Long subject i know lol.I am trying to make a script that will take the user logging into the computer for the first time and name the computer appropriately based on that users info.I.E.  If the user is a high school student, it would assign HS-StudentAssetTag#, if a Middle School teacher, MS-TeacherAssetTag#, or if a Principal or other Administrator of one of the grade schools GS-AdminAssetTag#I think I have the commands already to pull the building name (which @mm2270 helped me figure a way to assign that based on the students "Grade" populated in our "Position" field) but I'm needing it to be a bit more robust since that would only work for middle and high, if its a Grade school it could be 1 of 4 different buildings.  All the info is in our AD and pulled from PowerSchool (and we also use One Sync/Class Link Roster Server), I just need to find a good way to pull that info with a script that grabs the building(which could be based on security groups or OU), the t

Hi all,Our Prestage Enrollment process involves deploying 6 profiles, adding 1 admin account, and installing 4 packages: branding, DEPNotify, Jamf Connect Login, and Jamf Connect Sync. As of 2021-07-09, none of the packages appear to install as part of Prestage Enrollment. Looking at /private/var/log/jamf.log, it appears policies triggered by "enrollmentComplete" do kick off, but policies triggered by "start-depnotify" (which is a command in the DEPNotify post-install script) do not. I have created a brand new Prestage Enrollment using the same packages, and it also does not work. I have removed all packages except DEPNotify, and that also does not work. Technically, the other packages do install, but only because they are also triggered by "enrollmentComplete." DEPNotify is not, as that's not the recommendation per the setup guide.In searching, it seems the most common issue was unsigned packages, but again these were working fine until 2021-07-09, so that isn't it.I did consider recr

Hello everyone,I'm having some issues with the "Restricted Software" on JAMF Pro where  I can restrict 1 word app fine with the "Restrict exact process name", but not with 2 or more words.working example:Process Name: MessagesChecked with "Restrict exact process name"and all messages (even if you copy paste app and rename, still gets blocked.)but something with 2 words doesn't.not working example:Process Name: FileZilla ProChecked with "Restrict exact process name"if I put "FileZilla Pro.app" in process name, it gets blocked but with that exact file name from applications.any ideas how to block process name that is more than 2 words?Thanks in advanced.

In my organization, we use Citrix SSO for VPN. It's available in the Apple App store for free. When users go to install it, instead of installing, Jamf Self Service opens the APPLE App Store and demands and AppleID to proceed. This isn't how it used to work, and isn't how it is supposed to work. How do I find out what went wrong? this App used to just install. but as soon as I started working here, I get told that it doesn't work anymore.

First a warm "hello" to the community ;)I hope, someone can help me, to find a solution for my question:On Windows® environment, it is possible to set up, that only signed Office macros (for example Word®,Excel®) are allowed to run. Unsigned macros can be denied for running by setting up a Group Policy.We also use Microsoft Office® 4 Mac and now, I am looking for a way, to prevent our users from running unsigned Office macros.I did a search here and found a couple of contributions about Office macros (for example, how to disable all office macros) , but no one, wich handled exact this case.Is there a possibility, to set up, that only signed Office macros are allowed, and if, how could I set this up?I would be glad, if someone could help me here.Thank you very much for reading my question and thanks a lot more for answering :)Greetings, NOVELLUS

Hi all,I've been handed a LONG list of Usernames, and I need to make a list of any computer serial numbers associated with those Usernames.I'm assuming this is a custom API call, does anybody have anything cooked up and ready to go?Thanks!

We have an employee that left our org, and the user was issued the laptop permanently for their personal use. Best way to accomplish them not being managed anymore would be to give them instructions for "jamf removeframework" and then delete the device from our JSS I am thinking. Any other recommendations or something I'm missing? The user is across the country now so I'll have to give them detail on how to do this themselves. Any pkgs around that would automate this so I don't have to have them using Terminal? Thanks, Tom

I am trying to get a configuration profile built to manage com.cisco.webexmeetings.config.plist so we can define our Organization ID. If I manually create the plist everything works fine, but when I try to use a custom settings configuration profile it is not taking. I am figuring I am just missing something dumb. the JSON works fine.  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OrganizationID</key> <string>super secret information</string> </dict> </plist>   Shoved this in to a configuration profile and its not working.Anyone have any ideas? 

Hey everyone! I have a bit of a non standard request...Basically I would like to limit my own personal mac computer and I am seeking have admin privileges whilst preventing my self from changing user settings (adding/editing/deleting accounts) or altering network settings. Ie I would like an admin account with the network preferences and user pane disabled in system preferences - or some variant of this where I can access these settings but can't modify them etc. Currently I'm getting around this by using blocking software to block all of system preferences and modifying the settings as needed using passwords given to family members but I'm sure you can see that this is super frustrating at times! Is this possible with any Jamf products? I found it a bit overwhelming scrolling through all of the offerings and as such I'm asking here. I'm more than happy to pay for the product I'd just like to know which one if any would best suit my needs. Please let me know any other po

Hi,in our environment all of the devices stopped checking in into Jamf. What did we do since the last check-in?There were three issues, which we think we have fixed: Resolved The .. @... service token expired 23 days ago.Resolved The ASM token of '...@...' expired 23 days agoResolved The APNs certificate of 'appleCert@...' expired 23 days ago. How do we get the devices back into Jamf without reinstalling/resetting the devices? Any hints?

I just turned on Patch management for these apps yesterday. I google searched this error but didn't get far. Anyone know what this is about? 

I couldn't find any extension attribute in the templates or in any forum for showing the local timezone of a computer in jamf, so I wrote my own. It's just a simple script to pull the info from the localtime file, and cut off the first part that is always the same, then return the result to the jss. example: TimeZone:/America/New_York Script:#!/bin/bash # Extension attribute to return current TZ localtime=`/bin/ls -n /etc/localtime` TimeZone=${localtime:79} echo "<result>$TimeZone</result>" exit 0 Here's the full .XML file for importing to jamf directly:<?xml version="1.0" encoding="UTF-8"?><extensionAttribute> <displayName>TimeZone</displayName> <description>gets time zone</description> <dataType>string</dataType> <scriptContentsMac>#!/bin/bash
 
 # Extension attribute to return current TZ
 
 localtime=`/bin/ls -n /etc/localtime`
 
 TimeZone=${loca

Hello, I've been asked to change our JSS URL without migrating our server. Is this possible? Current: jss.crop.domain.com Outcome needed jss.domain.com What I was thinking: Add a DNS entry = jss.domain.com Create a policy changing the URL on the clients: defaults write /Library/Preferences/com.jamfsoftware.jamf.plist jss_url https://new.jss.url:8443 3.Change the URL in the JSS settings and change Tomcat certificate. If anyone has done this before, would this work? In my mind, it seems like it would. Thank you.

I have a question regarding the "Enrollment Only" Privilege Set in Jamf Pro User Accounts & Groups, and I'll try as be as clear as possible. Can anyone clarify if all users who are invited to enroll in Jamf (i.e. by email invitation or via the enrollment web console) need to first be added in Jamf with Enrollment Only privileges?I know this isn't needed for Macs setup via Prestage enrollment, but in order for us to be able to assign a (LDAP) user to a device during User Initiated Enrollment, we first have to add them to the user group in Jamf Pro with the Enrollment Only privilege set. Otherwise we don't get the 'Assign to User' option when they go through the User Initiated Enrollment Process.I know we can edit the user information post-enrollment (via the Jamf Pro interface), so I'm not sure if it is necessary to even use this 'Assign to User' step? Can anyone explain why either way is better? Thanks!

Hi all,I'm really just posting this to document the long journey that I've had to creating a new enrollment workflow for our district.GoalTo have one universal enrollment for new Mac's that auto name themselves based on the user logging in, with the least amount of signing in as possible.Requirements1.  A Jamf Infrastructure Manager (JIM)2.  Microsoft Azure/Active Directory3.  Jamf Connect (Installed in Prestage Enrollment as well as config profiles)4.  PPPC Utility and TCC profiles covering Jamf (and jamfDaemon), osascript, including all system events and accessibility also installed with prestage enrollment5.  Configuration Profile for Microsoft SSO extension that includes apples setup assistant also installed with prestage enrollment6.  Microsoft Company Portal App (in Prestage Enrollment)7.  Managed Apple ID's that are federated to Microsoft loginsStepsPrestage Enrollment:After much testing our prestage enrollment includes all the installers for a

Hi guys, I have certain polices that need to be added after the prestage enrollment on certain machines.We have couple of MacMini used for marketing purposes and we have about 3 policies that are only meant for these machines. What is the best way to attach these policies so that once they are scoped in prestage, it also gets scoped on the policies. My though was using a smart group and having it linked via serial numbers but not sure if that's the best or efficient method. 

Hi, I want to remove the current login user as admin and I tried this command and it seems not to working. #!/bin/bash/usr/sbin/dseditgroup -o edit -d "$currentUser" -t user admin is anyone can help me with this?Thank you

Hi all, I've noticed an issue recurring in a number of our managed Jamf Pro instances and just wanted to see if anyone has had similar experiences.A Jamf Pro tenant will have 32bit apps configured and scoped to a number of iOS devices. These apps are EOL as they can only be installed on iPads running 32bit architecture which as a company we do not manage unless absolutely necessary.I've found with a lot of these apps, once the app is removed from the app store, that app simply disappears from Jamf Pro and is unable to be managed. I haven't been able to 100% prove if these apps have been manually removed by another administrator or the apps are removed from Jamf as soon as the app is removed from the App Store. Although the app is no longer in Jamf Pro, the app will stay installed on all devices it was scoped to. Due to the fact I can no longer remove devices/buildings/departments etc from the scope of the app, these legacy apps will then appear in the "Other" list as "Managed

Hi all-Been awhile since I've been round these parts. Trying to work out a scenario for a customer and I'm having a heck of a time getting a VM properly enrolled into Jamf Pro. I thought I was doing all the magic things needed, but perhaps missed something. Host platform: Intel (16" MacBook Pro i9)Hypervisor: VMware Fusion Pro 12.2.3Network: BridgedGuest OS: macOS Monterey 12.3.1in the VM's vmx file I have:hw.model = MacBookPro16,1smbios.use12CharSerialNumber = "TRUE"serialNumber = C02CF0CVMD9R (very close to my actual serial number. The 9 at the end is a different digit on the actual hardware)I thought those in the vmx file would allow MDM to function properly but when I do a user-initiated enrollment I get the CA profile, the MDM profile and that's it. In the computer's inventory I get "MDM Capability:No"I feel like I must be missing something dumb as a result of being out of this game for awhile. Thanks!

I can't seem to find documentation, or I'm just not using the right search criteria. I just added a few extension attributes for our devices and was hoping to be able to pull a report of all the results. Is it possible to export a list of each device and the results of their extension attributes?

So it was decided at our school to do Drive for desktop as everyone's backup solution. However once everyone installed it, our Wifi performance crashed because Drive was taking up all of our bandwidth. After speaking with our Google agent, they suggested running the following commands in terminal in order to throttle the amount of bandwidth Drive for Desktop uses.defaults write com.google.drivefs.settings BandwidthRxKBPS 100 defaults write com.google.drivefs.settings BandwidthTxKBPS 100. I have confirmed that the commands work when entered in terminal, but I can't get the policy to execute properly on the scoped machine. here is my script: #!/bin/bashdefaults write com.google.drivefs.settings BandwidthRxKBPS 100defaults write com.google.drivefs.settings BandwidthTxKBPS 100exit 0 it runs on the machine, but nothing changes or happens with the preference file, and jamf shows no details about why the script didn't execute when I look at the policy logs. I should m

I'm attempting to install Covalence from Field effect that is a cyber threat monitoring. I'm trying to install the agent and push the licence from Jamf. I'm following the article they gave us (See "Deploying the Endpoint Agent via Jamf" below). So I push the three configuration profile like they suggest, copy the information from the licence XML file in the Configuration profile like they suggest.When my test MacBook have receive the configuration profile and can confirm they are there, I push the agent. The installation is completed, but the agent won't take the licence.I've already created a ticket with Jamf and Field Effect, but I take a chance with the Jamf Nation community Deploying the Endpoint Agent via JamfWhen deploying the Covalence package file (.pkg), the license needs to be distributed prior to installing the Covalence agent using a device configuration profile.  Additionally, you’ll need two other MDM configuration profiles: one for explicitly allowing

Hi,I have a script that prompt users to register their Macs to Intune. I would like to run the policy every 60 minutes. What's the best way to get this done ?Thanks!

I modified an existing script (credit to Richard Purves) that runs successfully to change the computer name to the barcode using the Pro API on Monterey machines.  My same script does not seem to work on Big Sur machines.  I use the API to pull the barcode and then use that barcode to rename the computer.  I initially thought it was because I was using the #!/bin/zsh shell, but I have switched it back to #!/bin/bash.  Same error.The error I get from the logs is as follows:"Script result: execution error: Error: SyntaxError: JSON Parse error: Unterminated string (-2700)"Clearly has something to do with the JSON Parse, but this is my first Pro API script so I have very little experience here.Copy of my script:#!/bin/bash# POC script for Jamf Pro API# Variables first# API user accounts here. One for reading, one for writing back. Security.# Generate API base64 credentials by using:apib64="xxxxxxxxxxxxxxxxxxxxxxx"PREFIX="UH"SUFFIX="UOC"# Current JSS addressjss

I am trying to get "one-button reinstall" working on a student laptop, and I am following this guide here: https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/ However, at one point it says: "When it finishes, upload the InstallAssistant pacakge directly to Jamf Pro and deploy to your Macs using a policy. It’s OK to rename the package file before uploading.",  but I have no idea where in Jamf to do that.I tried using the Packages widget within settings but even when I add a name and upload the package there, click save, it doesn't show up in the list.Any advice on this?