I am trying to figure out a Smart Computer group that can see which Macbooks have not registered with AAD yet and need to.The setup guide says to use a group for if the Macbook has the Company Portal app. Which is great for the first run but what happens if user ignore or it fails part way.I have come across this past on an EA, but it seems this should no longer be needed: Solved: Intune Extension Attribute - Jamf Nation Community - 211981I also like this idea but no mention of how the smart group was done: Solved: Jamf policy frequency every hour - Jamf Nation Community - 263626I see the items that Intune adds, such as Computer Azure Active Directory ID, Conditional Access Inventory State and others.But I can't seem to get a group that works to show me Macs that do not have those. It seems to want to filter off a value that would be there versus not existing.Thanks

I've tested with empty packages and our Apps Package, there are no errors, there are also no references to it downloading in the install.log. It will then install during a policy trigger, but when done via prestage enrollment, it just skips over the package.I've run out of ideas.

Many of our users are complaining about MFA fatigue on their Macs. We are a Azure shop and use Microsoft Authenticator. What could be causing the multiple MFA prompts per day all of the sudden and what would a solution be? So far we have thought possibly Jamf Connect is improperly configured. Or potentially adding the "Windows Accounts" Chrome extension since that is a requirement on the PC side. Any thoughts on this issue? 

This is probably a dumb question but I have not been able to find an answer.I was requested to remove an App which was purchased by a 3rd party and converted to a "dangerous" app. I am able to get the Bundle ID for the App but not the Name (IE: App Name "Keynote" would be Bundle ID "com.apple.Keynote.") When I type the name of the app in nothing related shows up. As long as I have the Bundle ID, can I substitute my own "App Name" and still have the App Restriction work?

I'd like to set a Configuration Profile or policy on my Mac mini servers to grey out or hide the Sleep, Restart, and Shut Down options on the Apple Menu (login window too, but I think I already know how to do that part). The purpose to this is to force someone to open a Terminal and issue a shut down or restart command which would ensure someone doesn't just click the wrong button. Is there a way to set this? it is for Mavericks 10.9.3. Thank you

Hi all, wondering if you can help, as I am at a loss as to why this is happening. We run jamf connect to sync our passwords with our AD accounts, and it is working fine for everyone except those running Ventura. For those on Ventura, it gives us an error every few hours saying our ldap password is out of sync and we must enter it, but when we try it gives en error on jamf connect: //ping.***.com/as/token.oauth2, ERROR: Unknown error. Message: grant_type is required, STATUS: 400Everything is working fine, we can get on our network shares, use teams and outlook fine, there is absolutely nothing wrong other than this error not disappearing. Has anyone seen this before and if so do you have a fix? I have updated to the latest version of Jamf Connect but that hasn't changed anything. 

I'll try to keep this as short as possible folks, promise. I have two issues rearing their heads around the corner:First being that devices that have been enrolled for some time now have suddenly started asking the User to login with Jamf credentials in order to use Self Service. This is happening despite the fact that the mobile device in question has been using Self Service just fine until this point. Second is a device that is showing within School Manager as Supervised and Jamf as Managed, is suddenly denying access to Self Service altogether. For a little bit of background, our team just swapped from on On Prem to Cloud last week. I know it's easy to just say it's an issue that may have occurred during migration but I'm not so easy to jump to that conclusion with confidence. Any ideas and insights as to how to resolve these issues would be greatly appreciated; especially if this continues to pop-up with other devices. Thank you

For some reason, you don't need admin access to install Java games, it just installs a .jar file that you can open. Is there a way to block .jar files from opening? 

Hi all, I have a application that is a DMG, and I have a license file that i need to drop into the users application folder. Any suggestions on the best way to deploy this app? I am not sure if using the built in payload in policy would be enough or to use composer? Any guidance appreciated. 

How To from Jamf Nation that has pretty much all the info you need to do in Jamf, but since we use Godaddy for our Certificate, there are some extra steps. https://www.jamf.com/jamf-nation/articles/115/enabling-ssl-on-tomcat-with-a-public-certificate All of these Commands should be done on a Mac in Terminal. Open the command prompt or Terminal. Create a folder on your desktop named "Certs" and navigate to the directory using the following commands: mkdir /path/to/Desktop/Certscd /path/to/Desktop/CertsGenerate a Private Key and CSR by executing a command similar to the following: openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.keyWhen prompted, enter the appropriate information. The certificate authority (CA) administrator should be able to provide the desired values for these fields. Ensure that you use a fully qualified domain name (FQDN), "[Your Jamf on prem URL]". Note: These values will also be used to generate a self-signed cer

I've seen three different values for FileVault recovery key: valid unknown invalid Valid and unknown are obvious, but how does a key become invalid?

Hi Everyone, We are having a really strange file vault issue here. We have some machines that encrypt with our config, everything looks fine then, out of the blue, the personal recovery will report as invalid and shows as invalid when I check on the client with fdesetup. Then sometimes, it will resolve itself. Ive even compared DB backups to see if the recovery key changes and it stays exactly the same. I hope someone might have some ideas because this could lead to some major issues. Thanks Dave

Hi there,We have some users who needed to run Mojave until recently. We went to upgrade them (all users are remote) and I noticed that every system running Mojave stopped checking in with Jamf on 8/13/22.We disable Admin access for end users and use either the Jamf Admin user or a policy to temporarily perform admin procedures.Unfortunately both of those options are not working (Jamf admin refuses password and zero policies in Self Service will work, they just error out).The last thing I want to do is ship the computers back in and manually wipe them and restore them. Does anyone have a solution for forcing check in on systems that seemed to have dropped off?

Hi all.Anyone have a quick shell script to rename computers by looking up the serial in a CSV file? Figure it should be easy to install a CSV on the computer and then run a script to rename?Of is there another easier way to do this? Why? I duplicated a renaming policy and then didn't remove "all computers" from scope, causing buggered computer names. It would be nice to not have to fix manually.

Retirement of selected ‘Legacy’ definitions. Back in February of 2021 we announced that we would be marking a number of Patch Management definitions as deprecated. This was quickly changed to adding the text of (Legacy Definition) in the publisher column of Patch Management due to the unintended consequence of the ‘Deprecated’ tag. Since that time we had been maintaining the Legacy Definitions in sync with new new replacement definitions, though we have recommended that customers use the ‘newer’ definitions in their Patch Management policies.We have now made the decision to formally deprecate a number of the legacy titles and remove them from the list of available Patch Management titles in Jamf App Catalog. This removal of legacy definitions will happen over time. The first step will be to change the text in the publisher column from ‘Legacy Definition’ to ‘Deprecated Definition’. Whilst the definitions will still be available for a short period of time in Jamf App

Hello!I'm trying to dream up the best method for our SRE team, who maintains our non-IT, product-focused, VPNs... to deploy the various VPN profile files out to all company machines. Without going through IT, so they can work during their normal hours (which are far greater than IT's current hours). And this allows them to manage the VPNs swiftly.They need to deploy a number of .OVPN files to a specific folder on machine. It looks like building a .DMG is a good way to do this if we want to use Jamf... but then I get a little stuck. I see through the API (Jamf docs here, great post here) that I can give the SRE team an API key that empowers them to push that file into our Jamf file repository. But... that still doesn't auto-deploy the file on-the-fly. I assume I could have a policy here, but policies don't deploy the .DMG every time it updates.Anyone have any nifty solutions here?

Hello, My users create shortcut icons on their home screen on the ipads from safari and then need to delete them and are unable to. This restriction seems to be enable as default as other configuration profiles restrictions on different scope are set to allow apps to be deleted and they also can not delete them. Is there a way to look at the global settings that seem to be locking down the configuration profiles?And/Or how do we check/change the ipads as supervised versus unsupervised?Thanks, TMAC

On Mojave, we deploy (lab) iMac using "kcpassword" method that auto login to an account upon enrolment completion which then runs DEPNotify to complete/start the initial setup. That same setup is not working for Catalina. Any help would be appreciated.

Hi All,I'm trying to use this script to determine if a Mac's uptime is 5 days or longer, then output results as "Yes" if so, and "No" if not. But when configured as an EA, it only gives the "No" result. What am I missing?#!/bin/bash# Get the system uptime in secondsuptime_seconds=$(awk '{print $1}' /proc/uptime)# Calculate the uptime in daysuptime_days=$(echo "$uptime_seconds/86400" | bc)# Check if the uptime is greater than or equal to 5 daysif [ $uptime_days -ge 5 ]; thenresult="Yes"elseresult="No"fi# Output the result in the correct format for Jamf Proecho "<result>$result</result>"

We have 150 managed iPads that are booked out on a lesson by lesson basis across school and we have 8 periods a day.  When students sign out of their device the user profile remains, and at the end of the day we have to delete every user profile on Jamf (via management command) to free up disk space, otherwise lessons will be impacted the following day.  The shared iPad settings are set to ‘number of users = 8’.  Also, students sometimes forget to sign out so we have to log them out as well.This is very frustrating as there isn't a blanket command for all devices to 'delete user profiles' and 'log out users' which would be a much more effective method for managing shared devices and way less time consuming. 

What is your opinion of Jamf? Do you like it? Do you hate it? What is its biggest weakness? Where does it excel? Who does Apple like most between Intune, Airwatch, and Tanium? How do end users benefit from Jamf over other support options? Pros and Cons. Who is better than Jamf?Interviewing for a position at my company and I am tasked with presenting Jamf. Specifically, I had the option to pick between W365, Tanium, and Jamf as my presentation.Any help would be greatly appreciated. I have enjoyed my research into the company so far and hope to get some real-world feedback from those who live it.Thanks in advance.

Hi All, I've been doing a lot of research on 802.1X certificates as we are looking to move away from AD-binding and move to a software such as JAMF Connect in the very near future. This has brought many challenges while researching, and I think I've just made myself more confused in the process. I'm a novice with networking, so please bear with me on that.  Here is essentially what I need to do: I need to have some way to authenticate with the network at the login window on non-bound machines. I've read that using a machine-based certificate with distribution via SCEP is the way-to-go in this scenario, which is fine at the logon window.Our security policies require that we have user-based authentication when a person is actively using a machine. So if John Smith logs in, John Smith's credentials need to be used to authenticate against the network, not the machine-certificate used at the logon window.  I read in Apple's documentation that you can use a Syst

A lot of my enrolled macs are not updating the user field. Its random but its really an inconvenience to have to update them manually.any command out there to update users and location field? when the field is not populated? My macs get named after user ID. We run a script to rename them and bind to AD based on LDAP userID.Again this is random as some work and others dont. Dont even know where to begin to look as to why.Im running latest but this happened before on all versions 9.x

Hi Everyone,I am wondering if its possible to allocating 5-10Gbs of storage of an device, to be allowed to used for updates,Thanks

Hello everyone,  I want to send an "Advanced Computer Searches" result to another team using Power Automate.Whatever I do, the email body doesn’t show the result I want “mac address”  Outlook result:  Any idea ?