Hello community, Using Jamf Teacher I noticed a problem: Since all the management certificates have validation dates (for example until 2028), students can simply change the date on their iPads to 2029 and Jamf Teacher is unuseable, restrictions will not reach this iPad. (The student is also not able to use the internet oder other things, due to the wrong timestamp, but that‘s not the point) Reading a lot of threats here I noticed that I‘m not the only one with this problem, but I couldn‘t find my solution. Is there any way to set the time and date automatically on iPads? The best solution would be via a configuration profile, but I couldn‘t find any. I found some scripts for Macs, but do they also work for iPads (and how do I activate them for our iPads?   Thank you for your help 

Hiwe have recently pushed beyond trust jump clients to all our laptops via jamf . i can see the logs saying its successfully installed confirming from rep console establishing a remote session. however i am unable to see the app in the list of applications in jamf for any of the machines. , any idea why . Thanks

I'm testing scheduling OS updates in Jamf Pro 11.11.2. I have Software Updates setup to Download and Schedule to Install for the latest version based on device eligibility. I ensured that the bootstrap token is escrowed. On the target device I see a message that reads:Managed UpdatedAn update to macOS 15.2 is past due. You can install it now or it will be installed automatically 12/12/2024, 9:56am The issue is that the time keeps changing and it never get its installed. Any suggestions? 

I've created an EA with the script  #!/bin/bash echo "$(mdls "/System/Applications/Utilities/Terminal.app" -name kMDItemLastUsedDate | awk '{print $3}')" and running it on my device, it returns  2024-12-12 as expected. I then created a Smart Group with Criteria <Name of EA>, Operator 'after (yyyy-mm-dd)' and Value '2024-01-1'. Jamf returns a list of devices but I do not believe this list is accurate, as it does not include my device when I've been using Terminal all morning. Any suggestions on what could be happening or what I can do to improve its accuracy?  

Hello We have started to enroll our macbooks for our employees without adminrights. Yes we have the privilege access configured in jamf connect, but don't want use it for everyone :) So i started to configure what is necessary for our employees that they can work without adminrights. So far so good. Now i am actually helpless with this one problem about creating a symlink via jamf pro policy after installation of Visual Studio code. What i need is: A symlink in the directory /usr/local/bin/code which points to /Applications/Visual Studio Code.app/Contents/Resources/app/bin/code   So i am able to create it, but it isnt working. Checking it on a testmachine the symlink shows me in the "get info" as "Original" the path /usr/local/bin/code  instead of /Applications/Visual Studio Code.app/Contents/Resources/app/bin/code   So its not the first symlink i create but its the first in this location /usr/local/bin/code so maybe i am doing something wrong. I am using this sho

Hello Jamf family, Is there a script that can uninstall apps like in Intune? Thanks, JM

I have deployed BeyondTrust's remote support client to my test machine. However, if I set the configuration profile to Allow Standard Users to Allow Access for ScreenCapture, the app doesn't seem to realize it's been authorized. It continues to prompt to allow. Even if I check it with an administrator account. As you can see in the screenshots, even the Accessibility and Full Disk Access are also showing denied, even though they are set to allow in the configuration profile.The fun part is (on a fresh image) if I set the ScreenCapture to Deny, then use an administrator account to allow while on the computer, it actually does allow it.

Has anybody been able to configure the Apple Intelligence Report section in Privacy and Settings?

Hi eveyrone, Rookie here. how can I upload a larger than 5GB pkg to jamfCloud?  With Jumf Sync the max is 5GB. I checked the log and I get below. Failed to copy Adobe_AE to JCDS (Jamf Sync): dataRequestFailed(statusCode: 400, message: Optional("EntityTooLarge: Your proposed upload exceeds the maximum allowed size - max allowed size = 5368709120")). Adobe After Effects on its own package is 6.38 GB.    

I am trying to renew the certificate on my IIS distribution point on a Windows server.  The documentation has changed recently and the new documentation seems to have left out the part of making that request in the Certificates snapin in mmc. I can get part way through from memory but I know there were some other settings that I cannot recall.  This is the documentation updated in October of 2024... https://learn.jamf.com/en-US/bundle/technical-articles/page/Using_IIS_to_Enable_HTTPS_Downloads_on_a_Windows_Server_2016_or_2019_File_Share_Distribution_Point.html Does anyone have a printed out copy of this page prior to the update?  I recall that it was step 4 where they talked about making the request that I need to do.   Thank you in advance for any help.

May be a silly post but I thought I post here for some ideas if any. So i been tasked to create a green colored folder on users desktop that contains "X file". I can get this working on my local system but when I package it and deploy it to another system when the folder installs on the new system the color reverts back to default. Basically it seems like the custom folder color settings don't carry over. I've tried installing the folder in a shared location then creating a colored alias still no go. I've also tried creating a custom green icon folder and trying to redirect that icon to the shared folder location but even that is proving to be challenging. has anybody ever had to tackle a silly task like this? I've been at it for a few days already maybe I'm overthinking?

Hi everyone, Does anyone have experience switching Apple accounts when renewing a VPP Server token? What is the impact on applications? Can we have more than one Apple account for the VPP Server token? Thank you.

Hi all,    can someone confirm this for me, (those who use sandbox) Does this have it's own JCDS??   so, if i connect via the sanbox, it's not conecting to our live cloud jcds??   TIA

In Apple's macOS Sequoia 15.0 release notes the following is mentioned: "Executables, scripts, and launchd configuration files can be installed using MDM and stored in a secure and tamper-resistant location." How does this work in Jamf? I have searched but could not come up with the answer. Has anyone been using this and if so how do I configure a tamper resistant location?

Greetings admins! I wrote a custom migration script that reads several aspects of the users home folder and backs them up to a user specified destination.  That part seems to be working OK, but when I go to write this data back to the same locations on the user's new system, it needs full disk access to work.  My idea was to have the script run directly from Self service (Policy > script execute), but in order to do so, Self service needs full disk access to be able to write back to the users Library folder.  What PPPC do I need to create to allow Self service to have full disk access?

Just thought I'd loop you guys on a nice tool. If you're here, you're running an MDM with probably a high amount of Apple devices. Your enterprise is then too probably running macOS caching servers to save on bandwidth etc. Currently there's a couple widely used tools for monitoring your caching servers like ErikNG's Cacher (https://github.com/erikng/Cacher) and krypted's precache (https://github.com/krypted/precache). Just wanted to let you guys know about one more that I found particularly helpful. Netdata (https://github.com/firehol/netdata) by ktsaou at Firehol is a free/great tool for monitoring all types of Linux/Unix type devices. It also can monitor some more basic functions of macOS machines. Recently he assisted me with writing a plugin to also help with monitoring the caching function on our caching servers. (https://github.com/firehol/netdata/issues/2766) This in conjunction with prometheus and grafana, has allowed me to monitor historicals, create alerts when something

I've setup an API role to Read Smart Computer Groups + Read Static Computer Groups but when I try the script (at bottom) following I get this result:-  Access token obtained successfully. {   "httpStatus" : 401,   "errors" : [ ] } I'm fairly new to the API side of things so might be the script is inaccurate.  My Questions are:- 1) If I go to JAMF_PRO_URL/Api what do I put for username and password (screenshot below)? Is this an account that has access to the Jamf Pro instance or should this be client id / secret or something else?  2) What privileges do you need as a user in Jamf Pro to be able to run these API calls?  3) Is there something wrong with the script below? If I do echo "$access_token" should it show details or would it be normal to get a response like "Could not extract value..."    For the script below I changed JAMF_PRO_URL to URL for Jamf Pro instance and CLIENT_ID + SECRET to details of the API Client.      #

What is Sovereign Cloud in the Setting > Global > Device Compliant used for?Is it just a text box that we enter anything or leave blank or the connection setting to ITunes  

Guys, In my environment I got 85 devices enrolled in Jamf using User initiated Enrollment because my organization did not have ABM and that's why user initiated enrollment did for those 85 devices. Now my organization going to bring rest 30 - 40 devices unmanaged devices to jamf through ABM by enrolling through ADE. In case If I bring those 85 devices to ABM and assign the ADE profile to those 85 devices, shall I run the reenroll command to enroll through ADE or I've to do the factory reset and initiate the ADE. Kindly advice

Jamf Connect has been working in our environment for a few weeks, but we've run into some issues with MFA with security keys.On a computer undergoing prestage enrollment, an SSO window appears prior to configuration. MFA works without issue. After prestage completes, the SSO window appears again. At this point, it should be creating the local account, and connecting to AzureAD. However, if the account is authorized to use a FIDO2 security key, the MFA page will hang.Following this guide, I was able to get MFA working successfully for most logins without issue even with a security key authentication available except when logging into the computer. For all other logins, I don't run into any errors on MFA unless it's when I actively choose Windows Hello/Security Key.

Hello,   I work for a large Fintech company and currently we have our macs enrolled in their JAMF with all their security endpoints. The company I work for is splitting off from the larger company. Me and another guy have been building out our JAMF and it's going well, it's looking to go live May 2025 with some of the first actual enrollments as the migration kicks off but obviously will be testing it more thoroughly first.   The discussion now is how to create the smoothest transition for the users. One method is to erase all the macs and have them enrolled clean in our JAMF. This is the one we want to do. The second method being pushed by the higher ups is to remove the JAMF framework, get all the security software uninstalled and leave no trace and make sure they all work. The issue with that one is we are not admins in the current company and do not have access to the removal of the security endpoints so we either need to ask for the all the passwords (not likely) or have

Does any one happen to know how to structure a config profile for plist settings for Microsoft edge https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies   The aim at present, is to enforce safe browsing, prevent incognito mode and prevent deleting browsing history. As this helps curb miss use of web browsing as kids realise, they can't hide where they have visited.

Part of our Mac hardening, we have to have the BT icon show on the menu bar. All our Mac's are mostly Ventura with a handful of Sonoma. I don't see anything in to Jamf to allow this. I have a command that when ran locally via terminal, it'll add the icon, but if I create a policy using the Files and Processes>Execute Command, it won't add it, but the according to the log on the device, it was successful.  I've also tried using a script, but the script won't add it either.defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Bluetooth -int 2

Job posting: "... You can write production-quality code for automation in Python, Bash, or similar languages" I've written some scripts, but nothing significant like the open-source projects we all use. I can modify what I need from other sources to get stuff done. What sort of 'production code' have you used or written? Where would I start to write something?  Seems everything I can think of exists I'm not nearly experienced enough to contribute to nudge or super, etc. If you have a code repo, where'd you get the experience? I guess I'm having a rough day after being passed on job after job and the only factor I can figure is I don't have the programming experience as a sysadmin

I am having a little brain fart here, but I'm sure it's simple. When I run this jamf policy using the event flag from Terminal, it runs just fine (probably because it prompts for my credentials). But if I try to run it from self service, I get an error that a Terminal is required for the password. Script: #!/bin/bash #Find current logged in user loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) #Runs SysDiagnose as Current User su $loggedInUser -c "sudo /usr/bin/sysdiagnose -u -f ~/Desktop/" Error: I want users to have the capability to run SysDiagnose from Self Service, without it prompting for a password.