Hi there, I've been sitting with this issue for a couple weeks now with no end in site with support, so I figured I'd ask others. We've just started up our Jamf Pro tenant. When we attempt to enable the Cloud Services Connection and input the Jamf ID email address and password, it throws an error saying "Incorrect Jamf ID email address or password". There's only one user in the tenant, the same admin account that set everything up, and that's the jamf ID address and password I'm using. Support has had me try different test accounts and even reset the tenant, but it hasn't changed anything, and I can't seem to find any record of others having this issue. Has no one else run into this problem? This is holding back our implementation projections in a big way given the slow speed of support's communication.

So my father's company is in the transition to Microsoft 365 and now we are looking how to manage about 15 Macs. I'm fairly familiar with Mac management with Jamf Pro, but the MSP wants only Intune to manage all the devices in the environment.Will we miss out on something by using Intune, and not Jamf Pro, to manage our Macs?Our users are admin and know their way on macOS.For us it's most important security is in place (Conditional Access, Compliance, passcode, FileVault and Firewall) and there is a decent onboarding with Apple Business Manager.Will Intune suffice, or is it still better to have a decent MDM like Jamf Pro for Mac management?Someone know their way on both solutions!?

I work in a computer lab that utilizes our AD. I was wondering if there was any way to make some sort of template so that each new user that logs on can automatically have applications such as Microsoft Word or Adobe Photoshop on the desktop specifically. Perhaps I've not looked hard enough but I thought I'd at least ask. Thank you

Looking for input and help :)We have identified a number of systems that were enrolled with a dodgy push cert which is causing config profiles to be extremely slow when being deployed.. Is there a way to fix the identified systems without having to unenroll and re-enrol? but .. if we need un-enroll and re-enrol - is there a way to do it smoothly? and what the best way to approach itThanksRob 

I have a script that is running a lot of commands starting with su "$currentuser" -cWhen the policy is run locally or via Self Service the script runs as expected.  When I let it run via check-in, all the lines that start with the above command do not run.  Any ideas?

I've deleted a mac 3 times and it re-enroll after a new installation every time. From the GUI I've removed MDM and deleted it.  What could cause it to re-join and can I stop this from happening? Thanks,  

We're having a problem where managed Apps keep reinstalling themselves on our iOS devices.  My understanding is that starting with iOS 14, managed apps could be deleted by end users, but my testing has revealed that iOS 14.0 and iOS 15.0 will reinstall the apps of their own accord.  Looking at Google Sheets as my test example, I have the following set:- Install Automatically/Prompt Users To Install- Automatically Force App Updates- Make App Managed When Possible (greyed out)- Make App Managed if Currently Unmanaged- Allow users to remove app (iOS 14 or later) and in in a Configuration Profile that is assigned to the device, we have - Removing Apps:  Allowed I suppose I can go to the Scope tab for the App and add an exclusion for the device in question to keep it from reinstalling itself, but that doesn't scale.  Where should I look next?  

Hello folks,Newer Jamf Pro user here. We've got about 230 devices enrolled, 98% of which are existing machines from the field (mostly remote) that we're using user-initiated enrollment for. We're doing pretty basic stuff, installing a few apps, issuing a password policy, and things like login screen message etc. One these machines, there is a local admin for our use, and the user is also a local admin. We've had two instances recently where, a user has rebooted, done the user-initiated enrollment, and then upon rebooting, is asked to change their password at login to comply with the password policy, and then the next time they try to login after this, they are told their password is wrong. I'm finding the same issue with the local admin, and the only way I can get in is if I push a new local admin account to the machine via a policy. But after I login, if I go to users & groups in sys prefs/settings, and I try to reset the password, I get "reset password failed." We are not using F

Hi All,is it possible to withdraw a Quick Actions in the Jamf School?Best Regards and Thanks for a fast answerPeter

I have a policy with the command below to install macOS updates for high priority updates like 12.5.1.  softwareupdate --install --os-only -R  However, I have a bunch of machines that state there are no updates available in the logs.Eligible device:Command result ("No updates are available."):We have an SLA for zero-day patches like this of 7 days once it's released to hit 90% of eligible devices, and we've missed that, but I'd like to wrap this up ASAP.My original command is below, but was installing things like Xcode command line tools, so I modified it slightly:softwareupdate -i -r -R

Is there a payload that would allow one to force a device name?  I know you can do it via an enrollment profile but I'm looking to do this via a configuration profile.

What exactly is http://kickstart.apple.com/ ? Googling "Apple kickstart" just gives me ARD results, or the man page.

We have the skip TouchID setup for our new enrollments which works great for new machines, however as we upgrade to Monterey after reboot that setup wizard runs again.  I have tried many of the scripts and profiles out there but they all look old and non still work, especially with Monterey.  I am hoping someone else has worked through this already as part of their Monterey Upgrade?  Any solutions out there that have been tested and are working in Monterey?  Thanks in advance.

Ok so we have a very weird issue here in my org and I wanted to see if anyone else has ever run into this. On some of our late-2016 and mid-2017 15" Pros, users are having login issues post Monterey upgrade (12.1 and 12,2). When they attempt to login to their account it accepts their password but then just sits there with the progress bar and never logs in. Sometimes the account will let you in, but the users have no menu bar, extremely limited access to the keyboard, and it just never really logs in all the way. But you can use the keyboard shortcut to logout and then log back in with no issues. So given these experiences and after troubleshooting further, we have pinpointed that this issue is with FileVault. We can also go through a password reset with the recovery key, but never change their password, and the users can login with no problem; they can also login fine if we turn off FV and decrypt the drive. But then as soon as we turn FV on again and the drive encrypts the issue is b

Hello, So I am trying to get the wallpaper login policy to set the wallpaper, it works on one of my test machines Mac Book Air that running a M1 chip but the iMac that I have thats running a intel i5 chip is not handling the osascript. It errors with this: 33:48: execution error: Finder got an error: AppleEvent handler failed. (-10000)   #!/bin/bash #Create Directory for Custom Image mkdir '/Library/Wallpaper' # Change directories cd '/Library/Wallpaper/' # Download the wallpapercurl -k -Os https://linktowallpaper.com -s cd '../..' currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to "/Library/Wallpaper/Background.jpg"'  

Does anyone have a script for macOS that functions similar to Jamf Reset for iOS? I'd like to be able to run said script on my MBAs to wipe them, and make them unmanaged in Jamf Pro.

With the help of people on Jamfnation I created a policy to add users to the lpadmin group so they can add printers (though rather than adding "Everyone" to the group like I should've done, my policy runs at login, checks to see if a user is a member of lpadmin, and if they aren't then it adds them to the group). The people who asked for this then asked if there was a way to allow users to only add USB printers and not network printers. I'm guessing the lpadmin group is no longer going to be an option, but does anyone know an alternate method that might accomplish this?

We have "imaging" policies set to the root of jamf so all sites have access to them.We are using DEPNotify to manually call these policies. These policies are scoped to a group, but in some areas they do not need a few of the "image" apps to be installed. If I scope the policy for these apps to exclude these groups will it stop the policy from installing even its its manually called using sudo jamf policy -id that DEPNotify uses?

Is there a way to remove iCloud Drive from the sidebar without a 3rd party tool?

I have been looking around for some assistance on removing 2 lines from the hosts file. I would prefer a script as I need this done on 30+ MBP's, I did see a few scripts but the are adding entries not removing entries. Any help is appreciated.

We had a script, triggered by a LaunchDaemon, that ran just fine under 12.6, but since updating to 12.6.2, it now spits out the dreaded "unable to execute" "Operation not permitted" error.The script is not anything exceptional, it reads some data from NETSTAT and writes out data to the /tmp directory. Running the commands from the script independently works, but running the script itself fails every time.Despite the fact that it shouldn't need "Full Disk Access," I have tried giving both the script and Terminal Full Disk Access, and that hasn't changed anything. Additionally, this is a script that we run perpetually on a schedule, so disabling SIP just to run the script is not an option. I have also tried simply moving the script to a different location (Desktop) and it still fails with the same error. There's a part of me that thinks there is a terminal command that will register and exception to a script to allow it to run, regardless of GateKeeper restrictions, but I cannot remember

I was able to get the Google Chrome Extension Blacklist up and running without issue, and it is working great. The second I block one extension, the students move on to another, so I am hoping to do the reverse and block everything and allow just a few. I thought that it would be an easy fix to change the key from <ExtensionInstallBlacklist> to <ExtensionInstallWhitelist>, but that isn't working. Has anyone had success with a specific script that you could share? I have spent time browsing the community posts, and most are from several years ago. Just for reference, this is the Blacklist Script I am using: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>DeveloperToolsDisabled</key> <true/> <key>ExtensionInstallBlacklist</key>

Hello,I am currently attempting to write a script to patch a Mac computer.This is my script:#!/bin/bash todayDate=$(date "+%d.%m.%Y") patchingLogFile=patching_"$todayDate" exec > /tmp/"$patchingLogFile".txt 2>&1 echo "Part 1:0 log file has been created" computerMacOSVersionFirstValue=$( sw_vers -productVersion | /usr/bin/cut -d. -f1 ) macOSVersionUpdate="11.7.2" if [ "$computerMacOSVersionFirstValue" == "11" ] ; then softwareupdate -R --fetch-full-installer --full-installer-version 'macOS $macOSVersionUpdate' 2>&1 else echo "Don't do the update" fi The problem I am getting, is that when I look in the log file, I get this return:Scanning for macOS $macOSVersionUpdate installerInstall failed with error: Update not found But if I run the code:softwareupdate -R --fetch-full-installer --full-installer-version 'macOS 11.7.2' 2>&1Then the computer will update with the intended version.I don't know what I am doing wrong! Can a scripting guru help me plea

I am curious to know how everyone deploys Apple TVs in their environments. I am finally seeing a downside of scoping a user to the Apple TV located in their workspace due to the fact the Apple TV seems to be trying to install applications that are not meant for tvOS, which is piling the failed commands of "App does not support Apple TV devices" a mile high. The user would be scoped an application meant only for iPadOS/iOS and under the Mobile Device App it is set to "Make Available in Self-Service", but still I see these errors. What is the best practice for scoping an Apple TV to a user that also has a iPadOS/iOS device? Do I need to exclude all devices LIKE "Apple TV" from each of my 500 applications? I hope I'm missing something here.

Hi Jamf Nation!I have a Mac studio that continues to crash and/or restart once it is enrolled. When removed from enrollment, the user says this issue does not occur, but every time we do enroll, the problem starts up. I have removed it from policies with restart payloads but not sure what would cause this to happen multiple times a day. Has anyone else experienced this? Thanks!~ G