Hello,We have bunch of intel, m1 and m2 Macs.I am trying to lock them with activation lock so that no one can erase the mac the device.Currently, the Macs can be forced into recovery mode and use "erase MAC" to fresh install the OS.Can someone guide me to lock with company ABM please?Any help is appreciated! Cheers

Hello I need your help to stop uninstallation after install to the users machine how we can stop that from jamf

Hey everyone near Toronto. Was considering starting a user group for us. Just trying to gauge how many people would be interested. I’d be hosting in Toronto distillery district where I work. We have a top facility in Toronto and we keep getting featured in magazines Anyway add your comment if you’d be interested in attending I’m working with Jamf on content and such. Once I have everything sorted I’ll actuslly create it under user groups.

When trying to set an expiry time for mobile account have found that even if you specify a time when saved the nominated time always reverts back to "0" and "hours". If this is the only time available in this pane, why is it there? Nothing that I have read on the Admin Guide gives a clue to how it is supposed to be configured / set. We do have scripts that do a similar job if the title is correct, but having some issues with the scripts on later macOS. Thought that Configuration Profiles would be better to use maybe not if the only value is "0 hours"

I've been asked to report on how many Macs enrolled into our on-premise Jamf Pro instance (currently ~350) have local administrator accounts set, and when they were last logged into. Can anyone advise how best to go about this? Could this be done via an Extension Attribute?

I have a stupid script that removes stale homedirs in a computer lab that (for reasons I won't get into) uses PURE network accounts. Computers bound to AD, etc...so we can't leverage jamf -removeAccount type of script  Network accounts aren't really accounts. The lab manager wants homedirs that haven't been modified for 14 days to be removed. We have a script that works. We point to it in a policy that can be run in Terminal as a custom trigger or could be scheduled to run at a set interval. It works just fine,  but only  if Terminal is granted full disk access. I know that JAMF scripts get copied to a local temp dir and run from there. How can I do what I want without granting Terminal full disk access (slight security risk but I don't want to do it if I don't have to). 

Keychain issue saving WiFi - Just started happeningI think this has something to do with Jamf Connect. I've never experienced it on my computer until today when I tried. I believe it worked before I added Jamf Connect to this computer. However, this happens on newly imaged machines now too.If someone goes to join a Wireless network that requires a password, it will give you a Keychain Not Found error "A keychain cannot be found to store <Network SSID>."I've looked in the User Templates folder like some suggest, no Keychain folder exists in there. I've tried to do a keychain reset, no luck. There is no Keychain First Aid selection. I don't see any policies that block this... I just don't know what else to try or look for.The silly thing is, if you hit Cancel, it remembers the password and doesn't really care. I don't believe it works on the login screen though.Thanks,Dominic

Has anybody managed to get this working? There is a discussion from a few years ago here https://www.jamf.com/jamf-nation/discussions/10110/configuration-profile-for-time-machine that details the same problem, with no resolution. In short: A configuration profile with Time Machine is pushed out to all machines - it says completed, though all machines have time machine showing as unconfigured in sys prefs. To go with this I have also pushed out two scripts, containing the command tmutil enable, and tmutil start backup, to run either side of the config profile. Again, nothing seems to work, although the profile isn't failing. Ive tried connecting to the share remotely via smb, and I can read/write, although when using afp, I get a password authentication prompt that no credentials (network, or the local admin) will get past, even with settings in Server > Time machine set to 'All users' and File sharing in sys prefs is set to Everyone Read/Wri

The Notifications indicator in the Jamf Nation banner is acting odd for me. Opening some sections of Jamf Nation (e.g. My Profile, Tech Thoughts) will cause the Notifications count label to show 25 unread notifications, but if I open the Notifications page there will be nothing showing as unread. If I just sign in to Jamf Nation and look at the Jamf Pro section under Products the Notifications count is accurate. Anybody else seeing this?

Are you running the NT-ware uniFLOW SmartClient for macOS? As you probably know, NT-ware's older versions (v1.1.0 and lower) were not as robust as their Windows versions. In order to upgrade/update to newer versions, you need to uninstall the older versions first. NT-ware places their default uninstall script here... /etc/smartclient/uninstall-smartclient.bash Unfortunately, this script is extremely rudimentary and lacks any support for running in an automated environment that uses an MDM/UDM solution such as Jamf Pro. With that, I give you my highly augmented version of an NT-ware uniFLOW SmartClient uninstaller that works both locally and/or with Jamf Pro. A brief HOWTO is posted down below... after the script. THE SCRIPT #!/bin/sh ############################################################################## # # SCRIPT FILENAME: # uninstal

Hi, I am needing to upgrade an app as soon as a machine is updated to Ventura. My current thought is to have a policy scoped to a smart group for OS version equal or greater to 13 and then have it deploy at login. Do you think this is the best way or would at start up be better? I also don't know if the machine will get added to the smart group right away. Feedback appreciated. 

Hi everyone,We're wondering, is it possible to use Touch ID with Jamf Connect, or are there any restrictions / implications of using it? We have users that are using it, but are about to deploy Jamf Connect to all users.Best,Jure

I have shared iPads set as 6 max users in the DEP profile (the profile for shared classroom iPad carts).  But there always comes a point when users start having login issues, or resetting pins don't work.  Usually because the device has no more memory or storage which gets solved by deleting the user profiles - which are way over 6.  Why are the devices allowing more than 6 users?  I thought they were supposed to delete the last profile used if a user logged in that went over the max allowed?  What am I doing wrong?Thanks!And if this post is in the wrong place, could someone point that out also?  I can't find the 'question and answer' box.

Hi We have 802.1x authentication for the MacBooks using PulseSecure Agents. We are also using NoMAD to sync AD passwords on local system, and I am facing following challenge and need some guidance for the same.We have WIFI configuration profile pushed through JAMF on new devices. post enrollment. The profile installation is done manually by user  as we want use to input the AD credentials and avoid using a common pre shared key for the SSID authenticationWhen user tries to connect to a specific SSID, first they receive authentication prompt for the WIFI ( unless the existing working credentials are stored during profile installation). Once they are connected to SSID, user receive the authentication prompt from the NAC agent and they get connected once the compliance checks are passed.Problem: Recently we have started facing challenges on some MacBooks where the Use changes AD password ( password renewal after expiry or some other issue

So, I have a few machines where it appears as though through no action taken by the user, the MDM profile and all associated JAMF-issued profiles get deleted from some of the machines we have in deployment. Does anybody have any clue what could be causing this, and moreover, how to stop it from happening?

Hi team,I was configuring the splunk on jamf integration but I get the following.2022-09-27 10:55:36,376 INFO pid=2078630 tid=MainThread file=setup_util.py:log_info:117 | Log level is not set, use default INFO2022-09-27 10:55:36,376 INFO pid=2078630 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled!2022-09-27 10:55:36,376 INFO pid=2078630 tid=MainThread file=jamfpro.py:get_token:72 | JSSAuthToken requesting new token2022-09-27 10:55:37,180 ERROR pid=2078630 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events.Soma help thanks.

I have noticed that attempting to set the default user shell to zsh in the Jamf Directory Binding pane doesn't work. Settings > Computer Management > Directory Bindings > User Experience > Default User Shell New users still default to Bash on both Big Sur and Catalina. Is this a known issue?

Hi; I am looking for a way to reboot both MacOS and iOS/tvOS devices via API commands, either with classic API or uAPI. I've found that I can use the classic API's mobiledevicecommands RestartDevice <id> endpoint to reboot mobile devices. But this doesn't apply to Computers. Oddly, the classic API computercommands endpoint does not include a Restart command like Devices does. I've found that I can create a Policy for computers and setup the Restart Immediately policy, and setup a custom event trigger such as "Reboot" to trigger it. Two questions - First, how to trigger a Policy custom event via either of the APIs?Second, how do I scope this so that I can select only one or some subset of Computers to reboot? I don't want to create a separate policy for every computer, but definitely don't want to reboot all my computers! I do realize that I could setup reboots to happen at specified times, but I really need this to be an on-demand

Hello,I have all the configs in place for DEP & user-enrolement. But let's say, we sent a new macbook to a new employee who is starting as Work from home and the employee doesn't connect to wifi during initial MAC setup and goes on to create a local account. I have the macbook in ABM & in the scope of prestage enrollement as well. Can we do anything about it? Thanks! 

Using a newly drafted Okta Device Trust script, this is the issue that some users are running into ERROR: Error in accessing default keychain Originally it was an issue with python and python3, but that has been resolved, however, even after running the following command for the, the user still sees the okta keychain in Keychains, though its grey with all actions also greyed out but the user can see the okta-db file when running security list-keychains"sudo security delete-keychain "/Users/$user/Library/Keychains/okta.keychain-db". I ran the above during an ssh session but even after closing and reopening the Keychains app it still shows up, which is troubling. Tried confirming deleting the file and from the SSH session at least it shows its gone sudo security delete-keychain /Users/$user/Library/Keychains/okta.keychain-db security: SecKeychainDelete: The specified keychain could not be found. running "sudo ls /Users

My district recently purchased Jamf School to manage all of our iPads and a lab full of iMacs.  So far I haven't run into many issues with enrolling devices and deploying apps, but I've hit a wall when it comes to Adobe CC.  I've searched the forum here for solutions, but most of them seem to involve Jamf Pro tools, and I haven't been successful with the few workarounds I've seen.  I have tried using Composer to package the installer and I was even sent a script by Jamf support to download the package from Google Drive and install it, but with no luck. I have tried deploying the package for the stand alone creative cloud app as well as packages with some of the Adobe apps included.  I'm using the Apple Silicon versions right now, but would eventually like to deploy the Intel packages as well for some of our older iMacs. Does anyone have another suggestion for this macOS/Jamf newb?  Thank you

Hi all,I'm having two challenges and I need to find a solution.  I would like this solution to be native.  That is, I know there is a solution that uses the macadmin-python.  I'd like to avoid that if possible and find a solution within Jamf Pro or the scripting framework built into macOS 12.3.  Here's my challenges:1. when I add an 802.1x network profile using the Configuration profiles in Jamf Pro, it places the network at the BOTTOM of the list of preferred networks.2. I have not been able to find a scripting solution other than the macadmin-python script in many other Jamf nation posts about this topic.Does anyone have any other solutions?  This really is challenging because our users are not connecting to the proper Wi-Fi network (Employee 802.1x) and employees are so insistent on adding the Guest and BYOD to their school laptop. 

I want a simple script to add to self service which will give me a dialog box with some selection/drop-down and some text boxes which will all tie together at the end to create the name and then recon to push to jamf.Drop-down will have 4 choices each and everything will be selected manually.Final name will beExample: NA.John.Doe.M1Pro14 

I have the ADCS/802.1X configured with unbound macs using Jamf Connect. The profile works, but sometimes I notice that the com.apple.network.eapolclient.configuration is blank; even with the configuration profile and proper certificates in place. I have to re-deploy the profile fix the issue. Has anyone run into this before?   

Hi everyone,the previous Administrator at my Workplace used the Model identifier with like "Book" and not like "Book" to sort the Macs into MacBooks and all the other more Stationary Macs.After the first departments bought the new M2 MacBooks Pro, we noticed that Apple had removed the word Book from the Identifier, meaning that the MacBooks were suddenly treated like an iMac or Mac-Mini.My solution for this would be to evaluate the value of Battery Capacity. For iMacs and Mac-minis it says N/A, while MacBooks always have a percentage there.Out of curiosity, how do you implement this distinction, if at all?Would anyone recommend another way?