Just a quick question. I have a problem where I cannot login with a Pre-Stage Enrolled admin account any longer. I was at first but not now. https://community.jamf.com/t5/jamf-pro/cannot-login-with-local-admin/m-p/332899#M281166 I was in Zoom call with a Jamf tech and I am able to login with a Standard Student account. He had me run a command in Terminal and Secure token is enabled for both my Admin account and Student account. He asked for the logs on the mac but I can't navigate to /Var/Logs because we found out that a Standard User doesn't see "Go to Folder..." in the Finder Go. To help him out does anyone know a way around this? He escalated the call to an engineer.I could also create a new policy to create an admin but I thought I would ask her first before I do so. Thanks!

We have discovered a large number of Macs in our fleet that appear to no longer have the Jamf agent installed on them. This may be because users used the "jamf removeFramework" command on them. I have been working on figuring out how we can get these systems re-enrolled. For years I have used the command "sudo profiles renew -type enrollment" command to re-enroll Macs that are in Apple Business Manager. Running this command requires me to interact with the Mac to complete the enrollment process. I tested this a few days ago on my test Mac to take note of everything that happens after the profiles command is ran. We would like to do this in the background silently. We have an agent called Aternity installed on all of these Macs. We know they're in use and active. They're just not connecting to Jamf Pro. Aternity can send scripts to the Mac, and my thought was that we could run the profiles renew command in a script pushed out to these Macs. Are there any options that can be used with th

New and somewhat confused JAMF-user here, and thus: silly questions.I'm using Entra as my Cloud Identity provider and I'm trying to create a smart user group based on membership in an Entra-group (JAMF_KLA) in order to build configurations for said usergroups. But I cannot for the life of me get it to work (nor do I know if it's actually possible).Looked at the mapping of both the SUG and in the CIP-setup, and everything there looks like it should work. Can also do a test against various users, and it works (User that is in the Entra-group gets green checkmark, user that is not in group gets red checkmark). Which tells me that the lookup is working.I see that I can also add users from a Directory Service from the Settings-menu. However, is that only for admins/auditors? I see that there's an option for Enrollment Only. Does this mean that the imported users do *not* have access to the JAMF-console?

Hey Jamf Nation! I have a short script set to run once per computer at recurring check in. I am also about tell Jamf to update macOS from 14.7 to macOS 15. I believe individual Macs check for macOS updates as part of the recurring check in (very easily could be wrong!). My question is, which happens first? If a Mac contacts Jamf as part of a recurring check in, and finds out it is due for both a script to run and a macOS update, which does it do first? Thank you all!

I don't know if my subject made sense, but here goes... Most of the software installs we deploy go through a two-step process: cache the installers, then run the installers. I'm testing different ways to run the Adobe CS6 installation (at logout, in the background, at startup, etc.), but to save cooking time, I'd like to be able to cache the hefty-sized CS6 .pkg file from a Mac that has a local distribution point, over either a Firewire or Thunderbolt connection instead of letting it cache from our JSS server. Occasionally we'll push out cached .pkg files through Casper Remote, but it doesn't appear to interact with the local distribution point the same way that Casper Imaging can. Am I missing something or is this not possible through the standard Casper suite? Thanks! JSS 8.62, etc, etc.

Does anyone know if it is still possible to prevent the removal of management profiles on Jamf Pro for iPads?I believe there used to be a iPad restriction to do this. I can't seem to find it now.Any help would be most appreciated. 

How do you guys have your road warriors login to Jamf Connect from public wifi with captive portals?I only have a few users that do this but wonder what the Jamf Connect config setup is like.

I attended JNUC in both 2023 and 2024 and finally have got around to implementing Installomator as per https://www.youtube.com/watch?v=p2J6fTQXIwU.  Lots of people were talking about it and in 2024 was convinced to at least try it.  The implmentation in the video uses two Smart groups. Smart group targetting "Patch Reporting" for the targetted application.  For example, the criteria would be Patch Reporting: Google Chrome is less than Latest Version. Smart group targetting the above group because you can't target policies using Patch Reporting directly as per the video. The first group using Patch Reporting updates just fine.  My issue is the 2nd group does not update correctly.  When I initially save it the numbers match but after testing by updating an app the 2nd group will not update to reflect the number of the 1st group.  The only way to update it is to go in and edit and resave the group.  Then it will update correctly until the next time it

Hello everyone, For the Chrome browser, I've created a PLIST for installing the extension and a second one for configuring the extension, and it works perfectly. That's why I'd like to do the same for Firefox. The PLIST for installation works. But for the extension configuration PLIST I don't know how to do it? I can't find any information about this if it's possible. Here's what I did for Chrome : Preference domain : com.google.Chrome.extensions.IDextension   <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ConfigJson</key> <string> { "backend_servers": [ { "title": "Exemple title", "url": "https://exemple.com" } ], "base_url": "https://exemple.com", "allow_custom_server": false, "allow_registration": tru

I'm trying to install Nexthink by using the script that was provided that has all the information in it. I'm issues getting it to run.  In the path BASE_PATH="/Library/NexthinkInstall" should this be where I'm mounting the .dmg file? For instance, I created a composer pkg to add the Nexthink.dmg file to /private/tmp/Nexthink and then tried adding the completed postinstall script.   #!/bin/bash# v5i - nxt_collector_installer.sh## Nexthink Collector Installation script for macOS## This script makes the following assumptions:# 1) The 'csi.app' folder from the Collector DMG is deployed to the endpoint. The installation# only needs that folder and not the full DMG.# 2) The deployment directory is configured below as 'BASE_PATH'# 3) This script is located in the same directory as the csi.app folder from assumption 1.# # Instructions: # 1) Modify the Nexthink Instance Settings in the section below# COLLECTOR_ADDRESS - The data collection address from the welcome email# CUSTOMER

I am new to the community. I have a configuration policy for AD binding. The policy has been in place for well over a year. There has been no changes to the Active Directory settings, however its giving failing messages. What's causing this?  

Here's one out of left field, from my security group... We have a number of computers (Macs, windows, etc) reporting in CrowdStrike, Axonius, and other services.  Not all of the Macs are enrolled in Jamf, for reasons good and bad, and we need to get them enrolled. The security team is looking for ways to deploy Jamf without needing to visit the computer (identifying user and location can be a challenge).  I know nothing about whatever process CrowdStrike might use for this.  I do know that installing MDM software on Windows computers can be done via Active Directory, and apparently CrowdStrike uses a some kind of method for deploying MSI or exe installers to Windows computers. I also know at one time Jamf had a quick add package that could, maybe, have been deployed from CrowdStrike or other tool that can support macOS pkg files, but today Jamf deployment depends on having the user, at the computer, download and install, with authentication, the Cert and MDM files. &nbsp

Got an odd one. Anyone had this issue where Microsoft Word won't save anymore?I tried uninstalling, re-installing. Killed preference files and Microsoft Container files. Just on this Mac after he updated to 15.1 and Word 16.91.24111020. Tried an older version. User is signed into M365 okay. Other apps are fine, like PowerPoint and Excel. Other Macs are fine. Happens on every Word file, even a new blank one. Once we click Save As, just beach ball, freezes for a bit. No prompt or options to save from Finder.

Hey Guys, Is there a way to export a report that confirms which users have the screen and system audio recording setting toggled on? The goal is to export a list of users with any settings enabled in that area. 

Greetings! Having a bit of trouble with a host name mismatch on a ceritificate that's causing an issue with Outlook on startup. So far, I've added and exported the certificate in Keychain Access, uploaded it to the JSS in a configuration profile, and then tried to deploy it to a test computer but the problem here is that the trust settings are set to Use System Defaults. Then, I tried packaging the certificate up with composer and copying it to /tmp and installing it with this command: /usr/bin/security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain /tmp/certificate.cer Which does add it and set to Always Trust... However, I still see the Verify Certificate message when Outlook is opened and Use System Defaults as the Trust settings even though the certificate is marked trusted for all users. Any thoughts on what I might be doing wrong or another way to go about adding this certificate to the keychain and setting it to Always Trust? Thanks!

How do I get rid of this message for good ? Even after I 'cancel all' the next day there are a bunch of them again. Is it trying to install a configuration profile that has been deleted from my configuration profile payload? What's actually causing this?  

I am experiencing an issue where iPad apps are not installing on certain devices. This issue started on November 12th 2024. The affected devices are only devices that have not been enrolled in Jamf before. If I wipe a currently enrolled device and reenroll it, the apps will load just fine.  All apps I have pushed are not installing (including self service).  The errors I get on the iPad are "sign into iTunes to allow domain.jamfcloud.com to manage and install apps" and "This Apple ID can not purchase App Store Apps" My organization has managed Apple IDs and we use VPP for all apps. I checked, and there are no apps that are not under VPP or have run out of licenses, despite Jamf Pro saying, "Pending - All licenses are in use or the license is not assigned yet" under pending commands. This has never happened before and I am extremely confused on why this is only happening to devices that have not been enrolled into Jamf before. Any ideas are appreciated!

I'm looking for an up to date extension attribute that checks to see if a mac has an account signed into iCloud and what that full account name is, if an account is signed in.   I've found several other EA's that look for this plist, MobileMeAccounts.plist. The mac I'm testing with is running on OS 15.1, and I do not see this plist under ~/library/preferences.   Any info on if the plist has changed or moved would be greatly appreciated as well.

I've been doing a bit of a clean-up on our Jamf Pro instance prior to us migrating to Jamf Cloud (which will hopefully be within the next month or two) and one of our extension attributes seems to be a bit out of date as I've noticed it's not been working properly.It's supposed to determine what the active/in-use network interface is (i.e. Ethernet or wireless) and has the following script:#!/bin/sh OS_MINOR=`/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2` if (( $OS_MINOR < 5 )); then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"`</result>" else echo "<result>The networksetup binary is not present on th

Just setup MacOS onboarding and working great for use.As anyone configured the MacOS Onboarding extension attribute mentioned here https://www.motionbug.com/jamf-pro-and-macos-onboarding/This does'nt appears to create tag usisng  touch /Library/Application Support/JAMF/.onboardingcomplete. I assume thats what its suppose to do, unsure if the path is correct shouldnt it be touch /Library/Application\\ Support/JAMF/.onboardingcompleteDoesnt create the file either way assuming thats what its suppose to do.Anyone got this working? think I missing something simple.   ThanksTom

Can some suggest how can we Managed Login Items to allow in background for the application Zscaler   We are implementing this in our company to ensure that users wouldn't have an option to turn off. We implemented something similar creating a Configuration Profiles for Ms defender using a some documentation from Microsoft but over ever I don't any documentation for Zscaler. 

Seeing inconsistent deployment of a Config Profile that is required for use of CISCO Secure Client. "the current system configuration does not allow the requested operation" My device it installed fine (15.1) on another device (15.1), it gets the above message in the JAMF device record.   The config profile does have one kernel extension being deployed Kernel Extension Bundle ID       com.cisco.kext.acsock  

The Autoactivationlink is not passing through to the application.  The mobileconfig provided is for Intune, the vendor does not have a Jamf version.  I am also having trouble getting it to pull the USERNAME and DEVICE_NAME from the system, I tried the original palceholders {{Username}} {{Devicename}} and the ones you see now..  I have obscured the link as it is unique to our license. <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><!-- This profile contains all CIRA DNS Firewall specific settingsFor detailed information on these options, please see the MDM specification"--><plist version="1.0"><dict><key>PayloadContent</key><array><dict><key>PayloadContent</key><dict><key>ca.cira.secure.remote</key><dict><key>Forced</key><array><dict><key>mcx_preference_settings&

Hey all,Does anyone have a solution to automatically install apps upon enrolment from the mac apps app store and then make them available in self service as well?Appreciate any help or advice, Thank you!

So I've created a new package using Jamf Pro web GUI, pointed it to a newly uploaded file on repository, and tried to deploy, but all installs are failing because the "package could not be verified". Never had this issue with Jamf Admin...just sayin' Jim