I am doing some tests with our installation and workflow on the new M1 with Big Sur.  It seems that it was fine installing our older version of Jamf Connect Login (2.0.4) from self service as long as I would check for Rosetta on the hardware first, and then install it if it wasn't present.  All seemed well until I decided to do the latest OS update for Big Sur, and after the restart I am getting the following Error : Unrecoverable error: SecurityAgent was unable to create requested mechanism JamfConnectLoginLoginUI".  So now the machine is bricked as it's stuck unable to run the login screen.I haven't figured out a way to get around this without reformatting the device, the problem is it won't boot, and when I am in recovery mode with terminal, the authchanger program won't run due to the an incompatible CPU type (yes authchanger is only for x86, yet in recovery it's stuck to arm64.  Anyone else think of some way I could get reset and remove JCL from the Login windo

Hi all,I’m trying to do something super simple but I’m obviously missing something: I’m deploying Jamf Connect with OKTA. I have two apps (Access + Admin). My user is in these two apps and I thus expect the user to be an admin on the mac (at user creation) but the user keeps getting the standard role.Is there anything wrong in the PLIST below?Why is my new user not getting the admin role?Thanks     <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>AllowNetworkSelection</key> <true/> <key>AuthServer</key> <string>clienst_instance.okta.com</string> <key>CreateJamfConnectPassword</key> <true/> <key>EnableFDE</key> <true/> <key>EnableFDERecoveryKey</key> <true/> <key>Migrate</key> <true/> <

As I was working to reassign iPads to different staff this school year, I realized that the pre-stage enrollments that I have been using no longer have devices within the Scope.  I am also unable to add devices to the scope. Any help I can get to get devices back into those pre-stage enrollments is much appreciated.

Hi,Does anybody know where the settings are located for deferring major and minor updates separately. The one's mentioned here https://support.apple.com/en-gb/guide/mdm/mdm02df57e2a/web as Defer major releases and Defer minor releases. I only found deferring updates here: Configuration Profiles > Restrictictions > Functionality, but this is 1 profile which I think should be 2 seperate ones. With Monterey around the corner being able to defer a major release separately from minor updates would be really helpful. Thanks, Tim

We got a couple of OS X 10.11 machines, that where enrolled in a different MDM (we cannot access anymore)Since there is a lot of data on the drives we do not want to wipe the machinesIs there a trick to get rid of the old MDM profile ? "Normal" profile removal via bash fails with error "Profile is not removable" bash-3.2# profiles -R -p com.uni.mdmprofiles uninstall for identifier:'com.uni.mdm' and user:'root' returned 101 (Profile is not removable.)

I attended my first JNUC in 2020 which was in virtual mode where I want to share my experience and observations:1. I never feel it was in virtual mode, even I feel energy and enthusiasm was on the higher side.2. Full marks goes for systematic planning and unbeatable experience.3. I already attended few events like this from different vendors but Jamf have always some unique thing.4. I really want to appreciate that Jamf do lot of pre-checks before the event goes live.5. last year we had awesome jamf and other speakers ( aka ..jamf customers) and all of them were just awesome. Good part about the session was you definitely learn something that will help you in real time.6. They always focus on hybrid session content i.e. technical + management + best practices + awareness about other security/other tools which makes the event more successful.7. For sure its always pleasure to make the awesome connections in any event. I wish I could present something this time but hectic schedule d

Hey all,So I'm sure there are bunch of ways to do this, however I've not explored this until now (and we are all working remotely). With new machines we get purchased we are thinking of sending them to the staff directly and having them set it up, but currently I'm using DEP Notify to run a script at login after a local admin account is created. We used to run this from our network so that the unit could bind to AD and get the right permissions and then we would help new users login before leaving our network to create their mobile accounts. Is there a good way to continue to do this remotely or would I have to switch to a whole new method of imaging to remove the bind (which would not be great for when we get back due to wireless authentication and such requiring a bind)? How is everyone doing binds these days? I assume NoMAD and JAMF connect are being used, but what alternatives are there? Gabe ShackneyPrinceton Public Schools

Hi Guys 👋 New here, so please forgive me if this is a silly question and I'm getting all of the terminology wrong.We recently acquired Jamf Pro and we've got it up and running with a few basic policies. So far we've only enrolled devices manually (with either an email invite or downloading the agent from our Jamf instance). Policies and everything work just fine on enrolled devices which is great.We've also configured the PreStage Enrolment integration so that Apple Business Manager (ABM) and our Jamf console are linked, which all worked without a hitch, but I'm confused about the PreStage Enrolment policy.I don't understand how we 'transition' a device from PreStage enrolment to a 'full enrolment' - i.e. - if I PreStage enrol a device, does it then just pick up all of the policies and config I've configured for my other devices that are assigned to 'All managed devices', or do I need to recreate my other policies in the PreStage enrolment settings? All I really want to do

Hey guys,I'm working on upgrading some MBAs and I have a policy that creates a new standard user which the students can use. I have the Macs joined to an AD and I thought just to test I should try to login as the student account. It fails. I know it's not the password since I reset it. Weird thing is, is that if I make the account an administrator then it allows me to login?!?! I then remove the admin rights and reboot and it goes back to failing. Any ideas?Thanks!

I get the feeling I'm behind the 8-ball. Our educational institution has been running macOS High Sierra until very recently when Adobe dropped support for it forcing us to upgrade to Mojave. Since the students are not using the labs due to COVID-19 I have time to catch up and learn what I should have learned in Mojave and Catalina but now for Big Sur. Why go to Big Sur? I prefer all my Mac labs to be on the same operating system version where possible and we are considering a lab of the new Mac Mini computers with Apple M1 SOC. I setup my first Big Sur lab machine yesterday (a Mac Pro 2013) and none of the policies ran that I could see, nor did any of the installers execute. For example, my installer to create /Library/AdminToolBox and drop all my scripts there failed like this: Checking for policies triggered by "recurring check-in"... Executing Policy Copy Maya Installers Mounting casper cp: /Volumes/casper/Packages/Installers_2020.pkg: Operation not permitted Erro

Is this topic covered somewhere?

I have build a NoMAD config profile and have pushed it out. When it is FIRST INSTALLED, it works beautifully. If I either Quit NoMAD (and let it relaunch according to the LaunchAgent) or restart the computer, it breaks horribly. As you can see from my raw plist below It should show extra menus but after the NoMAD app is quit and it relaunches, it loses all the customization and it even stops displaying the password expiration in the menu bar! <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ADDomain</key> <string>ourdomain</string> <key>GetHelpOptions</key> <string>https://internalsite.company.org</string> <key>GetHelpType</key> <string>URL</string> <key>HideExpiration</key>

I had a ticket with JAMF about the JAMF Connect login window being off-center anytime I use a dual monitor. They attached it to a PI. But I wanted to create this discussion to see if more people have the issue and see if we can push this to a higher priority. Also, JAMF was able to reproduce.

Hello,I need to setup a simple extension attribute to display the installed version of Python on our MacBooks. I'm using the following script input, but the display in machine inventory for the extension attribute remains blank. What am I missing? Here is the script:#!/bin/sh PY=`python --version` echo "<result>$PY</result>" exit 0That should do it, right?Any help is appreciated!

I would like to enable a group of users to be able to send the "Lock Computer" command, but without granting them the "Administrator" role.What are the privileges that I need to set for this group to be able to send this command?Thanks.

As shown in the attached pic, MySQL is creating a ton of what I believe are binary log files, and it's filling up the hard drive. Not sure how this got enabled, or how to stop it, so if anyone can advise, that would be great.

Hello, In our iOS deployment we are currently trying to figure out how to disable the ability of users to sign into iCloud on managed devices. I see lots options for specific iCloud functionality in configuration profiles, but nothing that would stop it dead. Does anyone have any experience with this sort of deployment? IOS version 8.1.3, JSS version 9.62

Hi All, New member here trying to setup our iPads. I'm missing the Self Service app. I have it enabled in the settings. After the iPad boots up from the initial setup it says this apple id cannot be used for purchases. I'm thinking that is stopping the Self Service app from installing. 

I just recently purchased two Apple Remote Desktop licenses for myself and my IT Specialist. I just added the licenses to Jamf and have not scoped it to any devices. Jamf is now saying that 1 of the licenses is in use, even though the software has not been installed on any computers. How is this possible? How do I get my license back? At $80/ea, I certainly do not want to be forced to purchase another one.

I am in the process of enrolling devices that have been wiped over the summer. They had been sitting for a while as we were upgrading our server(s). When trying to enroll, I get the 'The MDM server for your organization returned an unexpected status (500)' error. Then I found this thread:https://community.jamf.com/t5/jamf-pro/device-enrollment-installation-failed-the-mdm-server-for-your/td-p/194200I have been attempting to delete the keychain as it has worked for others, but I am running into other problems due to inexperience. When using the rm command it returns Permission denied (even after asking to override permissions). I see that the permissions are rw-r--r-- for apsd.keychain. So I thought of trying sudo, but it asks for a password and I do not know of any default passwords.Edit: Forgot to mention the important part, I am trying to do this at setup since I am unable to proceed.If someone can point me to a good guide on terminal basics or do a quick step by step, it would be muc

Although I know the settings are depreciated for Big Sur, I have a profile installed with Allow on the Media Restrictions section. This is because I still have Catalina machines in use however when I check the profile in System Preferences on a Big Sur machine, it shows Deny for all mount rules. I'm guessing this is why I can't mount any external USB drives. When I move the computer to another site that doesn't have that profile, I can mount USB drives again. Anybody know how I can fix this?

Hi,has anyone successfully deployed a fully licensed CorelCAD 2021? How did you do it?I've been trying for days, but I just can't figure it out. Thanks for helping!

Hello all, is there a way to clear all restricted software rules with a command line.when we want remove jamf on a computer we use "sudo jamf removeMdmProfile and removeFramework" but I'm not sure that the restricted software rules are removed.thank you

Good day everyone, I'm hoping that I can get a second set of eyes on this script. It is designed to check the status of Find My Mac, and works find locally, but it is erroring out when I run it through a Jamf Policy. Here is the script: !/bin/bash this script will check the status of Find My Mac. If it isn't running, it will end, otherwise it will execute the AppleScript below that fmmStatus=$() if [[ "$fmmStatus" = 0 ]]; then echo "Find My Mac Not Running" exit 1 else osascript -e "tell application "System Events" to display dialog "Hey there! IT requests you please stop using "Find My Mac" on this MacBook Pro as it has been found to interfere with our Mobile Device Management security settings.Please go to System Preferences > Apple ID > Find My Mac and disable the checkbox for this feature.If you have any questions please reach out to IT and we can help you out. Thanks!" fi exit 0 I receive the error message of -> Script result: 110:115: syntax error: A iden

All of a sudden when I log in to my jamf pro cloud portal with various admin accounts I only see the first two computers that were managed by jamf and the other 70-some odd computers are no longer showing up ... what could possibly be causing this?