Hello! I am relatively new to Jamf, so I am currently exploring all of the ways I can use it to customize the user experience for my university's computer labs. I have been working with Profile Creator to make custom Configuration Profiles and then uploading them to Jamf. This works great for third party applications, but when I try to use some of the System Settings payloads (for settings that do not seem to exist in Jamf), the payloads disappear when I upload the .mobileconfig file. It is possible that some of these settings are deprecated, but they should in theory be modifying common .plist files. I have tested this with both signed and unsigned profiles. Any suggestions, insight, or advice would be much appreciated! (Please none of the "why do you want to lock down the user experience" comments -- we all have our reasons for managing our spaces the way we do.)

hi, mac os server 10.14.6Jamf Pro 10.15.1 we had to move all our data from old SAN to new one. This has been done and working. We updated to mojave our server with the Jamf pro 10.15.1 We wanted to use now SMB be cause of the new APFS machine we are getting with our new DEP process in place. here what's happening i CAN mount the share manually with SMB credentials i CAN user Jamf Admin and the share CAN be mounted no problem Jamf Remote : error could not mount distribution point Self service : error could not mount distribution point policy with login ; error could not mount distribution point any help ? i tried many things...

I wish there was a way to search inventory just by serial number. I have yet to have that work correctly. Am I missing something, or should I put this as a feature request?

Hi Jamf Nation, We're excited to announce that Jamf Pro 10.17 is now available! This is a significant release for us and we're excited for you to get your hands on the new Google Secure LDAP integration and enhancements to User Enrollment and Enrollment Customization. Read the full release notes here. Garrett Update: On Tuesday, December 3 we released Jamf Pro 10.17.1, a version that mitigates an issue impacting EDU Profiles. Standard Cloud customers will be upgraded to this new version during the previously-scheduled mass cloud upgrade on December 6-7. The new version is available for download on the My Assets page on Jamf Nation. Customers can also request an upgrade by contacting their Jamf account representative. Release notes for this version are available here. Cloud Upgrade ScheduleYour Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.17.1 based on your hosted data region: Hosted Region Begins Endsap-southeast-2 Dec

This just started happening last week. Wipe an iPad, start the DEP/setup process and get to the Remote Management screen. It goes past the screen fine>LDAP account sign-in screen, fine> Profile Installation screen fails with "Invalid Profile" Never had it fail 1/2 way thru the DEP process. I have tried:new prestagereboot primary serverrefresh token on DEP instance Anyone else seeing this? Any ideas?

AD Users. So i have seen this issue on a few of my machines. Were the user is authorized to unlock the machine from file vault but on restart only the local admin is showing up. Turning File Vault off and back on, on the user i want to be able to get in does work. But thats like a day process. Anyone else have any thoughts?

Hi everyone, We're currently testing a modified version of a script (presented below) which we originally found here: https://github.com/Yohan460/Automatic-Secure-Token-Granting-Workflow. To put it simply, this script grants the local admin account (which we deploy and manage via a LAPS workflow on Jamf) a SecureToken via the sysadminctl -secureTokenOn command. The script: #!/bin/bash apiUser="" apiPass="" apiURL=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url | sed 's|/$||') udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') extAttName=""LAPS"" LAPS_User="LAPS" LAPS_Password=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}') Local_User=$(ls -l /dev/console | cut -d " " -f 4) Output="" while [[ $Output ==

I have certain ldap users I need to give access to more than one Site - and don't want to give access to all Sites.. I therefore created a Jamf Pro User Group (non ldap) and gave it specific permissions. The members tab is blank and shows no way to add members. Is there a way to add members?

Trying to block the Vuze torrent app on our machines. I have a Restricted Software policy set up however the process id for Vuze is called JavaApplicationStub, a generic Java application process. I can restrict the JavaApplicationStub process and is works however that also blocks some of the finance software the team uses. I am currently excluding the finance department from this so they that run there software. This is not ideal because no finance department could run Vuze as well. Has anyone found a better way to use the Restricted Software policy to block Vuze in a more precise manner and not block JavaApplicationStub as a whole?

We've run into this frequently enough that I feel like some good feedback might be nice. We don't put local user accounts on our Macs, everyone uses mobile AD accounts. On occasion, we'll have a user complain that their machine is slow/not performing/etc, so we offer to put them into a fresh machine with new OS, typically an SSD, etc. In the past, to migrate their user account, we've just copied files from their user home directory to a network share or to an external drive, then had them log in on the new machine to create their account there, and then bring the data down into the newly created network account on the new machine. I've tried using Migration Assistant in the past, but I've noticed it struggles with the migration and changes the computer name to match the old machine, and sometimes it flat out doesn't work. Does anyone have a good solution for migrating an AD network account from one Mac to a new one, while preserving the user data?

Hi Everyone, I'm having an issue, I know that I can always exclude computers that are provisioned with depnotify to not run these policies in jamf... but I would have to exclude on every policy that runs at the networkstatechange trigger. Just wondering if this is a possibility... while depnotify is going through my installation workflow the networkstatechange trigger happens for some reason (not sure why, i'm connected via Ethernet (wifi is also on but Ethernet should take priority)) Is there a way to ignore the networkstatechange trigger while the dep user is logged in? Also another piece of info... the dep user is not an AD user.

Hi Nation, does anyone know how to activate FaceTime and iMessage for our managed Apple ID in ABM?My searches are not successful at this time and maybe some of you have some experience with it.

Hey guys,I'm need to run security show-keychain-info command to query Keychains information of endpoints. Some of them return User interaction is not allowed although their Keychain is unlocked.Other security commands don't work on those endpoints.How can I fix this now?

I'm trying to create a workflow for our school in which a computer can be booted, will check for available software updates and apply any necessary, and then check in with our JSS once no more software updates are identified. I'm curious if anyone has a solution for capturing the server response from the softwareupdate command? So far when I run: #!/bin/bash su=$(softwareupdate -l) echo "$su" The terminal output is: No new software available. Server response and then: Software Update Tool Finding available software Output of echo "$su" With the server response "No new software available." printing first and without regard for the output of the echoed variable. In other words I only ever seem to be able to programmatically capture "Software Update Tool" and "Finding available software". Does anyone have a solution for capturing the server response from the softwareupdate command?

Hello, I'm very new to scripting and need help getting a specific line from a txt file. I need to get an Adobe Challenge Key for our License renewal process. I figured out a way of packaging the terminal tool kit and running a script to get a text file as the output. Now I'm struggling to figure out a way to get key back from each computer. I just need the fourth line.

Hi, I'm attempting to deploy an Adobe CC Shared Device package through a Jamf policy. The .pkg installer fails however, and /var/log/install.log tells me that the CCP Package Installer (which is invoked in the preinstall script) fails with exit code 81 and the following log messages: 2019-11-18 11:16:51+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : InstallLanguage specified in Info.plist in preinstall...() 2019-11-18 11:16:51+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Launching AdobeDeploymentManager... 2019-11-18 11:16:56+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Exit code of AdobeDeploymentManager is (81) 2019-11-18 11:16:56+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Exit ... The package works when downloaded and installed manually. I have also tried to manually compress the .pkg (as both .zip and tarball) before uploading to Jamf Admin, but no success. Adobe's documentation d

In Restricted Software, I am able to block certain apps like Terminal from being launched. I also have exclusions for certain computers as well as local users that are on the computers. The exclusions worked great until I upgraded to JAMF Pro 10.15.1. Excluding computers continues to work fine, but excluding a LDAP/Local account does not seem to hold anymore. With that local account excluded, I used to be able to bypass the restriction and launch the app in question, just like I could with excluding computers. Has anyone else run into this problem?

Hello, I'm about to enable filevault disk encryption for our company's macs, but I wanna make sure I do everything correctly to avoid any problems. And I quite puzzled on what some parameters mean I the filevault configuration profile payload: We chose to only use individual recovery keys for more security so i ticked Require File Vault 2 and Create individual recovery key.Since we need to get those recovery keys back to Jamf, I obviously ticked Enable Escrow Personal Recovery Key but then here's where I get lost.I don't know what is the Escrow location description and the "Record number" message. Plus, I don't know what difference it makes to select whether automatic encryption or manual encryption (then the JSS redir cert). I can't seem to find any infos about this in the documentations.Any clues on what those informations are ? And any advice on how I should proceed to deploy such a thing ? Thanks in advance.

Hi all- ever since xcode 11.x.x I have been having issues with multiple installs of xcode installed on a machine. Sometime it works and my users have no admin prompt to install mobile pkg Other times they are faced with the admin promote to install the mobile pkg. How can there be a consistent way to get MULTIPLE XCODE installs to work on 1 given machine without the requirement of admin rights. I used rbouton scripts and they're have worked till recently... But now it's inconsistent Please help and share any scripts you use to make this happen and use xcode 11.x with admin rights Thanks

Hello, First, I would like to know what is MRTConfigData and what it does, I have heard about gatekeeper and xprotect, but nothing about MRTConfigData, does it have something about security? I have read in other forum that the current version for macOS Catalina is MRTConfigData (version 1.50) http://swcdn.apple.com/content/downloads/52/33/061-23572-A_EBMWE1MEE7/4cwg7ae0o3nwvyeawaadelabyb6xgpul36/MRTConfigData_10_15.pkg But my main question is how some users get the direct download links for the latestgatekeeper, xprotect AND MRTConfigData version if they are not show in Software Update or https://support.apple.com/downloads/macos ? Are they Illuminati? Thanks Camelia

Is there a log file that shows who made changes to Advanced Computer Searches?

UpdateTime and location update with 19 people signed up for Thursday we'll keep it Thursday. If you can't make it then I'll be in the Hyatt lobby by the fireplace at 17:30 today (Tuesday) Hey all in trying to get a room looks like we would have to move the Mini event to Tuesday @1700 (5pm). Would y’all be still willing to attend then?

https://docs.jamf.com/10.11.0/jamf-pro/administrator-guide/Integrating_with_Apple's_Device_Enrollment.html I'm trying to follow the documentation for the version we're running. The problem is that we're renewing not starting fresh and that isn't addressed. There are various outdated videos on the topic. I think we don't have to do the Public Key sectionand only need to Click Download Token to download the server token file (.p7m).from the next section and follow the instructions for Uploading. Any ideas?

Hello, Is it possible to add an object from AD into Jamf? If so, can someone walk me through it. I would like to add something that needs to be turned on or off by another team, but would like to reflect this so our help desk can look at the user and verify if its been turned off or on.

Is there a way to remove computer and mobile device enrollment invitations from the OTA and URL lists in JSS?