I've been down the rabbit hole of deploying Cisco's new Secure Client and I am running into an issue that I cannot find any documentation on. Some context: we only need the Umbrella Module for our school and nothing else that is loaded within Cisco's PKG. I have been successful with deploying the choice XML file, but I get the following pop-up in the installation:  I would like this permission to be enabled within the config profile I built in jamf, but I can't seem to locate any of the info I need to do so. I already have gone through Cisco's docs and pushed out the System Extensions payload, but that seems to be just for the Cisco Secure Client itself and not this "AnyConnect VPN Service." If I manually toggle it on, the Umbrella Roaming Module will activate and work as it should, but if this is not toggled on, then the roaming stays inactive.   Any ideas? I am assuming there is something I am missing in the System Extensions payload, but I could be wrong... 

Hi everyone, We just implemented Jamf Connect and are still testing it. We had issues with devices randomly getting kicked off AD, so since we are on AzureAD now, we decided to get Jamf Connect. When we set everything up when a user logs in, we can reboot the machine, and someone else can log in. Now, after a reboot, no one else but the last user can log in. How can I get out of this? What are your best practices for using Jamf Connect in a lab environment?  Thank you

Is there any benefit or drawback to installing config profiles through prestage (where it says "Use this section to add configuration profiles to the PreStage enrollment") vs. after enrollment (a config profile scoped to all computers)?If the former is advised, would I then remove all scopes in the actual config profile(s)? As it stands, right now we don't install via prestage. Rather it enrolls, it does its thing, then installs policies and config profiels.Thanks folks! :)

I am unclear as to how to keep licensed Apps, like FileMaker Pro, up to date with "Apps" in the JSS. I found lots of good stuff like Adobe Reader and I see FMP in that list too but how does it handle licensing? Testing with Reader worked flawlessly. But its a free app. It would be nice to use that Apps - JAMF apps area to keep as many apps up to date as possible to avoid packaging etc. Can anyone point me in the right direction for that, video on TY or something? Cheers.. 

We've got a Journalism cart that has about 26 MacBooks in it. Some issues popped up and I wanted to test clearing out the profiles daily because some students just don't listen and keep ~50GB in their profile even though they have external drives for their work.I have a pretty simple script that just makes sure to ignore our admin accounts and runs a..for a in $userListsysadminctl -deleteUser $aThis seems to work and the home folder is gone but the account is still technically there when you go into users and groups. So when we try to login the MacBook just hangs since there's technically an account still there but no home folder.These users are not secure token holders since only students use them so it's not that and they are Jamf Connect created accounts.Is this just not possible on M1s? They had Intel Macs before I got here and said they used this script all the time but now it just falls a little short with fully removing the account from the device.

Hi, We have a Configuration Profile pushing out our WiFi settings with certs currently, but recently the first batch started expiring. They get renewed, no problem, but the expired cert is left in the keychain. I'm trying to script the removal of them using the following script, so they can't be selected for the wireless profile. #!/bin/bash # Grabs the expired certificate hashes expired=$(security find-identity | grep EXPIRED | awk '{print $2}') # Check for certs if [ -z "$expired" ] then echo "No expired certificates, we're all good" else # Deletes the expired certs via their hash echo "Deleting expired certs" security delete-certificate -Z $expired fi exit 0 #success If I run these commands locally on the machine, then it works no problem, but via a policy it always fails with: 'Unable to delete certificate matching "XXXXXXXX..." Any thoughts? Is there a better way to manage certificates for WiFi profiles? ThanksChris

Details Executing Policy Install Cisco Secure Client 5Downloading Cisco Secure Client 5.1.pkg...Downloading https.jamfcloud.com/jcds/downloads/Cisco%20Secure%20Client%205.1.pkg...Verifying package integrity...Installing Cisco Secure Client 5.1.pkg...Installation failed. The installer reported: installer: Package name isinstaller: Installing at base path / installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. The package is attempting to install content to the system volume.)

Greetings all,We are in the very earliest stages of setting up Okta.  I'm currently working on configuring our JSS Dev environment to use Okta for SSO.I'm working directly with our internal Identity Management team who manages our Okta instance.  They setup the integration on the Okta side, but I have no idea how they went about it.In the JSS dev, I've enabled SSO using Okta, added the necessary metadata URL provided by the IAM team, etc.When attempting a login, I am presented with the expected Okta user name screen, followed by the password screen, suggesting that the login process is working (and I've received notifications of a successful login), but then directed to an error message:Safari can't find the server.Safari can't open the page "https://https//<mysandbox>.jamfcloud.com/saml/SSO" because the Safari can't find the server "https".Note the extra "https// in the Url.The Okta team says everything is OK on their end, and I've reviewed the JSS SSO settings with th

Hi,if i want to be sure that after deployment with Jamf a file (i.e /usr/local/bin/dockutil) persists on the mac, what is best practice to accomplish that with jamf?I think a combination of Extension Attributes, Smart Groups and Policies will work, but I'm wondering if anyone has figured out what works best yet. Maybe so that it is universally applicable and easily reusable.Maybe someone has written an article about it?Many thanks in advance 

whats the best appoach to deploy new Jamf Protect plan in to machines?currently we have a Default plan that is deployed to all Macs using configuration profiles in Jamf Pro. I want to either deploy a new plan that has tamper prevention enabled or edit an existing one to enable it.what is the best way to fix this?it’s enough to edit the current profile and deploy it in Jamf Pro and I don’t have to create a new one?

Hi I'm wanting to create a smart computer group in JAMF Pro, for any Macs we enrol after a specific date. This is so I can scope a policy I have created to only deploy to Macs enrolled on or after the date set in smart group. I cant see an option to do this, any advice or help would be great.Thanks

Can someone tell me what Jamf Pro can do that Intune cannot for iOS devices?I am struggling to fin and documentation to support this online. thanks in advance for the support!

I'm trying to hide FileVault option from being offered in setup assistant during pre-stage, and when I go to customize what steps I want to show, it's greyed out and I cannot skip it. Currently testing on a Mojave machine, but we also are deploying Ventura machines. Looking at Jamf and Apple documentation it seems I should be able to block this, but I can't figure out why its not allowing me to. 

I have searched for a discussion about this and not find this problem, so I am raising a new twist on and old issue. I am trying to advertise some printers in Self Service and cannot get the drivers. I have uploaded the ppd files and I have policies to push out the printers etc. The issue I have is getting the drivers up into JAMF. This is where it gets complicated. HP has decided to not make their drivers available. Instead you can only download an install assistant called Easy_Start.app which will go out and download the drivers for you, install the printer you need, then remove downloaded drivers, thus leaving you without a copy of them to use in JAMF. I need to find a way of packaging the drivers that got installed on my machine so that I can upload them to JAMF instead. I did try reaching out to HP customer support twice for help in getting just a copy of the divers but that seems to be impossible. I have been assured that nobody in the printer industry does that. You cannot do

In the UI my users are _absolutely_ assigned computers, yet they do not appear in my API response. This shouldn't be a permissions thing. I'm very confused. Anyone seen this before?

I'm looking to see if anyone has a configuration profile created that gives ALL Adobe Apps access to Desktop, Documents, Downloads, and External Media. We're managing classroom computers with the Adobe Suite and each time a new user logs and launches an Adobe application it asks for access to those folders.Thank you!

I am trying to get this script to work for this extension attribute. It's just not pulling anything in Jamf Pro. But when I run the same commands in terminal on the local machine, as root, it works. Any suggestions?   

Howdy!I am trying to install an app called SwitchResX on some Macs to allow more control over resolutions for the end users. All my other apps have been installing fine within Self Service, but I can not get this one to install at all after setting it up in Composer and then deploying it. The only difference is this app does not install in the Apps folder but in the System Settings/Preferences on the Mac. Are there any additional resources or things I should look out for when trying to install this type of application? 

Is there a way to either create or assign an admin account as the "management account" after enrollment? We were told by Jamf to turn off that feature in the user-initiated enrollment settings due to the recent issues that setting presents when enrolling (PI113195 - Account Creation is skipped if a management account is enabled under UIE on Mac OS Sonoma).Obviously this isn't ideal but since we've had to turn it off, wondering if we can create an admin policy on newly enrolled machines and somehow make that the management account? Hoping that can be done. Creating the account is easy but unsure if able to tie it as the management account ¯\\_(ツ)_/¯ 

Hi,Unfortunately, we have a problem installing an app on a few devices.An error message AMSErrorDomain 203 appears.Unfortunately, we can't do anything with this message. It is also strange that it only affects some devices:"AMSErrorDomain erreur 203. / The operation could not be completed.(AMSErrorDomain error 203) I No server with the specified host name was detected.detected. The operation could not be completed. (kCFErrorDcmainCFNetwork erreur -1003.)"What does that mean? Where can we find the problem?Regards and thank you very much in advance. 

Due to security restrictions within my environment, I have spend an considerable amount of time to install JAMF without having an internet connection to my server (it took me a long time as I was not well-versed in linux as well but it was one of the project's requirement). I would like to share it here so that others will not have to go through the same experience that I did and benefit from this post. Operating System: RHEL 7.7ISO Used: rhel-server-7.7-x86_64-dvdJava Version: openjdk 11.0.6mySQL Version: mysql community server 5.7.28JAMF Version: 10.17 RPM Needed For mySQL Installation:mysql-community-libs-5.7.28-1.el7.x86_64.rpmmysql-community-common-5.7.28-1.el7.x86_64.rpmmysql-community-client-5.7.28-1.el7.x86_64.rpmmysql-community-server-5.7.28-1.el7.x86_64.rpm mySQL InstallationStep 1. look for existing mariadb by executing:rpm -qa | grep mariadb-libs Step 2. Remove mariadb by executing:rpm -ev --nodeps mariadb-libs-xxxxxx Step 3. Install mysql-community-common by executing

There is a user who has an unencrypted internal drive. His jamf profile should be requiring him to enable FileVault. However, we he restarts or logs out of his device, he is not prompted for FileVault to be enabled. He is already enrolled in jamf but the "Install Configuration Profile Disk Encryption" is stuck as pending. I've tried sending a blank push. Is there a way to push this policy so they are encrypted without having to unenroll and re-enroll their MacBook? They are on an Intel Mac.

Hi everyone, Have you ever tried to update a PreStage Enrollment through the v2 API?I'm trying to create a python script that will update the customPackageIds of said PreStage Enrollment when certain packages have a new version available. This always gives me error 500, internal server error, I think. It would be something like this: import requests payload = { "customPackageIds": "110" } headers = { 'Accept': 'application/json', 'Authorization': 'Bearer XYZ', 'Content-Type': 'application/json', } response = requests.put('https://XYZ/api/v2/computer-prestages/3', json=payload, headers=headers) This is my first time doing something like that with python and JSON and I would gladly use python-jss for this but as far as I know it can't handle PreStage Enrollments. What's your take on this?

Hey guys. New to JamfPro line-up but I've gotten the hang of it pretty well. During the integration between Jamf Trust (Security Cloud / Wandera / RADAR / Please setup a naming convention), and Jamf Pro as the UEM, you have the option to either authenticate with Basic Authentication (Username, Password), or with OAuth, utilizing an API client in Jamf Pro with the appropriate permissions. The permissions are listed here, under the Requirements section. This Requirements section is the same for all versions of the Jamf Trust (Security Cloud, Security, Safe Internet, Wandera, RADAR, Please setup a naming convention) documentation, even the deprecated ones.https://learn.jamf.com/en-US/bundle/jamf-security-cloud-setup-guide/page/UEM_JamfPro_Establishing_UEM_Connectivity.html#task-6779 A Jamf Pro API Role and Client with the required permissions. For more information about API Roles and Clients with Jamf Pro, see API Roles and Clients in the Jamf Pro Documentati

Hi,Is it possible for an organization to disable the factory reset option on an iPhone? Alternatively, is there a policy or script that can accomplish this?