Is there an option to remove a user's ability to perform mass actions in jamf Pro?  We recently conducted a risk assessment, and we discovered that anyone can perform a mass action as long as they have permission to use that action on an individual device.  Is there a permission or another tool you have used that would remove the jamf users ability to do something like wipe all devices but allow to still wipe one device at a time?

Hi I would like to:Defer a major update (from Sonoma to XX) for 90 days & Allow all minor updates (from 11.5.2 to 11.5.3) How i can achieve that. 

Is there a way to display a computer group in the Jamf Pro Dashboard based on whether it is Locked in Computer > Management? I tried all the advanced options but could not find anything that seems to work.

Historically, I've been using this command to restrict modifying WiFi settings to admins only: /usr/libexec/airportd en0 prefs DisconnectOnLogout=Yes JoinMode=Automatic JoinModeFallback=DoNothing RememberRecentNetworks=No RequireAdminIBSS=Yes RequireAdminNetworkChange=Yes RequireAdminPowerToggle=Yes I've recently realized this no longer works on Sonoma.  Does anyone know of an alternative way to enable this on Macs running Sonoma?    

Just curious if anybody has run into an issue where you uninstall app, but won't reinstall, but the policy logs show successful reinstall. A while back I was testing a snagit version and used the uninstaller, but after that, I could never get it to reinstall. I went through the Mac and removed every file related to Snagit, went in to the /Jamf folder and removed anything related to snagit. For that I eventually just reimaged it. I just came across the issue again uninstalling cisco secure client. I have a script that uninstalls the old version of AnyConnect and modified it, but it broke something and didn't uninstall. I gave myself admin rights and just ran the uninstallers for both the client and the dart agent. Verified all other files were gone including in the /Jamf folder. Now when I try to install the old version which we use in our current deployment, it doesn't install, but the policy log says it was successful. It does install the /opt/anyconnect folder, but not all the compon

In a recent deployment of the SecureConnector, we are discovering a large number of systems generating errors after the SecureConnector deployment. It is suspected the process is being spawned twice. Our install policy is very generic without any custom configurations. Has anyone experienced similar behavior or found a resolution? 6/29/15 9:16:46.339 PM sshd[22462]: error: Bind to port 2201 on 127.0.0.1 failed: Address already in use.6/29/15 9:16:46.340 PM sshd[22462]: fatal: Cannot bind any address.

Is there an updated script to install Google Drive? I have been trying to deploy Google Drive via Self Service using the package installer. 9/10 times it fails, whereas installing Google Chrome with a script works every time. I would like to do this with Google Drive. I have seen a few scripts out there, but they are many years old.

I've run into this issue a few times on different machines, where i let a user upgrade to the next macos version and after downloading the update it prompts admin credentials to install. Neither the local admin or the user's secondary admin accounts work and the only way to upgrade the macos is to sign out of the standard user, sign in as one of the admin accounts and run the update there. Is anyone else running into this issue too or found any solutions? It isnt bad when they are in the office, but remote users without access to admin accounts are unable to upgrade their os.  And yes, jamf has the software update ability, but ive yet to see that succeed in working for major updates. 

Hello All,On a Standard Account, when user tries to upgrade to MacOS Ventura it's asks to enter admin credentials.On the Same machine when it's asks for Monterey 12.6.1 Update, user can update it wit out any admin rights. Trying to find out what could be the issue and how can we mitigate it.Thank you. 

I would like to know a single platform for upgrading and updating macOS with standard user permissions. Does anyone use a single platform for M1/M2 & Intel Mac in their environment? 

Hello everyone,I'm a new Mac JAMF admin at my organization and first time poster here. First off want to say thanks to the community here, as I've already received lots of help here already perusing the forums with other questions I've had (that have previously been covered).  I do have a question as it pertains to firmware / recovery locks as it pertains to M1 Macs.Currently managing a fleet of around 700 Macs. I'll just state what our organization is wanting to have happen and maybe some of you have suggestions that I haven't thought of or found. I have orders from up top to try to lock down MacOS, so employees are unable to wipe it and bypass JAMF. There was some sort of an incident, which has prompted this request. Ultimately if a user is having a problem with their MacOS device, we would like them to bring it to IT for a reimage to ensure the JAMF MDM profile is present. It was my understanding a Firmware password was previously used on Intel Macs but this feature is not pres

Forgive me if this is answered in another discussion - I have seen similar posts, but nothing that gets to the root of what I am trying to accomplish. I am also, unfortunately not versed in BASH scripting, hence the reason for reaching out... I am trying to put together a policy that includes a script to completely remove any installed versions of Oracle JAVA - including multiple JDK versions if found. I am familiar with the official method published here: https://www.java.com/en/download/help/mac_uninstall_java.xml However, if a machine has multiple JDK versions installed, I need a way to detect those and loop through an uninstall command to remove each. Does anyone have a script that will accomplish this? Thanks for any insight that can be provided... Brian

we are using jamf connect for account creation for our environment and we are populating accounts from okta ldap and okta is idp.I am able to download and enrol my device with user initiated process but for auto enrolment I am not able to proceed after doing authentication with okta.I can provided crews and I can approve okta prompt for authentication successfully but right after successful authentication the login window on the devices remains as it is and password box goes blank. 

I have a CIS requirement from our security team that will disable an NFS, HTTP, and FTP server and I'm having a difficult time coming across anything on JAMF Nation or Google searches. Is anyone doing anything like this? Thanks!

For safety and sanity, we'd like to be able to disable this feature on in our fleet. I couldn't find any documentation on a configuration profile payload or policy setting or even a homebrew script to disable this feature. A config profile would obviously be best as it would prevent the users from re-enabling. An ongoing policy that uses either a script or an actual policy payload would be... fine I guess, but less preferred as between recurring checkins the user could do whatever they wanted. Does anyone have any resources on this?

Hello, I did a bit of searching for this answer, but I wasn’t able to find anything as exact as what I’m looking for. I have a 100 something iPad 8th Gen’s. I keep getting told that they will no longer be supported in Jamf Pro around the fall of 2025. This is from someone internally in my company. From what I’m seeing, it’s not necessarily 8th Gen’s that are no longer supported, it is devices that are not able to be updated to a certain iOS.The way I understand it, as long as the device is not older that 4 major iOS versions, then it is supported. So in the Fall of 2025, as long as the device is iOS 16 or higher (assuming iOS 19 comes out), it is still supported. Am I correct on this?

HelloFirst of all, sorry if this is already solved in some other thread. I have not found it.It turns out that in my son's school they force me to install on his computer the JAMF application to know what he does during school hours. But it so happens that I don't want them to be able to know what my son (or whoever may use the computer) does outside of school hours. I assume that the hours when the application works can be configured in the application. But since they are the ones who install it, and I don't have administrator permissions on it, I can't know if they set it up correctly or not.What options do you recommend me so that this does not happen? I had thought of creating a virtual machine and have them install the application on that machine. Another option I had considered was to install a second operating system on an external hard drive, and outside school hours boot the computer from it. But maybe I am making my life too complicated and there is a simpler option, such as

I've got multiple developers who are having an issue where when connected to Cisco VPN User Tunnel, they are not able to connect to a USB connected iPhone in Xcode.  When not connected to Cisco VPN User Tunnel, the developers are able to access the USB connected phone without issue.

We have set up Single Sign-on via Azure, and it works like a charm.However, a couple of weeks ago, an alert popped up that the "Signing Certificate issued by SSO Identity Provider is expiring in .. days".I followed the instructions to "Visit your SSO Identity Provider to update the certificate", and the newly activated certificate is valid until June 2026.   But, the alert does not go away.   In the SSO settings, we originally linked to a URL for the Identity Provider Metadata Source; and, this URL did not change in Azure when the new certificate was activated.  I tried to replace the URL with the updated metadata file, but still no change in the alert. I suspect that the best practice for SSO certificate management involves updating it more than 30 days ahead of the expiration (30 days, being when the alerts started); and, since it progressed to the point of alerting, it can't be undone?   Having reached this point, however, I wonder what I can

Hey Jamf Admins! We're getting back into the swing of things at Rocketman Tech and part of that swing is LaunchPad - The Jamf Admin Meetup! The Rocketman Tech team will be presenting a JNUC 2024 Recap where we will discuss macOS Sequoia, CIS Compliance, Blueprints, and Platform SSO with Jamf Pro.Date: October 11th, 2024Time: Noon MDT (GMT-6)Register here: https://rkmn.tech/j-launchpad  Additionally, we're super curious about everyone's favorite sessions from JNUC last week. If you weren't able to attend this is an excellent opportunity to get your hands on a curated list of the best of the best from JNUC. Survey: https://rkmn.tech/launchpad-survey As always, super stoked to see y'all there!- Caleb  

Hello,Using JamfNow, I am able to enrol a Mac purchased via Apple business. (i.e. device was automatically inserted into ABM on purchase of device by Apple).I am able to use created blueprint within JamfNow to push the setup to the Mac.I have 1 issue, the status screen for the device says that Activation lock is not activated, when I look on the Mac looking at System Information I can see that activation lock is not activated.   I have tried the various combinations of activating Find My on the Mac, deactivating, wiping the Mac, reinstalling. I have gone as far as wiping the Mac by erasing disk and reinstalling OS around 10 times trying the various combinations without luck.I have even have gone as far as removing the Mac from JamfNow and ABM and trying to get activation lock to activate outside of the ABM without success.My understanding is that while a user cannot remove the management profiles, they could wipe the Mac and reinstall using their own Apple ID or if stolen the

Hey Everyone! We are looking to send out documentation to our fleet on how to enable and use TouchID on their macOS system should they want to. That being said, I am having a hard time determining which macOS systems in our fleet even support it. I am not looking for if it is enabled, disabled, or if fingerprints have been registered just trying to see if the touch sensor technology is even there on some systems in our fleet. Can this be accomplished with an Extension Attribute? If so, can anyone point me in the right direction? I tried like every one of them suggested in this thread but not working on 14.5 Sonoma as an EA or linked to a Smart Group: https://community.jamf.com/t5/jamf-pro/touchid-extension-attribute/m-p/170024 Looking to avoid painstakingly going through each model and looking it up, hah. Thank You!

Is there any application that can be used for the iPad and Macbooks to record the screen as it goes through ADE? I want to be able to use this for training purposes for our staff and IT department to make how-to. I have a bezel but it doesn't allow the ability to record the enrollment screen when enrolling a new device through our prestage. 

Hi All,   Has anyone got the script enable the migrating local account with cloud identify (Azure), Pleas see link for more information:  https://learn.jamf.com/en-US/bundle/jamf-connect-documentation-current/page/Existing_Local_Account_Migrations.html Kind Regards

 Hi Jamf Nation, Is there a remote lock script that someone can recommend for a Mac in Jamf Pro that not managed? (Can only be deploy by Jamf Pro)Also is there a script to turn Mac's from unmanaged to Managed in Jamf Pro? Thanks in Advance Nation!