Hey, since last week we can not remove the Restriction Software settings from Mac Clients. We run Jamf Pro Version 11.13, most Clients are on macOS 15.3.1 Removing Clients from the Scope does not remove the Restriction Setting from the Clients. New Clients enrolled to the Site formerly in Scope of the Restriction get the Restriction Setting ... Should I delete the Restriction Rule to remove it from the Clients? Thanks in advance!

HiI can't find any documentation on the new "Autonomous Single App Mode apps" restriction in the iOS Profiles. Can someone explain me what it does? Thanks in advance!

Basically the title, does pushing the same config profile with different settings applied cause conflicts? Here is a very specific example: Security and Privacy One profile has the firewall turned on and another has the firewall off (not checked). Basically, which wins? Do they fight? We had some weird behavior happen when pushing the same payload multiple times with different settings. Any advise or guidance is appreciated.

TLDR: If Jamf Connect's password countdown isn't updating or Kerberos tickets aren't being received, turn off iCloud+ Private Relay. We recently solved a puzzling issue affecting a small number of users. After password changes, their Jamf Connect Menu Bar wouldn't refresh the expiration countdown (even showing negative numbers) and they weren't receiving Kerberos tickets, despite the new passwords working correctly in Entra and AD. After hours of investigation - trying different Jamf Connect versions, reinstalls, profile changes, and terminal commands like klist and kinit - we discovered the culprit: iCloud Private Relay was rerouting traffic, preventing proper domain resolution needed for Kerberos tickets. The simple fix: turn off iCloud Private Relay and restart Jamf Connect. Both issues resolved instantly!

Aloha Everyone! Account type: Jamf School Not sure if this is the proper place to ask, but I've been working on deploying a custom wallpaper to all of our student MacBooks for a few months now and am hitting a wall. Our previous rep, Christina was looking into this, but all we could find was a solution for Jamf Pro.  I've tried the following: Setting a path and inputting it into a Jamf School Profile Using composer to create a DMG to upload to Jamf School but the file is not supported Using composer to package the image file and deploying through Jamf School - still no luck Script to push out the image file and still no luck (would reset the desktop picture with a stock image) Current environment: Student Restrictions Profile is installed on all MacBooks where they cannot change the Desktop picture. However, this was not in place for years until I deployed it recently. We want to reset all of the wallpapers before the end of the school year, if possible.  If anyone has

Hi all, Looking to upgrade several Ventura machines to Sonoma. Plan is for JP to issue commands to download and install Sonoma and users receive a prompt to reboot to finish the upgrade. Testing hasn't yielded expected results. Leveraging Software Updates in JP with "download and install" + Target version > specific version deploys the upgrade but the machines automatically reboot with no warning or user interaction. Duplicated experience with 14.7.3 then 14.7.4 (after the latter was released last week). Happens with Intel-based and Apple silicon machines. Noticed some prior discussion on the forums recommend using MDM commands. Not sure if the above scenario meets the criteria. Appreciate the assistance.

Hi Nation, does anyone know why some iOS devices are able to set the screen lock time to never and other ones not?I have no idea if there are some configuration profiles or anything else in jamf PRO wich causes this. Thanks for your help :)

Recently I've been trying to extract infos of which extensions our users have on their browsers.I have a script running for our major browsers and it's working great but now I'd like to get more infos that are sealed inside a .json file.Is there a way to extract specific lines from a .json file such as the "manifest.json" you can find in every Chrome extension's folder?Specifically I need only the rows talking about which permission does the extension have as seen below.

Sorry if a little off topic but I need to change my email address assoicated with this Jamf Nation Community.I have looked everywhere but can't see the option.

We’re using JAMF Connect to manage our logins for our school iMac lab, and we’re having a bit of an issue with students changing passwords. I understand that if their network login is changed, they are prompted to enter their most recent local password to sync them up. The trouble is, students typically only have their network password changed if they forget it, meaning they effectively become locked out of that particular iMac.I was thinking that if I can detect which accounts have mismatched passwords, I could write a script to remove the local profile entirely, and allow the student to log in with their network password again. Does anyone know of a way to detect whether or not an account has a mismatched password via a script? My initial plan was to read PasswordCurrent from the local account’s com.jamf.connect.state plist, but that variable only updates while JAMF Connect is running while the user is logged in.

Hello all,First-time poster on Jamf Nation, so please criticize formatting, grammar, etc.We use Bomgar Remote Support on our Macs, but when deploying to a test machine running Sequoia, I get the message "Allow Remote Support Customer Client to find devices on local networks?" It looks like a PPPC popup with options to "Don't Allow" or "Allow", but I can't find a corresponding PPPC setting. We already have Accessibility, SystemPolicyAllFiles, and ScreenCapture set up according to this deployment guide, and I don't see another PPPC option that looks related to this error message. I'm not even sure why this is a permission that needs to be allowed. It feels like the Windows message to "allow this device to be discoverable on local networks," but it's going the opposite way. Why would I need permission to go out on the network and connect to the Bomgar server from my endpoint? Has anyone else seen this popup before or something similar?

After the upgrade to MacOS 12.3, the Jamf login screen went away, i found that running this command would fix the issue : /usr/local/bin/authchanger -reset -jamfconnectAlthough after creating a policy and trying this through execute command i get the following error:LLVM Profile Error: Failed to write file "default.profraw": Read-only file system I tried the command in terminal manually with sudo permissions and it did work. How can i fix it ? 

Hi all,I just migrated from JamfNow to JamfPro and Im very new here. Im addressing computer's name by a Smart Group with a policy to execute this Script, which is not working for me.Basically I want to use the prefix MBP or MBA, depending on the model, following the SN of the laptop. Any advice or help will be highly value.  #!/bin/sh# Get laptop modelmodel=$(system_profiler SPHardwareDataType | awk '/Model Identifier/ {print $3}')# Get Serial Numberserial=$(system_profiler SPHardwareDataType | grep Serial | awk '{ print $4 }')# Assign a prefixif echo "$model" | grep -q "MacBookPro"; then    prefix="MBP"elif echo "$model" | grep -q "MacBookAir"; then    prefix="MBA"else    prefix="APPLE"fi # Generate computernamecomputerName="$prefix-$serial"echo "$computerName" # Rename computerscutil --set ComputerName "$computerName"sleep 5scutil --set HostName "$computerName"sleep 5scutil --set LocalHostName "$computerName"s

I asked this same question on the Clearpass forum, in case there are more people there that are doing similar things, but I'm hoping for someone with the conceptual understanding to just give me a nudge in the right direction regarding this setup. We have been using 802.1x with Machine certificates issued by AD, with ClearPass and Windows machines for a couple years now. I understand the process that the windows machine joins the domain, get's a certificate, and then our clearpass servers are domain joined and can authenticate the machine with Active Directory using some of our various AD servers. All of that works well, and makes sense to me. Now we're extending it to macbooks and adding Jamf, so that we can also set up certificates on the macbooks (they will not be domain joined) via SCEP/NDES integrated with our windows CA, with the goal of them also doing 802.1x with EAP-TLS. So far, we have the SCEP process working fine, and the macbooks obtain their certificates from our CA via S

Hi All,I've never had a problem before using composer to package apps until version 10.28. When packaging a drag and drop app such as Krita or Blender, Composer has started displaying this error message during the 'Build as PKG' build process - Couldn't communicate with a helper application. I've never seen this before, it's doing it on a clean install of Catalina 10.15.7 and on a different machine with an upgrade to Big Sur 11.2.3. It will package VLC successfully but not Krita or Blender.It will create DMGs ok for all three. All three are given the same owner/group & permissions before creating a new PKG. Root, Admin and 755. Has anyone else encountered this issue and were you able to resolve it?Thanks for any info!

Hello everyone, still a beginner with the 14 days trial.   I know what I want but I don't know how to archive that. I would like to give out a device and the user logs in with his MSO365 account. (name@comapny.com) So the device gets entrolled to "his name".   - Cloud Services connection is on. - Cloud identity provider is configured with our Entra ID. The test shows I can search for users and groups and see if they are part of a group   How do I need to proceed to get the users in Jamf Pro?   Thanks a lot in advance.

Hello - we have iCloud accounts disabled for our staff. However, many of them would like to use Apple Music as a quality of life issue, and some have a longstanding workflow of purchasing music from iTunes for work functions. In my restrictions profile I have "allow Apple Music" checked, however, in my testing I still cannot log in to either Apple Music with a subscription account, or even the iTunes section of the app.  Is there a way to enable Apple Music and iTunes for users without enabling iCloud accounts? Thank you!

We upgraded our on prem Jamf Server from 11.1.5 to 11.13.1 and after that when open Self Service is says "Self Service Cannot reach a JAMF MDM server".When I download a new Self Service from JAMF I just got version 11.1.3? 

Hi, I want to enable set time zone automatically using your current location radio button on system settings for all my org Mac on bulk. How do we get it, I want all the Mac date and time settings to be like it is on this image.

We have a lot of users who aren't updating Chrome. How are you enforcing updates and relaunches to apply the updates? 

I am looking for a way to remove a firmware password via JSS policy. I work for a school district and we try to lockdown the computers so that the student don't have access to the recovery panel amongst other things. The problem is that there seems to be an issue with at least one of the computers not recognizing our firmware password, so we have no access either. Is there a way to do this using the built in policy (under accounts), or am I going to want to write a script based on the firm passwords article? Possibly helpful information:MacBook Airs (Mid-2011)Lion 10.7.4 and some 10.7.5current JSS 8.61

Hello !I made a smartgroup for macOS greater or equal to 15 Sequoia. It should be simple:Criteria: Operating SystemOperator: matches regexValue: ^1[5-9]I have NO computer running Sequoia, but I have 3 results. 3 Intel computers with macOS version 10.14.6 (2 of them) and 10.15.7 for the last one.I searched all around and can't find where is the problem. I'm not really used with regex, but this one should be simple.Any help is welcome

Hi! Please! I'll need to know what SQL syntax I need to run in the Mysql database to get the scope (and also exclusions) of profiles and policies. Thank you very much

When we open a policie and look at the logs which computers are completed or failed the button under actions called details is not working anymore. The button next to it called flush i functioning just fine. Does anybody noticed the same problem ?? we are using jamf pro cloud and i got some mails that there was a update so not sure if it has anything to do with that.

I set up a push certificate with the intention of being able to send non invasive messages to IOS devices through the APN and Self Service app as opposed to locking the screen on a user. Notifications are typically temporary so in order to verify they are seen by the user, I would like to change the notification to persistent so it doesn't go away until the user views the message. I see in the IOS settings menu for the Self Service app, I can manually change the notifications to persistent but I don't want to touch each device. Is there some XML I can add the Self Service app in Jamf that would be associated with the app level notification settings? Or is there another way to do what I want?Thanks,Rob