. Finally they posited trying the configuration on two like devices--doing so requires me to purchase an iPadOS version of Apple Classroom app on ASM and deploy it through Jamf so I can add it to an iPad. But the app will not appear in Jamf for deployment. I've been back

Using Self Service, it says packages are installed - but they are not anywhere on the Mac. I can't see where anything is configured incorrectly.

I have installed Ivanti client and connected to it, I am using a PSAM feature. To use this I need to get a system extension blocked for the SAM. And I need to allow it on the Security & Privacy section. Issue: I am not getting this prompt nor appeared in the Security & Privacy section. Can any one help me on this. Do we have any terminal command or any other process to enable the system extensions prompt?  OR to manually allow this extensions?  

Hey allcurrently we have the problem that some users can no longer log in to SelfService.We have turned off our LDAP server and switched everything to Azure AD with SSO.We have also changed the configuration so that a login does not have to be required in SelfService. However, after clicking the login button, only a white screen appears: However, this does not apply to all users. Network and Internet can be excluded.Does anyone have any ideas? 

New malware to worry about:https://www.uptycs.com/blog/macstealer-command-and-control-c2-malwareUptycs recommends the following measures and actions:Keep your Mac systems up-to-date with the latest updates and patchesOnly permit the installation of files from trusted sources that allow ‘App Store’ or ‘App store and identified developers.’In Ventura (13.3), "App Store" and "App Store and identified developers" are the only two settings under Security, but it looks like there is a way to run unsigned apps anyway under the "Developer" section?  I am thinking of adding a block for "weed.app" in JAMF - Restricted Software. I didn't see a confirmation that weed.app is the process name, so that is a bit of a guess.

Greetings all! In iPad Prestage Enrollments there is a "Temporary Session Timeout" when. one enables Shared iPads for the prestage. It doesn't appear to have any affect.  Does anyone know if this feature is currently known to not work?"Temporary Session Only" also appears not to work, as there is still the option to log in with an Apple ID on my Shared iPads.I will probably have to call Jamf on this one, as I did previously for the inability for MDM commands to change the amount of time until the Shared iPad screen locks. This turned out to be a Product Issue that was reopened.  

We are trying to setup Shared iPads for one of our departments.  However, devices will timeout back to the Lock Screen after 2 minutes and we cannot locate the ability to change this to 1 hour. Our PreStage Enrollment sets the device up as a Shared iPad, Temporary Session Only, Temporary Session Timeout of 3600 secondsOur Configuration Profile targeting the device cannot set Maximum Auto-Lock or Maximum Grace Period for Device Lock settings from Passcode section or the Profile will failManually issuing a remote command to the device to Update Passcode Lock Grace Period (Shared iPad Only) or Adjust Shared iPad Settings do not seem to helpI've attempted everything I can think of at this time or have found online and no matter what, the devices will go back to the login screen after 2 minutes.  As these iPads will sit on screens that need to be referenced without interaction for several minutes at a time, this has created an issue where the devices are not functional for th

Hello,i have the problem, that the devices on their first registration ask to create manually a computer account. I don't know why this happened, because in the past the process was the following: We have SSO Azure and the user got the Microsoft Window to login with the Microsoft-Account credentials. After that the MacBook automatically created the local computer account like the Microsoft-Account.But now, after login with the Microsoft-Account the user must create manually a computer account and there is no automatically account creation. If you do that, you get an error after a few minutes.Can somebody help me? I do not know what is wrong with our configuration in Jamf Pro and i don't find something to fix that.Thank youJulien

Using the API, is it possible to get the value of a single extension attribute? For example if I have the follow XML<computer> <general>...</general> <extension_attributes> <attribute> <name>Domain</name> <value>DomainA</value></attribute> <attribute> <name>Firewall</name> <value>On</value> </attribute> </extension_attributes>Is it possible to request the value of the Firewall extension attribute?

Hello JAMF-ers. I am give access to upload CSV files into our inventory Preload to one of our new system technicians and I am having some issues figuring out what all is needed to be able to do this. I've given him Read, Create, and Update rights to nearly everything in our instance (except for scripts and users). I'm guessing maybe it needs delete access to something in particular? If anyone has any insight, it would be massively appreciated. 

I need assistance in settings up permission for a user that only needs to be able to upload inventory preloads for mobile devices.. currently they can only view active data but need to know hte correct permission(s) so they can upload a new CSV file.

How Erase-install script bypass the end user's admin credential to provide at the time of OS upgradation? In which step of script it is helping us to bypass the admin credential?  

We have an iPad Air software version 12.4.6 which is managed by JAMF Pro.We can no longer send commands to it through JAMF.  Everything is pending.Wifi connected fine.The capacity is full.Restriction policy does not allow to delete devices from the iPadWe simply want to wipe it.   Even unmanage device command just stays in pending.Any suggestion folks?~ Peter 

Hi all, Our Qualys console recently started reporting on Git related vulnerability - CVE-2022-41903Vulnerable git version detected on our assets: git version 2.37.1 (Apple Git-137.1)This is the native Git version that comes bundled with the OS. Apple has not yet provided a security update on this one so I'm trying to find a way for doing patching effectively and urgently.I understand that I can get the latest release (2.39.1) from here: https://git-scm.com/download/macHowever in order to be able to upgrade I would need either Homebrew or MacPorts. The problem here is that none of them seem to be installed to the impacted assets so I would need to deploy one of them first.I also tried upgrading Git via Git: git clone https://github.com/git/git Unfortunately it's not working.I'm not really experienced with Git so at this point I'm not sure about the possible best approach to address the vulnerability. I'm also not sure about what was going to happen to the c

Afternoon Jamf nationHas anyone been able successfully disable Airdrop/handoff  in Ventura.I have been having search on here and can't find anything that works.I have tried few custom config profiles but just can't get them to work even after a restart.Does anyone have workable config profile they can share?Thanks    

Hi guys!So we have this situation, the screen is just for reference purpose, from Word but we need this for Outlook.We want to configure default reply font options for both Latin and Asian language.Is that possible with a script?The OutlookFontPoke seems to only have this for the Latin field.

In September 2022 we started bundling a notification engine with most App Installers software title to enable end users to be notified that there was a pending software update available if the app was currently running (App Installers would silently update the app if the app was not running). I had previously described these changes in this Jamf Nation post. During JNUC last year we announced that we would be releasing future updates to this end user notification capability to make it easier for Jamf Pro admins to configure how often these messages appear, the message and a deadline by which the update must be applied (if desired). To prepare for this upcoming capability we have started including the new end user notification engine in the installers being distributed by the App Installers feature. Most end user notification messages will display with the icon of the application that is running such as this Firefox example.Unfortunately there are some software titles that we

Hey there - this is really doing my head in and is probably something that can be resolved in about two minutes. Where do you change the 'managed by ""company name"" ' for devices enrolled in Jamf Pro? I have looked in every setting, everywhere and cannot see how to do this - previous MSP have their name on it and it's really quite annoying!TIA

Hey everyone!Quick question if I may, I know there is an option to set a popup after the first time a user login into his mac on which programs are being installed and a welcome message to our organization, but I can't for the life of me find on the web the name of this feature or where it can be found on the Jamf connect interface....Attaching a link to a video that shows this feature at 3:15 https://www.youtube.com/watch?v=YkGCtlQv7fc&t=193sThanks in advance!  

We've just completed our annual Apple GSX Certificate renewal.We got the new cert, converted it to a .p12, imported into Jamf, clicked 'Test', and got the 'A connection to the GSX Server was successful' result.When we run the GSX Lookup on all devices, though, 100% of our inventory returns as "Serial Numbers Not Found"This worked 2hrs ago on the old cert, so it seems to be a break between the cert and our GSX account.I'm trying to work this with Apple, but getting to anyone with GSX knowledge is pretty difficult.Apple's cert renewal instructions here: ( https://gsxapiut.apple.com/apidocs/ut/html/WSFaq.html ) have been wrong for 2+ years:"...The FQDN is a very important field and it's case sensitive. Please be sure to provide the following value for this field: For test environment CSR : Applecare-APP157-[SoldTo ID].Test.apple.com For production environment CSR : Applecare-APP157-[SoldTo ID].Prod.apple.com For example,if your soldTo is 0000012345, the value should be Applecare-APP157-0

It would be convenient to be able to move columns left and right in the Advanced Search "View." Some websites and apps use drag & drop and some use a table to set the order. This would remove the step of having to export the contents and reorganize the column yourself every time.