At the company I work for, I.T. sets up all laptops for incoming employees and I'm trying to figure out how to automate as much of the computer setup as possible. One of the snags I'm running in to is that FileVault 2, when set up from the command line via sudo fdesetup enable doesn't provide an obvious way to escrow the recovery key to JAMF like it does when you do FileVault 2 setup manually through System Preferences (see image). Anyone know how to do this? All the computers this applies to are 10.13 or higher. Thanks in advance! .

Hello,I was wondering if anyone out there has run into an issue where they are working with networking issues on iPads and want to make/ push policy changes but the device is unable to connect to the wifi to get the new update?Is there a way to set a secondary wireless network to auto connect should the primary be unreachable?I was thinking this could be a "troubleshooting only" network that would be turned on when the main goes down. What are you doing in your environment to have:1) iPads auto connect to the wifi2) Prevent the wifi menu from being enabled so employees cannot switch to other networks3) In the event you need to reach devices that have gone offline I am trying to eliminate putting all of my eggs in one basket and touching 300 iPads at 10 locations.Any insight is greatly appreciated,Greg

Hello,The organization that I work for maps local samba shares to macs at login when on campus. We use the following script (which has worked flawlessly for years). Unfortunately when running from login hook, the username field now fills with "root" everytime, and the user has to re-input their username to map to the drive. Any ideas on how to fix this? username="$3" if [ -z "$username" ]; then # Checks if the variable is empty (user running script from Self Service) username="$USER" fi echo "User: $username" # Mount the drive mount_script=`/usr/bin/osascript > /dev/null << EOT delay 10 tell application "Finder" mount volume "smb://[SERVERIP]/[Drive]/$username/Documents" end tell EOT` exit 0 

We have an on-prem installation of Jamf Pro (latest version) and would like to deploy JAMF teacher. We've done this, but we've found that the teacher actions, such as setting an app lock for a specific app, only works intermittently (some devices can, others can't), regardless of which network the devices are on. However, control of devices always work, meaning that when a command has been sent by the teacher, the student always receives them and they work as expected there.I've been looking in the documentation to see what the network requirements are. The details are sparse, but the key phrase here seems to be "(On-premise only) Allow secure inbound connections from "student-api.services.jamfcloud.com". Does that translate to that whatever IP is behind "student-api.services.jamfcloud.com" needs to connect via HTTPS (TCP 443) to the tomcat server that we host on-prem? Or is there any other interpretation that can be derived from this? Any hints on what's going on here?How does the Jam

Hey everyone Hoping someone can help - I am in the middle of deploying MS Defender ATP and for this configuration policy, the Content Filter tab is nowhere to be found in my JAMF Pro! - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-9-configure-network-extensionI'm on version 10.25.2-t1605115216 - I know it is not the latest, but does anyone have know of a legacy method to perform this step if this specific to newer versions?

Every few months, I spend some time cleaning out old installer packages from my Jamf Pro servers. I launch Jamf Admin and start deleting the old packages while also making sure that the installer policies and patch policies are using the latest installer packages. This can be very time consuming. I'm wondering if anyone has a better way of doing this. 

I've noticed lately that ASM is not syncing with JSS intermittently, it will come up with the error: Sync failed. Awaiting next sync. I've already placed public token in ASM and have uploaded the ASM token to JSS. No changes have been made to our firewall or filtering system. We are on version 10.17.1 Is there anything I'm overlooking?

Have had multiple instances of users failing to give SS enough time to download and install apps, whether they be from a direct download package or VPP. It seems that the progress indicator is not tied to the actual progress of the installation, so in most cases it will say "Done" even when it's not. They click multiple times, see an error, and then send us a ticket that it's "not working". I've considered some sort of pop-up that tells them to be patient and even monitor the app icon in the Applications folder, wondering if anyone has any sort of method they're using that might be more precise. Like a pop-up when it starts and another when it's actually complete. I realize this might not be possible within a VPP-based profile, maybe that's reason enough to go the direct download path via script...

Hey Everyone,Pardon my ignorance, I'm trying to figure out how to install OS updates efficiently. Currently, I'm running the Software Updates Policy which installs the security updates just fine, but does not install the OS updates IE) Big Sur 11.5 on a machine running 11.4. I did come across another method to do this which is to run a second policy with the file and processes payload to run the software update tool, Softwareupdate -i -a, but I am trying to avoid situations where no warning or notification is given and a user restarts there machine and they have to wait 30 minutes for the upgrade to complete. Is there a way to obtain a dmg or pkg of these minor OS updates which I can send out or is there a better way of doing this? I've tried searching the forums for any more clues but haven't had any luck there or I'm searching for the wrong thing. Any help would be appreciated, i'm still learning. Thank You

on our devices (10.10.x) we have two local accounts, one "ITadmin" and one "enduser" (also admin level).We want to set a password policy that only applies to the enduser account as we need to keep the ITadmin accounts the same. I've tried creating a configuration profile that is set to be user level with only a password payload configured but it doesn't show as applicable to the scoped devices. If I change to computer level it deploys just fine, but is applied to all the accounts.I've tried using pwpolicy but I can't get the xml file to be in a readable format to be applied.there is very little help that I can find on how to make a working xml file for this, the man page is very dodgy to say the least and none of the few examples I can find seem to work.I don't really want to go down the line of using the deprecated command set as I want them to work on 10.11. Has anyone got a clear example of a working xml file to feed into pwpolicy?

Hi all,I'm new to Jamf Pro and am struggling to find out how I can exclude a machine before it's enrolled with Jamf.   We apply a few profiles and run a few policies on enrollment but I need to replace a few of them with the profiles/policies I am testing.  I have an unenrolled VM with a known hostname and serial number.  Is there any way to accomplish this? Thank you,-Doris

So I have a policy that runs  /usr/local/bin/RemoteUpdateManager once a week. I've noticed lately that not all apps are updating to the latest with this method but most are. So I ran it manually on a computer I know wasn't fully updated. The output said no available updates, you are fully updated. But I know that it's not, comparing it to Patch Management. What's weirder is that when I log into the machine and open Adobe CC Desktop app, it says it's up to date with an out of date version number. Has anyone else seen something like this or have a working process of keeping you Adobe CC products up-to-date? 

Has anyone managed to apply the following setting from the terminal? System Prefs > Notifications > Do Not Disturb > Check When the display is sleeping

HI,I'm a newbie here @ Jamf Pro. I need to deploy few .APP apps (like FileZilla). I've made a PKG via Composer 10.34.0, but It's failed during the installation. Can you provide me with some tips? Or Link if you have? I've tried to google documentation, but no luck with my case.B/RAlex

Hey everyone - total beginner here with very little scripting knowledge. I am currently in the middle of trying to remove Symantec from all our macs and have the script file to do it, however I need to install this file to a specific location on each mac and then run it. How would I do this? I tried to use composer and create a before and after image and then make that into a pkg but it didn't work and it did not add the file to my test machine in the location I wanted. I know there is a simple way to do it but cannot find a step by step guide online

Good morning all. I'm having issues getting JAMF to initialize after an update to 10.34.1 from 10.29. The update installs no problem, but it gets hung up on Initializing Change Management when attempting to complete.I tried a solution found here: https://community.jamf.com/t5/jamf-pro/jamf-server-hanging-on-initializing-change-management/m-p/243366I ran the steps involved there to run the MySQL command and while it does restart the initialization, it still hangs at the same spot.Has anyone run into this recently and have alternative options or solutions?

In Protect, when a Alert Auto-Resolves or just Resolves, what does that mean. Did a file get quarantined? Is the file/program blocked but still on the device? Did it get deleted? Do we know?

New info this morning regaridng log4J.  Version 2.15, included in the recent JAMF patch, is still vulnerable.  When is a patch incoming? Event Impact:CVE-2021-45046 was originally believed to allow a denial of service in Log4J 2.15.0 if certain non-default configurations were used. Security researchers have since found ways to leverage this vulnerability to allow remote code execution. Additional research on Log4J 2.15.0 also showed that previous mitigations (specifically setting system property log4j2.formatMsgNoLookups or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true) did not provide sufficient protection as there are still code paths in Log4J where message lookups could occur. References:https://logging.apache.org/log4j/2.x/security.html

I tried to deploy Jamf Connect with GoogleID as per the Jamf Connect admin guide but during login, I'm getting an error "Configuration is nil or invalid"Does anyone come across this issue? please suggest

The Mac sometimes cannot connect to a wifi network even though there is no profile showing for that particular network.  A search on the web seems to suggest that the following files need to be deleted from /Library/Preferences/SystemConfiguration/:com.apple.airport.preferences.plistcom.apple.network.eapolclient.configuration.plistcom.apple.wifi.message-tracer.plistNetworkInterfaces.plistpreferences.plistI just wonder if there could be a script to do this.  I tried using a bash script but always has "no such directory"  "no permission" etc errors.Any help would be appreciated.

Looks like our fix for jamf for our previous issue was not complete.https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046https://logging.apache.org/log4j/2.x/security.html 

Hi All, I'm new to the API and newish with scripting, so please bear with me.My end goal is: have a list of all the Mobile Device Applications and what they are scoped to. I've tried this for loop:#!/bin/bash IDs=$(curl -sku myusername:mypassword -H "content-type: text/xml" https://myinstance:8443/JSSResource/mobiledeviceapplications | xmllint --format - | awk -F '[<>]' '/<id>/{print $3}') for idNumber in $IDs do curl -sku myusername:mypassword -X GET -H "Accept: application/xml" https://myinstance:8443/JSSResource/mobiledeviceapplications | xmllint --xpath "/mobile_device_application/scope/text()" - done Though it tells me that the "Xpath is empty".Is there a way for me to reiterate through the Application IDs I find using curl, and show me the scope for each and all of them? Thank you

I have an admin account created with our DEP Profile "Staff admin". We manually create a second admin account "Tech admin" when provisioning and finishing touches for distribution. I want to get rid of that Staff Admin account, both moving forward for newly provisioned devices, and for existing devices in the fleet.For the first, all I need to do is replace the info in the DEP Profile, is that right?For existing accounts, how can I achieve this? My concern is with the secure boot tokens and ensuring that Jamf can still perform tasks administratively for both new and existing devices without issue. I don't have a full grasp on how Jamf performs elevated tasks and don't want to screw it up!Unless I'm missing something I don't see a payload to do this in the documentation. As a scripted solution, any known templates that have been used or might be useful here? Thanks in advance!

Forgive me if this has been addressed already.  I was unable to find anything quite like what I am after. I need to export our inventory and for that export to include specific attributes about the individual machines. If I were to export all computer inventory I just get a few options for how to base the search like computer name, applications, etc. Doing this will only display that search criteria, like a list of just computer names.What I am looking for is a way to pull the full inventory list and have it also display some of the info I would find when drilling down into the machine properties. For example could I export all the machines with their respective Serials, Reported IP Addresses, and Site? Or Computer name, User, and Building? Something like that. 

I have Created the Config profile for this in Jamf and it does not seem to be working.Process starts with:Checking for expected bundle ID: /usr/bin/defaults read "/Applications/iTerm.app/Contents/Info.plist" CFBundleIdentifier Results: com.googlecode.iterm2 Create a Configuration Profile with the appropriate settings including the bundle ID and no love.