Documentation and course materiaal provides this script to Display a message to a user, if they click OK, then open Self Service. messageToDisplay="$4"policyToExecute="$5"policyAction="$6" buttonClicked=$(osascript << EOFbutton returned of (display dialog "$messageToDisplay" buttons {"OK", "Cancel"} default button 1)EOF) if [[ "$buttonClicked" == "OK" ]];thenopen "jamfselfservice://content?entity=policy&id=$5&action=$6"fi However, this fails when the script is run in a policy, due to the JSS running the script as root instead of currentUser. Working with Jamf support we were able to make the modification below, which allows the script to run as intended when deployed via policy. messageToDisplay="$4"policyToExecute="$5"policyAction="$6"currentUser=$(ls -l /dev/console | awk '{ print $3 }') buttonClicked=$(sudo -u $currentUser /usr/bin/osascript<<END tell application "System Events"activateset the answer to button returned of (display dialog "$messageToDispla

Hi,I tried to create Push Certificates but don't know where is place to upload certificate?Here's my step:1, Click on Jamf Account and input my Jamf ID2, In this step, I don't know where used to upload certificate?  Thanks,

Hi All,  We've recently been sending some old machines to a reseller. Before sending these machines out to the reseller, these are removed from ABM and then removed from Jamf.  However, our reseller has gotten in touch and told us that they are still seeing the odd machine in Apple's master DEP enrollment database. just wondering if we're missing anything and if anyone has an idea of how we can check for any other aspects of DEP enrollment. 

Team, is there a quick and easy way to export all recovery keys? Also, do we have the option to export this from smart group sorted details from Jamf Pro?

Does anyone have a script or something to remove Adobe Air from our Macs? Our past IT guy installed it on everyone's computer but we have no use for it anymore and I'd like to get rid of it. I haven't been able to find a script anywhere to uninstall Adobe Air.

We have a handful of users having Dock issues after updating from macOS 12.5 to 12.6.1. At login the Dock will take several minutes to launch or never appear at all. Sometimes a restart will bring the dock back, otherwise manually invoking a DockLib script will give it back. Has anyone seen this issue in their environment?

I have distributed Windows ATP for Mac like described here https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf It works fine, but the auto update of the ATP does not work. According to https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-updates And I run ./msupdate --install --apps wdav00 no updates are found - even I can see the all clients are not updated and have a "yellow" alert sign Anyone know how to add ATP so it will work with MAU?

Issue is, right now, prestage enrollment of iPads isn't working. The error I see in our Jamf cloud/Pro server logs is:2023-03-29 16:59:04,484 [ERROR] [duledPool-5] [ileAssignmentSynchronizer] - DeviceEnrollmentProgramException[responseCode=404, responseBody='PROFILE_NOT_FOUND', message='The DEP service reported an error.'] com.jamfsoftware.dep.comm.DeviceEnrollmentProgramException: The DEP service reported an error. at com.jamfsoftware.jss.objects.streamlinedenrollment.service.comm.DeviceEnrollmentProgramRequest.sendOneTime(DeviceEnrollmentProgramRequest.java:65) ~[classes/:?] at com.jamfsoftware.jss.objects.streamlinedenrollment.service.requests.AssignProfileRequest.send(AssignProfileRequest.java:34) ~[classes/:?] at com.jamfsoftware.jss.objects.streamlinedenrollment.service.requests.AssignProfileRequest.send(AssignProfileRequest.java:14) ~[classes/:?] at com.jamfsoftware.jss.objects.streamlinedenrollment.service.comm.DeviceEnrollmentProgramConnection.sendRequest(DeviceEnrollmentP

    I just want to share a quickie solution I made to address some complaints about enrolling Macs. Our setup has some policies set to install when enrollment is complete, but then others that install at the first check in. This usually means that there is usually a 15 minute gap after the EnrollmentComplete trigger before the first big bunch of apps are installed. Large installers like MS Office take a very long time to download and install. Techs usually are guessing when the enrollment is finally done. Sometimes they shut the computer down when there are still things to be run.  I know there are tools like DEPNotify that make the whole process transparent to whoever is sitting at the computer, but unfortunately I don't have the bandwidth to look into making that work for us. Here's what I did to eliminate that 15 minute gap and to let techs and users know that they may now begin using the computer.I created a policy called "zzzzz Check-in after enrollment" (the zzzzz

I seem to be having a problem with PreStage enrollment. I had 2 computers purchased recently and neither went through the process at all.The computers macbooks were purchased the same way as always. If I Open Apple business Manager and goto Assignment History, both laptops with the correct serial numbers are listed there. When I log into Jamf and goto PreStage Enrollments, and then goto scope, the devices are listed there. However, when the computers were first turned on by the remote employees, etc. Jamf did not kick in and I had to send the employees email invitations. Any ideas on what to check or troubleshoot? I don't think anything has changed.

Detailed step by step guide using Symantecs system extension as an example since that seemed to be most popular. Creating this thread for everyone to share new found knowledge, best practices & management tactics all in one place as we venture into a new Kext-Less macOS. WWDC System Extensions Keynote https://developer.apple.com/system-extensions/ Click Here for a Great Breakdown of System Extensions from Scott Knight To start, the best way I know of to obtain a list of system extensions that are present on the machine via terminal is the following command. systemextensionsctl list This command will produce the following information regarding system extensions. enabled active teamID bundleID (version) name [state] for a full example, using symantecs release for macOS 10.15, the following is populated Hugonaut$ systemextensionsctl list 1 extension(s) --- com.apple.system_extension.endpoint_security enabled active teamID bundleID (version) name [state] * * 9

(Hopefully) automate the remediation of sideways Falcon installationsBackgroundDuring the initial phases of our CrowdStrike Falcon pilot, we discovered a surprising number of sideways installations which were reporting the seemingly dreaded: Error while accessing Falcon service.ResultsIn less than 18 hours, we were able to reduce the number of sideways installations from 13 percent to well less than 1 percent. (This exercise also helped us to better detect sideways MDM enrollments.)Continue reading …

Hi All, I have setup a Jamf Setup and Reset configuration, and this works with removing the Microsoft login data from Safari, but...........the page is still open, and another user can get a "view" of a current page eg. portal.office.com, as soon as you try get to another page, it brings up the authentication page which it should.Is there anyway to close down Safari and essentially do a soft reset of Safari, and not just the Microsoft credentials. I know this can be done via settings, even if I have to use another app if possible. RegardsSimon

Hi, Does anyone have a script to enable the checkbox to admin password system-wide or configuration profile in Jamf Pro to get this done? Thank you in advance.  

We have started noticing a lot more issues with our iPads getting mdm commands towards the end of last week and today.  We did update to 10.44.1 around 9 days ago.  Inventory Updates, app installs, and profile install/removals will just be stuck pending forever.   We've restarted our jamf instance, restarted iPads, turned off caching servers (since we've had problems with app installs previously), tested on outside networks, but it seems to be the same no matter what.  Is anyone else having issues?  I'm not sure if it could be an Apple thing or maybe a 10.44.1 thing, or if it's something entirely different.Thanks!

Hello,I noticed that the EA that Jamf provides for Firefox patch management is probably buggy. Does anyone know how to fix this? Unfortunately, it does not really show what error is here.Thanks in advance!

Hi,I have built a helper daemon to request privileged operations on macOS, but the problem is that the user can use the launchctl command to unload my daemon. I want my daemon to keep running and prevent it from being removed by the user. So my question is: is there any way to prevent the user from unloading my daemon?Thanks 

spent 2 hours to figured out how to enable Okta extension for Safari, post it here if someone need it.  #!/bin/zsh # Safari Extensions File Path(my is macos 11.6): # ~/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions/Extensions.plist username=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'` cd /Users/$username/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions/ enabled=$(plutil -extract "okta\\.ExtensionLauncher\\.Extension\\.WebExtension (B7F62B65BN)".Enabled raw Extensions.plist) if [ "$enabled" = "false" ]; then plutil -replace "okta\\.ExtensionLauncher\\.Extension\\.WebExtension (B7F62B65BN)".Enabled -bool "Yes" Extensions.plist jamf displayMessage -message "Okta Extension is enabled for Safari, please quit and reopen Safari." else echo "Okta Extension already enabled." fi   

Folks,I'm a new learner of Jamf. When I explore I found that no option to check the device ownership in Jamf nevertheless the devices are enrolled via user-initiated enrollment unable to find it's COD or BYOD. Kindly help on this. Thanks.

Hi,We are migrating our iOS devices from MobileIron to Jamf Pro, and I'm looking for assistance on auto-configuring the Ivanti Secure Access Client app (formerly Pulse Secure) for our users.In MobileIron, we achieved the connection configuration via a VPN policy, which we then associated with the Ivanti Secure Access Client app. However, in Jamf Pro, I am facing a couple of challenges:I cannot find a sample PLIST XML configuration for the Ivanti Secure Access Client app to use in the App Configuration section within the Mobile Device App. Neither the suggested AppConfig Generator nor online resources have provided any examples.When trying to create a VPN configuration profile in Jamf Pro, I couldn't find a way to associate it with the Ivanti Secure Access Client app as we were able to do in MobileIron.If anyone has any suggestions or experience in resolving these issues, I would greatly appreciate your input:Is there a sample PLIST XML configuration for the Ivanti Secure Access Client

how spot on is the mass action update command for IOS devices (iPad) in jamf? ive been told its a known hit or miss issue - all else being equal, device is on wifi etc 

We just had a massive panic. We had the majority of our students Managed Apps vanish from their iPads for about half an hour. I think it might be to do with "Safelist and blocklist applications Supervision". We had it enabled a while ago to block Social Media and Games. We have the App store itself blocked but on a previous MDM students found a way to bypass this, hence we had the additional restrictions.Earlier two students were having an issue where they said that Gmail kept deleting itself every few days. I unticked the restriction on Social Media just in case somehow it was causing issues for the students' Gmail app. This should have relaxed restrictions if anything. But soon after students were coming to us in droves saying that they had lost all their apps from their iPads. I disabled the "Safelist and blocklist applications" restrictions entirely, then a few minutes later tried adding Apps to a different group and suddenly all the student apps came back, much to our re

Hello,Is it possible to prevent iPad users to remove JAMF profiles from their devices? iPads are enrolled through AC2 (not DEP). Users are able to reach the profile under their iPad settings and simply click "Remove profile". This is causing huge constrains in managing our iPad fleet.Thanks!

I have read in https://itwire.com/business-it-news/security/jamf-taps-into-azure-sentinel,-and-patches-more-apps.html that Jamf Protect can now integrate with Azure Sentinel. Is there documentation available on how to do this?

Anyone had to do this before? If so, mind sharing how you did it? When using the basic instructions from Splunk to install, a plist file is put (by the splunk service when calling an enable-boot command) into /Library/LaunchAgents which isn't going to work well for gathering logs from system.log when logging in as a standard user account, and in fact it fails to launch at all. Per some internet searches, I placed the plist in LaunchDeamons which seems to work but is causing some concerning login behaviors (delay, screen blanks out for 10 seconds, etc). Wanted to see if anyone had done this before and I'm just missing something about the "proper" way to do this. Before you ask why we'd want to install the forwarder on individual endpoints, let me just clarify that this is not my idea.