If i go to: -Computer-Search InventoryNo matter how simple the string i enter, it shows no results.Could anybody help me utilize the search function?

Has anyone been able to block users from using Office 365 while still allowing users to install Office 2016? I've got a handful of users who want all the bells and whistles of 365 so they buy their own account and install. Our company is supposed to only be using VL Office 2016.

I'm seeing an issue where once we apply the Mojave update to a machine, the MDM profile then gets listed as unverified and other pushes (IE apps and other profiles) don't come down until I remove the MDM and re enroll the machine. Then of course I have to navigate to the profiles section of system preferences and approve the new verified mdm profile. Is this normal behavior or is there a work around? I've tried removing the MDM profile then doing a sudo jamf manage command, however I get an error saying "Error installing the computer level mdm profile: profiles install for file: '/Library/Application Support/JAMF/tmp/mdm.mobileconfig' and user 'root' returned -915 (Unable to contact the SCEP server at"https://ourserver.com:8443//CA/SCEP".) Not sure If maybe I'm doing something wrong. Gabe ShackneyPrinceton Public Schools

I'd like to pass a file name via a default script parameter into a bash script which calls an osascript, but am running into problems. I've been fiddling around with something like the below, but am continually getting errors. The script does work perfectly if I hard-code the full path, and the file exists, so it must be something to do with pulling in the parameter. $4 is set to green.png in my policy Any ideas out there? #!/bin/sh if [ "$4" != "" ] then osascript -e 'tell application "System Events" to set picture of every desktop to ("/Library/Desktop\\\\ Pictures/$4" as POSIX file as alias)' fi exit 0

Hi,I have a policy that deploys the macOS Catalina installer to /private/var and that uses the Files and Processes module to run startosinstall. I have the policy scoped to one computer right now and set to run once per computer. The mac will download and run the macOS upgrade, but the policy never says completed in Jamf. As a result, the policy keeps repeating itself on the already upgraded mac. The mac will get to the login screen, but then it will reinstall macOS Catalina once I log into the mac.

So I have a strange issue where my configuration profiles are not being pushed out to my machines. Mainly my profiles that are the fonts. I removed the framework and reinstalled it to test. This reinstalled most of my profiles but only four of my hundreds of fonts. Also a few of my management profiles such as login window doesn't push ether. No consistency to what fails or why. I have also ran jamf recon, mcx, and manage, and policy just hoping but no luck. Anybody have this issue?

Hey folks, I want to add a Freshservice agent that is deployed through a PKG to several computers to be allowed file access through a Jamf PPPC payload. However, the file itself does not contain an application, and creates mostly a .plist and several files in the under-layer of the system (currently checking what exactly). Is there a way to find the Identifier the Code Requirement for a process that is not an .app file, and how?

We wish to migrate to macOS Catalina and the Kerberos SSO Extension. We have previously used AD binding. As part of manually migrating a computer, we put it in a static group called "Unbound". This group is scoped with configuration profiles for Kerberos SSO and is excluded from profiles that bind to AD. My question is about new computers coming into the environment. Is there a way to automatically put new computers in this group prior to enrollment? I don't see anything about group membership in PreStage enrollments. (I also have about 40 Macs coming onboard from an M&A where there's no DEP.) As I type I wonder if it would be better to put the existing computers in a static group and reverse my logic on the profiles. But any ideas are welcome. Thanks. (Running Jamf Pro 10.15.1 on-prem with a 10.19 upgrade scheduled this week.)

So I've run into an issue that is driving me batty... I run the standard terminal command: security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain /path/to/cert.cer and I get: SecTrustSettingsSetTrustSettings: One or more parameters passed to a function were not valid. If I go to keychain access, it added the cert... but not as "Always Trust". Which is essential for this cert. It's set to use system defaults and just says "This root certificate is not trusted." I have re-exported the cert from the windows server and I get the same thing every time. No matter what, it won't import as Always Trust. Any ideas folks? Additional note... when I go to delete the imported cert from keychain manager it throws up an error that says: "An invalid record was encountered." I have to restart Keychain Access 1 or 2 more time for it to allow me to delete it.

I have a test JAMF Pro server (10.20.1) on Red Hat that has the MySQL on another Red Hat server. It almost looks right but some odd things are happening machine searches in the web interface for all machines (nothing in the search field) bring zero results but if I search explicitly for a machine I know is in there by typing its name, I find it Accessing the API gives <computers> <size>0</size></computers> so that agrees in a way to the first point. Unfortunately it looks like this issue has been in there through several upgrades so restoring is probably not going to fix it. I'd like to get it back to a point that I trust it. Given that it's a test server, would it be simplest to just blow away the database and recreate it? If that is the way, will the Tomcat server re-configure the database with all the tables as it does its first connection or do I have to re-do its installation too? Regards, David

Good Morning! Is there an updated script to hide the iCloud Setup Wizard when users first login? Here is the version I have been using for Mojave (which works fine until you install any OS updates or upgrade the OS): #!/bin/sh ## # Writing out launchd item to disable the iCloud login wizard every time the os version is increased/patched. ## echo " <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.markIcloudComplete.plist</string> <key>LaunchOnlyOnce</key> <true/> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/usr/local/bin/markIcloudComplete.sh</string> </array> </dict> </plist> " > /Library/LaunchDaemons/com.markIcloud

I'm looking at collapsing all the sites into "None" in our Jamf Pro server. Just wondering if anyone has done something like that? The API looks like it might be able to do this. Basically I think I need to iterate through all the computers and change the site to "-1" and the id to "None" Is anyone able to give me some pointers? Regards, David

Anyone know which Classic API endpoint will show whether disk encryption is enabled on a host ? I've been playing with the API for a few hours and I haven't figured out how to find the same data you would see by "computername -> Disk Encryption"

Hey all,Trying to find a way to have jamf helper post a message that has clickable links. Perhaps one of the buttons could be set to go to that link. If not I could always push a link to their desktop and just have them double click it, but I'd rather it be inline.Gabe ShackneyPrinceton Public Schools #!/bin/bash # Determine OS version osvers=$(sw_vers -productVersion | awk -F. '{print $2}') dialog="Thank you for being a part of the Mobile Access Program! Please click on this link http://mylink.com to compete a brief technology usage survey. Signed, Gabe Shackney Technology Office Princeton Public Schools" description=`echo "$dialog"` button1="OK" jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" icon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertNoteIcon.icns" if [[ ${osvers} -lt 7 ]]; then "$jamfHelper" -windowType utility -descriptio

I have an an issue where I need to update some user fields in the API but I don't really know where to start. In summary, I need to loop through all users and for every user whose 'managed_apple_id' field is blank/null I need to copy the data from the 'roster_managed_apple_id' field to the 'managed_apple_id' field. Does that make sense? Is anyone able to help?

I'm probably missing something. I'm trying to implement some of the scripts hosted here on the JAMF Nation board for keeping Adobe Reader, Chrome, and Google Earth up to date. If I run the script on a computer, I have zero problem. It executes perfectly. Creates a log file like it's supposed to, updates or doesn't update the app. If I set up a policy and have it run at check in I get CA019 rgendler 10 minutes ago Failed Executing Policy Chrome Install/Update No log file created, no feedback, nothing. Am I missing something?

I would like stop users from upgrading to 10.15.4 due to these warning messages coming up for legacy system extensions. Currently users are admins on there laptops and we don't have a separate Software Update Server. What's the best way for to do this and give them access back again once software providers have updated their software.

Hi Folks, Just a simple heads-up. If you have multiple domains, make sure to use port 3268. Reason is this is the Global Catalog that contains ALL information of the forest in read-only. You need to know which Domain Controller is your Global Catalog. Ask your AD administrator. This should solve some issues like:- queries taking very, very long (had 20+ seconds, now less than 1 second)- don't get all group memberships (remember, you need universal groups)- Wilcards not working properly -- Was seen by @Serge My example: See you.

I've tried as root, still blank. No updates found from the update server when I do softwareupdate -al. Package receipts from the following command show it is up to date. Does anyone know where the command softwareupdate --history pulls its data from? I'd like to remove it and see if it re-populates, at least the latest patch, after the next patch cycle. I use the results from this command to populate the 'latest os/security update installed' to a field in jamf via extension attribute. Currently this system shows blank in that field on the JAMF Pro server as a result. for i in `ls /System/Library/Receipts/*.plist`; do defaults read $i | egrep -i "(PackageIdentifier|InstallDate)"; done InstallDate = "2019-07-24 18:25:21 +0000"; PackageIdentifier = "com.apple.pkg.CompatibilityNotificationData_10_14.16U1819"; InstallDate = "2018-11-21 14:17:06 +0000"; PackageIdentifier = "com.apple.pkg.Core"; In

Hi all,I think this is not possible but smarter minds may know a way...A T2 Macbook Air was activated and enrolled using DEP, then the record in jamf was deleted.Can this device be re-added to DEP without wiping the device?

Hi all, I need to disable the following restriction: Allow USB accessories while device is locked I can find it in Apple Configurator but not when setting restrictions in Jamf Pro.Is it true that you can't set that setting using Jamf Pro?

Does anyone know how I could use a Smart Group to pull in software that is installed that isn't listed in Applications? This is for Palo Alto Traps. I'm trying to capture devices that don't have it installed. I'm thinking that I might need to add something to the installer that creates a "dummy" entry in Applications and report on that. Let me know what your suggestions are. Thanks!

I am trying to prevent our users from turning on content caching, yet when I use either Restrictions or the Content Caching payload it still allows the user to enable Content Caching. I am able to set the cache size to 1 byte, which I guess effectively disables it, however I'd like them to be unable to even check the Content Caching box in the Sharing Prefs Pane. Any ideas?

We have screen share setup and it works flawlessly if the computers are on our internal network but I can't seem to get it to work at all if they are remote (i.e. working from home) I can see the systems on Jamf Remote and confirmed the IP's are correct but after it says Creating SSH connection to their address and then again to another IP address the status section just goes blank and nothing ever happens. Am I missing something for the remote users? We have both Remote Login and Remote Management turned on for All Users. The last user I tried with was even on our VPN and still nothing.

Has anyone managed to get this working? I used PPPC Utility to make the Profile as per the KBs below on Sophos website: https://community.sophos.com/kb/en-us/134552https://community.sophos.com/kb/en-us/134686 The policy successfully deploys to scoped machines but I still get the alert to grant Full Disk Access Sophos is not automatically granted Full Disk Access in Security & Privacy What am I doing wrong?