Hi! Please! I'll need to know what SQL syntax I need to run in the Mysql database to get the scope (and also exclusions) of profiles and policies. Thank you very much

Hello! I use my own Connectwise Control agent as my main source of remote support for clients. As you all know, since the Catalina update, Screen Recording and Accessibility permissions have been denied by default for most remote control applications, requiring someone with administrative credentials to sign in and permit the use of both categories to the application. I was hoping to find some way via a shell script (or otherwise) to force-allow these permissions to all computers in a policy. Just a little disclaimer: I do not use Jamf as my MDM platform for computers. If there are any solutions from within the Jamf platform please feel free to share them so I may attempt to replicate them on the platform I use though. I've seen a few articles posted on various platforms but they all relate to prompting users to allow permission. Any help, pointers, or references to other helpful articles would be much appreciated. Thanks!

Hi everyone, I was hoping anyone could help me out. We keep having the same issue where teachers enable restrictions on their classes, and when they select to end it at the end, a couple of students stay restricted... We need to go to the jamf school instance and disable the restrictions manually from there. We are all using same model devices, same network and bluetooth enabled. This clearly is a disruption for our students since they either need to stop at the IT office to have their device unrestricted or wait for the restriction time limit to expire.  

Hi all!I have been tasked with installing Kaseya VAS through Jamf Pro at my agency. I want to avoid the why question, cause I know you will feel the same way I do!When I try to create the package in Composer with a snapshot, it will create the pkg, but with my personal machines settings, which means it will show up as my MacOS devices in the Kaseya back-end for every machine that I run this pkg on. Meaning that a user named Mike will still show on the back-end as being on my personal machine.When I download the Kaseya agent from my VSA site, I get a file with the agent application, and the items needed for installation (plist, cmd, exe). Now, I imagine that the agent installation application is just some script or wineskin to run the exe for install.I have been dealing with this for a month now, with no movement from Kaseya support, and it is driving me nuts!!! Any ideas? Thanks a bunch for taking a look!

When we open a policie and look at the logs which computers are completed or failed the button under actions called details is not working anymore. The button next to it called flush i functioning just fine. Does anybody noticed the same problem ?? we are using jamf pro cloud and i got some mails that there was a update so not sure if it has anything to do with that.

Hi All,  In light of Microsoft security updates KB5014754: Certificate-based authentication changes on Windows domain controllers and the 2/12/2025 KB5051979 which toggled Full Enforcement Mode as promised for February 2025 (which you can temporarily delay until September 2025): What is Jamf's best practice guidance for implementation of Jamf SCEP Proxy?  SCEP requests issued using the proxy supply RFC822 name in SCEP request and utilize a certificate template that allows that - but the resulting certificate does not have the necessary SID to work with the new Microsoft security posture outlined in the the security updates. Any thoughts or guidance from anyone?  Thanks!

New behaviour in iPadOS 17 - when you only define a lock screen wallpaper and do not define the home screen wallpaper and you do not click the check box to use the same image for lock and home, iPadOS 17 now magically makes home and lock screen identical. (Huh? That's not what I asked for)I filed an Apple Feedback Assistant ticket and they said it is "currently functioning as intended".It didn't do this in 16.So what's the issue? If you make a reasonably great looking lock screen wallpaper it is totally distracting as a home screen wallpaper. The app icons become too cluttered with the background - there's no visual sense of depth to separate. If you use the QR code, it looks terrible on every page.The consequence is that you have to allow changes to wallpaper and you have to choose a plain style home screen. Then if you want your beautiful lock screen to stay "locked" so that students don't remove it you have to play the restrictions dance in both Restrictions and the Wallpaper payloa

Hi all, Wondering if anyone else has ran into a similar issue. I've only noticed this with new devices running sequoia so far.  I have a policy running a script to enable remote management and remote login for a local managed admin.  I see that the service is running, but when going to remote management, there is no user displayed on 'Allow Access for'   If I try to kickstart the process manually, it shows that these settings are already enabled and my specified users still doesn't show on the list of users to allow.  I tried a fresh pre-enrolled device without running the policy in question, but the issue remains. My managed local admin is not on the list of users.  Anyone experience similar issues and have a fix?   

I'm cleaning up my Jamf environment mobile devices, iPads more or less, and I'm trying to use the "User and Location" fields such as "Name", "Username", "Email" fields, but every time I enter a name or email or anything and select save, no information is retained in these fields. Is this a feature only available to Macbook enrolled devices and not iOS? All iPads are having this issue and every one I've tried is enrolled and managed. Any help is appreciated!

I set up a push certificate with the intention of being able to send non invasive messages to IOS devices through the APN and Self Service app as opposed to locking the screen on a user. Notifications are typically temporary so in order to verify they are seen by the user, I would like to change the notification to persistent so it doesn't go away until the user views the message. I see in the IOS settings menu for the Self Service app, I can manually change the notifications to persistent but I don't want to touch each device. Is there some XML I can add the Self Service app in Jamf that would be associated with the app level notification settings? Or is there another way to do what I want?Thanks,Rob 

Hi All, We are planning JAMF Pro 11 integration with Cisco ISE version 3.2. I would like to know if it will support it and if we can have a step-by-step process for what needs to be done and how. Please need the help.

we execute a script that prompts them to enter their current Mac login password along with the 6-digit PIN they wish to use as their password moving forward. Upon setting the Mac login password to a 6-digit PIN using the script "sudo dscl. -passwd /Users/"$LoggedInUser" "$currentPassword" "$newpin, successful password conversion occurs. However, post-restart, users who are logged into iCloud receive a prompt stating "This Mac can't connect to iCloud because of a Problem" and are asked to log in to iCloud again. Additionally, the Touch ID configuration removes previously added fingerprints, necessitating the need to reconfigure Touch ID and log in to iCloud after setting the password as a PIN and rebooting. Has anyone seen this or any hints about this

I want to trigger a script to run after the app is installed from Self Service. Currently the app is installed manually via Self Service. Its not a package, its from the Mac Apps/Jamf App Catalog. I want a custom event trigger that will run the script when the app is installed. What do I put here that will make that happen: Any other settings I need to configure in this script policy to make it run proper?Basically I want to run a simple script that will make Chrome Default but only after its been installed. I do not want to use a package (policy) to install Chrome, I want to keep installing it from Mac Apps/Jamf App Catalog which allows me to keep it up to date.  

What is the best way to stop the macOS Sequoia install app from downloading automatically? The problem that this creates is when non-admin users try to upgrade to macOS Sequoia, the install app launches. The install app requires an admin user to run the install. If the upgrade is done entirely through Software Update, a non-admin user can run the upgrade. The install app doesn't launch since it wasn't downloaded. This was an issue last year when I opened up upgrades to macOS Sonoma. I had to create a policy that would temporarily elevate users to admin. They would be demoted back to a standard user at the first check-in after the upgrade. This worked well, but I prefer not to have to do this again.

Hey All! I've created a script that is supposed to mount our district's Private Network Folder and create  Desktop and Dock shortcuts for the share for the currently logged in user. I've been able to get my script to work locally, but whenever I try to pass the script through Jamf, it asks to give Terminal "Finder" access:   I believe this is what I need to give terminal access to: I set up a PPPC profile as follows but it doesn't seem to have helped: Any Guidance on what PPPC settings I need to pass to our computers so that end users don't get that prompt? I also tried uploading rtroutons config profile found here to no avail.   Bonus points if anyone wants/can help me figure out the best way to pass this script? I know I could send it in a Policy that runs at every login, but that seems like bad practice? Maybe a LaunchAgent? Disregard my sloppy code, it's cobbled together from what I kind of understood from the 400 and what ChatGPT helped me write... &nbs

My Google-fu is failing me today. Does anyone have a link to the Apple KB (I think?) that talks about how joining Macs to AD should be discontinued?

Hi everyone,  can someone help me sending the jamf pro summary? i always recieve an error :  Failed to upload Jamf Pro Summary; 500 Internal Server Error: "{"message":"An unexpected rest client error has occurred","fields":null,"classification":"UNEXPECTED_ERROR"}"

Hello, I am testing adding a printer to iPads via a configuration profile. Anyone have any experience with that? What information do I need. I create a new configuration profile and go the AirPrint option. I see that I have to input the printer IP address, port and resource path. Lets say I only know the ip address and leave the port and resource box empy, will that still work? Thanks

I believe Scheduled updates should work, but I probably did something wrong.So, I created a smart computer group where I added my machine. Then, I opened software updates and tried to force macOS updates for this group (I have used different flags to force the update). My machine is Apple Silicon (m1). I don't see a proper way to check scheduled updates on my machine, so I use API (v1/managed-software-updates/plans) for it.In answer, I see already 14 plans, and most of them failed with the error "EXISTING_PLAN_FOR_DEVICE_IN_PROGRESS" .That means at least the plan should be executed, but nothing happened.What did I do wrong?{ "totalCount" : 14, "results" : [ { "planUuid" : "09487431-7d17-4c4f-baa2-5b5d03f7c076", "device" : { "deviceId" : "579", "objectType" : "COMPUTER", "href" : "/v1/computers-inventory/579" }, "updateAction" : "DOWNLOAD_INSTALL_SCHEDULE", "versionType" : "LATEST_MAJOR", "specificVersion" : null, "maxDeferrals" : 0

"Security is not a product, but a process." – Bruce Schneier   In today’s endpoints landscape, organizations managing macOS / Windows endpoints face an increasing need to enforce stringent security standards to protect sensitive data. The CIS (Center for Internet Security) Benchmarks serve as a globally recognized framework for safeguarding endpoints against security threats. When combined with the powerful capabilities of Mobile Device Management (MDM) such as Jamf Pro, Intune, Endpoint Central, etc., , IT administrators can seamlessly implement these benchmarks to enhance security without compromising user experience.   CIS Benchmarks are consensus-based, best-practice security configuration guides. They provide detailed recommendations on configuring IT systems to mitigate vulnerabilities. For macOS, the CIS Apple macOS Benchmark offers actionable steps to harden systems against cyberattacks while ensuring compliance with organizational security policies.   Using CIS

Hello,   Apologies if this is not the right place to ask questions like this. I tried searching before posting, but did not find anyone else already asking about this recently.   I have set up a prestage enrollment with the option "Minimum required macOS version" set to "Latest version based on computer eligibility". I thought that this would update a computer to the latest version of macOS that is compatible with the device, but it seems to just install the latest version of macOS that came with the device. In my test case, I am using a MacBook Air (M1, 2020). When I get to the desktop after the Setup Assistant finishes, the first thing I get is a notification about a macOS update available, which is not what I expected. Here's what I did:1) the MacBook Air had Sequoia installed before, and I used the Jamf management command "Wipe Computer" from the web interface2) the computer reboots, does its thing, and brings up the Setup Assistant3) the prestage enrollment seems to be w

It there a way to disable rw access to Login Items or disable the whole pane in the General pane? I have the Extensions area locked

Is anyone else seeing issues with updating to Google Chrome v133.x while on Sequoia 15.2? Getting an error code when sending off this version via policy, and the installer even fails when trying locally- getting a generic error like "The operation can't be completed some items had to be skipped. For each item, choose File > Get Info, make sure "locked" is deselected...etc". Even our RMM tool is unable to push a patch/update out.The only way I found to fix this was to entirely delete the old version of chrome installed (which was only version 131 from a couple months ago) and then Chrome installed without an issue. I'd rather not have to script a removal and then reinstall, only because that seems silly to have to do when this was working just fine previously. Does anyone else see similar behavior or know of a good way to handle this?

A staff has asked us to install Final Cut Pro on an iPad we manage. Deployed it from school.apple.com and we can see it install on the iPad but when launched it says Try Monthly or Try Yearly.   I suspect it needs an Apple ID since it is subscription based, but we've specifically disabled the use of the app store and Apple IDs on these iPads. We don't want them using their personal Apple IDs.   So, how can I make this work? I can create a generic managed Apple ID (e.g. iPad01@school.domain.com )in school.apple.com but how do I assign it to this iPad? And more importantly, how can I make sure it's only used for getting Final Cut Pro to run (i.e. they can't purchase anything, they can't store anything, they can't backup anything to this account, etc)?

We’ve recently left our old LDAP (eDirectory) integration on our Jamf instance and are now integrated with Entra. Feels good :)But what can we do next?- Login to Mac with Entra logins? What are some good alternatives to Jamf Connect?- Mount AD volumes? What do we need and what’s the options?