Hi all,I have recently been brought on to my organization and am working with Jamf Pro for the first time. I've tried coming through the posts to look for topics that would help clarify things for me on issues that we're having, but I just cannot seem to find the answer.Problem:All of our new MacOS devices with 12.3 or newer do not automatically launch DEPNotify, older MacOS devices such as 12.2 will automatically launch the package and begin the configuration process. From what I have read, there may need to be some verbiage changed in the scripting process or potentially another package? I could use some help getting pointed in the right direction. Thanks for any help and feedback on this.

I wanted to share my configuration XML for those wanting to rollout zoom to IOS and lock it down. I am working through Zoom's documentation here:Using MDM to configure Zoom on iOS The following is the configuration I used: <dict> <key>SetSSOURL</key> <string>yourdomain</string> <key>SetEmailDomainsRestrictedToLogin</key> <string>yourdomain.org</string> <key>ForceLoginWithSSO</key> <integer>1</integer> </dict>

I have a CSV with a list of all the departments and buildings. Is there an easy way to bulk import it into Jamf? I looked at MUT, but don't see how to do it with that. I think it can be done with the API as well, but if anyone has a working solution it would be helpful. Thank you

Have never been able to figure this one out. Configuring a policy to add Adobe Illustrator to a dock will always fail and show a "?" All of the other Adobe CC apps seems to work fine. Adobe Illustrator CC 2018 file:///Applications/Adobe%20Illustrator%20CC%202018.app/ I have a theory that the OS cannot translate the upper case"I" double lower case Ls ("ll") properly. Any other theories?

Hello All,Has anyone implemented this solution? Basically it ends a meeting 5 minutes early to give the conference rooms, etc for turnover. Here's the link with Windows specifics.https://help.onaskcody.com/hc/en-us/articles/360004769820-Ending-Appointments-and-Meetings-Early-in-Outlook

Hi everyoneStarting from today my users are receiving an "unexpected error" while connecting with our VPN profile.We are using the built-in mac os VPN client to establish an ipsec connection with our firewall and everything worked fine until today. The profile is set up with JAMF.Everything works fine if we set up manually the vpn interface.The JAMF-made interface is giving us the "unexpected error".The JAMF-made interface works fine if we push the interface with the field "account" not blank (we usually push that blank because the account name is different from the mac username).Any tips?  

Hi folks,Some parts of our network have recently been upgraded, and we've noticed with our Lab Macs that are on the upgraded network, when logging in, every user is met with the prompt below:To clarify, authentication isn't required to have a working network connection - devices are already connected and able to access the network / internet. Each user can go into System Preferences and disable this, however this isn't viable with a Lab setup as multiple different users will use multiple different devices each day, with any accounts created on the devices cleared overnight.I've had a look online at some resources to see if there is a way to disable this. There are some proposed scripted solutions:https://community.jamf.com/t5/jamf-pro/get-802-1x-authentication-status-for-ethernet-via-script/m-p/164047However, unfortunately the prompt appears immediately after logging in, before any login scripts can start. I have also attempted to see what process is kicking off this prompt to see

First post - here we go!Some context for this post: Our Company picked up Jamf Pro in 2019. Since that time we have slowly been building up the platform. Primary goal being to get to a zero-touch state with our devices (wanting to cut out IT as the middle-man for having to manually setup new Macs). We hit a snag with this process in that our devices rely on certificate based authentication to connect our users to various services.The machine based certificates would deploy relatively quickly after login; however, we could not get the user based certs to deploy due to a missing flag for the user account on the Jamf side. The flag being “MDM Capable User”. Without the username populated in this field - the user cert config profile would not deploy to the Scoped Macs. It was originally due to us skipping account creation in pre-stage and leveraging Jamf connect to complete that step. This left the user without a secure token and would require fully unenrolling the device from Jamf vi

Hello Jamf Nation,   Today we are releasing Jamf Pro 10.41. To learn more about this release and the product issues it addresses, review the release notes here.   Cloud Upgrade Schedule   Your Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.41 based on your hosted data region below.   Review this guide if you need assistance identifying the Hosted Data Region of your Jamf Cloud instance.   Hosted Region Begins Ends ap-southeast-2 16 September at 1400 UTC 16 September at 2300 UTC ap-northeast-1 16 September at 1500 UTC 17 September at 0100 UTC eu-central-1 16 September at 2200 UTC 17 September at 0800 UTC eu-west-2 16 September at 2300 UTC 17 September at 0600 UTC us-east-1-sandbox/us-west-2-sandbox 17 September at 0000 UTC 17 September at 0900 UTC us-east-1 17 September at 0400 UTC 17 September at 1700 UTC us-west-2 17 September at 0700 UTC 17 September at 2

Hello,We have bunch of intel, m1 and m2 Macs.I am trying to lock them with activation lock so that no one can erase the mac the device.Currently, the Macs can be forced into recovery mode and use "erase MAC" to fresh install the OS.Can someone guide me to lock with company ABM please?Any help is appreciated! Cheers

Hey everyone near Toronto. Was considering starting a user group for us. Just trying to gauge how many people would be interested. I’d be hosting in Toronto distillery district where I work. We have a top facility in Toronto and we keep getting featured in magazines Anyway add your comment if you’d be interested in attending I’m working with Jamf on content and such. Once I have everything sorted I’ll actuslly create it under user groups.

When trying to set an expiry time for mobile account have found that even if you specify a time when saved the nominated time always reverts back to "0" and "hours". If this is the only time available in this pane, why is it there? Nothing that I have read on the Admin Guide gives a clue to how it is supposed to be configured / set. We do have scripts that do a similar job if the title is correct, but having some issues with the scripts on later macOS. Thought that Configuration Profiles would be better to use maybe not if the only value is "0 hours"

I've been asked to report on how many Macs enrolled into our on-premise Jamf Pro instance (currently ~350) have local administrator accounts set, and when they were last logged into. Can anyone advise how best to go about this? Could this be done via an Extension Attribute?

I have a stupid script that removes stale homedirs in a computer lab that (for reasons I won't get into) uses PURE network accounts. Computers bound to AD, etc...so we can't leverage jamf -removeAccount type of script  Network accounts aren't really accounts. The lab manager wants homedirs that haven't been modified for 14 days to be removed. We have a script that works. We point to it in a policy that can be run in Terminal as a custom trigger or could be scheduled to run at a set interval. It works just fine,  but only  if Terminal is granted full disk access. I know that JAMF scripts get copied to a local temp dir and run from there. How can I do what I want without granting Terminal full disk access (slight security risk but I don't want to do it if I don't have to). 

Keychain issue saving WiFi - Just started happeningI think this has something to do with Jamf Connect. I've never experienced it on my computer until today when I tried. I believe it worked before I added Jamf Connect to this computer. However, this happens on newly imaged machines now too.If someone goes to join a Wireless network that requires a password, it will give you a Keychain Not Found error "A keychain cannot be found to store <Network SSID>."I've looked in the User Templates folder like some suggest, no Keychain folder exists in there. I've tried to do a keychain reset, no luck. There is no Keychain First Aid selection. I don't see any policies that block this... I just don't know what else to try or look for.The silly thing is, if you hit Cancel, it remembers the password and doesn't really care. I don't believe it works on the login screen though.Thanks,Dominic

The Notifications indicator in the Jamf Nation banner is acting odd for me. Opening some sections of Jamf Nation (e.g. My Profile, Tech Thoughts) will cause the Notifications count label to show 25 unread notifications, but if I open the Notifications page there will be nothing showing as unread. If I just sign in to Jamf Nation and look at the Jamf Pro section under Products the Notifications count is accurate. Anybody else seeing this?

Are you running the NT-ware uniFLOW SmartClient for macOS? As you probably know, NT-ware's older versions (v1.1.0 and lower) were not as robust as their Windows versions. In order to upgrade/update to newer versions, you need to uninstall the older versions first. NT-ware places their default uninstall script here... /etc/smartclient/uninstall-smartclient.bash Unfortunately, this script is extremely rudimentary and lacks any support for running in an automated environment that uses an MDM/UDM solution such as Jamf Pro. With that, I give you my highly augmented version of an NT-ware uniFLOW SmartClient uninstaller that works both locally and/or with Jamf Pro. A brief HOWTO is posted down below... after the script. THE SCRIPT #!/bin/sh ############################################################################## # # SCRIPT FILENAME: # uninstall_nt-ware_uniflow_smartclient.sh # # DESCRIPTION: # The core functionality of this script was written by NT-ware to uninstall #

Hi, I am needing to upgrade an app as soon as a machine is updated to Ventura. My current thought is to have a policy scoped to a smart group for OS version equal or greater to 13 and then have it deploy at login. Do you think this is the best way or would at start up be better? I also don't know if the machine will get added to the smart group right away. Feedback appreciated. 

I have shared iPads set as 6 max users in the DEP profile (the profile for shared classroom iPad carts).  But there always comes a point when users start having login issues, or resetting pins don't work.  Usually because the device has no more memory or storage which gets solved by deleting the user profiles - which are way over 6.  Why are the devices allowing more than 6 users?  I thought they were supposed to delete the last profile used if a user logged in that went over the max allowed?  What am I doing wrong?Thanks!And if this post is in the wrong place, could someone point that out also?  I can't find the 'question and answer' box.

Hi We have 802.1x authentication for the MacBooks using PulseSecure Agents. We are also using NoMAD to sync AD passwords on local system, and I am facing following challenge and need some guidance for the same.We have WIFI configuration profile pushed through JAMF on new devices. post enrollment. The profile installation is done manually by user  as we want use to input the AD credentials and avoid using a common pre shared key for the SSID authenticationWhen user tries to connect to a specific SSID, first they receive authentication prompt for the WIFI ( unless the existing working credentials are stored during profile installation). Once they are connected to SSID, user receive the authentication prompt from the NAC agent and they get connected once the compliance checks are passed.Problem: Recently we have started facing challenges on some MacBooks where the Use changes AD password ( password renewal after expiry or some other issue) and then the user is unable t

So, I have a few machines where it appears as though through no action taken by the user, the MDM profile and all associated JAMF-issued profiles get deleted from some of the machines we have in deployment. Does anybody have any clue what could be causing this, and moreover, how to stop it from happening?

Hi; I am looking for a way to reboot both MacOS and iOS/tvOS devices via API commands, either with classic API or uAPI. I've found that I can use the classic API's mobiledevicecommands RestartDevice <id> endpoint to reboot mobile devices. But this doesn't apply to Computers. Oddly, the classic API computercommands endpoint does not include a Restart command like Devices does. I've found that I can create a Policy for computers and setup the Restart Immediately policy, and setup a custom event trigger such as "Reboot" to trigger it. Two questions - First, how to trigger a Policy custom event via either of the APIs?Second, how do I scope this so that I can select only one or some subset of Computers to reboot? I don't want to create a separate policy for every computer, but definitely don't want to reboot all my computers! I do realize that I could setup reboots to happen at specified times, but I really need this to be an on-demand type of trigger that get's initiated via an

Hello,I have all the configs in place for DEP & user-enrolement. But let's say, we sent a new macbook to a new employee who is starting as Work from home and the employee doesn't connect to wifi during initial MAC setup and goes on to create a local account. I have the macbook in ABM & in the scope of prestage enrollement as well. Can we do anything about it? Thanks! 

Using a newly drafted Okta Device Trust script, this is the issue that some users are running into ERROR: Error in accessing default keychain Originally it was an issue with python and python3, but that has been resolved, however, even after running the following command for the, the user still sees the okta keychain in Keychains, though its grey with all actions also greyed out but the user can see the okta-db file when running security list-keychains"sudo security delete-keychain "/Users/$user/Library/Keychains/okta.keychain-db". I ran the above during an ssh session but even after closing and reopening the Keychains app it still shows up, which is troubling. Tried confirming deleting the file and from the SSH session at least it shows its gone sudo security delete-keychain /Users/$user/Library/Keychains/okta.keychain-db security: SecKeychainDelete: The specified keychain could not be found. running "sudo ls /Users/$user/Library/Keychains" shows that

My district recently purchased Jamf School to manage all of our iPads and a lab full of iMacs.  So far I haven't run into many issues with enrolling devices and deploying apps, but I've hit a wall when it comes to Adobe CC.  I've searched the forum here for solutions, but most of them seem to involve Jamf Pro tools, and I haven't been successful with the few workarounds I've seen.  I have tried using Composer to package the installer and I was even sent a script by Jamf support to download the package from Google Drive and install it, but with no luck. I have tried deploying the package for the stand alone creative cloud app as well as packages with some of the Adobe apps included.  I'm using the Apple Silicon versions right now, but would eventually like to deploy the Intel packages as well for some of our older iMacs. Does anyone have another suggestion for this macOS/Jamf newb?  Thank you