I noticed that there are 2 Managed Local Administrator Accounts listed in the Inventory > General page of our computers. All our computers and devices are all under Apple School Manager and are automatically enrolled via PreStage Enrollment (so I am thinking that User-Initiated Enrollment never happens for us).   My questions are: 1. Under Settings > Global > User-initiated enrollment > Computers, do we need to check the box for "Enable user-initiated enrollment for computers"? And if yes, do we need to check the box for "Create managed local administrator account" (everything else is unchecked) given that each PreStage Enrollment also creates a managed local administrator account?   2. Under Settings > Global > User-initiated enrollment > Devices, do we need to check the box for "Enable for institutionally owned devices" (everything else is unchecked)?   3. If

How do I toggle this feature off or prevent it from being toggled on?  I went to reset the users password via Recovery Setup Options, user had logged into personal Apple ID when MacBook was issued but didn't remember the password.  FileVault is enabled an we escrow those PRK's, but it wasn't until after the user reset their Apple ID password and logged in with it on the recovery side before the system would even allow me to put in the escrow'd PRK.  We don't manage Apple IDs, I really don't see the point in them if they can't purchase anything through them.  Yes I've had a VPP setup for yrs, but there are those few who like to connect their watches and such.  Any advice would be welcomed.VickiH

We want to block Apple Intelligence while not signed in to ChatGPT, but allow it to be linked to ChatGPT with a specific workspace ID. This is because we recognize that Apple Intelligence while not linked to ChatGPT is a learning target. Do you know anything about this control?I know that sign-in can be managed by specifying a workspace id.

Hi everyone,  I'm starting to deploy some Mac Mini for a school, although they don't have any LDAP or Federation, they want to deploy Mac mini with Jamf School for a Lab. No problem for that, I've made the DEP profile, started every mac, and create several standard account in them. The problem is when I want to add some restriction to this mac, I would like to know if there are any possibilities that the restrictions only apply to the Standard account, not the Admin account. Because Standard accounts are the student's account, and we don't want them to have access to some functionality of the mac. Thanks for your help and sorry if this question seems to be too Noob style. Ben    

Does anyone have an EA that will bring into inventory those applications that have been authorized in Location Services?

Hi, I am looking for a Universal Version of aria2c that I can deploy as PKG to the Mac Clients. On Brew I found Version 1.37 which seems to be the latest Universal Build? We do not want to have Brew on every Client. Is there a way to create a PKG of the local installed aria2 from Brew and to distribute it to other Mac Clients who do not of Brew installed? Thanks!

  This time, looking for a job was a bit different. In the past when you looked, there always seemed to be a few options out there you could choose from. At the very least, a list you could rank and go after a few based on priority. These days it seems you may still see what appear to be quite a few options out there, but unfortunately the times they are a changing as the saying goes. I don't want to sound dire, but between new factors that have chipped away at what you see and what you actually get. It's quite a bit more difficult out there right now. Because of that, I wanted to jot a few things down to see if I could help about my recent experience. So whether you're in the midst of your job search or about to embark on that journey, here are some observations that I think could help. Things aren’t totally what they appear to be. Between AI being tier zero to any job applicant, and the fact that companies are posting ghost jobs just to compile data, my fir

Does anyone have an EA that will bring into inventory those applications that have been authorized in Location Services?

When making a script available in the Self Service app and the user runs the script.Where is it stored and how long will it be stored there?   I see packages in the /Library/Application Support/JAMF/Receipts folder, but no scripts are there are stored there

Hi, I am trying to find all installed Apps from the Mac App Store which have not been purchased through the VPP/Self Service. This is what I got with the help of an older Script from Craig Lindsey #!/bin/bash # JAMF Extension Attribute that finds any MAS apps # that were NOT purchased through VPP # Based on Script from: Craig Lindsey for Starz 2017-2-10 checkMD=$(mdfind -onlyin /Applications/ 'kMDItemAppStoreReceiptIsVPPLicensed == "0"') #echo "### checkMD - $checkMD" if [ "$checkMD" = "" ] then echo "<result>Not Found</result>" exit 0 fi result="" mdfind -onlyin /Applications/ 'kMDItemAppStoreReceiptIsVPPLicensed == "0"' | while read VPPApp do AppName=$( echo "$VPPApp" | awk -F'/' '{print $NF}' | sed -e 's/^"//' -e 's/"$//') result+="$AppName" echo "### Result - $result" done echo -e "### Result-TEST - $result" #echo -e "<result>$result</result>" exit 0   And this is the Result I get

Hello,   I am currently having an issue with installing Symantec on any MAC device (does not matter the OS). When running the policy, I get an error message: Installing SEPRemote v.14.3.5055.3000.pkg... Installation failed. The installer reported: installer: Package name is SEPRemote v.14.3.5055.3000installer: Installing at base path / installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. An error occurred while running scripts from the package “SEPRemote v.14.3.5055.3000.pkg”.) I assume this has something to do with the package but this just happened out of no where so I am confused on what the issue on/ where to get a new package. Any ideas?

Have issue for client when they have been auto logout after Apple set default 3 minutes. Please note that I am saying User Logout but in fact the setting is "Start Screen Saver after". Option to change that is greyed out, there is no policy set for that specific setting (at the start of the issue). There are set settings in Computers - Configuration Profiles - Login items - Logon Banner  where two options are available: "Log out user after" and "Start Screen Saver after".  When setting specific time for first option - it doesn't change anything  - users still are being logout after 3 minutes. If value is set to 0 or disabled  - the same result - 3min. defaults is still active.  If setting for "Start screen saver" is set up to specific time  - that will change logout time to that specific time. But it will change back to 3 min. at random restarts. So you can restart once, it will stay 35 min., restart one more time  - it will suddenly

Hello, I have a question and a couple of request:  1. If I run a script with API credentials on students' machines, is there a way students can find or check the credentials?  2. I want a working script which will prompt to select a static group and after selecting it, the computer should be automatically added to that particular static group. I have tried many scripts and for some reason its not working. I gave up and decided to get help from this awesome place. I am pretty sure many would have done this and will have a working script.  Thanks.

Hey Everyone, I’m still getting used to Jamf Pro and wanted to ask—what’s the most efficient way to handle app updates across multiple Macs? Is there a built-in method for automating third-party app updates, or are most admins using third-party tools or scripts for that? Also, how do you handle update notifications for users? Just trying to streamline our update process without too much manual effort.  Thanks For Any Suggestions!

Hello All, Hopefully this is the correct place to post this, but I need a helping hand. What are the management capabilities that are lost when using User-Initiated Enrollment as opposed to using Device Enrollment through Apple Configurator? I am implementing Jamf into our organization and we already have a number of Mac computers in circulation, and wiping these devices to enroll them may not be feasible. Any and all help is appreciated. Thanks! I have only been able to find one article covering this, but it does not list everything. https://learn.jamf.com/bundle/jamf-now-documentation/page/Supervision.html

I'm trying to create a Configuration Profile to change the screensaver from Flurry to Classic slide show. I have an option set in the Login Window to use the /System/Library/Screen Savers/Classic.saver for the Screen Saver module, but it doesn't seem to work and it stays at Flurry. Ideas or suggestions would be greatly appreciated. Thanks,Richard Eppert

I couldn't find record of the new bundle identifiers posted anywhere so I thought I'd share my findings for anyone who may need these for hiding some of the new built-in apps via the "Do Not Allow Some Apps" restriction or with the "Home Screen Layout" payload.Not all of the built-in apps currently auto-populate in Jamf Pro when typing the app name. All you need to do to use an item from this list is type the name of the app as you'd like to see it in "App Name," scroll down and choose "YOUR_APP_NAME +" in blue from the bottom of the search results, and paste the new bundle ID in.iOS & iPadOS 12-16App Name | Bundle ID Activity | com.apple.Fitness App Store | com.apple.AppStore Apple Store | com.apple.store.Jolly Apple Support | com.apple.supportapp Arcade

I'm fairly sure this isnt possible but not able to find any documentation backing it up. Is it possible to block the phone app on iPhones? We have no cellular service and I have tried sending a "some apps not allowed" config blocking the phone. But the device remains able to call 911 services. Can the phone app be completely disabled and blocked?

Almost a year ago we implemented 802.1x wifi authentication NOT using Active Directory certs. The certificates all issue properly and work just fine with our WiFi authentication.After we deployed the profiles and issued certs, I made sure this was set:sudo defaults write /Library/Preferences/com.apple.mdmclient AutoRenewCertificatesEnabled -bool YESNow that we are approaching the 1 year expiration of some of the first Macs to test this, we are expecting their certs to automatically renew, but they are not. I have a Mac with a computer cert expiration of Feb 9 - well within the default 14 day window for renewing - but it isn't renewing. Keychain Access still indicates that it expires Feb 9. There are no duplicate certs that would indicate a renewal. The Profiles system preferences does not have a renew or update button for the 802.1x profile. Here is what happens when I try to renew it manually with the profiles command:profiles -verbose renew -ty

Hi all! recently arrived to Apple management and I've got a task pending to fix: to setup two environment variables necessary for one GUI application.I can setup them over a plist file stored in /Library/LaunchAgents, but same plist file doesn't work loading it as a Configuration Profile from Jamf Pro. If I look for loaded profiles, it appears from Jamf as well as from terminal typing 'profiles list -all', but it doesn't work. Other plist files launched from Jamf are working properly but no for setting environment variables.Could someone to assist on this?Thanks a lot in advance

Hello all,I noticed today that I can no longer send MDM commands to a specific device. These commands are always only on the status "Pending". When I took a closer look, I found out that the MDM profile has already expired a few weeks ago. How can something like this happen? These actually renew themselves 180 days before expiration. Am I wrong? I built a search query for it and saw that this happened to a total of 10 devices. Do any of you have a tip on how I can recapture these devices? I tried a "sudo profiles renew -type enrollment" but this had no success unfortunately. An error 500 came back.

"We've detected a recent WebKit update which may impact Enterprise Single Sign On (SSO) for Microsoft 365 services" - MicrosoftI think we are running into an issue related to this and wondering if others are as well. We have iphones setup as shared devices using jamf setup and jamf reset. We do a soft reset between users since you still have to register the device between full resets (unless someone has a way to skip that requirement) When a user resets it is keeping the prior login active on Epic rover. Before it was clearing the token, but we are seeing sessions remaining I think on iOS 17 devices.

Hi all   I created an override how make I Autopkgr to recognize it so it starts working Now the jssimporter is deprecated I can't get packages to upload to Jamf, for instance the AmazoncorettoAppleSiliconJDK21 Downloading works but how can I get it uploaded  Any help is very much appreciated    

I've read that Google Identity supports OIDC - but does anyone know for sure whether a business could use GI for free to utilize Jamf Connect?

Hi, I appreciate if anyone can share a script that can delete the computer from which the script is executed from  the JamfPro (onprem server). It would be great if the script can delete the computer getting the computer ID or computer name and check with Jamf and delete if available and then remove all the profiles including the CA certificate, basically remove the framework.  Thanks in advance.