Hi, I’ve notice that since upgrade to macOS 26.6, I sometime get popup window requesting all kind of apps (such as browser) to access the “login” keychain. I dug a little inside the unified logs and saw that Jamf Connect get repeated exception from type “CSSMERR_DL_INVALID_DB_HANDLE”probably when trying to access the keychain. Any chance someone else also encountered this issue ? Thanks  2026-09-13 08:46:17.697211+0300 0x3477 Activity 0x9269f00 1421 0 Jamf Connect: (CFOpenDirectory) Open a given node2026-09-13 08:46:17.698036+0300 0x3477 Activity 0x9269f01 1421 0 Jamf Connect: (CFOpenDirectory) Querying records from directories2026-09-13 08:46:17.698807+0300 0x3477 Activity 0x9269f02 1421 0 Jamf Connect: (CFOpenDirectory) Open a given node2026-09-13 08:46:17.698816+0300 0x3477 Activity 0x9269f03 1421 0 Jamf Connect: (CFOpenDirectory) Querying records from directories2026-09-13 08:46:17.701048+03

We're making a behind-the-scenes improvement to how your Jamf products work together — no action needed, and nothing will be deployed to your devices as a result.Over the next several weeks, we're grouping the Jamf products you own — such as Jamf Pro, Jamf Protect, and Jamf Security Cloud — into a single "platform environment." This is the foundation for Jamf's future platform capabilities, letting your products work together as one connected experience. In most cases, we'll set this up for you; there's nothing to configure. If we can't, this has no impact on your current experience and we'll let you know in the coming weeks and provide you a way to create this Platform Environment in Jamf Account.What this means for you:Already connected Jamf Pro and Jamf Protect? Nothing changes. Your setup continues to work as it does today. Not yet connected? The two will connect automatically. Your Jamf Protect plans will appear in Jamf Pro, ready for you to review and deploy on your schedule. Set

Fortinet's recent FortiOS 5.4.1 release for their FortiGate security appliances prevents any version of FortiClient prior to 5.4.1 from registering to the appliance. Users may even get a "FortiClient is being actively blocked from registration" which can cause panic and confusion. The problem is that, as of this writing, FortiClient 5.4.1 has yet to be released. Talk about putting the cart before the horse. So let's say that you don't want to have a few hundred upset users and would rather uninstall FortiClient discretely, en masse. Fortinet's documentation tells you to run the FortiClientUninstaller GUI app to uninstall FortiClient. But here's a more streamlined and scriptable method: /Applications/FortiClientUninstaller.app/Contents/Resources/uninstall_helperrm -rf /Library/Application Support/Fortinet/ Optionally, check for the existence of the following file and delete if it exists/private/var/root/Library/Preferences/com.fortinet.FortiClientAg

I have an interesting issue. A student logins in via Jamf Connect two weeks ago.Account is created. Account has been used and logs in via Jamf Connect every day until yesterday.Teacher emails me today, saying every time the student logs in, it immediately logs him out. Remote into the Mac mini, log in via Jamf Connect, issue confirmed.Logged in via local account behind Jamf Connect, issue still exists. Looked into the device’s Computer Usage logs in Jamf… every time the sign in happens, Jamf registers the user as “root”. Now, I can purge this account and I’m sure it’ll recreate properly and log in correctly. But I’d like some insight on how this could’ve happened. Students don’t have terminal access or admin rights. And it just… randomly started yesterday.

Hello,On our Mac fleet managed with Jamf Pro, we use Jamf Connect with Google SSO. We also have a local account called “localadmin” on each Mac, and only the IT administrators know the password.We recently deployed Jamf Protect, and I would like to create an alert whenever someone logs in to the “localadmin” account on one of our Macs.I have already tried creating a Custom Analytic and using a Jamf Pro script, but I haven’t been able to get it working properly.Has anyone already implemented something similar with Jamf Protect?Ideally, I would like to receive an alert whenever a successful login to the “localadmin” account occurs.Any advice or examples of Custom Analytics would be greatly appreciated.Thanks!

I'm seeing this popup on some of our users devices since the upgrade to Monterey, but I'm not entirely sure what it's trying to do, and it seems like I need to know in order to prevent it from popping up by automating what it's trying to do. I think this is from trying to install FortiClient, but I'm not positive. How can I tell what it's doing so I can make this easier on our users?

I am trying to enroll a mac using user initiated enrollment using the enrollment url. but during the process only general profile is getting installed and the enrollment page is stuck and not moving forward.We have configured Okta as a CA with dynamic SCEP challenge. The general profile which is installed is the SCEP enrollment. Any thoughts? 

Hey,First-time poster. We have an issue where we want to force install certain chromium-based extensions to certain devices. This is fine, add the custom plist with the ExtensionInstallForcelist with the GUID and update the manifest URL. This is then deployed to the required subset of users.The issue we have is scaling this with multiple extensions. This is fine if there is no overlap on the devices where this is being deployed but as soon as Extension A & Extension B are deployed to one device with multiple profiles then only one wins.Any ideas on how to deploy multiple extensions across multiple profiles when there might be overlap in the scope of devices? I’ve tried using just the plist within the preferences folder but it seems like it only respects/looks for policy within Managed Preferences instead.Many thanks for your help.

I'm seeing a number of Macs reporting that FileVault 2 is not enabled, despite the encryption state being displayed as Encrypted. I've also seen this sometimes change to show Enabled before reverting back to Not Enabled again. Is this a known issue? The machines appear to be completely fine and encryption seems to be on.

Hi there,I’m experiencing an issue that has suddenly appeared on several Macs in my fleet, which is managed using an on-premises Jamf Pro server.On an increasing number of Macs, the “Connect to Server…” option in the Finder’s “Go” menu has disappeared.I am not applying any specific configuration profile that blocks certain features. I only customize the Dock by adding quick access to applications from the Microsoft Office suite, our VPN, and the Macintosh HD icon on the desktop.A user can still browse the folders on their server through their Finder browsing history, but they can no longer access the “Connect to Server…” option.Could you please help me understand what might be causing this issue?Thank you.

We have a Jamf Pro license and according to what I can see Composer is part of this. But I can not find this software anywhere when I log into the backend ? - Where can I download this ?

My friend Claude and I developed a tool for Jamf and Iru. It allows you to schedule tasks such as activating policies at a specific time or deploying a configuration profile at a specific time. This tool is particularly useful when you need to have certain tasks completed without being physically present at your computer.https://github.com/kylejericson/mdm-scheduler

With Jamf Pro 11.32, support the next major Apple operating systems, use new inventory attributes to gain real-time visibility into computer enrollment and health, and enable a UUID column to distinguish between directory groups with identical names.Be sure to check out the Jamf Pro release notes for all of the exciting new features and enhancements.Thank you for your continued support and feedback!

Today we are releasing Jamf Pro 11.32; highlights include:Compatibility with Apple Operating Systems Compatibility and new feature support are based on testing with the latest Apple beta releases of macOS 27 Golden Gate, iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. Inventory Reporting — New Computer and Mobile Device Inventory Attributes This release introduces new inventory attributes for computers and mobile devices that provide real-time visibility into enrollment status and device health, reducing reliance on MDM queries and lowering server load. All attributes require OS 27 or later on the platforms noted, and are based on testing with the latest Apple beta releases: Apple Enrollment Type — Supported on macOS 27, iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. Awaiting Configuration — Supported on macOS 27, iOS 27, tvOS 27, and visionOS 27. Return to Service — Supported on iOS 27, iPadOS 27, and visionOS 27. Device System Health — Supported on iOS 27 and iP

Nobody knew what anyone else had builtThe first real AI problem on our team had nothing to do with model quality. It was that dozens of people had each built something genuinely useful, and none of them knew about the others.  That’s where CSAssistNOW came in. All applications I have developed with AI end in the word “NOW” because it is directionally accurate to the time it takes to build, it is catchy, and almost a little bit annoying. It’s just a shared place to publish and find the prompts and skills people build.There are four reasons we wanted this. Visibility - Once a department gets past a certain size, AI use can very quickly become fragmented. Someone automates a renewal summary, someone else builds an account brief, then another builds a risk status dashboard. A library helps make the work visible and legible. You can see how AI is actually being used vs. how it’s supposed to be used, or what you see folks using it for on social media. Basic social features were added to try

Hello Team,We are currently using Jamf pro + Jamf Connect for privilege elevation on our macOS devices. From an audit and compliance perspective, we are looking for a solution that can monitor and track user activity after elevated privileges are granted and can Alert .Specifically, we are interested in capturing and reporting on:Commands executed using elevated privileges (sudo/admin actions) Applications launched while elevated System configuration changes Software installations/removals Security-related modifications Detailed audit logs for compliance and forensic investigationsWe would like to understand how other organizations are addressing this requirement in their macOS environments.Are there native Jamf Pro, Jamf Connect, capabilities that provide this level of auditing? If not, what third-party solutions are commonly integrated with Jamf pro for monitoring privileged user activity? Has anyone implemented this using CrowdStrike, SIEM/EDR platform? What has been your experience

Everyone learns differently, and at Jamf we want to meet you where you are. This may mean comprehensive written documentation. It may take the form of multimedia content like videos or podcasts. One of the best ways to practice a tool is to use it – navigate the interface, explore objects, discover new features, make mistakes, and learn from the experience. That’s why we’re offering new opportunities to train with our products in the form of software simulations.   We want to provide realistic and meaningful learning experiences for new and seasoned users. Software simulations allow you to familiarize yourself with the interface, objects, and workflows without the worry of compromising your own server. In a simulated environment, we can provide guidance and tooltips. If you lose your way, we can help get you back on track. You’re in the virtual driver’s seat, and in a safe environment to practice before returning to manage your own fleet.   At the Jamf Nation User Conference

I am trying to create a basic Time Machine Configuration Profile to backup users to a SMB share.   After initially realising my mistake that the SMB share would need to authenticate based on the Computers AD credentials rather then the users credentials. (as the time machine process does not run as the console user) I am now able to see the SMB share listed as a valid time machine backup disk.    The problem that I have is the client computers system disk has been added to the "Exclude from Backups list". Obviously I have not included this in the Configuration Profile and changing the various "Tick boxes" doesn't seem to help.   Is there a reason the computers system disk would be added to the "Exclude from Backups list"    As part of the MDM profile? As the result of the setting in another none time machine profile? Due to a setting on the the system disk?   (Problem exists for both Arm and Intel's running Mac OS 15.2) Any help appreci

Hello,I manage a fleet of iPads used for exams with my on-premises Jamf Pro instance. I push a configuration profile to restrict all of the iPad’s features and only allow students to access Safari and a whitelist of approved websites.I was informed that students might be able to use ChatGPT on the iPads by exploiting a vulnerability.I haven’t been able to verify this yet, but is there a way to block access to ChatGPT through a configuration profile?Thank you in advance for your help.

We have one of our users who is trying to take their macbook off the domain. When they take their macbook and establish it on a network that is not our own, they cannot get signed into their computer. The machine will error stating incorrect username or password while off the networkWe attempted to setup active directory through  the general settings area of Jamf Pro, we established “Directory Bindings”, entered our domain information. The computer OU format of OU=OU1,OU=OU2,OU=OU3,DC=DC1,DC=DC2 and went into “User Experience” and ensured “Create Mobile Account at Login” was checked. Now I am not sure what else I missed in setting up the domain or which settings we need to enable so our user can take their device offsite. I do not want to remove the configuration/enrollment from the device or create a local account. Does anyone have any suggestions?

Can someone help me how to block copilot app record option for corporate ios devices, i tried adding xml dictation on device apps> app configuration to block but did not worked 

Hi Nation,Product Office Hours #4 - Jamf's Engineering AI: Nighthawk - A peek behind the curtainNext session: Thursday, 3rd Sep - 9am CDT / 3pm BST / 4pm CESTSpeakers: Akash Kamath, Chief Technology Officer, Martin Barnard, Senior Product Manager & Justin Wilke, Principal Enterprise ArchitectRegister here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! Anything we don't get to, we'll follow up right here within 24 hours.See you Thursday 3rd!

Over the summer some of our computers has lost our Wi-Fi profile. I wonder what’s the best solution to get it back. For the moment they are using our guest Wi-Fi. But it’s very limited for the users so we need to get the profile back.I’ve created a smart computer group that show all the computers that don’t have the profile. Should I put the group in the scope? Won’t the loose the profile again when they’re not in the smart group anymore?

Hello all,First-time poster on Jamf Nation, so please criticize formatting, grammar, etc.We use Bomgar Remote Support on our Macs, but when deploying to a test machine running Sequoia, I get the message "Allow Remote Support Customer Client to find devices on local networks?" It looks like a PPPC popup with options to "Don't Allow" or "Allow", but I can't find a corresponding PPPC setting. We already have Accessibility, SystemPolicyAllFiles, and ScreenCapture set up according to this deployment guide, and I don't see another PPPC option that looks related to this error message. I'm not even sure why this is a permission that needs to be allowed. It feels like the Windows message to "allow this device to be discoverable on local networks," but it's going the opposite way. Why would I need permission to go out on the network and connect to the Bomgar server from my endpoint? Has anyone else seen this popup before or something similar?

Has anyone been getting unsuccessful GSX warranty lookups this week?  I have been getting them since yesterday.