We need to use API to identify if a computer is a member of one of five existing Static Computer Groups (StCG), on the client side, using an API script. The value is used locally to feed other non-JSS related workflows. The StCG names would look like these: MyGroup_01 MyGroup_02 MyGroup_03 MyGroup_04 MyGroup_05 We typically use UUID to find the computer, and this API call seems to work: staticComputerGroup=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers/udid/${uuid} | /usr/bin/xpath '/computer/groups_accounts/computer_group_memberships[1]' 2>/dev/null | /usr/bin/sed -e 's/<group>//g;s/</group>/++/g' | /usr/bin/tr '++' ' ' | /usr/bin/sed '/^$/d' | /usr/bin/grep MyGroup ) After wrestling with this for a couple hours, I wonder if the above is as convoluted as it seems. I created a few other API scripts that were easier and less of an eye sore: assignedUser=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers

I downloaded the macOS installer via Apple's App Store. I tried to install using a policy but the policy-- following the white page found here: https://docs.jamf.com/technical-papers/jamf-pro/deploying-macos-upgrades/9.96/Packaging_and_Deploying_the_macOS_Installer.html . That has just failed each time I tried to install via policy.So today, I packaged the installer via composer. Put the pkg into my JAMF distribution point via Admin. Changed the definition of 12.1.0 to the pkg. When trying to upgrade via Self-Service to test the patch I get Error: Package was not successfully downloaded. 400 on my test machine.  I have read so many other forums here on JAMF Nation about different ways people are installing the upgrade. Brain is kind of soup from all of them. Assistance in installing the latest MacOS would be appreciated. I need to push it to a fleet of 300 + Macs. 

I am running a script that will ask the end user to enter the machine name. It will not work through Casper (remotely or in a policy) but will work fine if I run it locally. Any ideas why it may not be running? I have included the script below. !/bin/bash ComputerName=`/usr/bin/osascript <<EOTtell application "System Events" activate set ComputerName to text returned of (display dialog "Please Input New Computer Name" default answer "" with icon 2)end tellEOT` Set New Computer Name echo $ComputerNamescutil --set HostName $ComputerNamescutil --set LocalHostName $ComputerNamescutil --set ComputerName $ComputerName echo Rename Successful exit Very odd the script runs fine when ran locally through the terminal. But stalls and never runs and never errors out when ran through a policy or through remote. Thank you.

Hi folks, with Python deprecated and throwing scary warnings to users when it's invoked by Jamf, we're looking to replace our trusty logged-in-user detection command that we use in scripts.  Self Service scripts work reliably with $3, but what method are you all using to detect the logged-in user for other scripts?  What works reliably every time, and doesn't pick up _mbsetupuser or similar accounts? Thanks in advance for any suggestions!

Hello,Seems that Jamfnation pages now interpret code in messages incorrectly as described in this page.https://community.jamf.com/t5/jamf-pro/best-way-to-demote-user-from-local-admin-to-standard-on/td-p/154332 The page converts code into emojis.This should be turned off for text entered as code.Is this possible that this happened after the forum conversion? As an example if I type the following two characters : / together I see this: 😕😕Even in code:: / :/ Perhaps it needs to be change how it's interpreted from HTML to something else... 

ruh roh.Anyone else notice this? 

Is there a Terminal command I can use to manually run, from Terminal, a Jamf script I've created?

Hi,I'm new to scripting and I'm trying to delete all files and folders within the Desktop folder and the Downloads folder without actually deleting the Desktop folder and Download folder themselves. I've tried using rm -rf /users/username/desktop/* , but it prompts for confirmation and then doesn't execute when trying to deploy through Jamf. Does anyone know how to do this? I want the trigger for the policy to be "at logout".

JAMF just added 2 new insights to Protect. If I read the docs correctly, I have to go into our existing plan, check them to be active and then save the plan. Does that mean I have to push out the new profile to all the devices? Or does the updated plan auto-update? We use JAMF School, is it better to make a brand new profile or can I "Replace Profile" file with the new on in the existing profile?PPPC Question: that is in the profile but I notice that it is IN the list for Full Disk Access but NOT checkmarked on devices. Is that an issue? 

Hi folks,We deployed 60 MacBooks this summer with the intention of installing more next year (500+ devices). So far, I am not entirely happy with the JAMF School solution in that there is no walkthrough tutorials like JAMF Pro. Every time I look for something specific, it throws me to JAMF Pro. It was pretty painstaking setting everything up in JAMF School the way we wanted it and what looked like a simple task, ended up causing frustration and disappointment.We want to use the JAMF School macOS App for On-Demand App installations. I reached out to a JAMF Rep, and was given a hopeful reply, but only to be thrown a website link to a single KB article which only had basic instructions on deploying the JAMF School App and not how to add Apps for Teachers and Students to install On-Demand.Please, if anyone has been successful in using the JAMF School macOS App for On-Demand App Installs, please let me know and how you did it.RegardsRay   

I have a configuration profile setup with the lock screen payload set to use the all ipads smart device group.  When a brand new device is brought over from ABM (DEP) there is no asset ID assigned to the device yet and I have been going into the device once it comes under management and setting the asset ID.  However, it seems that the profile is loading on the device initially (like it should) but not updating after I set the asset ID so it shows on the lock screen as "asset ID:   ".  If I "change" that configuration profile and save it, it asks if I want to push to all devices under scope and if I say yes the device will then say "asset ID: 99-999".  How do I get it to update the profile on the devices without making a change to the configuration profile and saving it?  Or is there a way to set the asset ID before the device comes under management and has the profile pushed to it to begin with?

Hello and happy holidays everyone!I would like to ask your help to understand if there's a way to gather the main OS language set at user level.We have a mixed environment with two languages being used (Italian and English) with only some single-language applications installed accordingly (Office 2011 and Adobe's).Knowing which language is being used would be very helpful to create smartgroups and deploy apps/updates (such as Office 14.2.5) where there are separate updates for each country.Many thanks for your support!CiaoCarlo

Hi ,I am experiencing weird issue with my Mac M1 pro deviceDevice was part of pre-stage enrollment, remote management gave us some certificate issue We just unassigned the device from pre-stage and ABM, restarted the device and ideally it should give us normal setup assistance but  the Remote management prompt fails to disappear, we restarted the device but no luckIt still gets the "Remote management certificate error" though it is not part of pre-stage and unassigned in ABM  

I am banging my head against the wall with this one and I feel a though the solution should be simple. I read that Jamf Pro 10.26 is supposed to be able to permit enabling NTP/time zone settings without needing location services turned on. However, for the life of me, I cannot find documentation detailing how. I tested a custom configuration profile that does apply the settings successfully, but only if location settings are enabled. For Catalina, I currently use a script (see below). I do not want to rely on my end users turning on location settings to get this configured. How is everyone else doing this now? Am I missing something obvious? Current script: #!/bin/sh #################################################################################################### # # DEFINE VARIABLES/PARAMETERS # #################################################################################################### timeserver="$4" defaults='/usr/bin/defaults' systemsetup='/

Hello We are looking to move over from Meraki to our Jamf environment, we currently have about 900 in Meraki and 600 in Jamf.  Just looking to get any info on this, i saw a post about a quick add pkg and script but not much other info. Thank you!! any help is much appreciated!!

Hello,We use User profiles for setting the wifi configuration.We had old setup where the user account was a mobile account.We migrated with rtrouton script (https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/migrate_ad_mobile_account_to_local_account) , these mobile account to local account.The "user profiles" were removed from the current user (as seen in the gui, and confirmed with the "profiles" command)But in the Jamf interface, in the inventory, these profils are still displayed. These users lost the wifi configuration this way. More problematic, updates to these profils aren't pushed back to these users. 

Hey All,I'm curious about a few features with The Mut v6.0  and am wanting to test it out but I can't figure out how to sign in to the application as we use Single Sign-On to auth to Jamf Pro.  I have tried using my SSO credentials in the username/password fields or settings another password to my Jamf Pro user, but both methods are still telling me that I have invalid credentials. Is there something I am missing? or do I need to completely disable SSO to be able to use The Mut?

Hi everyoneIm a total noob to JamF. I recently joined a company and they have about 10 macs which are out of use.They charged me with writing up a protocol for wiping, reinstalling and re enrolling the macs to JamF.The company currently uses Jamf but Iv not actually used it myself.Iv done a bit of research on the subject. I found this video detailing a process for Catalina. However I would like this process to run and be completed through jamf and not need the selfservice part.Could anyone pls tell me the steps to follow for this process? It would be an amazing help!!Thanks in advance

Hello everyone,Does anyone know the command that will run the 'Free up space' command for the OneDrive folder.I want to run it after a user has logged out, just wanting to know if this is possible first.Thanks, Browner.

Hi everyone,The majority of my end users are standard users with Filevault2 enabled. If they try to upgrade Monterey they get this message "You must provide authorization for this volume by setting it as your startup disk." I have a self service policy that downloads MacOS Monterey 12.1 and then unpackages itself into their /Applications folder. Following that has a Files and processes payload with the executed line /Applications/Install\\ macOS\\ Monterey.app/Contents/Resources/startosinstall --agreetolicense --forcequitapps This is the feedback when going to logs in Jamf for each attempt: Result of command: Error: failed to authorize for installation. Provide a password with --stdinpass or --passprompt. By using the agreetolicense option, you are agreeing that you have run this tool with the license only option and have read and agreed to the terms. If you do not agree, press CTRL-C and cancel this process immediately.Can anyone help me out where I am suppose

Hi Guys, I'm having some issue with upgrading 11.6 to 11.6.2My environment is a bit difficult. 1) we are on prem2) App Store and Software update blocked 3) Users do not have admin rightsThe only way is to push the installer via JAMF and use the script to install. I also keep having error during the upgrade too. Do anyone have a good idea of how to do it smoothly? 

We have managed iPhones in Apple business manager synced with JAMF Pro. We have federated our domain so our business email addresses can be used as Apple IDs. Is there are way to only allow our business federated email addresses (now Apple IDs) to be used to sign in on our managed devices? We've had a few people sign in to our managed phones with their personal iCloud/Apple ID accounts, and it syncs their apps and wallpapers across both devices, as well as connects both phones. 

Hello all,Sorry for the novice question -- I am a ConfigMgr/Windows Engineer who recently was asked to support this environment until our open positions are filled. I've tried to find documentation on this process and troubleshooting it but have had no luck with the official docs.My support team is trying to get this new device provisioned for an end user and claims the device was in Jamf but simply "vanished" at some point. I can confirm the device does not exist in Jamf. The device does exist in ABM and has been assigned to Jamf. What would be my next steps in getting this device to show back up within Jamf? Thanks

To reduce the amount of licences we have deactivated the option "Allow Jamf Pro to perform management tasks" on certain devices that have not been active for a longer period of time. Now we want to re-enable this option on some devices, but we are not able to get the randomly generated management password for these devices. Is there a way to read out this randomly generated password? 

To my knowledge, Apple does not currently have a way for us to enforce what accounts are able to login using the iCloud pane on iPads. We are about to unlock the iCloud pane for our students to be able to login with their MAIDs, I'm looking to prevent them from being able to install an apps with a personal AppleID on another device and have those apps install automatically on their issued device if they are logged in with that personal account. Anyone have a config for blocking Settings -> App Store -> Automatic Downloads -> Apps?  How are others dealing with this issue with iPads and MAIDs?