The DEP process where I work doesn't allow MDM Profile removal on some Mac devices.Which is fine etc....But currently after a Cyberattack in my organization my JAMF instance is offline.I need to remove the MDM configuration profiles as something in there is stopping our Trend Micro product from launching to configure its disk access, system extensions and so forth.I've booted into recovery, disabled SIP, gone into /var/db/Configuration Profiles, removed the files as suggested in a number of places online.They seem to have disappeared, yet the Trend application still refuses to launch to configure itself.I am completely stumped. Does anyone have any suggestions?On a machine that allows the MDM profile to be removed this removes the profiles and everything works as expected.They seem to 

We're using erase-install v.28.1 and in testing so far it's been great, really enjoying the new script and swift GUI.  I want to know if anyone else has used this or something similar in conjunction with a terminal command to delete the machine calling the script from Jamf.  In this use case, the machine in question has a Self Service button to initiate a Factory Wipe, and we would like to call --postinstall-command that essentially runs: sudo jamf delete_computer ID=XXX where the machine we're running the command from is the one in question.  I've tested a few 1 line commands in " "s and they work, but I've not tried including a small script inside yet.  Unless there is an already easy way to show the machine's ID in a single line, I figured it would have to be nested in a small script, I just haven't put down the time yet to test, curious if anyone else has already done this or something similar.

Is anyone else having problems with using the feature in JAMF Admin for "Install only if architecture type is".  It does not seem to work because it will not save the setting.  The behavior from the application is it lets you set the setting, save.  But then when you quit JAMF Admin and open it backup then open the same package you just saved the setting for it is not there.  Currently using JAMF v10.43.1

Good morning, I've been looking into ways to get away from AD binding and have had some mild success in testing the SSO extension with Kerberos. I've found that i'm successfully getting a ticket and the majority of functionality is working as intended. However, I for the life of me have been unable to get it to prompt me to sync my local password with my AD password. I've created a brand new local account, and signed in via my AD account to the Kerberos app. I've tried this in Catalina and Big Sur to no avail. I've never been able to get that dialog to appear. Anyone run into this and have any ideas on how to resolve?

Hey everyone,Having an issue with jamf app catalog installations. Some machines just seem to randomly not want to install the app. These machines are very similar, it's a computer lab, but one machine will install successfully and its neighbor will fail.My question is how do I investigate this further plus all I see in the console is that it failed with no real information and also has anyone else experienced this and was able to fix it

We recently set up our JSS instance to use G Suite for Single Sign-On, following these instructions: https://www.jamf.com/jamf-nation/articles/440/configuring-single-sign-on-with-g-suite-google-apps Everything is working well, except after a certain amount of time, the user starts getting SSO errors like this when attempting to log into JSS: "An error occurred while processing your Single Sign-On request. Contact your administrator for assistance." When this happens, it appears that the only way to fix it is to log out of Google and back in, which is not the ideal user experience. It also prevents us from being able to use authentication in the Self Service app, since there's not an easy way to force a Google logout inside of it. I haven't tested the exact timeframe, but I believe this occurs after the SAML Token Expiration (which is defined in the JSS as 480 minutes). I can increase this, but I'm not sure what the ideal setting is, or if increasing it would just postpone this issue

I'm trying to make things really simple for our users with a script that does quite a few things, including enrolling them into the JSS. It seems to me that the easiest way to do this is to push a script onto the computer, put a LaunchDaemon entry into /Library/LaunchDaemons, and force a reboot. Up to this point everything works fine. However, rebooting AFTER the script does its thing invariably fails. The system log says: com.apple.xpc.launchd[1] (mil.navy.spawar.sd.stage1[113]): Service exited with abnormal code: 2 The timestamp is precisely when the "shutdown -r now" command is issued in the script. The script's process does get shut down, but the computer does not get restarted, and I have no idea why. Does anyone have any ideas as to what I can check?

Hello,We have an issue where we have an old version of Sophos which encounters automated installment issues when encountering Ventura versions of MacOS or carbon chipsets.  In order to update the current 'SophosInstaller.pkg', do I need to manually create the new .pkg file?  I downloaded the current version of Sophos Endpoint Protection but there are no .pkg files in the zip.  Then I am reading that I need to create the package that contains all the necessary components and scripts.  Is this something I can find that is pre-created to mitigate the hassle of figuring out how to create the .pkg file myself? Thank you for any help!Kerry

using jamfpro with office 365 for mail/calendar/contacts syncing and using the built in mail/calendar app for apple iPhones. How do I go about seeing shared calendars. Is this a issue with the apple built in calendar app? Would we have to use outlook app to be able to see shared calendars?

Hi all,  Don't know if anyone observed this, or even care.Within JAMF inventory, any Macbooks running macOS Ventura will show random .0 to end the OS version number. Eg:13.113.1.013.213.2.0My observation is this is completely random. It doesn't matter if the Macbook is an old Intel, or the new Apple Silicon M1/M1Pro. It also doesn't matter if the Macbook was upgraded to macOS Ventura, or reimaged directly to macOS Ventura. The ".0" appearing at the end is completely random.What give? And does it even matter?I am thinking for the future, what happens if macOS 13.2.1 comes out, and I need to find all Macbooks 13.2 or older. Do I need to have seperate scoping because there's 2 ways to identify 13.2 & 13.2.0 ?

Hi folks, looking for a bit of help. I’m trying to update a custom extension attribute called "Lifecycle Status" for Jamf Pro Classic API by its serial number. xml = """<extension_attributes><extension_attribute><id>67</id><name>Lifecycle Status</name><type>String</type><multi_value>false</multi_value><value>Active</value></extension_attribute></extension_attributes>""" headers = {"Authorization": f'Bearer {token}', 'Content-Type': 'application/xml', 'Accept': 'application/xml'} res = requests.put(url, data=xml, headers=headers)res status from PUT is 409 error - "Conflict" : The request could not be completed due to a conflict with the current state of the resource You can get technical details http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.10

Greetings, My apologies if this has already been discussed, searching this is very vague and I haven't found exactly what my goal is. Essentially I have a policy I want to flush, but I only want to flush it on a specific group or smart group. I can't find an interface option for this, I would think an option inside of the "Actions" menu would be ideal (Feature Request?). Does this require a script that runs a jamf policy command? I've found in older discussions that you cannot flush a single policy from the jamf command line, only the JSS web interface.

We recently setup federated MAIDs using MS Azure. We have a group of users needing to use iMessage on their district iPhones. iMessage and FaceTime are allowed in the profile restrictions. iMessage is enabled in ASM. Toggle is grayed out on phones. In ASM users are listed as students, but are in fact staff. Any help would be appreciated.   

I am teaching myself jamf on the fly it's going well so far. I just have one burning question. When I go to Devices> Prestage Enrollments> Scope> View should this always be populated with devices? I am just wondering why once the enrollment process is complete why they would stay populated in that list.

We have a few labs with Ventura 13.1 installed and need to update to 13.2. Is there a solution that works that does not require signing into each system, passing credentials through jamf policies to the endpoint, or using a script needing api access ran from a jamf policy? I've tried multiple times to use the "send remote commands" feature and it comes up with nothing when it's all said and done. Under Monterey this worked pretty bad where about 50% of the systems would work each time but under Ventura thus far it's been zilch.Is this common for everyone else or has anyone experienced this and have some insight or fix?Edit: Felt I should elaborate more...the process needs to be done without signing in. When I do the remote commands I can see "AvailableOSUpdates - Scheduled" show up as a pending command. It eventually disappears and nothing happens.

How can we get a User Group started in our area? Thanks in advance!

I want my computer groups to list the computer name, username and last check-in.A while back a co-worker showed me how to list the username, it was some sort of global settingbut I can't remember where it was.Can somebody point me in the right direction to set it so that when I create a computer group it will display the computer name, username and last check-in.Thanks

I have a similar issue to this yet decided to create a new post to hopefully get some assistance.I'm new to provisioning Chrome and don't know the components. Keystone?Basically I created a Composer snapshot on a machine that never had Chrome. I then packaged it with only the Google related settings/folders and I get the error Chrome may not be able to keep itself updated. When I try to manually change the setting on client testing machine after install, I get update errors.I need help to get the Chrome may not be able to keep itself updated banner removed and allow Chrome to auto update for all users, and then provision latest Chrome to all JAMF clients with or without Chrome. I'm hoping to just change a setting file and push that file with the Chrome app.Any help is greatly appreciated.

Hello, I had a config profile in place to disable Find My Mac in all company Macs. This was working as the option was greyed out for all users. With the release of macOS Ventura, this is no longer working and the option is not longer greyed out, and has become clickable. Has anyone else encountered this? Thank you!

I have been testing the Intune registration with Jamf and ran into a bit of an issue.Trying to do the correct workflow for the end user (install company portal in one policy, Self Service to register)However once I start the registration process:Safari Openscert is downloaded (always allow)brings you to a Jamf Self service splash screen about registering a device, where you can select "Register My Device"At this point, Self Service opens and nothing happens.  I can click "Register my Device" over and over again, but it just keeps opening Self service and not completing registration.Not sure what is wrong in this process.  Any insight would be helpful 

I need to find a way to turn on the setting in Chrome:  "Always use secure connectionsUpgrade navigations to HTTPS and warn you before loading sites that don't support it"  Has any one tackled this before or know a command or plist to edit that will enable it remotely? Any help is very much appreciated.

I am teaching myself jamf on the fly it's going well so far. I just have one burning question. When I go to Devices> Prestage Enrollments> Scope> View should this always be populated with devices? I am just wondering why once the enrollment process is complete why they would stay populated in that list.

Hi all, Am trying to create a script to copy files from /Library/Shared/TeamsBackground to the User's Microsoft Teams folder. As a test case, i deliberately do not have Backgrounds and Backgrounds/Uploads folders in the User's Teams directory. When i ran the script, it just went to the last Else statement "Teams Never Ran". I know for a fact that the Teams folder ~/Library/Application Support/Microsoft/Teams exist. What am I missing? Thanks #!/bin/sh CURRENTUSER=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + " ");'` if [[ -f "/Users/"${CURRENTUSER}"/Library/Application Support/Microsoft/Teams/Backgrounds/Uploads/file1.jpg" ]] then echo "Already copied to the user's fo

I'm trying to send a notification to our users with SwiftDialog. I have set up the notification permission and deployed the mobileconfig with Jamf but it gives me the error "notifications are not available: couldn't communicate with a helper application".What could be the issue?

I am starting to hate macOS Ventura with a passion. Our users who are moving forward with Ventura are being prompted to login to their AppleIDs after they login to the computer. It's a Notification that pops up in the upper right,. The choices are to either click on the button in the notification that will take you to the AppleID login or you can click on the X... that also takes you to the AppleID login. We absolutely do not want our users logging in with their AppleIDs. I can't figure out how to stop this notification so I figured I could do a Config Profile that ONLY blocks access to the AppleID setting and/or the Internet Accounts setting. We are already using a config profile with the Restrictions settings configured. In theory I could just check the boxes to hide those, but we have a number of Macs that already have FindMyMac enabled and I really need users to disable that before I block their access to do so. So I thought maybe I can create a new profile in JamfPro that only con