Your Mac is Ready for FileVaultFileVault keeps your Mac safe by encrypting your data andprotecting it with the password you use to log in. If youforget your password, you can use your Recovery Key toreset it.  

Greetings,Is there a way to determine the last time a policy was triggered?  I’m doing some clean-up in my cloud environment, and have several policies created by other people that I’m reasonably certain haven’t been used in a long while; like months or years.  Ultimately its my decision on whether to remove the policy or not, but having evidence to support that decision (and the knowledge of how to get that evidence anytime) is useful to me.

Teachers have been using Apple Classroom to lock iPads if students are misbehaving on them. However, the students have found that if they restart their iPad, the lock clears and they can access it again. Wondering if anyone knows of any other ways for teachers to be able to lock their student’s iPads that doesn’t just clear if a student restarts it. After some testing, I found that if I put it in Lost Mode, that works, but the problem with that is the teachers would need to tell me to do it. I also considered putting a passcode on the device, but the teacher would need to unlock the device for these students each time they use it, and if a student gets locked out, I could see them trying to guess the password too many times and getting locked out for a long period of time. I am looking for tools other than Apple Classroom that teachers could have access to, or any other ideas for how to lock a student out of an iPad and keep them locked until the teacher clears the lock. 

To install Creative Cloud at my company, end users are directed to the Adobe Creative Cloud website (https://www.adobe.com/creativecloud/desktop-app.html). Every two weeks I get a report from our Security team listing device vulnerabilities. There's frequently a fair number of devices that need one or more Creative Cloud apps updated. I started emailing users individually, reminding them to update their Creative Cloud apps. Wondering if there's a better way, because emailing users and following up when they don't respond is too manual and too time-consuming. Curious how other admins approach this.

Hi, I want to deploy an initial default Dock layout after enrollment is completed, where the end user can later change it to whatever suits them.I’ve heard of multiple methods, such as using Dock items in Jamf Pro settings, scripts, Outset with docklib, and dockutil. I was wondering what the easiest and most hassle-free approach would be as an MDM administrator. Thanks in advance.

We are so excited to have our first in-person meetup for the KC Mac Admin's group for 2026! The event will take place at the WeWork Lightwell Location just off of 11th and Main. We have a very exciting agenda for our meet up. Food and Drinks will be Provided! (Please reach out to me, chris.zimmerman@jamf.com, if you have any food allergies we should be aware of!) The Agenda for our evening is as follows: Introductions / Food and Drinks“Let’s Talk about Apple @ Work” - Todd Thurman, Children’s Mercy

Connect 3.4.0Self Service+ 2.12.0OS 26.1 Tahoe (Many other machines on 26.0.1)I can not get this prompt to close no matter what I do. Everything in the back end seems fine with my machine and my connection to Jamf, self service, connect, everything, it all seems fine. Anyone have any ideas?  I did not see this issue prior to updating OS from 26.0.1 to 26.1 and that is the only thing I can think of that may be triggering it. I have tried deleting associated keys and allowing them to regen, I have tried flushing and re-pulling Config Profiles and Policies. P&S settings are all good. I have fond that if I leave the window there for 30min or more, it will finally close after entering PW and selecting Always Allow, but then comes back up after Reboot. 

We have an iPad that switched on after 2 months now it has an expired certificate I cannot renew. (See the attached images)This iPad is connected to the wifi but it doesn't communicate with the JAMF server all the commands are in pending status.When I check the "  JSS Built-in Certificate Authority " in the server it's expires in 2033Can anyone help regarding this issue what should I do?      When I open the iPad from the JAMF server This is what I can see on the device When I got to the PKI certificate and checked the certificate expired in 2033 Most importantly self-service is not working       

Hi, I am running a  vendor bash script from self service as part of a remediation effort. As part of the script there is a device shutdown. This happens before the device feeds back policy logs so if it fails I cant see why. Would anyone know if sh scripts and their results get logged automatically somewhere or if there is a simple command to get them to do so? Alternatively presumably I could remove the reboot from the script and have the JAMF policy do that?

How to do we stop these notifications from popping up? Staff are receiving these throughout the day and it’s very annoying and disruptive. MB Air M2 and OS is 15.5.0 or later. Is there a config profile or settings to adjust in Jamf?

We've recently been trying to get users to update passwords more regularly and with that of course, is keychain issues. I was trying to create a script to remove local wifi connections and server connections so when they accessed them, they could just recreate it by typing in their password. I've been struggling with this for a couple of days and had success locally, but not when deployed, and now I've broken it completely again.#!/bin/bashsecurity delete-internet-password -l "cwinprint" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "pwinfile" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "cwinfile" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "fwinfile" ~/Library/Keychains/login.keychainsecurity delete-generic-password -l "IS-EMP" -s com.apple.network.eap.user.item.wlan.ssid.IS-EMPsecurity delete-generic-password -l "CO-EMP" -s com.apple.network.eap.user.item.wlan.ssid.CO-EMPLooking to use this as a script to

Hello,Google is our IdP for logging in to Jamf Connect Login. I am using Self Service+ which states that the local password is “In Sync”. If I change a users password in Entra (which then will sync to Google Workspace), the “in Sync” does not go away or update ever. If I were to reset the password locally though Self Service+ using the menu bar drop down (opens Entra password change portal) it then states that the password is out of sync and that I need to login again to Self Service+. Great! I login, it accepts the new password, and states that the password is “in Sync”. I am never prompted for the old password.If I log out of the user and log back in with the new password, I am successful at the Google SSO pane, but it then has a smaller Jamf Connect pane that asks for valid credentials, which is the previously set password. The local password will not update despite “being in sync”.I have to be doing something fundamentally wrong, any help would be really appreciated. 

By using Jamf Pro to revoke the administrator privileges of users, we are now facing a problem. Applications like Cusros have a very high update frequency. However, we don't want to simply and brutally grant the users the administrator privileges and let them complete the automatic update by clicking once in the Self Service. Do you have any suggestions on how to solve this?

Is it possible to deploy the OneDrive plist config file via jamf or does it have to be packaged in composer so it installs in the correct location?

Hi All, We are running JAMF Pro on the local server / on prem "Windows Server" (not the cloud version). I want to use the Patch management to update the Apps (Chrome, Firefox VLC Office apps etc..), macOS etc.. I'm new to this is there any way I can get some help to set up this? Article videos etc..

I am currently getting to know more about the new Blueprint feature in Jamf Pro. Currently I can see that a blueprint has been deployed to 60 devices, 19 devices are pending and 1 device currently has got an error. How can I check which devices have already received the Blueprints components and which devices still need them?Thanks in advance!

I am trying to create a cloud distribution point using Amazon S3. The JSS returns the error: Unable to create distribution for this bucket But when I check my buckets there is a bucket similar to jamf235a039ede4741fe831b0e31287c6c7d created. Anyone have any luck with this?Thanks!

Hi, Im currently working on setting up Self Service+ in time for the deadline of March 2026. We currently have over 400 machines with Self Service instaleld and looking to deploy this to new machine in batches first for testing. Ive currently been testing on my self and manually installed the application and Ive had some issues with the Keychain popping up, which I saw was an issue on past threads. What would be the best way to go around this in a production environment? 

How can I manage the new* AI Controlswithin Firefox with a Configuration Profile?Is there a way to configure it via a JSON?Thanks in advance!

I have successfully setup PlatformSSO for EntraID authentication and after running it for a while I have some oddities.If the token expires Safari will offer passkey as an option for logging into EntraID federated applications.  Our conditional access policies allow passkeys, MFA, Strong Auth (FIDO etc).  Once the login is complete the Mac will passthrough creds for any access in any browser.If the token has expired then in non-Safari (Edge, Chrome and Firefox) the user is only offerred password as the option to login unless they have a passkey in Authenticator or an external FIDO token registered in EntraID (Yubikey etc).If you go to User/Groups and press the Authenticate button in the user account then the token is refreshed without any user interaction.Trying to work out if I’ve missed something in the config profile or if there is another issue.Anyone else seen similar and worked out a way to resolve so passkey/biometrics is offered across all browsers rather than just Safari?

I asked this same question on the Clearpass forum, in case there are more people there that are doing similar things, but I'm hoping for someone with the conceptual understanding to just give me a nudge in the right direction regarding this setup. We have been using 802.1x with Machine certificates issued by AD, with ClearPass and Windows machines for a couple years now. I understand the process that the windows machine joins the domain, get's a certificate, and then our clearpass servers are domain joined and can authenticate the machine with Active Directory using some of our various AD servers. All of that works well, and makes sense to me. Now we're extending it to macbooks and adding Jamf, so that we can also set up certificates on the macbooks (they will not be domain joined) via SCEP/NDES integrated with our windows CA, with the goal of them also doing 802.1x with EAP-TLS. So far, we have the SCEP process working fine, and the macbooks obtain their certificates from our CA via S

Is this supposed to happen?  Our automatic upgrading of the Self Service+ app has changed back to /Applications/Self Service.app (was /Applications/Self Service+.app).  Also is prompting for keychain access since, well, the application name changed.  Anybody else?

Hello all.I am getting this error in my notifications when I login to Jamf Pro.  I cannot seem to determine what is wrong with this, and it appears that our Jamf Connect configuration is working properly. Thanks in advance.-Pat 

Trying to use Jamf’s App Installer feature in Jamf School.Issue:  Apps set to on-demand do not show in the Jamf Teacher App.Hoping my setup is incorrect as this post referencing a similar issue is more than two years old. I’d happily use Self Service+ but the guidance even calls out the fact that on-demand content will continue to be through Jamf Teacher.Using Self Service+ would solve the Keychain messages our users are getting since we sitting at stuck at jamf connect 2.45. Solving to issue at once would be great, but my reading of the documentation tells me apps download wouldn’t be available in Self Service+ Will any other Self Service+ features work if I don't have Jamf Pro? Self Service+ is considered a modular application meaning only items that are configured will display for end users. At this time for Jamf School customers that also use Jamf Protect will have the Security dashboard in addition to the Account management dashboard. Access to on-demand content will continue to b

Hi,    Our company WiFi uses user network creds to join, but the window that pops up for this has a certificate dropdown box (with several items available).  The users get confused and start trying these.   Is there a way to remove this box for at least this one SSID? Thanks in advance,    -Pat