Run any Jamf Pro policy at the next user login or computer rebootBackgroundRecently, we had a need to run a particular Jamf Pro policy only the next time the computer rebooted.Having previously created Recon at Reboot, I started on a modification for this one-off need. About a third of the way into the modifications, a Heaven-inspired question came to mind: Why don’t you write a script to execute any Jamf Pro policy at the next reboot?Continue reading …

Hi,Does Jamf support configuring a firmware password or preventing users from entering Safe Mode?Thanks, 

Hi All,Really just wanted to post the video of our 2022/2023 device enrollment that is currently fully automated and 'zero touch' really just as a thankyou for all the knowledge you guys and gals have inadvertently poured into me to make any of this possible.If anyone has any comments, require assistance or even suggestions id be more than happy to take the time to reply,https://youtu.be/G5Cm0gUNVDc Kind regards and keep doing what your doing!Pete

Hello, Struggling quite a bit with the Firewall features in JAMF and I'm wondering how others are working with or around it. The configuration options are very basic either Block Everything or Control incoming connections for specific apps which looks like you'd then need to populate the list with any application that could possibly receive incoming connection which seems like an impossible task. Also the fact that if you have a policy applied to the machine with the Firewall payload its locked to whether that policy says the Firewall is enabled or not. In our environment, we do not allow incoming connections nor server services to be running on user workstations. Being able to easily block this with a policy is nice, but then we have cases where someone wants to use AirPlay which needs incoming connections to work. Allowing 1 application through the firewall does not appear to be an option so the alternative is to not apply the Security and Privacy policy to their machine. Defini

Hoping someone's done it! Currently we disable Lock Screen notifications for a couple of apps. this has the downside of the rest of the notification settings of that app becoming locked up and we've seen complaints about users who want sounds on, sounds off etc. Has anyone managed to disable just the setting "Allow notifications when the screen is locked" ?

Hello,Fonts are distributed on shared iPads (through profiles ;-))These profiles are well installed BUT the fonts are not accessible...Any idea?

Hello everyone,I am using Jamf Connect with Google Workspace over a few sites. Everything works fine except for the Google/Jamf Connect login window which in certain countries defaults to the local language.Is there a way to configure English as a default language for the login screen ? In theory, we'd append hl=en but the question is where ?Thanks in advance!

Hi All,How to configure VPN (Not per-app VPN) for macOS from Jamf Pro. Also, the requirement is that User should not able to change or remove VPN  

Anyone have a good way of setting the time zone up correctly? I have tried using the time zone script on the jamf forums, however we are still seeing issues with the time being up to 5 minutes off. Is there a way to enable the automatically detect time zone setting while also enabling locations services to allow this to happen?

Hi!  We are trying ot extract the APNS certificate form the Jamf Pro database to be able to monitor the expiration date, but the keystore is password protected.  Does anyone know how to retrieve the password? This is what we get from the database:  mysql> select * FROM push_notification_keystores; push_notification_keystores_id : xkeystore_type                  : xkeystore_password_encrypted    : ...keystore                       : binapple_id                       :

I want to deploy a .jpg file in a customized path on macOS, /Library/MyCompany/logo.jpg Now on my test mac I placed the .jpg on the mentioned path and using by composer I did drag and drop the entire path and built as .pkg. Now if I deploy it through JAMF Pro, it will create any issue or better to sign this package using by Jamf Pro's built-in certificate downloading it from Jamf Settings/PKI Settings and install cert and make it trust in system keychain and sign using by Jamf Composer when going to build the package and then deploy it. Which is correct?Instead of using Jamf Pro to deploy the package if I try to install the unsigned .pkg it will create any issue on different mac?

Google have pushed out an emergency update for Chrome on the Mac. I've noticed in our 'Mac Apps' - Chrome is not yet up-to-date.Is there a way to force a 'Mac App' to deploy the latest version? Or do we just have to wait for Jamf to sort it out at their end? 

I recently deployed our first enrolled M1 MacBook. I logged in and added the user as an Admin account but the user could not install Teams or Zoom. Both failed after the user put in her password for the install. I logged in as me and both apps installed OK following the user’s method of downloading from the respective websites. User logged in and was able to set up both programs. Is there a Jamf setting that is preventing her Admin account from installing or is this an Apple setting?Any insight would be appreciated

I know this feature request is out there about 100x and I have yet to see a script that does it. Most of these logs are available via the API. So I wrote a script that will let you input either a single serial number, or a CSV of serial numbers and then output a CSV with header for any of the following logs - Screen Sharing LogsJamf Remote LogsComputer UsagePolicy LogsCompleted MDM Commands I only included those because they all leveraged the same API endpoint and it made scripting it easier. If you're handy with scripts, I'm sure you could build off this quite easliy. I'm not a scripter - so I'm sure this isn't perfect. Use at your own risk, just posting it since it seems some people would benefit from it. Since it's 1 API call per device, it'll chew up some server resources, I wouldn't run it during peak hours if you have 10,000 devices. I'm sure I'll miss linking this on a variety of feature requests, so feel free to link it on any that I missed. #!/bin/bash # # # Creat

Hi,I am currently trying to use the Jamf Pro API to run software updates on our Mac environment. I did some testing a few weeks earlier and was able to successfully update a single mac using the API command. Recently I have tried to update a whole room full of macs but receive a http 401 error when running the script. The only change I made to the script was to add the device IDs of the relevant devices.In order to try and troubleshoot this I removed all the device IDs except for the one I used in my initial test but still receive the 401 error.I have also confirmed that my credentials to Jamf Pro were correct, this is proven by the fact I do receive a valid bearer token when requested. I have also checked all of my Jamf Pro account permissions and I have every available permission assigned. Also the same bearer token is able to run this command.curl --request GET --url "$url"/api/v1/macos-managed-software-updates/available-updates --header 'accept: application/json' --header "Authoriz

Say what you will about Jamf Remote, but I found it quite useful for support. It let me keep screen sharing disabled to meet compliance, while still allowing me to use it when I needed it.I still have the app from its last version, however after upgrading my Jamf Pro server I'm now getting "This account does not have privileges in the Jamf Pro Server to use Jamf Remote". Of course, the option to give myself privileges is no longer available in the GUI.I'm wondering if maybe I can modify my database directly to add the Jamf Remote permissions flag back to my account. Has anyone else done this? Or at least, does anyone know what that database entry might look like?

Has anyone deployed Sophos Endpoint to Mac devices using Jamf School, specifically? During my deployment call, the only thing Sophos had was for Jamf Pro, which is a different animal than Jamf School. The person working with me was phenomenal and tried to adapt the instructions to Jamf School with my help, but I've got random little snags with Sophos which has caused me to pause my deployment. Instead of scoping it out and installing everything, I have to manually lay hands on the machines (my users aren't capable of doing full install) and install everything, going into security and preferences and making those changes as well.I've reached out a few times, but not heard back from Sophos.

Hi Everyone,I have recently come into a problem with users trying to install applications through MAC self service over Wi-Fi. For some reason, when users go to install an application over Wi-Fi in MAC Self Service, they get an error message. (The users are on our school Wi-Fi) This is what I see on my end: [STEP 1 of 4]Executing Policy Arduino IDE 2.0.4[STEP 2 of 4]Mounting BrooklineCould not mount distribution point "Brookline"[STEP 3 of 4][STEP 4 of 4]However, when users download it when connected through ethernet, there are no problems. Has anyone seen something like this and have any ideas? Much appreciated!Joe

We have SSO enabled (and working) in our environment, but the only thing that it does not work for is the Jamf Admin app. Is it possible to enable SSO for Jamf Admin? Or will it only accept Jamf account credentials?

HiI have a iPad Pro 12,9 - 2018 with iPadOS 14.0.1The Profile EDU fails to update.I'm looking for a solution. Thanks,Matthieu

HelloI have macOSc Monterey in my companyI want to configure 802.1X ethernet (based on computer authentication), my macOS are bind to ADI have already made a configuration that works but the connection is not automatic.Is it possible to configure this connection so that it is launched when the mac starts?thanks

Hello Jamf Nation, Wanted to bring awareness to this issue we've experienced with a few of our users.  Each time, this issue happened on a M2 Macbook machine (one was a brand new one). I've been unable to find a solution to this issue with the exception of completely wiping the device. The most recent time this happened the user was attempting to install software from Self Service (more specifically Docker) and each time the install would keep hanging/spinning and would not complete or error out. This is most likely because it was stuck attempting to update inventory (as our policies have inventory update once an application is installed).  Opening terminal and running sudo jamf recon yielded the following result (text/image below):  sudo jamf recon Retrieving inventory preferences from https://*REDACTED*.jamfcloud.com/. Finding extension attributes... Locating package receipts... Locating hard drive information.. Locating applications... Locatin

Hello Jamfnation,Just wondering if anyone has had any luck with configuring the new settings for blocking access to preference panes in macOS Ventura? The old method is deprecated and produces some strange results if used: https://developer.apple.com/documentation/devicemanagement/systempreferencesOne example being that blocking 'users and groups' also blocks 'screen sharing' in General > SharingHopefully Jamf will be releasing a config profile setting soon?

My company has purchased and acquired one of our venders to make a more all in-house company.I am charged with on-boarding their computers, but I wanted to only enroll their computers in Jamf Pro but not apply any policies other than install our corporate anti-virus. I am only looking currently to monitor their computer and eventually tweak the computers, as a whole, over to our configuration.Is there a way to have a secondary Jamf Pro profile or exclude the policies to be applied?

Hello Everyone, I wanted to start up a convo around the changes coming to Microsoft Edge updates. Starting with Microsoft Edge version 113, Microsoft Edge for macOS will start using a new updater named EdgeUpdater. More details: https://learn.microsoft.com/en-us/deployedge/edge-learnmore-edgeupdater-for-macos Microsoft provided a configuration example, and it appears to use the same logic/keys as Google’s Keystone updater. Can anyone confirm this? Also, anyone know if we need to change our current MAU configuration to not include MS Edge? Thanks!