Hi all, I was wondering if anyone had any experience setting up a configuration in Jamf for computer cert auth using freeRADIUS. I am in the planning stages of moving our Macs over to cert based wireless auth and have a few questions regarding the deployment to Macs. Should I be using the X.509 Certificate payload for the computer certs created by freeRADIUS? If not, will the AD Certificate payload work to fulfill this? I will be using pfSense to host the freeRADIUS server, and we are using Ubiquiti APs.

Recently, my organization's Compliance and Security Operations teams requested visibility into how macOS apps are patched. They needed a report showing deployed apps via Jamf and their version status. After two manual reports, I knew there had to be a better way and developed a Python script for automation. Initially, I didn't plan to share the code publicly, thinking it might not be helpful to others. However, a friend, Chris Ball, encouraged me to release it—leading to the creation of Patcher. Manual reporting takes time away from critical tasks like CVE remediation and policy setup. Automating these processes allows MacAdmins to focus on more pressing matters. The time saved with Patcher has been invaluable for myself, and I hope others will benefit from it too. What does Patcher do? Patcher leverages the Jamf Pro API to automate patch management reporting, transforming data into actionable insights. Designed as a Command Line Interface (CLI), it integrates easily with LaunchAgents

Hey everyone, I have been going through different posts across here and Reddit, and I could really use some help. I am attempting to use the Jamf ADCS connector to push a machine certificate to a MacBook, which I can get it to do successfully. In the same profile, I have the network configuration in place there as well.   The issue that I am running into is not anything with the certificate/Jamf side, but with the Windows RADIUS server. I have an unbound AD object for the machine created, but I am unsure what I need to do with the object. The machine currently is successfully attempting to authenticate with the certificate, but NPS is rejecting it for error 8 - User account does not exist.   Does anyone have this set up in their environments, and is there a better way to do things? My security and systems teams won't let me domain bind the Mac devices, so I am using Jamf Connect for authentication, and I assume this is also why I am having account issues.

Have have been testing the removal of admin rights for some of the users in our environment running on MacOS. One issues that has come up is the ability to change the password for Keychain "login". For a standard user that options is greyed out. If we grant them admin rights again that option returns. I know they could just use the Users and Groups option in System Prefs to change the password, but some of our users change their password using a windows box and then want to come sync up the mac after the fact. Just doing a logout and log back in using the new password doesn't always prompt the sync. Is there a plist file or some system file we can change permissions on to allow a standard user to change the login keychain. It seems strange that that would be locked down as its not really a system change. Also just incase anybody wonders, yes the "lock" icon has been unlocked already, but the menu item still shows as greyed out. Thanks for any help!

Hi there,  We have an app that has 44 total licenses, and on Jamf Pro it says there are 24 in use. But only 4 are showing up on the scope. There were 20 pushed into Jamf School with a different token. I am wondering if anyone could help me figure out where I could find these missing in-use "scoped" devices could be, or a starting point? I've tried looking at the static group I think they could be at, but I didn't see anything on one of the devices that are in that static group. I wonder if deleting the static group would help, but I didn't see the app on one of the groups device listed anyway.  Thanks  

We are a mix of Windows and MAC devices. The MACS are Domain joined. User logs in the first time connected to our wired ethernet in the office to create their account using their Active Directory information. Over time the user has a local password for the MAC login screen (the very first password they made) and an AD password which is different and needs to be changed every 120 days.   Scenario: User is on the log in screen trying to get in to their local account with invalid or forgotten password   Attempt: Using the recovery code the user gets to the screen where they reset their password however it always gives an authentication error in the end to complete the change. Seems like even though this is to reset the local account password it needs to be in communication with the domain server. User can reset password if they go back into the office and hook up to a wired connection.   Attempt2: Creating a policy to reset the local user account. Fails to send push to comp

We use JAMF pro and our end users travel a lot. If they forget their Mac password on the road what is the best way to get them back in from Jamf? Thanks!

Updating MAC O/S using JAMF is hit or miss - mostly miss- even with the new "Software Updates" feature recently rolled out. I followed a JAMF Training video https://trainingcatalog.jamf.com/update-macos on the 3 ways I can push out updates. I'm using the first method of creating a Configuration Profile and enabling the Software Update payload. Should there be a specific URL (Software Update Server. Specify a URL of the form http://server.net:8088/index.sucatalog) as suggested? I'm thinking this profile won't work if there isn't an update server to check with? 

Has anyone encountered this issue when trying to use 'Local Login' with Jamf Connect?It has been working fine for me up until now. I didn't make any changes to the config profile so I'm not sure how this has happened. 

Hi all, I don't think this is related to Jamf per se but I am still looking for feedback. We recently updated our stock to use various M3 models. On first connect with previous wodels, we would be greeted by the basic "language selection", then the screen to connect to a wifi network, then the SSO login using O365 logins. With the M3s, after the langauge selection screen, the wifi icon shows wifi is activated but there aren't any networks appearing an we get a message saying that "wifi networks aren't availabe "as if wifi is deactivated. It sometimes works if we hard line it but so far the only 100 percent of the time solution is to reimage the machine. This is going to be an issue since we want to start direct shipping these things to employees who request them when onboarding or changing laptops. Has anybody come across something similar?

Hi all,I have not found anything on the below on the interwebs, anywhere, and am pulling my remaining two follicles of hair out!As of last Thursday, new users on our Macs now can't log into Office for Mac, we're using the latest version of Office (this is the only change).We use JAMF Connect and a custom script to deploy the logged in users email address to OfficeActivationEmailAddress in com.microsoft.office which has been working perfectly up until last week.I've done some testing and tried removing the script from login and just using a PLIST with two entries in:OfficeActivationEmailAddress is set to a manual entry of a test users email addressand <key>OfficeAutoSignIn</key> <true/>With these two set we get the email address prepopulated, as expected but are told we can ONLY use PERSONAL accounts, remove the email address but leave OfficeAutoSignIn set to true and we don't get the email address prepopulated but can manually enter it and all is well in the

Update 11 November 2024: Standard cloud upgrades are scheduled for the weekend of 15–16 November (details below). We appreciate your patience. Today we are releasing Jamf Pro 11.11. Highlights include: Managed Device Attestation Using MDM RequestsJamf Pro now supports Apple's DeviceInformation attestation, a Managed Device Attestation method that verifies the computers and mobile devices in your fleet are legitimate Apple devices. Computer and Mobile Device Inventory Reporting EnhancementsNew inventory information for Battery Health and FileVault 2 enablement are gathered by declarative status reports. Support for New Mobile Device RestrictionsUsing mobile device configuration profiles, you can now restrict the use of RCS messaging, block the transfer of an eSIM to a different device, and preserve the eSIM on an erased device due to too many failed password attempts or the Erase All Content and Settings option.     For additional information on what's included in thi

Is it possible to enable non-admin users access to "system preferences > date & time > date & time"? Subpoints of system preferences > date & time are: -date & time-time zone-clock We want to allow (non-admin) users only to change the "time zone", nothing else. Is this possible or do we really need to open the complete "date & time" preferences for non-admins? Thx! Note: macOS 10.12.x

Fairly new to JAMF Pro and looking for a way to stop Self Service from launching automatically when a Mac logs in for the first time (after its enrolled via pre stage enrolment). Is it possible to stop the auto-launch but still be able to use Self Service when necessary?

is this the corrent place to report these items? Adobe Creative Cloud desktop app missing v6.4.0.361 released on 09/16/2024

Jamf announced in January that the Jamf Pro Classic API will no longer support basic authentication in a future release. Classic API scripts can still run—administrators just need to make a simple change in how they authenticate. Let’s look at why this change is coming and how to convert Classic API scripts to use bearer tokens for authentication instead of usernames and passwords. The token obtained during this workflow will allow authentication to either the Classic API or the more modern Jamf Pro API. We’ll cover: How bearer tokens improve security Request the first token Parse the token Use the token to send an API command Expire the token Renew the token How bearer tokens improve security This change to move away from supplying usernames and passwords as credentials for authenticating to Jamf Pro is a good thing. Bearer tokens improve security by reducing the number of times credentials are sent to the server. Instead of sending them with every request, a token is sent instead,

Hey all, We have a 1-to-1 iPad program for our elementary and middle school students and I've noticed that students have found that signing out of their Google Chrome profiles allows them to browse freely with the added bonus of deleting their browsing data. We have tons of browsing restrictions in place already, but kids are kids. I'm wondering now if there's a way to lock them into their Google Chrome profiles so that they're not able to sign out, kind of like restricting account modification for their Apple Accounts. This seems to be the only way to ensure that they're unable to delete their browsing history, and it also seems that the specific restriction in Jamf only applies to Safari, unless I'm missing something. Any thoughts?

I have made a script, with help from other scripts found online, that will take user input and then update user information on JAMF Pro. All working apart from where you enter the staff/students full name for example "John Smith", script is only reading the first word on the input and updating JAMF = John.  Been on this for a few hours trying anything that I can find and now I am at a loss of what I can try to sort this.   Any help on this would be very welcome :)   JAMF_FULLNAME=`/usr/bin/osascript << EOTtell application "System Events"activate set JAMF_FULLNAME to text returned of (display dialog "Please enter fullname " default answer "")end tellEOT` #Store input full nameecho $JAMF_FULLNAME   ------------------------------------------------------------------------------------------------------- Complete script for information:   #!/bin/sh echo ""#1. Get user input for usernameJAMF_USERNAME=`/usr/bin/osascript << EOTtell application "System Event

I've got an exemption group set for a handful of machines to allow them to use Screen Sharing. But when the compliance script run's its remediation it appears to be disabling Screen Sharing.The logs show that the rule failure being identified...   Tue Nov 5 14:14:09 UTC 2024 system_settings_screen_sharing_disable passed (Result: 0, Expected: "{'integer': 1}")   ...and then where the fix should be skipped because of the exemption...   Tue Nov 5 14:15:16 UTC 2024 system_settings_screen_sharing_disable has an exemption, remediation skipped (Reason: Exception - Remote-ScreenShare)   And yet Screen Sharing is being disabled as soon as the remediation is finished. I haven't modified the script. And there are no configuration profiles or other policies running to re-disable Screen Sharing.

The last post I can find relating to this is from 2017; There isn't a solution there and I've tried almost everything previously listed.We've been using JAMF for a few years mostly without issue - this is the first time we're seeing this error. There's a similar error "connecting to jamf server" which can be resolved by simply uninstalling and allowing JAMF to reinstall Self Service. No luck on this one. also tested:computer restart, trying from an IT account (removes any variables from the users startup items), refreshing the MDM, clean uninstall and reinstall of the JAMF Framework.I did find the list of ports, but we aren't seeing any blocked ports (on machine, router, or via ISP). Issue is present both on and off VPN (so that is irrelevant).Currently this is only affecting the one machine but as I don't have a fix there's trouble if it spreads. The Mac still has access to jamf controls via terminal, still receiving profiles and policies, still reporting in all information to the ser

We have deployed Kerberos SSO extension to all mac devices so that we can access SMB shares from file server. When we enroll new mac device, for the first time JAMF asks Kerberos credentials and user needs to manually enter the username and password. Once user provided credentials, it receives Kerberos token and token renews automatically. Issue which I am reporting here is why user needs to enter Kerberos credentials for newly enrolled mac, why it can’t be automated. JAMF connect menu bar plist: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" http://www.apple.com/DTDs/PropertyList-1.0.dtd> <plist version="1.0"> <dict>                 <key>Appearance</key>                 <dict>             &nbs

I have deployed Sophos Intercept X to our mac and ipad fleet. running great on the Mac, but on the iPads the app has to be opened before the device is enrolled into Sophos Central to pickup the policies. It's unfeasible to get all our students to manually open the app so I'm racking my brain to figure out how to do this. Initially I setup a config profile to deploy a single app mode payload which opens the app, and then had a smart group (with criteria of having the single app mode config profile installed) in the scoped exclusions to disable the single app mode once it was pushed out. but this created a loop.  I'm wondering if anyone had any suggestions on how to get this sorted by either being able to open an app without single app mode. or another criteria i could try with the smart group.

Hi, I'm running into an Enrollment issue where the jamf connect okta screen is getting bypassed if the computer is idle and goes to sleep. For example, the user will go through the setup assistant options and reach the jamf connect screen. The mac goes idle/to sleep and once the mac is turned back on, it prompts for a local account login instead of the jamf connect login and you do not get an option to switch to the jamf connect screen anymore. How could I keep the computer display awake when new users get to the jamf connect screen stage? If a computer goes idle and prompts for local account login, is there anything I can do to revert back to jamf connect screen? For one case, I wiped the computer and reinstalled macOS, went through setup stage and it still prompted for local login instead of jamf connect screen

Good morning, We have a problem with shared iPads and students that have to change the Apple School password.After select the name on the list and before begin the password change process, appear the setup assistant about the language and country, I just now create a profile removing all the setup assistant steps from shared iPads and it stil appearing.The problem are the students don't be patience and the iPad get hang during the language process if you didn't wait to select and continue with the password change process. Thank you very much and Merry Christmas.

So we have an ipad that I enabled lost mode, due to the fact it was overdue and the one who checked it out did not return it.  So then I locked it and put a message on the screen.  It was returned so I disabled lost mode, does the system take a while before it unlocks it?  I can see that the command is pending 12 minutes ago, along with other commands that are still pending since 7-2-24 after I locked it.  But what I am not sure is if this iPad has active internet connection so that it can receive the command.  How can I connect this ipad when it is locked and I do not think there is an active internet connection to it?  Will the factory reset method work and when I am asked to join a network connect it and then the commands will process?