With the help of people on Jamfnation I created a policy to add users to the lpadmin group so they can add printers (though rather than adding "Everyone" to the group like I should've done, my policy runs at login, checks to see if a user is a member of lpadmin, and if they aren't then it adds them to the group). The people who asked for this then asked if there was a way to allow users to only add USB printers and not network printers. I'm guessing the lpadmin group is no longer going to be an option, but does anyone know an alternate method that might accomplish this?

We have "imaging" policies set to the root of jamf so all sites have access to them.We are using DEPNotify to manually call these policies. These policies are scoped to a group, but in some areas they do not need a few of the "image" apps to be installed. If I scope the policy for these apps to exclude these groups will it stop the policy from installing even its its manually called using sudo jamf policy -id that DEPNotify uses?

Is there a way to remove iCloud Drive from the sidebar without a 3rd party tool?

I have been looking around for some assistance on removing 2 lines from the hosts file. I would prefer a script as I need this done on 30+ MBP's, I did see a few scripts but the are adding entries not removing entries. Any help is appreciated.

I was able to get the Google Chrome Extension Blacklist up and running without issue, and it is working great. The second I block one extension, the students move on to another, so I am hoping to do the reverse and block everything and allow just a few. I thought that it would be an easy fix to change the key from <ExtensionInstallBlacklist> to <ExtensionInstallWhitelist>, but that isn't working. Has anyone had success with a specific script that you could share? I have spent time browsing the community posts, and most are from several years ago. Just for reference, this is the Blacklist Script I am using: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>DeveloperToolsDisabled</key> <true/> <key>ExtensionInstallBlacklist</key>

Hello,I am currently attempting to write a script to patch a Mac computer.This is my script:#!/bin/bash todayDate=$(date "+%d.%m.%Y") patchingLogFile=patching_"$todayDate" exec > /tmp/"$patchingLogFile".txt 2>&1 echo "Part 1:0 log file has been created" computerMacOSVersionFirstValue=$( sw_vers -productVersion | /usr/bin/cut -d. -f1 ) macOSVersionUpdate="11.7.2" if [ "$computerMacOSVersionFirstValue" == "11" ] ; then softwareupdate -R --fetch-full-installer --full-installer-version 'macOS $macOSVersionUpdate' 2>&1 else echo "Don't do the update" fi The problem I am getting, is that when I look in the log file, I get this return:Scanning for macOS $macOSVersionUpdate installerInstall failed with error: Update not found But if I run the code:softwareupdate -R --fetch-full-installer --full-installer-version 'macOS 11.7.2' 2>&1Then the computer will update with the intended version.I don't know what I am doing wrong! Can a scripting guru help me plea

I am curious to know how everyone deploys Apple TVs in their environments. I am finally seeing a downside of scoping a user to the Apple TV located in their workspace due to the fact the Apple TV seems to be trying to install applications that are not meant for tvOS, which is piling the failed commands of "App does not support Apple TV devices" a mile high. The user would be scoped an application meant only for iPadOS/iOS and under the Mobile Device App it is set to "Make Available in Self-Service", but still I see these errors. What is the best practice for scoping an Apple TV to a user that also has a iPadOS/iOS device? Do I need to exclude all devices LIKE "Apple TV" from each of my 500 applications? I hope I'm missing something here.

Hi Jamf Nation!I have a Mac studio that continues to crash and/or restart once it is enrolled. When removed from enrollment, the user says this issue does not occur, but every time we do enroll, the problem starts up. I have removed it from policies with restart payloads but not sure what would cause this to happen multiple times a day. Has anyone else experienced this? Thanks!~ G

Today we have seen constant JamfPro outages, As anyone else noticed these issues?

Hi, I am trying to figure out why my users are being asked to input their apple id when the phones are set up to be device based app assignment and not apple id. Anyone else come across this issue? Downloads still happen, it's just annoying for the end user.

UPDATING: This appears to be something with the Managed Configuration tab on the Managed App page that is failing, or possibly my editing of the mobileconfig in a way that messed up the identifier or other info. When using the example mobileconfig from the Wiki, and only editing the min OS version, deadline, and target OS, then deploying as its own profile, The -print-profile-config option Tribruin shared reflects the information from the deployed profile. I think that resolves this - now just need to review the options in the example and pare down to needed.  --Hello All,I am attempting to deploy and leverage Nudge in order to help non-admin users meet update deadlines after update approval in Jamf School. I am referencing this blog here, as well as a few others and the nudge documentation at the git repo. I have:- Deployed Nudge_Suite-1.1.10.81462.pkg to test device running MacOS 13.2.- Applied the following plist as a managed configuration on the app page in Jamf School, u

Hello Everyone,I am looking for a JAMF solution that can auto-login a local user after an unexpected reboot. I've seen this post and unsure if it will be useful or if it is a similar solution to what I am looking for. FileVault is also enabled and I've been told that this is not possible with FV enabled. For Context: I am using Mac Minis that are managed by JAMF, they have a hardwired connection 24/7 and are expected to run 24/7 as digital signage. The Mac Mini's will turn off occasionally without a reason after looking into logs. If JAMF Pro has a solution to run a script and push it to a device at the log-in screen, that would resolve the issue. Whatever information you can give me helps! Thank you in advanced!

I'm new to Jamf Pro, and I asked our on-boarding solutions expert on some best practices for creating User Groups in Jamf to limit access for our Tier 1 IT Staff, but they were not to helpful. Are there any good tips on what permissions to setup for a least privileged model within Jamf Pro for our IT Staff?Ideally a setup that goes from Tier 1 (least privileged) to Tier 3 (most privileged) in terms of what these users can get to and modify on the Jamf Pro settings side and what harm they can do to devices.  We don't want our Tier 1's to be able to wipe a device for instance.

Hello,My team and I are trying to release a new enrollment look for our greater team and we found that DEPNotify can really make it look good. Is it possible while depnotify is running to have a video come up and play? On the other hand is it possible to just have the depnotify screen toggle through images as it is running certain policies to give us the ability to share more information with our endusers.What we've tried:Inside the DEPNotify script towards the end after all the polices have completed it have the command -# Play the video file defaults write com.apple.QuickTimePlayerX MGPlayMovieOnOpen 1echo "open -a QuickTime\\ Player /usr/local/att/Mac_Welcome_Video_Test_3.mp4" >> /var/tmp/depnotify.logsleep 80defaults write com.apple.QuickTimePlayerX MGPlayMovieOnOpen 0We have also tried taking out of the DEPNotify script and gave it is own policy where it is called as the very last ticket item using the same script as shown above.  Thank you in advance for the

Since the self service update (updated on my M2 test machine today) my non VPP items in self service are generating false negatives "item failed" errors. Even a simple inventory update will generate a false negative. They execute fine but users will absolutely report these false negatives believing them to be actual negatives.  This doesn't appear to be true for all macs (seems to be fine on my intel) What are my next steps?Thank you 

We have an iPad that is not getting the options that iPhones have to register with Azure ADWhen we add an iphone it immediately gets the option to register with Microsoft within the jamf app on the device. However, we are trying to add an ipad device and it does not get the option to register with Microsoft in the jamf app. I was able to register it with Microsoft through the settings in the Microsoft Authenticator app, however, this is not the normal process and the ipad does show in Azure ad, but its compliance shows as n/a. Because the compliance shows as n/a, we are unable to connect the device to email and other Microsoft apps. Is there something that we are missing? The only thing that we can see causing the problem is that the ipad did not get the option to register with Microsoft from within the jamf app for some reason.

Over the past couple days, we have looked at adding the few PC's we have in our office to JAMF so we can use JAMF as a master inventory of all machines in our office,but have seen you can no longer use Recon.exe to this. Is their another way to add the PCs to our inventory?

Hello, For some reason pagination for above call is not working as expected.Issue: receiving 500 error for random pages.For example. I have 200 records, then I am doing 10 page size when I am on page 14 no issues, when I am on 15 page receiving 500 error, then I am on 16 page everything working as expected. Can someone help?

Error: An exception of class NilObjectException was not handled. The application must shut down. Scenario: I was uploading the following file, using Jamf Admin, and it failed every time: Install macOS Big Sur.app.pkg Fix/Solution: Rename the file, the extra dot is causing the error FROM: Install macOS Big Sur.app.pkgTO: Install macOS Big Sur app.pkg (REMOVED dot before "app") NOTE: This error and solution may not help you. Other scenarios could also cause this. Also tried (non worked): - Updating file through Jamf Pro --> Settings --> Packages --> New Package --> Upload --> would not upload at all- Updating Jamf Admin- Changing file permissions

Does anyone know how to uninstall LanSchool Classic programmatically?  There used to be an /uninstall command that I could send in a one-line script to uninstall in older versions on Catalina (possibly Big Sur).  The file path I guess has changed and it no longer works. I have tried taking the Uninstall.app provided in the original DMG, pulling it out, and placing it in the Shared user's folder to try and run that uninstaller.  The documentation all points to manually uninstalling it this way, but it fails to run due to Apple's Gatekeeper not being able to "check it for malicious software". I want to automatically uninstall (with a JAMF Policy) if the computer is no longer in the "Students" Smart Group. Thank you in advance.Dave W.

Wondering if anyone has a script that I can deploy via self service that will essentially allow a user to reset and remove all bluetooth devices?  I know that Monterey requires a script and Big. Sur still goes through the bluetooth module settings.  My fleet is mainly consisting of standard users. 

Is there a way via the JSS GUI to find whether you have a username in the system but no assigned Mac?I've only ever been told this can be accomplished with a MySQL search

Is there any functionality to allow a standard Admin password for a supervised iOS device? We have users that forget their self-set passwords on the Supervised devices. However, the Clear Passcode commands are not working because the device is locked and the WiFi/Cellular status is unknown. We need a better solution for this... Devices shouldn't be able to be bricked, even off WiFi. 

Hi all, Non-admin users cannot run this update. Is there a way to cancel/skip/run the update from jamf ?Re-packaging the app will cause user’s enrolment loss.   Thanks,

Hello Everyone,  I am having an issue with one of our technicians leaving Remote Desktop enabled. I thought that Jamf Pro would log the username of the Jamf user who enables it but the field is blank under management history. See attached picture. Is there a way through a smart group/script after so much time has elapsed that it would auto disable remote desktop?  Thank you!