Hello! I am very inexperienced with scripting, so tell me if i'm in the wrong place. I want to have a simple script execute the following (at a user level): defaults write com.apple.loginwindow TALLogoutSavesState -bool false I have a few scripts (for mounting network shares) that I run using Outset when the user logs in. I'd like to do the same with this one. Any guide on how to call this command as the user?

With Apple devices continuing to gain major prevalence within both educational institutions and businesses of all sizes, it’s becoming increasingly important for organizations to manage not only their devices but also the Apple ID that the user signs-in with. This is where Managed Apple IDs come in. While you can restrict the ability to sign-in to an Apple ID using an MDM solution (or our team can do this for members of our own managed service offerings), in doing so you are denying users key functionality and features, such as iWork collaboration and iCloud Backup. This article aims to highlight these benefits and discuss how to leverage your organization’s existing Microsoft 365 accounts as Managed Apple IDs to give your users one fewer log-in to remember. That said, it should be pointed out that it remains best practice to disable signing-in to any Apple ID on devices that aren’t permanently assigned to an individual user and Shared iPad isn’t being used. This is most common in smal

Certificates and the technologies surrounding them can be a difficult topic to understand. In this series, we’re going to break down the underlying concepts around these technologies in a straightforward, easy-to-understand way. In our first part we will cover the basics of certificates and how they work, and in the future we’ll talk about SCEP, AD CS, 802.1x, and more. What is a certificate? A certificate is a unique, digitally signed document which authoritatively identifies the identity of an individual or organization. What makes up a certificate? A signed digital certificate contains the owner’s distinguished name, the owner’s public key, the certificate authority’s (issuer’s) distinguished name, and the signature of the certificate authority over these fields. There are often other fields, such as Country, State/Province, City, Organization, Department, and more which can more accurately identify the certificate or the object which the certificate identifies. These fields aren

Welcome to Part 2 of our discussion of Certificates, SCEP, and 802.1x. In our first post we took a look at what certificates are and how they work. Today we will take a look at Active Directory and Active Directory Certificate Services. What is Active Directory? Active Directory (AD) is a set of roles and features which run on Windows Server. In essence, it is a database and set of services that connect users with the network resources they need to get their work done. Active Directory is often used as a broad term to describe several concepts and services. There is much, much more to AD but this isn’t a Microsoft AD course, so we’ll only cover what we need to know here. What does Active Directory do? At its core, AD helps administrators manage permissions and control access to network resources. AD uses several directory objects to do so: Users Groups Computers Security Policies (Group Policy Objects) Active Directory manages the security policies applied to its many moving parts

Easily allowing your end-users to opt-in or opt-out of your internal beta program is the first step to building your user-base of “trusted testers.” Let's take a closer look at how we implemented this via Self Service, and how we utilized the combination of an Extension Attribute and Inventory Update to populate our testing group, rather than the Jamf Pro API. This type of workflow can be used for implementing your own beta test group, or it can be used in conjunction with other workflows where you want users to self-report. This workflow was originally posted to my personal blog, which you can find by following this link. Additionally, I've documented some related workflows and spoken about our beta test program at JNUC. Feel free to take a look at the links below if you would like to learn more:Dan K. Snelson Blog - Your Internal Beta Test Program: Opt-in / Opt-out via Self Service (sans Jamf Pro API) Dan K. Snelson Blog - Invitation Only Betas JNUC 2019 - Your Internal Bet

What are Extension Attributes? Why were they added to Jamf Pro and why do they matter? These questions, and others, will be answered in this short post. Extension Attributes can be a powerful tool in the tool belt of the Jamf Pro admin, and we will dive into them a little deeper in this post. At the end, you should have a working knowledge of Extension Attributes, a few workflow ideas, and some further resources to continue on in your journey to become an Extension Attribute guru. So buckle up and let’s go on a journey!   What Are Extension Attributes? Introduced in the Casper Suite days, Extension Atributes are a method for extending the data stored in Jamf Pro for an object (computer, mobile device, or user). From our developer documentation: Extension attributes allow Jamf Pro to store additional inventory information about a device beyond what is collected by default. Their values can be set via API call, or through the Jamf Pro console itself. While Jamf Pro is designed to co

Originally this article was posted on Jamf Nation here, prior to the launch of Tech Thoughts. tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like iOS or iPadOS, where all configuration profiles and certificates are scoped to the whole machine. "Managed Users" A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways: First user created by Setup Assistant when machine is first set up via Automated Device Enrollment A user with administrator rights initiates a user enrollment via an enrollment URL or renewing the Automated Device Enrollment with a profiles command Mobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM. For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High Sierra For a configuratio

First, let me start off by saying you should never use basic auth for anything, anywhere, at any time.   Next, let me tell you why you need basic auth or “Resource Owner Password Grant” or “Resource Owner Password Claim” (if you speak Microsoft) or “Resource Owner Password” (if you speak Okta) or just plain old “password” (if you read the ancient runes of the .well-known/openid-configuration endpoints).  I promise you it’s a good reason.   What is ROPG The basic password flow used by Resource Owner Password Grant (ROPG) is literally an endpoint receiving a user name and a password and returning something to say the password is good, bad, or other. curl 'https://login.microsoftonline.com/12345678-9abc-def1-0000-000000000000/oauth2/v2.0/token' \\ -X POST \\ -H 'Host: login.microsoftonline.com' \\ -H 'Accept: */*' \\ -H 'Connection: keep-alive' \\ -H 'Accept-Language: en-US,en;q=0.9' \\ -H 'Content-Length: 295' \\ -H 'User-Agent: Jamf%20Connect%20Configuration/2606 CFNetw

Maintaining user accounts in Jamf Pro can be daunting if you work in Education. Depending on the size of your district, you may have over a thousand staff and students enter and exit within a three-month span each school year. If your district is one-to-one, that’s a thousand new user accounts getting created each year. If you aren’t doing user-based app assignments, maintaining users may not even occur to you, but there are benefits to cleaning up user accounts in your Jamf instance. If your Jamf instance is on-premise, you know an integral part of the instance is the database. If your instance is in the cloud, you may not be aware of the significance of the database. With any database, it’s important to keep it healthy. By healthy, I mean stable, efficient, and secure. Bad data in a database can lead to inaccurate reports or, in the case of user base app assignments, wasted app licenses. Bloated databases can result in poor performance or the need to continually tune your Jamf instan

I originally posted this article on the Apple@CVTC blog, and you can find out more about JPS API Wrapper on our GitLab project. As a developer or anyone that writes code, managing APIs can be a time-consuming task. You need to a lot of time figuring out how to send requests, retrieve data, and process responses. In this context, API wrappers come to the rescue. An API wrapper is a package that simplifies the use of APIs by providing a unified interface for sending and receiving data. In this article, we will be discussing jps-api-wrapper, a Python package for the Jamf Classic API and Jamf Pro API. What is JPS (Jamf Pro Server) API Wrapper? JPS API Wrapper is a Python package that simplifies the use of the Jamf Classic API and Jamf Pro API. It provides a unified interface for sending and receiving data, making it easier for developers to interact with the Jamf APIs. With JPS API Wrapper you can easily retrieve data on devices, software, and other assets managed by Jamf, and even pe

Is there a way that we can delete printer that user added? we have a open directory that teacher can pick what printer they want to add. now we have new system that only uses one virtual printer, and we already push that one using LPD. what we want to happen is to remove all printer that they add and only printer one printer will stay the one that we push.

Have apple school manager setup, and trying to deploy iMovie to a test MacOS.  Using Self Service and when the user clicks install it spins then comes back with an error saying "Cannot Reach Jamf Pro Server".  We are cloud hosted, I have tried the machine off the district internet incase a Firewall issue was causing it.  No luck,I am able to deploy a custom package of Chrome from the Jamf Cloud distribution point.  I also have tried xcode also another free app and it still gives me the error of "Cannot Reach Jamf Pro Server"Mac Store Apps do not install 

Hey all, Not sure if this is the correct place to post this but here we go:Long story short - I'm new to Jamf (actually our whole company is). Now we are trying to renew the "client certificate(?)" because employee's are losing connection to the VPN due to the cert being expired. Eventually this will become an issue for our employee's in other countries as they cannot come into the office to retreive a new one. At the moment it's only valid for a year (if that gives you an idea what I'm talking about) I've seen a lot of people mentioning this issue but I haven't found a solution yet. We are in an on-prem environment using ADCS with Jamf. Feels like there should be a way to automate this? Is our configuration wrong somehow? Not sure why the Mac's are able to retreive these without issues when enrolling them but not renew them? Every suggestion on where to look are highly appreciated! I would also like to mention that i'm not familiar with everything so please be pati

Hey Jamf people! We are having a weird issue with our GlobalProtect certificate deployments.  We have deployed the certificate to our endpoints 10 days prior to expiration to make sure we don't have any expirations (leads to p0 outages).  This time is weird though, as we can see successful config profile (containing the new cert) deployments to endpoints, but on their machines, they retain the cert that is expiring soon.  Whats even weirder, is that it does not happen to all people we deployed the certificate to.  Has anyone ever seen this issue?Lukas

New Jamf Tech here!I am currently looking for a way to streamline our Summer refresh and deployments. Our acting Jamf admin is great, but stays busy with several things, so I really want to try to make things better for our students and also just teach myself something.The short version: We use a 1-1 model that functions on a rotation using stock out of a warehouse. It's fine, but we face a lot of bottlenecks that slow down the process when thousands of devices need to be deployed or refreshed. Seeing as how I am new to all this, I may get confusing, so I apologize!!Overall, I want our devices to be able to fall into any students hands at any grade level 95% configured then finish with a short checkout/single sign in process. After it's set up, it's used the entire school year or until it is ready to be wiped. I have heard that Jamf Reset & Setup in education works well and I think that could work towards my goal, but I also saw a session at JNUC where they spoke of using

Below is a screenshot of the Jamf School Profile/Settings interface.I am confused about how to do this overall. Is the idea that you basically create holistic settings that are all encompassing for a type of device, and you put all of the things and stuff in one, and only apply "one per device" or is the idea to be granular and only for example configure the WiFi, Certificates, DNS Proxy if needed, and that's it.If the idea is to be more modular, is there any type of guide that covers which policies can conflict in which case it's a race condition to determine which profile is applied if there are conflicting settings that would prevent the other profile from applying?If I had to guess it should kinda look like this.Modular profile 1 - Connectivity related settings only. So WiFi, Certs, and anything needed to get your content filter to work on the device. Beyond that, I don't know. How should these things be chunked up, or should it be that beyond the connectivity profile, that it

is there a possible setting that erases all stored data on a supervised ipad after a certain time period of lets say, two weeks?I'm talking about clearing the photos, documents, files folders as well as app-specific folders like pages or keynote, or even third party apps.I don't know if Apple itself even has a function like that integrated, but maybe the jamf function may even overwrite that?Thank in advance already for your suggestions!Max

Good day JamF Nation.Hoping someone can provide some insight.i have a site that I manage and we use authchanger to either disable JamF connect or enable.1 of the policies is set to reset the mac to default login and the other is to enable jamfconnect. This works on all devices, except 1. The policies run without error, but the policy isnt applying to the device.Make:AppleModel:iMac Intel (21.5-inch, Mid 2017)Model Identifier:iMac18,1OS:12.6Id appreciate some direction here as i am not able to identify why it isnt applying to the device

We are a Jamf Shop and Jamf (currently until our instance is updated to 10.43.1) does not have a native mechanism for managing com.apple.servicemanagement. Jamf deploys their own com.apple.servicemanagement payload to manage the Jamf apps however since the ability to manage Login Items was added to MDM we have been using a separate payload to manage our 3rd party login items.This has been working fine until macOS 13.2. Now we are seeing very inconsistent behavior where our managed login items are no longer managed. When I look at the deployment guide it seems like com.apple.servicemanagement allows multiple payloads. e.g. "Duplicates allowed: True—more than one Managed Login Items (com.apple.servicemanagement, com.apple.loginitems.managed) payload can be delivered to a user." Up to macOS 13.2 the behavior was that multiple com.apple.servicemanagement payloads were respected. https://support.apple.com/guide/deployment/managed-login-items-payload-settings-dep07b92494/1/web/1.0 I rolled b

Can we integrate RSA with Mac for login screen authentication when Jamf Connect is also already deployed?

Hey Folks,Curious if anyone has found a way to automate emails to users based on a Smart Group membership?   Examples of things we’d like to notify users of:Your internal storage is at XX% of capacity, here’s what you can do about itYour laptop hasn’t checked in to Jamf in XX days, please turn it onYour computer hasn’t rebooted in XX days, please reboot Right now, admins are getting emails from Jamf based on criteria we prioritize (eg: ‘storage almost full’), or manually checking Smart Groups once a month, and emailing the users directly.I know you can email group members via VIEW -> ACTION -> SEND EMAIL, but that’s a manual process, and we’d rather automate it. ## I found versions of this feature request on JN, and confirmed with Jamf that it's not currently part of the product in 2023.2016 post: https://community.jamf.com/t5/jamf-pro/alert-system-user-on-smart-group-change/m-p/1416392013 post: https://community.jamf.com/t5/jamf-pro/automated-emails/m-p/10530

Hi,I'm trying to get Jamf connect working with Google. We can connect and update the local password using the toolbar application, however when logging out of the device it will load a Google sign in window and when signing in to this it produces an error "Configuration is nil or invalid". Any ideas as to what I'm missing? Thanks

Has anyone been able to make a Code42 CrashPlan installer in Composer?  I'm trying to do that for version 10.2.0 of Code42 and it fails.  I notice that there are some Code42-related files that change after the installation is done, so I'm thinking that Composer might not be making an accurate "after" snapshot.  I can give more details if someone wants.  I'm  just wondering if there is anyone who has gotten this to work, and, if so, what they did to get it to work.  Thanks.  --Jeff 

We were testing our Apple Business Manager and Apple Configurator 2 enrollment.  We have a few MacBooks that were not added to ABM when they were purchased and need to be added via iPhone Apple Configurator2.  I was able to add the macbook into ABM but now when it gets to the Remote Management screen it gives an error stating  "Enrolling with management server failed. unable to connect to the MDM server for your organization. "Usually when we enroll a new mac and is on ABM this section has no issues connecting.  PreStage enrollment seems to be setup properly and never had an issue.  Is there a difference for the remote enrollment when the device was enrolled into ABM using Apple Configurator2?  Is this something to check on Jamf Pro or on ABM side?

We are excited to announce the launch of the Jamf Learning Hub, a one-stop-shop for all of our product technical content. This new resource provides a self-directed user experience, so you can access relevant technical product content at the right time and in the appropriate format, meeting you where you are at in your learning journey.   The Jamf Learning Hub includes a wide range of content, from “Getting Started” guides to advanced technical articles and training videos. Whether you're new to our products or a seasoned pro, you'll find something of value in the Jamf Learning Hub. This platform will replace docs.jamf.com to provide a unified and intuitive experience for searching and accessing all of our published technical product content, helping you be even more successful with Jamf. The Jamf Learning Hub provides: A single access point for product documentation and training content Improved search capabilities, making it easy to find what you need by providing the most rele