Detailed step by step guide using Symantecs system extension as an example since that seemed to be most popular. Creating this thread for everyone to share new found knowledge, best practices & management tactics all in one place as we venture into a new Kext-Less macOS. WWDC System Extensions Keynote https://developer.apple.com/system-extensions/ Click Here for a Great Breakdown of System Extensions from Scott Knight To start, the best way I know of to obtain a list of system extensions that are present on the machine via terminal is the following command. systemextensionsctl list This command will produce the following information regarding system extensions. enabled active teamID bundleID (version) name [state] for a full example, using symantecs release for macOS 10.15, the following is populated Hugonaut$ systemextensionsctl list 1 extension(s) --- com.apple.system_extension.endpoint_security enabled active teamID bundleID (version) name [state] * * 9

(Hopefully) automate the remediation of sideways Falcon installationsBackgroundDuring the initial phases of our CrowdStrike Falcon pilot, we discovered a surprising number of sideways installations which were reporting the seemingly dreaded: Error while accessing Falcon service.ResultsIn less than 18 hours, we were able to reduce the number of sideways installations from 13 percent to well less than 1 percent. (This exercise also helped us to better detect sideways MDM enrollments.)Continue reading …

Hi All, I have setup a Jamf Setup and Reset configuration, and this works with removing the Microsoft login data from Safari, but...........the page is still open, and another user can get a "view" of a current page eg. portal.office.com, as soon as you try get to another page, it brings up the authentication page which it should.Is there anyway to close down Safari and essentially do a soft reset of Safari, and not just the Microsoft credentials. I know this can be done via settings, even if I have to use another app if possible. RegardsSimon

Hi, Does anyone have a script to enable the checkbox to admin password system-wide or configuration profile in Jamf Pro to get this done? Thank you in advance.  

We have started noticing a lot more issues with our iPads getting mdm commands towards the end of last week and today.  We did update to 10.44.1 around 9 days ago.  Inventory Updates, app installs, and profile install/removals will just be stuck pending forever.   We've restarted our jamf instance, restarted iPads, turned off caching servers (since we've had problems with app installs previously), tested on outside networks, but it seems to be the same no matter what.  Is anyone else having issues?  I'm not sure if it could be an Apple thing or maybe a 10.44.1 thing, or if it's something entirely different.Thanks!

Hello,I noticed that the EA that Jamf provides for Firefox patch management is probably buggy. Does anyone know how to fix this? Unfortunately, it does not really show what error is here.Thanks in advance!

Hi,I have built a helper daemon to request privileged operations on macOS, but the problem is that the user can use the launchctl command to unload my daemon. I want my daemon to keep running and prevent it from being removed by the user. So my question is: is there any way to prevent the user from unloading my daemon?Thanks 

spent 2 hours to figured out how to enable Okta extension for Safari, post it here if someone need it.  #!/bin/zsh # Safari Extensions File Path(my is macos 11.6): # ~/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions/Extensions.plist username=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'` cd /Users/$username/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions/ enabled=$(plutil -extract "okta\\.ExtensionLauncher\\.Extension\\.WebExtension (B7F62B65BN)".Enabled raw Extensions.plist) if [ "$enabled" = "false" ]; then plutil -replace "okta\\.ExtensionLauncher\\.Extension\\.WebExtension (B7F62B65BN)".Enabled -bool "Yes" Extensions.plist jamf displayMessage -message "Okta Extension is enabled for Safari, please quit and reopen Safari." else echo "Okta Extension already enabled." fi   

Folks,I'm a new learner of Jamf. When I explore I found that no option to check the device ownership in Jamf nevertheless the devices are enrolled via user-initiated enrollment unable to find it's COD or BYOD. Kindly help on this. Thanks.

Hi,We are migrating our iOS devices from MobileIron to Jamf Pro, and I'm looking for assistance on auto-configuring the Ivanti Secure Access Client app (formerly Pulse Secure) for our users.In MobileIron, we achieved the connection configuration via a VPN policy, which we then associated with the Ivanti Secure Access Client app. However, in Jamf Pro, I am facing a couple of challenges:I cannot find a sample PLIST XML configuration for the Ivanti Secure Access Client app to use in the App Configuration section within the Mobile Device App. Neither the suggested AppConfig Generator nor online resources have provided any examples.When trying to create a VPN configuration profile in Jamf Pro, I couldn't find a way to associate it with the Ivanti Secure Access Client app as we were able to do in MobileIron.If anyone has any suggestions or experience in resolving these issues, I would greatly appreciate your input:Is there a sample PLIST XML configuration for the Ivanti Secure Access Client

how spot on is the mass action update command for IOS devices (iPad) in jamf? ive been told its a known hit or miss issue - all else being equal, device is on wifi etc 

We just had a massive panic. We had the majority of our students Managed Apps vanish from their iPads for about half an hour. I think it might be to do with "Safelist and blocklist applications Supervision". We had it enabled a while ago to block Social Media and Games. We have the App store itself blocked but on a previous MDM students found a way to bypass this, hence we had the additional restrictions.Earlier two students were having an issue where they said that Gmail kept deleting itself every few days. I unticked the restriction on Social Media just in case somehow it was causing issues for the students' Gmail app. This should have relaxed restrictions if anything. But soon after students were coming to us in droves saying that they had lost all their apps from their iPads. I disabled the "Safelist and blocklist applications" restrictions entirely, then a few minutes later tried adding Apps to a different group and suddenly all the student apps came back, much to our re

Hello,Is it possible to prevent iPad users to remove JAMF profiles from their devices? iPads are enrolled through AC2 (not DEP). Users are able to reach the profile under their iPad settings and simply click "Remove profile". This is causing huge constrains in managing our iPad fleet.Thanks!

I have read in https://itwire.com/business-it-news/security/jamf-taps-into-azure-sentinel,-and-patches-more-apps.html that Jamf Protect can now integrate with Azure Sentinel. Is there documentation available on how to do this?

Anyone had to do this before? If so, mind sharing how you did it? When using the basic instructions from Splunk to install, a plist file is put (by the splunk service when calling an enable-boot command) into /Library/LaunchAgents which isn't going to work well for gathering logs from system.log when logging in as a standard user account, and in fact it fails to launch at all. Per some internet searches, I placed the plist in LaunchDeamons which seems to work but is causing some concerning login behaviors (delay, screen blanks out for 10 seconds, etc). Wanted to see if anyone had done this before and I'm just missing something about the "proper" way to do this. Before you ask why we'd want to install the forwarder on individual endpoints, let me just clarify that this is not my idea.

Hi,I forgot my Jamf Pro login password. How can I forget my password?Thanks,Trinh Tran

Hello all.What is the best naming convention to use for Jamf. We recently talked to a systems engineer, who stated that having the Serial Number in the name is not a good practice, from a security standpoint. That it is not good to have serial numbers exposed.What naming convention do you use for your devices in jamf?

I just wanted to know how I will be able to manage the app notification on macOS through JAMF. Like as SwiftDialog app is installed on my mac but I can see its notification is turned off by default in System Settings/Notification. I want to turn on for SwiftDialog and also its feature has to be managed for both type, banners and alerts, any idea?

Hi JAMF Nation We're starting to use JAMF in our business and so far, everything is working smooth. We have a special namingconvention for our Windows notebooks and now also want to mirror this naming convention to our Macbooks - so they would start with MBSMB**** (4-numbers) Is there a way to create a script that automatically sets the computername & local host name to that naming convention that also automatically counts upwards? So starting from MBSMB0001 and automatically counting upwards. Otherwise we'd have to manually type in the name for every Macbook. If this is not possible: what would be the easiest script to give that specific naming convention? I'm not very familiar with scripts at all, so I thought I'd ask you guys for help. :-) Thanks a lot. 

So none of our devices are prompting users to sync their passwords after they change it via IdP.  I checked the Jamf Connect configuration profile and it looks to have all the settings correct.  NetworkCheck is set to 15 and we have the Jamf Connect notification profile enabled under Settings>Computer Management>Security.Jamf Support told me it could be hidden behind the time and that i should click on it to look for the notification.  I had a device that updated the password days ago and when i click on the time there is no password notification there.Has anyone seen this?  Any way to force a password sync? EDIT - After messing around on my device right after posting this I have noticed that the Jamf Connect icon is not in my menu bar.  If i launch it and click Connect it then prompts me to sync the password.  Is there a way that I can have this app launch on boot and have it automatically logged into?

I configured the wonderful Support app today, and everything seems to be working the way I want it to, except for the custom logo I'd like to use (our institution's logo). I edited the image size down to 48x48, and put the file in the recommended location (/Library/Application Support/[our institution name]/[image file]), though the image will not appear in the Support menu on my test device. When I edit other features in the config profile, the changes take place almost immediately, but the logo has yet to change. Anybody familiar with deployment of this app have any pointers/ideas?

Lightspeed just released the newest version of filter agent that completely changes how it works based on Apple's system extensions. This is completely different from the way it worked before. If I were to update it via auto update it would give the users a number of permission prompts that they could decline. LS released some documentation for updating these permissions automatically via MDM but frankly the instructions are kind of confusing for a relative newb. Could one of you kind experts perhaps take a look at these instructions and boil down what I need to do? Thanks in advance!

I was curious to know how I will understand that if any app is creating any issue on my mac or to other app installed on my mac? Which log will help me to understand that this app is creating issue on mac or creating issue to other app running on my mac? Like as wifi log, system log, install log they do have their own purpose for administrator to let them understand what is done or going on. I need a solution like that. Any help will be appreciated.  

Hey all. I finally got a chance to refine this little Self Service app and it works great. User can now pick a folder to sanitize in preparation for moving to the OneDrive Synch folder. Still have a lot of non-compliant Mac users who need to get important stuff in the Cloud. The script we have now in production doesn't give the user a choice. It automatically runs on their existing OneDrive Folder, which is okay, but I would like users to be able to run it in advance before they even sign into OneDrive for the first time to avoid synch errors right off the bat. Before this gets into production, however I have two questions. How to best prevent a user from selecting any any folder outside their own home directory, where illegal character removal might break something. How to make it so this script also fixes illegals in the parent directory? It may not seem much to ask someone to fix ONE illegal filename manually after the script fixes the other 3,000, but I want to make it bul

Hi everyone, I am hoping someone might be able to help me out with an issue I just started running into. Also wondering if anyone else is having this problem.We have been using the built in "Software Updates" policy in Jamf for years now, and it has been working great for installing macOS updates for our end users. However, the last couple of months, something has changed where the policy no longer only installs security updates and feature updates for the current OS, but will force the device to upgrade to the latest macOS without any warning or prompts. This is problematic for us, as some of our users have software that has not been made compatible with macOS Ventura yet. The only way to downgrade from Ventura is to wipe the computer, so that becomes extremely time consuming and annoying for our users.Is this a bug with the Software Updates policy or is this now the intended design? If it is the latter, does anyone have a better way to run updates for the current OS the user is on, i