Here is the scenario:1.) I scope a computer a policy that they can run in self-service.2.) I scope another policy to another computer that can be run in self-service.3.) Both computers DON'T run the policies.4.) I want to figure out which computer, has what policy, but not do it in a gui platform, I want to instead report out what computer has what policy scoped to them that they are able to run.These seems "easy" enough, but no matter what I look at, I can't seem to find anything that can just spit out a "list" outside of going to the asset individually or looking at the policy itself.Use case: I have a policy that is a template, I create a policy each time for each computer/user that needs this policy. I need to have a list of all users that have this policy associated with a device for auditing purposes. You're probably thinking, why can't you just put everyone in the same policy (great question), this is due to the nature of how we are t

Hi,whenever students try to download an application in their students app the following error occurs:"Licenses cannot be assigned because the service token is invalid." Funfact: Every Token is valid...Any suggestions what I am doing wrong :-D  

Hi All,Sorry if this has been asked before.I'm using this script with zero modifications except for the parameter changes as shown in screen shots below:https://github.com/kc9wwh/macOSUpgrade/blob/master/macOSUpgrade.shI pulled the installer for 12.6 from Mr. Macintosh. The installer will attempt download from self service but I get this error: We were unable to prepare your Computer for OS Monterey.

Does anyone have AppNeta Silent uninstall script or could anyone help with it, please? AppNeta needs to be removed from all mac machines via JAMF.

Getting fond memories of Sim City 2000, but not necessarily having the best time with Jamf Pro at the moment... So I have the jamf connect metapackage going out and being installed - yes, all the permissions have been set to wheel/root, yes, it is signed, yes, by an apple developer ID cert, and yes, the cert is valid. It contains the jamfconnect PKG, branding assets, postintall script, and the notify script. It is being installed, as booting into the machine we are getting the jamfconnect login screen, which works normally. However, after logging in, at the point where the notify script should be run, I am getting the generic notify screen and the "reticulating splines Again.." status message, to which I have to command +control + X to get past.After the fact I check that the depnotify.log file does indeed exist in /var/tmp/, but it is blank. So it is appearing that the script is not running to update it - hence the splin

Hallo everyoneNeed some help with understanding how the printing works on the macos.Previously I always have set up the printers in our jamf Pro Server and it works all fine. We need only the standard printing(keeping it simple).Now I have to set up a new canon Uniflow printer available in every office with different models. How do I get the printer driver, which can be different for each printer?The Printers in our company are configured on a win print server and the driver used on windows devices is: Canon Generic Plus PCL6. How do I get the driver for the printer?I can access the smb share where the printers are. While configuring the printer, I couldn't figure one which ppd file to choose from the list. So I chose the Generic.ppd.Again the question, which PPD file shoud be chosen for the various printer?I have been digging for Information on how the printing works on macos. really confusing for something very sim

Hi all,i'm trying to deploy configuration profile with a screen recording enable for Flameshot.the issue is i cant create  a configuration profile due to missing signature.when i try to create a profile from the PPPC utility i get error " the executable  may not be signed" and by running is someone managed to work it with it and/or managed to create a configuration profile for unsigned application?Thanks in advance 

Hello Jamf Nation, I've just recently become the Systems Admin of the school district I work in. I was recently tasked with coming up with suggestions for replacing the our school servers with something "new". We currently only need a single ESXi host to serve Netsus Netboot server and a Casper Distribution server. We have gigabit networks in our schools for file transfers. The busiest time for our servers is during the summer where the school technicians will re-image laptops up to 15-20 at a time. Our distribution points are using ~120 GBs of space for packages at this time. I don't expect this to grow very fast at all in the future. I'm hoping you guys could recommend a solution that can maximize data transfer for imaging, have some sort of redundancy for protection, and is affordable for a public school system. I'm totally okay with refurbished gear that comes with a 3-5 year warranty. I've looked at hardware

We have just over 1,000 iPhones in Jamf for our staff. Our staff are responsible for repairs themselves by contacting Apple directly. We have experienced some very confusing and convoluted issues with Apple in this regard, and I'm still unclear how to avoid future issues.I myself have sent a few iPhones for repairs over the past 2 years. The only information Apple provides is to "Remove your iPhone from your Apple ID". Well, I can't do that if the iPhone was set up by another employee, and we have our PreStage Enrollment profile configured with "Prevent user from enabling Activation Lock" set to enabled, and "Enable Activation Lock on the device (ASM/ABM)" set to disabled. Yet, inevitably, after we send the iPhone in for repair, we get the iPhone returned to us with a note that they couldn't do the repair or replace the device because either the iPhone has remote management, or it's assigned to ABM/ASM. My question is, how do I know which of these acti

Hello Everybody,our School has managed IPads since 8 month. The first classes, that get devices, are provided with managed apple ids. That worked very fine, every user got an automatic ID. Now we added some additional devices, but for them no id is generated and we dont know why. All works fine, the device is registered  in apple school manager and jamf. Only the ID is missing. We have synchronised SFTP several times. Can someone help us?Thank you!Marius

No mention of this one on the forum yet, so either this software is perfect (hahaha) or I’m on an island. I may need to mass deploy and maintain the Nexthink Collector. Never heard of it before, but it looks like a client side agent (ugh) that collects and sends analytics to a central repository. Anyone here have experience with this one you can comment on?

How are you getting the latest version of Xcode deployed to users Macs?It's too big to package and put on Jamf and users don't want to spend the time downloading it until forced by Infosec.Thanks.

We are trying to push out a profile to have our Mac's (in a primarily Microsoft environment) to auto join our 802.1x network. I have setup the Jamf ADCS and am able to push a device cert to the Mac's that I would like to use. I created a policy in NPS to use that cert for authentication that I would like to use but am getting auth failures. Any guidance for how to remediate this? 

I am putting together a simple script that will allow a user, when added to the appropriate scope, to have access to a button on self-service that will promote the user to a local admin for a preset number of minutes, Say 15 minutes.  Then after the 15-minute interval expires, the script removes them from the admin group. It works but during that 15-minute interval, the self-service icon spins the in-progress wheel.   I would prefer it to execute and have the self-service button complete, then in 15 minutes demote the user. It is likely the command I am using to sleep for 900 seconds. #!/bin/bash ## query the system for the current console user with the loginwindow user=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) ## add that user to the admin group dseditgroup -o edit -a $user -t user admin; ## after fifteen minutes sleep 900

I have an installer that will prompt the user to accept incoming network connections.However they don't have administrative rights.  Allowing this will add this to the application firewall but I can't figure out how to do this (automate) with JAMF.I tried to add this to my firewall configuration profile however this is a executable and I don't think it has bundle ID.  I tried this command and it came up null.  osascript -e 'id of app "/usr/local/bmc-software/client-management/client/bin/mtxagent"' I tried to add this to the application firewall from the this command line sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/local/bmc-software/client-management/client/bin/mtxage

I am installing the new Carbon Black Sensor and out of three machines, 2 did not get installed and I cannot figure out why. The policy does show installed and completed with no errors. I am using system ext mode as all three machines are running Monterey. Any ideas? 

Today we released Jamf Connect 2.14.0 for general availability; this release includes the below details. Key Feature ContentDisable password syncing for specific local accounts: The Password Sync Block List (PasswordSyncBlockList) setting is now available for configuration in Jamf Pro and Jamf Connect Configuration. IT allows you to specify a list of local macOS accounts that you do not want to go through password synching (typically admin accounts). You can specify one or more local accounts as an array of strings using their local macOS account names (i.e., short names). Configure custom local account full names: The Full Name (OIDCFullName) setting is now available for configuration in Jamf Connect Configuration. It was added to Jamf Pro in the 2.13.

Hello All. I am a relatively new admin, thanks for your time and please redirect me if this topic has been covered before. I will try and be as thorough as possible. I am attempting to deploy Cylance Protect 3.0.1 using Jamf Pro to new M2 Macbooks. Following all of the documentation I can find with both Jamf and Cylance here is what I have done to this point.1. Created a configuration profile with a system extension payload.This policy is set to deploy in the prestage. 2. I have the package deploying from a cloud share point, also in the prestage.Results: The software is installed on the test machine. It did not run on its own and when I attempt to start it manually I get the following result.I need the program to install and run

Is there anyway to exclude an iPad that's been scoped via group to an app? I want the group to still receive the app, except for certain iPad(s), but they still need to remain in that group to receive other configs and/or apps.This can easily be done in Jamf Pro, but I'm not seeing anyway to do this in Jamf School. Am I missing something? Or is it just not possible?Thanks for any help!

I'm trying to work with support to figure this issue out...We have a bunch of iPads/iPods in our pre-stage enrollment that are assigned but don't have device names/aren't in our inventory to manage. Some of the device names just show up blank and are unmanageable. The devices appear to have the jamf mdm profile on them and are completely locked down so I can't factory reset/restore them/log out of the apple ID even after removing the mdm profile on Apple Business Manager. I can't find them in Jamf to unmanage either.Does anyone have any idea how this could have happened? Not sure if it was an issue when they were initially enrolled or if it was a configuration we did that would cause them to disconnect from jamf somehow? Has anyone had anything like this happen to them? They are kind of stuck in limbo and I'm unable to do much of anything with the devices. 

I have a MacBook Pro here, but the user forgot his password, so i want to restore it with my Personal Recovery Key in JAMF. Now the problem i got a Personal Recovery Key in jamf but it doesnt work on the device. (says its wrong)So I have no possibility to log in to that device + another problem the firmware password doesn't work either. My question is there any way to force the macbook to send te Personal Recovery Key to JAMF without logging in.  

Hello,we use Jamf Pro Cloud 10.30 at the moment. With Jamf Pro Tools (Composer 10.31) and even older Composer versions, it is apparently no longer possible for me to include files on the user's desktop in the package, so that I can deploy these files to the user desktops via DMG and fut. The error message as shown in the picture always appears. Does anyone know the problem or has a workaround?Thank you! 

We did have LDAP working with a Linux infrastructure manager server, but it stopped working. We suspect the server may have been deleted from AD, but because no one here is a Linux expert we couldn't do any real troubleshooting - we couldn't even login to it. We decided to just build a new Infrastructure manager server but this time do it on a Windows server. We gave it the exact same hostname and IP as the previous one that we decommissioned so the firewall rules would all still point to the same location. At first we thought the new server could just slide in and pick up the role and restore LDAP but I found that when this new server enrolled, it created a new instance. I figured that's ok. I'll just give it a difference display name so I'll know where to point the new LDAP config. I cloned the existing LDAP config but changed the display name and pointed it to the new infrastructure manager instance.

Hello!I am building a package to install FortiClient vpn (the free vpn standalone client) for our users.After several tests, a policy authorizing the security extension is indeed present and allows to avoid blocking it during installation, but a popup asking me to authorize the addition of VPN configuration appears right after the installation.This popup is generated by the "FortiTray" binary and after several tries and I don't know how to authorize it ahead of time so that the installation is totally invisible.It says that ""FortiTray" would like to add VPN configurations"Any idea on how I can authorize this or setup ahead of time ?

Hi,I am trying to set the push certificates privilege to read only for a single user. The user privileges are set to custom.I go and untick the create, update and delete boxes leaving only read ticked, then go and save.. and when looking at the list, all the boxes are ticked again.I am certain that there is another privilege that I have set, that might be forcing this. Spoke with JAMF Support, and all they could say is its a bug, then just closed my case, so coming here for some advice.Can anyone help?Thanks