I've been asked to report on how many Macs enrolled into our on-premise Jamf Pro instance (currently ~350) have local administrator accounts set, and when they were last logged into. Can anyone advise how best to go about this? Could this be done via an Extension Attribute?

I have a stupid script that removes stale homedirs in a computer lab that (for reasons I won't get into) uses PURE network accounts. Computers bound to AD, etc...so we can't leverage jamf -removeAccount type of script  Network accounts aren't really accounts. The lab manager wants homedirs that haven't been modified for 14 days to be removed. We have a script that works. We point to it in a policy that can be run in Terminal as a custom trigger or could be scheduled to run at a set interval. It works just fine,  but only  if Terminal is granted full disk access. I know that JAMF scripts get copied to a local temp dir and run from there. How can I do what I want without granting Terminal full disk access (slight security risk but I don't want to do it if I don't have to). 

Keychain issue saving WiFi - Just started happeningI think this has something to do with Jamf Connect. I've never experienced it on my computer until today when I tried. I believe it worked before I added Jamf Connect to this computer. However, this happens on newly imaged machines now too.If someone goes to join a Wireless network that requires a password, it will give you a Keychain Not Found error "A keychain cannot be found to store <Network SSID>."I've looked in the User Templates folder like some suggest, no Keychain folder exists in there. I've tried to do a keychain reset, no luck. There is no Keychain First Aid selection. I don't see any policies that block this... I just don't know what else to try or look for.The silly thing is, if you hit Cancel, it remembers the password and doesn't really care. I don't believe it works on the login screen though.Thanks,Dominic

The Notifications indicator in the Jamf Nation banner is acting odd for me. Opening some sections of Jamf Nation (e.g. My Profile, Tech Thoughts) will cause the Notifications count label to show 25 unread notifications, but if I open the Notifications page there will be nothing showing as unread. If I just sign in to Jamf Nation and look at the Jamf Pro section under Products the Notifications count is accurate. Anybody else seeing this?

Are you running the NT-ware uniFLOW SmartClient for macOS? As you probably know, NT-ware's older versions (v1.1.0 and lower) were not as robust as their Windows versions. In order to upgrade/update to newer versions, you need to uninstall the older versions first. NT-ware places their default uninstall script here... /etc/smartclient/uninstall-smartclient.bash Unfortunately, this script is extremely rudimentary and lacks any support for running in an automated environment that uses an MDM/UDM solution such as Jamf Pro. With that, I give you my highly augmented version of an NT-ware uniFLOW SmartClient uninstaller that works both locally and/or with Jamf Pro. A brief HOWTO is posted down below... after the script. THE SCRIPT #!/bin/sh ############################################################################## # # SCRIPT FILENAME: # uninstall_nt-ware_uniflow_smartclient.sh # # DESCRIPTION: # The core functionality of this script was written by NT-ware to uninstall #

Hi, I am needing to upgrade an app as soon as a machine is updated to Ventura. My current thought is to have a policy scoped to a smart group for OS version equal or greater to 13 and then have it deploy at login. Do you think this is the best way or would at start up be better? I also don't know if the machine will get added to the smart group right away. Feedback appreciated. 

I have shared iPads set as 6 max users in the DEP profile (the profile for shared classroom iPad carts).  But there always comes a point when users start having login issues, or resetting pins don't work.  Usually because the device has no more memory or storage which gets solved by deleting the user profiles - which are way over 6.  Why are the devices allowing more than 6 users?  I thought they were supposed to delete the last profile used if a user logged in that went over the max allowed?  What am I doing wrong?Thanks!And if this post is in the wrong place, could someone point that out also?  I can't find the 'question and answer' box.

Hi We have 802.1x authentication for the MacBooks using PulseSecure Agents. We are also using NoMAD to sync AD passwords on local system, and I am facing following challenge and need some guidance for the same.We have WIFI configuration profile pushed through JAMF on new devices. post enrollment. The profile installation is done manually by user  as we want use to input the AD credentials and avoid using a common pre shared key for the SSID authenticationWhen user tries to connect to a specific SSID, first they receive authentication prompt for the WIFI ( unless the existing working credentials are stored during profile installation). Once they are connected to SSID, user receive the authentication prompt from the NAC agent and they get connected once the compliance checks are passed.Problem: Recently we have started facing challenges on some MacBooks where the Use changes AD password ( password renewal after expiry or some other issue) and then the user is unable t

So, I have a few machines where it appears as though through no action taken by the user, the MDM profile and all associated JAMF-issued profiles get deleted from some of the machines we have in deployment. Does anybody have any clue what could be causing this, and moreover, how to stop it from happening?

Hi; I am looking for a way to reboot both MacOS and iOS/tvOS devices via API commands, either with classic API or uAPI. I've found that I can use the classic API's mobiledevicecommands RestartDevice <id> endpoint to reboot mobile devices. But this doesn't apply to Computers. Oddly, the classic API computercommands endpoint does not include a Restart command like Devices does. I've found that I can create a Policy for computers and setup the Restart Immediately policy, and setup a custom event trigger such as "Reboot" to trigger it. Two questions - First, how to trigger a Policy custom event via either of the APIs?Second, how do I scope this so that I can select only one or some subset of Computers to reboot? I don't want to create a separate policy for every computer, but definitely don't want to reboot all my computers! I do realize that I could setup reboots to happen at specified times, but I really need this to be an on-demand type of trigger that get's initiated via an

Hello,I have all the configs in place for DEP & user-enrolement. But let's say, we sent a new macbook to a new employee who is starting as Work from home and the employee doesn't connect to wifi during initial MAC setup and goes on to create a local account. I have the macbook in ABM & in the scope of prestage enrollement as well. Can we do anything about it? Thanks! 

Using a newly drafted Okta Device Trust script, this is the issue that some users are running into ERROR: Error in accessing default keychain Originally it was an issue with python and python3, but that has been resolved, however, even after running the following command for the, the user still sees the okta keychain in Keychains, though its grey with all actions also greyed out but the user can see the okta-db file when running security list-keychains"sudo security delete-keychain "/Users/$user/Library/Keychains/okta.keychain-db". I ran the above during an ssh session but even after closing and reopening the Keychains app it still shows up, which is troubling. Tried confirming deleting the file and from the SSH session at least it shows its gone sudo security delete-keychain /Users/$user/Library/Keychains/okta.keychain-db security: SecKeychainDelete: The specified keychain could not be found. running "sudo ls /Users/$user/Library/Keychains" shows that

My district recently purchased Jamf School to manage all of our iPads and a lab full of iMacs.  So far I haven't run into many issues with enrolling devices and deploying apps, but I've hit a wall when it comes to Adobe CC.  I've searched the forum here for solutions, but most of them seem to involve Jamf Pro tools, and I haven't been successful with the few workarounds I've seen.  I have tried using Composer to package the installer and I was even sent a script by Jamf support to download the package from Google Drive and install it, but with no luck. I have tried deploying the package for the stand alone creative cloud app as well as packages with some of the Adobe apps included.  I'm using the Apple Silicon versions right now, but would eventually like to deploy the Intel packages as well for some of our older iMacs. Does anyone have another suggestion for this macOS/Jamf newb?  Thank you

Hi all,I'm having two challenges and I need to find a solution.  I would like this solution to be native.  That is, I know there is a solution that uses the macadmin-python.  I'd like to avoid that if possible and find a solution within Jamf Pro or the scripting framework built into macOS 12.3.  Here's my challenges:1. when I add an 802.1x network profile using the Configuration profiles in Jamf Pro, it places the network at the BOTTOM of the list of preferred networks.2. I have not been able to find a scripting solution other than the macadmin-python script in many other Jamf nation posts about this topic.Does anyone have any other solutions?  This really is challenging because our users are not connecting to the proper Wi-Fi network (Employee 802.1x) and employees are so insistent on adding the Guest and BYOD to their school laptop. 

I have the ADCS/802.1X configured with unbound macs using Jamf Connect. The profile works, but sometimes I notice that the com.apple.network.eapolclient.configuration is blank; even with the configuration profile and proper certificates in place. I have to re-deploy the profile fix the issue. Has anyone run into this before?   

Hi everyone,the previous Administrator at my Workplace used the Model identifier with like "Book" and not like "Book" to sort the Macs into MacBooks and all the other more Stationary Macs.After the first departments bought the new M2 MacBooks Pro, we noticed that Apple had removed the word Book from the Identifier, meaning that the MacBooks were suddenly treated like an iMac or Mac-Mini.My solution for this would be to evaluate the value of Battery Capacity. For iMacs and Mac-minis it says N/A, while MacBooks always have a percentage there.Out of curiosity, how do you implement this distinction, if at all?Would anyone recommend another way?

I have a user group, that has only site level access.  But I'd like to have it setup to where the group has the ability to use jamf admin for only their site.If I'm understanding correctly how JAMF has this setup, what I'd like to be done is not possible.  It looks like to give some access to JAMF admin, they have to have full access.  Am I correct?  or am I missing something?Thanks!

This is a feature request. On the view of individual Smart Groups, please add the list of items that are scoped to all devices in the smart group (applications, policies, profiles, etc.).

Hi everyone!We're looking for a workflow on how to do a double Inventory Update after the policy has run. Specifically, we're installing Jamf Connect via a policy, and while there is already an inventory update set to run as a maintenance task after the policies execution, this inventory update does not yet include Jamf Connect in the list of installed applications. So we need to have another one run a little bit later, which then reports Jamf Connect app as installed, which uninstalls other profiles from the computer. How could we go around doing that?

Hello... I thought this would be easy but I'm struggling. I need to create a report that contains all "FileVault 2 Enabled Users" per machine that is rolled into Jamf. I can click on an individual machine and check it manually per machine at the disc encryption section, but I can't figure out to have this automated into a report via an Inventory search/Smart Group. Anyone?

Hi all, Is there a way for script remove computers on jamf protect with more than 30 days no contact? The goal is if they connect again they will be added but if not they are gone gonethanks Carmelo

 Hello,I have DEP in place and working fine.I have some Macbooks that require User-initiated enrolment.As far as I am aware, I can invite the users by enrolment invitations or sending them the link https://companyName.jamfcloud.com/enroll/I have LDAP (Google) setup but why is it asking for the user to login. Shouldn't it just let the user search their name via LDAP and download the profile to install once I invite them to download or send them the link?I have attached 2 screenshot. To login, I can only use my Jamf admin account to login and then it let me use LDAP to search for the employee to download the profile. By this way, I need to give my admin credentials to the employees to login.  Am I missing some options to ignore the login screen or this is the only way?Any help is appreciated. Cheers!

Figured I'd start a chat thread for commenting/chatting during JNUC 2022. So the keynote is about to start. Are you hyped? :) Will we blown away? Or will it be mostly "meh"? :)

Resorting to posting my issue here because Apple has been no help when I try to explain what is going on. I can't find anything useful as nothing I come across seems to be the problem we are running into. This is in regards to updating our user machines which are a mix of both Big Sur and Monterey throughout the company. We use Nudge as a means to steer our end users to install the most recent versions of macOS. We were seeing issues with downloads failing, even after reviewing firewall rules with the system admins and Zscaler exceptions as outlined on Apple's own website. We have also tried to install the install assistant for testing, and that failed due to a "could not communicate with a helper application" failure message. All of these issues require us to direct the end users to boot into safe mode, which so far is the only way that we have seen any success with getting these things installed. We are a pretty small team and our company is rapidly growing, so I would like to g

Hello All, I Have a macbook that will not update inventory. This device was recently updated from High Sierra to Big Sur. When looking in JAMF Pro it shows that the device is checking in properly but hasn't updated inventory since last July. Any suggestions?