So I was getting this error constantly on every machine.When I checked the Approved System Extensions, I noticed there was 'Allowed Team Identifiers' for a few Applications, one being Cisco AnyConnect. So I created a new Approved System Extensions policy and removed the 'Allowed Team Identifiers' portion for Cisco AnyConnect. As you can see in the NEW policy, the 'Allowed Team Identifiers' is gone. Question for clarity... I assume if the Team Identifier is already being entered within Allowed System Extension Types, it would be unnecessary to also add Allowed Team Identifiers. That option seems to be for applications that do not need System Extension or System Extension Types. Is this correct? After I removed the Allowed Team Identifiers in the NEW policy, I didn't see anymore errors... So for clarity, is Allowed Team Identifiers necessary, or can I delete that portion without causing any harm?

I have a fleet of Macs that are enrolled in Microsoft Endpoint Manager via the Jamf connector and Company Portal. Upon adding the criteria "Computer Azure Active Directory ID", "User Azure Active Directory ID" and "Conditional Access Inventory State" to Inventory Display, all Macs show their status for each of these criteria as "Not present" from within the Computers > Search Inventory page in Jamf Pro. If we look at the actual Mac inventory record, the attributes are visible with their correct values And again, when viewing the contents of a smart group, the attributes are visible too I would expect these attributes to all be visible from within a computer search from the Computers > Search Inventory page in Jamf Pro. Is anyone else seeing this? Am I missing something?

Is there any easy way to find out what different policies and configuration profiles a Static Group is scoped to? At the moment, it seems like you would have to check the all policies and profiles individually. If there isn't a way, consider this a FEATURE REQUEST.

We have 2 mac devices we want to trial in Jamf Now and wondered if we can use it for free as its under 3 devices but add on the Jamf Connect package ($2 per user per month) so we can use Azure AD logins?I wasnt sure if this was a package for one of the other bundles and wouldnt let you add it to the free package?

Hi all I am using API for the first time ever. The need to use API has crept up as I have discovered that apparently there is now the ability to flush a single policy for a single device by using the API protocols. It was apparently implemented in 9.96 - check it out here. Looking at the JSS REST API Resource Documentation, I have worked out that I can use it to obtain the necessary JSS IDs for a computer and a policy. However looking at the '/commandflush' aspect of the API, I just can't work out how I would get the specific policy for a specific computer to be flushed. Basically what I am after, is the ability to tell (or 'Put' in API language) for the status of a computer ID to be changed to 'Pending' for a particular policy ID. This is my early attempt of creating a bash script to achieve this.... #!/bin/sh jssAPIuser=[input a jss account] jssAPIpassword=[input the password] jssURL=[input your jss url] macName='systemsetup -getcomputername | awk '{print $3}'' policyName=[in

.

Just trying to run a script on machines that deletes all the garbage entries of printers that JAMF School has put onto systems while trying to manage/add printers in the JAMF Cloud web interface (which is actually a nightmare since there is no real documentation other than "just do this" and nothing is actually validated before it is pushed to systems).  Even though I removed the printers in JAMF, the printers still show up as local entries on each machine and I can also do lplist which dumps all the printer entries that were added to CUPS from JAMF.  I can also see all the printers in CUPS WebUI.Now, I just want to a simple bash script that is sent to each machine once to fully clear the printers so I can make one more push in JAMF as a clean slate for printers here on out.  Scripting Module is enabled and works(already tested).Here are two versions of a simple looping script I have tried to run - both fail:#!/bin/bash lpstat -p | awk '{print $2}' | while read printer

I am trying to add another user to our mac fleet using a script.  The script goes through without error and creates a user but no directory folder so when I attempt to log in as the "sub" it just spins and spins.  Here is my script....what am I missing?sudo dscl . -create /Users/subsudo dscl . -create /Users/sub UserShell /bin/bashsudo dscl . -create /Users/sub RealName subsudo dscl . -create /Users/sub UniqueID 1000sudo dscl . -create /Users/sub PrimaryGroupID 20sudo dscl . -create /Users/sub NFSHomeDirectory /Users/sub sudo dscl . -passwd /Users/sub becker

This is more of a heads up post… after talking with Apple support today I have found that there is an emerging issue regarding USB-C to lightning cables, MacBooks, and restoring iPads. If you find yourself frustrated, restoring iPads with such a combination…. Two things of note. The workaround is simply to use a USB A to Lightning cable. And the second point of note is to please call AppleCare. My case number on the issue is 101888762488. Please let them know if you are impacted because we need them to get this fixed as soon as possible. Hopefully this helps someone not spend a bunch of time troubleshooting their Mac, trying replacement Macs and different USB C to lightning cables.

If an iPad is turned off when the "unmanage device" command is sent and the device is marked as "unmanaged" will the JSS continue to try to contact the device for 1 day, 30 days or longer to remove all the profiles that came via the Prestage Enrollment and Configuration profiles? If the command is only sent for a limited time is it recommended that the iPad be turned on at the time of sending the "unmanage device" command?

Sending the Enable Lost Mode, Lock Device, Wipe Device or Unmanage Device commands do no good if the mobile device is not checking in with Jamf.  Until it checks in (which may be never), it continues to use a Jamf license.  I don't see a way to release the Jamf license without deleting the record from Jamf, which I'd rather not do (as then we no longer have a record of the device).  Or am I missing something? 

Hi, Our schools are purchasing a huge amountof iPads end of the year with the purpose in mind to lend them to students fulltime, until the yare leaving. One of the few restrictions we are bound to set (via law) is a content filter per DNS. Since they can take the iPads home with them they are not bound to the school wifi and we would need to set a global DNS entry. Is there a way to set the DNS globally? I've seen workarounds with scripts, but is this possible on iOS?

Hi,I'm testing MDM commands to force software updates (12.6.x to 12.6.2) It's worked well, but it seems that if you click on the countdown timer for the reboot, it stops the computer from rebooting. Does it stop it indefinitely? Will it install the update on the next reboot? And if not, do you send the command again? I'm only asking because I have a limited number of computers I'm able to test on and I'm just trying to work out the kinks before having to actually do this in the wild. TIA

At Jamf, we want to ensure you have the tools you need to meet your regulatory requirements relating to Privacy. As our portfolio of products continues to grow, we’ve updated our list of sub-processors which is publicly available in our Trust Center or by clicking here . If you have any questions about this change, contact privacy@jamf.com. For more information about our privacy program please see the following: Data Processing Agreement for Customers Data Processing Agreement FAQs Information Security Schedule Privacy Policy   All the best, Jamf privacy@jamf.com

getting the 503 service unavailable while calling the API after getting the token successfully. 

Is anybody here still running their JAMF pro instances on-prem? Our management is very anti moving things to the cloud.I am a super new Sys-admin for our Mac stuff and management has tasked me with researching what to replace our current hardware relating to our JAMF pro environment. I am having trouble finding super good data of how much hardware/specs we actually need to support what we have with some extra headroom.Management likes the idea of going VM for most of our JAMF stuff, but JAMF support seems is a little wishy-washy on if that's a good idea. I think they are really trying to push the cloud service (which I get). We're also running things mostly in Linux right now, but management has discussed going to Windows Server whenever we get new hardware.If any of you guys are still running JAMF pro on-prem, do you have any insight on how you have things structured, what hardware you are running, and how well it seems to run? Also you guys use any 3rd party applications to monitor y

Hey there, Does anyone have any experience with installing Adobe apps like Fresco, Reader, Photoshop, etc to a mobile device (iPad Pro)? I'm able to install other apps by adding them through VPP and scoping my device to them but with Adobe apps it doesn't work. The apps show up under Mobile Device Apps and it shows the license is used but they never show up on the device. I know that when installing on a computer they need to be packaged together but I'm not sure how it works with mobile apps.

Looked at dsconfigad hoping it would point upward to dsconfig.Looked at dscl which I think just lists them in alphabetical order.Looked at odutil which seems to only list connections and statistics. Any help appreciated.

I'm been running the script with success as long as the end user doesn't restart their mac before hand. I have a test mac on 12.3 and I deployed 12.6.2 via the script. I see in the logs that it selected 12.6.2, but the in the morning when I checked, the mac updated to 12.5.1. My question is, if the mac is older then a certain version, will it just update to the next big update regardless of selecting 12.6.2?

We've got Nudge working on a single OS level, utilizing the ever changing version numbers and continually updating the minimum version to be whatever the latest point release (12.6.1, 12.6.2, 12.6.3, etc)... it's been working fine.  Users even seem to not have as many problems as before...It can be labor intensive to continually maintain each major OS level in it (11.x, 12.x, 13.x).  is there a way to 1) combine all the OS's into one profile to manage and 2) have it auto-patch to the latest minor version (so for example, 13.0 updates to 13.1 automagically or 12.x --> 12.6.3)? I've been looking at the wiki page and trying out various options in the 'osVersionRequirement' schema, but nudge always reports that conditions are met.  I can go back to manually specifying but was hoping there was a simpler solution for longer term maintenance.  

Hello,I upgrade 100 MBP for Catalina to Monterey. After upgrade to Monterey, 0 printers and I need to re-install.someone knows why ? Thanks !

What do the different statuses mean on https://ideas.jamf.com/?I was looking at a number of different statuses and most are pretty straightforward but "In Ideation" is unclear to me.  What does that mean?Some other statuses I found are:In IdeationPlannedReviewedImplementedSubmittedNot Likely to ImplementDuplicateFuture ConsiderationNeeds more informationThere may be more. 

For some odd reason on M1's & Intel Macs especially on Monterey, when the machine is going through Pre-stage enrollment the machine just shiuts downWhen enrollment reaches "Applying Settings" it either shuts down or reboots. Both on Intel and M1.I have ticked & unticked all Config Profiles in Prestage but still the behaviour remains.Has anyone else had this issue? If so how did you resolve it?

Hello, we have a local admin account for troubleshooting purposes on our macOS systems. We're seeing that we can login to a small percentage of some of them. No error message, just the password field shake. These accounts are not setup manually, so we're fairly certain that the password is correct. Logged in from another user, we can run "dscl . authonly <USER>" and then enter the password for the account when prompted. If we enter a purposefully incorrect password we get:Authentication for node /Local/Default failed. (-14090, eDSAuthFailed)<dscl_cmd> DS Error: -14090 (eDSAuthFailed) If we enter the correct password we get:Authentication for node /Local/Default failed. (-14167, eDSAuthAccountDisabled)<dscl_cmd> DS Error: -14167 (eDSAuthAccountDisabled) So from here it sounds like the account was disabled somehow. But if we run:dscl . -read /Users/<USER> AuthenticationAuthority | grep DisabledUser it doesn't have it flagged as Di

Has anyone seen a situation where the Jamf Pro UI won't accept adding a computer or group to the scope of a policy or profile right away? It usually takes multiple tries before it is finally added to the scope. Here's a screen recording demonstrating the issue:https://drive.google.com/file/d/1n3y9p5Po9BqT29bsVnh0fpZbwI4uJUFK/view?usp=sharingIt's fairly intermittent, i.e. one day it will work straightaway, but on most other occasions it will take multiple attempts. I've also seen similar behaviour when trying to add a package to a patch policy under Patch Management.This smells like a PI or if not, something specific to our DB. We run Jamf Pro v10.41.0 on a Windows Server 2019 VM.