Hello everyone,At the beginning of the year, we started our journey from leaving Novell in favor of Active Directory and MS Cloud. Now it's time to make adjustments for our Apple environment. We have chosen not to use Jamf Connect (initially) but rely on our supplier that they can do it well without (though not as well as with). But there are some important points for us to get across.- Not binding the units to ADs- Enable access to network volumes, own storage volume and sharedIs there anyone in the community who is in such an environment and what have you done to solve it? Or is there any specific way to go to solve it, recommendations?Then another little thing. We will (sadly) move part of our Apple environment to Intune for financial reasons. As I don't know much about Intune, I take the opportunity to ask the question if anyone here knows. Can we run Macs in Intune without binding them or is it a must on that side?

I have a Smart Group monitoring computers where the bootstrap token isn't escrowed. In the past week, I noticed a couple freshly wiped + re-enrolled computers (all on Sonoma 14.2 and 14.2.1), where the first user logging into the computer isn't getting the Secure Token or Volume Ownership. Also, the bootstrap token doesn't get escrowed. Background: in our 1:1 deployments, we have a PreStage-created, hidden local admin account. In this 1:1 PreStage, we have enrollment customization turned on, pointing to our SSO IdP. User gets a device, logs in through SSO, which populates their info into the local user creation screen. They enter their password again, and get logged into the device. Enrollment finishes, and for some reason Jamf is showing the PreStage admin account as the only Secure Token holder and Volume Owner. And as mentioned, bootstrap Token doesn't get escrowed. I can fix manually using sudo profiles install -type bootstraptoken, but trying to figure out why this is happeni

This might be a stupid question but here goes. I'm looking to use LAPS with Jamf and I can't seem to find the "ClientManagementID"  for the API call./v2/local-admin-password/{clientManagementId}/account/{username}/passwordAny help will be appreciatedThanks in advance.

Hello All, I was wondering if anyone here has been able to successfully implement OneDrive Known folder move?We are trying to move user's Desktop and Documents folders to OneDrive, without any user interaction, we have tried to apply these settings using the Applications and Custom settings payload, we can see the CP in System preferences Profiles but nothing changes in Onedrive. Other settings like hide dock icon and open at login are successfully applied with the same CP.<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KFMBlockOptOut</key> <true/> <key>KFMOptInWithWizard</key> <string>xxxxxxxxx</string> <key>KFMSilentOptIn</key> <string>xxxxxxxxx</string> <key>HideDockIcon</key> <true/> <key>OpenAtLogin&l

Apple Classroom - Students show up, but as "offline" in the teachers classroom console. We are using Securly SMART Pac. The students Ipad are getting the classroom profile, so that seems to be working. Any ideas? Firewall port? Smart Pac issue? I'm grasping at straws here. Thanks for your help.

Hi,Just in case anyone is struggling with the Cisco Secure Client deployment, modification of the xml file, etc etc, below is the step by step guide offered by Jamf Support, it differs slightly from the guide here - How to deploy Cisco Secure Client via JAMF (MacOS) – Cisco Umbrella  ( Which is still great for the configuration profile setup ) 1. Download cisco-secure-client-macos-#.#.#####-predeploy-k9.dmg from Cisco's Download site2. Double click the DMG to mount it. You should see the items below.3. Create a temporary folder to store files. For example:* Click shift+command+G on the keyboard, enter /Users/Shared/, and click enter.* Right click and select New Folder.* Enter folder name, i.e: CiscoSecureClient4. Drag and drop Cisco Secure Client.pkg and Profiles from mounted DMG to the folder you created in the previous step.5.Open terminal and navigate to the folder you created above (i.e. cd /Users/Shared/CiscoSecureClient) then run the following command:* installer -

 Hello,Our organization utilizes Microsoft PowerApps Portal to foster a community for our macOS users, providing a space to share ideas, tips, and best practices. We are looking to implement notifications, either through Jamf’s Self Service portal or the Mac notification center, to alert users when new posts are made. If anyone has experience with integrating notifications between PowerApps and Jamf, or can provide guidance, it would be greatly appreciated.

Anyone else getting 503 errors from Jamf Pro

Think i missed something in the install i followed the instructions and from a video done about a year or two ago and i get that cannot reopen error i ran the log command and i do see the JSON missing error and i can see it in the setup but i am guessing it's not installing it  Nudge -simulate-os-version "14.2" -disable-random-delayzsh: command not found: NudgeIT Admin@jason-zs-mini MacOS % log stream --predicate 'subsystem == "com.github.macadmins.Nudge"' --style syslog --color noneFiltering the log data using "subsystem == "com.github.macadmins.Nudge""Timestamp                       (process)[PID]   2024-09-17 15:42:24.183975-0500  localhost Nudge[627]: [com.github.macadmins.Nudge:user-interface] Finished delay2024-09-17 15:42:24.190505-0500  localhost Nudge[627]: [com.github.macadmins.Nudge:sofa] Failed to decode previously cached

Hi there, I am trying to automate some processes based on our LDAP integration. At this we have a stable integration with our LDAP and all the tests are successful. (Settings: System > LDAP servers).Group Names and GIDs are found. So far I was able to use the information for some configuration profiles. Now I want to use it for associating specific devices with a smart computer group but I am somehow stuck. Ultimately, it should result like this: If user is member of a specific LDAP group, then the user's device to be associated automatically with a specific computer smart group.  In system > computer management, I created custom "extension attributes" to map the "Directory Service Attribute" "gidNumber" to the LDAP attribute for "GID". But it does not seem to work. Any idea what I am missing?

Originally deployed withprestage set to "Enforce device name" set to Serial Number. Configuration Profile allows name change. Set name VIA MUT and the device gets new name and it looks like it is good for that day... Next day the device does inventory, and it reverts back to serial#. Is there any way to fix this aside from wiping 1600 ipads and getting a new prestage? I was not aware that enforcing the mobile device name meant we wouldn't be able to change it from our end later... that's quit the... feature. IF I set the name MANUALLY, then the name does stick. I really don't want to manually name 1600 ipads though. The description in Prestage for "Enforce Mobile Device Names" reads - "Mobile device name will revert to the value entered if the device name is changed by the user". This is false. What it should say is "Mobile device name will revert to the value entered if the device name is changed by Any means other than throug

My Automated Enrollment on the Jamf Now side is working fine however I'd like to add the Jamf Security cloud (RADAR/Jamf Protect product) as an integration in the UEM section. However there's no option for Jamf Now but there are options for Pro,School etc which seems strange. Then when creating the activation profile manually theres an option for Jamf Now but when selected nothing happens. I've enrolled the devices manually and they're showing as unmanaged as I've used the QR code from the admin pages as the QR codes sent to end users dont actually work. Any help is appreciated.  

We use Okta/FIDO2 to allow users to login to Self Service and see certain Apps only they are assigned.We're seeing an issue where the private browser window has automatically filled in the username with a different one (some users have 2 Okta accounts, one for elevated privileges elsewhere in our business).Anyone else seeing this? Is it Jamf, or Okta? It's been hard to narrow down so far.

I'm working through the usual new macOS approval process for my org. Everything checked out on my test machines, so I updated my daily driver. Now, every 30 minutes or so I am getting a popup that is new to macOS 15 saying "sudo is trying to execute a command as administrator." Clicking "Cancel" makes it pop up again a few seconds later, and authenticating with an admin makes it pop up again about 30 minutes later. I like this popup in theory, but as implemented it doesn't give anywhere near enough information to figure out why it is showing up or if it's a valid request. I've ruled out our in-house launchagents and the like, and it doesn't seem to be happening on test machines with normal user programs installed. That makes me think it's tied to some admin related tool like Jamf Sync, Packages, autopkgr, or something else that most users won't have installed. Alternatively, it could be some driver set like the LogiOptions+ needed for some keyboards. Is anyone else seeing this recurri

Hey everyone, getting some really strange errors the last few days on all my macs. To be clear, I am only running AD, and nothing has changed on the mac side of the house what so ever. Currently if you UNCHECK the "create mobile user account at login" box, network users log in without error. However, once you check this box and try to log in a network user, a dialog box pops: "You are unable to log in to the user account "abcdefg" at this time" Logging in to the account failed because an error occurred. Any conversation or help would be great, as we are completely stuck on this side about what would be causing this issue. Note that last week our engineer rolled the DC's, and the problem was gone for the rest of the day Friday, but it has once again returned. I am simply looking for any and all info to try and resolve this issue.

I'm trying to find a functional EA under Sonoma that I can use to create a search for users who still have mobile accounts.   Does anyone have one that works for builds later than 14.3?   I'm unsure what may have changed against other EAs I've found here.

Apart from waiting for Apple to release a patch for this.  Can I ask what other mitigations people are doing or thinking about doing for this recent issue?

Is it still the case that there is no way of allowing Location Services for a specific app, for non admin users? I don’t see a PPPC option for it, and it’s been stated that this is impossible in the past. Zoom soft-phone client wants location services enabled for 911 call routing. Users don’t have admin rights.I've seen someone say the below works for Big Sur, but even then I believe that just enables the general Apple location services, and not specifically for an app in particular.#!/bin/sh sudo /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -int 1 sudo /usr/bin/defaults write /Library/Preferences/com.apple.timezone.auto Active -bool trueI need Location Services checked for Zoom specifically.

I am trying to prepare for our next semester.  I do not upgrade instructional machines until the semester is over.  In doing so, I learned that my older Intel machines could be moved up to 13.6.3 and started to do so.  However, for the Lab Instructor machine, this disables valuable features within Remote Desktop for non-admin users.   For my lab instructors logging in via AD, this would be the three options to the: Copy, Install, and Unix. Of all these Copy would be my critical loss for a lab instructor.  They can still observe.13.6.2 still allows my non-admin users access to all these features.Also, for machines running Sonoma (my M1 machines) I also loss the ability to login to all lab machines at once via my admin account.  This would be using the Send Unix Command of an osascript   The error they return is 143:162: execution error: Not authorized to send Apple events to System Events.So . . . if Apple Remote Desktop is still part of your

A profile called "whitelist during school hours" is setup with a time filter. It has a whitelist, so that private games and other unwanted apps will disappear from the students' home screen. Unfortunately, the profile works only for 60-80 % of the iPads automatically. We have to push the button "re-try" in the administration console, or we have to ask the students to open the app Jamf Student, so that their iPads asks the Apple Push Server for any updates (including updates on profiles).Have you experienced non-reliability with time filtered profiles?Any suggestions how to fix that are welcome. (We tried IP address based profiles that work a bit better, but they aren't reliably either.)

Found out today that some students have the "Private Wi-Fi Address" option enabled in the settings for their appropriate SSID.  We don't want this setting enabled on any of our iPads so we have it disabled in all of our wifi SSID config profiles.  I had one this morning that I was able to enable and disable it, I tried restarting but no change, also tried removing and adding that SSID's config profile but no change, I could still enable or disable.  All of our devices are running ~16.6 or newer, probably around half have gone to iOS 17.  I'm guessing it defaulted to off rather than on like an unmanaged SSID would normally due to the profile disabling it, some just found that they could enable it for whatever reason and have.

Hi allApologies if this has been answered already but we are trying to push an 802.1x LAN profile down to our macOS devices.We have managed to push the wireless equivalent down with a certificate etc however when we try and create the LAN equivalent the device doesn't pick the certificate defined in the profile. Has anybody come across this issue before? We've seen a similar issue in the past with windows devices where you have to start the wired auto config service but wasn't sure if something similar was required on macs?thanks  

NOTE: Okta Verify appears to have rolled back to 9.23.0 as the official release which is working in macOS 18.1 beta 6.  iOS SSOe support appears to be working in 9.24.1 with iOS 18.1 beta 6. Limitations and RequirementsApple has made two revisions to the PSSOe framework.  V1 allowed for Password authentication and can be used with macOS Ventura and greater.  V2 added functionality for authentication with PSSOe to include SmartCard and Secure Enclave credentials. At this time, Okta supports the V1 framework with limited support for V2 with Shared Device Keys.  The “Password”authentication method is available with Okta.  PSSOe support is limited to local account password sync only.  The PSSOe credentials are not used for authentication to Okta gated resources.  To complete the setup for the full expected behavior of PSSOe, an administrator must set up both the Extensible Single Sign-On extension (SSOe) configuration and the PSSOe configuration on the same device.  Okta uses a hybrid of t

Not a Jamf Pro issue, but Jamf Pro does hightlight it.  Four years ago when we got our first Silicon Macs, we occasionally found the odd machine which we couldn't log on with our admin account. Password wobble. We never found our the reason and just went into Startup Options, wiped the Volume Group and re-enrolled.  We now have more Macs, almost all Silicons now, so we see the problem more.  In order to ensure that our first admin account has Secure Token, we create it through Jamf Policy.  We've found that on Macs where we've flattened it with Erase All Content, or even Disk Utility in Startup Options (yes we definitely delete the Volume Group, not just Macintosh HD), we get the odd case where the Policy failed because "a folder with that name exists".So Erase All Content, and even Disk Utility says it has erased the Data Partition, but somehow it hasn't. Not knowing as much about Macs as I do about PCs, I'm guessing that the partition table is held in NVRAM,

Can anyone help with JSON script line to change the name of Managebookmarks?  "ManagedBookmarks": { "type": "array", "title": "Bookmarks",