Hi folks.I try hard to get VPN On Demand to work. Unfortunately, it currently does not work with Jamf Pro's built-in way (PI-101098), so Jamf Support referred me to iMazing Profile editor. Getting bits and pieces from various web resources together, I tried to built a working VPNOnDemand.mobileconfig by myself, but as soon as I deploy it to my client, it does not have any affect.The VPN on Demand configuration should basically do the following:1.) If client connected to a certain company WiFi network ("SomeWifiNetwork" in the example), it should generally NOT use VPN at all.2.) If NOT connected to the WiFi network above, but any other network, it should ALWAYS establish a VPN connection while trying to connect to certain domains (example1.com and example2.com in the example).3.) Trying to connect to VPN server via L2TP ("1.2.3.4" in the example), shared secret included ("SHAREDSECRET" in example), user name and password should be prompted (hence not included in example).When I deploy i

If you have multiple virtual MDM's in apple school manager linked to different sites in Jamf, you assign a device to one of the MDM's in ASM and you have the setting Automatically assign new devices that is in the assigned MDM/Site's PreStage will it only assign devices linked to that MDM/Site in ASM? I.E. does the PreStage setting "Automatically assign new devices" work when you have more than one MDM in Apple School Manager?

Hello , I want to deploy Zscaler app using self service , but when standard user want to install it , need to type admin password for modify system keychain. Do you know some way how to solve this? or add more admin privileges to this app?Thank for help 

I'm pondering the idea of leveraging a Extension Attribute that could theorietically report/verify the existence of a specific root CA certificate in the OS X System Keychain. Based on the results it yields, I could add/delete certificate(s) as needed via scripts/policies, etc. Has anyone invented this wheel yet?

Is there a way to remove the news previews from the Today View widgets? There are inappropriate news articles that show up for students and parents are wanting this blocked. I have the widgets blocked but it doesn't remove them from that view.

Hi, I know some of you are using Installomator to update third party software and since I need to clear some time I decided to give it a go on a small part of our Macs. They are more or less all the same under ventura. Works great on most of our macs, but for some reason, it does not work on several of them, the logs is giving the same error : firefoxesrpkg : ERROR : Error veryfying Firefox.pkg error : Firefox.pkg: rejectedsource =no usable signature.  Any recommendations ?

Hi all,We are using Jamf Pro server on-prem in a network environment disconnected from the Internet.Jamf Pro servers and devices are communicating with Apple through a proxy.In this case, is there a way to use the ABM device as an ADE without the intervention of the administrator?Please, help me. 

We have a fleet of mac and we're trying to prevent users from automatically upgrading their macs to macOS Ventura or any other new macOS that Apple releases. This prevents us from users accidentally breaking their software which do not work with the latest macOS. Is there a way to do this in Jamf?  Thanks, 

Is there a way to access the Control Pannel while in Single App Mode for Jamf Pro. I would like the ability for the users to be able to change the brightness, as well as lock the rotation of the screen when needed. Please advise. 

I've started playing around with the Microsoft Enterprise SSO plugin to compliment Jamf Connect.  For end users, this seems like an easy no brainer setup.  The problem comes with our IT tiered accounts setup.  In our environment, standard users have a mundane account while IT tends to have a Tier 2 account, server admins have a Tier 1, etc.  This was done for various security reasons, and generally works well for us.This setup does not play nicely with the Microsoft Enterprise SSO though.  For example, in my testing I effectively get locked out of Jamf because the Microsoft SSO auto applies the mundane account and Jamf doesn't have a built in account switcher I could use to swap to the appropriate tiered account.Does anyone have any recommendations on how to handle this edge case?  The vast majority of our users won't have these tiered accounts, but those that do will be pretty vocal about things not working.  I don't see a way to exclude specific sit

On occasion we have Macs repaired that require a motherboard swap. If we don't remove them from Jamf before the repair, then when we get them back it enrolls as a completely different computer that just so happens to have the same serial number. We are using a script to rename all computers to their serial numbers. This means that after repairs we will have 2 entries for basically the same computer. What I'm doing now is I will export the list of all computers and use Excel's conditional formatting to find duplicates for me. Then I locate the duplicates in Jamf and delete what is the old computer record and keep the new computer record. Is there a way to use a smart group to put together Macs that have the same name? Sure, I could build a smart group to look for all computers named "C02XXXXXXX" but that would require that I already know which ones I'm looking for. If I had a small number of computers then I could skim the list manually and pick out the duplicates, but with over 1300 Ma

Hi All, I am fairly new to scripting and am humbly requesting help.  We use the following script to rename the Computer Name to Asset Name(via what is uploaded in Inventory Preload).  What I found, is I also need this script to enable Dynamic Host Name and set that name to that same Asset Name.  I cannot get that last piece to work and believe it was incorrect, so I have removed it and asking the community. Here is the script I am using to set Computer Name to Asset, which has been working great.  I am hoping to be able to use this same script and add the piece to enable naming of the Dynamic Host name as well.  #!/bin/bash#set the variables for the server and API accountjssUser=UserNamejssPass=PWjssHost=https://tenantname.jamfcloud.com#get the serial numberserialNumber="$(ioreg -l | grep IOPlatformSerialNumber | sed -e 's/.*\\"\\(.*\\)\\"/\\1/')"#get the asset tag from jamfassetTag=$(/usr/bin/curl -H "Accept: text/xml" -sfku "${jssUser}:${j

I am creating a Jamf Pro User group for our Help Desk, and I want them to have the ability to use some or all of the Management Commands available. Which privileges do I assign to the group? Right now all they have is Send Blank Push.. 

Does anyone has some working screensavers script that can be working on ventura. So in the script a folder is defined, that should make slideshowI used this one below, but it seems not anymore to work  #!/bin/zsh # Get user logged into console and put into variable "user" user=`ls -l /dev/console | cut -d " " -f 4` export SYSTEM_VERSION_COMPAT=1 osMajor=$(sw_vers -productVersion | awk -F"." '{print $2}') osMinor=$(sw_vers -productVersion | awk -F"." '{print $3}') sudo -u $user defaults -currentHost write com.apple.screensaver CleanExit -string "YES" sudo -u $user defaults -currentHost write com.apple.screensaver PrefsVersion -int 100 sudo -u $user defaults -currentHost write com.apple.screensaver showClock -string "NO" sudo -u $user defaults -currentHost write com.apple.screensaver idleTime -int 700 if [[ $osMajor -eq 14 && $osMinor -ge 2 ]] || [[ $osMajor -ge 15 ]] ; then sudo -u $user defaults -currentHost write com.apple.screensaver moduleDict -dict m

Hi all,We have our Macs AD bound with mobile accounts, and starting with Big Sur we've had several users run into an issue when trying to use sudo in a terminal window. They'll get the error that they're not in the sudoers file. Normally they'll be standard users using Privileges and it will work, but for some, sudo has stopped working altogether.We've tried converting the mobile accounts to local accounts but this didn't solve the issue either. Has anyone run into similar issues?

My boss asked, "How much data do our users save on their Macs?"Anyone know how I can figure this out? I manage around 800 Macs with Jamf Pro and they don't all have the same size of internal drive, so looking at something like "boot drive percentage full" or "boot drive available MB" isn't too helpful.Thanks,  --Jeff

We are working on a Secure Token policy and have traced the issue to the Parameter Labels not resolving. Here is the script we made to test it: #!/bin/sh ## Pass the credentials for an admin account that is authorized with FileVault 2 adminName=$4 adminPass=$5 userName=$3 ## Prompt for Password userPass=$(/usr/bin/osascript<<END application "System Events" activate set the answer to text returned of (display dialog "IT needs to Activate Encryption, Please Enter your Password:" default answer "" with hidden answer buttons {"Continue"} default button 1) END ) # create the plist file: echo '<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Username</key> <string>'$adminName'</string> <key>Password</key> <string>'$adminPass'</string> <key>AdditionalUsers</key&g

Hi,We need a way to stop dummy eicar malware files being downloaded from online in Chrome, Edge and Safari.It looks like Jamf Protect or Jamf Radar can not do this. It can only stop the files being executed after they have been downloaded to the Macbook. Is there a way we can implement download restrictions using Jamf Pro?thanks 

Hey, we use Jamf School. How does everybody keep Google Chrome updated. What is the best way to push Google Chrome? I had the chrome enterprise downloaded. I uploaded it to Jamf School and pushed it as an in-house app. On new Macs, it downloads whatever version of chrome was available at the time I downloaded the pkg. Normally, Google Chrome then updates on the Macs. Today I pushed it to a Mac, and it could not update it took me to the webpage to re download chrome. I don't know if this is a common thing. To fix it, I downloaded the latest version of the and pushed that in Jamf School. Only issue.... for teachers that already have the old Google Chrome, it breaks chrome. Basically it installs the new, but does not tell the teachers to restart chrome. All they see is that Chrome is not working, and there is no notification to restart Google Chrome which fixed the issue.

i have a configuration profile that i distributed to "all computers". i have since made one of them unmanaged but its still listed as pending. any way to clear that?

I have been asked to implement Jamf to manage the local Firewall - security would like the Firewall to be enabled, user restricted from making changes, and block all incoming connections ASIDE from built in Apple or signed software. I can do this locally by just making sure the right buttons are selected, but when managing this through Jamf there is no way to allow built in Apple software. These services would include AirDrop, AirPlay and hand off from iOS devices to macOS. Jamf has two options: block ALL incoming connections (which prevents AirPlay etc) and "Control incoming connections for specific apps". The second option allows the user to select whether to allow or deny an incoming connection - and the message doesn't convey that the connection they are allowing is actually related to AirPlay, so I foresee a lot of tickets as a result.I've done googling for this and it looks like this used to be able to be fixed with scripting, but that isn't an option since Monterey dropped. How

Hello all - tried my hand at Applescript but failed. Tried to find some way to do this in Jamf but I don't think it can, not familiar enough with the guts of Apple bits and bobs to draw on any huge knowledge (though half ok in Linux) so pitching this to the community. All I want to do is add, either in Finder or by some method or another (putting an icon somewhere on the thing,) a SMB share (from a Windows server) onto my student ipads. They need to be able to browse to some files for an app (Clicker) to work. I cannot for the life of me fathom out how to do this. I've set up a separate AD account for authentication but really stumped. It surely can't be hard to do, can it? If anyone's passing and has done this I'd really love to get it working. Thanks all!

Hello,I need help about something :- we filtered the content of our iPads via Jamf content filter "Built in : limit adult content"- we add a few blacklisted url. on the iPad it's now impossible to delete safari browsing history. It's grey in safari and in Settings. I try to exclude an iPad from the group (content filter), now i can delete safari history again. Have you a solution to allow to delete browser history and keep "content filter".

Users whose name contains an apostrophe/single quote (ASCII code 39) are presented as @#039 instead of '.This is the case in their user profile and also in their device profile (which uses the user's name in the iPad).Users are imported from LDAP. 

Hello, I am looking to create a Jamf Extension Attribute to create a username that matches a users LDAP info $FULLNAME and turn it into `firstnamelastname` or `firstname-lastname` and then use the Jamf Variable $EXTENSIONATTRIBUTE_# on the Account Name within Prestage Enrollments Account Setup.$FULLNAME/REALNAME don't work as it creates a space between the names and this creates issues when attempting to call username in scripts as it will only see the `Last` name of the user. $USERNAME does not work as this is an email address from our LDAP and the @ symbol is also an illegal character causing the same issue.Unfortunately I have no idea where to begin other than knowing to use <result> with in the custom attributes, very new to scripting and I am the only Jamf Admin at this small company. Does anyone know how to accomplish this automatic Account Setup?