hello, I am looking for a scrip to help me remove objects for inactivity of more than 90 days, however I have not achieved.I’m not that good at programming or command lines.I have researched and searched several forums however I have not found a script to help me run what I am looking for.someone from the community can guide me. I am new to the JAMF tool and my knowledge is very poor. 

Hey everyone, I am in the home stretch of an application deployment but have one user experience issue I would like to resolve if possible. I have a new working Sophos deployment, however I get the attached pop up any time the policy runs for install. It must be accepted to install the software and bypassing that for our end users would be excellent. So far i have tried xattr -d com.apple.quarantine /var/tmp/SophosInstall/Contents/Helpers/SophosCBR.bundle before the install kicks off with no success. Any input would be greatly appreciated on if this is even possible to prevent.

System Preferences -> Security & Privacy -> Privacy -> Advertising Does anyone know of a way to enable this via plist or conf profile?

Hi there, We use the "Restrict the App Store" option in Jamf Pro Profile Config but this seems to not do anything to stop a user from signing in with their own Apple ID into the App Store on their MacBook. Does anyone know how to block signins to App Store?

We're trying to scope smart groups based on Patch Reporting: {Application} Less than Latest Version. Currently we only have Patch Reporting: Google Chrome in there. How do we add more for other applications, or am I mistaken and Google Chrome is the only one supported by JAMF?

I'm trying to set up and test LogCollection. I created a Jamf user account and want to give it the barest privileges, only what is needed to connect and upload the logs. The only privileges I have configured for this account is create/update Attachment Assignments and create/update File Attachments. When I run the policy, I get the error "The request requires user authentication". What else do I need to provide this account to be able to connect and upload the log files?

Hi Team,Does anyone know how to enforce the screensaver after 15 minutes of inactivity and require a password to unlock in Sonama?I've been trying through a script but it doesn't seem to work, and end-users are still able to change the settings through System Settings., even after the screen lock Password is required need to unlock the screen

JAMF newbie here...Our K-12 school is looking at a hybrid approach in terms of technology and I'm wondering if somebody could share their experience or thoughts around this.Current situationTeachers are all assigned a laptop device (Microsoft OS) and we use Microsoft as our primary platform in the school.We have a BYOD policy for students and they are opting more and more to bring iPads to the school.  As a result, we considering rolling out JAMF to manage the iPads.  The majority of the apps we use are Microsoft (e.g. Teams, OneNote, etc)From a management perspective, could the teachers still engage with JAMF features such as lock screen, etc from their laptops or would they need an iPad as well to do this?

Hi Guys,I've been following the documentation and training videos for setting up a limited access DMZ deployment of Jamf Pro, which for the most part has been easy to follow. I've updated web.xml to block access to the api servlet, but wanted to remove the documentation as well. The relevant step in that training instructs you to remove the API directory from the web root to stop the API documentation being accessible... only there is no API directory on my deployment. If I access: https://jamfproserver:8443/api I'm presented with a page that allows me to choose between "classic API" and "JAMF Pro API" pages. I've removed the classicapi directory, so it 404s, but the JAMF Pro API link takes me to active documentation. I assume this folder has simply been moved and the training / documentation is lagging behind, in which case I'd love to know where it's now located. Any help appreciated!

Hi friends,I am new at Jamf and appreciate your help.We use Jamf Pro in the cloud and we have a local Microsoft CA server.My goal is to install certificates from the local CA using Jamf pro cloud on the mac devices.I understand there are two ways to do this:1. Using Jamf ADCS Connector2. Using Jamf SCEP with local NDES serverAm I right?What is the right and secure way to do it?We also have Azure and Intune if that can help. Thanks  

Our previous Jamf admin showed me how to package Citrix Workspace for Jamf, but at that time it was a PKG file. Now it's a DMG. The Installer PKG (in the DMG) bundles Citix Workspace and something called "Citrix Enterprise Browser". There's a way to install just Citrix Workspace, according to https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html (search for "Install only Citrix Workspace app" on that page). You need to download an XML file and then can run a Terminal command line that installs the Citrix Workspace.app file in your desired location.So my bright idea was to take that .app file, drag it to Composer, then build a PKG to get just a clean install of Citrix Workspace that I could then deploy via Jamf, but it doesn't work. The app installs, but when I attempt to connect to Citrix, the cursor just spins forever and doesn't connect. But when I launch the app using the build instructions from Citrix, I can connect just fine.I'm not sure

I have a bit of dilemma where I need to remove Jamf Framework and enroll many devices at once. I was thinking we can do something with a script:#!/bin/bashsudo jamf removeFrameworksudo jamf enroll -prompt -nopolicy #After this is run, it would request for JSS and password.  This is where I am stuck. I understand this is a bad Security practice. But I still want to do this. I was thinking of creating a one-time account to do this push and removing the account.With that said, my question is:Is there a way to add the username and password inside the script so that when "sudo jamf enroll" runs, it uses the credential to bypass it? I don't want the users to enter the credentials instead use a one-time script to run everything and complete it.

Hi all,We have tested out the Jamf Compliance Editor and it works wonderfully till the point that we wipe the laptop and re enroll it. In order to better understand and troubleshoot the availability of the policies, we have set the remediation and compliance policies to ongoing and also added them to self service so that we can see when we run run them. For some reason, on a wiped laptop the remediation policy will be made available only one time after i ran the audit policy. However, the laptop wont be scoped to the remediation policy after that no matter what we did: Restart, waiting for 24-36 hours, reset baseline, ran audit policy again, delete the device from Jamf before enrolling, erasing the Macbook reinstalling OS from scratch and enrolling. The only thing that did work, was to install the compliance editor on the wiped laptop locally => create a new project => select the standard that we are aiming for (CIS1 in our case) => Create Guidance => Cl

Testing installing this app https://github.com/root3nl/SupportApp and something isn't quite right that I can't figure out.  1. I have a Policy with this package where the Scope is my test computer.2. I have a Configuration Profile using Application & Custom Settings > External Applications using this json file.The Scope is a Smart Computer Group.3. The Smart Computer Group uses Criteria where the Profile Identifier "is" the Value of "149694A2-D63C-4195-94C6-26B778EFA58D" which is the Identifier of the application. The app is installed on my test computer but it is not picking up any of the settings from the json file. Any input would be appreciated. 

I am looking for a solution to disable/hide the ability to activate Airplane Mode on iPadOS. I work in a K-12 school district and we have lots of devices around for various needs. Some offsite as well. Students and/or parents are turning on airplane mode and not allowing us to communicate with the device. I understand they can just disconnect from their own network but I'm trying to mitigate possibilities for no connection. If there is a way, pleas let me know what you got. 

I am in the process of installing Sophos using a policy. Sophos has several PPPCs, and Kernels that need to be put in place. These are being pushed by a configuration profile.I do not want the install of sophos to happen before the configuration policy is on the system, yet I do not see any option when creating a smart computer group to determine if the configuration policy has been applied.  How do I verify the policy is in place before the install? Thanks in advance for your help!

Is there a way to control notifications settings for apps deployed from Jamf Pro via something like a Plist file?

I am having issues updating a classic API script with the bearer token. Testing the script below I seem to have an issue somewhere as the variable will not propagate accordingly. I am getting "MBA-1" every time I run the script.   # Getting the computer's serial number to make the API call serialnumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') # Decrypting the string above function DecryptString() { echo "${1}" | /usr/bin/openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } string=$(DecryptString $EncryptedString $Salt $Passphrase) model=$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk '{print $3}' | sed 's/[1-9].*$//') case $model in MacBookPro) short=MBS ;; MacBook) short=MB ;; MacBookAir) short=MBA ;; iMac) short=IMC ;; *) short=UNK ;; esac # A basic API Call that's getting information for the computer. # computerxml=$(curl -s -H “Authorization: Bearer ${token}” -H ${jamfurl}/JSSRes

Each week we go through and find the machines that have a 'Filevault 2 Individual Key Validation' of 'Unknown' and reach out to those users to resolve (via check in, reboot, etc). My confusion is why they validations becomes 'Unknown'. I imaged a machine recently and the validation was 'Valid' and everything was fine, but after turning it off for a few days it later became 'Unknown'. What causes Jamf to no longer recognize the key is valid? The machine was imaged and had a valid key then only a day or two later it became 'Unknown'.Did it try to rotate itself and the new key just needs to be validated by Jamf? If that's the case, how can we change the rotation frequency?Does it regularly need to check-in with Jamf to validate the key even though it hasn't changed? If so, how can we tell it to validate the key less frequently?We have a smart group enabled and use the 'Issue new FV key' policy on it but we aren't sure if that's helping at allhttps://learn.jamf.com/bundle/jamf-pro-doc

I am seeing this issue with Macs running Sonoma and Connect 2.27.0. I am not sure if Connect is actually causing this but it is currently my prime suspect.What is happening is this. The Mac boots up, asks for a PW to decrypt the drive and then opens to the Finder no problem. I can also log in using the Local Login option. If I then log out, it brings up Connect and I can log back in no problem.But (you knew this was coming) if I lock the screen or put the machine to sleep from the Finder, when it wakes up and asks for a password, it will not accept whatever I enter. It acts like I'm entering the wrong password and I can't get past this and must reboot the machine to get back in.Anyone else seeing this? I have't seen it on any of my machines before Sonoma.

When enrolling a computer I have the need to automatically add the device to an AD security group after the AD bind. I attempted to use dseditgroup for this but it does not seem to recognize computers (even though there is a "-t computer" option). Has anyone done this or know of a way to automate this via a script as part of the enrollment process? Thanks.

Hello All,In our environment the Loggen in User name is in firstname.lastname format and I am trying to figure out how to extract the first name with a script. Till now what I have is below #!/bin/bash#gets current logged in usergetUser=$(ls -l /dev/console | awk '{ print $3 }')Echo $getUser#gets namedfirstName=$(finger -s $getUser | head -2 | tail -n1 | awk '{print toupper($2)}')computerName="ABCD-ABM-"$firstName"-MacBook"Echo $computerName#set all the name in all the placesscutil --set ComputerName "$computerName"scutil --set LocalHostName "$computerName"scutil --set HostName "$computerName" sudo Jamf reconAnd the result I am getting is - ABCD-ABM-LASTNAME-MacBook I am not good with scripting however what I understand is the 'firstName' is unable to fetch first name from firstname.lastname however same works good when the name is like firstname lastname. 

Hi,  How can I create new admin user using command line and user home will be delete automatically when remove from System Preferences?I successfully create new admin user using the following command but when I delete this user from system preferences the home folder will not delete automatically compare to users create manually from system preferences.Any advice?Thank yousudo sysadminctl -addUser Admin -fullName "Admin" -password admin123 -home /Users/admin -shell /bin/zsh -admin

Heard today that there is no option for Virtual Attendance at JNUC 2024. ------------------------------------------------------------------------- EDIT 02/15/24 - It appears that recorded sessions will be made available in November. Information regarding this was buried in the FAQ for the event.  Still a bummer though.    The original message below may be ignored.  ------------------------------------------------------------------------- This development saddens me, and I'm sure it will make others sad as well. Charge us more to attend virtually if you must to make things happen this year. Many customers cannot attend live for whatever reason. Some may not be able to get hotel rooms to make the stay, others may not be able to break away from work. Having the virtual option keeps us all in the loop, without it, it is like being on the outside of a movie theater during a major summer release.     Don't shut out your customers Jamf. Be more inclusive tha

When I filter a list of computers in Jamf Pro there is a column heading that says BOOT FULL. What does this mean? Thanks,Jim