I looked through Configuration Profiles but not seeing anything for this. On the Advanced tab in Network configuration, there is a check box to only allow administrators to turn off wireless. Is it possible to set that with a Configuration Profile so that users cannot turn off wireless?

I'm trying to figure out how "Allow user to be granted first secure token" functions on the back end. I have seen a few tools that will generate the first secure token for a local account they create if the secure token has not been generated yet. Apple is claiming this is impossible, which has me wanting to know how it works even more. Anyone know the terminal command the Jamf binary is using for this?     New Features and Enhancements - Jamf Pro Release Notes 11.2.0 | Jamf

I need to remove the signature from a profile so that it is readable. In the past I have used this command:  openssl smime -inform DER -verify -in /Path/To/Profile I get a "Verification failure" when I try this. How can I remove the signature? It has been a while since I have needed to do this so has the procedure changed? I found some websites that said I can do this using Configurator but the profile won't open in Configurator. 

Hello!We have a Jamf Connect window setup that works well except for one part: If you are a new hire and haven't setup your account yet (we use Okta), when you receive a new machine and get to that window, you'll let it sit but it will auto-continue to a standard MacOS login window. Without walking through the setup process that immediately follows the JC window, the machine will never pickup your username and you'll find yourself in a type of soft-lock where the machine doesn't have an account to use and we need to reach out to these users to walk them through a complete wipe/rebuild from Recovery. I assume there's just some setting/property in our Jamf Connect config profile that "autocomplete's" but I'm unsure what it is. Potentially the "Allow Local Fallback" property? We use that for it's intended use after the user has already setup an account to login to their machine, but our problem of course occurs only for new hires only when they haven't setup an account first.For what

I have a 10.13.6 fresh build mac with an local admin account created by macOS setup Assistant it has a secureToken, but then i bind the machine to our AD which has the setting enabled for mobile accounts, then login as a AD user and get the prompt Enter a secureToken Administrators name and password to allow this mobile account to use file vault.You can select bypass but would prefer we dont get this prompt in the first place for non filevaulted machines.Does anyone know how to suppress this?thanks

Hey Guys,I´m currently looking to get a List of Static Groups from a specific computer. I found the API command: v1/computers-inventory-detail/{id} getting a large JSON with the Details.Now I want to cut it down to:1. only the Arrays from Key "groupMemberships"2. maybe to all Arrays with "smartGroup=false"I tried with plutil -extract, but I cant get the right Keypath...Here is an example of my JSON:"id" : "866", "udid" : "6A94F1BD-XXXX-XXXXX-XXXX-ECB58DFA0B61", "general" : { "name" : "MC-XXXXXXXX", "lastIpAddress" : "XX.XX.XX.XX", "lastReportedIp" : "XX.XX.XXX.XX", "jamfBinaryVersion" : "11.7.1-t1721056075", "platform" : "Mac", "barcode1" : null, "barcode2" : null, "assetTag" : null, "remoteManagement" : { "managed" : true, "managementUsername" : null }, "supervised" : true, "mdmCapable" : { "capable" : true, "capableUsers" : [ "XXXXXX" ] }, "reportDate" : "2024-08-21T06:55:17.421Z", "last

Hi, I'm Andy.I finally figured out how to do this.So if there are other Archicad Users out there... enjoy! Just thought I would share this since I couldn't find any posts on how to do it. I will be using Composer & Archicad 25 Full Installer 4013 for Mac.Download the Installer to your Mac, and mount it.https://graphisoft.com/resources-and-support/downloads?localization=USA&type=AC&version=25to the side, open a Finder window to /Users/SharedDrag the Archicad Installer.app into /Users/Shared Open ComposerDrag the /Users/Shared folder into Composer on the left bar This may take some time to copy overRemove everything in the folder inside composer that you do not want. Click on the > next to your Shared Folder in the Left Bar Select ScriptRight Click > Select Add Shell Script > postinstallCopy this script: (reference: https://helpcenter.graphisoft.com/user-guide/76135/)/Users/Shared/ARCHICAD\\ Installer.app/Contents/MacOS/installbuilder.sh

I have been having problems getting Symantec Management deployed during my enrollment process. Like a lot of Apple admins, I use a script that runs the whole ZTP process. All other apps deploy reliably with no issues. What makes this even harder to figure out is that if I use Terminal to run the SAME POLICY that is being ran during ZTP, it works. Every time. The ZTP script is running "jamf policy -event install-symantecmanagement". The only difference between this and me using Terminal is that in Terminal, I need to use "sudo" before the Jamf policy command. Also, a Symantec Management install policy that we have setup to run at check-in for Macs that don't have it installed for some reason works. There is only one Symantec Management install policy. It works when we use Terminal. It works with a check-in policy, but it won't work when the ZTP script runs the policy. Here's the breakdown of the install policy. I get a "Cloud-enabled Agent Installation Package" from the app owner at my

I am looking for a pilist which has Adobe Acrobat feature lockdown settings in plist,

 As shown in the below screenshots, after clicking "Change Password" then authenticating, I am taken to a home page screen. I then have to scroll down and select "Change Password" again. When changing the password there, an error occurs. I am using Jamf Now's Jamf Connect option with Azure.    

We use Okta as our main identity provider, and I'd like to leverage that alongside Jamf Connect to get Zero-touch working in my environment.  is there any advice for disabling Nomad and getting Okta and JC working nicely together?

Hi there, Jamf App Catalog is great at patching applications. The only caveat is the method that it uses to communicate with the end-user that an update is pending. Most of our users ignore or are unaware of the notification from Jamf App Catalog when a new update is pending and as a result complain of their apps getting abruptly closed. This is compounded by an ongoing issue of inconsistent notifications (an issue that has been open for a couple of years).   Is there a way to mitigate the above issue by maybe a passthrough of a notification to a prompt or dialog box that the user can interact with? All my attempts at trying to resolve this issue is cut short by there being no direct feedback on the local machine that is recording Jamf App Catalog interactions with the local machine i.e a log that can be leveraged to base notification triggers on a Jamf Pro policy and Notifier App.   I thought to leverage IBM Notifier for this task as it would be ideal. Except that once

 Greetings all,Until last JAMF Pro update i had no issue with the script below. But as of today, the script returning blank result without error. Any idea ?   APIUsername="" APIuserpassword="" JAMFServer="" EAID1=69 JAMFAPIToken=$(curl -X POST -u $APIUsername:$APIuserpassword -s $JAMFServer/api/v1/auth/token | plutil -extract token raw -) DeviceSerialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') curl -u $APIUsername:$APIuserpassword -H "Accept: application/xml" $JAMFServer/JSSResource/computers/serialnumber/$DeviceSerialNumber/subset/extension_attributes | xpath -e \\ "//*[id=$EAID1]/value/text()" 2>/dev/null 

Does anybody have a way to look for Rapid 7 and it's version? it doesn't seem to put anything in the /Applications folder.

@MakiK 現在「Return to Service」Appsの検証をしているのですが、何も操作せずに復帰しますが、最後に下記の注意がポップアップします。先週のイベントの動画では表示されなかったと記憶しています。これはReturn to Serviceの「Appの構成」タブに記述する内容が不足していると言うことでしょうか。

Hello everyone,I have received command entries from JAMF tech support to adjust our password policy that is reporting errors. I have been running these commands manually with a remote session with the user and it works. Is there a way to create Policies so that this will run without the user and myself involved? Reboot is not required but to run the commands requires user name and password in Terminal. On the user's Mac in Terminal run  sudo jamf removeframeworkOnce that completes stay in Terminal and  run  sudo profiles renew -type enrollmentAny help is much appreciated.  

I tried creating shortcuts directly on iPads and it let me do that but after refreshing the profile they disappeared! I then found out about the Web Clips and put those in my profile and organised them on the Layout however they don't show on the iPads either!Can someone explain how I get URL shortcuts on to a home screen please!

I looked all over the internet, tried ChatGPT and can't find anything to allow a few websites to pop up windows.  This is affecting our Intune Integration when Safari opens and it goes to login.microsoftonline.com and device.microsoftonline.com. It take 2-3 times before we can successfully get through the enrollment.Does anyone know how to do this, I don't want to allow all pop-ups as I think that is dangerous. Apple isn't making this easy.  

We have been using Nudge as a means to prod users to update for a few years and it has been flawless until recently. In test machines Nudge is no longer running despite having the launch agent installed being included in our managed login item profile. Manually installing the Nudge suite causes the service to run, but it doesn't pick up its settings in our Nudge config profile (minimum OS and whatnot). Granted we created our Nudge config profile back with version 1.x. Comparing the json for 1.x to 2.x looks identical, so I don't think that is our issue. Has anyone experienced something like this? 

I haven't used the Software Updates feature before. In the past, I have tried performing a mass action using a static group for testing. Yesterday, I decided to do that for some of my hot spares on the bench to take them from 14.5 to 14.6 and discovered that we had enabled the Software Updates feature. This understandably removed that ability from an action, so I figured I would give it a try with an eye towards deferrals as the "killer app" of the process.We control updates on our active machines with some restrictions payload and restricted software, but the spares are a little more relaxed. The only thing they get is our software update payload, which is set to make sure updates are automatic and enabled:So I decided to take two of them, put them in a static group and run the following:This ran very much like previous experiences with the MDM action. Devices eventually handled the commands and downloading/staging commenced. I set one machine aside with the 'REBOOT(8)' man page open

Hey everyone. I deployed a policy that runs a script which notifies users that they need to reboot their Macs. The policy is scoped to a Smart Group that contains users whose Macs have been up for 10 days or more. The issue I'm running into is that after the users reboot, they're seeing the notification again. My guess is that an inventory update isn't happening quickly enough after the reboot to remove them from the Smart Group. Can anyone help me configure this properly? Happy to provide any other details. Thanks in advance!

Greetings all, We're getting our Fall builds ready, and again I am facing the issue of automating the software installation for the Wacom tablets in our Industrial Design (17 Cintiq 27" panels) and Multimedia (10 Wacom 12" LCD tablets) labs.  I'd really like to not have to walk around to each one of these to individually allow the permissions they need (which is Wacom Technical Support's position). Does anyone have, or know of, a way to automate this, particularly in Jamf Pro, but I'll take anything.  We are running Big Sur on a variety of Mac types, but no M1's have Wacoms hooked to them yet.  There were a variety of suggestions in Jamf Nation last year, but most of them were for Mojave and we were unable to get them to work successfully in Catalina. Thanks in advance for any suggestions.

I am working on a script that uses Swift Dialog to prompt users who have been running their Macs for a long time to reboot. The script creates a launch daemon after getting user input from Swift Dialog. The user is offered a drop down menu with 4 options: Reboot Now, 1 hour, 4 hours, 1 day. The StartInterval for the launch daemon gets set based on the option the user chooses from the drop down menu. Users are allowed 3 deferrals which I track using a PLIST. After the time set in the StartInterval elapses, the user is able to choose a different option. This changes the StartInterval to a new value. I included a step in the script to bootout the launch daemon just before it gets deleted and replaced with a new one containing the new StartInterval. When the new launch daemon is installed, there's a step to bootstrap it. I see in the policy log that the bootout step is failing, which then leads to the bootstrap step also failing since the launch daemon is still running.  Boot-out fail

Hi All,We have a few laptops that are actively checking in and performing inventory updates however, there are a couple commands that have been pending for a week, like the "lock device" command.I have attempted the following in an attempt to fix:Canceling all pending commandsSending a blank pushAny ideas on what could be the issue? The lock command has worked well in the past and the only thing recently changed was the MacOS updates(beta) was turned on and we've been upgrading people from 14.0 to 14.6. All devices were already on Sonoma before the issue arose.

Good afternoon,We are currently testing the Compliance Editor and have deployed the CIS Level 1 benchmark to three test devices via Jamf Pro. The benchmark appears to be fully implemented on these devices. However, the 'Sonoma CIS Benchmark Level 1 Audit' in Jamf is showing that the devices are non-compliant because Siri Listen was not disabled (system_settings_siri_listen_disable). I checked the devices, and Siri Listen was already disabled (screenshot below) before the CIS benchmark was applied. Does anyone know how can I resolve this false positive?  Thank you.