I've noticed recently that a number of our brand new deploy machines are getting their bootstrap token escrowed properly but when the user logs on for the first time, they're not getting a secure token -- meaning we have to then manually grant a secure token using a known account which has one. Any ideas why JAMF isn't issuing secure tokens to new users?  

Afternoon, Just got a reminder that i need to migrate to the new Self Service + does anyone know how to do it? Thanks

I am trying to setup an extension attribute to verify if MS defender is enabled on devices in our environment. When I save the EA I only get a response from 1 device but I need responses from all of my devices. Any advice would be appreciated! Thanks   #!/bin/sh echo "<result>`mdatp health | grep real_time_protection_enabled| awk '{print $3}'`</result>"    

We run a clustered on premise environment. One JSS internal, one JSS in the DMZ behind a reverse proxy. I've never loved that even though you turn off the UI on the DMZ instance that www.myjss.com/api is still exposed as a UI. We do restrict what users have access to the API but I still don't like it being exposed so I tried blocking it in the reverse proxy.  After doing this, I noticed that it broke the sync with VPP.  I removed the /api block in the reverse proxy and the purchased apps immediately came down. I went and checked the reverse proxy logs thinking that I'd have an error logged every time the sync monitor ran. I found no such errors. The only thing i found in the logs related to /api was an errors with remote users and the self service branding icon not being passed down. Anybody else have any insight into why blocking /api breaks VPP sync and also why there would be no errors logged in t

I saw a couple of articles online to install Cisco Secure Client via jamf. However it was mostly for VPN and umbrella and when taking dmg from xdr into composer it proved to be less then helpful. No matter what it did not like to be manipulated. I have created a deployment script using full installer dmg for anyone that runs into this who also is using Cisco XDR. I am open to suggestions on the script but this got the job done and cleanly. Make sure you setup a configuration profile for background processes. First thing is go in to Cisco XDR download both Full installers for AMD and ARM. Then upload the DMG files in to Jamf Next Create the Script using this bash script. It uses the jamf waitingroom cache applications. #!/bin/bash # Author: Ryan Tarson # Cisco Secure Client DMG Installer Script for Jamf (Flexible for Both Architectures) # # This script insta

How do I get passed the Activatiion Lock with a teacher has their Apple ID logged and Find My turned on. We run into this more than I would like to admit. We are trying to make sure they have it turned off before we take the device because they are no longer going to be with the school or it is broken and Find My needs to be turned off so it can be repaired.How do we get passed this without asking the person to come back in, remove the device from their iCould account, or ask them if they would be ok with giving us their password so we can get the device activated. I had to contact a person that had moved to Austrailia. Luckily they trusted me with their password and I was able to get the device activated.  Any help would be great. Thanks for your time in advance.

Since the recent update to Version 11.14.1, I've noticed that policy logs are no longer visible. Is anyone else experiencing the same issue, or am I the only one facing this? Let me know.  

To configure zoom for deployment with an MDM Zoom recommends putting us.zoom.config.plist into the /Library/Managed Preferences folder. i have been doing this with DepolyNotify using a policy with a package to put the file in the folder with no issues. I am now trying to replicate this with Setup manger. The policy runs during setup manager and says it installed (also Jamf logs shows this) but the file is not there. I also tried a policy with a script to create this file, it also said it succeeded but the file was not there.Does /Library/Managed Preferences refresh its self or something when a user first logs in?

Looking to see if anyone has created a Configuration Profile that will gray out the "Download iOS Updates" and Install iOS Updates" within the Automatic Update section. I do not want end-users to turn off the feature. As admins the plan is to have another configuration profile created to defer iOS updates for 14 days to confirm testing of a new update. We currently have that in place.

We are looking to set up a secondary automated device enrollment profile and would like to enforce a minimum OS requirement during enrollment. The primary profile already has this restriction in place. We would appreciate any suggestions or guidance.

Hey everyone,I’ve set up Jamf Connect with Google IdP following the documentation and tested it; everything seems to run fine. However, I've run into issues during PreStage Enrollment deployment in Jamf Pro. I can’t seem to launch Jamf Connect properly for local account creation to show the Google login screen. Right after the Setup Assistant, it only shows a black login screen with empty fields for user and password. According to troubleshooting, it might be due to the permissions in the package, but since I’m using the official Jamf Connect 2.42.0 package and distributing it through Cloud Distribution Point (Jamf Cloud), I don’t think there should be an issue.Has anyone had a similar experience and found a solution? Here is my configuration excluding secrets:  

Hi all,Having an issue with Filevault and our local admins getting secure token access. So I have a config profile set to enforce Filevault enablement. The user logs in, they enable filevault, all good to go. Problem is that the local admin we create does not have a secure token in this instance, and it's necessary the local admin has one.What I could do is login with the local admin first, enable filevault, but then I'd have to give the user local admin creds to login to the device prior to JamfConnect screen. That is undesirable.How can I ensure the local admin gets a secure token without actually logging in as the local admin? I know that the sysadminctl command can do it, but that would require someone with a secure token to authorize it (that's not feasible for obvious reasons).

Testing BeyondTrust deployment on Mac OS Sequoia. I also tested this on Sonoma, and ran into the same problem. I'm using the install script from BeyondTrust, and their recommended PPPC Configuration Profile. The installer appears to run successfully, but I am getting a pop-up asking for permission to copy the .app file to the Applications folder.  Is there a change I can make or a security setting I can adjust to allow this app to copy to the applications folder without the user needing to click allow?  

I'm surly missing something simple. I am trying to update the Adobe CC and Adobe Acrobat (with CC) packages in JAMF. They keep failing with the response being to contact the vendor, and the install log is saying there was an error with executing the packages scripts. Downloading the downloader for a managed package from the Adobe Admin CenterDoing all the random steps to download the package with the adobe package downloader app that comes in the .dmgUploading the install.pgk to JAMF (JAMF auto zips the file when uploading)Putting the install.pkg.zip in a policyTrigger the policy and fails every time.If I run the package locally on the device it works like a charm. Before I break down and put the installer pkg in a pkg and run it with a script, does anyone have any idea what I missed?

Any one notice if you install Self Service+, it re-triggers enrollment complete / first time login policies?

We are pushing a configuration profile to users. So far 1800 machines have completed but there are 450 that still show pending. In this list there are some machines that show pending but when I go to management history for a few of the pending machines it shows that the configuration profile completed but it does not show up in completed. Is there a way to fix this so that we can have a more accurate reading on machines that are actually pending/completed. 

Hi,  I have been asked to disable the telemetry on Rancher Desktop for deployment in our fleet, and was hoping someone might have done this, or had some insight as to what would be the right way to do it. you can pull the settings and i can see the flag i need to change, but my json skills are not my strongpoint...   I know this needs to be changed to False "telemetry": { "enabled": true } https://docs.rancherdesktop.io/references/rdctl-command-reference/#rdctl-or-rdctl-help    Any suggestions would be welcome

I've spent some time researching where these options are actually stored, and found them in all locked away in  /private/var/root/Library/Preferences/com.apple.CoreBrightness.plist   This file is editable by all users, as it simply stores the current display tone and brightness settings. The only trick is, this file is only read at startup, so editing it does require a restart afterwards. For our computers labs and classrooms, we simply run this script at every login. That does mean, however, that if someone changes the display settings, it takes two restarts to get them to go back to our desired default settings (if someone can figure out what service or process to restart to force the preferences to update, that would be great, but for now, this solution is working for us).   Update: I have discovered that in order for this to work,

I am using the Make Me an Admin : https://github.com/jamf/MakeMeAnAdmin I'm having 3 questions/concerns:• It is not reliably creating a log?• Is there a way to get the log to me or at least a notification that the policy was run?• Is there a way to block them from creating additional admin accounts while they are an admin? Thanks!

IBM normalized their installation namespaces on Mac/Windows, and changed where they store the license server settings inside a file called "/Applications/IBM SPSS Statistics/Resources/Activation/commutelicense.ini". I wrote a script to update this - its similar to the spssprod.inf file. On launch however I get this popup: Clicking "apply existing license" goes right into the app and checks out a license. The warning doesn't come back. I found that some setting (where I'm not sure) is stored in a file called "com.ibm.spss.plist" in the user profile preferences folder. I can't of course just copy this over to an existing profile because it has many hard coded paths to my user profile inside it. Anyone else run into this issue? I'll likely bounce the issue off IBM support, but I thought I'd ask here as well.

Has any one had the issue where Jamf Compliance editor is not creating the PDF in the Project folder? Not sure if there is something I'm doing wrong, but after taking my course, I was creating a plan for my current organization.    After creating the CIS LVL 1 benchmark, the PDF is missing within the build folder. Not sure if there is a way to get that report as it would be pretty useful.    Thanks for any insight. 

Hello everyone! Something strange happened about 32 hours ago - a main instance has disappeared from my Jamf account. I can't log in to <myinstance>.jamfcloud.com Does anyone of you had such case? It's really frustrating, because it stops all the work in our company - we can't do onboarding (Enrollments), help employees to solve their Jamf-related problems and so on... Jamf support replied about 13 hours ago. I have immediately answered their questions and since then, there is a silence from Jamf people's side. Is there any way to see, if this instance was deleted by someone, or not?

Hi! Looking for a way to disable the "Restart and show password reset options" as mentioned in https://support.apple.com/en-us/HT202860 We have firmware passwords set on our laptops (by policy the firmware password is only known to IT) and when a user clicks that, it gets stuck at the firmware password screen. Reboots go right back to the firmware screen. Unfortunately, with all the work from home, we can't just stop by to fix it. 

Today we are releasing a maintenance version of Jamf Pro; this release addresses the following product issues: Jamf Pro Server: Security Issues Jamf provides the CVE-ID for security issues with high or critical severity when possible. [PI126232] Updated a third-party library to resolve a known vulnerability. (CVE-2025-24970) Jamf Pro Server [PI125880] Jamf Pro users who migrated from an on-premise environment to a Jamf Standard Cloud-hosted or Premium Cloud-hosted environment using a custom URL and port 8443 will no longer experience authentication errors while using SSO through Jamf Account. [PI126314] Jamf Pro successfully populates data in the mdm_client database table, resolving an issue that prevented computers from receiving user-level commands and configuration profil

Hi all,Im looking for a simple and easy buy user friendly way to restart a mac .. I know there is many options out there .. script .. jamf policy , DEP Notify . .. but have always had feedback from business saying that there are not very user friendly. I have been tasked to see if i can find a friendly way to restart with less user interaction or at least a deferral ..Any idea is much welcomed..rk