We've started ramping up our iPad fleet and have set up a block of 80 for a classroom in 4 iQ 20 pclocs carts. The carts are connected one at a time initially to an M1 Macbook Air with an HP USB-C dock which provides network access to the wired network and several USB-A ports to connect the 2 cables from the carts. The Macbook is set up to provide Internet Sharing and Content Caching via the dock to the carts Each cart has 4 USB IQ devices - 2 at each end. I'm only seeing 1 at each end actually providing network. When I subtsitute a USB C Multiport adapter for one of those USB A cables from the cart I get both IQ devices on that end providing network. I'm wondering if this is a bandwidth issue for the dock or a limitation on the macbook. Our only other setup like this uses an old intel iMac connecting direct to the cart via the 2 USB A cables and there are no issues at all. Has anyone seen problems like I'm seeing? Have you found any docks that do work in

Hi Ive noticed that some of our machines start this new behavior that they logout after 30 min of inactivity and it sets itself automatically in security and privacy setting. I did not set this up and I can not find anything in the policies or in configurations. Had anybody else has this problem? Thank you,-Popak

My company has a new directive that our intranet page must open on every system at login. We do not have to change/set the default page to our intranet, but each user is supposed to get it at least once a day. Simple. I created an ongoing policy that runs at login that does one thing–Run command "open http://ourintranet" I did this so that it would open in the default browser for each system. It works like our management has requested–the intranet page opens for every user at every login. However, it opens Safari, regardless of the default browser the user has selected. Why? There is nothing in that command or otherwise in the policy to specify Safari. Our users have Firefox, Chrome, Opera, RockMelt and several other browsers. Many of them never launch Safari. I want this script to open the page in their default browser, not something I have (by matter of policy) dictated. Any suggestions?

Hi,I'm looking for an extension attribute that displays if the computer name is set to $serialnumber of the computer. The purpose is to run a rename policy to machines that has not $serialnumber as computer name.

Hi, Given the latest vulnerability in Git, does anyone have a way of controlling the version of Git effectively from within Jamf? I found an extension attribute from 2014 (https://gist.github.com/homebysix/501a3bc5144b77aecc0c) that kind of works but only takes the Apple version of Git while ignoring whether a user has a version installed via brew for example. I also wanted to know how you're handling the built-in version of Git, is there any way to disable it and force users to use brew instead?

Hello everybody, does someone have a idea how I can remotely add a folder of pictures to the desktop pictures selection? Appreciate any ideas/feedback, thank you.

Any chance there is an easy way to fix config profiles which failed to install on a number of machines without having to redistribute the profile to all machines?

Hi everyone, I have mashed together the following script to report a managed device's current LAPS password, which is stored as an extension attribute on the JSS. Unfortunately, when I run the script, nothing is returned (no errors either). #!/bin/bash apiUser="" apiPass="" apiURL=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url | sed 's|/$||') udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') extAttName=""LAPS"" LAPS_Password=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}') echo $LAPS_Password Does anyone know what may be going wrong here?

Hi everyone,I've followed this guide: https://www.jamf.com/jamf-nation/articles/649/creating-a-signing-certificate-using-jamf-pro-s-built-in-certificate-authority And i'm signing my configuration profile with this command:/usr/bin/security cms -S -N "JamfSign" -i ~/Desktop/Custom.mobileconfig -o ~/Desktop/Custom-signed.mobileconfig I don't get any errors when signing but when I try and upload the signed configuration profile to Jamf I get a "File cannot be processed" error. If I double click on the signed profile to test it on a mac I get an error opening it. Any ideas what I'm doing wrong? Thanks,

Hey all,We are having an issue where an 802.11x network we push in a profile is getting removed from the preferred list of networks and then it breaks the profiles ability to join said network. My solution to this is to find all the devices that are missing that network and then exclude, then re scope them to that profile, but I need some help with the scripting of the EA. We have 3 networks all named similar. Each includes the name or our district so its making it hard for me to grep the exact network I need from the list without pulling all 3 of them. Then I just need a result that said" has the network" or "doesn't have the network". Two things not working is the grep for the specific network name and the if section if the result is blank.Any help would be greatly appreciated! Here is what I have so far: #!/bin/sh ##Get the wireless port ID WirelessPort=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}') #

I have an attribute for "In Storage" that I have configured in all of our policies to not use. I was thinking it could be helpful for this to be set automatically to "Yes" during enrollment so nothing runs on the device in Jamf. We have several different static groups that get different configurations so ideally nothing would happen to a device until we assign it a group. There are some things that ALMOST everything gets that isn't scoped to specific groups but we would prefer these get paused until after we set which group it should be in. If there is a better way to accomplish what we are trying to do please let me know!

Until now, I've been content with deploying Malwarebytes for Mac via Self Service as basically a drag-n-drop install to /Applications. This new version that was released recently requires admin rights upon first launch to install a new helper tool. (What's the deal with all these new helper tools?) It looks like it installs /Library/PrivilegedHelperTools/com.malwarebytes.MBAMHelperTool and /Library/LaunchDaemons/com.malwarebytes.MBAMHelperTool.plist I guess we'll have to roll these along with a launchctl command to enable the LaunchDaemon in any updated policies. Does anyone know what these PrivilegedHelperTools do?

Has anyone had any luck with getting the new Malwarebytes for Mac 3 menu bar item hidden from a policy or script? Been digging through the Application Support and Preferences for by the OS and User, and can't seem to find anything that changes if you check or uncheck the "Hide Application Icon" in the Malwarebytes settings. Thank you for any help you can provide!

Hi all, my company has decided that we will be putting malwarebytes on all mac computers. I have been doing some searching but have found very little detail about it. I have found the following kernel infoGVZRY6KDKR com.malwarebytes.mbam.rtprotectioncom.malwarebytes.UserAgent What I have not found is any PPPC information. It does not have any permissions showing up under Security & Privacy. Has anyone had any recent dealings with malwarebytes? is there anything I am missing?

Hi Everyone, I confess it's been a minute since I've worked in Jamf in this capacity, but as far as I know I've done things right. I built 3 packages from .app files using Composer (i.e. dragged them from my Applications folder into Composer as sources, created packages out of them, uploaded & categorized them in Jamf Pro). I created a policy to install them, scoped it to the targeted test computer, and ran a sudo jamf policy from the test computer's end. The command appears to execute fine, doesn't throw any errors. But when I go back to the Applications folder of the test computer, only 1 of the three applications (Gimp) is there. I'm not understanding what's going wrong and it doesn't seem like there's an obvious error code anywhere! Below is my relevant /var/log/install.log data Can anyone help me figure out what's going on? 2021-03-22 14:00:38-07 RCHSGRAPHICSLAB19m installer[4237]: Product archive /Library/Application Support/JAMF/Downloads/Blender.pkg trustLevel=100 2

I Tried to wipe a Big Sur machine, expecting it to re-install the OS and connect to MDM. The 6 digits worked. it rebooted to the no entry sign. An internet recovery didn't work (both with newest release keypress and default release - it was orignally a Sierra machine). In the end the only option was a USB bootable Big Sur re-build. It did rejoin the MDM correctly though. Anyone else seen this - is this how it's supposed to function? Seems odd.

I'm trying to get some profiles on my VM's, running on a esxi platform. when i make a empty profile at system level it get's pushed fine to my "regular clients" MBP etc. the profiles never appear in my VM's. i tried to jamf removeMDMProfile jamf manage on all VM's i have the MDM Enrolment profile so it seams they get pushed like they should.the VM's are in the same subnet as my other clients so network issues are unlikely.the following telnet tests are fine. telnet 1-courier.push.apple.com 5223 telnet gateway.sandbox.push.apple.com 2195 telnet gateway.push.apple.com 2196 i'm at a loss, i see no reason why it shouldn't work. who can help?

Hello friends I'm trying to make a script to change the user password of about 200 machines and I'm not getting it, what I have so far and this !/bin/bash unset HISTFILEdscl . -passwd /Users/username newpasswordsecurity set-keychain-password -o oldpassword -p newpassword

Hello everyone, I'm new to Jamf management and I'm wondering if the following scenario is possible. I'm able to deploy Symantec Cloudsoc and WSS (Web SercurityService) via jamf. The issue I'm having is with completely automating the Cloudsoc/Wss agent installation. We don't want users to have the option of not clicking the "allow" button in system and preferences -> Security & Privacy -> General tab. We would like to eliminate the possibility of users not completely installing agents on machines. I haven't found a way to bypass this issue and currently stuck, any guidance would help

We have enrolled more than 40 Macs using QuickAdd package and they all have worked fine. One of the Mac has installed the MDM profile but it is not installing the configuration profiles and also the MDM Capability is No. We have setup smart groups for configuration profiles which just pick up the Macs right after the enrolment but in this case its not working even after Mac was left overnight. Any suggestions.

Hi all, I have been getting a headache with patch management. I have tried to update adobe acrobat reader, and google chrome on two different machines. I have downloaded the recent update from the 3rd party site as well as from jamf's 3rd party product site. I click the patch in self service and I either get "error" or "finished" but upon inspect the version, it failed to update and the patch reappears in self service acknowledging the out of date software. I called jamf support and they told me they weren't able to help at the moment and opened a case. Has anyone else experienced this? And can someone please help??

I've spent days trying to figure this out.If I run the command below as standard user, from terminal, it works just fine:mount_smbfs //username:'password'@server.corp.local/subfolder/another%20sub%20folder /Volumes/SOP/We have some files that are constantly changing on a windows share. To add to the headache, the path has whitespace within it.The Macs that need access to it aren't on domain (legacy application hold up).I'm just trying to provide the users access to the share from the desktops and the script should run on login.I'm running another script prior to this one, which creates the folder on the volume (/Volumes/SOP) with correct permissions to the folder and it is successful.Here is the script that throws the error in the subject line of this post: ############################ !/bin/sh currentUser=$(ls -l /dev/console | awk '{ print $3 }')True_Path=//username:'password'@server.corp.local/subfolder/another sub folder/usr/bin/su $currentUser osascript -e 'mount_smbfs "'$True_

Is anyone deploying Xcode through the 'Mac App Store Apps' option with any success? Our one app development class uses Xcode on the computers then tests on their iPads so I need to make sure the versions match for this to work. Previously I had been downloading Xcode and deploying manually but this is somewhat time consuming. Then if the iPad app updates that causes issues until I can get the computer app updated again. When trying to install Xcode from the App Store through Self Service it fails, but I'm not able to find anything in the logs about why it fails. When trying to install it this way with Xcode already installed, the app itself opens but it doesn't seem to be updating to the latest version. Anyone else having similar issues? I've deployed plenty of iPad apps this way without issue so I can't imagine it's that different.

Looking for some help on this one. I received a list of extensions to block from my Security team. That is all fine and dandy since I can add them to the "ExtensionInstallBlacklist", which, will prevent users from installing them. However, in testing this, I found that if it's already installed before I send out the config profile it doesn't do anything with that extension. I tested this by installing Adblock Plus (cfhdojbkjhnklbpkdaibdccddilifddb) on a Mac. I then deployed out the config profile and found Adblock Plus was still there and functioned correctly. I even closed and reopened Chrome. If I remove Adblock Plus manually, then, try to reinstall it, then, then it is blocked from reinstalling with the profile in place still. Has anyone found a way to disable and/or remove already installed Chrome extensions via configuration profile? I even tried the "BlockExternalExtensions" setting but that did nothing. Thank you in advance!

So I'm configuring some Default User Template LaunchAgents to configure a default screensaver for some of my company's most popular fan art. (It's actually been really well received by the team). They're designed as first-run images when they log into their forced-Local Active Directory users. However, I'm getting very inconsistent results now...namely it's not working at all. The .plist launches a Shell Script located in the /sbin/ folder. The odd thing is that it mostly works in an existing user. The screensaver is meant to use "Flipup" with a specific folder of images, shuffle the pictures and set a start time of 5 minutes. For example, I intentionally set my "default configuration user" screensaver first to the "Holiday Mobile," set the picture selection to "Cosmos" (one of the defaults) with a start time of 20 minutes and unchecked "shuffle images." Then I changed it to "Arabesque."