Hi everyone,I've set up a test PreStage Enrollment, where a local admin account is created. In addition to that account, the local user account that gets created during the Setup Assistant, is a standard account (we don't allow our users to be admins). Our FileVault 2 configuration profile is set to be enabled at login, which works fine for the standard user. The first time this user logs out and logs back in, the FV2 is enabled. However, that leaves the admin user, which is still not FV2 enabled. How can we remotely enable FV2 for this user, without the end user having access to the admin user's credentials and logging into that account, just to enable FV2?Thanks!

I'm wondering if there's the ability to apply a Mac's previous name as it is in Jamf, at the time it is reenrolled or as a post-re-enrollment process after it has been wiped and reloaded with a fresh OS.  Right now there is the ability to create a policy to run with the “Enrollment Complete” trigger and possess a Maintenance payload with the “Reset Computer Names” checked.Unfortunately though when enrollment completes, before the aforementioned policy has a chance to run, an inventory update is run (a built-in part of the enrollment process) which of course causes the Mac’s existing name in Jamf to be changed and overwritten to the default “iMac” name it automatically gets when installing an OS.By the time the above "Reset Computer Name" policy runs, the Mac’s name in Jamf has already been set to the generic “iMac” due to the forced inventory update at the time of enrollment.We currently name our Macs based on location (building and room number) along with the asset tag

We are trying to find a way to block the Freeform app on iPadOS 16.2 for our K12 District. We normally would use a Restriction Profile using the SafeList and Blocklist Payload but I do not see an option for that app. Does anyone have a script or way to block?

@pixeleyesltd We have 30 licenses of AutoMounter that we purchased through Apple Business. The app. distributes with no problem, but after maybe several weeks it stops working and I get an error message. At such time I have to un-scope, delete the app, and re-scope to reinstall to get the app. to work again. Has anyone else experienced this issue? 

When our Devices are wiped and setup for a new teacher the EDU Profile is not installing, thus Classroom will not show student devices online. I have had the profile installed on the device, but the moment we wipe the device the profile will not reinstall.  I have checked the Inventory Profiles / Mangement Configuration Profiles / and Management Groups  - Smart and static.  I have insured all the profiles are setup the same way.  same groups, etc. We are refreshing our teacher fleet of ipads and this is causing issues and making them unusable for classroom.

Is there a way to restrict End Users from viewing Profiles in Ventura?We usually block this on Monterey Macs, however on our test Ventura devices it appears to have been moved to Legacy Disabled Preferences:The only issue we have with people being able to see these is they can add profiles.

Wondering if someone could help me with Patch Management on Jamf Pro on version 10.42.1, Currently I am associating InstallAssistant.pkg's for the version i want to update to in patch management, i.e. installpackage.pkg for 13.1 from MrMacintosh's website and creating a patch policy to have it available in self service or force if not installed within 3 daysBut nothing is happening with either methods it downloads the package and does nothing with it. what would i need to do to make it actually install/update?

We’ve come across an issue with Cisco AnyConnect where the connection option we use (called client_installed_local) appears fine on Intel Macs, but does not appear at all using the same version of AnyConnect on M1 Macs. We’re using AnyConnect 4.10.04071.How our setup should work:User connects to the VPN serverUser is then prompted to choose options for connecting. Client_installed_local is the first option, and what the user will be choosing.This then kicks the user over to Azure MFA authentication.Once authenticated via Azure, the VPN connectsOther facts:The installer package is the webdeploy core vpn package, pulled from the predeploy package. I have been told we don’t need anything else.Our previous versions all used the webdeploy package. There is nothing special about these that I can see.Tested on macOS 12 and 13 on both the M1 and Intel sidesOlder versions ran on everything from 10.14 up to 11 without issue on IntelsHere’s what I’ve tried:Reviewing and implementing a Configurati

Hey guys, The management is thinking to move from Jamf Pro to Intune to manage our Macs, I've never worked with Intune before and would like someone who is using it to tell me about their experience : - Is it really good MDM for managing Macs?- Comparing to Jamf, which one is better?- Any downside of moving from Jamf to Intune?Hope someone can shed some light on these points.Thanks in advance 

I've read through a few posts already, stating to compress the pkg as a zip first, then upload to JAMF, but I'm having the same issue. When I try to install the package directly on the machine, it works fine. But if I install it from JAMF via a policy, it errors:The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.Not sure what else to try at this point. It happens on both Monterey & Ventura.

So I was getting this error constantly on every machine.When I checked the Approved System Extensions, I noticed there was 'Allowed Team Identifiers' for a few Applications, one being Cisco AnyConnect. So I created a new Approved System Extensions policy and removed the 'Allowed Team Identifiers' portion for Cisco AnyConnect. As you can see in the NEW policy, the 'Allowed Team Identifiers' is gone. Question for clarity... I assume if the Team Identifier is already being entered within Allowed System Extension Types, it would be unnecessary to also add Allowed Team Identifiers. That option seems to be for applications that do not need System Extension or System Extension Types. Is this correct? After I removed the Allowed Team Identifiers in the NEW policy, I didn't see anymore errors... So for clarity, is Allowed Team Identifiers necessary, or can I delete that portion without causing any harm?

I have a fleet of Macs that are enrolled in Microsoft Endpoint Manager via the Jamf connector and Company Portal. Upon adding the criteria "Computer Azure Active Directory ID", "User Azure Active Directory ID" and "Conditional Access Inventory State" to Inventory Display, all Macs show their status for each of these criteria as "Not present" from within the Computers > Search Inventory page in Jamf Pro. If we look at the actual Mac inventory record, the attributes are visible with their correct values And again, when viewing the contents of a smart group, the attributes are visible too I would expect these attributes to all be visible from within a computer search from the Computers > Search Inventory page in Jamf Pro. Is anyone else seeing this? Am I missing something?

Is there any easy way to find out what different policies and configuration profiles a Static Group is scoped to? At the moment, it seems like you would have to check the all policies and profiles individually. If there isn't a way, consider this a FEATURE REQUEST.

We have 2 mac devices we want to trial in Jamf Now and wondered if we can use it for free as its under 3 devices but add on the Jamf Connect package ($2 per user per month) so we can use Azure AD logins?I wasnt sure if this was a package for one of the other bundles and wouldnt let you add it to the free package?

Hi all I am using API for the first time ever. The need to use API has crept up as I have discovered that apparently there is now the ability to flush a single policy for a single device by using the API protocols. It was apparently implemented in 9.96 - check it out here. Looking at the JSS REST API Resource Documentation, I have worked out that I can use it to obtain the necessary JSS IDs for a computer and a policy. However looking at the '/commandflush' aspect of the API, I just can't work out how I would get the specific policy for a specific computer to be flushed. Basically what I am after, is the ability to tell (or 'Put' in API language) for the status of a computer ID to be changed to 'Pending' for a particular policy ID. This is my early attempt of creating a bash script to achieve this.... #!/bin/sh jssAPIuser=[input a jss account] jssAPIpassword=[input the password] jssURL=[input your jss url] macName='systemsetup -getcomputername | awk '{print $3}'' policyName=[in

.

Just trying to run a script on machines that deletes all the garbage entries of printers that JAMF School has put onto systems while trying to manage/add printers in the JAMF Cloud web interface (which is actually a nightmare since there is no real documentation other than "just do this" and nothing is actually validated before it is pushed to systems).  Even though I removed the printers in JAMF, the printers still show up as local entries on each machine and I can also do lplist which dumps all the printer entries that were added to CUPS from JAMF.  I can also see all the printers in CUPS WebUI.Now, I just want to a simple bash script that is sent to each machine once to fully clear the printers so I can make one more push in JAMF as a clean slate for printers here on out.  Scripting Module is enabled and works(already tested).Here are two versions of a simple looping script I have tried to run - both fail:#!/bin/bash lpstat -p | awk '{print $2}' | while read printer

I am trying to add another user to our mac fleet using a script.  The script goes through without error and creates a user but no directory folder so when I attempt to log in as the "sub" it just spins and spins.  Here is my script....what am I missing?sudo dscl . -create /Users/subsudo dscl . -create /Users/sub UserShell /bin/bashsudo dscl . -create /Users/sub RealName subsudo dscl . -create /Users/sub UniqueID 1000sudo dscl . -create /Users/sub PrimaryGroupID 20sudo dscl . -create /Users/sub NFSHomeDirectory /Users/sub sudo dscl . -passwd /Users/sub becker

This is more of a heads up post… after talking with Apple support today I have found that there is an emerging issue regarding USB-C to lightning cables, MacBooks, and restoring iPads. If you find yourself frustrated, restoring iPads with such a combination…. Two things of note. The workaround is simply to use a USB A to Lightning cable. And the second point of note is to please call AppleCare. My case number on the issue is 101888762488. Please let them know if you are impacted because we need them to get this fixed as soon as possible. Hopefully this helps someone not spend a bunch of time troubleshooting their Mac, trying replacement Macs and different USB C to lightning cables.

If an iPad is turned off when the "unmanage device" command is sent and the device is marked as "unmanaged" will the JSS continue to try to contact the device for 1 day, 30 days or longer to remove all the profiles that came via the Prestage Enrollment and Configuration profiles? If the command is only sent for a limited time is it recommended that the iPad be turned on at the time of sending the "unmanage device" command?

Sending the Enable Lost Mode, Lock Device, Wipe Device or Unmanage Device commands do no good if the mobile device is not checking in with Jamf.  Until it checks in (which may be never), it continues to use a Jamf license.  I don't see a way to release the Jamf license without deleting the record from Jamf, which I'd rather not do (as then we no longer have a record of the device).  Or am I missing something? 

Hi, Our schools are purchasing a huge amountof iPads end of the year with the purpose in mind to lend them to students fulltime, until the yare leaving. One of the few restrictions we are bound to set (via law) is a content filter per DNS. Since they can take the iPads home with them they are not bound to the school wifi and we would need to set a global DNS entry. Is there a way to set the DNS globally? I've seen workarounds with scripts, but is this possible on iOS?

Hi,I'm testing MDM commands to force software updates (12.6.x to 12.6.2) It's worked well, but it seems that if you click on the countdown timer for the reboot, it stops the computer from rebooting. Does it stop it indefinitely? Will it install the update on the next reboot? And if not, do you send the command again? I'm only asking because I have a limited number of computers I'm able to test on and I'm just trying to work out the kinks before having to actually do this in the wild. TIA

At Jamf, we want to ensure you have the tools you need to meet your regulatory requirements relating to Privacy. As our portfolio of products continues to grow, we’ve updated our list of sub-processors which is publicly available in our Trust Center or by clicking here . If you have any questions about this change, contact privacy@jamf.com. For more information about our privacy program please see the following: Data Processing Agreement for Customers Data Processing Agreement FAQs Information Security Schedule Privacy Policy   All the best, Jamf privacy@jamf.com

getting the 503 service unavailable while calling the API after getting the token successfully.