Hey All,We just had a successful roll out of a one-to-one with MacBook Airs and I wanted to share some of what really worked for us. We started with imaging, which we use DEPNotify to prompt to name the computer and then run the installs for base software. (We asked Apple to setup our order but they had so many issues and delays that we canceled their setup and ended up setting up close to 2000 on our own using labs and our office, along with 100 Belkin ethernet adapters, and we ended up being able to image from 200-300 a day ). Our base system has Chrome, Firefox, Cisco Umbrella, Zoom, Adobe Creative Cloud (just the desktop app) and Microsoft Office Pro installer. I also install DockUtil and Desktopr to set each desktop and dock as they logged in. The last prep work I did was create a ton of TCC profiles to allow my various scripts and applescripts to work: We then had handouts where we kept all the machines on wired connections for the first login (still binding, dont ask) an

does anyone have this enabled in a policy ?does it actually work? Perform authenticated restart on computers with FileVault 2 enabledRestart FileVault 2-encrypted computers without requiring an unlock during the next startup so basically you have an encrypted mac, it's running a policy that requires a restart (software install policy, OS X update etc..), so when the policy 'restarts' the computer, the computer will bypass the 'encryption login lock' and go directly to user login screen ?

Hello there, I was wondering if there is a way to convert Mobile accounts from Open LDAP (Mac Server OS) to local accounts as I noticed that some of my users are not getting all policies/configuration profiles to work right and I assume its because of this. Thank you all. EDIT 1: Solution in comments below.EDIT 2: Once we removed the "mobile" from the accounts everything worked out fine.

Hi all, I'm having issues updating the DEP Token in the JSS. I always get the Error Message "Invalid results returned from Apple Service. All the Terms and Conditions are accepted, Time on the JAMF Server is correct. Does anybody have i hint to what is going wrong here? Any help appreciated.

I'm charged with standing up Jamf Pro on-prem and I need help understanding how internal Root and Intermediate certificates get deployed. Do these certificates have to be manually uploaded to Jamf Pro then distributed via configuration profile, or is there a way to do it via the AD CS connector? Thanks for the help.

We have a config profile with the setting "Restrict App Store to MDM installed apps and software updates" checked. On computers that only have Managed Distribution VPP apps, we're still getting a notification that there is an app that needs to be updated. When clicking on the notification, the app store is unable to open (as is desired). Is there something we can do to prevent these app store notifications?

Hello Team! We have some MacBooks which weren't added in Apple Business Manager( and as a result, in PreStage enrollment scope) and we used user initiated enrollment to add their MDM profile in Jamf pro. We managed to add them to the apple business manager later. The thing is, I want to check the "Automatically assign new devices" for PreStage enrollment so that when we buy new MacBooks, their enrollment would be automatically through that. But I'm afraid maybe it affects the previously bought MacBooks and erase their accounts. I wanted to know if that's the case, or it just affects the new purchase. As a general question, if a MacBook is being added to MDM using user initiated enrollment and and then being added to Apple Business Manager (and Jamf inventory, after the enrollment), does checking the "Automatically assign new devices" affects on that too or not (makes it go through PreStage enrollment or not).

Has anyone created an extension attribute to see if the McAfee Agent is managed or unmanaged? Originally i had made one looking at /Library/McAfee/cma/scratch/etc/log since it usually lists if the agent is managed or unmanaged there. But that log rotates out and may not have the necessary line always. There is also a SiteList.xml which lists all of the repositories, but i'm not sure if that is the best measure to know if a client is successfully managed or not. Existence of a keystore could be a possibility also... Any other locations to look at for the extension? Thanks

Just wondering if anyone else is seeing a crash when doing a full scan with Microsoft Defender? It momentarily pops up a message: "There's a problem with this App." The link in the message just takes me to the Microsoft Support Site, not to anything specific The message disappears and the app is reloaded. I can do a quick scan with no issues. OS is Catalina. I'm just in test stage so have only tried on two machines so far.

Stopping Mac OS Update notifications any suggestions on how to do this process?

First, thanks to @rtrouton for bringing us the Privileges app. I'm trying to set the Dock Tile Timeout time via configuration profile, using the "DockToggleTimeout" .mobileconfig sample from GitHub. So far I haven't gotten the configuration profile to apply the setting. I discovered that changing this setting from the Privileges app reflects in the corp.sap.privileges.plist in the user's profile (specifically in UsersmyuserLibraryContainerscorp.sap.privilegesDataLibraryPreferences), and so I changed the configuration profile to apply at the User level instead of Computer. However once the configuration profile was applied, the .plist file was not changed to reflect this change. Any thoughts on what I might be doing wrong? This seems like it should be fairly straightforward.

Hi Everyone As you may or may not know, Microsoft is ending support for Office 2016 for Mac on October the 13th 2020 (see link below). At our company everyone has an Office 365 license, and all new Macs are deployed with the Office 365 version, however there are still a lot of users (we believe) that are still using Office 2016. I would like to create a report of which machines are still running 2016, but as 2016, 2019 and Office 365 confusingly all seem to have the same version numbers, this is proving rather difficult. My question is- does anyone have a clever way of differentiating Office 365 versions of Office from 2016 and 2019 in a search or a Smart Group? Thanks! https://support.microsoft.com/en-us/office/end-of-support-for-office-2016-for-mac-e944a907-bbc8-4be5-918d-a514068d0056#:~:text=Support%20for%20Office%202016%20for%20Mac%20ended%20on%20October%2013,will%20you%20lose%20any%20data.

When changing a port number assigned for Healthcare Listener incoming communication of the ADT message. After changing the port in JPS (jamfcloud), and verifying (/etc/jamf-im/hcl/com.jamfsoftware.hcl.properties) on the host running jamf-im, after the next sync. We did not see messages delivered to JPS from listener. Should the Infrastructure Manager host (running Healthcare Listener) be restarted? There are no restart/reboot recommendations or a section on best practice when changing the port assignment in the documentation.

A few weeks back Apple released a supplemental update (2020--005) for macOS Mojave then quickly pulled it because it was causing issues. They then fixed it and released it again. Regardless if a computer had the faulty or the fixed update, the system build will be "18G6032". I'm trying to populate an EA using Data Type = String and Input Type = Script. I will then create a SmartGroup that I'll be able to identify computers that need the new Supplement update AND that are on the 18G6032 build. Here is the script I'm using for the EA: #!/bin/bash if /usr/sbin/softwareupdate -l | grep -q 'Supplemental'; then echo "Present" else echo "Not Present" fi If I understand this correctly, I'm using the "softwareupdate -l" command to list the available updates and if the word "Supplemental" is found/not found it is supposed to populate the EA with Present or Not Present. When I run this from ARD to a remote computer it is working fine however when I put it in an EA, the field is bl

We are attempting to create an enrollment invitation to connect a few iPads purchased outside of our DEP agreement, but every attempt ends in failure. The result is always "There was 1 error sending invitation" with the status "Failed to send invitation". History doesn't show anything. Some previous posts direct to a resend option but I cannot find it. Anyone else having this issue?

Hi, Has anyone seen any permissions issues with API updates of computer records since upgrading to 9.81? We have a pre-existing script that changes the status of an extension attribute for a computer record. It seems that since we upgraded to v9.81, this has ceased working. The most useful part of the API output seems to be the line: <p>Error: Not authorized for a user PUT</p> I have checked the privileges for the API user and there seem to be 2 newer privileges: Computer Extension Attributes & User Extension Attributes. I have allowed Update for both of these (along with update on Computers already set), but still no joy. Any thoughts?Dan

Working with DEPNotify, and I'm wondering if you can have multiple prompt windows. Right now, We're limited to two text fields (right now, owner and asset tag), and 4 popups. I think I need one more text field (room number)... So was thinking of having multiple windows. Would be nice to start with just asking "Purpose" and Asset Tag (computer name is derived from asset tag). Purpose would then determine what info was asked on next "window". If it's a lab machine, we wouldn't ask owner, we'd just ask Department, Building, and Room. If it's a user machine, we'd also ask owner. Is this doable? Or should I start looking at Splashbuddy?

Hello everyone! I am looking for an easy policy to remove avast.. Thinking if someone has already scripted this out or figured out how to run avasts app without user interaction. The goal is to, remove avast before installing symantec and in the end, set a policy to remove avast if Symantec is installed for those that may be missed somehow. Thinking I can get my own script figured out, but wanted to see if others have already figured this one out. Thanks!

Hey Folks, I read all the depNotify posts here and followed along. My depNotify is working fine, same as my starter script. Here is what I did: Based on this guide ( https://github.com/jamf/DEPNotify-Starter#configuration-within-jamf-pro) I did following steps in our jamfPro:  1. I uploaded the installer package called DepNotify-1.1.5 according to the link above  2. I created the script called as the depNotify Starter  3. I created a policy and associated my package and script to that  4. I scoped that policy to our test computers. Everything works fine and the app starts right away once test user logs intp the mac in question. The problem/question for me is, how should I specify in the script which apps/policies are running at the moment? I found POLICY_ARRAY in the script and whichever I put there in the format of policy_name, id it gets displayed in the prompt for the test user. Should I add all policies(that mac is supposed to

Hi, justs starting down this Intune path. On a several test macs, I get the following error when I run the Self service policy to launch the Company Portal App and register the machine: Registration with Intune failed.Run the item again, ensuring your computer is connected to the internet. If you still cannot connect, contact your IT department.Details: Microsoft's Company Portal.app is not installed. The App is installed but the policy clearly it thinks it is not. The app was installed by downloading from the link provided on the macadmins page and then installed. Visually I can see it in Applications folder I'm using the macOS Intune Integration policy item for a self service policy Regarding Intune Integration - Conditional Access has been set up in Jamf Pro. Heartbeat is happening, a test of the connection works and also I can force the inventory to upload. Just wondering if anyone has seen this before or has any ideas?

Hi everyone, we need to see which apple id is being used on every device we have enrolled in jamf. For this I've created an extension attribute that seems to work but only for a few hours. I don't understand why but after a while it goes from this: to this: and if I run a sudo jamf recon it goes back to normal for another while but after sometime it keeps going bad. this is the script that I'am using: !/bin/bash appleid=$(/usr/libexec/PlistBuddy -c "print :Accounts:0:AccountID" ~/Library/Preferences/MobileMeAccounts.plist); echo "<result>$appleid</result>" exit 0 Do you have any suggestions or ideas about why this happening? Thanks in advance ps: I am pretty new to mac and jamf

I have a question regarding scripting. I'm trying to build a user account in an educational lab environment that's easy for some of our students to sign into that subsequently removes their data on logout (a la Deep Freeze). It warns the user this will occur and although I could just use a Guest account I'd like to try this first. I've accomplished most of what I'm looking to remove (though if I'm missing something please bring it up) but I can't find an answer to my issue in the forums. I can't seem to remove Safari data from session to session. This is the part I need help with:Any combination of the following commands (whether I insert into Files & Process or into Scripts after my other one) doesn't seem to have any effect and I'm not quite sure why: sudo bash -c "rm -f /Users/student/Library/Safari/History.db"; sudo bash -c "rm -f /Users/student/Library/Safari/LastSession.plist"; sudo bash -c "rm -f /Users/student/Library/Safari/HistoryIndex.sk"; sudo bash -c "rm -f /User

Update: September 23, 2020Today we are making a new release of Jamf Pro available to resolve issues impacting Volume Purchase Program (VPP) and mobile device management (MDM) functionality, including license assignment errors and hanging MDM commands. Your instance will be upgraded directly to 10.24.2 during your cloud upgrade window, as outlined below. /// Hi Jamf Nation, We are excited to announce that we are prepared to deliver same-day support for Apple's new operating systems as they become available! This release also includes a number of enhancements to user provisioning, enterprise workflows, and security and privacy. Read the full release notes here. Garrett Cloud Upgrade ScheduleYour Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.24.2 based on your hosted data region below. Please note: your environment will be upgraded directly to version 10.24.2. Because we know that same-day support for new Apple operating systems is

After upgrading a couple of Macs to 10.15.7, I can now log in using my password when I unplug the Smart Card. I ensured the configuration profile with the payload to "Enforce Smart Card Use" is still installed. Now with the 10.15.7 update, I can unplug the Smart Card (screen saver kicks in) and log in using a password or Touch ID. Macs prior to 10.15.7 were fine, including Mojave, High Sierra. Anyone else seeing this?

I was directed to this web link: https://macops.ca/disabling-first-run-dialogs-in-office-2016-for-mac but when i look under /Library/Preferences/ I do not have com.microsoft.Word (excel,ppoint) but i have it under ~/Library/Containers/com.microsoft.Word/Data/Library/Preferences/com.microsoft.Word.plist am i supposed to add each of the .plist (word,excel,ppoint) to /Library/Preferences/ ???