I am being tasked with sorting out a solution for macOS SysLog redirection. Security is wanting/needing macOS user Authentication logs among other logs. Most of the tools I am seeing died when Apple updated to Universal Logging. I'm working with our Splunk team to see what options we have with Splunk. However, I am wondering what other organizations and admins are doing for log redirection.

Customer Education has long pursued the goal of meeting you where you are. We create learning experiences for aspiring technicians and seasoned admins looking to expand their knowledge and better understand the tools available to them. We aim to provide context, use-cases, and additional resources to help you in your journey to support users. We created the Jamf 170 Course to respect the importance of keeping devices secure, remediating threats, and fostering a general understanding of attack vectors that malicious actors may leverage against your environment. I began at Jamf as a trainer delivering the Jamf 200 Course (and for you grizzled veterans, the CCT). The 200 covered everything from turning on your Mac for the first time to writing a custom script and deploying it with a policy. For new Mac users, this resulted in a deluge of information in a short amount of time. For Mac aficionados, much of the elementary subject matter felt irrelevant. Over time, the Customer Education team

Hello,I'm pretty sure one of you will know this. I stumbled upon a script left by the previous administrator in our Jamf instance. It's a script to name machines. The naming convention uses Building + Laptop or Workstation + Last 7 digits of serial. For example, a laptop in the San Francisco building should be named like this: SFOMLP-xxxxxxx. A workstation would be named SFOMWS-xxxxxxx. Everything works well except the part where it determines whether it's a laptop or a workstation. That part of the script looks like this:# Determine if portable or desktopcomptype=$(/usr/sbin/system_profiler SPBluetoothDataType | awk '/Complete/ { print $NF }')if [[ $comptype == 'Portable' ]];then base="MLP"elsebase="MWS"The problem is that it names everything with the base MWS, which suggests to me that the comptype variable needs to be edited because it's not grabbing the correct info from the system. Perhaps that line to grab info from System Profiler is no longer correct (?).  Any in

I work in a school district and was wondering if anyone had used scripts to shut down apps after a certain time.  We are looking for a way to stop students from accessing safari and google chrome after school hours.  Any help would be appreciated.  I'm new to scripting and haven't had much practice with it.

Hi All Does anyone know how to actually disable the Airdrop service on OSX Sierra ( I've tried the command "defaults write com.apple.NetworkBrowser DisableAirDrop -bool YES" ) dont the Mac's are still broadcasting via Airdrop I've restricted AirDrop using a configuration profile - But this only removes the AirDrop from Finder and not actually disables the service Any advice would be greatly appreciated

I feel like i'm missing something here. Aren't nested groups supported in v9? I don't see how to add a computer group to a static group.For example: If i have static groups called Lab1, Lab2, Lab3, etc. that all have specific computer assignments, then i'd like to have another static group called something like All Labs that have the static groups Lab1, Lab2, and so on. That way, if i want to push a config profile to all labs, i can just select All Labs as the scope, rather than listing all of the individual labs.

I just wanted to know if there is any restriction to use same Apple ID for push notification can be used for ABM login for any order for VPP app or DEP device assignment. Or this two Apple Id has to be different and it is must?

I am following the below link to sign a package.https://learn.jamf.com/bundle/technical-articles/page/Creating_a_Signing_Certificate_Using_Jamf_Pros_Built-in_CA_to_Use_for_Signing_Configuration_Profiles_and_Packages.html My question is if I dont go to keychain and do those steps mentioned in the link and go to Jamf Settings/ PKI Certificate and download my JAMF built-in certificate and installed it on my mac and sign the package with composer when building the package then there should be any issue? Or this two method are having different purpose, if yes then what is that?

Hi Community,I had an idea to solve a problem I'm facing but wanted to know if Jamf Pro could encounter an issues with this idea. Problem: users in our environment have been saving confidential information in specific location. Given the nature of the documents and contracts we have these files need to exist somewhere else.Solution: script that does a search in the problem directory (I've nailed down this one) and create an EA that reports "True" if the script returns non null/0 results. Realistically I'd like to see these files and results but I can worry about that some other time. Primary concerns here:1. The directory has at least 30 files but could be over 100 so performance issues is a concern.2. Running this kind of script on 30+ machines at a time - Jamf delays?

Hi,I downloaded the latest Autodeploy PKG form Parallels and made the changes in the config file and aded a Windows VM as described in the Admin manual. After Deloyment I get on the client the Error"Parallels Desktop Autodeploy.pkg" could not be opend because the developer could not be verified" in German"Parallels Desktop Autodeploy.pkg" kann nicht geöffnet werden, da der Entwickler nicht verifiziert werden kann.Should be because the app is not signed. Can you help me to solve the problem?Kind regardsMathew

We've been using LDAPS for some time without issue. It recently stopped working sometime over spring break when not in regular use. SSL certificate had expired on 03/30, so the new/current SSL certificate was uploaded but the issue is still not resolved. No other settings have been changed, firewall or otherwise.Test simply returns, "Unable to connect to the LDAP Server." "No Suggestions Available".Cloud logs don't seem to provide anything more specific. I'm not sure what may have changed to cause this issue; may have been Windows Updates on the LDAP servers, or possibly something on the JAMF Cloud side?JIM was a bit behind, so updated it from 2.2.2 to 2.4.0 and rebooted with no change.I can connect using regular LDAP (non-secure/test-only). Somehow there's a problem with the certificate, I just don't know what it is or where to find more specifics. The Subject and SAN both match the FQDN of the host, as expected. And as I said, this has been working without issues for several years, o

I'm being assigned to find out AppConfig for Epic Rover App, so we can deploy the App with server URL and path. There's not much information online, and seems like most app developers are not aware of this feature at all. Ranting aside, anyone has anything related to share?Thanks in advanced

Hi All,We have just purchased 3 Mac Studios with Apple Studio Displays.The problem is I would like to record the serial/asset numbers of the displays to the Mac Studio they are connected to.Anyone got any ideas around this?

So we have had Jamf Connect and Jamf Pro for a 4+ months now and things are going pretty well (read as: still new to Jamf Pro)However I had my first ever "I totally forgot my Azure password" call the other day.After reseting their Azure Password. We were faced with getting the local password reset. No problem, just enter the wrong password three times and I'll give you the recovery key to get in - right?We could not get the MacOS login screen to prompt for a recovery key after many failed attempts. I eventually used the admin credentials to do it.I am testing on a Ventura 13.3 machine enrolled in our Jamf Pro instance running Jamf Connect 2.22.0 and I cannot get MacOS to prompt for a recovery key after trying 10+ unsuccessful logins.Is this a configuration policy in my Jamf Pro? Could it be something configured in Jamf Connect?

I am trying to set an email address as the office licensing activation email.This is what is showing up on the profile on the test machine OfficeActivationEmailAddress = "$O365_licensing_email"Under the Application & Custom Settings paylods I havestring$O365_licensing_emailUnder the computer extension attributes I have:O365_licensing_email:IT@domainnamehere.comWhat am I missing to get that email address populated into the profile payload?

I'm looking for an extension attribute that I could add that would report whether the currently logged in user has the old or the new Outlook UI.  We've run into some issues that seem to be fixed by switching between the two and while we have a gut feeling for how many of our users are still on the old UI, it'd be nice to have some data to back that up.  I haven't been able to find any preference files or anything else specifically that would really tell me one way or the other.  Has anyone else found anything that works?

Hello folks! Wondering if it's advised to remove a computer from Jamf Protect if we plan to repurpose it from one user to another - or will Jamf Protect be able to tell it's on a new user, with a new hostname, etc? Noticed that one of our computers hadn't checked in "3 months" yet it's checking into Jamf Pro every day. Upon digging noticed that the host or computer name were different in both. Thanks!

Is it normal for a policy that only has a script as the payload to never get logs? I have our "master enrollment" script that calls on other policies after enrollment and it shows "pending" on end for any computer. What's strange is that the policies that it calls within the script work/are triggered.Trigger: Enrollment CompleteFrequency: Once per computerScope: All computers - Specific Users

We’re excited to share the new endpoint security-focused Jamf 170 Course! The 170 is an introductory certification course focused on Jamf Protect, macOS security features, mobile device management, and best practices to keep your fleet safe. This course is self-paced, available online, and the content is free to all. The 170 provides foundational knowledge for Jamf’s advanced instructor-led security counterpart, the Jamf 370 Course.   Keeping computers secure and safeguarding user data is no small ask. Jamf Protect provides the toolset to identify malicious activities, source analytics, and leverage MITRE ATT&CK framework intelligence. Even if you’ve been managing Apple devices for a while, and just now joining the security space, this can be a lot to take in. That’s why we designed the 170 to help you build a framework to understand and employ the features of Jamf Protect from the ground up. This course is contains 11 lessons separated into 3 sections.   Providing contex

Afternoon Jamf nation I looking for people who have successfully built a custom dock using this method here https://community.jamf.com/t5/jamf-pro/build-a-custom-macos-dock/m-p/264565Its sort of working, it only seems to be building the dock the second time the same users logs in. Any suggustion on how I can fix this behavouir as I need the dock to be created for every user that logs in when they log in. As this will eventually be deployed to a lab.ThanksTom

I've enrolled our school's fleet of iPads and am currently in progress doing the same to our Macs using Apple Configurator 2. The devices populate correctly in ASM and then I assign them to Jamf Pro, but when I try a test case of Apple Classroom with a teacher Mac and student iPad (assigned as such in ASM with Managed Apple IDs) I see some unusual behavior. The ability to lock students into apps is completely grayed out, as well as the Lock and Mute features. After some troubleshooting with Jamf, I've tried stripped-down PreStage Enrollment profiles on completely wiped devices to ensure no profiles were causing issues, added and re-added the devices to ASM several times, wiped the Mac completely and reinstalled OS, etc. Finally they posited trying the configuration on two like devices--doing so requires me to purchase an iPadOS version of Apple Classroom app on ASM and deploy it through Jamf so I can add it to an iPad. But the app will not appear in Jamf for deployment. I've been back

I have installed Ivanti client and connected to it, I am using a PSAM feature. To use this I need to get a system extension blocked for the SAM. And I need to allow it on the Security & Privacy section. Issue: I am not getting this prompt nor appeared in the Security & Privacy section. Can any one help me on this. Do we have any terminal command or any other process to enable the system extensions prompt?  OR to manually allow this extensions?  

Hey allcurrently we have the problem that some users can no longer log in to SelfService.We have turned off our LDAP server and switched everything to Azure AD with SSO.We have also changed the configuration so that a login does not have to be required in SelfService. However, after clicking the login button, only a white screen appears: However, this does not apply to all users. Network and Internet can be excluded.Does anyone have any ideas? 

New malware to worry about:https://www.uptycs.com/blog/macstealer-command-and-control-c2-malwareUptycs recommends the following measures and actions:Keep your Mac systems up-to-date with the latest updates and patchesOnly permit the installation of files from trusted sources that allow ‘App Store’ or ‘App store and identified developers.’In Ventura (13.3), "App Store" and "App Store and identified developers" are the only two settings under Security, but it looks like there is a way to run unsigned apps anyway under the "Developer" section?  I am thinking of adding a block for "weed.app" in JAMF - Restricted Software. I didn't see a confirmation that weed.app is the process name, so that is a bit of a guess.

Greetings all! In iPad Prestage Enrollments there is a "Temporary Session Timeout" when. one enables Shared iPads for the prestage. It doesn't appear to have any affect.  Does anyone know if this feature is currently known to not work?"Temporary Session Only" also appears not to work, as there is still the option to log in with an Apple ID on my Shared iPads.I will probably have to call Jamf on this one, as I did previously for the inability for MDM commands to change the amount of time until the Shared iPad screen locks. This turned out to be a Product Issue that was reopened.