I have inherited a Jamf instance that was set up and managed by someone who was just learning on the fly. This means there are a ton of configuration profiles, policies and such that are messy and in some cases unnecessary. I have been going through and cleaning up here and there but I am wondering if anyone has had an experience like this?Is it possible to create a new instance that I can build out the way it should be and then migrate the computers and devices from the old instance? One of the things I am looking to accomplish is the removal of some sites that shouldn't be there. But then if I remove the sites, it could break profiles and policies that are assigned to them, no? Any thoughts or ideas here would be appreciated. Thanks in advance! 

Hello all, I'm trying to write a script that allows an end user to set the name of their computer based on a specific naming convention. Unfortunately, my scripting knowledge is lacking and I'm having trouble getting the results I'm looking for. Here's what I've got so far. Any help would be greatly appreciated. I'm sure it's a bit of a hodge-podge so please forgive my hodge-podginess. #!/bin/sh #The user will choose their department from a drop down menu choose from list {"ACAD", "ALUM", "ANES", "BIOC"} with title "Departments" with prompt "Please choose your department" #The user will choose their building from a drop down menu choose from list {"APM", "BRI", "CAIR", "CFAC", "CCC", "CHCB", "CHW", "CRI"} with title "Buildings" with prompt "Please choose your building" #The user wil

We're looking for a Jamf Expert to take lead on clients' cloud-hosted Jamf Pro environments. Clients range from schools and non-profits to SMB and Enterprise companies. Work with the best Jamf Engineers on the planet and learn the ropes to managing enterprise clients at this fast growing Apple-based MSP!ResponsibilitiesProjectsLead update meetings with client stakeholders about the progress of time sensitive projectsLead whiteboard sessions about the technical aspects of a specific projectCollaborate with our team to build an incredible Jamf Pro server that brings clients to a Rocketman Approved stateImplement change management proceduresMaintenanceProvide Tier 3 support for Jamf ProCollaborate with the client’s Help Desk to automate solutions and create quick fixes in Self Service for common user issuesMeet regularly with stakeholders to ensure all their needs are metProactively maintain client’s servers based on macOS and Jamf updatesBuild custom scripts and solutions to aid in

Hi,I was wondering if anyone else out there has run into this issue. We are trying to automate the management of "classes" in jamf pro. We can create a class via the API, but we cannot add a user group to the teacher group or student group of a class (or even a user account to the class) via the API. The API seems to be incomplete and only supports adding shared iPad devices to a class (according to the documentation).It is strange, as the functionality is there in the GUI.if anyone else has had any success with this i'd love to know. Thanks! Elliot 

I apologize if this was answered already elsewhere, but most of the answers I saw looked MacOS related, not iOS. I somehow missed the expiration for our apple push certificate, so by the time I renewed it the old one was no longer valid. When I renewed it, I saw a message that because the old one had expired, I wouldn't be able to use that to push commands to our currently enrolled devices. So, I assume I'll need to touch each device to solve my blunder. What exactly do I need to do? These were all enrolled via DEP initially. If not for the need to update the DAC app for AP testing, I would just wait for the summer and factory reset all of them. If I could at least do 20 of them that would get me through AP testing next week. Thanks

Just setting up zero-touch deployment for our company that went full remote. I know that profile configs are unique to each org's requirements, but I wanted to get a feel for what people had implemented, and if there were any suggested profile configs to look into. For example, blocking user's system preferences access, or security profiles? 

I've been taking a look at about a dozen restart scripts that have been shared with the community over the last several years.  Unfortunately it's looking like forcing a restart on a MacBook with an M1 processor is no longer a viable option?  Is there a new way to do this through JAMF with a simply policy, or with a script compatible with the new macs?What we find is students rarely restart their devices, and sometimes we need them to (to force quit certain apps for instance so policy changes can be made).  We aren't talking about post software updates, just a way to scope a policy to prompt the user to restart their device, and offer some sort of short deferral, but ultimately enforce the restart with an automatic shutdown, if the last deferral expires.I've tried the one from @m_donovan at https://community.jamf.com/t5/jamf-pro/jamf-helper-reboot-script-with-deferral/td-p/188511#responseChild164611%3Cbr%3E but that does not seem to work anymore.  If anyon

I'm trying to write a script to unzip a zip file from tmp to a user Library, the exact path is:unzip /tmp/MicrosoftChartTemplates.zip -d /Users/USERNAME/Library/Group Containers/UBF8T346G9.Office/User Content/Chart TemplatesThe issue seems to be spaces, like for "Group Containers". From what I understand you need quotes, but that doesn't seem to work either. Once the file is in that folder I need to unzip it to that location. Any help would be much appreciated. Also, a DMG is not an option since we will be updating these files regularly and would like to only update the zip file and the not the entire package. This wasn't my decision, just what I have to work with.Thanks to all who take the time to reply.

I need to explain to some colleagues the technical details of what exactly happens on a Supervised iOS device when an app that has been blocked by a Restrictions profile is installed. I know that restricted apps already installed on a device when the Restriction profile is installed are "hidden" from the user, rather than uninstalled from the device, and the user can still search for and install blocked apps on the App Store but they are immediately hidden.My question is: how does iOS accomplish this? I think it is revoking all permissions to blocked apps from the User profile on the iOS device, and I swear I read those words somewhere at one point, but today I could not find anything online to support or refute my assumption. All the Apple and Jamf docs that I read simply refer to the allow/block list in general terms, and nothing about what happens under the hood--e.g., "Any apps other than Settings or Phone (on iPhone) can be placed on either an approved list or a disapproved one."

Hello All I am deploying Falcon from Crowdstrike and we have all the config profiles scoped out correctly for M1 machines and Intel machines. PPPC, sys ext, content filter and kernel extension all installing succesfully.However when i go to install the sensor ive had about 80 fails out of 100 say "error to reload sensor", i check the CS dashboard and thos same machines are showing up there, so it seems the app is installing and licensing but exiting with an error of 1. This is making tracking harder for us to go back and see which machines failed to remediate since so many "failed" machines actually seem to be ok. Anyone else run into this? I have a ticket with CS but they have not responded The other 20 show succesful and licensed in Jamf and are good to go in CS as well, no major differences in machines from fails and success. Many of the same OS versions and architecture across both categories

Hi All of our users in JSS come from our LDAP (Active Directory). In the LDAP, students are organised into OUs based on year groups, e.g. Year4 etc. Is there a way I can make a smart user group based on the year that a student is in? This way, when they log in as part of the iPad setup (DEP), I can then scope apps etc to students automatically. Any help would be appreciated! I suspect it might be something to do with extension attributes but I am a bit stuck. Tim

Hi all, We have enabled EFI for our mac users. Randomly some machines are locked and require EFI pwd. Issue happens often after a reboot.Anyone faced the issue ? Any tricks here?Regards,Mohamed

Trying to update google chrome via script is anyone implementing this already?

We use one of the custom active directory attributes to designate if someone is a Student, Faculty or Staff. I created a smart group to look at that attribute, so I could have two lists, one list of all the student iPads, and one of all Faculty/Staff iPads. The two smart groups are working, but only with newly activated devices. For example, the faculty/staff smart group has 3 members in it, but all three were iPads that got set up in the past 3 days or so. The group SHOULD have something like 400 iPads in it though. Any idea why the group is only grabbing new iPads, and not all, with the attribute that I designated? 

I know this is a common topic but I feel like I am a weird issue that may help someone in the future that I was wondering someone can help. I created a Configuration Profile to have an Application to start up every time the computer starts up.I did the following Configuration Profile -> Login Items -> Items -> Path to Application Now the app that I want to open is called Optisigns Digital Signage (Has total of 3 spaces).Problem I am having is: if I tried /Applications/Opsigins\\ Digital\\ Signage.app, or "Applications/Optisigns Digital Signage.app", the login item menu in User and group does not recognize the app name.   Now I can manually do the adding from the computer itself but I would like to figure this out via JAMF so I can save my time lol. Anyone have any ideas.  

The picture above shows how the recon, policy and manage commands are failing. What do we do if these commands are not taking affect immediately ? Can anyone please help ?

So I've enrolled a few iPads into JAMF Pro manually and everything goes okay......until I try to launch Self Service. It tells me that "this app must be associated with a Jamf Pro Server".  Kind confused, as I thought it would know that by default? As in, that's where I enrolled it from, right?  Bangin' my head against a wall here. :)

Hi!   Our University is using Jamf Pro 10.37.2 On Prem.We have a few different DEP Prestages.  I needed to move 24 computers from one Prestage to another.  I filtered the computers by name, for example 'LO214', which gave me 24 results.  With my results filtered I then chose 'deselect all', and the 24 computers that were listed were deselected, which was the correct behavior.  However, when I chose Save, all 785 of my remaining computers were also unassigned from that DEP prestage!  This must be a bug...  I can replicate it.

I am looking after MDM solution for my employer.We have decided (for most things) to keep the setup as 'uniform' as possible for all users.For some things, such as app functionality and the App Store 'blacklist' we have recently decided to introduce some subtle distinctions between normal users and managment. Right now, it's the difference of one chat app.I duplicated the existing profile and changed its scope to exclusively 'Managment' devices. This is a static group, btw. My test device was in this group the entire time (before any changes to app policy were even hinted at) and got the new profile immediately. I could also verify this from lock screen text. Installing the otherwise 'blocked' app was not a problem.I added a colleages iPhone to the management group but it seems that he is not receiving the new profile. There is no text on the lock screen to indicate which device management group he belongs to either. More worryingly it seems he can install just about any app (from the

Hi Everyone, Fresh installation of 10.16.0 on a new Server 2019 virtual machine and i'm getting a fatal error with a notice saying that : "To upgrade from versions earlier than Jamf Pro 9.98, you must first upgrade to Jamf Pro 10.0.0, and then upgrade to the current version" This isn't an upgrade though - it's a fresh installation Server 2019 , Java 11 x64 , MySQL 8.0 I have followed the installation documentation to the letter several times. Does anybody have any suggestions? I have already tried going through the JAMF support article on the issue. Strange how it's thinking i'm doing an upgrade when Jamf has never been installed on this server ever? Ideas?

I'm running into an issue when i'm pushing out Slack to users.  I create the package using Composer and then do the usual process of uploading it into JAMF.  In the screenshots below you’ll see how i’m doing that process.  And in the final screenshot is the error showing up in the logs that is preventing the successful install.  Any help with this would be greatly appreciated!

Hi, As of Monday, any device that runs our Self Service policy to bind to Active Directory immediately loses access to Self Service with the message that the MDM Server is not available. We can manually bind to AD in System Preferences which works fine, but using the built in Directory Binding has suddenly stopped Self Service working. Has anyone else experienced this?Thanks,

Has anyone been able to successfully accomplish this? I have tried several scripts ive found on these discussions as well as AutoBrew. The end result is the same, and its always a lack of permissions.Error: /usr/local is not writable. You should change theownership and permissions of /usr/local back to youruser account: sudo chown -R $(whoami) /usr/local So, is it possible to install this for a Standard user and allow them to update and install via brew, or does this require Admin?

Hello there, we've been using ZuluDesk and now jamfSchool for quite some time now. Over time the number ov iPads grew to 34 and the number of installed Apps is over 50 now. Everytime I need to update those devices our Internet connection is blocked for a long time due to every iPad downloading everything directly from Apple. I heard of the possibility to use a Mac Mini as "Caching Server" but I found no documentation as how to implement it with jamfSchool. Do I need to set up something in jamfSchool or just plug the Mini in, activate Caching in the Mini and plug it to the same subnet as the iPads run in?

Just wondering from those that have gone zero touch on MacOS devices, are all of your users then local admins? Just in the work flows I have tested, the person setting up the device is a local admin. Yes I realize that could likely be scripted post setup to change memberships, but was wondering what others were doing. Not to say its that much of an issue at my organization, we do not have the need to drop ship new devices, and set up is down to just a couple hands on steps.