I have "AutoRenewTickets" set to "True" in our Jamf Connect config profile, but it doesn't seem to be automatically renewing the tickets. Do we also need to configure the SSOe payload or something? Alternatively, I'm just gonna set up a launch agent to renew the ticket but that's really more of a last resort. Thanks, Matt

I hope anyone in Jamf Support or in the community can provide some guidance since Jamf Support takes forever to respond...Objective: Install CA certificate to Mac's processed Pre-Stage enrollment. Problem: The configuration profile used to install the CA to enrolled Mac's works great for "User-Enrolled" Mac's. For some reason it is not working with Pre-Stage enrollments. The configuration profile should be available for distribution from the profile settings section but it is not available for Pre-Stage. Troubleshooting:- After Pre-Stage enrollment I signed in and out of the Mac computer to see if that would trigger the config profile to run on the computer, but no success there.- For testing, I changed the distribution method from install automatically to Self Service and that did not worked as well. Config Profile Details:- Profile is configured with a Level of "User Level".- Distribution Method is "Install Automatically".- AD CS Server Integration configured and worki

Not being a troll, just want to know the real world options for me here.I have about 20 devices in JamfNow, and its going pretty well. I dabbled in Intune and there is just too much going on there, and I run into more issues than not.That said, Im looking to commit to either going back full time to JamfNow, which is where this question came from. Is there a value to going to Pro if Now seems to be just fine?

Hello, do we have any other way to block major os update aside from using the configuration profile (restriction - > functionality then defer for 90days) and restricted software in JAMF? Is there a plist that we can configure and upload or maybe a script to block the OS update and stop it from checking an available update?

I'd like to create a new user via policy that is enabled for FileVault 2/has SecureToken. As noted in the Local Accounts payload, the "Enable user for FileVault 2" no longer works in anything beyond 10.13. After doing some digging, the only solution I have come across to do this is using sysadminctl to grant SecureToken to the account after creation. This is something I'd like to avoid if possible since it requires passing not only the credentials for a SecureToken-enabled admin through a script, but also the credentials for the account to be enabled.Are there any secure methods to achieve this? 

Hello all!We have been having an issue lately where machines will start their prestage installation process (policies, app installs, scripts, etc) that we run on first setup BEFORE the user is able to even log into the machine via Jamf Connect 2.Previously the user would boot the machine for the first time and it would go through language selection > warn them about Company MDM setup > ask for location > then prompt for a Jamf Connect 2 login. It would wait there until logged in by a user THEN begin the full 10-15 minute setup. It would finally end with a reboot and come back up to a local login and the user would be able to log in without issue because it created a local user for them during that 10-15 minute setup.Now, the setup will begin nearly immediately after warning them of the Company MDM setup (about the same time as it asks for location. If a user gets distracted and doesn't log in at the JC2, it will go through its install then finish with a reboot and come back to

Hi Jamf community. I've been having some trouble understanding if the following is even possible, so I thought I'd post here to see if anyone has any ideas or has tackled this in the past.I have an EA I created, which gets the expiration date of the machine 802.1x issued certificate. It converts the expiration date into a "Jamf friendly" format, such as 2023-08-10 10:05:00. It reports that (if found) as the result in the EA.The problem I'm having is, I want to build a Smart Computer Group that uses this information to show me any Macs that have these certificates that are going to expire in say, 30 days from now. I can't seem to use any of the built in date operators to make this work. Neither the more than x days ago or less than x days ago criteria will give me what I'm looking for. They seem to only work properly with dates in the past and not ones in the future. And the before (yyyy-mm-dd)and after (yyyy-mm-dd) options wouldn't make sense to me it seems, since these would be consta

So I'm distributing app via Policy + Package, but I'm not sure how to "enable" the option to install such app only when the user wants to, so something that people can click as "available to install", not mandatory installation that all pc get.

HiI'm looking at maybe using Jamf Connect, with our Okta environment.So if i understand this correctly, during a login process for a user, they would turn their MacBook on, already be connected to their wifi, and just login using their Okta creds.Our Okta environment is configured to only allow login from trusted IP's (e.g our VPN)How can our users login using Jamf Connect, if the VPN hasn't been activated/enabled yet (e.g before the macbook login process has occured)Thanks

Hi folks,for a few weeks now we've been getting messages that the inventory has failed. The log looks like this:An error occurred while running the policy "Update Inventory" on the computer "xxx". Actions from policy log: Executing Policy Update Inventory Running Recon... Retrieving inventory preferences from https://xxx.jamfcloud.com/... Locating accounts... Locating package receipts... Searching path: /System/Applications Locating software updates... Locating plugins... Locating printers... Searching path: /Applications Locating hardware information (macOS 12.2.1)... Software update timed out after 300 seconds. The complete policy log is available in the JSS at: https://xxx.jamfcloud.com/policies.html?id=1&o=l Computer Info: ID: xxx IP Address: xxx Serial Number: xxx Can someone tell me what's going wrong? The inventory there for too long and then he breaks it off?Regards

Hi Jamf nationFor user level configuration profile to get applied, is required that the account is MDM-enabled User.We no longer bind our Macs to the active directory, instead we use local admin account with Apple SSO Extension for the connectivity to the AD.Using ADCS, we were able to deploy certificates in computer-level configuration profile and everything works smooth and flawlessly.As most of our users still have incorrect MDM-Capable user, is a reenrollment to fix this issue not an option for us.Did someone find any solution for fixing the MDM-Capable user?Any other ideas to fix this without reenrolling the device?

Hey folks, Im trying to create a Self-Service policy that will Disable or Enable the "Smart Quotes" keyboard feature in system preferences. When I run this code in my Coderunner app it works perfectly, but as soon as I load the script in the into a Self-Service policy I seem to have issues. The policies behavior looks good, popup comes up but the setting does not change. Any ideas? Thanks in advance   #!/bin/bash #Grab current logged in user user=`ls -la /dev/console | cut -d " " -f 4` #Check smartquote status currentstatus=$(defaults read NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled) #SwiftDialog Location dialog="/usr/local/bin/dialog" #DISABLES if [ $currentstatus = 1 ]; then $dialog --message "You are about to disable Smart Quotes" --icon "/usr/local/images/deepwatch-Logo.png" --mini --button1text "Disable" --button2text "Cancel" sudo -u $user defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false sudo killall Finder fi #

Hi there, We've recently migrated all our devices to jamf Pro from Meraki MDM. Our concern is because of how the jamf migrate tool brings devices into jamf Pro as user initiated enrolments that we are not able to manage local accounts the same way we would in prestage/ade enrolled devices. Is anyone aware of a means of getting control of the local user account that would make it possible for us to either delete or change the password of that account of the employee leaves? Since 80% of our devices have been enrolled in this fashion we'd be willing to use a paid solution as well.

Attempting to create a new package but stops at 99%I created a ticket, but no resolution. we started troubleshooting last Thursday.  Any ideas?

I am trying to set up JAWA (https://github.com/jamf/JAWA) to use within my organization for automated notifications to a Teams channel. We have an older Mac Pro we were going to use to host the RHEL server for JAWA. My organization's InfoSec department informed us they require this type of an application to be hosted by Azure for security and compliance purposes. I have not registered an application with Azure before, and I am also pretty foggy when it comes to certificates. I know it is a longshot as I would imagine JAWA is pretty niche, but if anyone has had to register an application with Azure before, or has successfully implemented JAWA in their organization I would immensely appreciate all the help I can get. 

Hi, is there a CLI from MacOS client to fetch the Room info under Inventory/User and Location/Room?

We're in the process of testing out Ventura. I updated from Monterey 12.6.2 to Ventura and keep getting AppSSOAgent error and it says quit or report. Our SSO is working, but this keeps coming up. Has anybody else experienced this error and have a resolution?  Thanks

Hi all,Has anyone had success using an Apple TV device on a touch screen monitor and gotten the touch feature to work? Looking to replace full blown PCs with Apple TV's for large touch screens that are used to display a webpage with different data navigable by touch.Any thoughts/successes you can share appreciated. So far all I have found out there is a bunch of "Apple TV is not a touch device" negative Nancy's. Hopefully some of you are creative and found a way.

Our setup has a generic local admin account to all enrolled macOS devices.We have a policy for FileVault that triggers on logout. I know this can be bypassed but the current workflow works for now until I can get my scenario to work.Our current fleet has encrypted and unencrypted devices.We also have a number of devices prepped, ready to be assigned and not yet encrypted. These prepped machines will have the local admin account and then get delivered to our assigned users. We use Jamf Connect's Microsoft 365 login to allow assigned users a way to create their local user profile.For the devices that are assigned and not yet encrypted, the assigned users have been canceling the encryption popup to bypass the encryption process. Ideal scenario:Do not enforce our FileVault policy to these devices that has not yet been logged in by the end users.After an end user has logged into the device, it will create a local user account which will not have administrator privileges. At this point

I have a room of M1 Mac Minis used for a Digital Art/Printing lab. The instructors like to use a plug-in that has not yet been updated to run natively on Apple silicon, so to use the plugin the students/users have been finding the Adobe Photoshop.app, getting info, and ticking the Rosetta box manually... nearly every time they go to run the app (the user account is removed upon log out and refreshed via script).I'm curious if anyone has any experience managing these settings. They appear to be set in a plist file in the user's Library folder: ~/Library/Preferences/com.apple.LaunchServices/com.apple.LaunchServices.plist; but I have not had any success trying to manage this with a custom config profile in Jamf, nor does dropping the preconfigured file into place during account creation keep that box checked.

Hi, Can anyone help me to provide the latest "SetTimeZone and SetTimeServer" Jamf script? as their old scripts are not working in M1+Monterey OS. Scripts are executing without any error but Time Zone>>"Set time zone automatically using current location" tick is not not enabled. 

Hi, I'm running a script from Jamf that pulls a gitlab repo then executes a script from said repo that installs some packages leveraging brew install. The script works nicely on the intel laptop but not on M1The error showing in Jamf should the script executed other parts of the script but fails when calling brew.install.sh: line 10: brew: command not foundIf I run sh install.sh locally via terminal it works well. If I run brew in either bash to zsh it finds the command.What could be occuring differently when executing the script via Jamf Self Service that means it's completely oblivious to the brew installation?Jamf Script Snippet#!usr/bin/env bash #Get loggedInUser name loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name 😕😕 && ! /loginwindow/ { print $3 }' ) #Execute script under loggedInUser #sudo -u "$loggedInUser" ~/devtools/install.sh #!usr/bin/env bash ############################ # installs homebrew packages # i

Hello all,I am having issues with the Okta Browser Plugin Chrome extension settings. When you open the plugin settings, the option "Disable browser password prompts" is toggled on and greyed out with the message "This feature is not available because your privacy related settings are managed by your organization or another extension". I want the users in the organization to be able to toggle this off but cant seem to find the cause of this blockage. I've spent hours working with Google Support and Okta Support trying to figure out what could be blocking this, iv ruled out both Okta and Google Browser Management and confirmed with Google support that none of my policies are blocking this setting.   I did some digging in the "Chrome://policy" json file and found this warning along with the Okta Browser extension ID "warning": "This policy is working as intended but a conflicting value is set elsewhere and is overridden by this policy."My next steps are to lo

I just joined a new company that currently uses a combination of Addigy and Meraki for MDM. After spending the last three weeks with Addigy, I can point to only one advantage over Jamf Pro. Addigy is more MSP focused. We can create multiple tenants to manage clients separately. In the past I have used sites in Jamf Pro for this and dedicated Jamf Pro servers for clients who are setup with Apple Business Manager. While I was being interviewed for this position, I made it very clear that I feel that Jamf Pro is the best solution and that I prefer to work with it over other MDM solutions. Today we have a meeting scheduled to discuss how the company will move forward with MDM solutions. I am strongly pushing for Jamf Pro. I would love some advice on how to convince the owners of the company to go with Jamf. I could learn to use Addigy but I feel that this would be a huge time drain when I already know Jamf Pro extremely well. What are some good points I can make to help convince them that

Do you deal with compliance on macOS devices? Have you reviewed the macOS Security Compliance project (mSCP) but have more questions? Have you heard about Jamf Compliance Editor?Great news, there are Open Office hours on Wednesday, Nov 2nd @ 2pm ET! Please sign up here: https://forms.office.com/r/erLkfc42xR