Hi All, I'm in the process of moving from JAMF Now to Pro. Currently have around 100 computers on JAMF Now and their FileVault key are store in the JAMF NOW Cloud. How can I migrate those recovery keys to Jamf Pro using profiles/policy script. I know that i could go on the host computer. Switch off filevault. Remove computer on JAMF Now. Enroll into JAMF Pro and use a policy/script to escrow key to JAMF Pro cloud. But thats very involved. Is there any other workflows that allow me to be more hands off.

After the macOS 13.3.1(a) Security Update is installed the sw_vers tool on the Mac will report the macOS BuildVersion is 22E772610a. Unfortunately the Operating System Build version shown in the computer record by Jamf Pro (at least versions prior to 10.46) will continue to show 22E261 which is the same as an unpatched 13.3.1 install. This means a Smart Group using the Operating System Build criteria can't be used to identify Macs that have the update. To determine the actual build version so you can create a working Smart Group requires creating an Extension Attribute to query the sw_vers tool directly:  #!/bin/sh # EA - Get macOS Build Version result=$(/usr/bin/sw_vers -buildVersion) echo "<result>$result</result>"   Once that EA is active you can use it as criteria in a Smart Group with the operator "is like" and the value "22E772610a" 

Bit of an annoying problem and was curious if anyone had an elegant method to crack it. Admin wants multiple sites to open by default when Safari is launched. It's easy enough to make a default homepage. I have a custom JSON schema in a config profile for that. I was wondering if anyone knew how to direct Safari to open a 2nd tab as well? I can't figure it out.

@mm2270 I seem to recall you building some great API scripts previously...hoping you can help me figure out what is wrong here...Im trying to run a script that calls the remove mdm profile button api and had found this... however its giving me an error when I run it even if I try in one line typing the variables directly in: #!/bin/bash ## account with computer create and read (JSS Objects), Send Computer Unmanage Command (JSS Actions) uname="$4" pwd="$5" if [ "$6" != "" ];then server="$6" else ## get current Jamf server server=$(defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url) fi ## ensure the server URL ends with a / strLen=$((${#server}-1)) lastChar="${server:$strLen:1}" if [ ! "$lastChar" = "/" ];then server="${server}/" fi ## get unique identifier for machine udid=$(system_profiler SPHardwareDataType | awk '/UUID/ { print $3; }') ## get c

Is there any way to adjust the web session timeout of Jamf Cloud without subscribing to Premium Cloud?

I've seen it asked a couple times before but it seems something has recently changed in macOS 10.14.2 I need to disable all external drive access R/RW. We've been doing it by preventing the kext from loading but users are reporting they suddenly have access again.I found this setting in config profiles. Anyone using this successfully?

How can I stop Composer from asking to install the helper application every time it is opened? I'm running 10.26.1.Even though I enter admin credentials, it never seems to be happy.Is anyone else seeing this or is it just me?

Can someone with more experience assist me in creating a package with Composer to install Velociraptor? Here is the information i was provided, the only thing i was given plus the client.config.yaml file.  Due to restrictions with Mac OS, a binary with a custom configuration file bundled is unable tobe compiled. For this reason, the install requires specifying a config file when launching theagent.The service install directive can be used to install the agent on Mac client. The followingcommand installs binary & config to /usr/local/sbin.• <velociraptor_file> --config client.config.yaml service installNote: The “client.config.yaml” file will be provided by Stroz Friedberg and included in the uploadportal.The service can be uninstalled with the following command:• /usr/local/sbin/velociraptor service remove --config=/usr/local/sbin/velociraptor.config.yaml• Confirm with ps -eaf | grep velo and sudo launchctl list | grep velo  I am assuming i need

Today we released Jamf Connect 2.23.0. This release includes the following changes and improvements: You can download all Jamf Connect logs from the past 30 minutes using the jamfconnect logs command in Terminal. For additional information about the command, use jamfconnect help logs.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Connect team

Hi all, I'm back again with another question on how to implement some settings from the CIS Benchmark. We are stuck on requiring an administrator password to access system-wide preferences. I've been doing some research on the issue and I've been hitting a dead end. I found the extremely helpful blog of rtrouton (https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/), but this doesn't seem to be working in Sierra. Does anyone know a good way to script this change? Thanks!

How can one remove an Extension Attribute that was created from a "Patch Management Extension Attribute" template?I do not see how in the official Jamf Pro admin guide instructions.Admin Guide Link - Creating a Computer Extension Attribute from a Template Creating a Computer Extension Attribute from a TemplateJamf Pro has built-in templates for many commonly used extension attributes.Log in to Jamf Pro.In the top-right corner of the page, click Settings Click Computer Management.In the ”Computer Management–Management Framework” section, click Extension Attributes Click New From Template.Click the extension attribute template you want to use.(Optional) Make changes to the settings as needed.Click Save    .

I’m the director of technology for my school. We are thinking about moving to Jamf School for our iPad MDM solution. We currently use VMware Workspace One. One of the features I love about our current MDM is that it has an app catalog on all the iPads Home Screen. When you go into it, it opens a webpage in safari that show all of the apps that are assigned to that specific iPad (or group). We’re able to quickly install or reinstall an app directly from the iPad.Does Jamf have a similar offering?

We control our iPads using JAmf, and I'm having an issue with the Diagnostic feature of i-Ready and MClass. MClass displays a white screen while trying to asses, and i-Ready displays a blue screen. I already whitelisted all the required websites.I did a system check using i-Ready and Mclass verification tools, and all seems ok. Any idea what the issue can be?  

Hey allwhat's the user impact when you switch from conditional access to device compliance?Will the user notice anything?does it work very different?thnx

Hi All, does anybody have a working XML for Palo Alto GlobalProtect on IOS? I can get the client installed but not configured at all. Palo support punted it saying it's not a supported MDM :(

I currently have policies and configs pointing to a static group.  I'd like to start using a smart group in place of it.   If I add all my devices to the new smart group and start pointing the policies and configs to it, will it redeploy everything?  I've added a few test devices to the new smart group (with criteria) and have not noticed any changes and do not get the prompt to push to only newly assigned devices, etc.  The logs also do not show any activity.   Just want to hear other peoples findings.   Thanks

Is there a way to enable reasonable security audit log retention via script to comply with CIS Level 1 requirements? Thank in advance

Hi everyone, I'm stumped.One of the higher ups at my work noticed a "your screen is being observed" message on their mac over the weekend and they're a little concerned.  I'm looking for clues.I used to be able to look for "screensharingd" in the system.log file and it would at least give me a time stamp and an IP address but that no longer seems to work (computer is on Ventura).Does anyone know where the logs for this have moved to?Thanks in advance.  Please feel free to let me know if you have any questions or anything.

All my apps are failed whenever I try to install from Self Services. When I run sudo jamf policy it just said "There was an error. Message has no content". Does any one have any idea? 

Hi, I would like to know which devices does not have a specific application for example keynote. Are there any ways to run a search and export the report using JAMF School?Thank you

Hello,  I was under the assumption that Config Profiles in Jamf Pro would prevent even admin from changing the configuration defined. However, that doesn't seem to be a given. For example I have enabled the Firewall using the native settings under Security and Privacy in Jamf Pro config Profiles. However, Sudo user are still able to disable the firewall in the terminal for example using sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1 Is it possible to completely block an admin from changing a specific subset of settings using jamf pro. Without removing admin rights all together.

Hello All,Apologies if this is the wrong audience. I am still fairly new to JAMF (and device management overall tbh).  Both Jamf Pro and Intune have the concepts of Extension Attributes (EA) however, from my limited experience i don't believe Intune can validate the status of EAs in the Intune Compliance Policies. Is my assessment true or does anyone know of a way for Intune to validate an EA allowing the admins to broaden the set of criteria included in the Compliance Policies. 

We are fitting a new Media room out with 20 Mac M2 pro mac mini units and everything is working fine apart from our power schedule. We have a config profile rolling a power off at 10:15pm and power on at 07:30am. It looks like the power off is working fine but is not powering on at the scheduled time.We have a new room (installed last month) of the M1 iMac's on the same version of Ventura (latest) and these power on and off fine.I have checked on the local Mac Mini with the pmset and the schedule is correct, is their anything I can check, assuming is not Ventura related as its working on M1 iMac's fine.Any ideas or help would be greatly appreciated. Cheers David

For new devices and troubleshooting older devices with an OS reinstall, we use the "enrollment" trigger for many of our Mac policies. We have been avoiding creating separate Intel and M1 packages for apps as much as possible. Rosetta has been capable of running all our Intel-based packages on M1s so it hasn't been an issue but I don't want to rely on Rosetta indefinitely. I would like to be able to install either the Intel or M1 versions of apps on enrollment. Is there any JAMF Pro setting I'm missing for the enrollment trigger being able to install the appropriate architecture/processor based package?Looking at alternative solutions: Eventually, our fleet wont have any Intel Macs but until then we still push a pool of default apps to our fleet and use Self Service to make non-essential/optional apps available. Without the enrollment trigger we have relied on having to flush once per computer policies for OS reinstalls or making policies set to "ongoing" at startup with smart groups to

We have begun using Twocanoes Xcreds, replacing NoMAD Login AD. In the process, we are also attempting to discontinue implementing a common local administrator account with a known password. This type of setup was demonstrated in a session at JNUC this year (although their example used Jamf Pro and Jamf Connect, not Jamf Pro and Xcreds... the principles should be the same though.)However, despite repeated attempts, I cannot reliably get the bootstrap token to escrow automatically at first interactive login, as I'm led to understand is supposed to happen. I can manually log in as a user on the system, then open Terminal, su to the Jamf Pro-created admin account, and initiate a sudo profiles install -type bootstraptoken, and it escrows without incident.I have to imagine it's SOME combination of settings that I don't have configured properly, but I don't know what.I currently have:In "User-Initiated Enrollment:""Username" is set to <admin user name>"Password" is set to <admin pas