A few iPads that I have to rename are not taking. I'm running Jamf Pro 10.8. I can rename them "2018-iPad-XXXXX" , hit save, update inventory and when I go back it reverts back to the old "iPad" name.. Any info would be helpful . Thanks. Pics below

Do I really need to connect to any on-prem directory service in jamf | PRO if I want jamf connect to do all the work?

For years we used a logouthook to remove Student homefolders on logout. after some issues in high sierra we created a combination of launchagents/deamons to accomplish this. But in Mojave we encounter the operation is not permitted when de script tries to delete the homefolder. this is caused by the new PPPC security.How can i whitelist a script so it is able to completely remove the homefolder(s) on logout? i know you can do some tweaking with a pppc policy but really dont know how this works in our situation.

Hey, I am setting up Self Service for our company at the moment. Now, after writing scripts to install /update Apps / programs, I was wondering if it is allowed to use the apps / programs Icons in Self Service. One example is Microsoft Office. My users can update all Office Programs via Self Service. Is it allowed to use e.g. the PowerPoint Icon from Microsoft in this Self Service Policy? Would be great if any of you have some experience regarding this. I don't know if that matters but we're from Germany. Edit: I mainly wonder about Office, Google Apps (GMail, GDrive..), Adobe Apps

I want to create a policy that will set a specific user that can access Remote Management on our managed computers. Used 6 different scripts I found here and they all seem to set Remote Login with Only these users (and there is no one in the user list).Here is the latest from Apple's latest ARD (3.9)sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users specificuser -privs -all -restart -agent -menu If I run this on the laptop in Terminal it does select Remote Management, but if I run this as a script, it will select Remote Login. The first time I ran it in Terminal low and behold the specificuser showed up. The next time I tested it in command line the Only Allow These Users had no name in it.That is what I am experiencing with ALL the scripts running as a policy script. None populate the specificuser and all activate only remote login. I am new to using scripts in JSS so if I miss something obvious just s

Has anyone seen this when using "Option Command R" on macOS? I have been searching for this without much luck...

I noticed one of my recently enrolled computers listed under Enrollment lists: "Today at 3:44 PM" However its currently 1:48 PM (I am on the east coast). Looking for other KB articles I see information about changing apache settings, but I am using the Jamf hosted version of Jamfcloud and all responses on this topic are quite old. I looked all over the settings and couldn't' find if local timezone or logs are configurable. Is this admin configurable or do I need to reach out to Jamf to make some apache change?

I am attempting to set a custom desktop background for all users through Configuration Profiles, and it is working. However, it is locking the desktop backgrounds, and I am unable to change it once it is set. There is an option in the Configuration Profile to lock the desktop background, and I do not have it selected, but it seems to be locking it anyway. Users need to be able to change the background after it is set. I am deploying the background image into a folder in the root directory, and simply setting the background to it using a configuration profile. Is there a better way to do this? Any ideas on why it is locked, when that option isn't selected? The only way I've been able to change the desktop background is to remove the configuration profile from the computer, then reimage it completely.

hi, I miss on the inventory-page from jamf now the following information for macintosh hardware:- size of memory- processor (i5, i7) and processor speed and an export-function as csv-file would be great. nothing ist possible at the moment, at least I can't find it? it would be very helpful for us to see instantly, if a mac is capable for specific needs (e.g. adobe creative cloud apps, music-apps, office-apps,..) many thanks, ferdinand

We are getting this error on only one computer when inventory update occurs. Message does not mean much, nothing in the associated logs on the server matches the error message. JSS 9.65Computer running OS 10.10.2 '"Gathering application usage information...Error running recon: Invalid Message - The message could not be parsed."

Yesterday I was experimenting with setting the homepage in Safari via Config Profile. It worked quite well, but it was only a test so I removed my computer from the scope and went home for the day. This morning I discovered that my computer was still locked in to the homepage I set in the test profile. I was done with my test so I deleted the profile from the JSS thinking that would definitely remove it from the computer. Nope. My computer still has the profile installed and it definitely managing my Safari homepage. I can't remove it from System Preferences > Profiles because the minus sign is grayed out. I tried using the profiles remove command but it tells me that the profile cannot be removed. How on earth can I remove this unremovable profile? I can't scope and unscope my computer to the profile since I deleted it from the JSS. Is there some magic way of removing this?

In my environment i am trying to setup our Mojave corp build with 365 and trying to take advantage of jamf passthorugh on mobile config. problem i have although all our emails are the same domain, 'conesto' for example, a small set of users have a different activation address so i cant use $EMAIL for the activation address. i have tested and although i can setup Skype with $USERNAME@fqdn old style, i cant do that with our 365 portal so its either full email or domain login................... how can i pass conesto$USERNAME as a activation value without json turning it to when it translates it from custom setting plist to MCX. i have tried to escape with but i only get it worse with \\ what am i doing wrong

We use Okta for our auth with Jamf.After a password change/reset, we sign into the Jamf Connect Sync window with the new password and it asks us for our local password (old okta password) and it is overwritten. This is all well until I look at the Okta logs and every 15min there is an invalid login attempt. After 10 attempts the user is locked out of their Okta account. After opening back up the Jamf Connect Sync window, I notice the old password is still saved. Replacing it with the new password is fine, but it doesn't update and save it for the future, therefore the invalid login attempts continue. Could this be to do with an auto auth or key chain configuration?Any assistance would be greatly appreciated.

Hello, we are more or less new to Jamf Pro and rollout our first managed Macs in a friedly user phase. Main Problem:AD usernames with - or _ in it like "muller-riha.marc" will not work. It is shaking like the password is wrong. Does anybody know anything about it? BestTristan

I'm SMH about an issue with policies that are staying in the "pending" state even though they have successfully completed. This is troublesome because the policy in question is one that the execution frequency is set to "Once per Computer". I've flushed the policies for the machine. I've even run recon on the computer and still the same issue. I have a cloud instance of JSS with version 10.12.0. Anyone else having this issue? Here is some context - The policy being run on 10.14 is using the "Execute a Command" field in the "Files and Processes" payload. The command being run is for running updates, then doing a restart: softwareupdate -i -a; jamf policy -trigger restartComputer The trigger "restartComputer" is also just a command payload running the following command: shutdown -r now Doing a recon, shows the computer was successfully updated by comparing the before and after inventory of the computer.

As a school district we have some schools that allow the students to get Apps from the Mac App Store. Because we are a school district, we obviously cannot allow admin access to those machine. Therein lies the rub. I would love to see if any of you have a graceful solution for non-admins to remove apps from the Applications folder without being an admin. This is what I have worked out so far:I KNOW I can use a script to move all apps from the applications folder to the user's applications folder.From there they should be able to delete them. (To my knowledge, please correct me if I'm wrong.)I KNOW that I should be able to exclude items from that action, Utilities folder, built-in Mac Apps, etc. I need some help getting a script together so that we can do this. If anyone has a more graceful method, I am all ears. I will include what I have so far but am limited by the string length and can only include a few apps. #!/bin/sh # current user is $3 shopt -s extglob cd /Users/$3/des

Hi,Is there a way to select 100 devices and change the asset tag for them all?There must be around this instead of doing them one by one. Thanks!

I know the title sounds illogical, but bear with me. I've been testing NoMAD and NoMAD Login AD as a replacement for our AD bind. We use LDAP group limitations regularly for policies, and also for a couple of user-level Configuration Profiles. I try to steer clear of these in general, but for things like Chrome managed preferences we're basically stuck with them. Policies seem to work fine. For example we have login Policies to mount SMB shares, scoped at the relevant machines and using an LDAP group limitation. A NoMAD Login account will pick up these policies and mount them at login. Despite being a local account, it apparently satisfies the limitation since the account name matches the LDAP account in AD (which is part of the relevant LDAP group). NoMAD itself ensures the user has a Kerberos ticket, so the share mounts without prompting for credentials, just as if we were still using an AD bind and mobile accounts. However, when doing the same thing with user-level Configuration

I have a simple configuration policy applied to my student computers which will require a password immediately upon sleep. However, 90% of the computing done in this school is done on two different websites so I have Guest User configured to access those two sites (and only those two) for the convenience of the students. However, I have noticed that this configuration policy does not seem to be triggering when the Guest User is the current logged on account. Any ideas here?

I just wanted to point out that version 19.012.20034 of Acrobat no longer works on 10.11, as you can see on the release notes here: 19.012.20034 Added support for: Win Server 2019 Dropped support for: Mac OSX 10.11 I haven't tested this with Reader yet, but an Acrobat Pro patch policy will need any 10.11 Macs excluded from the scope, since the definition still states the minimum OS version is 10.11. I can confirm that this version fails to install on any 10.11 Macs. Also, sorry to jump on the "patch management is mismanaged" bandwagon, but how did this get approved given the process for updating software titles that Jamf outlined here? The update is downloaded, installed, and run on virtual machines with different macOS versions: 10.9, 10.10, 10.11, 10.12, 10.13 (and occasionally on 10.8). ... The Patch Management Curator compares the JSON file with the update to verify that the version number, dates, minimum operating system, App Name, and BundleID match.

I was just wondering if there is a way to print the output of the sw_vers commend into a popup windows when it's run in Self Services?

What is the best practice at the end of the school year to wipe a device and set-up for a new user? We are using Jamf Pro and ASM. I had assumed I could just do a wipe and then re-enroll as the new user, but when I do that the iPad retains the information from the previous user - device name, location, etc. I'd like the device to maintain the asset tag number and then bring in all the information based on the new user.

Has anyone been able to create a policy to install Carbon Black?

In the past (before we had JSS) we have 'touched' each macbook and set them up for the teachers, we log in with our admin account and configure things such as setting up iCloud and enabling Find My Mac under that account. That way, if they lose it, we can find it again (obviously) With JamfPro and the zero touch type of deployment, how are you handling FMM, we don't want to have to log into each of the computers and setup iCloud under the management account. Ideas?

I updated from 10.10 to 10.12 last night and immediately noticed that I was getting prompted for JAMFAgent wanting to access SystemUIServer and SystemEvents. I deleted the old configs, created new PPPC Configs using the PPPC Utility and uploaded them to JamfPro. I scoped them out to my group and was still getting prompted to allow JAMFAgent permission. The versions on the laptops are correct, JAMFAgent and JAMF binaries are version 10.12. The Profiles installed show the new versions of the configs. Any ideas what I missed here? Thanks in advance