I've been tasked with some CIS recommendations for our apple estate. I am currently mulling over the firewall parts of this. Do you guys enable firewalls in your estate? It seems like a no-brainer, but this isn't windows and i don't know how much it really helps on the mac side. There are a lot fewer programs actively listening for ports and connections. Also with that, if i implement it now, what programs would it break? How do you guys handle this? Do you find its good to have one or not worth it?

While trying to send data from Jamf to SCCM, I am getting the following errors:-  [ 5] ERROR Jamf.ProxyService.Plugins.SCCM.SccmReports - There was an unexpected error sending the device to SCCM.- System.InvalidOperationException: Invalid registration state: Error. Cannot continue.We are using version 3.70 of the plug-in and SCCM version is 2111I have look through quite a few of the support articles and I am seeing various information, but none of them ever offer a solution and they just end. When I use the Jamf SCCM Proxy Service Helper and try to just send one machine manually I get different error.- [ 67] ERROR Jamf.ProxyService.Plugins.SCCM.Utilities.Certificates - There was an unexpected error sending the device to SCCM.- System.InvalidOperationException: Invalid registration state: Error. Cannot continue.

On Windows, you can set general DNS search suffixes (i.e. suba.domain.com, subb.domain.com, etc). Then there is also a "Connection-specific DNS suffix" setting the DNS server can share when the machine connects to the network (i.e. site1.suba.domain.com) depending on your office location. On Macs it seems to let you either take what the network gives you (which is limited to 1 entry) or use a longer list of manually specified options. Is there a way to mimic the Windows functionality of having a few general search domains which are set by script or config profile, but let the local network set a local search domain?

Hello Jamf experts! I am primarily a Microsoft Intune/SCCM admin.  I also manage our Jamf Pro environment for MacOS.  We currently use a SCEP Cert Profile in intune tied to an NDES server to deploy an 802.1x certificate to allow our azure joined Windows devices access to our on premise domain.  We currently have our macs bound to the domain to allow a cert request for this.  We recently got our Jamf Connect setup going and have no reason to bind to the domain anymore.  I have read the documentation on how to set up Jamf Pro as a SCEP Proxy but I am NOT a mac expert and don't really understand what needs to be put in the fields of this setup.  I'm assuming the URL is the Scep Server Url .  I'm not sure what to put in for Name, Subject, Subject alternative Name Type, or what options I should choose, or what Certificate I should use as the Signing Certificate.  I'm lost.  I opened a ticket with Jamf Support and they sent me the link to the

i have a script that runs software update via JamfHelper, however I cannot get the actual software update command (via API) to run untiless the JamfHelper window is quit. Anyone know how to run a process while still keeping the JamfHelper window open/active?  my syntax is as follows: /Library/Application\\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper \\ -windowType hud \\ -lockHUD \\ -title "macOS Security Updates" \\ -heading "macOS Updates Now Installing" \\ -description "Installation can take up to 45 minutes.. Close and save your work now." /usr/bin/curl -s -X POST -H "Content-Type: text/xml" -u ${apiUsername}:${apiPassword} ${jamfProURL}/JSSResource/computercommands/command/ScheduleOSUpdate/action/install/id/${jamfProCompID}

I am working to update our Lightspeed Relay cert and need to create a folder to house the .pem files. And I’m in over my head on this one. Kinda, sorta adept at Composer, but not enough to pull this off. Any help will be appreciated.

Hello,I'm having an issue with an app which is Downloaded from the Mac app store through VPP on Jamf. The app MSG viewer for Outlook creates files in /private/var/folders/.../T/.....Cwd.bundle. Several of the files that get created in this temporary folder are quarantined including Cwd.bundle. If the quarantine flag is removed from the Cwd.bundle file it works until next reboot when the files are removed. I have tried working with the vendor but they believe it has something to do with 3rd party security software on our Macs. I though the problem might be related to translocation, but I don't see how that would be an issue with an app directly from the app store. If I download their software directly from their site the problem does not occur AND no files are written in /private/var/folders at all.  I'm just looking for a solution. I've tried various profiles to allow apps from this vendor including using PPPC utility and allowing all but this does not resolve. Any sugge

Hi all, I know this isn't the NoMAD Login support channel but just asking on the off chance anyone else out there has found a workaround to this issue since Jamf Connect is the commercial version of NoMAD. When using a Macbook Air (M1), the NoMAD Login screen randomly goes off center with black bars on 2 sides as if the resolution of the background image is smaller than the screen's and it isn't "stretching" to fill. No other Google result out there except for a single report here about 9 months ago which remains open. 

Here is how I check for macOS updates, install the recent available and reset Jamf Connect login window.- Requires a local admin username, PID and password.Create a Script in Jamf Pro. #!/bin/zsh -i vers=$(sw_vers -productversion) install=$(softwareupdate --list-full-installer | sed -n '3p' | tr : '\\n' | tr , '\\n') name=$(echo "$install" | sed -n '2p' | sed -e 's/^[ \\t]*//') number=$(echo "$install" | sed -n '4p' | sed -e 's/^[ \\t]*//') if ls /Applications/Install\\ macOS* 1> /dev/null 2>&1 ; then rm -rf /Applications/Install\\ macOS* fi if [[ "$number" > "$vers" ]] ; then echo "Installer available $name $number." launchctl asuser <ADMINPID> sudo -u <ADMINUSERNAME> softwareupdate --fetch-full-installer --full-installer-version $number if [[ -d "/Applications/Install $name.app" ]]; then echo <ADMINPASSWORD> | "/Applications/Install $name.app/Contents/Resources/startosinstall" --agreetolicense --forcequitapps --nointeraction --user <AD

just curious if anyone has ran into this scenario. before purchasing jamf, i already had filevault enabled for my mac users, I was saving the recovery key to a safe somewhere in our environment. now that i have jamf, i want jamf to manage those keys with its filevault profile. would i need to decrypt my devices? and re-encrypt upon enrollment so that jamf can manage those encryption keys?

Due to macOS13 not being supported on 2012 Mac mini, which has been providing testing via ESXi faultlessly over the years.. I'm now looking at both UTM and VirtualBuddy.I can enrol and most things work. .but.. looks like recon is not able to see the disk..  thus storage in the device record is zero! This is a problem!Any suggestions for a fix or another method for working virtualising of macOS13 using an ARM Mac?VMWare seems quite far off on this with Fusion.. as for ESXi.. I don't think that's happening...

Just wondering if anyone is using a digital signage solution (mac based)?If so, do you like it and company details? Gabe ShackneyPrinceton Public Schools

Hi folks.I try hard to get VPN On Demand to work. Unfortunately, it currently does not work with Jamf Pro's built-in way (PI-101098), so Jamf Support referred me to iMazing Profile editor. Getting bits and pieces from various web resources together, I tried to built a working VPNOnDemand.mobileconfig by myself, but as soon as I deploy it to my client, it does not have any affect.The VPN on Demand configuration should basically do the following:1.) If client connected to a certain company WiFi network ("SomeWifiNetwork" in the example), it should generally NOT use VPN at all.2.) If NOT connected to the WiFi network above, but any other network, it should ALWAYS establish a VPN connection while trying to connect to certain domains (example1.com and example2.com in the example).3.) Trying to connect to VPN server via L2TP ("1.2.3.4" in the example), shared secret included ("SHAREDSECRET" in example), user name and password should be prompted (hence not included in example).When I deploy i

I am attempting to set (or more accurately clear) recovery lock on an M1 Macbook Air using bash. I work for a school district but we are using Jamf ProWe have had an issue where several hundred of our fleet have been (seemingly) randomly getting set into Recovery Lock. Some after initial log in. Others after our end users have had the device for a few hours or days. While the larger issue of what's triggering it is being investigated, I was trying to help speed up the process of getting these devices back into our users hands and clear the recovery lock code (and then set another one) so they could get back in.We have a little under 10K M1 MacBook Airs and I was able to obtain the management ID (as detailed here) for the devices I want to do this too. I am new to scripting but was able to work my way through obtaining a bearer token and parsing the different pages to find the device in question (using jq to pull the relevant management ID).I've looked at every sample script I could fin

I have found several articles on keyboard shortcuts in the JSS and different modifications to those shortcuts over certain JSS upgrades. But I can't find any information on how to disable JSS shortcuts all together. Is there a way to do this?

Provide your users a seamless post-enrollment experience when setting up their new MacsIntroductionApple’s Automated Device Enrollment helps to streamline Mobile Device Management (MDM) enrollment and device Supervision during activation, enabling IT to manage enterprise devices with “zero touch.”Setup Your Mac aims to simplify initial device configuration by leveraging swiftDialog v2 (or later) and Jamf Pro Policy Custom Events to allow end-users to self-complete Mac setup post-enrollment via Jamf Pro’s Self Service.Continue reading …

We have deleted managed iPads from JAMF without wiping them.What is the suggested way to wipe the devices now?  They still have JAMF self-service on them and it seemingly looks as if they are still managed.  I have tried a reset already but there is no erase all content and settings option. Cheers

Hello Everyone,i have a Problem with some macBooks, some of them has no space on their HDD, System Data is about 100GB, where can i find this Data to delete ?

Deploying O365 with full pkg inc Teams.Auto update via config profile. Looking at https://macadmins.software/ I can see what the version numbers are, along with tracking in JAMF via Patch Man. Both MacAdmins and JAMF show Teams as version 1.5.00.28558 installed Teams says its up to date with version 1.5.00.2760 MAU says 'everything is up to date' I've seen this also with OneDrive going out of whack..  I have a ticket in with MS 🙄  but in the meantime.. any ideas? 

Hi folks.I try hard to get VPN On Demand to work. Unfortunately, it currently does not work with Jamf Pro's built-in way (PI-101098), so Jamf Support referred me to iMazing Profile editor. Getting bits and pieces from various web resources together, I tried to built a working VPNOnDemand.mobileconfig by myself, but as soon as I deploy it to my client, it does not have any affect.The VPN on Demand configuration should basically do the following:1.) If client connected to a certain company WiFi network ("SomeWifiNetwork" in the example), it should generally NOT use VPN at all.2.) If NOT connected to the WiFi network above, but any other network, it should ALWAYS establish a VPN connection while trying to connect to certain domains (example1.com and example2.com in the example).3.) Trying to connect to VPN server via L2TP ("1.2.3.4" in the example), shared secret included ("SHAREDSECRET" in example), user name and password should be prompted (hence not included in example).When I deploy i

So, we had an interesting task of getting Time Machine to work over SMB and making it all scripted for zero touch and automated for remounting on reboots.We have a working script! And we are sharing it with y'all.How does it work?"Autofs" is the key to making this all work.and crontab for activating the mounts on reboot or disconnect/reconnect/We use computer serials as usernames for users SMB mounts to a Time Machine share. and each computer has their own folder by serial in the share, A Sparebundle file is the TimeMachine backup destination in each folder per computer.We run the script via a policy per computer with parameters filled for the script.notes:one odd behavior, if the script fails, a reboot helps get it working, not sure why yet, Requirements:Terminal PPPC, with full disk access,Crontab PPPC with full disk access. script:#/bin/bash # INPUT PARAMETERS: # password # size # server #---------------------------------------------- # o pipefail # -E = err trap inheri

Hi Jamf Nation,As a newbie to the Jamf space, this may be a relatively easy question I just have found it is quicker to just ask first before struggling through a lot of documentation haha.I want to allow our student network users to be able to print from all applications to our secure print server because  they currently receive pop-ups like these:And there is not always an admin like a prof\\lab manager\\technician around to approve. I just want to set a Jamf config. profile that allows printing from all applications, especially from Adobe products for our art students. Currently there doesn't look to be a config. profile preventing this but maybe this is a default for standard users and how the print server is configured via Jamf. However, one of my former colleagues created a config. profile to allow users to modify the printer list which looks like: Does this look like this could fix my issue because the printer isn't locked and allow modifications is selected? Than

Hey All,As part of our DEP workflow, we have Jamf Connect Login to create the account but as a previous step we have the Jamf SSO + PreStage LDAP auth features enabled - Has anyone seen where this can cause issues with corrupting users' account when they try and log-in after a reboot. Im currently investigating where after a reboot users are getting stuck at a macOS loading bar after they have auth'd to FileVault and wondered if the above is causing a conflict.let me know what you think ...Rob 

Hey all!I'd like to have an alias that points to Self Service available on the desktop of all Macs across our fleet. I guess there are several ways of doing this. Just looking to get some ideas on what a quick and easy method would be.Thanks!

I'm still kind of new to Jamf, I had an incident on Friday and need to disable iMessage and Facetime but can't figure out how.