I see lots of posts about the difficulty of clearing forgotten passcodes since the iPads no longer connect to wi-fi after going to sleep for a period of time, resulting in a DFU as the fix - but I did not see anything about whether we could block students entirely from entering a passcode on the iPad? Is that possible? Thanks!

Hello all, We're seeing this issue with some computers on our instance where the Management tab for some devices wont load. For the computers that won't it spins and spins until you see the message "temporarily unavailable" (and still just spins). Possibly related, it seems that these computers wont take new profiles either. I think that it may be related to a config profile that was generated incorrectly (i.e. this pppc utility / jamf pro issue  https://github.com/jamf/PPPC-Utility/issues/90 ) that caused a lot of our computers to have over 1000 (sometimes 10000) failed management commands, which we can see on the ones we can view management for. I deleted that profile, thinking that might help clear it all out, but the failures are still listed with something of an error message in its place. I thought I might have some luck with the with the "cancel management commands" from the inventory actions button, but that too hangs. I've also tried to use the classic

Update 12/28On December 9, 2021, a Remote Code Execution (RCE) vulnerability (CVE-2021-44228) was identified in the log4j library (https://www.lunasec.io/docs/blog/log4j-zero-day/). The log4j project released version 2.15 to address this issue. New information has come to light identifying ways to exploit log4j 2.15 when the formatMsgNoLookups parameter was not set. CVE-2021-45046 was assigned to this and fixed on December 16, 2021 in log4j 2.16.  We have continued to assess the impact and mitigate the vulnerability across our platform (tracked as PI-010403) as the security community has identified new issues in log4j.  Due to the nature of these issues, these are considered critical vulnerabilities. What Jamf products are impacted by the log4j vulnerability?Jamf Pro (hosted on-premises): PatchedJamf Pro versions older than 10.31 do not use log4j 2.x&nb

Hello everyone,We have recovered macOS Big Sur 11.6.2 InstallAssistant.pkg from https://mrmacintosh.com/ and are trying to upload it to Jamf Admin and JSS but it fails.Some of you also have this problem?

Hi There, our JSS Web Admin Stopped working yesterday and it came with following error:----------------http Status 404 Type Status report Message Description: The requested Resource () is not available, Apache Tomcat /6.0.24.----------------I restarted the Tomcat from JSS Setup Utility and also unload and load the Tomcat from the terminal and also did the following:Restart Web Services from Server Admin Restart My SQL Services Asked our LAN Admin's to Restart the server (Shutdown and restart) and they done it.Replace the Server.xml in /Library/tomcat/conf after doing backup of the file. (few times that this sever Tomcat had the same behavior this action fixed the issue). Still I am getting the same error. I sent the an email to JAMF this morning but so far NO answer. As this is our production server I have to fix it ASAP. any idea will be appreciated.

Hello!I'm looking for a way to check when a device has moved from one smart group to another. In this case I am using an integer Extension Attribute to track a devices vulnerability compliance. If a device reports that a specific file is >0 it is put in a group that says there is a vulnerability. Once that EA drops to 0, that device is good. Is there a way to check which devices HAD an EA >0 but are now at 0 so I can track that the vulns are being remediated?Thank you!

Hi,Devices enrolled via ABM do not appear in Search inventory in Jamf Pro,But the device is available under scope in Pre-stage Enrollment Tab Is this how it works ? ADE enrolled devices wont appear in Search inventory?

Scenario:When Mac laptops are imaged and joined to the domain in our corporate environment the desktop support teams have the option of giving the domain user local admin rights on their Mac device. Unfortunately, more often than not, they do so. The Mac image comes with a generic local admin account that all devices have and needs to be kept in place. These rights need to be preserved. New policy has come from the top, all local admin rights for domain users are to be removed from all domain devices. I have been recently given the role of Casper Admin with zero experience in Casper or OSX after an engineer left. Questions:How do we remove these rights from each device centrally through Casper JSS? Is there a way to do so? If this has to be some sort of script, what exactly should it be and how would it be distributed to devices as they come online and continue to check the devices to ensure that there are no new local rights given? Any help is definitely appreciated and certainl

if someone can briefly explain to me the purpose of the 'Management Account' when creating a QuickAdd package and Configuration ? (We already create a local Admin on each mac prior to any enrollment in casper system) when creating your QuickAdd packages and/or Configuration, what are some of you choosing from the options below?Hide it or NOT hide itAllow SSH for management account only

Here what I am seeing, Version Anyconnect 4.10.03104 with Compliance Module 4.3.2161.4343 giving me a DNS Error "The VPN client agent's DNS component experienced an unexpected error.  The VPN connection has been disconnected.  Please restart your computer or device, then try again." Now this versions supports Catalina 15.7 no problem but also notice Socket Filtering is greyed out. When I upgrade the Catalina 15.7 to Monterey 12.1 I get the DNS trying to connect. I also needed to allow Socket Filtering. Not sure if anyone been running to a similar issue? 

Now I got a setup that works like expected. User boots his empty MacBook and Jamf installs all the applications and settings. After a while the Mac asks to log in. But in the background it’s still downloading and preparing stuff.So I would like to show  a Work in Progress screen to the user and prevent him to shut down or do anything with his computer until everything is ready.Any ideas how to do that?

At the company I work for, I.T. sets up all laptops for incoming employees and I'm trying to figure out how to automate as much of the computer setup as possible. One of the snags I'm running in to is that FileVault 2, when set up from the command line via sudo fdesetup enable doesn't provide an obvious way to escrow the recovery key to JAMF like it does when you do FileVault 2 setup manually through System Preferences (see image). Anyone know how to do this? All the computers this applies to are 10.13 or higher. Thanks in advance! .

Hello,I was wondering if anyone out there has run into an issue where they are working with networking issues on iPads and want to make/ push policy changes but the device is unable to connect to the wifi to get the new update?Is there a way to set a secondary wireless network to auto connect should the primary be unreachable?I was thinking this could be a "troubleshooting only" network that would be turned on when the main goes down. What are you doing in your environment to have:1) iPads auto connect to the wifi2) Prevent the wifi menu from being enabled so employees cannot switch to other networks3) In the event you need to reach devices that have gone offline I am trying to eliminate putting all of my eggs in one basket and touching 300 iPads at 10 locations.Any insight is greatly appreciated,Greg

Hello,The organization that I work for maps local samba shares to macs at login when on campus. We use the following script (which has worked flawlessly for years). Unfortunately when running from login hook, the username field now fills with "root" everytime, and the user has to re-input their username to map to the drive. Any ideas on how to fix this? username="$3" if [ -z "$username" ]; then # Checks if the variable is empty (user running script from Self Service) username="$USER" fi echo "User: $username" # Mount the drive mount_script=`/usr/bin/osascript > /dev/null << EOT delay 10 tell application "Finder" mount volume "smb://[SERVERIP]/[Drive]/$username/Documents" end tell EOT` exit 0 

We have an on-prem installation of Jamf Pro (latest version) and would like to deploy JAMF teacher. We've done this, but we've found that the teacher actions, such as setting an app lock for a specific app, only works intermittently (some devices can, others can't), regardless of which network the devices are on. However, control of devices always work, meaning that when a command has been sent by the teacher, the student always receives them and they work as expected there.I've been looking in the documentation to see what the network requirements are. The details are sparse, but the key phrase here seems to be "(On-premise only) Allow secure inbound connections from "student-api.services.jamfcloud.com". Does that translate to that whatever IP is behind "student-api.services.jamfcloud.com" needs to connect via HTTPS (TCP 443) to the tomcat server that we host on-prem? Or is there any other interpretation that can be derived from this? Any hints on what's going on here?How does the Jam

Hey everyone Hoping someone can help - I am in the middle of deploying MS Defender ATP and for this configuration policy, the Content Filter tab is nowhere to be found in my JAMF Pro! - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-9-configure-network-extensionI'm on version 10.25.2-t1605115216 - I know it is not the latest, but does anyone have know of a legacy method to perform this step if this specific to newer versions?

Every few months, I spend some time cleaning out old installer packages from my Jamf Pro servers. I launch Jamf Admin and start deleting the old packages while also making sure that the installer policies and patch policies are using the latest installer packages. This can be very time consuming. I'm wondering if anyone has a better way of doing this. 

I've noticed lately that ASM is not syncing with JSS intermittently, it will come up with the error: Sync failed. Awaiting next sync. I've already placed public token in ASM and have uploaded the ASM token to JSS. No changes have been made to our firewall or filtering system. We are on version 10.17.1 Is there anything I'm overlooking?

Have had multiple instances of users failing to give SS enough time to download and install apps, whether they be from a direct download package or VPP. It seems that the progress indicator is not tied to the actual progress of the installation, so in most cases it will say "Done" even when it's not. They click multiple times, see an error, and then send us a ticket that it's "not working". I've considered some sort of pop-up that tells them to be patient and even monitor the app icon in the Applications folder, wondering if anyone has any sort of method they're using that might be more precise. Like a pop-up when it starts and another when it's actually complete. I realize this might not be possible within a VPP-based profile, maybe that's reason enough to go the direct download path via script...

Hey Everyone,Pardon my ignorance, I'm trying to figure out how to install OS updates efficiently. Currently, I'm running the Software Updates Policy which installs the security updates just fine, but does not install the OS updates IE) Big Sur 11.5 on a machine running 11.4. I did come across another method to do this which is to run a second policy with the file and processes payload to run the software update tool, Softwareupdate -i -a, but I am trying to avoid situations where no warning or notification is given and a user restarts there machine and they have to wait 30 minutes for the upgrade to complete. Is there a way to obtain a dmg or pkg of these minor OS updates which I can send out or is there a better way of doing this? I've tried searching the forums for any more clues but haven't had any luck there or I'm searching for the wrong thing. Any help would be appreciated, i'm still learning. Thank You

on our devices (10.10.x) we have two local accounts, one "ITadmin" and one "enduser" (also admin level).We want to set a password policy that only applies to the enduser account as we need to keep the ITadmin accounts the same. I've tried creating a configuration profile that is set to be user level with only a password payload configured but it doesn't show as applicable to the scoped devices. If I change to computer level it deploys just fine, but is applied to all the accounts.I've tried using pwpolicy but I can't get the xml file to be in a readable format to be applied.there is very little help that I can find on how to make a working xml file for this, the man page is very dodgy to say the least and none of the few examples I can find seem to work.I don't really want to go down the line of using the deprecated command set as I want them to work on 10.11. Has anyone got a clear example of a working xml file to feed into pwpolicy?

Hi all,I'm new to Jamf Pro and am struggling to find out how I can exclude a machine before it's enrolled with Jamf.   We apply a few profiles and run a few policies on enrollment but I need to replace a few of them with the profiles/policies I am testing.  I have an unenrolled VM with a known hostname and serial number.  Is there any way to accomplish this? Thank you,-Doris

So I have a policy that runs  /usr/local/bin/RemoteUpdateManager once a week. I've noticed lately that not all apps are updating to the latest with this method but most are. So I ran it manually on a computer I know wasn't fully updated. The output said no available updates, you are fully updated. But I know that it's not, comparing it to Patch Management. What's weirder is that when I log into the machine and open Adobe CC Desktop app, it says it's up to date with an out of date version number. Has anyone else seen something like this or have a working process of keeping you Adobe CC products up-to-date? 

Has anyone managed to apply the following setting from the terminal? System Prefs > Notifications > Do Not Disturb > Check When the display is sleeping

HI,I'm a newbie here @ Jamf Pro. I need to deploy few .APP apps (like FileZilla). I've made a PKG via Composer 10.34.0, but It's failed during the installation. Can you provide me with some tips? Or Link if you have? I've tried to google documentation, but no luck with my case.B/RAlex