Hey all, we have had an issue where about 653 of our laptops didnt renew their MDM profile when it was expiring.I'm now in process of re-enrolling them with the profiles renew -type enrollment command, however it prompts the end user to go a click install on their computer to complete the process.  Since we had them approve the ability for applescript to do keystrokes and mouse clicks perviously, I am thinking I could script the click of the update button in notification center when it pops up. I'm struggling to determine the UI element that is showing this button though.  Does anyone have any clues to processing the click of the update button seen here?  I always respect @mm2270 and their work, wondering if you have any idea if I can make it click this update button.

Hello everybody,i habe a strange problem: Since a few days apps disappearing randomly. They are not removed, because everytime i save (saving is enough) a profile of this device group the apps appear again. But not much later the next user complains about the same problem.I cannot say if it are always the same apps, but often the jamf apps "teacher" and "classroom disappears and also "Goodnotes". Did someone had this issue before and knows a solution?Thank you!Marius

We have Jamf Pro on-prem and are just rolling out Jamf Teacher. Our teachers only have 5 options within Jamf teacher (Clear Restrictions, Start Lesson, Restrictions, Applock and Weblock) and I'm wondering if we've missed a setting or the other Jamf Teacher features I've heard about are only available through Jamf Schools or maybe Jamf Pro cloud. Has anyone come accross documentation about what Jamf Teacher features are available with Jamf Pro on-prem?

Hey Nation :-)So here's a challenge for the scripting guru's...I'm trying to write an EA for getting the Design Capacity for a built-in Intel MacBook Pro battery.So far I have this script:/usr/sbin/ioreg -r -c "AppleSmartBattery" | /usr/bin/grep -w "DesignCapacity" | /usr/bin/awk '{print $3}'But this yields me waaaaaay too much info and the required awk value is on it's own new line right at the bottom.The body of the result output does contain the "DesignCapacity" value mixed in among hundreds of other values!So my challenge is... how do I get rid of all that extra value output to just have the final line output?eg:me@MacBookPro ~ % /usr/sbin/ioreg -r -c "AppleSmartBattery" | /usr/bin/grep -w "DesignCapacity" | /usr/bin/awk '{print $3}'gives this result:                {"PMUConfigured"=0,"FccComp2"=5050,"ResScale"=133,"SystemPower"=1051098690,"Qmax"=(5496,5497,5510),"DesignCapacity"=5103,"CellVoltage"=(4169,4169,4169),"PassedCharge"=26,"RaT

So, now the new iPadOS has the ability to view the wi-fi passwords on the students iPad. This is not a desirable feature for us. Is there a way to block the students from viewing the password?  Thanks

To install install-rosetta-2 and packages, create a; Script, policy, add package's, to do it after enrollment is complete. This will work on Monterey 12.3-Apple Silicon and all others macOS and Intel. Here are some screen shots. Hope this helps you on you way. this is a generalization if more specifics write.1) create your script 2) Create your policy3)Upload your install rosetta 2 sh4)Add all packages you need  

Hey folks, some news about MUT:It has been over 7 years since the first version of MUT became available, and in that time, the userbase and feature set have both grown drastically. What started out as a small learning project for me has grown into something bigger and more awesome than I ever thought possible. My life has also changed drastically in that time, and while MUT has gotten bigger and more popular, my time to work on it has significantly decreased.In the very near future, MUT will be moving from my personal GitHub repository to her new "fur-ever home" on the Jamf open-source repository on GitHub. MUT will remain open source and will remain available for download from GitHub. The App Store listing will also move from my personal Apple Developer account to Jamf's account. Both of these transitions will be seamless, and there should be no interruption in app usage for any current users of MUT.Jamf will continue to support MUT after the transition in the same capacity that they

A couple users upgraded to Monterey and got a notice that updated audio drivers were available in Teams. In other Office testing, I grabbed the standalone Teams installer and noticed this when running:Has anyone gotten an updated Distribution file working after expanding/flattening the package? Alternatively, the command line to use with the installer would help too.The audio driver is a separate package when I expand the main .pkg, but I'd like to avoid having separate packages in Jamf.

This community has been helpful for me in setting up Jamf in our small 40 person company, so I wanted to give back with a script you may find helpful. With the recent security and privacy issues around Zoom, our organization decided to ban Zoom from running on our corporate computers. SpaceX made that decision last week, and Google banned it as well this week. While we can add Zoom to the restricted software in Jamf, it doesn't remove all the additional cruft that Zoom leaves behind. It also doesn't uninstall the software right away, it only removes it when a user attempts to start the software. Zoom has an uninstaller built into the app, but it does not uninstall everything. I put together a script you can run both locally and as a policy on macOS devices. The script will report which files and folders it found and deleted after stopping the Zoom process and deleting the application. I recommend using this in addition to the restricted software in Jamf. This script to uninstall an

Hey My JAMF People! We've been noticing lots of issues with re-enrolled devices hanging on random VPP apps. So far 95% of the time if we delete a device record and re-enroll the device it fixes the issue. We're about to have a bunch of computers go through updating the OS to Monterey because they are a few versions out of date.I've packaged up a version of the Eraseinstall script by Graham Pugh that has a post install script baked into it to kick off the Erase install process automatically after running the package. I also have made a Self-Service script for our Field techs that makes an API call and deletes the device record of the computer that it is run on.My Plan would be to have a self-service policy to drop that Erase/Install package on the desktop and then have the techs run API call to delete the Device Inventory Record and then run the package on the desktop to actually perform the erase/install of Mac OS. What I am having trouble figuring out is getting a the p

Earlier this year a small group of passionate Mac Admins community members announced the formation of a new 501(c)(3) non-profit organization called the Mac Admins Foundation. You may have heard of it thanks to sessions at the PSU Mac Admins conference, the mention by Jamf CIO Linh Lam in the JNUC keynote this year, the MacSysAdmin conference session, in the Mac Admins Slack, or maybe even from seeing our popular VoiceOver shirt.   It’s been a fun journey getting the Mac Admins Foundation built and shared with the community, and we’re actively looking for ways to share what’s happening at the MAF. Conference presentations, social media outreach, and posts like this are just a few of the ways we want to stay connected with y’all. This week Co-Chair Tom Bridge posted our first quarterly update which provides news on the Training Scholarship program we’re working on (with the support of Apple and Pearson), the expansion of the board of directors, and upcoming initiatives for 2023 and

I know there are some topics and solutions to lock Profiles, but none of them are working right now to prevent users from removing MDM Profile and uninstall Jamf from the company laptop.May be someone can advise and help what is the solution for Ventura to lock removing MDM Profile option? We are not using ADE, thats why cant select option to disallow removing MDM. Please help guys. 

The following is a conversation between myself and Jamf, trying to get some more detailed information surround the Jamf Installer Preview. I hope this conversation is helpful to other admins who are exploring this new functionality.Me:I know that this feature is still in preview and more work is still being done before Jamf pulls it out of Preview.I've been communicating with other Mac Admins within the MacAdmins Slack Community regarding app installers and there was a little bit of confusion regarding some of the backend processes of how Jamf App Installers are being pushed down to end-user systems.I've read through the following links trying to dig deeper into app installers:https://community.jamf.com/t5/jamf-pro/jamf-pro-10-37-is-now-available/td-p/261726https://www.jamf.com/solutions/app-lifecycle-management/https://www.modtitan.com/2022/03/in-weeds-with-app-installers-preview.htmlhttps://www.jamf.com/blog/jamf-app-installers-faq/So my question presently, is if Jamf can provide eit

I'm looking to see if there is a way to configure Microsoft Teams notifications in Jamf, specifically the notification style.  For those unfamiliar, in Microsoft Teams, there is a setting where users can choose either the Mac APNS notification, or the built-in notification system in Teams.  To change this, click on the three dots next to your icon in the header bar in Teams, and choose Settings.  In the Settings window, click on Notifications, and select the Notification style.          I've scoured the internet to see if there is a way to configure the notification style within Jamf to deploy to managed Macs, and unfortunately I have not had much luck.  It appears Teams sets the notification style to "Teams built-in" by default.  In this case, I 'm looking to accomplish two things:1. Change the default notification style to "Mac" instead of "Teams built-in"2. Deploy the aforementioned setting in Jamf so that ea

Hello everyone, We have a really frustrating issue and so far nothing worked. We are moving from Intune MDM to Jamf MDM, but we are using Conditional access so the integration between Jamf and Intune must exist. The problem is that if you forget to remove the entries from Intune after resetting the device and you try to run the integration script you will receive an error, and from that point nothing will work.Steps to reproduce: Have an entry of an macbook enrolled with intunewipe the macos and add it to Jamf serverRun the integration scripCompany portal will opensign in with AAD usercomplete the steps on screen and you will receive an errorReset the logs for integration scripRun again the script and after finishing company portal steps "Authentication for JamfAAD" prompt will openA browser should open at this point, but nothing happens  What we tried so far:Change default browserDelete the entries from Jamf/Intune/AAD of the targeted device, Wipe de device and ret

Hi folks, just curious if anyone has come across an easy graphic matrix indicating the difference between Jamf Now and Jamf Pro licenses?Thank you!

Significantly enhanced Completion Action options help to provide your users a seamless post-enrollment experience when setting up their new MacsIntroductionSetup Your Mac aims to simplify initial device configuration by leveraging swiftDialog v2 (or later) and Jamf Pro Policy Custom Events  to allow end-users to self-complete Mac setup post-enrollment via Jamf Pro’s Self Service.Completion ActionsIn addition to the previous wait and sleep options, Setup Your Mac (1.4.0) introduces nine new Completion Action options (and you'll end up only using one). Continue reading …

It seems the value of the "Date Lost Mode Enabled" column in device inventory is incorrect in my Jamf Pro.The value of the device which has never been enabled Lost Mode seems to be the enrollment time instead of lost mode enabled.This problem happens on all 4000 devices in my environment. Is this a known bug?

We are seeing the expiration password counter. But some of our end-users see a -22 (for example) counter in the menu bar, or after a successful password change, there is a wrong number of days.How to fix it.

Hi there, I'd like to know if it's possible to configure smart groups in a way to apply a specific smart group ONLY when a device has just been enrolled. The issue we're having is Sophos Endpoint has 2 custom mobileconfig policies. 1 for MacOS Monterey and 1 for MacOS Ventura. I have a simple smart group setup that separates Monterey and Ventura devices Problem is, if someone were to upgrade their OS, their current Sophos installation will still be installed but the configurations for Sophos mobileconfig for Monterey will be removed and replaced with the Ventura mobileconfig. Since the configs are applying AFTER Sophos has already been installed this would undoubtedly break Sophos' permissions on the machine. Is there any way to have a smart group only apply immediately after enrolment and no other time? This is to make sure that when devices with Ventura installed have been freshly installed that they get the Ventura configuration only and not devices that upgrade

Hello everyone,I have created configuration profile, that has network pane and scep certificate pane.The network pane has all the settings for connecting to the 802.1x wifi and scep certificate pane is used for distributing the certificate to the system so that it could be used for authenticating the wifi .Now the problem here is ,everything is working fine except the prompt that we are getting to select the certificate for connecting the wifi .We should not get that prompt while connecting the wifi that is what I believe.Note : Our certificate is getting deployed on the system keychain and also when we manually select the certificate then we are able to connect the wifi network ,but the only thing is that we need to skip that certificate selection process.Any help would be much appreciated !

Hey everyone,Is there any good resources on how to setup/test Connect?I've confirmed that the Azure AD Client ID and tenant info are correct when using the Jamf Connect Config tool. It gives me tokens for OIDC and ROPG and shows successful each time. I also can confirm there is a login entry within Azure for the user.I read that it's best to have 3 config profiles pushed to the device: Connect, Login, and License.However, the license isn't applied and sign in is greyed out.Is there any best practices/guide that could be shared?

I already know that Jamf protect have Analytics for MRT but its not pulling any information on Antivirus. Does anyone have any custom Analytics for that? We have mix environment where different machine have different AVs and we want to find out if there is a way to tell if the AV is installed and which one.   

Can I have some help, please? I am using the google apps script and I wanted our URL for JAMF we wanted to connect with our username and password so we can auth to JAMF to help us get the data into the Google app script. I wanted to get some data from the app script I can use this data on google data studio, please? Thank you

I am fairly new to Jamf and inherited a system that someone else set up. I am looking for guidance with regards to Local Admin accounts.We have one account that is set up in Global > User-initiated enrollment > macOS. This works fine on enrollment.However, there is a second Local Admin account that is created by a Policy that runs at enrollment, startup and check-in.To me this seems like overkill, but to make sure I wanted to get some insights from the community.Do we need two Local Admin accounts? Would the first one be sufficient? What are the advantages and disadvantages of having two?Thanks.