At our school we follow a "security through obscurity" policy regarding WiFi connections. I know, I know.The kids never see the actual password, it is just pushed using a profile in Jamf School. But in iPadOS 16 the user will be able to see all stored WiFi passwords.Does anybody know if Jamf will be able to block that feature?Thanks!

We are planning to deploy Microsoft Edge for mac soon in our org. One my main worries is having a way to ensure the app is always auto updated. What is the best way to go about enforcing this?

I need to copy files over to a folder that I created called /usr/local/etc.  To be more specific, it's 4 files that I created that contain Lightspeed certificate files (.pem files). What's the best and easiest way to go about copying these files over to 30 Macs using Jamf?  I am not sure how a script would work since these files are stored locally.Any advice or help is appreciated.Thanks,Robert

Hi Everyone, Tomorrow is our scheduled call with a JAMF Engineer to help setup JAMF connect for us. I was wondering if anyone has any advice or knowledge they want to share that I can ask the Engineer. I am getting a bit of the pre-Meeting jitters since I want to make sure everything goes well. We are an Azure shop with Federation Enabled and have started to implement FireVault since July (slow roll out). Just want to see any advice or questions you wished you have asked.  Thanks. 

HI Team,Not able to see the updated version to upload the package and push in patch management. For example abobe brackets  newer version 2.1.2 but able to see only 1.4.2. any suggestions how to get these updated. also not able to see chrome canary

Like the title says, I can’t find a good article or tutorial that is up to date with all the info needed to properly set this up.I have a signed package that installs jamf connect, image assets, and the script, all with wheel/root 755. This has a postinstall shell script to install the jamf connect package and then set authchanger to -reset - JamfConnect -NotifyI have a profile setup and scoped that includes the script path and all other settings for connect login, it’s also deployed at enrollment.I feel like I’m doing this all correct and something isn’t clicking.Currently stuck at after first login, notify does not run.On Monterrey 12.3Any help would be greatly appreciated.

Hi all,I've scoured the internet and have had just about zero luck with this. I'm trying to get my script to request user input and it works great. When I load it into jamf self service it runs and then finishes with no error but never prompts the user for anything. Can someone point me in the right direction?I've tried getting the current user and running the command as them but no change.

Hi, I noticed that all of my Macs had an old scope that pushed out a Device license to all of our Macs. The problem is that my school has moved over to User License accounts and as soon as this old policy was pushed through, the User License accounts no longer work (it's using the device license)*.Is there a way to permanently delete the device license (hopefully without removing all of the adobe apps) and have it re-trigger the user license instead? Thanks in advance! *sadly these old policies were pushed through after I cleared out 500K+ failed polices.

I'm pushing out the Cisco Umbrella OrgInfo.json file.  It's currently working, but because I have the policy set to Reoccuring and ongoing, the json file copies to user endpoint every 15 minutes.  I'm not keen on chaning it to Once Per User or Once Per Computer, I'd rather keep it set to Ongoing. I've added the following to my installation script# Check for and install Cisco OrgInfo.json if missing if [ -e "/opt/cisco/anyconnect/umbrella/OrgInfo.json" ]   then     echo “OrgInfo.json exists’  else    sudo installer -allowUntrusted -verboseR -pkg /Library/Application\\ Support/JAMF/Waiting\\ Room/OrgInfo.pkg -target /fiAnyone have any better ideas?  Should I just build another policy just for the installation of this .json file?Thanks in advance,

Hello,We are seeing an issue where if the network on the mac changes Kerberos tickets disappear. I have to go to Jamf Connect and hit 'Connect'. I know this is a known issue but we are seeing it WAAAAAAY more now.This is the PI: [PI009997] When integrated with a Kerberos realm, Jamf Connect does not consistently obtain Kerberos tickets when a network change occurs.All my users are noticing it now even though we always keep Jamf Connect up to date with the latest version.If my mac goes to sleep and I wake it up the Kerberos tickets get flushed. If I connect to a docking station with ethernet it gets flushed. If I connect to VPN it gets flushed. If I switch Wifi networks it gets flushed.Anyone else seeing this?

I have created this policy but it looks like it's not pushing the update thru jamf pro. Can anybody advise me on this?

Hello, I’m trying to push the new software update on some iPads using Jamf. I push the command remotely but it only works on some iPads. Are the ones that are not being pushed unsupervised? Is there a way to make them supervised?

Is it possible to force a supervised iOS or iPad OS device to update their OS remotely without DEP? Thanksall devices are managed by jamf now, and supervised, but not in DEP

Today we released Jamf Pro 10.34 which includes enhancements to the Jamf Parent and Jamf Teacher apps, updates to the Jamf Connect auto-deployment settings, and new Shared iPad session features. This release also gives IT admins the ability to select which macOS version users or groups of users will download and update to.  Jamf Pro Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI-010190] URL injection is no longer possible through certain API endpoints.[PI-005567] Jamf Pro no longer unexpectedly stores WLAN information in the keychain.NOTE for on-premises customers: Be sure to review the release

In Jamfcloud, when configuring a new ADCS certificate authority (Global Management > PKI Certificates > New Certificate Authority > ADCS), the interface requires me to upload a Server Certificate file.  What are the requirements for the format of this file?Specifically, assuming that the file contains more than just a single, self-signed cert,Which elements of the full certificate chain should be included in the file?Leaf cert onlyLeaf cert + intermediate(s), but not root (This is what’s normal for a web server.)Full chain: Leaf cert + intermediate(s) + rootIf more than just the leaf is needed, should the elements should be provided in a leaf-first PEM bundle, as is typical (for example) for Apache?If the root isn’t included, is there someplace else where I am supposed to tell Jamfcloud to trust my internal CA root?Thanks,Chris

 I use Jamf Pro with SAML SSO and I am annoyed by certain behavior of jamf.When the Jamf web interface is open in multiple tabs and the session is expired, the jamf redirects to the logout page (logout.html) in all tabs. After that, I cannot log in to the web interface until all tabs that have the logout page opened will be closed.I am wondering if other jamf users are having same issue? Maybe there is a solution for it? Jamf Pro verison: 10.37.2-t1648851072

We have a bunch of sites for Labs in Jamf, but we are finally starting to roll out jamf to the rest of campus macs. We have a site just for these. We used to use MDS for imaging but are moving away with using ASM/ADE and jamf to push down all applications/settings. The question now becomes how do we image lab computers that are in different sites and assigned to different MDMs in ASM (we have an MDM for each site in ASM)?  Would rather not have to maintain our "Image" applications and settings in each site.  We could initially put lab computers in one site, do the image and then move them to their lab site but what happens with ASM when we do this? (techs do not have access to ASM). Also what about iOS/mac app store apps since they are assigned to MDM in ASM. If there is a computer assigned to a MDM in ASM, but is now in a different site (with different MDM token) in Jamf will they get the apps? Also will config profiles work even though ASM and Jamf Site that the computer

We have a fairly new deployment of Macs and our users are all standard users.On our previous Windows laptops, standard users were able to remove any "remembered" networks. This doesn't seem to the be the case for our new Mac laptops.I've tried enabling the Network preference pane using scripts provided by other users on the forums that uses the authorizationdb command. And while it does unlock the Network preference pane, it still prompts for admin creds when you apply the changes.How do you handle your users needing to remove old preferred networks?

Deploy your favorite from a trio of Jamf Pro Extension Attributes which leverage macOS Monterey’s (and later) networkQuality binary to help you better understand your users’ Internet connectionBackgroundAfter reviewing Brock Walter’s The networkQuality Is Not Strained post and observing fairly consistent download failures for just a handful of users, the time was right to leverage the networkQuality binary introduced in macOS Monterey to better understand our users’ Internet connection.Continue reading …

Trying to convert our jamf license to .mobileconfig to deploy on intune. Can’t seem to figure it out. Used mcxToProfile.py to convert. Do I add it as a device or user profile? Tried both and still showing as trial version.

we have a fleet of iPads that have recently had some security payloads distributed to them, one setting looks to have grayed out the ability to sign in to your Apple ID in the settings, thus preventing some users from downloading apps - I am trying to comb through what specifically that is, was wondering if anyone has came across this yet (I need some users to have that ability to download apps via unmanaged ID)

Hello,Before the release of Monterey, I was experimenting with krypted's MakeMeAnAdmin script. After the release of Monterey, I started noticing issues with the script, especially when executed on Apple Silicon Macs. Then, I discovered geekquixotic's MakeMeAnAdmin Script. The script seems to work very well for elevation and removal of privileges, but I'm having some trouble getting the logging and the group removal feature working. I'm hoping someone else uses this variation of MakeMeAnAdmin and can help me figure out what I might be doing wrong.I've set Parameter 6 to an authorization request header that I generated using DebugBear's basic auth header generator. The Jamf

Hi, On our JAMF pro, it shows 1 unmanaged computer.How do we find out which device that is?

I want to create policies that allow users to run system/security updates from Self Service so they can do it at a time when a restart is acceptable. I put together a test policy to update from 11.6.2 to 11.6.3. After scoping it to two test systems, I clicked on the update offers. The install job starts, but then just sits there with the installation cursor going round and round and no further progress is made. I've configured Software Updates, Restart Options, and under Files and Processes I've entered the following under Execute Command - /usr/sbin/softwareupdate -i 'macOS Big Sur 11.6.3' For Monterey 12.2.1, I've configured a similar policy which executes the command -softwareupdate --install 'macOS Monterey 12.1'The results there are the same. Has anyone done this successfully, and if so, what was the syntax you used? Is there anything else I may have overlooked?Thanks for your consideration

Hey Guys,I've run into a strange issue with people trying to Mount DMG Files. I've only experienced this with Monterey 12.5, regardless of whether it's a newly imaged machine, or an upgraded OS one. I've only noticed this with M1 Macbooks. When you go to open a DMG, it just doesn't do anything at all. Maybe a process inside Activity monitor loads up, then nothing. The only way I can get them to mount is if I go to Activity Monitor, select diskarbitrationd and diskimagesiod and force quit them. Then it will mount them for a while... Ultimately this comes back though.I've tried to use terminal to script this out so that some of my employees can install software, but killall doesn't seem to be having the same effect.Is this something you've been seeing? This has not happened in any other versions of Monterey. My computer used to mount them just fine, but now I cannot. Any ideas or suggestions? Thanks,Dominic