I am following the below link to sign a package.https://learn.jamf.com/bundle/technical-articles/page/Creating_a_Signing_Certificate_Using_Jamf_Pros_Built-in_CA_to_Use_for_Signing_Configuration_Profiles_and_Packages.html My question is if I dont go to keychain and do those steps mentioned in the link and go to Jamf Settings/ PKI Certificate and download my JAMF built-in certificate and installed it on my mac and sign the package with composer when building the package then there should be any issue? Or this two method are having different purpose, if yes then what is that?

Hi Community,I had an idea to solve a problem I'm facing but wanted to know if Jamf Pro could encounter an issues with this idea. Problem: users in our environment have been saving confidential information in specific location. Given the nature of the documents and contracts we have these files need to exist somewhere else.Solution: script that does a search in the problem directory (I've nailed down this one) and create an EA that reports "True" if the script returns non null/0 results. Realistically I'd like to see these files and results but I can worry about that some other time. Primary concerns here:1. The directory has at least 30 files but could be over 100 so performance issues is a concern.2. Running this kind of script on 30+ machines at a time - Jamf delays?

Hi,I downloaded the latest Autodeploy PKG form Parallels and made the changes in the config file and aded a Windows VM as described in the Admin manual. After Deloyment I get on the client the Error"Parallels Desktop Autodeploy.pkg" could not be opend because the developer could not be verified" in German"Parallels Desktop Autodeploy.pkg" kann nicht geöffnet werden, da der Entwickler nicht verifiziert werden kann.Should be because the app is not signed. Can you help me to solve the problem?Kind regardsMathew

We've been using LDAPS for some time without issue. It recently stopped working sometime over spring break when not in regular use. SSL certificate had expired on 03/30, so the new/current SSL certificate was uploaded but the issue is still not resolved. No other settings have been changed, firewall or otherwise.Test simply returns, "Unable to connect to the LDAP Server." "No Suggestions Available".Cloud logs don't seem to provide anything more specific. I'm not sure what may have changed to cause this issue; may have been Windows Updates on the LDAP servers, or possibly something on the JAMF Cloud side?JIM was a bit behind, so updated it from 2.2.2 to 2.4.0 and rebooted with no change.I can connect using regular LDAP (non-secure/test-only). Somehow there's a problem with the certificate, I just don't know what it is or where to find more specifics. The Subject and SAN both match the FQDN of the host, as expected. And as I said, this has been working without issues for several years, o

I'm being assigned to find out AppConfig for Epic Rover App, so we can deploy the App with server URL and path. There's not much information online, and seems like most app developers are not aware of this feature at all. Ranting aside, anyone has anything related to share?Thanks in advanced

Hi All,We have just purchased 3 Mac Studios with Apple Studio Displays.The problem is I would like to record the serial/asset numbers of the displays to the Mac Studio they are connected to.Anyone got any ideas around this?

So we have had Jamf Connect and Jamf Pro for a 4+ months now and things are going pretty well (read as: still new to Jamf Pro)However I had my first ever "I totally forgot my Azure password" call the other day.After reseting their Azure Password. We were faced with getting the local password reset. No problem, just enter the wrong password three times and I'll give you the recovery key to get in - right?We could not get the MacOS login screen to prompt for a recovery key after many failed attempts. I eventually used the admin credentials to do it.I am testing on a Ventura 13.3 machine enrolled in our Jamf Pro instance running Jamf Connect 2.22.0 and I cannot get MacOS to prompt for a recovery key after trying 10+ unsuccessful logins.Is this a configuration policy in my Jamf Pro? Could it be something configured in Jamf Connect?

I am trying to set an email address as the office licensing activation email.This is what is showing up on the profile on the test machine OfficeActivationEmailAddress = "$O365_licensing_email"Under the Application & Custom Settings paylods I havestring$O365_licensing_emailUnder the computer extension attributes I have:O365_licensing_email:IT@domainnamehere.comWhat am I missing to get that email address populated into the profile payload?

I'm looking for an extension attribute that I could add that would report whether the currently logged in user has the old or the new Outlook UI.  We've run into some issues that seem to be fixed by switching between the two and while we have a gut feeling for how many of our users are still on the old UI, it'd be nice to have some data to back that up.  I haven't been able to find any preference files or anything else specifically that would really tell me one way or the other.  Has anyone else found anything that works?

Hello folks! Wondering if it's advised to remove a computer from Jamf Protect if we plan to repurpose it from one user to another - or will Jamf Protect be able to tell it's on a new user, with a new hostname, etc? Noticed that one of our computers hadn't checked in "3 months" yet it's checking into Jamf Pro every day. Upon digging noticed that the host or computer name were different in both. Thanks!

Is it normal for a policy that only has a script as the payload to never get logs? I have our "master enrollment" script that calls on other policies after enrollment and it shows "pending" on end for any computer. What's strange is that the policies that it calls within the script work/are triggered.Trigger: Enrollment CompleteFrequency: Once per computerScope: All computers - Specific Users

We’re excited to share the new endpoint security-focused Jamf 170 Course! The 170 is an introductory certification course focused on Jamf Protect, macOS security features, mobile device management, and best practices to keep your fleet safe. This course is self-paced, available online, and the content is free to all. The 170 provides foundational knowledge for Jamf’s advanced instructor-led security counterpart, the Jamf 370 Course.   Keeping computers secure and safeguarding user data is no small ask. Jamf Protect provides the toolset to identify malicious activities, source analytics, and leverage MITRE ATT&CK framework intelligence. Even if you’ve been managing Apple devices for a while, and just now joining the security space, this can be a lot to take in. That’s why we designed the 170 to help you build a framework to understand and employ the features of Jamf Protect from the ground up. This course is contains 11 lessons separated into 3 sections.   Providing contex

Afternoon Jamf nation I looking for people who have successfully built a custom dock using this method here https://community.jamf.com/t5/jamf-pro/build-a-custom-macos-dock/m-p/264565Its sort of working, it only seems to be building the dock the second time the same users logs in. Any suggustion on how I can fix this behavouir as I need the dock to be created for every user that logs in when they log in. As this will eventually be deployed to a lab.ThanksTom

I've enrolled our school's fleet of iPads and am currently in progress doing the same to our Macs using Apple Configurator 2. The devices populate correctly in ASM and then I assign them to Jamf Pro, but when I try a test case of Apple Classroom with a teacher Mac and student iPad (assigned as such in ASM with Managed Apple IDs) I see some unusual behavior. The ability to lock students into apps is completely grayed out, as well as the Lock and Mute features. After some troubleshooting with Jamf, I've tried stripped-down PreStage Enrollment profiles on completely wiped devices to ensure no profiles were causing issues, added and re-added the devices to ASM several times, wiped the Mac completely and reinstalled OS, etc. Finally they posited trying the configuration on two like devices--doing so requires me to purchase an iPadOS version of Apple Classroom app on ASM and deploy it through Jamf so I can add it to an iPad. But the app will not appear in Jamf for deployment. I've been back

I have installed Ivanti client and connected to it, I am using a PSAM feature. To use this I need to get a system extension blocked for the SAM. And I need to allow it on the Security & Privacy section. Issue: I am not getting this prompt nor appeared in the Security & Privacy section. Can any one help me on this. Do we have any terminal command or any other process to enable the system extensions prompt?  OR to manually allow this extensions?  

Hey allcurrently we have the problem that some users can no longer log in to SelfService.We have turned off our LDAP server and switched everything to Azure AD with SSO.We have also changed the configuration so that a login does not have to be required in SelfService. However, after clicking the login button, only a white screen appears: However, this does not apply to all users. Network and Internet can be excluded.Does anyone have any ideas? 

New malware to worry about:https://www.uptycs.com/blog/macstealer-command-and-control-c2-malwareUptycs recommends the following measures and actions:Keep your Mac systems up-to-date with the latest updates and patchesOnly permit the installation of files from trusted sources that allow ‘App Store’ or ‘App store and identified developers.’In Ventura (13.3), "App Store" and "App Store and identified developers" are the only two settings under Security, but it looks like there is a way to run unsigned apps anyway under the "Developer" section?  I am thinking of adding a block for "weed.app" in JAMF - Restricted Software. I didn't see a confirmation that weed.app is the process name, so that is a bit of a guess.

Greetings all! In iPad Prestage Enrollments there is a "Temporary Session Timeout" when. one enables Shared iPads for the prestage. It doesn't appear to have any affect.  Does anyone know if this feature is currently known to not work?"Temporary Session Only" also appears not to work, as there is still the option to log in with an Apple ID on my Shared iPads.I will probably have to call Jamf on this one, as I did previously for the inability for MDM commands to change the amount of time until the Shared iPad screen locks. This turned out to be a Product Issue that was reopened.  

We are trying to setup Shared iPads for one of our departments.  However, devices will timeout back to the Lock Screen after 2 minutes and we cannot locate the ability to change this to 1 hour. Our PreStage Enrollment sets the device up as a Shared iPad, Temporary Session Only, Temporary Session Timeout of 3600 secondsOur Configuration Profile targeting the device cannot set Maximum Auto-Lock or Maximum Grace Period for Device Lock settings from Passcode section or the Profile will failManually issuing a remote command to the device to Update Passcode Lock Grace Period (Shared iPad Only) or Adjust Shared iPad Settings do not seem to helpI've attempted everything I can think of at this time or have found online and no matter what, the devices will go back to the login screen after 2 minutes.  As these iPads will sit on screens that need to be referenced without interaction for several minutes at a time, this has created an issue where the devices are not functional for th

Hello,i have the problem, that the devices on their first registration ask to create manually a computer account. I don't know why this happened, because in the past the process was the following: We have SSO Azure and the user got the Microsoft Window to login with the Microsoft-Account credentials. After that the MacBook automatically created the local computer account like the Microsoft-Account.But now, after login with the Microsoft-Account the user must create manually a computer account and there is no automatically account creation. If you do that, you get an error after a few minutes.Can somebody help me? I do not know what is wrong with our configuration in Jamf Pro and i don't find something to fix that.Thank youJulien

Using the API, is it possible to get the value of a single extension attribute? For example if I have the follow XML<computer> <general>...</general> <extension_attributes> <attribute> <name>Domain</name> <value>DomainA</value></attribute> <attribute> <name>Firewall</name> <value>On</value> </attribute> </extension_attributes>Is it possible to request the value of the Firewall extension attribute?

How Erase-install script bypass the end user's admin credential to provide at the time of OS upgradation? In which step of script it is helping us to bypass the admin credential?  

We have an iPad Air software version 12.4.6 which is managed by JAMF Pro.We can no longer send commands to it through JAMF.  Everything is pending.Wifi connected fine.The capacity is full.Restriction policy does not allow to delete devices from the iPadWe simply want to wipe it.   Even unmanage device command just stays in pending.Any suggestion folks?~ Peter 

Hi all, Our Qualys console recently started reporting on Git related vulnerability - CVE-2022-41903Vulnerable git version detected on our assets: git version 2.37.1 (Apple Git-137.1)This is the native Git version that comes bundled with the OS. Apple has not yet provided a security update on this one so I'm trying to find a way for doing patching effectively and urgently.I understand that I can get the latest release (2.39.1) from here: https://git-scm.com/download/macHowever in order to be able to upgrade I would need either Homebrew or MacPorts. The problem here is that none of them seem to be installed to the impacted assets so I would need to deploy one of them first.I also tried upgrading Git via Git: git clone https://github.com/git/git Unfortunately it's not working.I'm not really experienced with Git so at this point I'm not sure about the possible best approach to address the vulnerability. I'm also not sure about what was going to happen to the c

Afternoon Jamf nationHas anyone been able successfully disable Airdrop/handoff  in Ventura.I have been having search on here and can't find anything that works.I have tried few custom config profiles but just can't get them to work even after a restart.Does anyone have workable config profile they can share?Thanks