Get Support
Recently active
Hello,Previously, I was able to execute policy in Self Service from a Custom Menu bar in Jamf Connect, but it hasn't worked in months. When executed with Self Service closed, I get "Self Service quit unexpectedly" "Click Reopen to open application again. Click Report to see more detailed information and send a report to Apple." The command works fine if Self Service is already open though, so it seems like it's an issue just launching Self Service from the menu bar.Here is the section of the custom menu bar I'm talking about, if someone sees something that no longer works, please let me know:<dict> <key>Action</key> <array> <dict> <key>Command</key> <string>url</string> <key>CommandOptions</key
Hi all, We have recently switched our LDAP integration from AD to OKTA. How do I bulk update user and location from AD based outdated info over to OKTA based. Any assistance is appreciated. The MUT app looks like it would require alot of manual work to setup excel and is labor intensive.
so it seem that the build it option JAMF Pro does not woke and i see the same problem others have posted the white brick when i try a ad login, so i suck with Mac scripting also now to JAMF looking to do is when the system runs in enrollment or first boot and it see the MDM setting and start to run that. last step would be join AD.what i am looking to have it do is1. Join AD2. set the OU3. set the AD commuter name the the SN then reboot if needed4. this maybe a second scrip ( when assign a use set the Mac name that show up in mac info to the Users name)
Designed as a possible last step before a MDM “Lock Computer” command, FSWL.bash *may aid in keeping a Mac computer online for investigation, while discouraging end-user tampering Background When a macOS computer is lost, stolen or involved in a security breach, the Mobile Device Management (MDM) Lock Computer command can be used as an “atomic” option to quickly bring some peace of mind to what are typically stressful situations, while the MDM Wipe Computer command can be used as the “nuclear” option. For occasions where first forensically securing a macOS computer are preferred, the following approach may aid in keeping a device online for investigation, while discouraging end-user tampering. Continue reading …
I received this feedback from one of our teachers testing out Jamf Teacher- When I take control and lock them in an app, it literally clears their ipads from all other apps. Which is great! Except when I clear the locks on my end, all of their apps end up in different locations on their device. So I had a few angry students that spend hours organizing and categorizing folders and apps then suddenly I come along and clear things and then their apps are all messed up and scattered. That isn't a nice feature of this app for sure. I get it. I love having my iPad organized by apps I use and in folders. It's a shame that this developer didn't think of that aspect of things when designing the app. Just a little feedback for you. Are others experiencing this?
Hi All,I have a machine which is appearing in JAMF when searched for under the Inventory tab. However, it is not showing up in the Settings > Global > Automated Device enrolment menu, or in Computers > Enrollments > Prestage Enrollments. Can confirm that it exists in JAMF and is enrolled in the MDM in ASM.As it does not exist in 'Prestage enrollment' when booting it doesn't go through prestage enrollments.I can enrol the device using the online login https://ourjssdomain/enrol, however this is a specific use case where I need the machine to be enrolled through Prestage as the machine could be wiped whilst the user is on the go for security reasons.When running sudo profiles renew -type enrollment get the message: DEP enrollment failed: No device Enrollment configuration was found for this computer (MDMDeviceEnrollment:103)Which is obviously occurring because JAMF hasn't got it selected to run the device enrollment config, because it doesn't exist in there.Any idea on w
Hi,I have managed to mostly create a configuration profile that will make our Sonoma Macs compliant with CIS Lvl. 2. But I have come across two problems:1. An Administrator Account Cannot Login to Another User's Active and Locked SessionIf I am not mistaken, this should be fixable in one of two ways:a) By executing/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1which I have done, and the corresponding check, whether this has worked,/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'produces a result of 1, which is correct. But still that policy is failing in Jamf Protect.b) By setting values in /Library/Preferences/com.apple.PowerManagement.plist which I have also done through a policy. But this actually sets the values in /Library/Managed Preferencesand has no effect.Can you point me in the right direction?2. When I set
Jamf Protect hast baselines for CIS Lvl.1 and Lvl.2.Is it possible to use a different baseline, e.g. v8?
I'm unable to login to Jamf Pro after following the setup procedures. I'm integrating Jamf with Google Workspace and got locked out. Google Error 403.Error: app_not_configured_for_userService is not configured for this user. I am the admin on the account and GWP.
I have two profiles setting proxies up in the com.apple.SystemConfiguration domain.Both work if I double click on the profile and install via system settings, neither work if I install them via Self Service or pushing them from Jamf.Running 'scutil --proxy' shows an empty dictionary and trying various websites that should work all fail.I've tried a few different version of Sonoma and none work. I'm running "11.1.1-t1701704198" Jamf Pro on-prem.
Anyone else getting stuck in a boot loop after installing Rosetta? 2020 M1 MacBook installed 14.6.1, enrolled with JAMF, but after installing rosetta the computer gets stuck in a boot loop. DFU restore doesn't fix the issue. Happens with multiple laptops.
I have a computer where the MDM profile didn't renew last month, so it is expired. Haven't had the chance to look into why it didn't renew automatically, since I have many others that have. I did dig up some old notes from a SCEP issue I had previously and found the following command:'sudo profiles renew -type enrollment'It isn't perfect and I don't have another test with and expired profile. Running it on a test machine did require that I log in as the first "Setup User" that was logged in when the computer enrolled the first time via DEP during the assistant. After straightening that out it pretty much did what the man page suggests. A notification appeared, clicking it took me over into System Settings and a new MDM profile was installed with an expiration set to two years in the future. This does trigger an enrollement and reset some of the once-per-computer policies, so a little care was needed to descope/exclude some things that shouldn't run twice. Apart from that it seems like
Since Sequoia will be prompting users to review their screen recording settings monthly, I was wondering if it was possible to create a Smart Group that displays which apps in the Screen & System Audio Recording are either enabled or not enabled. Ideally, I'd be able to query by app name (Teams, Chrome, Zoom, etc).My goal is to regularly prompt users to turn this setting on for the app(s) it is not enabled for.Thanks,Michael
We are in the process of migrating a jamf instance from a company that we are splitting from into our very own jamf instance.I have a lot of configuration profiles so far that are all "uncategorized" and I have gone through a few of them one by one to move to our temporary categories but would love to know if there was a way to assign them in batches so I don't sit here for the next 20-30 minutes doing them one at a time if I don't have.If there isn't a way to do this then that is fine, I'll just click them each and do what I've been doing. Thanks!
Recently, we have had an unusually high load on our network.After digging into the problem a bit, logs and such, our suspicions have targeted our Jamf environment (Jamf Pro Cloud). We have discovered that a lot of traffic comes from AWS and in logs we also see the text "appinstaller".Once a year, when schools start after the summer, we install and distribute Mac computers to students. Since the turn of the year 2023/2024, we have added automatic installation of M365 - Word, Excel, Powerpoint, Outlook and Teams. So we suspect that the hard load obviously has something to do with this.However, it would be interesting for us to get a report that shows what has been installed, when and to which computers (or to whom) within a specific date range.Is there any way to produce such a report in Jamf?
Hey guys! So today we came across an interesting issue with a few iPads. It seems that if someone goes to Safari and clicks on a page to create a bookmark and then saves it to the home screen, you cannot go and remove the bookmark. These particular iPads do NOT have a home screen layout profile setup and while they do have Restrictions payload, we tried allowing permission to remove both user and System apps and neither options allowed removal. Anyone know if there is an option someone else I could be missing? I looked over every single checkbox in the Restrictions payload and the only others in effect are Passcode and Lock Screen so those should not be conflicting. Any help or advice would be much appreciated!Alex
We have an app that is set to automatically install on all our managed iPads (i.c. Google Docs). Some functionality is only available in the web version, but access to the web version is limited because the browser's default behaviour is to redirect you to the app.A workaround is: uninstall the app, until you need it again. But although I can uncheck the box 'prevent users from removing the app' and disable 'reinstall this app when it's removed by the user', I need a way to make it reinstallable via the Student/Teacher apps (in My resources).I tried to make a second group of iPads, containing the same set as the first one, so that every iPad has both the 'automatic installation' and the 'on demand installation'. But the app doesn't show up in the list. Is this workaround not possible, or am I overlooking something?
Hey guys,I've been working on a computer lab and I have some time to troubleshoot. I had to upgrade the lab from Ventura and 2022 Adobe apps to Sonoma and Adobe 2024 apps.Previously for the Adobe 2022 apps I would run them though Composer and I had no problem pushing them out and they would install successfully on my lab computers.However, this time round the installations fail about 90% of the time, a few would work but most of the time they would fail. I have Photoshop, Illustrator, Acrobat, etc and package them individually.I came across this: https://community.jamf.com/t5/jamf-pro/adobe-product-package-fails-to-install/m-p/301627I was going to try that when I also read to check the \\var\\log\\install.logI had it open when I was using Composer to create a new snap shot and I could see a bunch of failed messages. Mostly saying Install failed: The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. Then when the Insta
Hi, i am trying to script the final step in our onboarding process, where the user is presented with a list of Locations to chose, and once selected, the script will pull the serial number and rename the machine the location-serialnumberI'm 90% sure I have it right but i am getting echo errors when testing in CodeRunner... and i'd appreciate some extra eyes / advice.... #!/bin/bash #/usr/local/bin/dialog # Pull device serial number for lookup serialNumber=$(ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\" '/IOPlatformSerialNumber/{print $(NF-1)}') nserialNumber=${serialNumber} #Specify variables for swiftDialog dialogInstalled="/usr/local/bin/dialog" downloadDialog="https://github.com/swiftDialog/swiftDialog/releases/download/v2.5.1/dialog-2.5.1-4775.pkg" pathToDownload="/usr/local/dialog" pathToPackage="/usr/local/dialog/dialog-2.5.1-4775.pkg" #Check if swiftDialog is installed if [ -e "$dialogInstalled" ];then echo "Dialog Is installed" else echo "Dialog is no
Hello everyone not really a reach out for help but more informational.Our company ticketing system has been getting a lot of reports once upgrading to 14.6 & 14.6.1 that their macs are slow to lock and their touchid no longer work or theres a huge delay. I myself upgraded and was affected.Reading through some apple forums someone identified that the issue was with a configuration profile that sets the local device password policy. It uses the com.apple.mobiledevice.passwordpolicy payload type.I went looking into our jamf instance and found a password policy configuration group and unscope my machine from it. I then locked my mac and both lock and touchid were back to instantly working. I rescoped the same policy back to my mac and boom delays again.This is where things get complicated for our environment, we have conditional access policies set by intune that our macs register to for access to certain apps. Those conditional access policies are tied to our jamf password
Our Company utilizes JAMF Pro and JAMF Connect for MDM Management, Up until recently, we have always had local accounts created manually during prestage - then sign out and sign in with the users Azure Credentials - connect the local account and then merge the passwords so the local account and network account have the same credentials through JAMF Connect.We want to streamline this process and switch over to a Full Zero Touch Deployment - Currently we do have some minimal connection on the JAMF Pro side using LDAP Credentials/Directory services, so we can have admins login with their LDAP Creds and then techs can manually assign Location and User data by searching LDAP. We do not have an LDAP server connected and again, SSO is not setup yet. Part of that process I know we can setup SSO and use it in an enrollment customization then pass it through to Jamf connect during that process so the user can authenticate with their company account, it will generate the local acco
We have been using Jamf Setup with Entra SSO for a year now. Since the begining one of the first steps required is to log into Microsoft authenticator and register the device to the tenant using an account with cloud device administrator access. At JNUC I asked one of the sessions and they thought that requirement has been removed. I look at the documentation but I am not seeing any configuration changes but any device we setup still requires that step. Can anyone point to what I need to change to no longer require that registration step?
Hi guys,New to the Mac OS world, was an AD Engineer for 10+ years working in powershell.How are you guys going about deploying your vpn configuration files when installing your vpn?My org is using Aviatrix, I want to create a script to deploy the custom configuration file and name the profile after it's creation.
I'm wondering if I can default Jamf Connect Login to show the local logins first instead of the network sign-in.Our network (call it NET-RAD) currently uses RADIUS, which we knew, so we'd planned to use our WPA2 network (call it NET-DEV) for Connect Login.A logged in user needs to be on NET-RAD, and even though the password for NET-DEV is saved on the device, Connect Login always asks for the password to NET-DEV.Since we don't share the NET-DEV password with users (it's pushed out via config profile) they end up with no network access on Connect Login and unable to fix it themselves without some sort of hotspot.I understand this is expected due to how Connect Login handles network credentials, but I'm wondering if there's a way I can default Connect Login to the local login page, as opposed to the network login page, at least until we can get Clearpass in place and figure out a better way to do our network for Connect Login. That, or if someone has better ideas.
Hello Everyone,We’re expanding our student loaner program to include Mac laptops. Each semester, students will check out these laptops for their coursework, and at the end of the term, the devices are returned to be reset and reissued.Here are the key issues we’re facing:Active Directory Binding: All devices must be bound to AD, and there’s no workaround at the moment. We’re looking into Jamf Connect or an alternative, but those options won’t be ready in the near future.Data Removal: We need a reliable way to remove user data at the end of each loan period.External Resetting: The entity handling the checkout process (not internal IT) will need to complete the reset. This means the "Wipe" command isn't viable since we can't ensure consistent internet access or the ability to follow a complex process.We currently have a Self Service item that successfully removes user profiles. It works great for us. However, the biggest challenge is managing applications. We need to find a way to remove
Earn a cool badge and Jamf Nation Reward Bytes for your published articles. We’re looking forward to your submissions!
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
