Hi,Is there a way to select 100 devices and change the asset tag for them all?There must be around this instead of doing them one by one. Thanks!

I know the title sounds illogical, but bear with me. I've been testing NoMAD and NoMAD Login AD as a replacement for our AD bind. We use LDAP group limitations regularly for policies, and also for a couple of user-level Configuration Profiles. I try to steer clear of these in general, but for things like Chrome managed preferences we're basically stuck with them. Policies seem to work fine. For example we have login Policies to mount SMB shares, scoped at the relevant machines and using an LDAP group limitation. A NoMAD Login account will pick up these policies and mount them at login. Despite being a local account, it apparently satisfies the limitation since the account name matches the LDAP account in AD (which is part of the relevant LDAP group). NoMAD itself ensures the user has a Kerberos ticket, so the share mounts without prompting for credentials, just as if we were still using an AD bind and mobile accounts. However, when doing the same thing with user-level Configuration

I have a simple configuration policy applied to my student computers which will require a password immediately upon sleep. However, 90% of the computing done in this school is done on two different websites so I have Guest User configured to access those two sites (and only those two) for the convenience of the students. However, I have noticed that this configuration policy does not seem to be triggering when the Guest User is the current logged on account. Any ideas here?

I just wanted to point out that version 19.012.20034 of Acrobat no longer works on 10.11, as you can see on the release notes here: 19.012.20034 Added support for: Win Server 2019 Dropped support for: Mac OSX 10.11 I haven't tested this with Reader yet, but an Acrobat Pro patch policy will need any 10.11 Macs excluded from the scope, since the definition still states the minimum OS version is 10.11. I can confirm that this version fails to install on any 10.11 Macs. Also, sorry to jump on the "patch management is mismanaged" bandwagon, but how did this get approved given the process for updating software titles that Jamf outlined here? The update is downloaded, installed, and run on virtual machines with different macOS versions: 10.9, 10.10, 10.11, 10.12, 10.13 (and occasionally on 10.8). ... The Patch Management Curator compares the JSON file with the update to verify that the version number, dates, minimum operating system, App Name, and BundleID match.

I was just wondering if there is a way to print the output of the sw_vers commend into a popup windows when it's run in Self Services?

What is the best practice at the end of the school year to wipe a device and set-up for a new user? We are using Jamf Pro and ASM. I had assumed I could just do a wipe and then re-enroll as the new user, but when I do that the iPad retains the information from the previous user - device name, location, etc. I'd like the device to maintain the asset tag number and then bring in all the information based on the new user.

Has anyone been able to create a policy to install Carbon Black?

In the past (before we had JSS) we have 'touched' each macbook and set them up for the teachers, we log in with our admin account and configure things such as setting up iCloud and enabling Find My Mac under that account. That way, if they lose it, we can find it again (obviously) With JamfPro and the zero touch type of deployment, how are you handling FMM, we don't want to have to log into each of the computers and setup iCloud under the management account. Ideas?

I updated from 10.10 to 10.12 last night and immediately noticed that I was getting prompted for JAMFAgent wanting to access SystemUIServer and SystemEvents. I deleted the old configs, created new PPPC Configs using the PPPC Utility and uploaded them to JamfPro. I scoped them out to my group and was still getting prompted to allow JAMFAgent permission. The versions on the laptops are correct, JAMFAgent and JAMF binaries are version 10.12. The Profiles installed show the new versions of the configs. Any ideas what I missed here? Thanks in advance

Just wanted to understand what the process is here: I placed an app in the Self Service Store, and I believe some students installed this app when they shouldn't have. I've scoped out the student devices from the original deployment (I always make sure to check "Remove app when profile is removed"). This should effectively remove the app from the student devices, correct? The licenses should free up and be able to be used on other devices?

Testing out Device-Based VPP (JSS 9.82/OS X 10.11.2&3) and after banging my head against the wall, tried switching from my non-admin to my admin account and things installed instantly. Is this normal behavior? Am I the only one who didn't know this? Our goal around device-based VPP was to deploy to standard users - not helping. Have other seen this? When using my standard account, I get presented with this prompt:

Hello JAMF Nation, I am trying to remote into our machines using JAMF Remote but I get the errors. I am also a noob JAMF Admin and was wondering how the JAMF Nation was doing the following: Enabling: Screen Sharing: Only these users: DOMAIN ADMINS - Computer settings: VNC viewers may control screen with password: $apassword AND Remote Login: Allow access for: Only these users: DOMAIN ADMINS This would be extremely beneficial for Remote Controlling these machines that I am unable to do at the moment. I am currently playing with the script JAMF has in the Scripts section of the forums but it's not working properly even after setting the correct variables.

Is there a way to verify a user enters the correct password and if they don't prompt for it again. I am making a Apple Script to enable FileVault for the logged in user. So I have a AppleScript that pop-ups a dialog box asking the user for their password with hidden text and I store that to a variable. I need to somehow to check if the password they entered their is correct and if its not, prompt the user to try again. Thanks!

I have taken over the role of Jamf administrator in our organization. When setting up a new Mac that is in DEP, during initial boot we enter the AD userid and password of the user who is getting the machine. Shortly thereafter, we are prompted to enter a user account for the Mac. We generally enter our admin credentials here, but sometimes we get a message stating that this account name is invalid. The reason is because the hidden admin account is already created. I've looked in out Jamf Pro server and I can't find any policy that could be creating this hidden admin account. Is there something in DEP that could be creating it?

So I'm using built-in Jamf Patch Management to manage Microsoft OneDrive. According to the definition received from Jamf, the latest version (19.x) is supported on Mac OS X 10.11: However, I'm seeing patching failures, because according to the installer states that macOS 10.12+ is required: Sure enough, on https://macadmins.software site, the OneDrive minimum OS has changed: So if you're OneDrive patch management policy is failing, that's why. I'll adjust my scope to account for this bug for now - does a support ticket need to be opened to get this definition fixed? Or does someone from Jamf monitor Jamf Nation for these types of discussions on patch management definition issues..? ~Ted

Wondering if anyone else has looked to use Yo to do their own version of Patch Management notifications to alert users an app needs quit in order to update. The upper management at our University isn't a fan of the time warning and then force quit (without a second warning) that is offered in Jamf's Patch Management so I'm trying to use Yo to notify the user the app needs to quit. I can get Yo to quit the app based on the action button or allow them to defer, but not sure how to have Yo also trigger the installation if they choose to quit. To get Yo to notify the current user, the script needs to run as the logged in user (who doesn't have sudo). This works for the notification and to quit the app, but sudo is then needed to use sudo jamf policy -event installCustomTrigger. I haven't played with customizing the actual app with Xcode, I only deployed the Yo pkg to a test machine and am calling on it with yo_scheduler. When yo_scheduler is called, it doesn't wait for your response in

Hi, I am pretty new on this forum, is there a way to deploy SfB for OS X / Mac OS and define that it wil automaticly sign-in with the outlook credentials. We have done this for Lync 2011 but pretty new to SfB. Thanks!

My issues seems to be present in 10.13 and 10.14. We have the login window configured to show text fields for username and password. If a user logs out, the normal login window will show up. If a user restarts the machine, it will show the last logged in user but only gives a password field, if you click help it asks to reset your PW using your recovery key. At the bottom there is only a restart and shutdown button. I am 100% sure file vault is causing this and it is troublesome for shared Macs. We can't expect a user to log out every time, they will shutdown the Mac most likely. There is not user switch button on the screen, I have it configured to allow user switch but it's not there. Is there something I am missing regarding this login window or FileVault in general?

Hi jamf nation, Hopefully anyone know that problem.I have updated our jamf pro on-prem from 10.8 to 10.11.1 today.For sure, I did the incremental update steps provided by jamf. (update db to InnoDB, upgrading to 10.10 and after that to 10.11.1) Now tables are not correct anymore: But if i take a look into the details of a host it is correct:Also the OS entries are correct. Does anybody has this problem too? Also when upgrading Software via Patch Management, it gets stuck after one update done.All I can see in the local log is that one policy is finished, but the next one never starts: (unless I restart Self Service) Tue Apr 23 15:59:00 hostname jamf[27059]: Checking for patch ID 26 Tue Apr 23 15:59:00 hostname jamf[27059]: Executing Patch Policy Microsoft PowerPoint Tue Apr 23 15:59:19 hostname jamf[27059]: Verifying package integrity... Tue Apr 23 15:59:23 hostname jamf[27059]: Installing Microsoft_PowerPoint_16.16.19041201_Updater... Tue Apr 23 16:00:28 hostname jamf[27059]: in

i want to not allow the user change screensave time, and how to set this item in jamf . have a good ideal to me! thanks.

We are in the process of moving some users to an Adobe Named User license. The only way I've gotten things to work is to do a clean uninstall of all previous Adobe applications which includes removing everything Adobe from the computer. I've been having to do this manually and as we ramp up I need to be able to do this in a script. I can script the Adobe Creative Cloud Cleaner Tool uninstall, but it still leaves Adobe files scattered throughout the file system. How can I delete the following:Any file or folder beginning with Adobe or beginning with com.adobe From the following locations:/Applications//Applications/Utilities//Library/Application Support//Library/Preferences/~/Library/Application Support/~/Library/Preferences/

I want to provide a better user experience in general for my users. I found a script that will gently remind the user to restart their machine every 2 weeks. I am adding that this week. My question is: Does anyone else have any ideas or suggestions on how I should use Jamf Pro to create a better end user experience? I do not need suggestions on the management portion. I am trying to add scripts, policies and CP's that create more features for End Users etc. All suggestions are welcomed.

First: This is not Apple approved. I know that, you know that, do it at your own risk. I do, this works fine.UPDATE: I have added my imager for download to the bottom of this post with instructions This is not a discussion about why or opinions :). Some of us have this need, this is a solution! Thought I would share as I have seen a number of folks looking for these answers. Some of you are just looking for a certain piece of this, and thats great. Some of you are looking for a way to make an imager and that is here too. If you want to take the whole thing and make a fully automated USB Imager than that is also here :). If you don't like imaging, don't want to use this, or don't like it. That is okay! We each have our own thoughts and way of doing things, this isn't for you :). If you are interested, dabble in this, or have other thoughts/ways to make it better PLEASE post and share below! APFS / High Sierra Imaging: (Steps 1 and 3 are assuming your machines h

Hi All, I currently use a script on logout in my labs that deletes the user's account. It keeps some local admin accounts but deletes the rest. All works great in my Sierra and High Sierra environments. However in my testing with Mojave it keeps the last user when I login in with another. Then if I was to log out it keeps that last one but deletes the previous one. Hope that makes sense. Login with USER ALogout USER ALogin with USER BIf I look in the users folder, USER A is still thereLogout USER BLogin with USER CIf I look in the users folder, USER A is gone but USER B is still there. Here is the script I am using. I actually got this form another user on the forum and thank you for that. for dir in /Users/* do if [ ! "$dir" = "/Users/admin" ] && [ ! "$dir" = "/Users/viscom" ] && [ ! "$dir" = "/Users/root" ] && [ ! "$dir" = "/Users/main" ] && [ ! "$dir&#

Hi everyone, I tried searching but couldn't find really an answer. Hopefully I can explain my situation clearly with my limited knowledge in english language. Is it possible to construct a policy to install software this way. I would like to have a policy that install specific software. Software is available to every computer so that our Administrators can log in to Self Service and start the install. For classrooms there would be a script for each room that would use the custom triggers to start install on recurring check-in if the software is missing. My goal would be to get rid of some policies. Currently we have two policies for each software; one for Self Service installation and one for automatic installation for classrooms. The problem I have is that on recurring check-in when the script runs, it checks for policies for custom trigger install_maya_2018 but cannot find any policies because it is limited to <LDAP_Administrator_Group>. I tested to also include root user