I have been asked to implement Jamf to manage the local Firewall - security would like the Firewall to be enabled, user restricted from making changes, and block all incoming connections ASIDE from built in Apple or signed software. I can do this locally by just making sure the right buttons are selected, but when managing this through Jamf there is no way to allow built in Apple software. These services would include AirDrop, AirPlay and hand off from iOS devices to macOS. Jamf has two options: block ALL incoming connections (which prevents AirPlay etc) and "Control incoming connections for specific apps". The second option allows the user to select whether to allow or deny an incoming connection - and the message doesn't convey that the connection they are allowing is actually related to AirPlay, so I foresee a lot of tickets as a result.I've done googling for this and it looks like this used to be able to be fixed with scripting, but that isn't

Hello all - tried my hand at Applescript but failed. Tried to find some way to do this in Jamf but I don't think it can, not familiar enough with the guts of Apple bits and bobs to draw on any huge knowledge (though half ok in Linux) so pitching this to the community. All I want to do is add, either in Finder or by some method or another (putting an icon somewhere on the thing,) a SMB share (from a Windows server) onto my student ipads. They need to be able to browse to some files for an app (Clicker) to work. I cannot for the life of me fathom out how to do this. I've set up a separate AD account for authentication but really stumped. It surely can't be hard to do, can it? If anyone's passing and has done this I'd really love to get it working. Thanks all!

Hello,I need help about something :- we filtered the content of our iPads via Jamf content filter "Built in : limit adult content"- we add a few blacklisted url. on the iPad it's now impossible to delete safari browsing history. It's grey in safari and in Settings. I try to exclude an iPad from the group (content filter), now i can delete safari history again. Have you a solution to allow to delete browser history and keep "content filter".

Users whose name contains an apostrophe/single quote (ASCII code 39) are presented as @#039 instead of '.This is the case in their user profile and also in their device profile (which uses the user's name in the iPad).Users are imported from LDAP. 

Hello, I am looking to create a Jamf Extension Attribute to create a username that matches a users LDAP info $FULLNAME and turn it into `firstnamelastname` or `firstname-lastname` and then use the Jamf Variable $EXTENSIONATTRIBUTE_# on the Account Name within Prestage Enrollments Account Setup.$FULLNAME/REALNAME don't work as it creates a space between the names and this creates issues when attempting to call username in scripts as it will only see the `Last` name of the user. $USERNAME does not work as this is an email address from our LDAP and the @ symbol is also an illegal character causing the same issue.Unfortunately I have no idea where to begin other than knowing to use <result> with in the custom attributes, very new to scripting and I am the only Jamf Admin at this small company. Does anyone know how to accomplish this automatic Account Setup? 

Run any Jamf Pro policy at the next user login or computer rebootBackgroundRecently, we had a need to run a particular Jamf Pro policy only the next time the computer rebooted.Having previously created Recon at Reboot, I started on a modification for this one-off need. About a third of the way into the modifications, a Heaven-inspired question came to mind: Why don’t you write a script to execute any Jamf Pro policy at the next reboot?Continue reading …

Hi,Does Jamf support configuring a firmware password or preventing users from entering Safe Mode?Thanks, 

Hi All,Really just wanted to post the video of our 2022/2023 device enrollment that is currently fully automated and 'zero touch' really just as a thankyou for all the knowledge you guys and gals have inadvertently poured into me to make any of this possible.If anyone has any comments, require assistance or even suggestions id be more than happy to take the time to reply,https://youtu.be/G5Cm0gUNVDc Kind regards and keep doing what your doing!Pete

Hello, Struggling quite a bit with the Firewall features in JAMF and I'm wondering how others are working with or around it. The configuration options are very basic either Block Everything or Control incoming connections for specific apps which looks like you'd then need to populate the list with any application that could possibly receive incoming connection which seems like an impossible task. Also the fact that if you have a policy applied to the machine with the Firewall payload its locked to whether that policy says the Firewall is enabled or not. In our environment, we do not allow incoming connections nor server services to be running on user workstations. Being able to easily block this with a policy is nice, but then we have cases where someone wants to use AirPlay which needs incoming connections to work. Allowing 1 application through the firewall does not appear to be an option so the alternative is to not apply the Security and Privacy policy

Hoping someone's done it! Currently we disable Lock Screen notifications for a couple of apps. this has the downside of the rest of the notification settings of that app becoming locked up and we've seen complaints about users who want sounds on, sounds off etc. Has anyone managed to disable just the setting "Allow notifications when the screen is locked" ?

Hello,Fonts are distributed on shared iPads (through profiles ;-))These profiles are well installed BUT the fonts are not accessible...Any idea?

Hello everyone,I am using Jamf Connect with Google Workspace over a few sites. Everything works fine except for the Google/Jamf Connect login window which in certain countries defaults to the local language.Is there a way to configure English as a default language for the login screen ? In theory, we'd append hl=en but the question is where ?Thanks in advance!

Hi All,How to configure VPN (Not per-app VPN) for macOS from Jamf Pro. Also, the requirement is that User should not able to change or remove VPN  

Anyone have a good way of setting the time zone up correctly? I have tried using the time zone script on the jamf forums, however we are still seeing issues with the time being up to 5 minutes off. Is there a way to enable the automatically detect time zone setting while also enabling locations services to allow this to happen?

Hi!  We are trying ot extract the APNS certificate form the Jamf Pro database to be able to monitor the expiration date, but the keystore is password protected.  Does anyone know how to retrieve the password? This is what we get from the database:  mysql> select * FROM push_notification_keystores; push_notification_keystores_id : xkeystore_type                  : xkeystore_password_encrypted    : ...keystore                       : binapple_id                       :

I want to deploy a .jpg file in a customized path on macOS, /Library/MyCompany/logo.jpg Now on my test mac I placed the .jpg on the mentioned path and using by composer I did drag and drop the entire path and built as .pkg. Now if I deploy it through JAMF Pro, it will create any issue or better to sign this package using by Jamf Pro's built-in certificate downloading it from Jamf Settings/PKI Settings and install cert and make it trust in system keychain and sign using by Jamf Composer when going to build the package and then deploy it. Which is correct?Instead of using Jamf Pro to deploy the package if I try to install the unsigned .pkg it will create any issue on different mac?

Google have pushed out an emergency update for Chrome on the Mac. I've noticed in our 'Mac Apps' - Chrome is not yet up-to-date.Is there a way to force a 'Mac App' to deploy the latest version? Or do we just have to wait for Jamf to sort it out at their end? 

I recently deployed our first enrolled M1 MacBook. I logged in and added the user as an Admin account but the user could not install Teams or Zoom. Both failed after the user put in her password for the install. I logged in as me and both apps installed OK following the user’s method of downloading from the respective websites. User logged in and was able to set up both programs. Is there a Jamf setting that is preventing her Admin account from installing or is this an Apple setting?Any insight would be appreciated

👋Hey there, Jamf community!We have some exciting news to share with you all. The Jamf User Research Team has been hard at work organizing weekly customer workshops, and we want YOU to join us! These weekly workshops are the perfect opportunity for you to have your voice heard and provide feedback on a range of topics alongside other Jamf customers. Plus, you'll get to connect with like-minded individuals in the community and learn from their experiences. We're always adding new workshops, so be sure to keep an eye out on the

I know this feature request is out there about 100x and I have yet to see a script that does it. Most of these logs are available via the API. So I wrote a script that will let you input either a single serial number, or a CSV of serial numbers and then output a CSV with header for any of the following logs - Screen Sharing LogsJamf Remote LogsComputer UsagePolicy LogsCompleted MDM Commands I only included those because they all leveraged the same API endpoint and it made scripting it easier. If you're handy with scripts, I'm sure you could build off this quite easliy. I'm not a scripter - so I'm sure this isn't perfect. Use at your own risk, just posting it since it seems some people would benefit from it. Since it's 1 API call per device, it'll chew up some server resources, I wouldn't run it during peak hours if you have 10,000 devices. I'm sure I'll miss linking this on a variety of feature requests, so feel free to link

Hi,I am currently trying to use the Jamf Pro API to run software updates on our Mac environment. I did some testing a few weeks earlier and was able to successfully update a single mac using the API command. Recently I have tried to update a whole room full of macs but receive a http 401 error when running the script. The only change I made to the script was to add the device IDs of the relevant devices.In order to try and troubleshoot this I removed all the device IDs except for the one I used in my initial test but still receive the 401 error.I have also confirmed that my credentials to Jamf Pro were correct, this is proven by the fact I do receive a valid bearer token when requested. I have also checked all of my Jamf Pro account permissions and I have every available permission assigned. Also the same bearer token is able to run this command.curl --request GET --url "$url"/api/v1/macos-managed-software-updates/available-updates --header 'accept: applicatio

We have a hidden admin account that gets created with the pre stage enrollments. When using Migration Assistant some users clicked on the replace the current admin account with their user account. Is there a way to reinstall that admin account from the pre stage enrollment or would I just have to make a new admin account with a configuration profile or policy?Thanks

Say what you will about Jamf Remote, but I found it quite useful for support. It let me keep screen sharing disabled to meet compliance, while still allowing me to use it when I needed it.I still have the app from its last version, however after upgrading my Jamf Pro server I'm now getting "This account does not have privileges in the Jamf Pro Server to use Jamf Remote". Of course, the option to give myself privileges is no longer available in the GUI.I'm wondering if maybe I can modify my database directly to add the Jamf Remote permissions flag back to my account. Has anyone else done this? Or at least, does anyone know what that database entry might look like?

Has anyone deployed Sophos Endpoint to Mac devices using Jamf School, specifically? During my deployment call, the only thing Sophos had was for Jamf Pro, which is a different animal than Jamf School. The person working with me was phenomenal and tried to adapt the instructions to Jamf School with my help, but I've got random little snags with Sophos which has caused me to pause my deployment. Instead of scoping it out and installing everything, I have to manually lay hands on the machines (my users aren't capable of doing full install) and install everything, going into security and preferences and making those changes as well.I've reached out a few times, but not heard back from Sophos.

Hi Everyone,I have recently come into a problem with users trying to install applications through MAC self service over Wi-Fi. For some reason, when users go to install an application over Wi-Fi in MAC Self Service, they get an error message. (The users are on our school Wi-Fi) This is what I see on my end: [STEP 1 of 4]Executing Policy Arduino IDE 2.0.4[STEP 2 of 4]Mounting BrooklineCould not mount distribution point "Brookline"[STEP 3 of 4][STEP 4 of 4]However, when users download it when connected through ethernet, there are no problems. Has anyone seen something like this and have any ideas? Much appreciated!Joe