Creates a LaunchDaemon and a self-destructing Bash script to run a recon at next Reboot, after confirming your Jamf Pro server is availableBackgroundWith surprising frequency, updating a computer’s inventory with the Jamf Pro server the next time a computer reboots can be quite handy. For example:After upgrading the OS via erase-installAfter completing Setup Your MacAfter running Office Reset policiesAfter FileVault-related policiesThe self-destructing script will create a LaunchDaemon and

HiI'm trying to get an email notification when a specific application is not running on the device.For that purpose, I have a Smart Group for the devices where the process is not running and sends an email on each membership change. The annoyance is that on the user login after boot the app is not detected, generating a report because the device was added to the group, but in the minute after the application is detected and the device removed, generating a new message.I'm trying to reduce these unnecessary reports by introducing a delay or a condition on the smart group.My initial idea was to place a condition like "Last Inventory Update" or "Last Check-in" more than a few minutes ago, but the rule builder only works with date and days, not minutes.How would you accomplish the objective? [receiving email notifications on apps that are not running but with a small delay]

Happy Monday everyone, I'm currently going through the process of implementing the CISCAT benchmarks for Security, you can take a look at some of the features here if you are unfamiliar. I am trying to make it so that I can deploy SecureKeyboardEntry to the terminal. The best I could come up with is making a script to edit the PLIST and then pushing that script via policy. defaults write /Users/$USER/Library/Preferences/com.apple.Terminal.plist SecureKeyboardEntry 1 The bit seems to work in having the setting checked off, however it also seems to remove whatever terminal customizations the user has. Anyone have any recommendations for implementing this?

Hey All!I've tried with 0 success to get the screensaver to load up on the login window.   (set to 1min to speed up testing)I've tried all the Screensavers, but none will load over the login window. However, if a user is logged in, no problem, the screensaver comes right up. It's not the biggest problem, but to save my screens from burning, I set a power setting to put the display to sleep instead.  Students think the Macs are off instead of sitting down to use them and drift off to use a PC.  We run lots of metrics and device use often defines device purchasing. Any suggestions or maybe an upcoming patch/update?  I've tried some of the older scripting madness I used to use to overwrite pref/plists etc but those no longer work (really haven't worked well since Catalina).  I'm just stuck. &#1

i have a computer extension attribute we use to set a computer's Role. its a drop down list. im trying to get a script to update that EA value in bulk off a .csv file of serial numbers.im hitting a wall. i get no errors and it looks like it all runs fine, but it just wont update the EA value. i have the script running is a self service policy. i have pasted my script below. what do i have wrong?also most of this is cut and paste from many other sources on the internet. mostly jamfnation #!/bin/bash exec > /Library/pthsd/output.txt 2>&1 YourAPIUsername="$4" YourAPIPassword="$5" # This is your unix line ending formated csv file of serial Numbers # First Column is labeled serial INPUT=$(/usr/bin/osascript << EOF tell application "System Events" try set INPUT to text returned of (display dialog "Enter the path to the .csv file with serial numbers" buttons {"Cancel", "Enter"} default button 2 default answer "") end try end tell EOF)

Not sure if anyone has run into this slight issue... when I erase a new M1 iMac using Erase all content and settings, and then enrol a managed device, when the enrolment completes I run additional installations and configuration via DEPNotify. DEPNotify does not kick in when the computer is wiped using Erase all content and settings, however if I use Recovery and wipe it, everything works as expected... 

We have a big problem with our Big Sur machines that can't renew/generate a new AD Certificate.Big sur machines receive correctly the initial certificate from AD during enrollment, ONLY the renewal feature does not work.We have tried both on the local network and over VPN, same result. So it's not a VPN issue.Works fine with our Catalina machines though. All our machines are bound to AD. We are not using ADCS Connector.Running Jamf Pro 10.26.1 on prem on a Windows server. The AD-Cert is valid for 365 days and it set to renew 14 days before expire date. For troubleshooting purposes, we created a new certificate template with 7 days of validation and automatic renewal is set to 5 days before expire date.Unfortunately, we get the same problem as before. Works only on the Catalina machines. We have generated a sysdiagnose file from a catalina and big sur machine and sent it to the jamf support. Without any luck so far.

I've had an issue crop up today where devices (specifically iOS devices) are not getting VPP licenses assigned to them when an app is in scope. I've confirmed we have thousands of extra licenses available but each device is stuck in this state:Pending - All licenses are in use or the license is not assigned yetWhen checking the Volume Purchasing logs this message is repeated endlessly:[ERROR] [ralPool-309] [VppCommService ] - Error managing licenses. ErrorNumber: 9600 , ErrorMessage:Either an associate or a disassociate array is required.I've got a ticket in with Jamf, but I'm a newer Jamf administrator and wasn't sure if this is a Jamf/Apple problem or something I might be able to fix. 

Hi when I install the company portal on my iPhone it gets stuck at download management profile, which I understand.So how do I get my iOS devices compliant with (or maybe even without) the company portal thnx a bunch

Hello!I have Jamf connect set up on a Mac and when the display is locked and waiting for a password after so many minutes of inactivity, the only options I see are to enter the password or "cancel" which puts the display to sleep.I'd like to get it configured so that when the display is locked after inactivity that there be a way to switch to another user so if someone walks away and the screen gets locked, another user can still log into their account (without force powering off the iMac). Any ideas?

Hi ! I'm looking for how to check prevent Mac from automatically sleeping when screen is off in battery settings. I don't have this feature in configuration profiles. Do you know a solution ? Unfortunately I couldn't find anything :( Regards

I'm beginning to develop Self Service for a client and am wondering if anyone is finding the Flush System/User Caches at all useful? Or, is this in the same category as Repair Permissions, once in a while helpful but mostly not?

Hence MacOS Ventura Passkey's on it's way at any given time, Anyone having Conflicts with MDM Enterprised Macintosh'es with adding LastPass Password Generator and Cloud Repository with iCloud Keychain? Hence LastPass is just a Browser Add'In and iCloud is set in the System Preferences, Anyone Experiencing Hiccups/Conflist's and Errors?Is there a setting that we can disable iCloud Keychain as as Admin in Jamf Pro Config? 

  Im in a situation where i cannot log onto the local admin account that was created when it went through the prestage enrollment.  Our encryption policy essentially made that local admin user a filevault user, but in JAMF, it shows as not encrypted still. Typically, I would just need to log onto that user from the login screen or terminal but it all shows me as password incorrect. I tried resetting the paassword in recovery mode (it asks for the admin account password which i dont know), I tried local account payload for resetting, deleting, and disable filevault user but they all returned errors and was unsuccessful.  Is there any way to navigate this?

We were shown how to use Composer to package applications from DMGs when we purchased Jamf Pro.  You install the app to Applications via the DMG. Then you copy the app to Composer and supposed to change the perms to 'root' & 'wheel' and 'Apply Owner and Group to Frameworks and All Enclosed Items' to the uppermost folder (Applications).My question is, some apps come as a Package (.pkg).  Can I just import the package to Jamf to push the app to users? Do the permissions really matter?  The 'root' and 'admin' permissions are always there in Composer, all of our associates are admins on their Macbooks. Thanks in advance for any insights into this.

Hi folks, We want to use a policy to unbind computers from our AD domain and then rebind them. Binding can be done through the Casper GUI, which *'s out the domain credentials, so that's not a problem. However, I don't see a way to unbind computers like that, so we have a script to do it; however, the script also requires domain admin credentials to run. I can pass the parameters from the Casper policy, but I don't see a way to encrypt them, and I don't want the domain admin password visible in plaintext in Casper. Any help?

Hey Does anyone use Anyone use JumpCloud and Jamf Now?We have Jamf fundamentals setup and we'd like to deploy JumpCloud for for identity management.Anyone used the two services?  do they play nicely ?  

I have a machine that keeps getting Device Signature Error if I try to run sudo Jamf policy or sudo Jamf recon.I can temporarily fix this error for a few days if I removeFramework and re-enroll the machine.  The the error will come backFri Jun 17 10:14:04 IN-XXX-180122 jamf[75414]: Error Domain=com.jamf.jamfsecurity.error Code=-25293 "unlockWithPassword:error: : The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=unlockWithPassword:error: : The user name or passphrase you entered is not correct.}Fri Jun 17 10:14:04 IN-XXXX-180122 jamf[75414]: There was an error.     Device Signature Error - A valid device signature is required to perform the action.The time is correct on the machine.  Anyone have any ideas on this?

When I run the command below. I think it should only update the exclusion list for the mobile devices. While it does update the exclusion list it also removes the scoped devices. I'm not sure why.  curl $jamfProURL/mobiledeviceconfigurationprofiles/id/32 -H "content-type: text/xml" -H "Authorization: Basic ${apiBasicPass}" -X PUT -d "<configuration_profile><scope><exclusions><mobile_devices><mobile_device><id>$id</id><name>$name</name><udid>$udid</udid><wifi_mac_address>$wifiMacAddress</wifi_mac_address></mobile_device></mobile_devices></exclusions></scope></configuration_profile>"  

Hello JAMF NationAs the subject states I have been tasked to migrate about 50ish or so macs from one domain to another and was wondering how others like myself have got this to work as effortlessly as possible. I have some concerns and was hoping to get some Ideas on how to go about it and getting it all done properly.Currently: Machines are domain bound and in their perspective security groups and OU's and managed with (NoMad) for password changes. The usernames (mobile) currently on the machines have file-vault enabled and are the only accounts to have a secure token. Question? How or would it be possible to migrate to a new domain with a new username as the usernames do not follow the same convention as the previous domain, that would in part need to have a secure token passed to it as well as maintaining the File Vault structure already escrowed to JAMF and making sure these users are added to their new OU's a

Does anyone else deploy this out to their users?If so, could you tell me your method. Composer does the job, but it could be cleaner.

With the increasing trend to stop binding macs to AD, I put together a script to demote mobile accounts to local. To re-iterate - this one is risky. Please test it carefully if you decide to try it out. If you find additional attributes that your fleet needed - would be interested to hear. #!/usr/bin/perl -w # mobiletolocal.sh # Created by LD # Appears safe to run whilst logged in - user keeps existing password :) my $userlist = `dscl . list /Users`; chomp $userlist; my @excludedusers = split(" ","root daemon nobody _amavisd _appleevents _appowner _appserver _ard _assetcache _astris _atsserver _avbdeviced _calendar _ces _clamav _coreaudiod _coremediaiod _cvmsroot _cvs _cyrus _devdocs _devicemgr _displaypolicyd _distnote _dovecot _dovenull _dpaudio _eppc _ftp _gamecontrollerd _geod _iconservices _installassistant _installer _jabber _kadmin_admin _kadmin_changepw _krb_anonymous _krb_changepw _krb_kadmin _krb_kerberos _krb_krbt

I was curious if anybody had additional information for a project I've been working on. I'm running into an issue where in some computer labs that see frequent use, there are often many users signed into a mac at the same time and the machine begins to slow down.What I was looking to do is setup a policy where users are automatically logged out after a certain amount of time of inactivity. I see that is a configuration profile option for this setting, however from my testing it seems that the inactivity timer is only active when somebody is not on the lock screen. Is there a way using the configuration policies to log out a user after a certain amount of time, even if they are at the lock screen?

Help! So we are in the middle of implementing Jamf Connect. We require online authentication and multifactor authentication with Azure AD.But what is the workflow when a user lost his password?Sure when the FileVault login window shows, we can enter the personal recovery key. Then the online authentication window will appear, and for this the user can login with the new Azure AD password.But then Jamf Connect want to have the previous local password to sync the online and local password. But we have only the personal recovery key at this point. We cannot continue from this point on.How to proceed from here? 

Hello Jamf Nation!Does Jamf foresee any time in the near future that this option (Enable Lost Mode as a Mass Action) will be available?