Hello all,I just started with an existing system that isn’t really documented.  This means I have to do a lot of jumping around to determine what something does, where it applies, and even if it is working.  I want to create some good documentation for this, but I’m don’t know what the best method for doing this would be.Thank You in advance,-Pat

Hey everyone!We are relatively new to Jamf School and iPads in general for our district!We come from a Chrome environment so of course there are some abilities we had with GAC that we would like to emulate with Jamf School! Are we are to lock Chrome or Safari to only sign-in/authenticate with our @Domain accounts? Our fear is that students will just be able to login to any personal account and message/interact with each other that way (our admin is very pro-restricting student's virtual communication platforms).I appreciate any and all help!Thanks all,

  Your Mac is Ready for FileVaultFileVault keeps your Mac safe by encrypting your data andprotecting it with the password you use to log in. If youforget your password, you can use your Recovery Key toreset it.  

Thanks in advance for your input...Our current scenario: our newly purchased iOS/iPadOS devices are automatically enrolled into Jamf Pro and then go into a default group. This group has a relatively restrictive Configuration Profile that prevents users from adding an Apple Account. If the user needs a different configuration or apps on their device, they need to submit a form to the device management team. From there, the device mgmt team works with the user and so on. Since we’re in education, we’re dealing with a full gamut of needs, business apps, engineering, utility/infrastructure, scientific, entertainment, media, development...you get the idea. So, we can’t anticipate ALL of the apps users want beforehand.Questions: what is your organization's workflow for newly purchased iOS/iPadOS devices? And how do you communicate to end-users where to go for additional support/apps/configs when they power on their new device?We're thinking either a wallpaper with messaging about reaching ou

For test purposes, I have a very simple shell script. #!/bin/shkillall Dockexit 0A policy runs the script, and it’s available in Self Service. When I run it from Self Service, it works as expected (I can see the Dock restart itself). Hooray!However... (1)Self Service reports “Item Failed”, and (2)when I go to the Policy and check its logs, there’s no indication the Policy ever ran (status remains Pending).Is there a way to reset the Dock that Self Service won’t regard as a failure, and fail to log the Policy execution? 

Version: 12.1 MontereyProcessor: M1 ProLast Inventory Update:01/12/2022 at 12:27 PMLast Check-in:01/12/2022 at 12:26 PMSupervised: Yes What are my troubleshooting steps to get these to go through. Let's collab.  

Hi Jamf Nation Team, We are currently working to deploy the Falcon Sensor in our system, but we need to monitor the sensor's status. Unfortunately, the Extension Attribute I was using is not gathering the necessary information. Could you please help me if you have any that I can use: Sensor Registration: Confirms whether the Falcon Sensor is correctly registered with the CrowdStrike cloud.Sensor Operational Status: Checks if the Falcon Sensor service is running correctly on the endpoint.Sensor Cloud Connectivity: Verifies that the sensor can successfully communicate with CrowdStrike’s cloud infrastructure. Thank you!

New and somewhat confused JAMF-user here, and thus: silly questions.I'm using Entra as my Cloud Identity provider and I'm trying to create a smart user group based on membership in an Entra-group (JAMF_KLA) in order to build configurations for said usergroups. But I cannot for the life of me get it to work (nor do I know if it's actually possible).Looked at the mapping of both the SUG and in the CIP-setup, and everything there looks like it should work. Can also do a test against various users, and it works (User that is in the Entra-group gets green checkmark, user that is not in group gets red checkmark). Which tells me that the lookup is working.I see that I can also add users from a Directory Service from the Settings-menu. However, is that only for admins/auditors? I see that there's an option for Enrollment Only. Does this mean that the imported users do *not* have access to the JAMF-console?

I need help with standard user elevation as user should be able to forget the Wi-Fi networks as they required. in my case if it asks for admin credentials to forget the network.is there any privilege management feature in jamf?  

Hello-I have 500 new iPads. I want 250 to be assigned to a standard prestage and I want 250 to go into a shared iPad prestage. Is there a way to do this in bulk, or am I stuck looking up serial numbers and assigning them to the prestage one by one?

Trying to install Dockutil during JSM but it fails. Based off the logs its because its attempting to install to the system (/usr/local/bin). My pkg was created in Composer with the appropriate R/W permissions applied to all elements of the pkg but still no luck. Any help is appreciated!

I'm trying out the new PCM Device Compliance feature for macOS and am running into a problem. When running the "Microsoft Device Compliance" policy, it launches Company Portal, I login and it seems to complete the registration without issues. When I lookup the device in InTune, it's not there at all. In Azure I see the following:Join Type: Azure AD registeredMDM: NoneCompliant: N/AI configured the feature according to this technical paper: https://learn.jamf.com/bundle/technical-paper-microsoft-intune-mobile-devices-current/page/Integrating_with_Microsoft_Endpoint_Manager_Introduction.htmlAny help would be appreciated.

I have successfully setup PlatformSSO for EntraID authentication and after running it for a while I have some oddities.If the token expires Safari will offer passkey as an option for logging into EntraID federated applications.  Our conditional access policies allow passkeys, MFA, Strong Auth (FIDO etc).  Once the login is complete the Mac will passthrough creds for any access in any browser.If the token has expired then in non-Safari (Edge, Chrome and Firefox) the user is only offerred password as the option to login unless they have a passkey in Authenticator or an external FIDO token registered in EntraID (Yubikey etc).If you go to User/Groups and press the Authenticate button in the user account then the token is refreshed without any user interaction.Trying to work out if I’ve missed something in the config profile or if there is another issue.Anyone else seen similar and worked out a way to resolve so passkey/biometrics is offered across all browsers rather than just Safari?

I'm needing to delete a ton of Smart Device Groups but they all have apps associated to them.  How can I delete these groups without having to go into each one and remove the apps first.  I have 80+ groups and do not want to do each one manually.

Good day all,I’m deploying the google chrome extensions using the below.Installing the forced extensions work (regardless if there is a user logged in to chrome or not)However, one of my test computers doesnt have the user logged in to chrome and that blocks all extensions, even the ones in the allow list.And when Im testing against my every drivers that Im logged in, I have the opposite effects. Im allow to install all extensions. and none of them are getting blocked.I different set of eyes would be appreciated. I wish it was like some of the other post where people wait and then it works, but for me it hasnt been the case.  

Hi,I am experimenting with Compliance in Jamf Pro. I setup CIS lvl 1 monitoring as a start and without any Azure connection. But somehow it keeps giving the error: “Management settings deployment failed”. We run 43 Macbooks, all rolled-out with DEP and correct registered in Jamf (and Protect). Any idea?

We are facing issue with screen recording permission. To unlock security and privacy the device is asking for admin username and password. First of all, we don't know who those admin creds are. Second, we want to allow all users to be able to access security and privacy. This issue arrived only after we configured jamf connect with Azure AD. Not sure how to resolve it.

We have one user with a Macbook Pro M1 Laptop. Big Sur is installed on the machine and the logged in user is a Mobile Account and has admin rights. File vault 2 is also enabled.Deployment was some month ago and everything worked fine. Two days ago the user approached me as he was not able to login with his account credentials at home. He was in the office yesterday and after I logged in with my local admin account everything was fine and he could work. So told him to also to update his Big Sur installation from 11.2.x to the latest version 11.5.2. But as he tried to enter his password the following screen states that Authentication is disabled.I grabbed this screenshot from the internet cause our dialogue is in German.Anybody have seen this? Where does this come from and how can we fix this? I would greatly appreciate your help.Thanks

I am having a separate issue but need to submit ticket. When I log into Jamf Account and try to click the “Contact Support” button, nothing happens. Is anyone else experiencing the same issue?

I’m not too familiar with Securly (was just given access to Securly Filter for testing), but during the pandemic (before my time) Securly was implemented when students took iPads home. This was when our school district had Jamf Pro. Pretty much all of our iPads (less than 70~ stragglers still in Pro) are in Jamf School now. I replicated what we had in Jamf Pro as a configuration profile. It was simple enough from Securly’s documentation/old Jamf Pro configuration profile. But when I test it, and I see the activity, I only see ‘email’ (in Securly) as the user and not the actual email of the user. I’ve tested this by having my email account, a random student email account, and no active owner as the owner on the iPad (by adding/removing in Jamf School iPad inventory). All just say email. I tried this with the serial number as the variable but that shows up with random letters in the user field. I was hoping at least the serial number would actually show up correctly. Mostly, K-1 use iPad

FYI Just got this error on all my machines after editing a policy. jamf policy → Mon Dec 07 14:45:17 My MacBook Pro jamf[909]: Enforcing management framework... Mon Dec 07 14:45:18 My MacBook Pro jamf[909]: Enforcing scheduled tasks... Mon Dec 07 14:45:18 My MacBook Pro jamf[909]: Removing existing launchd task /Library/LaunchDaemons/com.jamfsoftware.task.1.plist... Mon Dec 07 14:45:18 My MacBook Pro jamf[909]: Adding launchd task com.jamfsoftware.task.1... Mon Dec 07 14:45:19 My MacBook Pro jamf[909]: Creating launch daemon... Mon Dec 07 14:45:19 My MacBook Pro jamf[909]: Creating launch agent... Mon Dec 07 14:45:19 My MacBook Pro jamf[954]: Informing the JSS about login for user schattc Mon Dec 07 14:45:21 My MacBook Pro jamf[954]: Informing the JSS about login for user schattc Mon Dec 07 14:45:21 Schatt's MacBook Pro jamf[966]: Checking for policies triggered by "recurring check-in"... Mon Dec 07 14:45:23 My MacBook Pro jamf[966]: There was an error. Invalid Message - The

I have two reporting tasks in Jamf Pro that I dread every time I have to do them: Creating a Security Stack report Creating a report that shows which computers have a specific application installed and which do not What I’m trying to doFor the security stack, we have (for example) 5 security products that should be installed across our fleet.What I’ve been doing is exporting Computer Applications inventory and working from the CSV. The problem is the way Jamf structures the export: The application name appears once The rows beneath it (per computer) are blank until the next application name appears Those blank rows still represent devices that have the app installed, but the format makes filtering, automation, and reporting extremely painful I’ve worked with other tools where the export shows the application name on every row per computer, even if the version is the same, which makes reporting much easier.What I’ve consideredThe only reliable approach I can think of is using Exte

Hello everyone,Running into a weird issue that I’m not sure if is intended or not (Fairly new to JAMF). We have some user’s devices that had not been checking-in\pushing commands properly via Jamf Pro, mainly due to users not logging in. Received a few back after the users left the company and they are at the local Mac login instead of the Jamf Connect login screen. I can connect them to ethernet and send them commands from Jamf Pro, but they do not check-in and receive commands (wipe\lock\etc). If I log in past the local Mac login, they start receiving commands again and work properly. I can also still use recovery to wipe them, but they do not receive any commands or check-in until I am past that initial Mac login screen.Tried using Jamf Routines and a few other things to try and get them to check-in and receive the commands without having to login locally, but nothing seems to work until I get past that first local login or wipe them. Is this intended? Does the local Mac login “soft

I have been requested to make two sided black and white the default print option for our Xerox Printer. I was able to accomplish this and add some handy presets for the user to select other options like 1 sided and color. What I have found is unless I open the Show Presets... option and check Reset Presets Menu to "Default Settings" After Printing... Print jobs will use the last preset selected by the user... so if they selected color... the next job will print color as well. Selecting the option above does just what it says and reverts to the default after each print job. My question is... is there a plist or a command line flag to check this box? I did not see anything in the plist file for the printer or in lpadmin. Any assitance would be greatly appreciated.

On a specific device, the “Update Inventory” command is successfully sent and works normally.However, when the “Renew MDM Profile” command is sent, it fails with the following message:Error command: The new MDM payload does not match the previous payload. Mismatched key: CheckInURLBecause of this issue, the device cannot renew its MDM profile, and the expiration date is approaching.What is causing this problem, and how can it be resolved?