Hello all,We leverage Jamf Connect via Microsoft Azure without any AD binding. What is the standard procedure if an end user forgets their local signed password to get back into their account on their machine?I linked an article which walks through the standard process with a special callout to step 3 in the process. Has anyone encountered this and how would you resolve?https://confluence.appstate.edu/display/ATKB/How+Jamf+Connect+Syncs+Your+Mac+Password+After+a+Password+Change 

Hi there,I have tried to search for an answer but have not found anything relevant.  We are wanted to use the patch definition to find computers that need security updates applied.While Catalina and BigSur patch definition only contains their versionsApple macOS Catalina: 10.15 (19A583) to 10.15.7 (19H2026)Apple macOS Big Sur: 11.0.1 (20B29) to 11.7 (20G817)Monterey contains all macOS versions Apple macOS Monterey: 10.9.0 to 12.6.0This causes the UI to show more computers needing Monterey security updates than the number of computers actually running Monterey.Why the definition of Monterey does not follow the same patters as Catalina or BigSur where they only show the versions application to their own.Will it be possible for Jamf to fix the definition for either Monterey or Catalina and BigSur so t

This is my end goal:1. User plugs in USB (which will probably be a launchdaemon)2. If not encrypted prompts user to encrypt3. If selects Encryption, encrypt USB. 4. If not it is read only (which is set up in JAMF currently).Will need this to be internal and not a software purchase so a script is what I am working on. I am having issues figuring out how to encrypt the USB. Below are some articles I've read but doesn't actually show how to encrypt the USB. There are options within diskutil man page but I may be reading or doing something wrong as it does not encrypt the USB and fails. Any assistance would be appreciated.  https://www.jamf.com/jamf-nation/discussions/8306/eject-usb-if-its-not-encrypted

Hello, I am fairly new to JAMF Pro and have had mostly good results.  My new devices auto enroll fine and get all required policies.  Most of my older devices have also been fine when completely reloading them before enrolling.  I am however having some issues with devices that are in the wild getting policies after I enroll.  So I have been visiting offices and manually installing the enrollment profile on devices that used to be enrolled in our Mac Server MDM instead.  While the profile installs fine and it auto pulls the MDM profile and another, the rest of my JAMF configs in at least 1 case haven't installed after 12 hours and multiple reboots and terminal command sends.  Looking in JAMF pro the devices still shows just basic enrollment but no group memberships or config profiles and policies for the device (but  the device HAS been added to several static groups).  I don't know what to do in these cases

Our jamfcloud instance was updated over the weekend to 10.41.0. This morning I created a new policy and tried to upload an icon for self service, but when I click Upload icon > Choose File > pick the icon > Click Upload, the entire page for that policy reloads and it doesn't actually upload anything. I've tried a dozen times with different .png files (all created using known good methods and tools I've used a hundred times before). If it makes a difference, we do have Cloud Services Connection enabled.Is anyone else experiencing this after updating to 10.41.0?

This is my script to notify user that app will be closed.It is working without trying to use parameters while configuring script. With coded data to processName and appName notification is working flawlessly.But I don't want to create script for each app that needs this functionality, that's why I'm asking for help with this script.#!/bin/bash #set -x processName=$4 appName=$5 message="$appName app is currently open. By pressing <Proceed> app will be closed and process will continue." echo "$(date) | Waiting for other [$processName] processes to end" while ps aux | grep "$processName" | grep -v grep &>/dev/null; do HELPER=`/Library/Application\\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -defaultButton 1 -lockHUD -description "$message" -windowPosition c -title "$5 Update/Installation" -windowType hud -button1 "Proceed" -alignDescription center -alignHeading c

You asked, and we’re thrilled to deliver! Tech Thoughts, Jamf Nation’s own technical blog, is now live! Jamf’s Community team is so excited to offer this space for increased knowledge sharing and problem solving!  Today we’re starting with two blogs: one from a Jamf technical expert (Thanks, @talkingmoose ), and one from us, your Community team. Plus we'll be sharing one from a fellow Jamf Nation community member on Wednesday! We hope you enjoy these pieces and consider

Hi all,To appease our auditors, we need to add a custom text field to all our Laptop entries.  It simply needs to say "Data classification level: C2".I've tried to do it via Extension Attributes, but it won't print out what I need.  (I'm sure I'm not using EA correctly) Has anyone been successful in just adding a custom text anywhere?   Thanks in advance!  

I installed the beta of the new macOS Ventura to test things before Apple starts shipping laptops with it in the fall. I am running into errors when trying to register with InTune (surprise surprise). I get the initial Authentication for JamfAAD pop up with the instructions, that immediately disappears and I get the Registration with Intune failed error box.Thoughts?

I think this is a Catalina issue as I don't recall noticing it in Mojave. I just installed the recently released supplemental update for Catalina and have noticed that all the log files in /Library/Logs have been removed after the upgrade. I took a snapshot on a VM and ran the upgrade a few more times just to confirm this is happening - it is. Before the upgrade I have a folder /Library/Logs/MyComputerName. In this folder is where I put custom logs, including the log file for our update script. That entire folder is gone, and most of the log files under other folders in /Library/Logs are gone as well (though some empty folders still exist). I read that Catalina has moved system files to a read-only operating system. I'm wondering if that could be part of this problem. Does anyone know if this is the expected behavior? Is there a better/recommended place to store log files that will survive macOS updates?

The time zone on my cloud hosted JSS is wrong. I know this is a user specific setting in Account Preferences but I am finding it difficult to find my time zone. I have already done this once but when Jamf updated it appears my time zone was reset. When I try to change it I select "English" and "America" but then I must choose from a list of names of cities form all over the world. None of the American cities I recognize are in my timezone. I am a simple minded American who does not have all of the cities of the world memorized as to what country and state they belong. Why can't Jamf put the actual name of the time zone to choose from? For example: "Central", "Eastern" or "Mountain"

I want to add a couple of internal apps to some Freelancers phones but I'm in a bit of a loop trying to create a Personal Device Profile. When I click 'Devices' > 'Personal Device Profiles' I get greeted with 'Configure user-initiated enrollment for mobile devices to continue'. So I go into 'Global Settings' > User-Initiated Enrollment', enable iOS for 'personally owned devices', then go back to Personal Device Profiles and it says 'CANNOT ADD NEW PERSONAL DEVICE PROFILES - When User Enrollment is enabled, you can only delete personal device profiles.'Am I missing something really obvious here? Feel like I'm just going in circles and not getting anywhere!

I'm new to Jamf pro and have experienced issues with pushing out apps. Under the device in management history it shows failed commands and the error appears as 'Please log in to your iTunes Store account'. Any suggestions as to what this could be.

Hello,I am currently working in a school that uses 900+ iPads and 300+ MacBooks and wanted to ask if anyone has used or is currently using Zero-Touch Deployment in their institutions? Every Academic year, we collect all the devices for wiping and reinstalling, which can be tedious with that many devices.I am fairly new to Jamf and would like some suggestions that may help ease in setting up devices through Jamf.Thanks!

Hello, I have created a 1Password8 Package using composer & deployed using policy on Mac. However every time I get this error 1Password is not installed inside of /Applications. Please move 1Password and restart the appThe previous 1Password7 app was downloaded from AppStore & deleted manually. 1Password8 package is not replacing the 1Password7 installed app. Kindly let me know if I can stop this error.Regards,Mak

Hello all.  I have a set of apple tv's that have been working fine without issue.  All of a sudden one of them decided to not advertise on airplay unless it has the configuration profile removed.  Any ideas?  I have wiped the device, updated, restarted.  When I exclude it from our scope it works fine.  No other apple tv's in the configuration profile scope are having any issues.

Background: As many of you may be aware, the Screen Recording option can only be enable by a physical user on a Mac. To manage this limitation set by Apple, I have created this workflow to prompt users to enable the Screen Recording option for the required App (Currently set to Slack, but can be easily modified). You can check out how I similarly addressed the Camera and Microphone issue here: Automatically Reset Teams Camera and Microphone for User Solution: I created this Script to check if an Application's Screen Recording permission has been set to enabled in the TCC Security and Privacy. If the TCC option is disabled, it will open System Preferences > Security &

I just created a group for our iPads called D1-Smart, however, I noticed that these iPads appeared in our as Missing Devices in our Smart Device Group.  Why?

I've noticed the only thing that helps is to restart it and it gets back to normal for a day or so before spiking again. Mysql.exe is the culprit and when I had a look at the server logs while it was happening I found - 2022-09-01 12:18:32,527 [ERROR] [Thread-822 ] [GetBootstrapToken ] - Computer ComputerShell [ID=131, Name=ELM069] requested Bootstrap token but no token was found2022-09-01 12:20:45,479 [INFO ] [duledPool-0] [rentProfileCleanupMonitor] - Running parent profile cleanup.2022-09-01 12:20:46,156 [INFO ] [duledPool-4] [CsaTokenServiceImpl ] - (Token does not exist) No CSA enablement auth code found, so no additional processing is required2022-09-01 12:23:03,562 [ERROR] [Thread-827 ] [GetBootstrapToken ] - Computer ComputerShell [ID=12, Name=eggs’s iMac (23)] requested Bootstrap token but no token was found2022-09-01 12:24:17,443 [ERROR] [Thread-827 ] [GetBootstrapToken ] - Computer ComputerShell [ID=82, Name=EOMB010] requested Bootstrap

Hi all, Novice Jamf user here. I have a configuration of 18 iPads we'll call "Teaching" iPads. As far as I can tell, I'm not using anything that doesn't already come in the box, so to speak, so I have a policy that configures a specific wireless connection and then pushes out five or 6 apps that we purchased through Apple School Manager, which is connected to our instance of Jamf.All the apps appear to deploy, but I keep getting this pop-up message on the screen that tells me to sign into iTunes to manage/install apps but we're not using iTunes on these devices and we don't have AppleID accounts associated with these devices, as they are being managed centrally by our organization.The only clue I get is when I pull up a specific device and look at the management history and see the command "Install App - Self Service" that is either at pending or can't install because the device was busy and I have no idea what this means.Any id

Can anyone please clarify what permissions are required for the LDAP Server Account?What functions does it perform aside from user/group lookup and authentication?TIA

Hi All i just wanted to know how people are managing turning on the firewall on your machines as i have 60 machines that i need to turn the firewall on but dont know the best way around this

Has anyone experienced any issues resetting (AD) passwords on a Mac? In AD I select an account and set, “User must change password at next login”, I attempt to login as that user and am prompted to change the password, but all password entered are rejected with: Your password does not meet the requirements of the server.” The password policy is set to 8 characters and that’s it. This same user will have no issue resetting in Windows. I will also receive the same error when attempting to reset from Users & Groups in System Preferences. I have seen this many times in the past so I don’t believe it to be strictly related to Mavericks, Yosemite or in this test case, Sierra. What’s strange is that some users will reset just fine. It would be great if I could resolve this as all of our student passwords are reset come deployment, requiring them to change it when they’re picked up. When we run into this problem we usually just change it in AD manually for them.

Has anyone been this stuck with a locked computer? I locked a computer remotely using JSS and creating the 6 digit code. The computer successfully locked, the student then tried to guess what the code is and got it wrong. He then brought it to me with the screen displaying "Your computer is disabled. Try again in 60 minutes" Once that time runs out it just shows "Wrong passcode. Try Again" without ever giving me the option to enter a code. I have tried booting into recovery mode and doing an internet recovery. Both times it just boots to the same screen. I took it to the Apple store and they claimed they have never seen this screen before and could not help. I then spoke with my Casper rep. They had me do a PRAM reset and a SMC reset, both times it booted to the same screen. She then told me to call Apple Support and they had me try everything listed above again. Apple Care sent this issue to the engineers and I am waiting for a response. I am lo

We have a configuration profile which enables the builtin firewall for the devices. It happens from time to time that developers are testing some applications and would accidentally deny the prompt for allowing access due to various reasons. Now, in previous macOS versions I would just fix the issue with socketfilterfw, however on Monterey macs I see the following:bash-3.2# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate Firewall settings cannot be modified from command line on managed Mac computers.So, now I have to move the device out of scope of the config profile, allow the blocked connection manually, then move the device back to scope. Furthermore, allowing exceptions on Jamf seems possible only if you have both the name and bundle ID, which is not available for a significant portion of command line tools as far as I am aware, only for signed apps. How are people handling firewall exceptions in an environment where people mostly do not have