I can see my managed preferences being targeted to the computers in their management tab but I can't find the preferences themselves anymore.

So i have noticed that over the last few weeks my 12.6.2 and 12.6.3 machines are getting the macOS Ventura Delta update not upgrade anymore. Is this correct? I found this when running my weekly softwareupdate -iaR command on my classrooms/labs machines to keep them patched. According to Appel an Jamf this should not be happening.  Did Appel release yet another bug? Or is this intended behavior and if ti is intended why only some of the machiens are doign this vs all of them in scope of my policy? While troubleshooting i ran this on a machine manually in terminal and it did it.  I forgot to check what the Software Update Pref pane showed before i started, will check a few more machines.

Hi all! We are looking for a way to reduce the sudo timeout period as recommended by the Center for Internet Security. The only solution we can find online is to manually edit with visudo and add: Defaults timestamp_timeout=0 However, we were hoping to script this task and not disable SIP if possible. Has anyone accomplished something like this or am I asking the impossible? Thanks,Jim

HelloHas anyone had any success in disabling WiFi and the WiFi menu. Configuring our Monterey build for our labs environments.Have found a script to disable WiFi but struggling to disable the WiFi menu.Have found a few config profiles on here but can't seem to get them working. I think there for older version off OSX.A config profile would be ideal if anyone is able to help. It would need to work on both intel and M1 Imacs.Thanks   

I'm trying to find Macs that have the Device Signature Error - computers where the certificate trust between Jamf and the endpoint is broken.  Anyone already have a good way to do this?  My thought was to make a Smart Group of computers with at least 7 days between the date of their last check-in and the date of their last inventory update, but I don't know how to get Jamf to compare those two fields.  Ideas?  Thanks!

Hello friends, So we are a very small team and I am very new to this admin role and we are realizing that we should have done this a few months back, but didn't do enough research at the time. So, excuses aside, here is the issue. We had our users upgraded to Monterey prior to Ventura releasing. We've deferred the updates for Ventura (per the following posts) as we haven't had the time to properly test things in our infrastructure. We also had turned off our forced system update policy that ran updates weekly.https://community.jamf.com/t5/jamf-pro/ventura-will-be-released-as-a-quot-minor-quot-update-bug/td-p/276218https://community.jamf.com/t5/jamf-pro/macos-ventura-update-major-amp-minor-update-deferrals-oh-my/td-p/276347We're still not ready for Ventura (getting a few things resolved, but have only had a couple accidental test cases).So we are sitting at a place where most users are running Monterey between 12.3 and 12.6, so if we turn the updates back on, majority of them

Hi all,Intune and Jamf Pro integration document includes: Important: You must exclude the User registration app for Device Compliance when creating the conditional access policy.  Would someone be able to explain which applications should be excluded from conditional access policies?Because there is no app called User registration app for Device Compliance in Azure.My second question is : What is the frequency of Mac's Intune compatibility check?Thanks

Hello! Just hoping someone can help me out here, I currenty work for an organisation that holds about 140 IMacs, Trying to do a more automated switch from Monterey to Ventura, I've noticed that Jamf Pro  has the 'Download & Install Updates feature' under management controls, I can send the command off and it will sit in pending commands for 5-10mins then just dissapear and do nothing... Any help would be great, or other solutions for a more remote Upgrade Path.... 

I am piloting Jamf Connect with Google as our IdP for some students in K-12. (with the hope of also doing staff)Currently if they forget their password, we need to reset their Google password, and then, as admin reset the local password on their computer.This requires physically having access to their computers. There's almost no point to have Jamf Connect if a password reset requires local login to finalize. (Further, after this process, it always requires the "verify" step... I think that's a different issue, but now some students have to type their PWs twice to get in.)Is this everyone else's experience too?  Seems pretty untenable. What would people do with a globally disperse workforce where IT can't physically have access to the machine?)Would Azure or another IdP handle this better?

Hi so a few apps that auto update are still asking for admin credentials. We have either VPP or Autopkg grabbing the latest version and installing. Even though the user is on the latest version of slack or whatsapp it prompts them with the "new helper tool" popup. Slack has only been a few users. Though yes we allow our users to use whatsapp and spotify. Even though they are on the latest we still get the popup. Any recommendations?

Hello,I been trying to remove local admin privilege for all users, but with an exception of two Local accounts. I was able to find a script from a previous post. For the most part it works, but one of the local admin account name has spaces in it. So when I run the script it takes in each word as a separate user. For example: if the admin account name is "The Admin" it would run as "The" as one account name and "Admin" as another account name. Not sure why the space is a delimiter. Any help would be appreciated!  #!/bin/sh adminUsers=$(dscl . -read Groups/admin GroupMembership | cut -c -18) for user in $adminUsers do if [ "$user" != "root" ] && ( [ "$user" != "The Admin" ] || [ "$user" != "secondAdmin" ] ) then dseditgroup -o edit -d $user -t user admin if [ $? = 0 ]; then echo "Removed user $user from admin group"; fi else echo "Admin user $user left alone" fi done 

Please tell me we're going to be able to suppress these and a million notifications aren't the future for end users:

I’ve been at my company for alittle over a year now, we have a bit of a apple environment with a fleet of iPads, some iPhones and apple TV’s. I have became the de facto jamf guy and throughout my tenure at the company so far attended jnuc 2022 (virtually) and completed the jamf 100 certification, I am now looking into the Apple Device support and the Apple deployment and management certification and then possibly jamf 200. Just wanted to get your insights to see if that is a good game plan (ps we have 2 test macs in our environment as well + a unmanaged Mac mini)

I was severely disappointed with Apple's new push to treat Ventura an "update" instead of an upgrade. Luckily I was able to block the upgrade on our Macs via Restricted Software and a Profile to delay the major updates for 90 days and it seemed to work very well until suddenly one day in December I started seeing lots of Macs appear with the new OS. I have not changed anything with the existing measures to kill and delete the Ventura installer, so I can only imagine that Apple changed something in the ASU mechanism to slip it through when Macs install Monterey updates. I think I can narrow it down to the 13.1 update. Now we're up to 50+ Macs running Ventura and I have no way to stop it from proliferating through our organization. It's worse than a virus! We aren't even close to being able to test all our apps and tools with Ventura.  Is anyone else out there having success at stopping Ventura from getting installed? 

I feel like I'm missing something fundamental about plist files and I could use a little education. I understand plist files are basically settings files with key value pairs so you can save/push configurations for the system and apps. What I don't really understand is how you would determine what settings are supported? For example, if I want to allow Microsoft Teams access to screen recording for all users; how would I know what key:value pairs are? I found JAMF's privacy preferences control utility, but is that showing me every option? Is it up to an individual app to publish it's settings somewhere? Does Apple publish there's for Screen Recording for example? I can find lots of how-to's on creating/editing plist files, but I think I must be missing something fundamental.

Hello all,I currently have an active ticket with Jamf pertaining to this infamous issue. Currently I have around 78 devices that have not checked into Jamf, and we suspect that are are more devices than what I listed that are impacted. I have tried several commands, such as sudo jamf reenroll -prompt, and removing the profiles, but they either error out or return with the same error. I have created an EA that monitors this issue, but, only four computers return with the MDM is broken error and the rest of the impacted machines do not return anything at all. It is a little frustrating, because I am worried that this issue might just keep reoccurring over and over. I was told that the best way to fix this solution is to wipe the machines whose MDM profiles cannot be removed, and I just really can't wrap my head around that, neither do I think that is the most professional solution in our case (since it impacts an educational environment). Does anyone have any more information o

For anyone who wants to put the Safari 15.4 updates for Catalina or Big Sur into Self Service:Catalina: http://swcdn.apple.com/content/downloads/38/11/002-79202-A_MMXLIHTSU2/nka279pyfdmd11tm36dds4jysecfq7b732/Safari15.4CatalinaAuto.pkgBig Sur: http://swcdn.apple.com/content/downloads/27/58/002-81938-A_JGLR6R7D8U/kfpfiwbr575oxwvs6quv4oova5gu6l6y0c/Safari15.4BigSurAuto.pkg 

HEy jamfnation we are having a major issue with clients not being able to mount the share 4 out of 5 times. I have been working with JAMF support and they thought it may be related to a patch but I removed that patch and I am still having issues. The system log on the client shows: Sep 18 11:03:40 ARNC02P904PFVH7 kernel[0]: smb2fs_smb_validate_neg_info: Server capabilities do not match Sep 18 11:03:40 ARNC02P904PFVH7 kernel[0]: smbfs_mount: smb2fs_smb_validate_neg_info failed 80 Sep 18 11:03:40 ARNC02P904PFVH7 mount_smbfs[81969]: smb_mount: mount failed to 10.40.34.26/CasperShareNBK, syserr = Authentication error Has anyone else run into this?

I'm going down the rabbit hole of fixing our devices that stopped checking in due to the invalid device signature issue that has been seemingly plaguing customers. I've had great success using Jamf API commands (jamf-management-framework) to get active devices re-enrolled and talking again.I have a sizable chunk of devices that I've marked as "Unamanged", to reclaim licenses from devices that may have fallen to the wayside. However, now that I know the device signature issue is a thing, I recognize that some of these devices could still be active and not actually stale.My plan was to send the API command to re-enroll to all the devices that are unmanaged. Based on a test, it appears that the re-enrollment just latches onto the exact same computer record in Jamf Pro, and it carries on with life.So on that note, how long do these API commands stay queued up before they time out or otherwise clear out? Or do they stay queued indefinitely?  Because my line of thinking right now is to

Here is the app configuration I have deployed for CISCO Anyconnect.  A user meant to move the icon and somehow ended up deleting it.I have since gone back in and specifically added their device's SG, however, the device never receives a deployment push.I assume I need to somehow tell JAMF the app is no longer on the device, and I remember this in training, but I have never had to use it in the field and now I need some help lol Below are the settings used, if anyone has any idea or sees anything I have done wrong please let me know.    

Hi!I have a MacBook Pro (16-inch, M2 Max, 2023) and a MacBook Pro (13-inch, M2, 2022) that did not let the user set up their own user in Setup Assistant. They went trough Setup Assistant and it never went to the user screen, and the only account on the computer is the Management Account which is set up to have the randomly-generated password. These computers are Prestaged with Apple Business Manager.My solution was having them erase the device, I delete the Jamf record, and they reinstall.  I'm wondering if anyone has any direction, since more M2s will be hitting out Fleet shortly as people upgrade, and I'd like to get to the root of why they are not being prompted to create their user in the Setup Assistant. Thanks!

Hi all, I am trying to get a macbook registered with intune, it was all working fine until last week and then we slowly started having issues with devices getting conditional access errors when trying to use outlook and teams. Looking into it, seemed to be that the issue is that the APNS cert for intune expired yesterday. However, we reupped that cert it is now all good, but I still can't get new devices to register with intune, and jamf is also being weird with Azure registration, as it says the device is registered with azure but the pop up requiring you to register it keeps showing up on the macbook. I can see the device in azure, but it never registers with intune. But then also I have machines that do show up in intune but users still getting the conditional access errors when trying to use teams/outlook! On the fresh built mac I have I get the Authentication for JamfAAD pop up but it never actually tries to sign me in. Anyone who could point me in the right di

I've got a package that JAMF installs with every Mac Startup. It contains a plist file and bash script which gets placed in /Library/LaunchAgents/. The Package was created with Composer. All works fine except I had to modify the script and create a new version of the package. Even though the package on the JAMF Distribution Share shows that it is the newer version (i.e., by the date modified and by the contents of the script), JAMF continues to install the older version. The older version no longer exists on the Distribution point, and I'm deleting it from the destination folders of the macs, but after each startup, the old version continues to get installed. I've even recreated the Package in JAMF, and recreated the Policy that deploys it. Is there a cache or tmp folder somewhere that I need to look for? 

Hi everyone, acutally I got the problem, that on FileVault encrypted Macs the input menu for keyboard layouts won't show up in the boot screen. The setting for the keyboard input menu is located in /Library/Preferences/com.apple.loginwindow with the key showInputMenu and a boolean value. If I try to set the value via defaults write, the checkbox in System Preferences is active and the input menu is shown in login window. BUT if the computer is FileVault encrypted, the input menu won't show up in the boot screen. Only if I set the checkbox manually in System Preferences, the input menu shows up in loginwindow and in boot screen. I tried Composer to evaluate which files are changed during clicking in System Preferences. The only valuable file is /Library/Preferences/com.apple.loginwindow. Does anyone have the same problems? Thanks in advice,Michael

Hi All, Our Adobe user base is around 300 and they do not have admin rights on their machines. I changed the deployment package to Self Service to allow the non admin users to install updates. If the users are already using the non admin Adobe Manager and then install the new Adobe Self Service one from Jamf Self Service, will this allow them to install updates with their non admin accounts. ThanksSimon