Hey Everybody,Quick question for you API experts, and apologies in advance.  I'm new to this.  I'd like to update a specific attribute.  I've included some sample XML that's close to what would be grabbed from a specific iPad.I'd like change "Mrs. Jane Doe" to "Mr. Jon Doe" in "SD-Full Name" of extension attributes.<?xml version="1.0" encoding="UTF-8"?> <mobile_device> <general> <id>2035</id> <display_name>School Staff iPad Mr. Jon Doe</display_name> <device_name>School Staff iPad Mr. Jon Doe</device_name> <serial_number>B28JDKL1J0CDM</serial_number> ... etc. </general> <extension_attributes> <extension_attribute> <id>2</id> <name>SD-Full Name</name> <type>String</type> <multi_value>false</multi_value> <value>Mrs. Jan

I know this is probably a long-shot... but has anyone figured out how to block Monterey from appearing in Big Sur's Software Update pane after 90 days? All of our Big Sur machines seem to have lit up this morning with the "Install Monterey" feature. We still have it restricted, but I'd hate to have someone get all excited and download it just to have it deleted...

Greetings! I recently enrolled in the Apple Developer program so I could obtain an Installer Certificate for JAMF Composer.  I was finding that more often than not, whenever I pushed a third-party app out via Self Service, it would look like it had installed, but wouldn't.  Upon checking the install.log file, it showed that the package was not signed and therefore was not installed. Obtaining the Installer Certificate has helped, but I've noticed a new issue when trying to install an app on an Intel-based MacBook Air.  The app installs fine, but when I try to open it I get the "You do not have permission to open the application..." error.  I thought installing through Self Service would prevent this since the apps are supposed to be installed as root, or SU? Anyway, I've tried this on an M1 machine with no problems.  It appears to be limited to the Intel-based laptops, regardless of what macOS version is installed.  Anyone have any ideas?&nb

Our school has 450+ MacBooks and 150+ iPads. At the moment I have one iPad that will not install the profile. The CA certificate is being installed before the profile with no errors. I'm not sure what could be stopping this one iPad from enrolling. I've followed the steps in the article below with no luck. Also, the iPad is set to the right time. https://www.jamf.com/jamf-nation/articles/192/mobile-device-enrollment-error-invalid-profile-or-invalid-certificate

Hi all, Which application format is better DMG or PKG ? Can anyone provide more details I understand to add scripts in application - PKG is best and for indexing DMG PKG installs for all users in home directory  

I'm looking for a simple way to allow members of my org's Field Support group to enable software in Self Service for any of our managed Macs without actually giving them access to our JSS. I use a Static Group as a target for each installation Policy that isn't scoped to all computers, so what I'm envisioning is a shell script that will run an AppleScript to display a popup listing the available titles, and then prompt for the serial number of the computer to be added to the appropriate Static Group using the Classic API (that's the easy part). I thought I'd seen something along these lines posted on Jamf Nation before (looking at you @dan-snelson), but darn if I can find it now. Before I re-invent the wheel I figured I'd see if it rang a bell with anyone else. Please post a reference if it does Thanks!

I've been asked to report on users who have iCloud Drive enabled. I found an older EA on the board but that doesn't seem to work on El Cap even if I amend the file path. This is what i'm using. !/bin/sh if folder exists, then iCloud Drive is enabled iCloudDriveFolder="~/Library/Mobile Documents/com~apple~CloudDocs" if [ -e "${iCloudDriveFolder}" ]; then echo "<result>Enabled</result>"else echo "<result>Disabled</result>"fi Seems to be that the ~/Library/Mobile Documents/com~apple~CloudDocs isn't recognised using the above. I can cd to the folder and terminal sees it as a directory. Now am i missing something or is it something else? Thanks Al

Hey Everybody,I'm having some trouble with my scripting.  I'm attempting to view an iPad's extension attributes, and then update them if needed, but my cURL request always come back with the same error: "The request requires user authentication" -- which I'm using.  Works for everything else, but not for extension attributes.  Maybe my code is wrong?  Here's what I have:curl -X GET -H "accept: application/xml" -H "authorization: Basic ${jssAuth}" "${jssURL}/JSSResource/mobiledeviceextensionattributes/id/$deviceID"  Thanks,-Rob

Hey all,I've been seeing an issue where my Zoom for IT client opens the sso page in Safari when zoom is first opened on a new users device.  My plist for zoom settings seems to be set correctly to use the embedded browser in the client but it continues to open a browser window when trying to login to SSO in zoom.  This only started a few months ago from what I can tell, or perhaps it is only since we started updating to 11.4.   I've since tried edited all the setting in the plist, however it still keeps opening a web browser when the user attempts to  first login to SSO.Anyone else seeing this or have a work around?

In JAMF school how can I configure the control center for my managed iPads?

We have a lab full of Macs, and I'm going to start managing them with Jamf. I put them in a prestage which works fine. But I'd like to skip the create computer account screen all together. I am already setting up a local admin account, so I don't need to create another account on each machine. Is there a way to do this?

What is the best way to make a .dmg of Office 2011 with only certain apps installed (Word, powerpoint, excel etc) and not all that other garbage that comes with it, basically I can pick/choose what applications will be installed, then create the .dmg I am saying .dmg because I also want to have it be uninstalled via policy, so my understanding is to create a .dmg and index it ?? what about FTU/FEU ?

Hey Everyone,Not sure what version this happened on, but we thought to do a test on new enrollments and since 2.4.5 on the part where a user logs into azure and then asks to enter their network password. We get an "Invalid Request". We we're on 2.2.2 before this. Some have suggested to change this to true."Create a Separate Local PasswordIf set to true, this key prompts users to create a new password for their new local account. If set to false, this key prompts users to re-enter their network password, which also becomes the local account password. This ensures a user's network and local password are synced during user creation." We don't want to do this as it creates confusion when it's time to reset the password back to Azure. Unless something changed, Jamf connect cannot write back directly to Azure. We've been needing to go through the SPR.

The prefix is showing up on the device, but it's not pulling down the serial. I've even tried a few commands I've seen on these forums, and it still won't grab the serial. I am learning scripting, and only know basic commands. I took over for the previous sys admin who left, and he could never get the script to work either. MODEL=$(sysctl hw.model)if [[ $MODEL == *"Book"* ]]thenPREFIX="TRML-"elsePREFIX="TRM-"fiSERIAL=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformSerialNumber/{print $7}')COMPUTERNAME="${PREFIX}${SERIAL}"/usr/sbin/scutil --set ComputerName $COMPUTERNAME/usr/sbin/scutil --set LocalHostName $COMPUTERNAME/usr/sbin/scutil --set HostName $COMPUTERNAME  

We need to use API to identify if a computer is a member of one of five existing Static Computer Groups (StCG), on the client side, using an API script. The value is used locally to feed other non-JSS related workflows. The StCG names would look like these: MyGroup_01 MyGroup_02 MyGroup_03 MyGroup_04 MyGroup_05 We typically use UUID to find the computer, and this API call seems to work: staticComputerGroup=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers/udid/${uuid} | /usr/bin/xpath '/computer/groups_accounts/computer_group_memberships[1]' 2>/dev/null | /usr/bin/sed -e 's/<group>//g;s/</group>/++/g' | /usr/bin/tr '++' ' ' | /usr/bin/sed '/^$/d' | /usr/bin/grep MyGroup ) After wrestling with this for a couple hours, I wonder if the above is as convoluted as it seems. I created a few other API scripts that were easier and less of an eye sore: assignedUser=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers

I downloaded the macOS installer via Apple's App Store. I tried to install using a policy but the policy-- following the white page found here: https://docs.jamf.com/technical-papers/jamf-pro/deploying-macos-upgrades/9.96/Packaging_and_Deploying_the_macOS_Installer.html . That has just failed each time I tried to install via policy.So today, I packaged the installer via composer. Put the pkg into my JAMF distribution point via Admin. Changed the definition of 12.1.0 to the pkg. When trying to upgrade via Self-Service to test the patch I get Error: Package was not successfully downloaded. 400 on my test machine.  I have read so many other forums here on JAMF Nation about different ways people are installing the upgrade. Brain is kind of soup from all of them. Assistance in installing the latest MacOS would be appreciated. I need to push it to a fleet of 300 + Macs. 

I am running a script that will ask the end user to enter the machine name. It will not work through Casper (remotely or in a policy) but will work fine if I run it locally. Any ideas why it may not be running? I have included the script below. !/bin/bash ComputerName=`/usr/bin/osascript <<EOTtell application "System Events" activate set ComputerName to text returned of (display dialog "Please Input New Computer Name" default answer "" with icon 2)end tellEOT` Set New Computer Name echo $ComputerNamescutil --set HostName $ComputerNamescutil --set LocalHostName $ComputerNamescutil --set ComputerName $ComputerName echo Rename Successful exit Very odd the script runs fine when ran locally through the terminal. But stalls and never runs and never errors out when ran through a policy or through remote. Thank you.

Hi folks, with Python deprecated and throwing scary warnings to users when it's invoked by Jamf, we're looking to replace our trusty logged-in-user detection command that we use in scripts.  Self Service scripts work reliably with $3, but what method are you all using to detect the logged-in user for other scripts?  What works reliably every time, and doesn't pick up _mbsetupuser or similar accounts? Thanks in advance for any suggestions!

Hello,Seems that Jamfnation pages now interpret code in messages incorrectly as described in this page.https://community.jamf.com/t5/jamf-pro/best-way-to-demote-user-from-local-admin-to-standard-on/td-p/154332 The page converts code into emojis.This should be turned off for text entered as code.Is this possible that this happened after the forum conversion? As an example if I type the following two characters : / together I see this: 😕😕Even in code:: / :/ Perhaps it needs to be change how it's interpreted from HTML to something else... 

ruh roh.Anyone else notice this? 

Is there a Terminal command I can use to manually run, from Terminal, a Jamf script I've created?

Hi,I'm new to scripting and I'm trying to delete all files and folders within the Desktop folder and the Downloads folder without actually deleting the Desktop folder and Download folder themselves. I've tried using rm -rf /users/username/desktop/* , but it prompts for confirmation and then doesn't execute when trying to deploy through Jamf. Does anyone know how to do this? I want the trigger for the policy to be "at logout".

JAMF just added 2 new insights to Protect. If I read the docs correctly, I have to go into our existing plan, check them to be active and then save the plan. Does that mean I have to push out the new profile to all the devices? Or does the updated plan auto-update? We use JAMF School, is it better to make a brand new profile or can I "Replace Profile" file with the new on in the existing profile?PPPC Question: that is in the profile but I notice that it is IN the list for Full Disk Access but NOT checkmarked on devices. Is that an issue? 

Hi folks,We deployed 60 MacBooks this summer with the intention of installing more next year (500+ devices). So far, I am not entirely happy with the JAMF School solution in that there is no walkthrough tutorials like JAMF Pro. Every time I look for something specific, it throws me to JAMF Pro. It was pretty painstaking setting everything up in JAMF School the way we wanted it and what looked like a simple task, ended up causing frustration and disappointment.We want to use the JAMF School macOS App for On-Demand App installations. I reached out to a JAMF Rep, and was given a hopeful reply, but only to be thrown a website link to a single KB article which only had basic instructions on deploying the JAMF School App and not how to add Apps for Teachers and Students to install On-Demand.Please, if anyone has been successful in using the JAMF School macOS App for On-Demand App Installs, please let me know and how you did it.RegardsRay   

I have a configuration profile setup with the lock screen payload set to use the all ipads smart device group.  When a brand new device is brought over from ABM (DEP) there is no asset ID assigned to the device yet and I have been going into the device once it comes under management and setting the asset ID.  However, it seems that the profile is loading on the device initially (like it should) but not updating after I set the asset ID so it shows on the lock screen as "asset ID:   ".  If I "change" that configuration profile and save it, it asks if I want to push to all devices under scope and if I say yes the device will then say "asset ID: 99-999".  How do I get it to update the profile on the devices without making a change to the configuration profile and saving it?  Or is there a way to set the asset ID before the device comes under management and has the profile pushed to it to begin with?