Hey Jamf people! We are having a weird issue with our GlobalProtect certificate deployments.  We have deployed the certificate to our endpoints 10 days prior to expiration to make sure we don't have any expirations (leads to p0 outages).  This time is weird though, as we can see successful config profile (containing the new cert) deployments to endpoints, but on their machines, they retain the cert that is expiring soon.  Whats even weirder, is that it does not happen to all people we deployed the certificate to.  Has anyone ever seen this issue?Lukas

New Jamf Tech here!I am currently looking for a way to streamline our Summer refresh and deployments. Our acting Jamf admin is great, but stays busy with several things, so I really want to try to make things better for our students and also just teach myself something.The short version: We use a 1-1 model that functions on a rotation using stock out of a warehouse. It's fine, but we face a lot of bottlenecks that slow down the process when thousands of devices need to be deployed or refreshed. Seeing as how I am new to all this, I may get confusing, so I apologize!!Overall, I want our devices to be able to fall into any students hands at any grade level 95% configured then finish with a short checkout/single sign in process. After it's set up, it's used the entire school year or until it is ready to be wiped. I have heard that Jamf Reset & Setup in education works well and I think that could work towards my goal, but I also saw a session at JNUC where they spoke of using

Below is a screenshot of the Jamf School Profile/Settings interface.I am confused about how to do this overall. Is the idea that you basically create holistic settings that are all encompassing for a type of device, and you put all of the things and stuff in one, and only apply "one per device" or is the idea to be granular and only for example configure the WiFi, Certificates, DNS Proxy if needed, and that's it.If the idea is to be more modular, is there any type of guide that covers which policies can conflict in which case it's a race condition to determine which profile is applied if there are conflicting settings that would prevent the other profile from applying?If I had to guess it should kinda look like this.Modular profile 1 - Connectivity related settings only. So WiFi, Certs, and anything needed to get your content filter to work on the device. Beyond that, I don't know. How should these things be chunked up, or should it be that beyond the connectivity profile, that it

is there a possible setting that erases all stored data on a supervised ipad after a certain time period of lets say, two weeks?I'm talking about clearing the photos, documents, files folders as well as app-specific folders like pages or keynote, or even third party apps.I don't know if Apple itself even has a function like that integrated, but maybe the jamf function may even overwrite that?Thank in advance already for your suggestions!Max

Good day JamF Nation.Hoping someone can provide some insight.i have a site that I manage and we use authchanger to either disable JamF connect or enable.1 of the policies is set to reset the mac to default login and the other is to enable jamfconnect. This works on all devices, except 1. The policies run without error, but the policy isnt applying to the device.Make:AppleModel:iMac Intel (21.5-inch, Mid 2017)Model Identifier:iMac18,1OS:12.6Id appreciate some direction here as i am not able to identify why it isnt applying to the device

We are a Jamf Shop and Jamf (currently until our instance is updated to 10.43.1) does not have a native mechanism for managing com.apple.servicemanagement. Jamf deploys their own com.apple.servicemanagement payload to manage the Jamf apps however since the ability to manage Login Items was added to MDM we have been using a separate payload to manage our 3rd party login items.This has been working fine until macOS 13.2. Now we are seeing very inconsistent behavior where our managed login items are no longer managed. When I look at the deployment guide it seems like com.apple.servicemanagement allows multiple payloads. e.g. "Duplicates allowed: True—more than one Managed Login Items (com.apple.servicemanagement, com.apple.loginitems.managed) payload can be delivered to a user." Up to macOS 13.2 the behavior was that multiple com.apple.servicemanagement payloads were respected. https://support.apple.com/guide/deployment/managed-login-items-payload-settings-dep07b92494/1/web/1.0 I rolled b

Can we integrate RSA with Mac for login screen authentication when Jamf Connect is also already deployed?

Hey Folks,Curious if anyone has found a way to automate emails to users based on a Smart Group membership?   Examples of things we’d like to notify users of:Your internal storage is at XX% of capacity, here’s what you can do about itYour laptop hasn’t checked in to Jamf in XX days, please turn it onYour computer hasn’t rebooted in XX days, please reboot Right now, admins are getting emails from Jamf based on criteria we prioritize (eg: ‘storage almost full’), or manually checking Smart Groups once a month, and emailing the users directly.I know you can email group members via VIEW -> ACTION -> SEND EMAIL, but that’s a manual process, and we’d rather automate it. ## I found versions of this feature request on JN, and confirmed with Jamf that it's not currently part of the product in 2023.2016 post: https://community.jamf.com/t5/jamf-pro/alert-system-user-on-smart-group-change/m-p/1416392013 post: https://community.jamf.com/t5/jamf-pro/automated-emails/m-p/10530

Hi,I'm trying to get Jamf connect working with Google. We can connect and update the local password using the toolbar application, however when logging out of the device it will load a Google sign in window and when signing in to this it produces an error "Configuration is nil or invalid". Any ideas as to what I'm missing? Thanks

Has anyone been able to make a Code42 CrashPlan installer in Composer?  I'm trying to do that for version 10.2.0 of Code42 and it fails.  I notice that there are some Code42-related files that change after the installation is done, so I'm thinking that Composer might not be making an accurate "after" snapshot.  I can give more details if someone wants.  I'm  just wondering if there is anyone who has gotten this to work, and, if so, what they did to get it to work.  Thanks.  --Jeff 

We were testing our Apple Business Manager and Apple Configurator 2 enrollment.  We have a few MacBooks that were not added to ABM when they were purchased and need to be added via iPhone Apple Configurator2.  I was able to add the macbook into ABM but now when it gets to the Remote Management screen it gives an error stating  "Enrolling with management server failed. unable to connect to the MDM server for your organization. "Usually when we enroll a new mac and is on ABM this section has no issues connecting.  PreStage enrollment seems to be setup properly and never had an issue.  Is there a difference for the remote enrollment when the device was enrolled into ABM using Apple Configurator2?  Is this something to check on Jamf Pro or on ABM side?

We are excited to announce the launch of the Jamf Learning Hub, a one-stop-shop for all of our product technical content. This new resource provides a self-directed user experience, so you can access relevant technical product content at the right time and in the appropriate format, meeting you where you are at in your learning journey.   The Jamf Learning Hub includes a wide range of content, from “Getting Started” guides to advanced technical articles and training videos. Whether you're new to our products or a seasoned pro, you'll find something of value in the Jamf Learning Hub. This platform will replace docs.jamf.com to provide a unified and intuitive experience for searching and accessing all of our published technical product content, helping you be even more successful with Jamf. The Jamf Learning Hub provides: A single access point for product documentation and training content Improved search capabilities, making it easy to find what you need by providing the most rele

Hello,I am very new to JAMF and have an issue with Installomator, I am trying to use it to install several apps. I have created smart groups for each app one that will see if the package is up to date or not installed and another for the members of that group so I can use it in the policy.In the policy I have it set to deploy the app name that I found from the github package list, every app that I try to install this way fails and gives me an exit code 4 error;2023-01-27 06:26:32 : REQ : adobereaderdc : ################## End Installomator, exit code 4 Error running script: return code was 4.I am not sure what is causing this error for the packages I am trying to deploy, any help would be appreciated!?Thank you

Hello, I'm IT manager in a school with 1000 ipads.Many students inadvertently click on the "download all" button. It often saturates the ipad.It would be great if the button could be disabled in Jamf School.Thx.

Any youtube channels or website where I can practice and learn scripting or get practice scripts to run and see how they work. Thanks

Hello, We have an older version of Sophos in our install package which will not install for any device running M1 or M2 chipsets.  This has been patched by Sophos but I need to get our current Sophos installer updated.  After some research I determined this will be a two step process.  One step is targeting the 27 enrolled devices are are missing Sophos through a configuration profile and a Static Computer Group.  And the second portion is updating the install .pkg.  When I follow the directions from Sophos it says click the 'Filename' file that is a .pkg file and upload, and then do the same with a Manifest File.  After downloading the macOS Sophos installer it is 3 file folders and the only .pkg file in any of these folders or sub-folders is a file called InfoPkg.Pkg.  Am I supposed to just rename this to something like "SophosInstall.pkg" and upload as Filename?!  And should the manifest file be a .plist extension?  

I'm new to this so I'm sure I making mistakes. We recently setup Jamf and Jamf connect. Now users can log into their Mac using their AD credentials. When a user is added to Jamf our installer set Jamf up to convert that users from a mobile user to a standard user. The problem is that as a standard user if you open terminal and use the id command it will only report back local groups not AD groups. The users access to certain network shares is based off of AD groups. If I force the user to stay as a remote user then all their groups are retained. However if the remote user changes their password it does not automatically sync. I feel like I'm missing something basic. I would like users to be able to login with the AD credentials and have all their AD groups and be able to change their passwords and have it sync. If anyone can point me in the right direction I would appreciate it. 

Best Practice to implement Policies, which options are best from the following :We are planning to deploy  standard policies & profiles required for device after enrollment in JAMF PROIs it best to use Recurring check-in + Once per computer for most of the policies?As Startup, Network Change & logout are more inconsistent as we have to depend on user when he will act on it  

Hey,I want to collect the information from our Mac Clients, if the automated software update check is enabled. The BASH Script for this action works locally on my Mac and I get the correct information when used in Jamf Pro as an EA. But all other Mac clients do not report anything back ... the Software Update is managed by a configuration profile, any ideas? Thank you! #!/bin/bash ########################################### # Check Status of AutomaticCheckEnabled # ########################################### AutomaticCheckEnabled=`/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled` LastDateCheck=`/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate LastSuccessfulDate` if [ $AutomaticCheckEnabled -eq 1 ]; then result="Yes" elif [ $AutomaticCheckEnabled -eq 0 ]; then result="No" else result="Unknown" fi echo "<result>$result - $LastDateCheck</result>"  

Hi all, I'd like to uncheck OTP for users (app: Yuibkey Manager) for users.  Otherwise, once touched, OTP will generate random numbers and bother users. Here is an ex: cccccbctnbhgchgnnrnhhlibtknenrceddfgjfndfifvGuide: https://support.yubico.com/hc/en-us/articles/360013714379-Accidentally-Triggering-OTP-Codes-with-Your-Nano-YubiKeyissue:  Any idea how to make it happen ?Thanks, 

We have a question!We have for example 10 classes 5a,6a,7a, etc. with every same 71 teachers and diffrent 28 student per class and one teacher Group names NE16514teacher (see screenshot). All 71 teacher are Member of Group „NE16514teacher“ and Managable Groups 5a,6a,7a, etc. for Jamf School Teacher & Classroom App.So, if we put under a Member Group "NE16514teacher" teacher to catgegory „Teacher“, we could’t see all classes in the classroom app but only under Jamf Teacher. But if we move the Teacher from category „Teacher“ to „Students“ (see Screenshot), than it works and we can see all classes in the Jamf Teacher App and in the classroom App.Why is it so?FYI: In the screenshot you see the teacher Simon with "owner device: 0"please ignore that. We tested with the teacher and "owner device: 1" with the issue.

I am putting this out there because JAMF support has washed their hands in assisting us. We integrated JAMF Connect with Azure AD recently and are currently testing. The issue we are having is that Azure, and our MFA setup in Conditional Access, is requiring users to log in at EVERY restart. It also is requiring password verification after authenticating. As you might imagine, this would cause some inconvenience to macOS users, especially if their means of MFA authentication was not at hand: phone, Microsoft Authenticator app (iphone or ipad) or other means. MFA does not work this way for anything else requiring it. It is only required once per app, per device, until there is a password change. Support suggestion was to exempt macOS from requiring MFA, essentially. This did not go over well with our Sys Admin who is heading the rollout of our MFA requirement. This is a real frustration as JAMF Connect was touted as a solution for AD authentication, ability to provide zero-touch d

Hoping to get some assistance from the knowledge of the JAMF Nation. I am struggling to remove an individual configuration profile, that was installed manually, via the command line. Testing on Mavericks 10.9.1 currently. Used the profiles man page and this: https://developer.apple.com/library/mac/documentation/darwin/Reference/ManPages/man1/profiles.1.html Commands I've tried: sudo profiles -R -F /tmp/profilename.mobileconfig sudo profiles -R -p profileidentifier sudo profiles -R -p profileidentifier -U username No dice so far. Use case is that a profile is installed manually and it needs to be removed without removing all profiles. Any thoughts out there? Thanks!Ben

I have a goal this quarter to deploy Jamf Connect. Things are looking great and working. However, I have one big questions that I'm just not sure about.If we don't use the menu bar (which we don't because we're not on the right Google Workspace edition, and therefore it cannot be configured). Will the local password still sync with the Google Password if it's changed? I'm testing this and while I can log in with my new Google Password, I'm then prompted for the old local password, I thought maybe it would update, but so far, it still asks to verify with the old password.Does it eventually reconcile so the local password is updated to be the new Google Password or is this what the menu bar is for? 

Has anybody created a presentation for their staff that explains WHY you're moving to Jamf? We're a non-profit org of 200 staff members who are mostly remote working and are moving to mobile device management. I don't want to reinvent the wheel if somebody has already created a presentation that explains why the move to Jamf and the benefits of an MDM. Many thanks!