Hi there,  We have an app that has 44 total licenses, and on Jamf Pro it says there are 24 in use. But only 4 are showing up on the scope. There were 20 pushed into Jamf School with a different token. I am wondering if anyone could help me figure out where I could find these missing in-use "scoped" devices could be, or a starting point? I've tried looking at the static group I think they could be at, but I didn't see anything on one of the devices that are in that static group. I wonder if deleting the static group would help, but I didn't see the app on one of the groups device listed anyway.  Thanks  

We are a mix of Windows and MAC devices. The MACS are Domain joined. User logs in the first time connected to our wired ethernet in the office to create their account using their Active Directory information. Over time the user has a local password for the MAC login screen (the very first password they made) and an AD password which is different and needs to be changed every 120 days.   Scenario: User is on the log in screen trying to get in to their local account with invalid or forgotten password   Attempt: Using the recovery code the user gets to the screen where they reset their password however it always gives an authentication error in the end to complete the change. Seems like even though this is to reset the local account password it needs to be in communication with the domain server. User can reset password if they go back into the office and hook up to a wired connection.   Attempt2: Creating a policy to reset the local user account. Fails to send push to comp

Updating MAC O/S using JAMF is hit or miss - mostly miss- even with the new "Software Updates" feature recently rolled out. I followed a JAMF Training video https://trainingcatalog.jamf.com/update-macos on the 3 ways I can push out updates. I'm using the first method of creating a Configuration Profile and enabling the Software Update payload. Should there be a specific URL (Software Update Server. Specify a URL of the form http://server.net:8088/index.sucatalog) as suggested? I'm thinking this profile won't work if there isn't an update server to check with? 

Has anyone encountered this issue when trying to use 'Local Login' with Jamf Connect?It has been working fine for me up until now. I didn't make any changes to the config profile so I'm not sure how this has happened. 

Is it possible to enable non-admin users access to "system preferences > date & time > date & time"? Subpoints of system preferences > date & time are: -date & time-time zone-clock We want to allow (non-admin) users only to change the "time zone", nothing else. Is this possible or do we really need to open the complete "date & time" preferences for non-admins? Thx! Note: macOS 10.12.x

Fairly new to JAMF Pro and looking for a way to stop Self Service from launching automatically when a Mac logs in for the first time (after its enrolled via pre stage enrolment). Is it possible to stop the auto-launch but still be able to use Self Service when necessary?

I have made a script, with help from other scripts found online, that will take user input and then update user information on JAMF Pro. All working apart from where you enter the staff/students full name for example "John Smith", script is only reading the first word on the input and updating JAMF = John.  Been on this for a few hours trying anything that I can find and now I am at a loss of what I can try to sort this.   Any help on this would be very welcome :)   JAMF_FULLNAME=`/usr/bin/osascript << EOTtell application "System Events"activate set JAMF_FULLNAME to text returned of (display dialog "Please enter fullname " default answer "")end tellEOT` #Store input full nameecho $JAMF_FULLNAME   ------------------------------------------------------------------------------------------------------- Complete script for information:   #!/bin/sh echo ""#1. Get user input for usernameJAMF_USERNAME=`/usr/bin/osascript << EOTtell application "System Event

I've got an exemption group set for a handful of machines to allow them to use Screen Sharing. But when the compliance script run's its remediation it appears to be disabling Screen Sharing.The logs show that the rule failure being identified...   Tue Nov 5 14:14:09 UTC 2024 system_settings_screen_sharing_disable passed (Result: 0, Expected: "{'integer': 1}")   ...and then where the fix should be skipped because of the exemption...   Tue Nov 5 14:15:16 UTC 2024 system_settings_screen_sharing_disable has an exemption, remediation skipped (Reason: Exception - Remote-ScreenShare)   And yet Screen Sharing is being disabled as soon as the remediation is finished. I haven't modified the script. And there are no configuration profiles or other policies running to re-disable Screen Sharing.

The last post I can find relating to this is from 2017; There isn't a solution there and I've tried almost everything previously listed.We've been using JAMF for a few years mostly without issue - this is the first time we're seeing this error. There's a similar error "connecting to jamf server" which can be resolved by simply uninstalling and allowing JAMF to reinstall Self Service. No luck on this one. also tested:computer restart, trying from an IT account (removes any variables from the users startup items), refreshing the MDM, clean uninstall and reinstall of the JAMF Framework.I did find the list of ports, but we aren't seeing any blocked ports (on machine, router, or via ISP). Issue is present both on and off VPN (so that is irrelevant).Currently this is only affecting the one machine but as I don't have a fix there's trouble if it spreads. The Mac still has access to jamf controls via terminal, still receiving profiles and policies, still reporting in all information to the ser

So we have an ipad that I enabled lost mode, due to the fact it was overdue and the one who checked it out did not return it.  So then I locked it and put a message on the screen.  It was returned so I disabled lost mode, does the system take a while before it unlocks it?  I can see that the command is pending 12 minutes ago, along with other commands that are still pending since 7-2-24 after I locked it.  But what I am not sure is if this iPad has active internet connection so that it can receive the command.  How can I connect this ipad when it is locked and I do not think there is an active internet connection to it?  Will the factory reset method work and when I am asked to join a network connect it and then the commands will process?

I am working on creating a good way to track Macs that are not communicating over MDM properly. I have several Macs that are not getting profiles installed, profile changes, and are generally not working properly with MDM communications. One way I have tracked them down in the past is to create a profile, scope it to all computers and then wait to see which Macs don't get the profile. This works, but I wanted to dig a bit deeper. I have been trying to use this command to find out if Macs are reliably working with MDM: log show --info --debug --predicate 'subsystem == "com.apple.ManagedClient"' --last 1h The time can be changed to what ever I want. It seems that this command is only gathering activity from the Mac, not incoming MDM activity. That's what I need. Running the command above will result in a lot of information so I have used grep to make the output more focused. So far, I haven't been able to identify communication coming from APNS.  Just running the command from a Mac

Hi all, New to Jamf and I'm not seeing the connection on getting Free apps deployed. I followed the steps in the Jamf 100 Course but im getting "Pending - All licenses are in use or the license is not assigned yet". So I went to Apple Business manager and added 1 licenses for the application (im testing this). Made sure the VPP was configured inside of Jamf. What am I missing??This is a 100% free app... why/where do I need assign a license?

I've been using a policy executing a straight up restart option bound to a SCG that gathers every Macbook that hasn't been turned off for more then 10 days but I find the policy to be too invasive since it doesn't allow deferral as far as I know.I've been searching if there is a way to just send a notification if somebody enters a SCG on their Macbook but I can't find anything of the sort and I'm not very good at scripting either.Do you have any tips about it?Thank you

I have a workflow to rebuild a Mac that is working pretty well for our purposes, and I'm not really looking to change it.  The workflow is initiated via Self Service, and it starts with a simple "softwareupdate" command that downloads the installer and then does an eraseinstall.  My issue is that since Sonoma, after clicking Install (or Reinstall) in Self Service, and the workflow starts, but it gives the appearance of stopping.  The blue spinning circle stops and the button goes back to Reinstall, even though the workflow continues.  It has caused some confusion if there is more than one hand in the pot. Is there a way to shift the focus off Self Service and bring forward the Apple Software Update window, or a terminal window that shows the progress of the download so the users know there is activity going on? Thanks,        Gus

I am currently running JAMF 10.8.0-t1539715549 and I cannot for the life of me, get any EDU profiles to download to our Macs for teacher use of Apple Classroom. We have been using Apple Classroom with iPads since it was launched and we really want the teachers to be able to use the Mac version. Has anyone had any luck with this? Note, we are manually adding the classes to JAMF and are not using Apple School Manager for the classes. I don't think that should have any effect considering the iPad app works just fine.

Hello, we are currently experiencing issues with our Apple TVs and tvOS 18: connecting to the Apple TV for screen mirroring is not working properly, teachers have to repeat the process multiple times for it to work. We want to be sure that the problem is coming from tvOS 18 and not from our network. Is anyone also encountering this problem?Thank you

Dear Team,I have a script to obtain all browsers extensions (Safari, Edge, Chrome and Firefox) the script is running well and I would like to use it as EA. Can any body give a hand? ThanksHere is the output [Warn] This script may not be able to access all user directories unless run as root. Safari Extensions: User: xxx, Name: com.adguard.safari.AdGuard.Extension, Id: TC3Q7MAJXF Chrome Extensions: User: xxx, Profile Name: Person 1, Name: Google Docs Offline, Id: ghbmnnjooekpmoecnnnilnnbdlolhkhi, Version: 1.78.1 Firefox Addons: User: xxx, Profile Name: default-release, Name: AdGuard AdBlocker, Id: adguardadblocker@adguard.com, Description: Unmatched adblock extension against advertising and pop-ups. Blocks ads on Facebook, Youtube and all other websites. Here is the scripts#!/usr/bin/env bash _arg_multilineField=$1 _arg_wysiwygField=$2 # Determines whether or not help text is necessary and routes the output to stderr die() { local _ret="${2:-1}" echo "$1" >&amp

I have a script that worked before OS15. After updating to OS15, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~ #!/bin/bash# set the allowed SSID GUEST-VIPallowed_ssid1="GUEST-VIP"##Get the wireless port IDwifi_port=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}')# current preferred SSID listssid_list=`networksetup -listpreferredwirelessnetworks $wifi_port | tail -n +2 | cut -c 2-`# current connected SSIDconnected_ssid=`networksetup -getairportnetwork $wifi_port | cut -c 24-`# clean up ssidIFS=$'\\n'for ssid in $ssid_listdoif [ "$ssid" != "$allowed_ssid1" ]thennetworksetup -removepreferredwirelessnetwork $wifi_port $ssidsecurity delete-generic-password -a $ssid -D "AirPort network password"#echo $ssid Not allowed, and removed#else#echo $ssid is allowedfidone if [ "$connected_ssid" != "$allowed_ssid1" ]thenne

I have a large number of labs in our district and students will either walk away from their workstations at the end of class and rely on another student switch users or just lock their account and leave.  Both scenarios leave the student logged in.  This can create some issues when attempting to use remote commands so I am looking for a configuration or script that I can deploy that will log users out.  I would think the easiest way to do this is deploy something at the end of the day.  Just wondering if anyone has something they are using that they like.

Hi there! I'm tasked with migrating our devices from Jamf to WorkspaceONE. Working on a migration script to unmange computers automatically and have the user install an MDM profile for automated enrollment.  My issue is the JamfPro API Command to UnmanageDevice. Its just not going through. Here is the command I am using:  curl -X POST --header "Authorization: Bearer $bearer_token" "$JamfProURL/JSSResource/computercommands/command/UnmanageDevice/id/$DeviceID" The variables are working for everything else so it can authenticate into jamf and pull the device ID using the computers serial number, but this is the main blocker. Below is the response I get: <html> <head> <title>Status page</title> </head> <body style="font-family: sans-serif;"> <p style="font-size: 1.2em;font-weight: bold;margin: 1em 0px;">Not Found</p> <p>The server has not found anything matching the request URI</p> <p>You can get technical detai

Hi EveryoneI hope this document will help everyone who use Cortex in their environment for mac and manage via JAMF Pro. You can deploy cortex via Jamf. It is pretty simple and straight forward. All you need to follow PaloAlto Networks document: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-for-macos. Here you will find they have already pre-configure MDM profile for Cortex one for M1 and another one for non M1. you will get all those here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac-using-unified-configuration-profile#id945ae538-41d5-4b65-ad37-233fd665e992. After download unsigned one upload to your Jamf pro and make some changes as required and follow the document if needed. After upload profile scope your machine to have them on endpoint before corte

Hi there, i had a message that our push-certificat will run out in 1 month. I probably made a mistake while renewing this cert. I generated a complete new one and now i cannot push to existing computers anymore.   sudo profiles renew -type enrollment   Registration with the administration server has failed.The update to an MDM profile contains another push topic   What can i do? Frank  

I'm wanting to enable the "Defer Updates of software updates" to block Sonoma when it comes out, but we don't have an outstanding Restrictions profile in place.So take this screenshot from below.  This is some of the default things ticked/unticked etc in a Restrictions profile.So. if i JUST want to have the restrictions for defering software updates.....should i leave the existing options enabled....or....untick them all?I just don't want to push out a restrictions profile, and then block a load of things that perviously were allowed.Thanks

Is there a way to get a list of all installed software from the JSS? What I am looking for is a list of every installed application in our environment.

During integration of Jamf Pro with Entra, a Global Administrator account is needed and this account must exist on the Entra tenant. Often, we use the same account to set up the app registrations for Jamf Connect and to create the various changes for conditional access exemptions, etc. Once these are set up, can this Global Administrator account be safely removed from Entra without affecting any of the integrations or applications created?