We are looking for a way to Restrict Third-Party Preference Panes created by Backblaze. Any suggestions?I found a way to hide it but we want to restrict it so it cannot be accessed. We use restriction payload to restrict the inbuilt Preference Panes but not finding a way to do this. Thanks.

Hello Guys,As title ,We encounter this question very similar to this post https://community.jamf.com/t5/jamf-pro/xcode-running-as-a-non-admin/m-p/211456Cus we have to remove admin right form users, so we're using script to solve most issues on Xcode like license agree ,add users to _developers and something like that.But when we want to download iOS simulators ,it prompt out a window "Xcode is trying to install apple software"and ask for admin password.We've tried the solution mentioned in that post, but encounter a error when extracting the payload of the .pkg .Is there any method that we can solved this by script or other way?Thank you guys for reading and answering this post.*We're testing with Xcode12 on MacOS 10.15

Is there a way to get the user's data that is in Jamf Pro system from Terminal?I have a script that writes into the System.log and has the host name but they also want the user's name (which I have) and Dept. (which I need) and possible other fields

I have a macOS Big Sur upgrade script that has worked perfectly in my testing on dummy machines but when I have it pushed via policy, everything works, except for the part after they click upgrade. It's as if the script just halts and exits. However, when I run it through self-service as that same user on their machine, it works normally and begins the upgrade! Any ideas on why they are different? Apologies for the caveman scriptBelow is my script; after the user accepts the upgrade, is when it stops (line 77 or ## Upgrade Here ##):#!/bin/bash if ! [[ $(sw_vers | grep ProductVersion | awk -F ":" '{print $2}' | awk '{$1=$1};1' | awk -F "." '{print $1}') == 11 ]] then if [ -e "/Users/Shared/deferrals_MacOSUpgrade.txt" ] then deferralsleft=$(cat /Users/Shared/deferrals_MacOSUpgrade.txt) else echo 3 > /Users/Shared/deferrals_MacOSUpgrade.txt deferralsleft=$(cat /Users/Shared/deferrals_MacOSUpgrade.txt) fi if [[ $(sudo find /Users -name "In

I was wondering what people thought about the current state of Jamf - Intune Co-existence, having the device managed by Jamf but sending inventory info and compliance for CA to Intune?  Our grand plan is to have the M365 suite accessible off VPN by utilizing CA and compliance with Intune, has anyone else really explored all the features of this pairing and what are your thoughts?  Thanks!

Hi all, we are currently using Jamf Connect 2.5, deploying via DEP enrollment. Our config profiles are 2.4.4. I have 3 separate profiles for connect, 4 if you count the notifications payload. One for Login, one for Menu bar and one for the license.  I would like to upgrade to 2.8. What is the best practice for doing so? I see form the Connect 2.8 admin guide there is settings to upgrade in Settings > Jamf Connect >, but I'm a little grey on this, does it upgrade the Connect installed on the machine or just the config profile versions? 

We are looking to restrict the use of all USB external storage for our users. I made a Configuration Profile with a Restriction payload that has all types of hard disk media access unchecked. On the Macs that are in the scope, the policy only works for those with standard level access, admins can still use USB drives. Is there a way to have it apply to the machine as a whole, regardless of the user level?

Unable to find an adequate script to make all Standard users Administrators.  I am new to scripting and have only been able to find a script that does it temporarily and reverts the account back to standard.This is what I have found so far.https://github.com/jamf/MakeMeAnAdmin I also need it to run without user prompting

We use JAMF Pro, and are having increased demand for parent control at home. We already run a transparent global HTTP proxy for students, but lots of parents want to control YouTube access or have other granular control with apps. I tried to enable JAMF Parent, but when scanning the QR Code within Self Service from a parent device, I get "An Error has occurred. Please contact your school IT admin". It's certainly possible this is a simple fix, we haven't used the apps in the past. We meet all the requirements set out in the guide (e.g. Account admin, valid 3rd party SSL certificate, unblocked jamfcloud traffic). Is there a setting I'm missing to enable this access?Thank you!

I'm suddenly seeing the above error on a number (most) of our lab-based iMacs running macOS Big Sur v11.6+ which are bound to AD.I noticed on the affected systems that our root certificate is no longer trusted in the System Keychain even though it has an expiry date in 2037. However setting this to be trusted again doesn't improve things. We are also seeing similar messages when attempting to launch other applications such as Chrome etc. and Adobe Creative Cloud applications no longer launch, claiming they are unable to contact the Adobe licencing servers. Users don't seem to be able to write to the Desktop either. I've tried removing the computer objects in AD and rebinding, and also removing previously created user directories in /Users and rebooting. We are about to begin a trial of Jamf Connect and come away from binding but for now the issue is disrupting our teaching, so any advice around how I might overcome these errors would be greatly appreciated!

Hey Everyone,I have probably missed it right under my nose but is there any documentation on how to call jamf helper in a script?

Hey Everybody,Quick question for you API experts, and apologies in advance.  I'm new to this.  I'd like to update a specific attribute.  I've included some sample XML that's close to what would be grabbed from a specific iPad.I'd like change "Mrs. Jane Doe" to "Mr. Jon Doe" in "SD-Full Name" of extension attributes.<?xml version="1.0" encoding="UTF-8"?> <mobile_device> <general> <id>2035</id> <display_name>School Staff iPad Mr. Jon Doe</display_name> <device_name>School Staff iPad Mr. Jon Doe</device_name> <serial_number>B28JDKL1J0CDM</serial_number> ... etc. </general> <extension_attributes> <extension_attribute> <id>2</id> <name>SD-Full Name</name> <type>String</type> <multi_value>false</multi_value> <value>Mrs. Jan

I know this is probably a long-shot... but has anyone figured out how to block Monterey from appearing in Big Sur's Software Update pane after 90 days? All of our Big Sur machines seem to have lit up this morning with the "Install Monterey" feature. We still have it restricted, but I'd hate to have someone get all excited and download it just to have it deleted...

Greetings! I recently enrolled in the Apple Developer program so I could obtain an Installer Certificate for JAMF Composer.  I was finding that more often than not, whenever I pushed a third-party app out via Self Service, it would look like it had installed, but wouldn't.  Upon checking the install.log file, it showed that the package was not signed and therefore was not installed. Obtaining the Installer Certificate has helped, but I've noticed a new issue when trying to install an app on an Intel-based MacBook Air.  The app installs fine, but when I try to open it I get the "You do not have permission to open the application..." error.  I thought installing through Self Service would prevent this since the apps are supposed to be installed as root, or SU? Anyway, I've tried this on an M1 machine with no problems.  It appears to be limited to the Intel-based laptops, regardless of what macOS version is installed.  Anyone have any ideas?&nb

Our school has 450+ MacBooks and 150+ iPads. At the moment I have one iPad that will not install the profile. The CA certificate is being installed before the profile with no errors. I'm not sure what could be stopping this one iPad from enrolling. I've followed the steps in the article below with no luck. Also, the iPad is set to the right time. https://www.jamf.com/jamf-nation/articles/192/mobile-device-enrollment-error-invalid-profile-or-invalid-certificate

Hi all, Which application format is better DMG or PKG ? Can anyone provide more details I understand to add scripts in application - PKG is best and for indexing DMG PKG installs for all users in home directory  

I'm looking for a simple way to allow members of my org's Field Support group to enable software in Self Service for any of our managed Macs without actually giving them access to our JSS. I use a Static Group as a target for each installation Policy that isn't scoped to all computers, so what I'm envisioning is a shell script that will run an AppleScript to display a popup listing the available titles, and then prompt for the serial number of the computer to be added to the appropriate Static Group using the Classic API (that's the easy part). I thought I'd seen something along these lines posted on Jamf Nation before (looking at you @dan-snelson), but darn if I can find it now. Before I re-invent the wheel I figured I'd see if it rang a bell with anyone else. Please post a reference if it does Thanks!

I've been asked to report on users who have iCloud Drive enabled. I found an older EA on the board but that doesn't seem to work on El Cap even if I amend the file path. This is what i'm using. !/bin/sh if folder exists, then iCloud Drive is enabled iCloudDriveFolder="~/Library/Mobile Documents/com~apple~CloudDocs" if [ -e "${iCloudDriveFolder}" ]; then echo "<result>Enabled</result>"else echo "<result>Disabled</result>"fi Seems to be that the ~/Library/Mobile Documents/com~apple~CloudDocs isn't recognised using the above. I can cd to the folder and terminal sees it as a directory. Now am i missing something or is it something else? Thanks Al

Hey Everybody,I'm having some trouble with my scripting.  I'm attempting to view an iPad's extension attributes, and then update them if needed, but my cURL request always come back with the same error: "The request requires user authentication" -- which I'm using.  Works for everything else, but not for extension attributes.  Maybe my code is wrong?  Here's what I have:curl -X GET -H "accept: application/xml" -H "authorization: Basic ${jssAuth}" "${jssURL}/JSSResource/mobiledeviceextensionattributes/id/$deviceID"  Thanks,-Rob

Hey all,I've been seeing an issue where my Zoom for IT client opens the sso page in Safari when zoom is first opened on a new users device.  My plist for zoom settings seems to be set correctly to use the embedded browser in the client but it continues to open a browser window when trying to login to SSO in zoom.  This only started a few months ago from what I can tell, or perhaps it is only since we started updating to 11.4.   I've since tried edited all the setting in the plist, however it still keeps opening a web browser when the user attempts to  first login to SSO.Anyone else seeing this or have a work around?

In JAMF school how can I configure the control center for my managed iPads?

We have a lab full of Macs, and I'm going to start managing them with Jamf. I put them in a prestage which works fine. But I'd like to skip the create computer account screen all together. I am already setting up a local admin account, so I don't need to create another account on each machine. Is there a way to do this?

What is the best way to make a .dmg of Office 2011 with only certain apps installed (Word, powerpoint, excel etc) and not all that other garbage that comes with it, basically I can pick/choose what applications will be installed, then create the .dmg I am saying .dmg because I also want to have it be uninstalled via policy, so my understanding is to create a .dmg and index it ?? what about FTU/FEU ?

Hey Everyone,Not sure what version this happened on, but we thought to do a test on new enrollments and since 2.4.5 on the part where a user logs into azure and then asks to enter their network password. We get an "Invalid Request". We we're on 2.2.2 before this. Some have suggested to change this to true."Create a Separate Local PasswordIf set to true, this key prompts users to create a new password for their new local account. If set to false, this key prompts users to re-enter their network password, which also becomes the local account password. This ensures a user's network and local password are synced during user creation." We don't want to do this as it creates confusion when it's time to reset the password back to Azure. Unless something changed, Jamf connect cannot write back directly to Azure. We've been needing to go through the SPR.

The prefix is showing up on the device, but it's not pulling down the serial. I've even tried a few commands I've seen on these forums, and it still won't grab the serial. I am learning scripting, and only know basic commands. I took over for the previous sys admin who left, and he could never get the script to work either. MODEL=$(sysctl hw.model)if [[ $MODEL == *"Book"* ]]thenPREFIX="TRML-"elsePREFIX="TRM-"fiSERIAL=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformSerialNumber/{print $7}')COMPUTERNAME="${PREFIX}${SERIAL}"/usr/sbin/scutil --set ComputerName $COMPUTERNAME/usr/sbin/scutil --set LocalHostName $COMPUTERNAME/usr/sbin/scutil --set HostName $COMPUTERNAME