Originally this article was posted on Jamf Nation here, prior to the launch of Tech Thoughts. tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like iOS or iPadOS, where all configuration profiles and certificates are scoped to the whole machine. "Managed Users" A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways: First user created by Setup Assistant when machine is first set up via Automated Device Enrollment A user with administrator rights initiates a user enrollment via an enrollment URL or renewing the Automated Device Enrollment with a profiles command Mobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM. For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High Sierra For a configuratio

First, let me start off by saying you should never use basic auth for anything, anywhere, at any time.   Next, let me tell you why you need basic auth or “Resource Owner Password Grant” or “Resource Owner Password Claim” (if you speak Microsoft) or “Resource Owner Password” (if you speak Okta) or just plain old “password” (if you read the ancient runes of the .well-known/openid-configuration endpoints).  I promise you it’s a good reason.   What is ROPG The basic password flow used by Resource Owner Password Grant (ROPG) is literally an endpoint receiving a user name and a password and returning something to say the password is good, bad, or other. curl 'https://login.microsoftonline.com/12345678-9abc-def1-0000-000000000000/oauth2/v2.0/token' \\ -X POST \\ -H 'Host: login.microsoftonline.com' \\ -H 'Accept: */*' \\ -H 'Connection: keep-alive' \\ -H 'Accept-Language: en-US,en;q=0.9' \\ -H 'Content-Length: 295' \\ -H 'User-Agent: Jamf%20Connect%20Configuration/2606 CFNetw

Maintaining user accounts in Jamf Pro can be daunting if you work in Education. Depending on the size of your district, you may have over a thousand staff and students enter and exit within a three-month span each school year. If your district is one-to-one, that’s a thousand new user accounts getting created each year. If you aren’t doing user-based app assignments, maintaining users may not even occur to you, but there are benefits to cleaning up user accounts in your Jamf instance. If your Jamf instance is on-premise, you know an integral part of the instance is the database. If your instance is in the cloud, you may not be aware of the significance of the database. With any database, it’s important to keep it healthy. By healthy, I mean stable, efficient, and secure. Bad data in a database can lead to inaccurate reports or, in the case of user base app assignments, wasted app licenses. Bloated databases can result in poor performance or the need to continually tune your Jamf instan

I originally posted this article on the Apple@CVTC blog, and you can find out more about JPS API Wrapper on our GitLab project. As a developer or anyone that writes code, managing APIs can be a time-consuming task. You need to a lot of time figuring out how to send requests, retrieve data, and process responses. In this context, API wrappers come to the rescue. An API wrapper is a package that simplifies the use of APIs by providing a unified interface for sending and receiving data. In this article, we will be discussing jps-api-wrapper, a Python package for the Jamf Classic API and Jamf Pro API. What is JPS (Jamf Pro Server) API Wrapper? JPS API Wrapper is a Python package that simplifies the use of the Jamf Classic API and Jamf Pro API. It provides a unified interface for sending and receiving data, making it easier for developers to interact with the Jamf APIs. With JPS API Wrapper you can easily retrieve data on devices, software, and other assets managed by Jamf, and even pe

Is there a way that we can delete printer that user added? we have a open directory that teacher can pick what printer they want to add. now we have new system that only uses one virtual printer, and we already push that one using LPD. what we want to happen is to remove all printer that they add and only printer one printer will stay the one that we push.

Have apple school manager setup, and trying to deploy iMovie to a test MacOS.  Using Self Service and when the user clicks install it spins then comes back with an error saying "Cannot Reach Jamf Pro Server".  We are cloud hosted, I have tried the machine off the district internet incase a Firewall issue was causing it.  No luck,I am able to deploy a custom package of Chrome from the Jamf Cloud distribution point.  I also have tried xcode also another free app and it still gives me the error of "Cannot Reach Jamf Pro Server"Mac Store Apps do not install 

Hey all, Not sure if this is the correct place to post this but here we go:Long story short - I'm new to Jamf (actually our whole company is). Now we are trying to renew the "client certificate(?)" because employee's are losing connection to the VPN due to the cert being expired. Eventually this will become an issue for our employee's in other countries as they cannot come into the office to retreive a new one. At the moment it's only valid for a year (if that gives you an idea what I'm talking about) I've seen a lot of people mentioning this issue but I haven't found a solution yet. We are in an on-prem environment using ADCS with Jamf. Feels like there should be a way to automate this? Is our configuration wrong somehow? Not sure why the Mac's are able to retreive these without issues when enrolling them but not renew them? Every suggestion on where to look are highly appreciated! I would also like to mention that i'm not familiar with everything so please be pati

Hey Jamf people! We are having a weird issue with our GlobalProtect certificate deployments.  We have deployed the certificate to our endpoints 10 days prior to expiration to make sure we don't have any expirations (leads to p0 outages).  This time is weird though, as we can see successful config profile (containing the new cert) deployments to endpoints, but on their machines, they retain the cert that is expiring soon.  Whats even weirder, is that it does not happen to all people we deployed the certificate to.  Has anyone ever seen this issue?Lukas

Below is a screenshot of the Jamf School Profile/Settings interface.I am confused about how to do this overall. Is the idea that you basically create holistic settings that are all encompassing for a type of device, and you put all of the things and stuff in one, and only apply "one per device" or is the idea to be granular and only for example configure the WiFi, Certificates, DNS Proxy if needed, and that's it.If the idea is to be more modular, is there any type of guide that covers which policies can conflict in which case it's a race condition to determine which profile is applied if there are conflicting settings that would prevent the other profile from applying?If I had to guess it should kinda look like this.Modular profile 1 - Connectivity related settings only. So WiFi, Certs, and anything needed to get your content filter to work on the device. Beyond that, I don't know. How should these things be chunked up, or should it be that beyond the connectivity profile, that it

is there a possible setting that erases all stored data on a supervised ipad after a certain time period of lets say, two weeks?I'm talking about clearing the photos, documents, files folders as well as app-specific folders like pages or keynote, or even third party apps.I don't know if Apple itself even has a function like that integrated, but maybe the jamf function may even overwrite that?Thank in advance already for your suggestions!Max

Good day JamF Nation.Hoping someone can provide some insight.i have a site that I manage and we use authchanger to either disable JamF connect or enable.1 of the policies is set to reset the mac to default login and the other is to enable jamfconnect. This works on all devices, except 1. The policies run without error, but the policy isnt applying to the device.Make:AppleModel:iMac Intel (21.5-inch, Mid 2017)Model Identifier:iMac18,1OS:12.6Id appreciate some direction here as i am not able to identify why it isnt applying to the device

We are a Jamf Shop and Jamf (currently until our instance is updated to 10.43.1) does not have a native mechanism for managing com.apple.servicemanagement. Jamf deploys their own com.apple.servicemanagement payload to manage the Jamf apps however since the ability to manage Login Items was added to MDM we have been using a separate payload to manage our 3rd party login items.This has been working fine until macOS 13.2. Now we are seeing very inconsistent behavior where our managed login items are no longer managed. When I look at the deployment guide it seems like com.apple.servicemanagement allows multiple payloads. e.g. "Duplicates allowed: True—more than one Managed Login Items (com.apple.servicemanagement, com.apple.loginitems.managed) payload can be delivered to a user." Up to macOS 13.2 the behavior was that multiple com.apple.servicemanagement payloads were respected. https://support.apple.com/guide/deployment/managed-login-items-payload-settings-dep07b92494/1/web/1.0 I rolled b

Can we integrate RSA with Mac for login screen authentication when Jamf Connect is also already deployed?

Hey Folks,Curious if anyone has found a way to automate emails to users based on a Smart Group membership?   Examples of things we’d like to notify users of:Your internal storage is at XX% of capacity, here’s what you can do about itYour laptop hasn’t checked in to Jamf in XX days, please turn it onYour computer hasn’t rebooted in XX days, please reboot Right now, admins are getting emails from Jamf based on criteria we prioritize (eg: ‘storage almost full’), or manually checking Smart Groups once a month, and emailing the users directly.I know you can email group members via VIEW -> ACTION -> SEND EMAIL, but that’s a manual process, and we’d rather automate it. ## I found versions of this feature request on JN, and confirmed with Jamf that it's not currently part of the product in 2023.2016 post: https://community.jamf.com/t5/jamf-pro/alert-system-user-on-smart-group-change/m-p/1416392013 post: https://community.jamf.com/t5/jamf-pro/automated-emails/m-p/10530

Hi,I'm trying to get Jamf connect working with Google. We can connect and update the local password using the toolbar application, however when logging out of the device it will load a Google sign in window and when signing in to this it produces an error "Configuration is nil or invalid". Any ideas as to what I'm missing? Thanks

Has anyone been able to make a Code42 CrashPlan installer in Composer?  I'm trying to do that for version 10.2.0 of Code42 and it fails.  I notice that there are some Code42-related files that change after the installation is done, so I'm thinking that Composer might not be making an accurate "after" snapshot.  I can give more details if someone wants.  I'm  just wondering if there is anyone who has gotten this to work, and, if so, what they did to get it to work.  Thanks.  --Jeff 

We were testing our Apple Business Manager and Apple Configurator 2 enrollment.  We have a few MacBooks that were not added to ABM when they were purchased and need to be added via iPhone Apple Configurator2.  I was able to add the macbook into ABM but now when it gets to the Remote Management screen it gives an error stating  "Enrolling with management server failed. unable to connect to the MDM server for your organization. "Usually when we enroll a new mac and is on ABM this section has no issues connecting.  PreStage enrollment seems to be setup properly and never had an issue.  Is there a difference for the remote enrollment when the device was enrolled into ABM using Apple Configurator2?  Is this something to check on Jamf Pro or on ABM side?

We are excited to announce the launch of the Jamf Learning Hub, a one-stop-shop for all of our product technical content. This new resource provides a self-directed user experience, so you can access relevant technical product content at the right time and in the appropriate format, meeting you where you are at in your learning journey.   The Jamf Learning Hub includes a wide range of content, from “Getting Started” guides to advanced technical articles and training videos. Whether you're new to our products or a seasoned pro, you'll find something of value in the Jamf Learning Hub. This platform will replace docs.jamf.com to provide a unified and intuitive experience for searching and accessing all of our published technical product content, helping you be even more successful with Jamf. The Jamf Learning Hub provides: A single access point for product documentation and training content Improved search capabilities, making it easy to find what you need by providing the most rele

Hello,I am very new to JAMF and have an issue with Installomator, I am trying to use it to install several apps. I have created smart groups for each app one that will see if the package is up to date or not installed and another for the members of that group so I can use it in the policy.In the policy I have it set to deploy the app name that I found from the github package list, every app that I try to install this way fails and gives me an exit code 4 error;2023-01-27 06:26:32 : REQ : adobereaderdc : ################## End Installomator, exit code 4 Error running script: return code was 4.I am not sure what is causing this error for the packages I am trying to deploy, any help would be appreciated!?Thank you

Hello, I'm IT manager in a school with 1000 ipads.Many students inadvertently click on the "download all" button. It often saturates the ipad.It would be great if the button could be disabled in Jamf School.Thx.

Any youtube channels or website where I can practice and learn scripting or get practice scripts to run and see how they work. Thanks

Hello, We have an older version of Sophos in our install package which will not install for any device running M1 or M2 chipsets.  This has been patched by Sophos but I need to get our current Sophos installer updated.  After some research I determined this will be a two step process.  One step is targeting the 27 enrolled devices are are missing Sophos through a configuration profile and a Static Computer Group.  And the second portion is updating the install .pkg.  When I follow the directions from Sophos it says click the 'Filename' file that is a .pkg file and upload, and then do the same with a Manifest File.  After downloading the macOS Sophos installer it is 3 file folders and the only .pkg file in any of these folders or sub-folders is a file called InfoPkg.Pkg.  Am I supposed to just rename this to something like "SophosInstall.pkg" and upload as Filename?!  And should the manifest file be a .plist extension?  

I'm new to this so I'm sure I making mistakes. We recently setup Jamf and Jamf connect. Now users can log into their Mac using their AD credentials. When a user is added to Jamf our installer set Jamf up to convert that users from a mobile user to a standard user. The problem is that as a standard user if you open terminal and use the id command it will only report back local groups not AD groups. The users access to certain network shares is based off of AD groups. If I force the user to stay as a remote user then all their groups are retained. However if the remote user changes their password it does not automatically sync. I feel like I'm missing something basic. I would like users to be able to login with the AD credentials and have all their AD groups and be able to change their passwords and have it sync. If anyone can point me in the right direction I would appreciate it. 

Hey,I want to collect the information from our Mac Clients, if the automated software update check is enabled. The BASH Script for this action works locally on my Mac and I get the correct information when used in Jamf Pro as an EA. But all other Mac clients do not report anything back ... the Software Update is managed by a configuration profile, any ideas? Thank you! #!/bin/bash ########################################### # Check Status of AutomaticCheckEnabled # ########################################### AutomaticCheckEnabled=`/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled` LastDateCheck=`/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate LastSuccessfulDate` if [ $AutomaticCheckEnabled -eq 1 ]; then result="Yes" elif [ $AutomaticCheckEnabled -eq 0 ]; then result="No" else result="Unknown" fi echo "<result>$result - $LastDateCheck</result>"  

Hi all, I'd like to uncheck OTP for users (app: Yuibkey Manager) for users.  Otherwise, once touched, OTP will generate random numbers and bother users. Here is an ex: cccccbctnbhgchgnnrnhhlibtknenrceddfgjfndfifvGuide: https://support.yubico.com/hc/en-us/articles/360013714379-Accidentally-Triggering-OTP-Codes-with-Your-Nano-YubiKeyissue:  Any idea how to make it happen ?Thanks,