Morning AllGearing up to role out Adobe 2025. Does have anyone have an EA which would show if a machine has no Adobe installed.I have done this using smart groups before, but gets a bit complicated given the amout of Adobe packages we push out.I already have script to remove Adobe, I was thinking I could then use the EA to build a smart group of machines with no Adobe installed.Thanks

It looks like the Apple large clock is suddenly appearing on the login screen, blocking the local login and shutdown buttons. I’ve already tried disabling the large clock setting in System Preferences, but it’s still showing. Additionally, there doesn’t seem to be an option to hide it using the plist.  

Anybody else getting double logins this past week in JS? My instance url takes me to a Jamf ID login but instead of SSO it takes me to the Jamf School login where I have to sign in again. Not a cookie issue as it happens in Chrome, Safari and other Macs and iPads.  Just wanted to check my sanity before going to support.

When I deploy the CIS L1 baseline via JCE I'm having an issue with the following: 9.16. Configure Login Window to Show A Custom Message. When I change the default text from "Center for Internet Security Test Message" to anything else, I get a compliance failure. How do I change this message to something more relevant without it flagging up as a compliance fail?  

We run a clustered on premise environment. One JSS internal, one JSS in the DMZ behind a reverse proxy. I've never loved that even though you turn off the UI on the DMZ instance that www.myjss.com/api is still exposed as a UI. We do restrict what users have access to the API but I still don't like it being exposed so I tried blocking it in the reverse proxy.  After doing this, I noticed that it broke the sync with VPP.  I removed the /api block in the reverse proxy and the purchased apps immediately came down. I went and checked the reverse proxy logs thinking that I'd have an error logged every time the sync monitor ran. I found no such errors. The only thing i found in the logs related to /api was an errors with remote users and the self service branding icon not being passed down. Anybody else have any insight into why blocking /api breaks VPP sync and also why there would be no errors logged in the reverse proxy?  

I'm surly missing something simple. I am trying to update the Adobe CC and Adobe Acrobat (with CC) packages in JAMF. They keep failing with the response being to contact the vendor, and the install log is saying there was an error with executing the packages scripts. Downloading the downloader for a managed package from the Adobe Admin CenterDoing all the random steps to download the package with the adobe package downloader app that comes in the .dmgUploading the install.pgk to JAMF (JAMF auto zips the file when uploading)Putting the install.pkg.zip in a policyTrigger the policy and fails every time.If I run the package locally on the device it works like a charm. Before I break down and put the installer pkg in a pkg and run it with a script, does anyone have any idea what I missed?

Any one notice if you install Self Service+, it re-triggers enrollment complete / first time login policies?

I am using the Make Me an Admin : https://github.com/jamf/MakeMeAnAdmin I'm having 3 questions/concerns:• It is not reliably creating a log?• Is there a way to get the log to me or at least a notification that the policy was run?• Is there a way to block them from creating additional admin accounts while they are an admin? Thanks!

Hi all,Im looking for a simple and easy buy user friendly way to restart a mac .. I know there is many options out there .. script .. jamf policy , DEP Notify . .. but have always had feedback from business saying that there are not very user friendly. I have been tasked to see if i can find a friendly way to restart with less user interaction or at least a deferral ..Any idea is much welcomed..rk 

Hello Guys,   We are using Jamf Pro as an on prem. Tomcat ssl certificate's expires very soon.I did renew the ssl  new certificate than restart tomcat service. But users were not able to connect to self service. Actually I deploy the new certificate to clients via  config. profile. I can see the current new Certificate in the keychain. For testing, test device was connected to self service when I set the new certificate to always trust.            

Hey all, I've been stuck on this for quite a few weeks. Our JSS servers were moved from one location to another. Since then we've had to redo numerous things. The last being TomCat. The boxes used to be behind a load balancer, now they are not. Anytime we navigate to our jss site, it says it is not secure over https and another issue is any policies with packages trying to push, fail due to it not being secure and not being able to make the connection. If I go into TomCat and "Change the SSL certificate used for HTTPS" -> Next -> I've tried "Generate a certificate from the JSS's built-in CA. Restarted the box. No different " Same steps as above, only this time, "Upload an existing SSL Certificate" -> our network guy pulled the cert we use for other servers. Anytime I try to upload, the second part where it asks for the password, it does not go through. This password works on everything else. Tried redownloading it from the s

I am trying to figure out a way i can use the profile command to remove a user profile that was installed by JAMF. The profile is used to add a AD generated user cert to connect systems to our . WiFi. For various reasons this cert breaks or gets removed. I was hoping to build something in self service user can use to remove the profile and re-add it forcing a new user cert to be generrated. But im having zero luck i get a profile not found error using sudo profiles -R -p "profiles ID" Error:profiles remove for identifier:'Profile ID' and user:'Username' returned -205 (Unable to locate configuration profile.)

Hey, since last week we can not remove the Restriction Software settings from Mac Clients. We run Jamf Pro Version 11.13, most Clients are on macOS 15.3.1 Removing Clients from the Scope does not remove the Restriction Setting from the Clients. New Clients enrolled to the Site formerly in Scope of the Restriction get the Restriction Setting ... Should I delete the Restriction Rule to remove it from the Clients? Thanks in advance!

HiI can't find any documentation on the new "Autonomous Single App Mode apps" restriction in the iOS Profiles. Can someone explain me what it does? Thanks in advance!

Basically the title, does pushing the same config profile with different settings applied cause conflicts? Here is a very specific example: Security and Privacy One profile has the firewall turned on and another has the firewall off (not checked). Basically, which wins? Do they fight? We had some weird behavior happen when pushing the same payload multiple times with different settings. Any advise or guidance is appreciated.

TLDR: If Jamf Connect's password countdown isn't updating or Kerberos tickets aren't being received, turn off iCloud+ Private Relay. We recently solved a puzzling issue affecting a small number of users. After password changes, their Jamf Connect Menu Bar wouldn't refresh the expiration countdown (even showing negative numbers) and they weren't receiving Kerberos tickets, despite the new passwords working correctly in Entra and AD. After hours of investigation - trying different Jamf Connect versions, reinstalls, profile changes, and terminal commands like klist and kinit - we discovered the culprit: iCloud Private Relay was rerouting traffic, preventing proper domain resolution needed for Kerberos tickets. The simple fix: turn off iCloud Private Relay and restart Jamf Connect. Both issues resolved instantly!

Aloha Everyone! Account type: Jamf School Not sure if this is the proper place to ask, but I've been working on deploying a custom wallpaper to all of our student MacBooks for a few months now and am hitting a wall. Our previous rep, Christina was looking into this, but all we could find was a solution for Jamf Pro.  I've tried the following: Setting a path and inputting it into a Jamf School Profile Using composer to create a DMG to upload to Jamf School but the file is not supported Using composer to package the image file and deploying through Jamf School - still no luck Script to push out the image file and still no luck (would reset the desktop picture with a stock image) Current environment: Student Restrictions Profile is installed on all MacBooks where they cannot change the Desktop picture. However, this was not in place for years until I deployed it recently. We want to reset all of the wallpapers before the end of the school year, if possible.  If anyone has

Hi all, Looking to upgrade several Ventura machines to Sonoma. Plan is for JP to issue commands to download and install Sonoma and users receive a prompt to reboot to finish the upgrade. Testing hasn't yielded expected results. Leveraging Software Updates in JP with "download and install" + Target version > specific version deploys the upgrade but the machines automatically reboot with no warning or user interaction. Duplicated experience with 14.7.3 then 14.7.4 (after the latter was released last week). Happens with Intel-based and Apple silicon machines. Noticed some prior discussion on the forums recommend using MDM commands. Not sure if the above scenario meets the criteria. Appreciate the assistance.

Hi Nation, does anyone know why some iOS devices are able to set the screen lock time to never and other ones not?I have no idea if there are some configuration profiles or anything else in jamf PRO wich causes this. Thanks for your help :)

Recently I've been trying to extract infos of which extensions our users have on their browsers.I have a script running for our major browsers and it's working great but now I'd like to get more infos that are sealed inside a .json file.Is there a way to extract specific lines from a .json file such as the "manifest.json" you can find in every Chrome extension's folder?Specifically I need only the rows talking about which permission does the extension have as seen below.

Sorry if a little off topic but I need to change my email address assoicated with this Jamf Nation Community.I have looked everywhere but can't see the option.

We’re using JAMF Connect to manage our logins for our school iMac lab, and we’re having a bit of an issue with students changing passwords. I understand that if their network login is changed, they are prompted to enter their most recent local password to sync them up. The trouble is, students typically only have their network password changed if they forget it, meaning they effectively become locked out of that particular iMac.I was thinking that if I can detect which accounts have mismatched passwords, I could write a script to remove the local profile entirely, and allow the student to log in with their network password again. Does anyone know of a way to detect whether or not an account has a mismatched password via a script? My initial plan was to read PasswordCurrent from the local account’s com.jamf.connect.state plist, but that variable only updates while JAMF Connect is running while the user is logged in.

Hello all,First-time poster on Jamf Nation, so please criticize formatting, grammar, etc.We use Bomgar Remote Support on our Macs, but when deploying to a test machine running Sequoia, I get the message "Allow Remote Support Customer Client to find devices on local networks?" It looks like a PPPC popup with options to "Don't Allow" or "Allow", but I can't find a corresponding PPPC setting. We already have Accessibility, SystemPolicyAllFiles, and ScreenCapture set up according to this deployment guide, and I don't see another PPPC option that looks related to this error message. I'm not even sure why this is a permission that needs to be allowed. It feels like the Windows message to "allow this device to be discoverable on local networks," but it's going the opposite way. Why would I need permission to go out on the network and connect to the Bomgar server from my endpoint? Has anyone else seen this popup before or something similar?

After the upgrade to MacOS 12.3, the Jamf login screen went away, i found that running this command would fix the issue : /usr/local/bin/authchanger -reset -jamfconnectAlthough after creating a policy and trying this through execute command i get the following error:LLVM Profile Error: Failed to write file "default.profraw": Read-only file system I tried the command in terminal manually with sudo permissions and it did work. How can i fix it ? 

Hi all,I just migrated from JamfNow to JamfPro and Im very new here. Im addressing computer's name by a Smart Group with a policy to execute this Script, which is not working for me.Basically I want to use the prefix MBP or MBA, depending on the model, following the SN of the laptop. Any advice or help will be highly value.  #!/bin/sh# Get laptop modelmodel=$(system_profiler SPHardwareDataType | awk '/Model Identifier/ {print $3}')# Get Serial Numberserial=$(system_profiler SPHardwareDataType | grep Serial | awk '{ print $4 }')# Assign a prefixif echo "$model" | grep -q "MacBookPro"; then    prefix="MBP"elif echo "$model" | grep -q "MacBookAir"; then    prefix="MBA"else    prefix="APPLE"fi # Generate computernamecomputerName="$prefix-$serial"echo "$computerName" # Rename computerscutil --set ComputerName "$computerName"sleep 5scutil --set HostName "$computerName"sleep 5scutil --set LocalHostName "$computerName"s