Hey there, I checked the boards but couldn't find a consensus. Does anyone know if custom scripts default to a certain working directory? I ask because I'm trying to gauge the importance of absolute paths when doing binary calls to the "jamf" or "scutil" binaries. If a shell starts in a user's home folder for these scipts, then theoretically if I were to make binaries called "jamf" or "scutil" that did less than helpful things (or daresay even malicious things), would that create a path vuln or does jamf know that aliases are called and defaults to whatever the system is set to previously? I know this all seems moot because the rule is ALWAYS USE ABSOLUTE PATHS, but as a curious mind and a infosec enthusiast I was just curious if Jamf had any protections for that already in place. Anyway, really loving this community of Apple nerds and look forward to the discourse. If this post is completely asinine or naive, I do apologize. I am but a poor script noob and am trying to learn

Using this workflow as a starting point:https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/I've set this up two erase a machine and install Big Sur. I have several applications set to install via a prestage enrollments which I'm testing. What's the best way to combine both the erase and install and then have Jamf run the prestage enrollment?   

We have a limited number of licenses and I have been advised to purge records of devices that haven't checked in for 90 days. I'm worried about doing that since so many of our users have taken to working from home and many have just taken the summer off.If we delete that record in JAMF Pro, will the record reappear if the device is turned on later? And, how will it affect the history like policy or computer management logs? The JAMF client is still installed.Does deleting a record affect the license count?  

Is there a way to extend the time that the JSS will log you out due to inactivity? I looked in all the links under Settings and everything under JSS Service and did not see this option anywhere. Is it possible to change this? If so, where is the setting? Thanks in advance.

Hello,We have 10k ipads to wipe.  Is there a way to wipe more than 100 per batch?  I am using the GUI from a static group (View, Action, Send Remote Commands, Wipe....) but it only seems to work when I try to wipe 100 or less. Thanks!

This summer we're finally moving to an Automated Device Enrollment/DEP-based deployment workflow for our Macs and we're wiping and reinstalling them with macOS Catalina. However on some of our Macs, after wiping, reinstalling and enrolling with ADE we are finding that some configuration profiles are not being applied (which is a big problem for us as one of these is needed in order for most of our software to get deployed correctly). On further investigation, when looking at the computer record in Jamf Pro of one of the affected Macs, we can see a large number of failed "Remove Configuration Profile (name)" commands with error "Profile with identifier (guid) not found, MDMClientError:89". With "name" and "guid" being replaced by a profile name and guid respectively. Obviously the profiles are not found because the Mac has been wiped and reinstalled. We found that we can remediate this by deleting the computer record before we wipe and reinstall the Mac but we were hoping

Self Service has been crashing for us ever since we updated to version 10.30.1. Seems to be whenever you go into or mouse over a column in the Browse section. If you click Home as soon as you log in, it stays running and continues to work. Just installed 10.30.3 a few minutes ago, ran policy so everything on my client end would update, still getting the same thing. I read somewhere that maybe having custom branding could be the issue? We have a banner set and a custom app icon set. Originally when it started doing it after updating to 10.30.1 I figured it would be resolved shortly with another update or there would be a discussion started as it seems to be an issue with the actual .app but I didn't see it mentioned in 10.30.3's release notes nor have I found any discussions really.

In my organization (Higher Ed) we do a bit of school branding on all of our systems. One being we set a custom background image at the login screens in our labs and classrooms. Did this in Mojave by making our image an heic extension and naming it Mojave then placing it in /Library/Desktop Pictures. In Catalina that directory moved to /System/Library/Desktop Pictures which you can not write to. I did find a way to do it via disabling System Integrity Protection SIP, making the change then re-enabling it. That is a lot to do on a few hundred machines. Does anybody have a better method to change that image or should I just forget about it? Thanks in advance.

Hi all, I'm not sure if this has been posted about beforehand, though I couldn't really find anything that answers my question beyond "Re-enroll the device". Basically we had a mishap in our environment where, upon renewing our Push Certificate, another Apple ID than the original was used, causing our devices to display the "APNs Feedback error". From preliminary research it seemed that this was a known issue, but no fix in place beyond re-enrolling the affected devices (All of them, if that's the case).We have since found that going back to the original Apple ID and generating the Push Certificate from there has reverted the majority of our devices, which we hadn't yet re-enrolled, to having no feedback errors, but those we had already rolled this out for are now getting the APNs Feedback error. My question is, to avoid re-enrolling each device (Which doesn't seem to be able to be automated, even by using sudo jamf reenroll -invitiation

My users are not able to create any groups in outlook, the tab is grayed out.

Hello!I know there is a command to trigger policies which is "jamf policy -id<number>" and I am wondering where I can find the policy ID number. I was looking at the each policy I made, but I couldn't find or see anything related to the ID number. Does anyone know a way to find the policy ID?

There is no urgency for this. What I am trying to do is learn how to create a script to do one-off application updates using a policy instead of using Patch Management. The idea is to include a set of parameters that a Jamf tech can fill in to specify which app we are updating with the policy that the script is attached to. The script below works, but there's just one issue. I'm using an osascript to display the dialog to alert the user that the app is about to be updated. The dialog appears, but it does not show the name of the app we are updating. Instead it shows the name of the parameter. Does osascript not work with parameters, or am I just doing something wrong? I don't want the update to run until the user has quit the app and clicked OK. Here's a screenshot of the dialog that appears. My script is below. Thanks for the help! #!/bin/sh #Updates application at the path defined in paramater 7 to the version defined in parameter 4. For parameter 5, fill in the full application

We're still struggling to get our Macs to register with Intune. After each failed attempt, in addition to removing the partial computer entries from Intune, we have to delete every single file and keychain entry that has anything at all to do with Intune and the Company portal app. After a lot of searching I came up with this script to remove the files associated with it: #!/bin/sh #variable for storing the current users name assuming the computer has the end user # and not the admin user logged in when this script is run. currentuser=`stat -f "%Su" /dev/console` rm -Rfv /Users/$currentuser/Library/Application Support/com.microsoft.CompanyPortal.usercontext.info rm -Rfv /Users/$currentuser/Library/Application Support/com.microsoft.CompanyPortal rm -Rfv /Users/$currentuser/Library/Application Support/com.jamfsoftware.selfservice.mac rm -Rfv /Users/$currentuser/Library/Saved Application State/com.jamfsoftware.selfservice.mac.savedState rm -Rfv /Users/$currentuser/Library/Saved Applica

Hi all, I am interested in setting SSID order within Macbooks. So I searched JAMFNation (as I do) and I actually found the answer.https://www.jamf.com/jamf-nation/discussions/18223/re-order-wifi-preferred-networks So within this chat, the solution is provided as a python script, which I am very happy about. I have tested this within JAMF Pro 10.6, it works as expected. But I would like to change thePreferredSSIDs = ["SSID_1", "SSID_2", "SSID_3"] line to bePreferredSSIDs = ["$4", "$5", "$6"] so that future JAMF Pro admin can easily see the listed SSID within the policy. But $4, $5, $6 do not work in python script :( Would any of you know how to read the $4, $5, etc parameter and parse it to the python script?

Hi,I have upgraded a machine to Big Sur, and now get a question mark against system apps in the managed Dock. Currently, these are added like this /Applications/Calculator.app for example. I'm guessing this is to do with these apps now sitting in System/Applications - however, updating the path does not solve the issue. Has anyone else come across this?

I receive the following error when trying to edit a configuration profile.  Any help would be greatly appreciated.

I am attempting to remote wipe the membership of a smart group but this action isn't working. After choosing Wipe Device and clicking Next, there is a spinning dots symbol for a few seconds but the screen down't move on and the action doesn't happen. Other actions like Restart work fine. Any help appreciated!

I tried posting this yesterday, but the forums flagged it as spam for some reason. So I created a support case (JAMF-3163676), but have not heard anything.I upgraded our JAMF 10.30.0 server to 10.31.1 last night. Everything went fine except now it's stuck at Initializing Change Management and I don't know how to fix it. There is one single error in /usr/local/jss/logs/JAMFSoftwareServer.log.The /usr/local/jss/logs/JAMFChangeManagement.log exists and the "jamftomcat" account has permissions to modify it. JAMFSoftwareServer.log:2021-08-11 19:26:00,457 [ERROR] [erverThread] [gUncaughtExceptionHandler] - Uncaught Exception from thread InitializeServerThread - ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@6bfb2009] unable to create manager for [/var/log/JAMFChangeManagement.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@5330f439[pattern=/var/log/JAMFChangeManagement.log.%i, appe

Hello, Is it possible to set somewhere in the configuration profiles that a local user must have a certain password complexity? Unfortunately, I can't find anything about this. Thank you!

Hi all,We just intregrated the Apple School Manager with Jamf School to some schools. So far, everything is working fine execept for the Apple IDs.I mean, I've wiped de device, I've applied the correct blueprint through the Apple Configurator. It links the iPad automatically to the JAMF, it goes automatically to the correct group, it takes the correct owner and finally all free and paid apps are being installed automatically. The enrollmente is apparently OK.The only problem here is that the managed Apple ID (by ASM) is not being pushed to the iPad.All Apps installed, find my device ON but there's no Apple ID signed in to the iPad. Could you please help me how to do that?, how or where shall I add the Apple ID to be pushed to the iPad during the enrollment? Thanks in advance.Mousani Junior.

Hi all, I used to get email alerts for every post, but have just realised I've not got them for a week or so... Is everyone else getting the alerts?

The built-in Apple software update payload that we can use in a policy will save a plist file to /Library/Application Support/JAMF called .userdelay.plist. The presence of this plist means that the user has selected one of the deferral options. It was easy to create an extension attribute that checks the file path above for the plist file, but what I would also like to do is track how long of a deferral the user selected. The text of the plist file is below. What I would like to do is make an extension attribute that will report the value for the key called "lastChosenDeferDate". <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>140</key> <dict> <key>deferStartDate</key> <date>2021-08-11T14:08:46Z</date> <key>lastChosenDeferDate</key> <date>2021-08-13T14:08:46Z<

I'm not a Jamf Cloud customer, but my understanding is that 10.31 was scheduled to be installed for Jamf Cloud customers this past weekend and it was cancelled very last minute. Can someone at Jamf provide a reason? Should on-premise customers who already installed 10.31 be concerned? Should we be holding off until 10.31.1 comes out?Please don't tell me to contact Jamf Support. I'm not the only customer who has this question and all customers would benefit from an answer.

Is there a way to restart the process of enrolling a new computer into jamf with the prestage enrollment? I have one macbook that wasn't assigned when first starting a set, or rather the wrong one got assigned.  I started them all up, set the country, language, put in the wifi, and on the one, it went to the privacy screen whereas the rest, started the enrollment process.   I corrected the mistake but it won't enroll now.  In the past, I have had to wipe to factory to get it do it again, but wondered if there was another way instead of having to do that, because I will have to reload the OS, iMovie, Garage band etc again on this if I go back to factory. Thanks in advanced.

HelloIs there a way to initiate an iCloud backup to a group in Jamf School? We're wiping 300+ iPads, and I need to make sure they're all backed up. I really don't want to do them one at a time 😇