We've got some security software that only consists of a single binary in /sbin and a launch daemon in /Library/LaunchDaemons Some of the installs were done by our security team manually (outside of Casper) and I've been asked to make it deployable. I need to make a smart group to manage which computers don't already have it and to make sure the software isn't re-installed on top of an existing install, but I can't figure out how to set criteria to look for the presence of either of those files. Does anyone have any pointers? (yes, I realize that this software won't work in El Capitan because it installs to /sbin, but we're waiting several months before upgrading anything)

I have configured passcode enforcement settings in my configuration profile, but the device does not seem to require me to change the passcode upon authentication, or during the initial setup.

Hello, I have been struggling with this error since our Jump Start. We have a service account that is to bind devices to our AD upon enrollment. Every time, both via policy or by going to user preferences I receive this error. My AD account works to bind the devices in User Groups but the Service account receives (plugin encountered an error processing request 10001). The service account CAN bind PC's to AD. Domain is NOT .local Computer name is under 15 characters.

I've been trying to distribute backgrounds to the M1 Macs for days. but unfortunately these M1s behave completely opposite to the Intels. Log says "Completed" but on the M1 is only a blue background instead of the distributed background. all Intel Macs have the new background loaded. I have tried both ways as PKG & DMG both are successful on the Intels, but not on the M1. what am i doing wrong ?

Hello,Is it normal to need to reinstall Jamf Connect after a macOS upgrade in order to get the Login component working again? It seems that after upgrading from Mojave to Catalina, or even applying an update in the same OS, that the Jamf Connect Login stops being active. The config is all still there, and the Jamf Connect app is still there in Applications, but the Mac goes back to the normal "bubble" login as opposed to our Google login. We have to then login and reinstall the Jamf Connect package to get the Google login back.Is there some way to get this automated?Or do we have some incorrect configuration?Thanks for any information you can give,Tim

After coming back from spring break on Monday and finding 5-6 people who left their MacBook Air unplugged and on, I found myself with users who couldn't connect to the 802.1X because of date and time issues. The users do not have admin rights. Nothing like setting the clock manually for people and rebooting. I decided to try tackling the problem in the form of a script. Said script would be triggered at login on an ongoing basis (in offline mode as the JSS itself may very well be unreachable at that point). It would be scoped to an all MacBooks smart group or any other relevant targets that the admin sees fit. It would work something like this below. I was actually able to find a file whose date is updated but otherwise not changed by the end user in the form of the XProtect definitions bundle. Any feedback or enhancements are welcome. I've tried it out on a computer by manually setting it's clock backward and it does seem to work. I haven't actually tried it using my JSS though. Ho

Hi guys I'm trying to get our Macs a bit more up to date and uniform, since they've gone virtually unmanaged for quite a while. I made a policy to install software updates from Apple's software update server. The restart option is selected to restart if a package or update requires it, and the user gets a restart message with the specified delay before the restart. Is it possible to give the user the option to delay this restart? For example giving them a message with the choice between 'restart now' and 'restart later' (with a later time specified).I know I can allow users to defer the policy, but is this possible for the restart as well? Thanks!

Just starting with Jamf Cloud. We have an On Prem file share DP which we intend to use for people on site so that's the Principal Distribution Point. Would the best way to make use of the Cloud DP be to make it the failover for the On Prem DP? That way if a machine can't reach the File Share it "should" fail over to the cloud one e.g. in the case of machines outside our network.

We are new to jamf and we started with the trial version of jamf pro. I saw that there really wasn't much I could do during the trial so we purchased the product. I activated the license, downloaded Jamf Connect installer but it's still in trial mode. I cannot figure out how to get the license info registered with the paid version. Is this built into the installer or is there an import feature. The CS group gave me a Dropbox of the files but there is no README. Could use some assistance. We scheduled a 1pm call with them as we really need to get their help getting this off the ground. Thanks in advance!

We use pre-stage enrollments to setup new Macs. One issue I've run into is with our CA Certificate for our Wifi network. If it installs before the Mac is bound to the domain it doesn't work. I have to remove the configuration profile, join it to the domain and then re-add the configuration profile. Is there a way to not let a configuration profile install until the computer is bound to the domain?

Does anybody know if there is a way to get a notification or email when a device is unenrolled? I know there is the webook feature, but is that the only way to get notified?

We use an S3 Cloud Share for packages that we can't install using scripts, and Jamf Pro running in AWS as well. We are now in the middle of starting to roll out Big Sur and would preferably do this through Self Service as our users are not administrators. Due to the size of the package (around 11-12gb), we couldn't upload the package through Jamf as we get an error message each time when trying to upload it. Therefore, it was uploaded directly to S3 and I can see the package there along with our other packages. Is there a way to make Jamf see this package as well? Currently I can see all packages but not that one. Unfortunately as I said, uploading it through Jamf itself or via Jamf Admin results in an error.

So I just today deleted the (legacy definitions) for Slack and Zoom in patch management. But the new ones are not populating at all. I also switched to the new definition for Firefox and chrome. Those are working properly. Has anyone seen that issue should I just go back to the legacy definitions?

I am trying to set up a VM to test JAMF Connect using Parallels 16 and Catalina. I have set up the VM to use the boot flags, devices.smbios.serial="C01VG0EFHGFVB"devices.mac_hw_model="MacBookPro15,1" The VM will enroll via the /enroll URL and show up under computers, it will then get the CA and MDM profile. Both of which show as verified. The computer record shows it as enroll but not managed and no other profiles will come down. If I run JAMF manage, it tells me the MDM profile is not approved. If I got back into the profiles pane. It is now unapproved. I have no idea how to fix this, I have never had an issue like this. Any Ideas?

We are replacing our fleet of classroom iPads with newer models.The new iPads have all been loaded in via DEP, and placed into PreStage Enrollment groups for each year/grade level. How do I get the new ones all going before unmanaging the old ones? Won't I exceed our Jamf Device Count? The plan had been to decommission all of the old iPads, then start up the new ones, allow them to enrol themselves and place them in the appropriate classroom.However, the delivery didn't arrive until after the holiday period and now we're faced with having no iPads for days while we roll over the new ones.

Hi, I have an app that I am trying to install, and I want to provide command line parameters for the install. I don't see an option for providing command line arguments in. JAMF Pro configuration sudo securityagent.pkg --key=XXX --env=XXX

I'm working on a script that is initiated through Self Service and Startup (ongoing). I want the script to know whether it was initiated from Self Service or if it just ran because of a restart. Right now I have the script detecting whether Self Service is running when the script starts which seems to work well, but I don't want Self Service to open up as soon as a user logs in and accidentally start the script. My question, is there an easy way for the script to know if it is being run from Self Service or not? Additional Information:I found that a process starts when a policy is run through Self Service called "JamfManagementService", but if I run pgrep "JamfManagementService" inside of the script, it doesn't find anything. If I run this same script through Terminal while a policy is running through Self Service it finds it every time. I'm not sure why this process can't be found when run from inside the policy, I think this would be the best way to resolve this issue if I could

Maybe I'm missing something really simple, but how do I access the global address book for my active directory in the "New Outlook"? An easy way used to be clicking the button next to the "To"/"CC" fields, but that's missing now:

Hi Everyone - I've been struggling with a computer for a good portion of this morning. I'm trying to push an app from the Mac App Store and have it assign VPP content to the computer. I've tried everything I can think of, including removing the MDM profile, re-reconign, sudo jamf enroll, etc...... and yes turning it off and back on again. Here is the full error: "VPP redownload call timed out <MDMClientError:72>" It just seems strange.... I tested pushing this app to another computer and it works totally fine and assigns the VPP content as it is supposed to. I tried looking this error up online without any luck. Does anyone have any ideas or suggestions for moving forward? Thanks!

I have about 100 M1 MacBook Airs to deploy and am working on my PreStage enrollment. Is it necessary to wipe and reinstall each time I want the ADE to run? In other words I make changes to the PreStage and fire up a MacBook - something doesn't work right, I make a few tweaks to the PreStage and want ADE to start over. I remember doing this a few years ago, not sure if it still valid given SIP, etc sudo rm /var/db/.AppleSetupDonesudo rm /Library/Keychains/apsd.keychainsudo rm -rf /var/db/ConfigurationProfiles/ thx

Hello all! We are doing a macbook refresh this summer and I am trying to figure out a way to wipe our current computers for the company buying them. I've done this before by utilizing the --eraseinstall function of the OS installers. However, the company we are using this time just wants them wiped, no OS needed. So essentially, the function of the Wipe computer command in Jamf would be perfect and save a lot of time from having to put an OS installer on the macbooks and wait for the erase install to finish. Unfortunately, this command is not available as a mass action. I'd prefer to not have to go into each computer in Jamf and do the Wipe command one at a time. I'd love to be able to avoid the eraseinstall method if possible. Is there another way to do the computer wipe as a mass action? Anyone have a different method of cleanly wiping 100's of computers quickly? Thanks in advance.

Hello Everyone, Does anyone know of a way to spec out a smart group that looks for the existence of a folder? For instance, if a directory such as "work" exists in /Users/Shared I can find all of the computers where this folder exists in /Users/Shared/work. I cannot find any criteria that seems to match up to this. Thoughts? Thank you as always!! Mick

I need help fixing a problem in a script that is supposed to trigger an osascript notification whenever a user tries to connect to a banned SSID. The notification should only occur when the user is either already connected or is trying to connect to one of the banned SSIDs. I though the problem was due to the fact that the script is being run by launchd, and so is running as root, however, even after running the notification command as the logged in user, no notification occurs even as the rest of the script works fine. Secondarily, we are also unable to remove credentials for a banned SSID from the local items keychain, but as is, the script has the desired effect of kicking the machine off a banned network if connected and preventing the machine from automatically connecting in the future. We are able to remove the credentials from the System Keychain, but it would be nice to find a way to also remove the item from the Local Items keychain as well. Anyway, the main issue occurs at

All,I'd like to install our wireless certificate on a group of managed Macbooks. The certificate is a valid third-party certificate and is required to connect to our 802.1x wi-fi. I'd also like to set the trust settings so the user doesn't get prompted (The users will not be admins on the machine so they can't trust the cert.) I tried using Configuration profiles in JAMF and deliver the certificate, the intermediate, and the root. that works, but the user gets prompted each time they connect as the trust settings are default. I found some articles on this site suggesting to do this task with a Composer package instead and using the 'add-trusted-cert' command. My question is:1. Is using a package still the best way to install a certificate with trust? Or is there a better way. I've never used Composer so I'll have to gain some skills.2. Is this normal behavior for a Mac to not trust a trusted third-party certificate? I've always tho

We've started ramping up our iPad fleet and have set up a block of 80 for a classroom in 4 iQ 20 pclocs carts. The carts are connected one at a time initially to an M1 Macbook Air with an HP USB-C dock which provides network access to the wired network and several USB-A ports to connect the 2 cables from the carts. The Macbook is set up to provide Internet Sharing and Content Caching via the dock to the carts Each cart has 4 USB IQ devices - 2 at each end. I'm only seeing 1 at each end actually providing network. When I subtsitute a USB C Multiport adapter for one of those USB A cables from the cart I get both IQ devices on that end providing network. I'm wondering if this is a bandwidth issue for the dock or a limitation on the macbook. Our only other setup like this uses an old intel iMac connecting direct to the cart via the 2 USB A cables and there are no issues at all. Has anyone seen problems like I'm seeing? Have you found any docks that do work in