I had a ticket with JAMF about the JAMF Connect login window being off-center anytime I use a dual monitor. They attached it to a PI. But I wanted to create this discussion to see if more people have the issue and see if we can push this to a higher priority. Also, JAMF was able to reproduce.

Hello,I need to setup a simple extension attribute to display the installed version of Python on our MacBooks. I'm using the following script input, but the display in machine inventory for the extension attribute remains blank. What am I missing? Here is the script:#!/bin/sh PY=`python --version` echo "<result>$PY</result>" exit 0That should do it, right?Any help is appreciated!

I would like to enable a group of users to be able to send the "Lock Computer" command, but without granting them the "Administrator" role.What are the privileges that I need to set for this group to be able to send this command?Thanks.

As shown in the attached pic, MySQL is creating a ton of what I believe are binary log files, and it's filling up the hard drive. Not sure how this got enabled, or how to stop it, so if anyone can advise, that would be great.

Hello, In our iOS deployment we are currently trying to figure out how to disable the ability of users to sign into iCloud on managed devices. I see lots options for specific iCloud functionality in configuration profiles, but nothing that would stop it dead. Does anyone have any experience with this sort of deployment? IOS version 8.1.3, JSS version 9.62

Hi All, New member here trying to setup our iPads. I'm missing the Self Service app. I have it enabled in the settings. After the iPad boots up from the initial setup it says this apple id cannot be used for purchases. I'm thinking that is stopping the Self Service app from installing. 

I just recently purchased two Apple Remote Desktop licenses for myself and my IT Specialist. I just added the licenses to Jamf and have not scoped it to any devices. Jamf is now saying that 1 of the licenses is in use, even though the software has not been installed on any computers. How is this possible? How do I get my license back? At $80/ea, I certainly do not want to be forced to purchase another one.

I am in the process of enrolling devices that have been wiped over the summer. They had been sitting for a while as we were upgrading our server(s). When trying to enroll, I get the 'The MDM server for your organization returned an unexpected status (500)' error. Then I found this thread:https://community.jamf.com/t5/jamf-pro/device-enrollment-installation-failed-the-mdm-server-for-your/td-p/194200I have been attempting to delete the keychain as it has worked for others, but I am running into other problems due to inexperience. When using the rm command it returns Permission denied (even after asking to override permissions). I see that the permissions are rw-r--r-- for apsd.keychain. So I thought of trying sudo, but it asks for a password and I do not know of any default passwords.Edit: Forgot to mention the important part, I am trying to do this at setup since I am unable to proceed.If someone can point me to a good guide on terminal basics or do a quick step by step, it would be muc

Although I know the settings are depreciated for Big Sur, I have a profile installed with Allow on the Media Restrictions section. This is because I still have Catalina machines in use however when I check the profile in System Preferences on a Big Sur machine, it shows Deny for all mount rules. I'm guessing this is why I can't mount any external USB drives. When I move the computer to another site that doesn't have that profile, I can mount USB drives again. Anybody know how I can fix this?

Hi,has anyone successfully deployed a fully licensed CorelCAD 2021? How did you do it?I've been trying for days, but I just can't figure it out. Thanks for helping!

Hello all, is there a way to clear all restricted software rules with a command line.when we want remove jamf on a computer we use "sudo jamf removeMdmProfile and removeFramework" but I'm not sure that the restricted software rules are removed.thank you

Good day everyone, I'm hoping that I can get a second set of eyes on this script. It is designed to check the status of Find My Mac, and works find locally, but it is erroring out when I run it through a Jamf Policy. Here is the script: !/bin/bash this script will check the status of Find My Mac. If it isn't running, it will end, otherwise it will execute the AppleScript below that fmmStatus=$() if [[ "$fmmStatus" = 0 ]]; then echo "Find My Mac Not Running" exit 1 else osascript -e "tell application "System Events" to display dialog "Hey there! IT requests you please stop using "Find My Mac" on this MacBook Pro as it has been found to interfere with our Mobile Device Management security settings.Please go to System Preferences > Apple ID > Find My Mac and disable the checkbox for this feature.If you have any questions please reach out to IT and we can help you out. Thanks!" fi exit 0 I receive the error message of -> Script result: 110:115: syntax error: A iden

All of a sudden when I log in to my jamf pro cloud portal with various admin accounts I only see the first two computers that were managed by jamf and the other 70-some odd computers are no longer showing up ... what could possibly be causing this?

Hi folks, Since I updated my MacBook Air to 11.5.2, I get an error message in Self Service.Jamf Pro Server cannot be reached. Everything else seems to continue working. Does anyone else have a similar problem?I'm using Jamf Pro Cloud. Thanks in advance,Florian 

Many of the MacBooks we purchased are showing as enrolled in Apple Business Manager and assigned to Jamf Pro but not showing up in Jamf unless we manually enroll or wipe them. Curious if there is something that we can do to ensure that we do not have to spot check these before sending them out to the user or if this is just a temporary situation as the inventory is relatively new. 

In my fleet there are a small handful of users that enabled the root account.This is the EA i use to determine it from someone on this forum#!/bin/bash rootCheck=`dscl . read /Users/root | grep AuthenticationAuthority 2>&1 > /dev/null ; echo $?` if [ "${rootCheck}" == 1 ]; then echo "<result>Disabled</result>" else echo "<result>Enabled</result>" fi My questions are:how can i prevent this happening in the future? right now its a small number of people but if word gets out it could be badsince the user's set up root themselves, i dont know the password to disable it, is there a way to get it resolved to disable root for users that have it enabled? Thanks! 

Hi everyone,I have created a script to rename computer name using classic API to get the device's site name and barcode_1 tag, however, it seems like intermittently it will fail for the script, usually, most of the time I see fail is unable to retrieve barcode_1 tag, sometimes it will fail at retrieving the site name. Can anyone have a look at the script and provide me some suggestions to improve as keep fixing the name manually is something I don't really want to do... Thank you so much#!/bin/sh jssToken='token for access' jssURL="https://your.jamfurl.com" serial=$(ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\" '/IOPlatformSerialNumber/{print $(NF-1)}') response=$(curl -X GET -s -H 'authorization: Basic\\'${jssToken}'' "$jssURL/JSSResource/computers/serialnumber/${serial}/subset/general") barcodeTag=$(echo $response | /usr/bin/awk -F'<barcode_1>|</barcode_1>' '{print $2}'); siteName=$(curl -X GET -s -H 'authorization: Basic\\'${jssToken}'' "$jssURL/JSSResource/compu

Hey there, I checked the boards but couldn't find a consensus. Does anyone know if custom scripts default to a certain working directory? I ask because I'm trying to gauge the importance of absolute paths when doing binary calls to the "jamf" or "scutil" binaries. If a shell starts in a user's home folder for these scipts, then theoretically if I were to make binaries called "jamf" or "scutil" that did less than helpful things (or daresay even malicious things), would that create a path vuln or does jamf know that aliases are called and defaults to whatever the system is set to previously? I know this all seems moot because the rule is ALWAYS USE ABSOLUTE PATHS, but as a curious mind and a infosec enthusiast I was just curious if Jamf had any protections for that already in place. Anyway, really loving this community of Apple nerds and look forward to the discourse. If this post is completely asinine or naive, I do apologize. I am but a poor script noob and am trying to learn

Using this workflow as a starting point:https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/I've set this up two erase a machine and install Big Sur. I have several applications set to install via a prestage enrollments which I'm testing. What's the best way to combine both the erase and install and then have Jamf run the prestage enrollment?   

We have a limited number of licenses and I have been advised to purge records of devices that haven't checked in for 90 days. I'm worried about doing that since so many of our users have taken to working from home and many have just taken the summer off.If we delete that record in JAMF Pro, will the record reappear if the device is turned on later? And, how will it affect the history like policy or computer management logs? The JAMF client is still installed.Does deleting a record affect the license count?  

Is there a way to extend the time that the JSS will log you out due to inactivity? I looked in all the links under Settings and everything under JSS Service and did not see this option anywhere. Is it possible to change this? If so, where is the setting? Thanks in advance.

Hello,We have 10k ipads to wipe.  Is there a way to wipe more than 100 per batch?  I am using the GUI from a static group (View, Action, Send Remote Commands, Wipe....) but it only seems to work when I try to wipe 100 or less. Thanks!

This summer we're finally moving to an Automated Device Enrollment/DEP-based deployment workflow for our Macs and we're wiping and reinstalling them with macOS Catalina. However on some of our Macs, after wiping, reinstalling and enrolling with ADE we are finding that some configuration profiles are not being applied (which is a big problem for us as one of these is needed in order for most of our software to get deployed correctly). On further investigation, when looking at the computer record in Jamf Pro of one of the affected Macs, we can see a large number of failed "Remove Configuration Profile (name)" commands with error "Profile with identifier (guid) not found, MDMClientError:89". With "name" and "guid" being replaced by a profile name and guid respectively. Obviously the profiles are not found because the Mac has been wiped and reinstalled. We found that we can remediate this by deleting the computer record before we wipe and reinstall the Mac but we were hoping

Self Service has been crashing for us ever since we updated to version 10.30.1. Seems to be whenever you go into or mouse over a column in the Browse section. If you click Home as soon as you log in, it stays running and continues to work. Just installed 10.30.3 a few minutes ago, ran policy so everything on my client end would update, still getting the same thing. I read somewhere that maybe having custom branding could be the issue? We have a banner set and a custom app icon set. Originally when it started doing it after updating to 10.30.1 I figured it would be resolved shortly with another update or there would be a discussion started as it seems to be an issue with the actual .app but I didn't see it mentioned in 10.30.3's release notes nor have I found any discussions really.

In my organization (Higher Ed) we do a bit of school branding on all of our systems. One being we set a custom background image at the login screens in our labs and classrooms. Did this in Mojave by making our image an heic extension and naming it Mojave then placing it in /Library/Desktop Pictures. In Catalina that directory moved to /System/Library/Desktop Pictures which you can not write to. I did find a way to do it via disabling System Integrity Protection SIP, making the change then re-enabling it. That is a lot to do on a few hundred machines. Does anybody have a better method to change that image or should I just forget about it? Thanks in advance.