We've recently run into an issue where a user accidentally logged in to their personal Microsoft 365 account rather than the company account, which creates some data headaches as company files were syncing to a personal account. I'm trying to find a way to collect the Microsoft 365 and OneDrive usernames into an Extension Attribute so we can audit them, but I haven't had any luck. They don't seem to be stored in a plist anywhere, and I haven't been able to find a terminal binary that will report the login names. Any ideas? Thank you!

Hello, I inherited a Mac fleet that we use JAMF pro to manage. I work for an educational institution, and we have several labs that we have bound to the domain. The previous admin implemented NOMAD this past year and now we have an issue when users change their AD passwords. The new password on those lab system is not recognized, it doesn't not seem to sync to AD, so they have to keep using the old password. I found the configuration that the admin used for the Nomad settings in JAMF but in referencing different forums/threads there doesn't seem to be many settings set that relate to the NOMAD password behavior, I've never dabbled with it so I'm trying to figure this out on the fly. I just thought I would post this to see if my suspicion is correct and for some kind of direction. below is the plist that we are using. thanks in advance  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1

Hello everyone!I'm trying to update our Mac in JAMF Pro (Cloud) to the latest MacOS versions and I'm seeing a lot of computers being Supervised: No and missing our management account in Local User. The funny thing is, they are checking in and inventory updates but I can't seem to send commands or even try to re-enroll through API, I get 401. How can I re-enroll them to have the management account back in and without them to wipe and re-enroll. There must be a way to re-enroll without impacting the user ?

I wanted to be able to have quick way of finding all of my managed Macs with a T2 chip. I made a smart group that tracks by model and it seems to work well, but I don't know if there's a way to use an extension attribute to query each system for the presence of a T2 chip. We can do this with the processor architecture. Can we do this to detect a T2 chip?

Title pretty much says it all. I have my own mac to be independent of my main organisation. On it I work on documents from many organisations some of which are confidential. My (very helpful) mac support says that JamF is take it (so my organisation have access to my machines, including apps, files, and the ability to wipe it) or leave it (and not have access to email/calendars, etc).I've asked whether I could be administrator for my own machine (and only that one), but it's a no go, apparently.Any guidance anyone can offer on what I'm getting into if I accept would be really appreciated.

I have paired my Yubikey with my mac. Pin has replaced my system password.I want to check the certificate expiry date in Jamf Inventory. I do not see the concerned certificate in Jamf inventory/computer/certificates !! I do not see the Yubikey certificate in my keychain either !!Any idea where the cert is stored ? How make it visible in Jamf ?

Hi,We've a number of Intel and M1 Labs Mac's that are running macOS Monterey for this academic year, at least so we'd planned ... They were updated to 12.6.1 to allow maximum deferral of Ventura, which is of course coming to an end imminently ...Testing various options, using Jamf's Restricted Software feature:On M1 Mac's we're seeing that you have to be logged on to and authenticate as Local Administrator to proceed with the updateHowever with Intel Mac's this simply isn't the case, even with the Restricted Software setting in place, a standard user can simply instigate the update, without any issue Might anyone know if I am doing anything wrong here? Or is this simply as it is? As if it is, this could present a potential issue in our Labs ... Thanks for any input / advice   

Hello Friends, I have a script which will run on mac and pop up will appear to enter your host name. Issue- I-  am getting this error (Script result: 37:45: execution error: System Events got an error: Application isn’t running. (-600)Rename Successful), how to solve this? Actually pop up is not appearing but if i use, sudo jamf policy then i am getting pop and able to rename Issue -2 -  how can i add one logo on pop up? Script#!/bin/bash#Freddie Cox for Knox County Schools#Edited by Justin Ellis#2012ComputerName=`/usr/bin/osascript <<EOTtell application "System Events"activateset ComputerName to text returned of (display dialog "Please Input New Computer Name as LT with asset number of the laptop EX-LT1234, Asset number can be found on bottom of your laptop" default answer "" with icon 2)end tellEOT`#Set New Computer Nameecho $ComputerNamescutil --set HostName $ComputerNamescutil --set LocalHostName $ComputerNamescutil --set ComputerName $

Hello, I am trying to deploy a script that will ask users if they've filled out and submitted their time sheet. If they click Yes, the message goes away. If they click No, it launches Safari and brings it to the front. I can get it to run on my machine just fine, but when I try to deploy it via Casper Remote or a policy, I get an error saying that "<" is an invalid character. In the very short script, I've quadruple checked, and can't find a < character at all. Can anyone offer any help as to what's going on? For reference, here's the script (website it goes to has been changed for privacy): display dialog "Have you completed your timesheet?" buttons {"Yes", "No"} default button 2 if the button returned of the result is "No" then tell application "Safari" to open location "http://google.com/" tell application "Safari" activate end tell else nu

Hello guys! I'm new to the community and kinda new to jamf pro itself.Could probably someone assist me with the next feature implementation.We have 2 local accounts created by a policy for our macbooks (besides the end-user's). They are: LAPS configured with this script and a local admin with a company admins shared password.Filevault enabling policy is now configured to Apply Disk Encryption Configuration, Default Filevault Policy, Requires fv2 At next login. This policy affects the scope of a Smart computer group with the next criteria:  FileVault 2 Partition Encryption State is not Encrypted.My question is: what's the bets way to activate FileVault for laps and the second local admin without any end-user notification?Thanks in advance.

Hi Everyone, Just wanted to see if anyone had any success enabling HTTPS on macOS.All my DP's are macOS. On-Premise Jamf. I can see enabling Apache on macOS is straight forward but what exactly needs doing to the httpd-vhosts.conf & httpd-ssl.conf files. If thats correct? I did add another into the DMZ for external facing devices, as the majority are WFH.But the security team is questioning AFP or SMB through the firewall. My company will not go down the Jamf Cloud route, as they are limiting cost expenditure. Right now, I'm telling users to connect VPN first before using Self Service etc.

I have a user who is encountering a Jamf Connect window that will not go away.  There is no option to exit out of the window, it is also grayed out so he cannot enter any credentials.  I searched the forum for similar issues but couldn't find anything.  Has anyone encountered this?  I confirmed he is in the AD security group for Jamf Connect, and he is the first user to run into the issue.  Any advice is greatly appreciated! Thanks, Kerry 

Hello there,Newer Jamf Pro user, I've got a system of about 200 devices setup and running right now which has been done basically with user-intitiated enrollment, but now I'm getting ready for us to start rolling out pre-stage.What I would like to do, is once setup assistant finishes, and the user gets to the desktop, I want to push a message with a policy using restart options that tells them to not touch their machine for 15 minutes at which point the machine will restart. Thought process here is to allow the computer to do all the software installs etc, so they don't mess anything up.I was trying to do this with "enrollment complete" but what happened is that the message would pop-up right overtop setup assistant if they didn't get through it quick enough. So I'm trying to get it to wait until it hits the desktop. I tried using "login" trigger, but it didn't seem to work, it says it ran, but never showed up.I appreciate any insight you could offer. Thanks!

Hi, i am looking to deploy Velociraptor via Jamf and wanted to know if anyone had any experience with this? Deploying Clients :: Velociraptor - Digging deeper!Curious what steps were taken to deploy it. Any help is appreciated. Thanks

So I've looked through various posts but haven't seen an exact way to do this yet. We've got Crowdstrike deploying properly but have two machines return the error below. We tried to re-install Crowdstrike, but I think it's a bad install, and we might need to remove it entirely and try again. Script result: Error: This machine is already licensed I tried to craft an uninstall to do it, but it's not working the way we had hoped. Hoping someone might know a quick fix or a best practice for silently uninstalling the sensor remotely.

Hi all! Question: we are sending out a policy using jamfHelpers "fs" window and I'm pretty sure in the past one was unable to exit out of it entirely (which is what we desire) but recently, I've seen (and tested) that hitting "command-Q" actually works to exit the fs window. Sometimes the fs window shows up then disappears after a few seconds on its own. Is this normal and/or anyone has seen before? Just curious. Test machines are M1 on Monterey. Here's our script: #!/bin/bash # Variables jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" # Message prompt "$jamfHelper" -windowType fs -heading "Test" -description "Hello! Try exiting this window" -icon /usr/local/jamf/logo.png  

Happy 2023 from Jamf's Tech Thoughts team! We launched Tech Thoughts just a few months ago, and so far the response from the community has been incredible. We took a short hiatus over the holidays, but we're glad to be back and ready to kick off the new year with some new and interesting posts that we think you will enjoy. To kick things off, we wanted to take a look at where we've been and where we are going with Tech Thoughts. First of all, thank you to all of the Jamf employees and community members that have submitted posts, given us feedback, and helped to spread the word. We started this project with the idea to create a collaborative space where everyone can share ideas with the community, and we wouldn't be able to create that space without your help. We have some ideas for what types of topics and information that we might want to cover in the future, but we also want to hear from you about what you'd like to read about. Is there a particular theme, topic, or technology that y

We have to push a new certificate out to our config profile. We are able to push it out and it gets installed correctly as we can see it in our Keychain Access.  The issue is we want it to be trusted always.  How do we set that in our Config Profile to be set to trusted.  Just a quick warning, I am not great at command line statements, so the simplest and easiest is best.  Thanks

Just wondering if anyone has a list of the Abbreviations and its full name for the remote update managerSo we have it implemented as a script to download RUM and reveal to the user that a certain adobe app has updates available however when it prompts the user to install updates it shows in this format : (ACAI/0.5.3.1/macarm64)we know PHSP means Photoshop, IDSN means indesign but does anyone know of a full list of what all these abbreviations mean

So I'm hitting a wall with the last piece of my zero touch deployment.My organization is looking to begin deploying ~150 iPads each year to students. We've run a beta group and I've got the unboxing and setup experience all automated how we want where we just hand them the box and they're ready to go. My last hurdle is assigning the specific User in Jamf to the specific iPad they end up with in hand.For the Beta I just manually wrote on each box which student it would belong to and kept a spreadsheet with the the serial number/User assignments. Then after the devices powered on used MUT to bulk update the entries in Jamf to reflect the spreadsheet.Is there any way I can avoid having to write and keep track of ~150 names and serial numbers each year? It's not the end of the world but I'd like to eliminate as much human error as I can. Maybe there's a way the student can enter their User info when first setting up the device?Open to any recommendations!

Hey guys, hoping for a little advice as I think I'm missing something key here.We are a Jamf pro customer and looking at integrating SSO to be enable support staff to login to our Jamf portal using their enterprise credentials. We are also wanting to leverage Apple SSOE to allow our users to log into Jamf Setup using enterprise creds. This is currently in preview and requires Microsoft Authenticator.My question - The org prefers using Okta for IdP purposes - If we setup Okta as our IdP in Jamf to enable portal login, will we still be able to use Azure for device SSOE? Or, does Okta offer the same functionality for using the Apple SSOE?Even though it's in preview, the SSOE testing is quite handy for our use cases and don't want to lose that functionality if we choose to use Okta for our IdP.If federating with Okta blocks our ability to use the SSOE/Setup functionality would like to know so I can submit an exception for Azure.Thanks ahead of time.

Hi I have been testing the new Jamf Mac apps and I am loving it.Its working fine for some of the Microsoft apps I've been testing but strangely its not working for the Adobe Acrobat Reader DC Continuous.It seems to have installed on 10 machines but no more and these may have been logged into at the time.I have also noticed that if you are logged in when it fires up the silent installer you cannot restart the machine at all.If you try to restart you get the message the computer cannot be restarted because software is being installed.And the Acrobat DC installer box pops up at Running package scripts. But never goes' any further.Does anyone know where i can check the logs or any ideas why the installer is not working. Cheers all  

For older macOS versions when swiftDialog isn’t an option, leverage Jamf Helper to provide your users actionable messagesBackgroundFor computers running macOS Big Sur 11 or later, swiftDialog is our go-to tool for displaying end-user messages.For the less than double-digit stragglers we still have running macOS Catalina, a fresh deployment of Nudge-Python  seemed overkill, so we turned to our old friend jamfHelper and added some new racing stripes:Auto-terminate fullscreen mode (after a configurable duration)Auto-execute the specified action (when in fullscreen mode) Continue reading …

I am trying to troubleshoot why Zoom 5.8.3 installed fine but 5.8.4 is failing every time. I am pushing it out through Self-Service and it fails every time. I install it manually and it works fine but installing from Self-Service fails. I have tried both the Zoom.pkg and ZoomInstallerIT.pkg both seem to be failing to install from Self-Service. Anyone got any advice?   

Hi Is there anyone suggest me that how I can Implemenet 100% Zero touch deployment for mac devices for our on Prem Jamf pro instences. Is there any one here implement have that successfully. And also macs are bound to Domain to use their AD asccount. So we setup our LDAP server in Jamf pro. In this situation I need suggestion that if we want to integrate Intune with Jamf pro how that will Impact though we didn't integrate our Azure AD with Jamf pro. I know it is little complex but any seggestion is appriceable.