Hey guys, we're looking for an opportunity to grey out the option "Allow this user to administer this computer" in system settings. Our users are no local admins and we do not want them to enable that option. Any ideas? thank you so much, Best, Florian

I know that most folks are recommending user-driven provisioning where the end-user gets to enjoy the process of being involved in setting up their Macbooks. Our org is not one of those. Our users prefer to get their Macbooks and get to work immediately and not have to wait for apps to install or things to be configured while they sit and do nothing. We achieve this in Windows by pre-provisioning (Microsoft calls it white glove) where we assign common apps (Office, Chrome, VLC, etc) to the devices rather than the user and we leave user-specific apps (not all users get Adobe Creative Cloud for example) to be installed after the user logs in. This way, we can get a fleet of Windows laptops ready for use by anyone with very minimal delays experienced by the user (they can work in Outlook and Chrome while Adobe CC is being installed in the background). I plan to achieve the user side of things using DEPnotify but any suggestions how to pre-provision common apps? Is putting the comon a

I'm looking for a way to not have Keynote, Numbers, and Pages install on enrollment. Is there a way to do this? Or do I just have to remove them afterward?

Lately, every Mac that has tried to perform user-initiated enrollment in Jamf has been met with "Device Signature Error in the jamf log. To resolve, we perform these steps:1. Remove Jamf Framework2. Remove Jamf CA certificate3. Remove contents of /Library/Application Support/JAMF/Downloads/4. Run this command: sudo update_dyld_shared_cache -force5. Delete the mac from Jamf console6. Run the QuickAdd package on the mac7. Approve the Device Management Profile on the Mac8. Assign the user to the Mac in the Jamf Pro console This issue seems to have started with MacOS 10.14.5, but that may be coincidence. I have attached screenshots from an affected Mac. We have 3 macs that are broken right now, and 2 that were repaired using the procedure above. Anyone else seeing encountering this?

I am working with a Jamf environment that currently does not have any Jamf LAPS capable admin accounts. They did not create a “Management Account” in User-initiated enrollment. They did not create a “local administrator account” int PreStage Enrollment.   We have since specified a “Management Account” and a “local administrator account”. With two separate names. They are using Apple Business Manager Automated Device Enrollment. There are some locations that do not have ABM, so they are using User-initiated enrollment. (That is begin resolved). LAPS is working with newly enrolled Mac systems using either admin accounts.    Is there away to retroactively add a User-initiated enrollment “Management Account”? I’ve tried using “jamf policy -trigger enrollmentComplete”. This will successfully re-run the enrollment policies, but it does not create the “Management Account” from User-initiated enrollment. “profiles -N” does work. But that requires user interaction.   Thought

I am trying to automate the creation of an Outlook signature and I have most of the parts down except I can't find a way to pass values from User and Location to the script. I thought passing $FULLNAME or $POSITION as script parameters would work but all it does is literally pass the string "$FULLNAME" to the script.

Hello!I need a hand writing an Extension Attribute script to gather "Reason for privilege elevation".The below command works in Terminal directly on a Mac running macOS 14 to gather the info but I don't know how to then parse it into a script for an Extension Attribute. The text in bold is what I want to gather. An endless running list of reasons would be ideal. Any help would be much appreciated 😊sudo log show --style compact --predicate 'subsystem == "com.jamf.connect"' --debug --info | grep "Reason for privilege elevation:"Result:2024-04-04 10:09:22.221 Df Jamf Connect[55703:31aeb0] [com.jamf.connect:PrivilegeElevation] Reason for privilege elevation: Admin elevation test 12024-04-04 10:18:37.006 Df Jamf Connect[55703:31aeb0] [com.jamf.connect:PrivilegeElevation] Reason for privilege elevation: Figma install

Anyone sussed out a way to remotely manage the startup security utility settings on Apple Silicon Macs? We use a lot of music production software that requires the "Reduced Security" option to be enabled and I haven't seen a way to deploy these settings either in PreStage or as part of enrollment. Is manually changing these on each device the only option here? Currently all devices on Ventura but moving to Sonoma over the summer.  Appreciate any help. 

This may be a newbie question but I have looked everywhere: Initially I was trying to get Jamf Tools: after some googling, it says I will need jamf nation account and go to My Assets.I create a jamf account for myself but ofcourse, no subscription hence no tools.My workplace uses Jamf Pro. I thought I can connect the two together and download the tools I will need. How do I connect the two together so I can use their subscription and download the jamf tools? If you say, "you dont connect your personal jamf nation account to their company's Jamf Pro":1. Do you create a new jamf nation account for each company you work with?2. My initial thought was I would use my jamf nation account -connect it to work email-work company and get the subscription and once I move to a new company, I would "un-link" and connect to theirs instead of creating bunch everywhere. Another reason I thought of using my jamf nation account is to have my certification in all in one place. It woul

Hi,I'm trying to create a configuration profile for distributing fonts, but no matter what file I try to upload (I've confirmed the fonts work fine on a local Mac), I get the following error:"File format not supported." Has anyone run in to this and know what needs doing to make it work? I've searched the forum but I've been unable to find anything on this particular issue. 

I have a script to remove the default apps from the dock but I can't get it to execute when a user logs in. It only works when I run the policy in terminal or from Self Service. The policy is set to trigger at login but doesn't seem to run. Is there an issue with the script or a Jamf policy setting that should be modified? #!/bin/bash# Get currently logged in usercurrentUser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')# Path to dockutil tooldockutilbin="/usr/local/bin/dockutil"# Sleep for 30 secondssleep 30# Remove default Mac apps from the dock/bin/launchctl asuser $(id -u $currentUser) $dockutilbin --remove 'App Store' --restart $loggedInUserPlist/bin/launchctl asuser $(id -u $currentUser) $dockutilbin --remove 'Contacts' --restart $loggedInUserPlist/bin/launchctl asuser $(id -u $currentUser) $dockutilbin --remove 'FaceTime' --restart $loggedInUserPlist/bin/launchctl asuser $(id -u $currentUser) $dockutilbin --re

The yesterday announced Apple TV 4K has no USB-C connector on the back:Apple TV 4K specs As we have no DEP, we have to use Apple Configurator to enrol the Apple TVs into the JSS. Does anyone know if and how we can enrol the Apple TV 4K without DEP?

My company is making a switch from Jamf to a new MDM, and we are in the process of migrating them over. I have been unenrolling the laptops from Jamf first and then usually deleting the profile in the Jamf console. However, I found a few profiles in Jamf that I missed. Despite them being unenrolled on the device for over a week, they are still checking in with Jamf according to the console. How is this possible? How is the device still checking in when JAMF has been removed from the device? 

I work at a university, which means we try to keep the same configuration throughout the academic year, which in turn means that I mostly don't use JAMF for about 9 months and then have a really crazy 3 months to prepare next year's configuration. Quite often, during those 9 fallow months, big changes happen. This time it's especially bad because we have also migrated to a cloud instance, which seems to have brought a number of changes along with it.The thing I'm struggling with is that the Composer interface seems to have changed in such a way that it's completely useless now. But it must be just me, because I don't see anybody else posting about it.Now, when I do a snapshot, instead of showing the files that it found in the main pane, in an expandable tree, I have to expand the snapshot itself in the left pane, and then Files – or at least I can find a list of what it found anywhere else but here. But that doesn't seem to be the right thing either; it's just a list of items that I ca

 Must have strong Mac, Apple & JAMF technical architecture experience, providing customer service focused macOS & JAMF solution design at least Jamf 300 certifiedThe successful applicant will be a macOS & JAMF Subject Matter Expert ArchitectApple Certified Support Professional (ACSP), or ACP certified or equivalent.starting from validating and/or gathering requirements (due diligence) from the business stakeholders Bash Scripting experienceDesigning a system and produce HLD, LLD, tech note. Build and implementation.  Service handover to operations team. Involve in creation of SOP and KB articles.Creating service solution architecture and service design based on modern Enterprise Mobility Management solutions (Air Watch/Workspace One, Microsoft Intune, JAMF Pro) Need to be commercially aware as hosting and licensing costs can influence the solution! Responsible to build & implement the solution within the designed architecture.Excellent

Every time I change an erroneous computer name on Jamf through "Search Inventory" the name eventually reverts back to "David's MacBook Pro" or something. Any ideas why this might be happening?

Looking for some guidance on how to suppress the Jamf Connect sign in window for a strictly local user account. In this particular work flow we have a few Mac's setup as Podcast stations using Hindenburg because of this there's only a local account on the machine called "Podcast" to preserve the application preferences. I would like to allow network logins on these machines (if possible) by leaving the Jamf Connect client installed. The issue I'm having now is when a user signs into the local "Podcast" account they're presented with the Jamf Connect "sign in" window which is causing confusing. I've gone over the various Jamf Connect keys but I can't seem to locate any options to suppress this window.Help! 

We have been using this script likely stolen from somewhere without source for a few years now to configure the nomad launch agent. The python bits need to be updated and unfortunately I don't know python which is making it a tad bit complicated to update. Any advice would be much appreciated.  loggedInUserPid: looks to be printing the user ID which is simple enough to translate to bash.launchctlCmd: I have not the foggiest what this does to try to translate it.**We are moving to JAMF connect later this year.  #!/bin/sh ## postinstall #*============================================================================= #*==============================å=============================================== #* REVISION HISTORY #*============================================================================= #* Date: #* Author: #* Solution: #*============================================================================= pathToScript=$0 pathToPackage=$1 targetLocation

I have a bit of a stupid question. Why doesn't the Enrollment Method display for Computers in the Device Record? For example, in the screenshot below, you'll see the enrollment method is blank for a computer that passed through Prestage like normal.But for mobile devices, the enrollment method properly displays in the inventory record.This in no way seems to effect any function within Jamf. I'm just wondering why this is and if its the same for everyone. Thanks!

Looking after iOS devices for a large IT company.We have a 'default' set of restrictions; every newly setup device gets this. There are other profiles as well that look after things for all devices (passcodes are a good example). Restrictions, though, are the main concern.So, there are manually created restriction profiles for managers. Another set for those in comms. Another set for interns, another set for something else, and so on. Things are now a little arbitrary.TLDR managers can use WhatsApp and USB (for Carplay) connections. Comms are allowed to use WhatsApp, and interns are allowed to use only critical apps (for example, only Outlook, Teams, and MS Authenticator). Everybody else just gets the Default (automatically) and can play with the Calander and other not-so-important stuff. But not WhatsApp! GDPR laws in Europe.A static group based on serial is used to 'map'  each device to each set of restrictions.What is starting to get on my nerves is the 'configuration creep'. I

Bonjour à tous,J’ai mis en place la solution de filtrage JAMF Trust, l’application bien installée, visible sur RADAR, le filtrage WEB fonctionne correctement.Cependant, je me suis rendu compte d’un problème un peu plus tard, j’ai un conflit avec le VPN Cisco qui confond le paramètre DNS de JAMF Trust.Lorsque le VPN Cisco est monté, le filtrage WEB ne fonctionne plus.Lorsque je désactive le VPN, le filtrage fonctionne à nouveau.Avez-vous déjà vu cela ?Pourriez-vous s’il vous plaît avoir une solutionMerci beaucoup pour votre aideTraduit avec DeepL.com (version gratuite)

We are implementing a "home made" solution so our AD students can login into specific Macs on specific time remotely using Screen Sharing.In order to complete our solution, we thought on activating Screen Sharing (not ARD) on specific hours by sending scripts to activate/deactivate Screen Sharing.We haven't found the command lines to add users/groups to the "only these users" menu.Yes, it is easy to do it with ARD (ARDAgent / kickstart), but we need to use Screen Sharing.Anyone knows the commands to set specific users to use Screen Sharing ?

Hello, I'm at the point where I had to create Sites in Jamf. I've never had a problem adding VPP licenses to apps but now when I scope an app, i.e. GMail, to "Campus A", I get "Content not available to assign to mobile devices". If I remove the site (in other words Full Jamf), I can assign VPP to the apps. (I tried adding it first to Full Jamf and then changing it to Site and I still had the same problem).Do I need to add these sites to ASM?  

Hello, I applied a "Facetime Deletion"  and " iMessage App Deletion" within the Restricted Software. The process name I used was -----System/Applications/FaceTime.app and /System/Applications/Messages.app I restricted the exact process name, applied "delete application" and "kill process". Both apps still appear on the dock bar on the test Macbook laptop. Am I missing something?  

Looking to limit UIE to a specific group via SSO and/or Cloud Identity Provider (Azure).Currently we have SSO configured via Okta and CIP setup with Azure.  Anyone got ideas on how to do the restrictions?  I've tried adding the group under Access, but it still allows all users.