I would like stop users from upgrading to 10.15.4 due to these warning messages coming up for legacy system extensions. Currently users are admins on there laptops and we don't have a separate Software Update Server. What's the best way for to do this and give them access back again once software providers have updated their software.

Hi Folks, Just a simple heads-up. If you have multiple domains, make sure to use port 3268. Reason is this is the Global Catalog that contains ALL information of the forest in read-only. You need to know which Domain Controller is your Global Catalog. Ask your AD administrator. This should solve some issues like:- queries taking very, very long (had 20+ seconds, now less than 1 second)- don't get all group memberships (remember, you need universal groups)- Wilcards not working properly -- Was seen by @Serge My example: See you.

I've tried as root, still blank. No updates found from the update server when I do softwareupdate -al. Package receipts from the following command show it is up to date. Does anyone know where the command softwareupdate --history pulls its data from? I'd like to remove it and see if it re-populates, at least the latest patch, after the next patch cycle. I use the results from this command to populate the 'latest os/security update installed' to a field in jamf via extension attribute. Currently this system shows blank in that field on the JAMF Pro server as a result. for i in `ls /System/Library/Receipts/*.plist`; do defaults read $i | egrep -i "(PackageIdentifier|InstallDate)"; done InstallDate = "2019-07-24 18:25:21 +0000"; PackageIdentifier = "com.apple.pkg.CompatibilityNotificationData_10_14.16U1819"; InstallDate = "2018-11-21 14:17:06 +0000"; PackageIdentifier = "com.apple.pkg.Core"; In

Hi all,I think this is not possible but smarter minds may know a way...A T2 Macbook Air was activated and enrolled using DEP, then the record in jamf was deleted.Can this device be re-added to DEP without wiping the device?

Hi all, I need to disable the following restriction: Allow USB accessories while device is locked I can find it in Apple Configurator but not when setting restrictions in Jamf Pro.Is it true that you can't set that setting using Jamf Pro?

Does anyone know how I could use a Smart Group to pull in software that is installed that isn't listed in Applications? This is for Palo Alto Traps. I'm trying to capture devices that don't have it installed. I'm thinking that I might need to add something to the installer that creates a "dummy" entry in Applications and report on that. Let me know what your suggestions are. Thanks!

I am trying to prevent our users from turning on content caching, yet when I use either Restrictions or the Content Caching payload it still allows the user to enable Content Caching. I am able to set the cache size to 1 byte, which I guess effectively disables it, however I'd like them to be unable to even check the Content Caching box in the Sharing Prefs Pane. Any ideas?

We have screen share setup and it works flawlessly if the computers are on our internal network but I can't seem to get it to work at all if they are remote (i.e. working from home) I can see the systems on Jamf Remote and confirmed the IP's are correct but after it says Creating SSH connection to their address and then again to another IP address the status section just goes blank and nothing ever happens. Am I missing something for the remote users? We have both Remote Login and Remote Management turned on for All Users. The last user I tried with was even on our VPN and still nothing.

Has anyone managed to get this working? I used PPPC Utility to make the Profile as per the KBs below on Sophos website: https://community.sophos.com/kb/en-us/134552https://community.sophos.com/kb/en-us/134686 The policy successfully deploys to scoped machines but I still get the alert to grant Full Disk Access Sophos is not automatically granted Full Disk Access in Security & Privacy What am I doing wrong?

Hi everyone!Starting our 1st week of remote learning and so far JSS has been invaluable for us. 1 issue I can't figure out. I have 1 iPad (at 13.3.1) that a user is trying to install and app for. JSS says the app is installed, but the app is not actually on the ipad. I have done a hard reset of the ipad, multiple inventory updates, blank pushes, reset network settings, reset all settings. Since the user is at home, I would like to avoid a full wipe and re-setup but maybe that is all we can do at this point?

Hey, I've got a problem with a Macbook,I have a home office employee who needs an admin account. How can I upgrade his default user to an admin with Jamf levels? Or can I create a new account via Jamf that is an Admin User?

Hi, I created a Configuration Profile for my Machines that would enforce, that Group XY and User ZZZ are denied at login. (Configuration Profile -> LoginWindow -> Access Tab -> Deny )The Profile got distributed and i can see it on the Machine.But I still can login with Users in the Group aswell as with the User is explicitly denied.I use OSX 10.10, with an Active Directory on Server 2012 level.We have CasperSuite 9.63 running at our site. Can anyone help me how to deny some accounts via a Profile - or do you have similar Problems doing that with Profiles? Best regards,bofh

Let me first qualify this question with the fact that I am not as proficient on the iOS side of JAMF as I am with macOS and only manage a couple of handfuls of iOS devices. I have a small group of users that have managed iPad Pros. They are having an issue where they cannot access Local Files (PDFs in this case) unless they are connected to WiFi. The same issue occurs with external USB drives via a dongle. I could swear there is a setting somewhere that allows/disallows local storage but I am having a brain cramp as to where that setting is and I currently do not have an iPad here at my new home office to test or try to reproduce the issue with. I am inclined to think that the files are not stored locally, or at least I was until they also tried to access them on an external drive. I am sure this one is simple, but I cannot summon enough search term magic to find it. TIA, /randy

Hi All, I am trying to create a smart group of all the virtual machines I've enrolled, but I'm not able to identify an attribute to filter on.

Hiya all, I'm starting to poke around the iPhone management stuff. I tried to get Request Signed CSR Automatically through JAMF Nation through my jss and have enter my user name (me) and the password with my jamfnation account, which I of course know. But afterwards, my jss spits out "Your JAMF Nation account has not been validated" Whom should I contact to get me validated? Thanks in advance

https://techcrunch.com/2020/04/01/zoom-doom/ Any validity to this article? I'm just a tad hesitant, considering it was posted on April Fool's Day, and no other article has been written regarding this exploit. If this is real, and it hasn't been patched yet, what are our options?

Hello all. I have created a policy that pushes Mojave package to a device. I created that package with Composer and it should go to the Application Folder. Logs for the policy shows that policy ran with out any errors, however Mojave Package not showing up in Application Folder. Any one seen that behavior before?

Has anyone been able to come up with smart group criteria for computers for which the warranty has expired? I had this working in 8.x but it seems to have broken in 9.x. My criteria is "Warranty expiration in less than x days" with a value of 0. These same criteria work fine with values of positive numbers (I have other groups for warranty expires in 90 and 365 days), but it seems the JSS doesn't know how to evaluate these criteria against warranty dates that have passed. Thanks,Eric

Hi, I am attempting to temporarily hide the latest Mojave Security Update. Previously I have been able to do this with the following in Terminal:sudo softwareupdate --ignore "Security Update 2019-001" However I am attempting to replace the 2019 with 2020 and it seems to accept this as a valid command, however the update still appears. I was wondering if anyone had maybe come across this at all? Thanks.

Best practice to set the default open with application? I need to set all PDF's to open with Acrobat Pro. I don't see any MCX template for it. I know the preference is stored in com.apple.launchservices.plist. Thanks in advance for any thoughts or help. Wi11

Wonder if anyone can help with this. We have deployed a large number of 'Beyond Trust' remote support iOS apps out to iOS devices in the company. When opening the app there are two fields the first field - 'URL' the address entered is static it never changes and i want to find out how to Pre-fill this field using Jamf to remove the need for customers to enter this everytime. App URL:https://apps.apple.com/gb/app/beyondtrust-support/id488264551 I've raised this with the app vendor to see if they can let me know what the tag is for the app with no reply. Any suggestions of achieving this using Jamf, App Configuration Thanks,

Anyone encounter this. Trying to make a Snapshot with Composer, and I get this (twice now). And I have tested it on the Mac I am making the snapshot with and Anyconnect opens fine, no message. Cisco AnyConnect version 3.1.00495, Mac OS 10.8.2

Hi Jamf Nation, Apache Tomcat recently announced a security fix for a high-severity vulnerability in their product. Because Jamf Pro requires Apache Tomcat and security is of utmost importance, we are passing on the following information so that you can take steps to mitigate the vulnerability if you have an on-premise environment. Please note: This issue does not impact Jamf Pro instances hosted in Jamf Cloud or other Jamf products. This issue only impacts on-premise Jamf Pro customers. We recommend immediate mitigation via one of the following actions:1. Comment out the AJP Connector in server.xml and restart the Jamf Pro Tomcat service2. Add a rule on your firewall to disable inbound connections to the Jamf Pro server on port 8009 Additional information about this vulnerability is available in Apache’s release notes. If you have questions, please email success@jamf.com. For assistance mitigating this issue in your environment, please contact Jamf Support.

Hello JAMFnation! Does anyone know, if there is a possibility to change the Network Service Order, of the network adapters by script? Would it be possible to change a persisting order with the networksetup -listnetworkserviceorder command? Thanks and best regards,Kevin

Hi All, Could anyone provide the solution to block "Google Drive / Backup and Sync from Google", I have created restricted software to block but not working. Thanks in advance. Regards,Sathish