Happy Monday all (🤣) So last week after successfully making a script on the classic api to change a site for mac using bearer tokens and properly salted/hashed api creds, i'm now on to my next challenge of using the preview api to set the recovery lock ready for all these MBP M1 pro's that are arriving shortly :- https://developer.jamf.com/jamf-pro/reference/post_preview-mdm-commandsso after getting to grips and trying to utilise the nice example generator, i send this to it in a script but all i get back is " [ ] " so not even a proper rejection.can I assume first that the "managementid" is the UDID of the device and the clienttype is correct for a macOS device??  code below..  NB. its worth noting in actually passing the managementid as a "'"$UDID"'" as i am running this script locally grabbing the udid via the MBP's serial number from the classic api.  I still get the same response..   curl --location --request POST "$jamfpro

Hi,I just noticed a bunch of my computers (about 75%) stopped checking in to Jamf Pro  (cloud) on a specific day in August:On running sudo jamf policy I get:There was an error.     Device Signature Error - A valid device signature is required to perform the action. Jamf log at /var/log/jamf.log on the client shows:Sat Aug 13 06:22:26 ServerXXX jamf[15424]: Error Domain=com.jamf.jamfsecurity.error Code=-25293 "unlockWithPassword:error: : The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=unlockWithPassword:error: : The user name or passphrase you entered is not correct.}Sat Aug 13 06:22:27 ServerXXX jamf[15424]: There was an error.Device Signature Error - A valid device signature is required to perform the action.  The problem seems to be fixed on each client by running sudo jamf enroll -prompt on the client. It's a lot of busy owrk to do this on each client - is there a better way?Also, since this is possibl

User was recently removed from old AirWatch MDM and enrolled into Jamf using pre-stage command - sudo profiles renew -type=enrollment. Before I installed the Jamf profiles on the device, I had to re-bind the machine to the domain because the local password and Okta password did not sync. I then removed it from the domain again and verified the local password now matched the users Okta password. Restarted the device and had user log in with newly updated password. Ran command to install Jamf profiles, restarted the device and had user review and install profiles. After all profiles and policies installed I tested Jamf connect (desktop app) and was able to have the user sign in via Okta. On the next restart where the user has to connect the local account to Jamf connect for the first time it does not take the local mac password that was being used. Keeps saying invalid password. Had user try the old and new password that was on the device and still could not conn

I'm currently testing out a Jamf Now (Fundamentals) deployment for a couple of Macs we have. I haven't used Jamf before so not too sure how Jamf connect should work, but have a feeling mines not correct.I have setup the setting "Enable password sync with Jamf Connect" and done the setup in Azure for it. When a user first logs on it asks to type in both password (microsoft & then local password) so it could sync.Then we changed the password in Microsoft to see if it worked but on the macbook we have to login with the old local password and then in Jamf connect enter the email and the new microsoft password and it says they are out of sync and input the local password.I assume this should be a bit easier as its not exactly syncing the passwords currently?

Has anyone been able to install 1password 8? I have tried installing it on my build Mac and bundling it with Composer. The installer seems to finish, but is doesn't show up under Applications. I have tried pushing the installer to the computer and then running it with a script. the first time I tried the below script, it will download the program and then it asks for admin login.open /path/to/app.app & so I tried this scrip, but it just spins forever.su <admin user - not root> open /path/to/app.app & I know it can be installed via the Mac apps (at least 1Password 7 can), but that links to the App store and I have that locked out so the users are unable to access it.BTW, I'm wanting the app to be available in the SelfService portal.

I'm testing the Mass Action Update on a couple of Mac's. One is an Intel and the other is M1. They both have the 12.5 available update, but when I deploy the command to both, I don't see any prompts where it gives you options when to deploy it. It does show up under their device as pending, but goes away. For the M1, have the bootstrap token on our devices. For the Intel, it looked like it worked, because the Mac is now showing 12.5. Is there a log where I can look up to see if the command ran successfully? 

Hi all, Somehow I am unable to install this driver from Apple website: https://support.apple.com/kb/dl1867?locale=en_US We use Papercut as our printer management, but we are unable to proceed due to the driver issues. Even the PPD driver from Ricoh website does not seem to work. Anyone using Ricoh MFP in their environment? How do you install printers on your users Macbook?

My client is going to be migrating from an in-house mail server (Kerio Connect) to Office 365 and I am trying to figure out how to leverage Jamf Pro for this project. The problem is that even though I have decades of experience with Mac administration and with using the VLA version of Office I have no experience with Office 365 and I am finding that some of the setup is frustratingly opaque. Take for instance the Exchange payload when setting up a User-specific Configuration Payload in Jamf: Is the Domain simply the organization's domain? More important, what do I enter for Internal/External Exchange Host, the Ports and the Internal/External Server Path fields?! I have looked at reams of documentation and I can't find a simple answer to those questions. I even asked the 3rd party company that is helping us perform the migration and they were not able to offer any suggestions other than "call Microsoft". If anyone here has any insight I would greatly appreciate it!BTW, this is spec

I remember being able to bypass all of the new user setup steps in macOS in the past, but I don't see how that's done now on newer versions of macOS. I remember there was a payload we could deploy in a configuration profile. We can do this during PreStage but if I setup a hidden admin account, and I later need to login using it, I would like to not have to click through all of the setup steps just to get in and do what needs to be done. Does anyone have a process for this to avoid the setup steps?

I have a LAPS solution running monthly to reset the local admin password but I also want to be able to trigger this after the password has been viewed.I have a custom trigger but without flushing the logs the custom trigger only runs monthly as well.Has anyone figured out a way to have a policy running on schedule but also be able to trigger it from a custom trigger on demand? The only way I see to do this is to create another policy which isn't best to duplicate things just for this.

I'm looking for a way to find out how many licenses I need for apps without having to note which smart groups are assigned to every single app. Ideally it would be a query (API or SQL, doesn't matter) to find an App Name and its license count, as well as the number of devices it is scoped to. In my mind it seems like such a simple thing, but I don't quite have the knowledge of what each table lists or even which is the correct table to pull that information from in the database. Does anyone have a script or query that they use themselves to pull this information? Any help is appreciated!

HIIm trying to setup a custom path on the inventory collection i want it to collect everything in the Users application folder but i dont know the syntax i need to use users/johndoe/applications ??

Hello,As of right now we enroll MacOS Devices in these steps.Depnotify -> Self Service opens -> Sign in with Microsoft account -> Click Register Device (This is a register to intune policy) -> Sign in with Microsoft again -> Keychain popup opens -> Sign in with Microsoft again -> Type local password to approve saving in keychain -> done.I already attempted to trigger the register to intune policy after depnotify ends, this should already prepare SSO so a login to the Self service is no longer needed. However, this seems to break the SSO. For some reason only triggering the policy from the Self service portal seems to work fine. Has anyone found a way to run the register to intune before opening the self service? And does that work? Additionally, any other tips to reduce the amount of times you need to sign in? Is there a way to automatically allow the keychain popup rather than having to type your local password? Thanks!Tobias

Hi all,We have Jamf ADCS Connector setup and everything is working fine. Certificates can be delegated and no issue there but..We have recently realised under PKI Certificates -> And under the Certificate Authority then under Active there is a lot more issued certs and a lot on "Pending Revoke" than there is devices. And so far we have only seen iPads on status "Pending Revoke".So we have a iPad and we tested this out - we added the iPad on the profile that delegates WiFi and the Certificates and the iPad is on and connected to a WiFi so it has internet but it is in locked screen. What we see is that Jamf asks the ADCS Connector for a cert while the iPad is on locked screen -> the Connector does its job and asks the CA for a cert and retrieves it -> and then i assume it ships it back to Jamf and then when Jamf tries to deliver the cert it cant because the iPad is on locked screen. It then waits and waits for the iPad to be unlocked but if it takes too long eventually the certi

Hi all,I've been working on the OneDrive deployment some time ago, but it wasn't something we want to use at that time.Things changed and now we want to look into deploying OneDrive and a nice config to a set of test machines.Deployed the standalone version to a machine from here.https://support.microsoft.com/en-us/office/onedrive-release-notes-845dcf18-f921-435e-bf28-4e24b95e5fc0#OSVersion=MacPushed our desired config to the machine and nothing happens... updated our plist to a very simple one:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OpenAtLogin</key> <True/> </dict> </plist>Still the app won't open at login.Does it require a user to initially sign-in first or missing something else??Thanks!

Hello everyone, We use JAMF School to manage our iOS devices. We are primarily a Windows environment when it comes to laptops and desktops. We currently have new and older MacBook’s(iMacs too) that are not in the domain. They are stand-alone. For security reasons we need to start authenticating users when it comes to macOS devices. I have read some documentation regarding authentication via Azure or LDAP. What would be the pro and cons of going with either one? Also, would it join the domain after the Device enrollment? If so, would those configurations be done in the organization settings or within the profiles? I also read about directory binding. Would this need to also be configured, or is it something not related? I have several questions to have a better understanding before moving forward. Any help would be greatly appreciated.

Jamf pro cloud - ipads/Iphones not updating using mass action command download, install, and restart devices.They have full battery. One is on wifi, one connected ethernet using an adapter, another device is using mobile data. Under the management commands on the device, the scheduleOS update command is just pending, and there's hundreds of them. Like it's trying every day, all day long for the last week.I saw some posts from a couple years ago on the jamf nation forum discussing this issue with no resolution. Has anyone else experienced this?

We want to be able to send notifications to our iOS devices.  We have about 50 of them enrolled in Jamf Pro currently.  We have not tried to use self service until now.  I went to the settings and under the Self Service section went to iOS and selected the "Automatically install self service app" option, then on the app options selected "no login" as we have several devices where there isn't one user and those are setup sort of like a kiosk but with more than one app available.  Of all the devices, the only one that immediately installed self service was an iPhone 6 running iOS 12 (which is the latest iOS it will install).  All other devices are on iOS 15 and have a command under the completed commands in management history that says "Install App - Self Service" but nothing was actually installed on the device.  What do I need to do to get the self service app to install on all the devices?

In preparation for the JAMF bind apocalypse... I'm looking to find machine certificate alternatives for 802.1x wired and wireless.Currently, for 802.1x wired and wireless, we use machine certificates requested from a Windows PKI server. It has worked quite well. However, in the future when we are unable to bind MAC's to AD... we are looking at alternatives.Has anyone been able to use the machine certificates generated from the JAMF PRO Built-in CA for 802.1x using configuration profiles??

I have 10 MAC device which i have already joined to Active directory. My question is how to control MAC device like windows PC which is mention below through Active directoryGroup PolicyPatchingSCCMPassword Sync with ADUser & Machine certificateI need help badly. Thank you

I want to take an exported list of SNs from jamf and run a command in terminal against it, what's the easiest way to do that?  

We are deploying and running a bunch of policy and scripts to computers, but if these run into errors you need to open the logs for that policy and look for any errors.Is there a way of creating dashboards which shows recent errors in scripts or a way to forward the errors to an external app for processing and dashboard creation.

Hi, I'm trying to Download the latest version of Adobe Express and while its listed in the App store with this name and we pushed out previous version called Adobe Spark its not updating on the iPads and Jamf is only recognising Adobe Sparc . It's a free App and have test the App sync with another Adobe App and it has synced in Jamf Pro without any issue. Any ideas on this would be much appreciated. Kind Regards, Ger Keane

We're experiencing NilObjectException Errors while imaging our MacbookAir6,2's using ThunderBolt to Ethernet from our 10.8.4 NetBoot Image. Is there any sufficient documentation to fix this on the 8.72 JSS. It's almost 50/50 as to when it occurs, I can image get the error then re-image and not get the error. It's then about 50/50 as to whether it will be able to recon and enroll itself properly. We've also seen a less common IOException Error. We've had to manually delete the JAMF Keychain in the Library/App Support/JAMF folder to get these machines to enroll. We're not sure if they're going to pose additional errors in the future. We thought it may have been a bad NBI so we built a second one, and same occurrence.

I have a dmg from a vendor and you run it and drag the app into the applications folder (nothing new, we all know this is process). Is there a way to have JAMF do this using the same dmg?