"Security is not a product, but a process." – Bruce Schneier   In today’s endpoints landscape, organizations managing macOS / Windows endpoints face an increasing need to enforce stringent security standards to protect sensitive data. The CIS (Center for Internet Security) Benchmarks serve as a globally recognized framework for safeguarding endpoints against security threats. When combined with the powerful capabilities of Mobile Device Management (MDM) such as Jamf Pro, Intune, Endpoint Central, etc., , IT administrators can seamlessly implement these benchmarks to enhance security without compromising user experience.   CIS Benchmarks are consensus-based, best-practice security configuration guides. They provide detailed recommendations on configuring IT systems to mitigate vulnerabilities. For macOS, the CIS Apple macOS Benchmark offers actionable steps to harden systems against cyberattacks while ensuring compliance with organizational security policies.   Using CIS

Hello,   Apologies if this is not the right place to ask questions like this. I tried searching before posting, but did not find anyone else already asking about this recently.   I have set up a prestage enrollment with the option "Minimum required macOS version" set to "Latest version based on computer eligibility". I thought that this would update a computer to the latest version of macOS that is compatible with the device, but it seems to just install the latest version of macOS that came with the device. In my test case, I am using a MacBook Air (M1, 2020). When I get to the desktop after the Setup Assistant finishes, the first thing I get is a notification about a macOS update available, which is not what I expected. Here's what I did:1) the MacBook Air had Sequoia installed before, and I used the Jamf management command "Wipe Computer" from the web interface2) the computer reboots, does its thing, and brings up the Setup Assistant3) the prestage enrollment seems to be w

It there a way to disable rw access to Login Items or disable the whole pane in the General pane? I have the Extensions area locked

Is anyone else seeing issues with updating to Google Chrome v133.x while on Sequoia 15.2? Getting an error code when sending off this version via policy, and the installer even fails when trying locally- getting a generic error like "The operation can't be completed some items had to be skipped. For each item, choose File > Get Info, make sure "locked" is deselected...etc". Even our RMM tool is unable to push a patch/update out.The only way I found to fix this was to entirely delete the old version of chrome installed (which was only version 131 from a couple months ago) and then Chrome installed without an issue. I'd rather not have to script a removal and then reinstall, only because that seems silly to have to do when this was working just fine previously. Does anyone else see similar behavior or know of a good way to handle this?

A staff has asked us to install Final Cut Pro on an iPad we manage. Deployed it from school.apple.com and we can see it install on the iPad but when launched it says Try Monthly or Try Yearly.   I suspect it needs an Apple ID since it is subscription based, but we've specifically disabled the use of the app store and Apple IDs on these iPads. We don't want them using their personal Apple IDs.   So, how can I make this work? I can create a generic managed Apple ID (e.g. iPad01@school.domain.com )in school.apple.com but how do I assign it to this iPad? And more importantly, how can I make sure it's only used for getting Final Cut Pro to run (i.e. they can't purchase anything, they can't store anything, they can't backup anything to this account, etc)?

We’ve recently left our old LDAP (eDirectory) integration on our Jamf instance and are now integrated with Entra. Feels good :)But what can we do next?- Login to Mac with Entra logins? What are some good alternatives to Jamf Connect?- Mount AD volumes? What do we need and what’s the options?

Hello,is there any way to automatically accepting the End-User License Agreement when starting Teamviewer QuickSupport for the first time? I couldn't finde something on Google. Thanks in advance for any help!

We are currently writing/testing our school lockdown policy in case of intrusion.  Ideally we would like to be able to:1) silence all iPads remotely2) be able to send an alert that pops up on the screen very visibly, regardless of lock statusI have tried sending an alert to self service but it pops up as a small banner (easy to miss) if the iPad is unlocked.  However, if the iPad is locked then all it does is tell you "self service has a notification", which you then have to unlock to read.  It is definitely not attention grabbing in an emergency.I cannot find a third party app that allows us to send these alerts to pupils - lots for windows, none for iPads.We are 1:1 iPads, staff and students, so this is our best way for alerts. How have other schools handled this please?  

Afternoon Jamf nation Just want to check some thinking around our prestage.Where going through a process of removing an old admin account which is no longer required, as we now managed admins through Jamf connect with admin groups configured in azure.Im right to say its still needed in the pre stage, as it does need to install an admin as the first user. We are already removing it has part of build process.Im assuming there isnt away for it not to exist in the pre stage.   ThanksTom

Hi all, I just wondered with iOS18 if any of you have come across these issues on iOS18, and even iOS17.6 devices. Bluetooth always on within the JAMF settings worked magnificently. I believe this worked due to JAMF Student in the background checking the bluetooth status, and when it was turned off, it would just toggle it back on. With the update to iOS18, and maybe even 17.6, we've noticed this toggle doesn't happen. I am assuming it's due to how background apps may now work and this behaviour doesn't happen. Just wondered has anybody found a way to force bluetooth to toggle back on? Or am I missing a trick with bluetooth somewhere? Also, we set a layout which forces specific folders for settings and files, camera and photo, and then our managed apps. This layout that is set seems to stop the command centre working properly, including screen recorder. Is there a workaround to this. Layout is important for us as students end up creating hundreds of photos and saving apps on across mul

Recently switched a number of our applications to Jamf App Catalog apps to reduce the amount of time we were spending updating applications. Almost everything is working fine, except I'm having trouble with one device and am not sure what I can do to fix the issue. In Jamf, this one device (2019 Macbook Pro running an Intel Core) keeps showing up as having failed any update for a Jamf App Catalog app. However, when I look at application info for this device, it indicates the application actually HAS updated (and end user has confirmed this). When I compare the log file /private/var/log/install.log on my own test Macbook and the end user's, I see an error that looks something like this on the end user's device:Error getting application status info for file:///Library/Application%20Support/JamfAppInstallers/com.google.Chrome/notify.app: Error Domain=NSCocoaErrorDomain Code=260 "The file “notify.app” couldn’t be opened because there is no such file." UserInfo={NSURL=file:///Library/Applic

How are we to troubleshoot Keychain issues, if we cant open Keychain Access.app if the users password isnt working? I've tried deleting the db in ~/Library/Keychains/ and rebooted, but that didnt help. This guy is getting prompts for login keychain for any non-browser app, including Self Service. Typically, in Sonoma and below we'd delete the login keychain in Keychain Access, delete the folder in ~/Library/Keychains then reboot, and at next login the user is prompted to create a new keychain. That aint happening now, and I'm banging my head against the wall trying to figure this out.

Last year, I created an extension attribute for reporting if the current logged in user is an admin user. The extension attribute is below. I noticed a few months ago that this EA had stopped working. The output of the EA was blank. What got it working was to remove the "^" symbol in the results line. Removing that symbol means that the EA will report "yes" but not "Yes". We standardize all yes/no answers in EAs with capital letters. All of my EAs get pulled in by PowerBI. I can't figure how how to capitalize the first letter in the output for "isAdmin". This does work perfectly when I run it in CodeRunner either as bash or zsh. The result I need if a user is an admin is "Yes", not "yes". How can I get this to work? I know how to capitalize ALL letters in the output but I can't find anything that capitalizes the first letter. I remember when writing this EA last year, I found that using ^ is what would capitalize the output, and it was working in Jamf Pro... until just a few months ago

I finally got around to getting my repo created of all of my JAMF stuff.  So far, I have all of the SwiftDialog scripts that I have been posting here up on my repo.  Will be adding more, and also posting my EAs as well..  I am new to the git repo world, so please be patient with me as this quite a learning experience!   https://github.com/ScottEKendall/JAMF-Pro-Scripts  

On Saturday, February 15, 2025, Jamf Cloud Infrastructure will be patched. During this time, you will be logged out of your Jamf Pro instance. The purpose of patching is to ensure that Jamf Cloud infrastructure and the database service are up-to-date, stable, and safe from security threats. Please see the times for our regions below.   Hosted Data Region Date Start Time End Time us-gov-west-1 February 15 0800 CT 1200 CT  

Good morning, simple question about Jamf Connect Deploy & Updates integration in Jamf Pro. Currently my configuration is: deploying Jamf Connect not in the prestage via .pkg (only launch agent) but via the integrated functionality of Jamf Connect combined with the Jamf Connect Login Configuration Profile, as shown in the screenshot. It works. Two questions. 1) In your experience is it a stable configuration? Up to now it has never given me problems, but I would like to update to 2.44 (I'm stuck on 2.39) and since the profile is in scope on All Managed Clients I'm wondering if it's stable and the best option. 2) If I remove this integration in the configuration profile, nothing would happen to existing clients, right?That way I could simply deploy the update via policy and reinsert the Connect .pkg in the Prestage, just to have more control. What do you suggest? If the integration works well in your experience i could simply choose the new version and keep this configuration :)Tha

Hello, We are a school district and are facing a potential problem with the deep integration of Apple Intelligence in iOS 18.1+. All students use iPads and they are starting to update to 18.1 and above. This is likely going to be a major problem once it's testing season and I'm not the only one worried about this. According to Jamf Support there is currently no way to restrict this "feature" on an MDM level.   The problems: 1. In Notes you type an equation and the solution will automatically fill in.  2. Typing math problems in other apps will show a solution in the keyboard suggestions.   What I've tried: 1. Disabling AI settings currently available for config profiles (not applicable) 2. Restricting: spell-check, auto-correction, predictive keyboard, auto-suggestions -- only affects words/grammar, not math. 3. Blocking AI related hosts: https://support.apple.com/en-us/101555 4. Disabling com.apple.calculator   There is a potential option but current

Hello,please vote for the following request. Link: Network autojoin - always on option | Jamf Nation Ideas I requested:Make it possible that autojoin can't be changed by a user. It should be possible to leave it always on. The problem without it:In our school we use iPads with WIFI always on. Our network profile includes our school network with an "automatically join the network" on.We also use specific profiles which are activated at 7:45 til 13:00 with some restrictions while being in school. We block specific gaming and social media websites and we configured a whitelist there make only necessary app while beeing in school available.The problem is that a lot of users now found out, that it's possible to turn autojoin for the school network off before arriving in school. They do this because they won't the restrictions beeing activated from 7:45 til 13:00. This causes also other problems like always catching the students which are not connected on purpose and not visible in clas

Has anyone run into this issue:-MacBooks are bound to AD-User changes password.-Restarts/locks computer can't sign back in again.  States account is locked out for "15 minutes"-Log in as the local Administrator account and log back out, user can then sign in without issue.-Change user's password and they can log in but when they restart/shutdown, won't let them back in until we sign in as local admin account. 

Hello everyone, since the major tvOS 18 update, I guess, there are additional screensavers displaying in the Apple TV than the usual skyline (ocean, aerial view of an airport etc.). We use them in conference room mode in schools and even though the screensavers look nice on a 4K display, the distraction of the students especially in elemantary schools is an issue. Is there a way to stop the screensavers from showing up, I couldn't find a matching setting in Jamf. If not, maybe this should be considered becoming a payload? Thank you in advance Benjamin

What I would LOVE to see implemented in Jamf is a report containing all of the apps currently existing in the App table and a list of what groups that apps are scoped to. FWIW, we have over 900 unique apps listed in "Mobile Device Apps" Right now if we look at the Apps table we see a list of all the apps but for the scoping, we see something akin to "3 mobile device groups, 2 mobile device groups excluded". I understand we can't see it all in the GUI necessarily, but if we could get a PDF report or a txt file generated that shows what those groups are, we could mark it up and know which apps we need to make changes on scoping each summer. Right now, we have to look at each app and go to the scope tab for it and decide and then keep going 899 more times. Very tedious process. Having some sort of report or spreadsheet we could markup would be wonderful so we only have to make scoping changes to the 10 apps or so we care about. It would also help because we could socialize the big list wi

Dear all, I am trying to deploy Cisco Secure Endpoint Connector v 1.24 via JAMF. I try to deploy a configuration profile to give the app full disk permission, install the kernel extension and something else. I tried to use this documentation for that: < Approval of the Mac Connector macOS Extensions with MDM > and < Approval of Full Disk Access for the Connector with MDM >. Unfortunately it is the documentation for version 1.18 and from 2022. But there is no newer documentation available. After trying to deploy the profile to a Mac with Sequoia 15.3 I get the feedback from JAMF: "The current system configuration does not allow the requested operation". (Die aktuelle Systemkonfiguration erlaubt den angeforderten Vorgang nicht). The MacBook is an Apple M1 hardware. Can someone help me to find my issue? 

Back at again with another script that has been useful in our company.  Before I took over as Mac admin, the users were creating their IDs with their employee# vs their first.last name.  As such we have a mixture of systems with incorrect UserID, so I borrowed this script (author unknown) from a very very old JAMF post and thought I would make it more user friendly by adding some Swift Dialog "flare" to it.   The user that you are wanting to change cannot be logged in for this, so what I do is scope it to an admin ID that is present on all of the computers, and I walk the user through how to login to the admin ID (the password changes after they login using LAPS, so no worries there) and then I instruct them on how to run the script.  It only takes a few seconds to run, and will restart the computer once it is done.  Here is the script #!/bin/zsh ###################################################################################################### # # Gobal "C

I've been doing some testing of the "Lock Computer" function (from the Inventory/Management screen) and it does not work as I would hope. I want to know if it's working "as expected" or if I'm doing something wrong or if there might be a bug which I should report somehow. While my test machine (M1/Sonoma 14.7.2) is offline, I send the "Lock Computer" command. Of course I don't expect it to be effective until the machine is awake/networked; Jamf shows it as Pending. Pretending I'm a computer thief & don't have the password, I wipe the machine, keeping it offline. But in order to install MacOS, I need to connect to the network and get past that pesky activation screen. Surprisingly, no problem: your Mac is activated! And installation of OS proceeds. As installation proceeds, I check Jamf: the Lock command is still Pending. After OS installation completes, but before creating an account, the Lock command disappears from Pending, but it doesn't show under Management History at all (Com

Hello everyone, We use Jamf School in our school to manage iPad that are borrowed to our pupils. I have set a mail profile for every single one of them. Since september i encounter an issue that i did not have before. The students password is automatically written in "Incoming Mail Server" but not in "Outgoing Mail Server".  We can manually put the password but i want the password to be automatically to earn some precious time. Is there a way to do it? Thanks