We have an issue with some techs abusing their device admin accounts and installing software without security review. We have techs making employees an admin on devices just to avoid getting tickets.I have an extension attribute that shows me admins on the device, but I can't see who did it.Is there a system log that will show me exactly what account made changes? Jamf doesn't give granular info like that. Can it been done through an extension attribute?

Has anyone had an issue of 2 separate packages that when uploaded under separate names - not replacing any existing ones - have the packages overwrite each other?

Update to in-product release notesStarting 13 March 2023, Jamf School will no longer display in-product release notes at the top of the dashboard.  Instead, you will have a What’s New section, showcasing the latest updateYou can still find all of the previous Jamf School release notes in our new Jamf Learning Hub. 

Hello,May I know if we have a way to prevent admin users to uninstall an app from MacbookAny lead:- Configuration profile from JamfThank you.  

Hi, I'm a complete newbie. ;-)We are using non-shared iPads at our school.I would like to remove all data (files/photos/videos) that students have stored on the device every night automatically without resetting all data. I couldn't find a way to realize this plan.

Hey hey!Is there any way to get a report spit out that shows, for example, all iPads with Room Controller on them that are less than version X? I've found that our Zoom Room controllers get cranky about updating when we have them locked in guided access mode, so I'd like to be able to check now and again to make sure they're all on at least version X for specific security/features that dropped with it. In this case I want to make sure they're all on 5.13.X for Teams compatibility.It doesn't seem like Smart Groups has a 'less than' functionality, and I've seen mention of using Patch Reporting but that only seems to work on the macOS side of things. I'd even be happy if I could just have it spit out a .csv file with device name and version number on it as I can quickly sort that.Thank you for any info or tips!

Setup Your Mac (1.8.0) introduces Configurations, which enable users with high-bandwidth Internet access to maximize initial computer setup, while also allowing users with low-bandwidth access to configure an organizationally compliant Mac in a single step.IntroductionApple’s Automated Device Enrollment helps streamline Mobile Device Management (MDM) enrollment and device Supervision during activation, enabling IT to manage enterprise devices with “zero touch.”Setup Your Mac aims to simplify initial device configuration by leveraging swiftDialog and Jamf Pro Policy Custom Events to allow end-users to self-complete Mac setup post-enrollment.Continue reading …

I am using jamf pro onprem environment & always using user initiated enrolment & is there any way i to restuct the old mac OS  enrolling to jamf ? any warning or intimation we can give before enrolling to jamf ? 

Hi, I am testing where I am able to cache a Monterey OS installer app into the machine. When I try to auto push the following command as a script or as a command using files and processes, it keeps give me helper tools crashed at random times through out the process -/Applications/Install\\ macOS\\ Monterey.app/Contents/Resources/startosinstall --agreetolicense --forcequitapps --nointeraction The machine i am executing on so far for testing is 2017 intel MBP 15inch with OS 11.6.3.I have tried removing the restart payload as well and no luckAnyone have any idea why this would occur? This worked fine when updating users from macos10.15 to macos12. Anyone have a workaround? 

Has anybody installed this before. I was tasked with getting this added to Jamf. I uploaded the mobileconfig file and the script. I uploaded observeit-cloudagent-OSX-bundle-2.2.0.313.pkg. It looks like it deployed, but not sure how to confirm and the department who is in charge of this doesn't know either, so they opened a ticket with the vendor.  As for the autoupdater package, does that also require its own script and mobileconfig? I deployed it, but got a message asking where the preinstall.json was located and if you hit cancel it brings up another error about a config profile.

We have a great update to the apps to share, the inclusion of Widgets for your Homecreen for both students and teachers as well as bug fixes and enhancements Jamf School Documentation Release Notes:Jamf Teacher 6.2.2 for iOS (2023-02-27)Widgets in Jamf Teacher for iOS and iPadOSThe Jamf Teacher app now uses widgets. This allows teachers and students to view app updates and shared documents on their devices without opening the Teacher app. It also allows teachers to customize their widgets and personalize their app experience. For more information about widgets for Jamf Teacher, see Jamf Learning Hub .Bug Fixes and EnhancementsPressing the tab button on the login screen now properly moves the cursor to the next text field.Teachers now receive an error message when text fields are entered incorrectly.Jamf Teacher 3.2.2 for macOS (2023-02-27)Bug Fixes and EnhancementsPressing the tab button on the login screen now properly moves the cursor to the next text field.T

We used to package up adobe CC apps from the adobe admin console, pull the PKG from the build folder, and throw that into jamf pro - it installed fine.Now when we do the same process it fails most of the time, but not always.One of the failures shows the below error. Same policy is still successful in a few instances.Anyone else had trouble recently with adobe CC app installation? Installation failed. The installer reported: installer: Error - the package path specified was invalid: '/Library/Application Support/JAMF/Downloads/Illustrator - Managed_Install.pkg.unzip/Illustrator - Managed_Install.pkg'.

I made a Package (named Receipt March2023.dmg) and made a Policy (named Receipt March 2023) that installs it.  I scoped it to one computer and the Policy successfully ran and the Package was installed.  I want to save an Advanced Search in Jamf Pro that will, among other criteria, search for computers that have installed this package.  I see that there is a Search criteria named Packages Installed by Casper.  If I choose that criteria and enter Receipt March2023.dmg for the Value, the search doesn't find any computers.  If I click the three dots to see the options for the criteria, Receipt March2023.dmg isn't in the list of Packages.  Why not?

Hello!I am a technology coach who is new to jamf.  Our students are currently unable to login to their iPads using their Apple ID.  When you go into settings, the option to sign in is greyed out.  We are having tons of federated ID issues, and no one from the district tech team has been able to give me a good answer as to why.Can someone here tell me what device restriction is turned on in a config profile so I can fix this?  

We are moving to make our end users be required to be standard accounts and remove thier admin rights, but we need to have a secondary local admin account on the machine to authenticate admin privs when needed, but our IT Security is requiring it to be for authentication only and not able to log in as a user. So far, I can't seem to find a way to make this possible to block the accounts ability to login while still allowing the account to auth when needed.Anyone have any suggestions or run into similar needs?

We are relatively new to using Jamf Pro in our environment. Our preferred method is having staff update their mac with the "Try Tonight" option if they so choose and not force a reboot by admins. My question is has anyone been successful with the Try Tonight option in their own environment? To confirm this is NOT the Apple push notification but the Jamf push notification. The Apple push notification with Try Tonight appears to work. This option, via Mass Action, is available but I have yet to see it work as designed. Is anyone else having this frustrating experience? 

Hello !I'm working on installing a computer and I just found that when I change it's IP address and start a recon, the IP address doesn't update on the computer's inventory in Jamf. I just tried to my own computer too and the same thing happens: the IP address doesn't update in Jamf. It's a problem as I have some policies that run based on that information.Is there something that I can do or is it a problem with Jamf itself ?Any help is welcome !

Hi,We are trying to complete our setup for deployment of Mac devices which including Jamf Connect and for some reason all of a sudden when we do a unbox and our MDM (Intune) installs Jamf Connect the menu bar app is prompting for the login of the user where it used to pass the login info from the Jamf Connect Login. If the user does not sign into that window it never seems to connect even after a reboot it just keeps prompting and you can close the window so the password syncs are never occurring.If another user logs into the MacBook and the new user profile is created it automatically connects the accounts, but the first time user account never gets connected unless they login. I'm not sure what has changed for this to occur, anyone else experienced this?We are using Jamf Connect 2.21.

A profile with a “Assessment Mode” payload is already installed on the system. Basically only one app can have this setting at a time.  You can find this error message in JAMF under the laptop's account and Management.  It will be a failed command and have the above reason for failure.  If you get a device with this issue, you can open the System Preferences > Profiles and search each for a "Setting  Assessment Mode". This should help identify the offending config file with a conflict.  There are a few approaches for a fix.  For instance, you could use Self Service to deploy the apps.  Have one delete the other when it is installed by a script that runs BEFORE the package.  Then have Smart lists to detect the software and use those groups to deploy and withdraw the respective Configurations.  This is one example of where it would be great if we could deploy configurations within date ranges in a similar way to policies.  -P

If only I had known before customer made this purchase…One has to sign in to an online account just to run the installer.Maybe it's not too late to be returned.

I am dealing with this issue where some users created webclips using Safari on their iPads. How can I prevent users from doing this? Also I am not able to delete the webclips they have created with inappropriate names. I have started looking to see if there are any configuration profiles that are preventing me from deleting those web shortcuts. Any help or suggestions is appreciated. 

I'm running into some problems with a Application & Custom Settings payload pushing a PLIST for Microsoft Edge where it refuses the values for ExtensionInstallAllowlist and ExtensionInstallForcelist.Anyone else seen this?

This is probably a dumb question but I have not been able to find an answer.I was requested to remove an App which was purchased by a 3rd party and converted to a "dangerous" app. I am able to get the Bundle ID for the App but not the Name (IE: App Name "Keynote" would be Bundle ID "com.apple.Keynote.") When I type the name of the app in nothing related shows up. As long as I have the Bundle ID, can I substitute my own "App Name" and still have the App Restriction work?

Does anyone have a good way to auto install homebrew for apple silicon and intel? Previously I used this script but it's getting stuck. #!/bin/sh# Set variables for the logged in userloggedInUser=$(stat -f "%Su" /dev/console)#Obtain processor type and add to variableprocessor=$(/usr/bin/uname -p)# Check for Homebrew if it exists then update it otherwise install Homebrewwhich -s brewif [ where brew ]; thenecho "Homebrew is installed ...moving on"elseecho "Homebrew is not currently installed. Installing..."/usr/local/bin/jamf policy -event brewfi# Create elevated permissions during installecho "$loggedInUser ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/elevated# Adjust permissions to elevatedchmod 440 /etc/sudoers.d/elevatedchown root:wheel /etc/sudoers.d/elevatedecho "$loggedInUser"# Check processor architecture type and run command according to processorif [ "$processor" = "arm" ]; thenecho "Installing brew app for M1"sudo -u "$loggedInUser" /opt/homebrew/bin/brew reinstall -

First time poster. Hopefully I'm doing this right. We are looking to implement Graylog in our environment (Mac/PC)To start, we are looking to just get logins and logouts. Is there a way to send Computer Usage Logs from Jamf Cloud to Graylog?Or, where does the Computer Usage Logs come from in macOS (10.13 or above)?Is there a login/logout script that I can run to send those specific logs to Graylog?