A Jamf Pro Computer Extension Attribute which returns enterprise-domain Apple IDsBackgroundLike most organizations, we want the best — most secure — experience for our users. So, naturally, we’ve investigated leveraging Managed Apple IDs.While Managed Apple IDs come with some fairly signification limitations, my personal favorite has to be:Allows browsing but not purchasing, paid or free in: App StoreHowever, the promise of a Shared iPad is quite alluring.The RubI also suspect “the rub” for most organizations who wish to federate their domain is Apple’s unwillingness to inform the enterprise which of their users will be impacted before federation is enabled:… but you can’t see their actual personal Apple ID.Continue reading …

Jamf Composer was used to build a simple packagepackage deposits an .app into /Applications. Tested and verified it works locallyUsed Jamf Composer and a Apple issued cert to sign the pkgUsed the IntuneWrapper to create an .intunemac file for IntuneFile was accepted by Intune and policy successfully createdErrors when trying to deploy.I’ve since been able to successfully build, sign, wrap and deploy using terminal however I would like to figure out what went wrong with the Composer build as I see the need for much more complicated packages in the future.Because I removed the policy that was failing and rebuilt a successful one I no longer have the error code Intune spit back for this post. There was no useful error message, just the error code close to, but not exactly, 0x87D13BA2. I stress this was not the exact error code as I was unable to find the exact code ANYWHERE, not even from Microsoft documentation of error codes.I post this hoping someone has run into this issue before and

We are trying to deploy the Forescout connector on a Mac machine through a Jamf policy, which requires us to deploy a .pkg file, a script, and most importantly, the folder containing the Forescout agent on the desktop. This folder includes the launch daemon and a few other commands. However, we are encountering errors and are not able to successfully deploy the folder. Can you advise us on how to proceed?

Hi there. I read somewhere that  GitHub Santa  can be integrated with Jamf Pro. If this is indeed true, can someone point me in the right direction to get started? And yes, I see the documentation included with the app, but was asking for more Jamf specific instructions as I am fairly new to MacOS Jamf configs. Thanks.

Hey JAMF-er's. This is probably an easy one but I'm still not super versed in scripting. I've cobbled together an script that Makes calls the Classic API to get the position, building, and asset tag information from a computer record. Here are the lines I am using to accomplish this:position=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/position/text()")location=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/building/text()")asset=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/general/asset_tag/text()")It all works as intended, but s there a way to combine these lines so it's not authenticating to the server 3 times to

Hello Jamf Nation! We recently released Jamf Protect 4.1.0. This release includes the following changes and improvements: Telemetry enhancements for collecting performance metrics, BIOS/EFI data, and diagnostic/crash files. These enhancements aid in meeting compliance requirements and improve incident response and IT troubleshooting workflows. A new diagnostics command for the Protect command line tool (Protectctl). Updates to existing Insights and the addition of two new insights to verify device compliance: 2.3.1.2 Ensure AirPlay Receiver Is Disabled and 2.6.1.2 Ensure Location Services is in the Menu Bar. Improvements to file quarantine and scanning functions to resolve a known conflict with some third-party security tools. Product Documentation  For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Protect team

We use AD in our enviornment, but we have many local users with admin rights. Now that our use of Casper has become more robust. We want to take the local admin users and turn them into standard users. Any suggestions as to the best way to do this?

Does anyone know if there's a way with Jamf to capture, or view, who enrolled a device via the user initiated web portal (https:jamfserver.com/enroll)? My Jamf instance has SSO enabled, so manually enrolling a device requires a company login, so I'd love to be able to view what user initiated an enrollment of a device. If I look at Jamf's change management log, that info doesn't seem to be captured -  only the name of device, the device ID, and the site it was enrolled in are captured there. I also briefly looked at the Jamf Pro server logs and a machine enrolled ~90 minutes ago doesn't show up in the logs by name, serial, or ID#. There isn't anything in the computer record in Jamf, that I can see, that stores this info either - the MDM Capable User is just the first user account created on the machine, not necessarily the person who enrolled it; and when enrolling devices a person can assign the machine to an alterative user, so the user set in Jamf isn't necessarily wh

This policy trigger is already being run: root 731 0.0 0.1 660664 10948 ?? Ss 8:25PM 0:00.42 /usr/sbin/jamf policy -randomDelaySeconds 300 I saw a policy fail for user based over seas, so I remoted into her computer, flushed the log for that policy and manually triggered sudo jamf policy ... but keep getting the above error, what does that indicate?

hi. i found a way to show device-names on the lock-screen, but way too small. Is it also possible to add the device-name to the wallpaper - without individual wallpapers for each device. zuludesk has implemented that feature. you can define a payload within the screen-layout section. maybe i didn´t find that feature yet, so please, help me. Thx in advance,Roland

Is there a way in Jamf Pro to block the widgets that iOS 15 insists on putting on the home screen with a newly setup iPad?  I've got everything else blocked that I want from the home screen of our student iPads but I cannot figure out for the life of me how to block those default widgets with iOS 15.

Is it possible to make a bulk update to uncheck Allow Jamf Pro to perform management tasks? I'm now trying to utilize MUT V6 for the computer names, but I'm wondering whether Mut can assist or if there is something else I can use.

When attempting to run software update on M1 macs currently at 13.0 or above, the admin password is not accepted.End users do not have admin rights on our machines.  The same admin account is on every mac, both Intel and Silicon.  The admin password works all around except for updating Ventura.Currently, we have machines on 13.0, 13.1, and 13.2.  When end users run the 13.2.1 update from Software Update they are prompted for admin credentials.  If I enter the local admin password it shakes like it is incorrect even though the same password works for other things that need elevation.  This only happens on the Silicon macs.I have read other threads talking about erase install script for updating from Monterey to Ventura but we have no issues with that process.  We only have issues for machines already running Ventura and needing to do a supplemental update like 13.2 or 13.2.1.Can anyone provide some insight?

Trying to deploy the Safe Exam Browser on our student MacBook Airs and I am having some issues getting the configuration to stay. I was originally creating the package(.pkg) using Composer, but when the students download the package from Self Service the settings are reverted back to the defaults. When I created it as a DMG and check the boxes to Fill user templates and existing home directories the settings come down as they should, but the end user is being prompted for a keychain password. However, it is not wanting the keychain password of the currently logged in user. It wants the keychain password of the user account I was logged in with when the package was created. Has anyone recently deployed the Safe Exam browser successfully? The only post I can find is where someone says they have done it, but they don't outline how they were able to do this. In theory I could use the pkg that I first created and then use a script to copy the .seb configuration file the machines,

Hello,As a part of the security compliance, we have all our JAMF enrolled Mac devices enabled with FileVault encryption. However, it is noticed on MacOS Ventura that with FileVault encryption enabled we are unable to login with any secondary or mobile account.The login is only working fine with the primary account login.As a workaround we can disable FileVault encryption by adding the systems into the exclusion list, but that can be a threat to the devices. Can anyone please help with any suggestion on this? Does the FileVault encryption policy require any extra payloads pre/post-defined? Thanks in advance.

Hi All, I'm in the process of moving from JAMF Now to Pro. Currently have around 100 computers on JAMF Now and their FileVault key are store in the JAMF NOW Cloud. How can I migrate those recovery keys to Jamf Pro using profiles/policy script. I know that i could go on the host computer. Switch off filevault. Remove computer on JAMF Now. Enroll into JAMF Pro and use a policy/script to escrow key to JAMF Pro cloud. But thats very involved. Is there any other workflows that allow me to be more hands off.

After the macOS 13.3.1(a) Security Update is installed the sw_vers tool on the Mac will report the macOS BuildVersion is 22E772610a. Unfortunately the Operating System Build version shown in the computer record by Jamf Pro (at least versions prior to 10.46) will continue to show 22E261 which is the same as an unpatched 13.3.1 install. This means a Smart Group using the Operating System Build criteria can't be used to identify Macs that have the update. To determine the actual build version so you can create a working Smart Group requires creating an Extension Attribute to query the sw_vers tool directly:  #!/bin/sh # EA - Get macOS Build Version result=$(/usr/bin/sw_vers -buildVersion) echo "<result>$result</result>"   Once that EA is active you can use it as criteria in a Smart Group with the operator "is like" and the value "22E772610a" 

Bit of an annoying problem and was curious if anyone had an elegant method to crack it. Admin wants multiple sites to open by default when Safari is launched. It's easy enough to make a default homepage. I have a custom JSON schema in a config profile for that. I was wondering if anyone knew how to direct Safari to open a 2nd tab as well? I can't figure it out.

@mm2270 I seem to recall you building some great API scripts previously...hoping you can help me figure out what is wrong here...Im trying to run a script that calls the remove mdm profile button api and had found this... however its giving me an error when I run it even if I try in one line typing the variables directly in: #!/bin/bash ## account with computer create and read (JSS Objects), Send Computer Unmanage Command (JSS Actions) uname="$4" pwd="$5" if [ "$6" != "" ];then server="$6" else ## get current Jamf server server=$(defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url) fi ## ensure the server URL ends with a / strLen=$((${#server}-1)) lastChar="${server:$strLen:1}" if [ ! "$lastChar" = "/" ];then server="${server}/" fi ## get unique identifier for machine udid=$(system_profiler SPHardwareDataType | awk '/UUID/ { print $3; }') ## get c

Is there any way to adjust the web session timeout of Jamf Cloud without subscribing to Premium Cloud?

I've seen it asked a couple times before but it seems something has recently changed in macOS 10.14.2 I need to disable all external drive access R/RW. We've been doing it by preventing the kext from loading but users are reporting they suddenly have access again.I found this setting in config profiles. Anyone using this successfully?

How can I stop Composer from asking to install the helper application every time it is opened? I'm running 10.26.1.Even though I enter admin credentials, it never seems to be happy.Is anyone else seeing this or is it just me?

Can someone with more experience assist me in creating a package with Composer to install Velociraptor? Here is the information i was provided, the only thing i was given plus the client.config.yaml file.  Due to restrictions with Mac OS, a binary with a custom configuration file bundled is unable tobe compiled. For this reason, the install requires specifying a config file when launching theagent.The service install directive can be used to install the agent on Mac client. The followingcommand installs binary & config to /usr/local/sbin.• <velociraptor_file> --config client.config.yaml service installNote: The “client.config.yaml” file will be provided by Stroz Friedberg and included in the uploadportal.The service can be uninstalled with the following command:• /usr/local/sbin/velociraptor service remove --config=/usr/local/sbin/velociraptor.config.yaml• Confirm with ps -eaf | grep velo and sudo launchctl list | grep velo  I am assuming i need

Today we released Jamf Connect 2.23.0. This release includes the following changes and improvements: You can download all Jamf Connect logs from the past 30 minutes using the jamfconnect logs command in Terminal. For additional information about the command, use jamfconnect help logs.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Connect team

Hi all, I'm back again with another question on how to implement some settings from the CIS Benchmark. We are stuck on requiring an administrator password to access system-wide preferences. I've been doing some research on the issue and I've been hitting a dead end. I found the extremely helpful blog of rtrouton (https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/), but this doesn't seem to be working in Sierra. Does anyone know a good way to script this change? Thanks!