Hi there, I'm working on a policy that should be able to deploy a launchdaemon plist to all machines. The below script I found here https://communithttps://community.jamf.com/t5/jamf-pro/remote-management-active-extension-attempt/m-p/119717y.jamf.com/t5/jamf-pro/remote-management-active-extension-attempt/m-p/119717    #!/bin/bash cat << 'EOF' > /Library/Scripts/jamf-Restart.sh #!/bin/bash sudo killall jamf sleep 10 sudo jamf policy EOF chmod 644 /Library/Scripts/jamf-Restart.sh chown root:wheel /Library/Scripts/jamf-Restart.sh cat << EOF > /Library/LaunchDaemons/jamf-Restart.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>jamf.restart</string> <key>ProgramArguments</key> <array> <string>sh</string> <string&

We've decided to move our scoped policies and conf. profiles to smartgroups, as we realized this will save a lot of work in the long run. I don't seem to find an efficient way to do this, at the moment i have to go through every single policy and conf profile and change the scope manually, which isn't even the bad part, the worse is that i can't find a way to list all the policies scoped to one department.When the policy is scoped to a few departments, it can't be found anymore in the search, it shows "2 computer groups, 2 departments" or something like that and that excludes the keyword from the search.Any help/ideas would be highly appreciated.

Found the solution to my problem - How to lock classroom pane/options with a custom profile in JAMF explained in first comment We are looking into deploying Classroom for our teachers and students next year. We would be doing Teacher Managed classes. (macOS devices, teacher and student). By default, students can change settings that include them being able to leave the class, and requires student approval to lock etc... Which is never going to work. JAMF has a couple wonderful configuration profile setting under Restrictions - Functionality. However they ONLY work with Prestage Enrolled devices, not those enrolled via QuickAdd. I have tested and confirmed that with a clean install of 10.14.4 and QuickAdd that the configuration indeed does nothing. Students can still change settings and require permissions etc. Allow Classroom to perform AirPlay and View Screen without prompting, Allow Classroom to lock the device without prompting,Require teacher permission to leave Classroom unm

Hi, Totally fed up with the constant updates of Flash player plug in. Does anyone have a deployable method to remove it from my lab Macs? I know there is the manager in the Utilities folder, and you can uninstall it with that. But this does not look scriptable to me. And I need a deployable method as there are about 300 Macs with it on. As usual, any help will be greatly appreciated.

Pretty new to Jamf and Mac management. Have been looking at the patch management process and focusing on browser updates, although what I'm discussing is applicable to any application update, not just browsers.What I'm seeing is some confusion among our users regarding the patching process. For example, user gets notified that there's an update available for Microsoft Edge. User initiates the install process. Browser closes, update begins.My question is: how does the user know the update has finished applying and they can safely re-open the browser? Is there a way to tell the application to restart after an update has applied? Curious to know how other admins/organizations are handling this. Thanks!

Hey,I'm trying to create a Smart Search, which lists devices with any Software title by Oracle installed. Is there an easier/better/future proof way than just adding every Application made by them? I found "Vendor" as an attribute, but does not yield any results.Any ideas?

Hi all,Just wondering what you're doing in terms of macOS and iOS updates? Our Windows workflow is fully automated with a 7-day grace period before the computer will automatically restart to install updates. We really want to have something similar in place for our Macs but also iPhones/iPads if possible as they're lagging behind everytime a new update is released.Right now what we're doing is trying to educate personnel and push them to update their devices which is not ideal to say the least...Is there a way to force them to update without interrupting their work by giving them a grace period? Does anyone have any suggestions or workflows they currently use for this that they'd like to share?Thanks in advance!

We've got a couple devices that after installing the latest updates of Sonoma are still showing RSR version (i.e. 14.1.2 (a)).  Does anyone know of a way to get this back to showing a true version of the OS that is running on the device?

I had a Mac that lost its connection with JAMF. I ran the following command on the machine, sudo Jamf enroll -prompt, and the machine started reporting into JAMF. The issue is that it will not push down any new Configuration Profiles and the "Management Commands" option is missing. I have tried to run the following commands to see if I could resolve any of these issues but nothing helped.sudo jamf -removeFrameworksudo jamf reenroll -promptsudo profiles renew -type enrollmentI also tried to do a manual enrollment but since the old "MDM Profile" is still on the machine it will not install a new one and I can't remove the old "MDM Profile" since it was enrolled with DEP. Is the only option I have is wipe the device?

Hi folks,I was looking through the logs on several iPhones in Jamf Pro today and noticed a pattern in many devices. I see a long list of apps installing themselves on established iPhones. Then I look back a few days and see the same list of apps installing themselves. These are the same apps and app versions, installing themselves over and over again. Of course during those times, the user has several icons on their home screens that are busy reinstalling, and that could make some unavailable for quite a while if outside WIFI range.Any thoughts on why this would be happening? I checked multiple department affiliations, so it isn't just one department profile. It's almost as if the device is not acknowledging the installed app list and thinks it needs to keep installing apps repeatedly.Thanks in advance for any ideas,Rob

Anyone gotta script that will automatically download the latest version of Dropbox? As the app is constantly updated, I'd like to have self service and enrollment policy that will always grab the latest version, but their download link does not lead to a specific DMG or package. With other apps I do this via CURL, but that doesn't seem to be an option here. https://www.dropbox.com/download?os=mac

This is my script I run for new installs:#!/bin/shsudo echo $4 > "/Library/Application Support/JAMF/Waiting Room/com.sentinelone.registration-token"sudo /usr/sbin/installer -pkg "/Library/Application Support/JAMF/Waiting Room/Sentinel-Release-23-1-3-6816_macos_v23_1_3_6816.pkg" -target /This is my script I run for upgrades:#!/bin/bashsudo echo $4 > "/Library/Application Support/JAMF/Waiting Room/com.sentinelone.registration-token"sudo sentinelctl upgrade-pkg "/Library/Application Support/JAMF/Waiting Room/Sentinel-Release-23-1-3-6816_macos_v23_1_3_6816.pkg"I have two policies.  One that is Cache.  One that is installed Cached.  That is for both scenarios above.  I am getting nothing but failure.Is that something wrong with the scripts?  I don't have my error messages because I keep flushing them, but the cache one fails but I see where the file fully downloads.  That's all it's supposed to do.  The second script is supposed to install that file.

Hi, We've recently moved from an on-premises server to the cloud.  We are using on-premises Active Directory for LDAP services and were hoping to move To Azure AD at some point.  We brought this up during the migration to the cloud and the JAMF tech who was assisting with the migration said that there was no path to upgrade from where we were with on-premises AD to where we wanted to be with Azure at that time. Since then, I've been looking around the forums trying to get more information.  In the older documentation (up to v10.29), I can see a blurb that says "To ensure your existing LDAP workflows (e.g., scoping or user accounts and groups) continue to work correctly, you will need to migrate your configuration when the migration assistant is available in a future release of Jamf Pro. Adding the Azure AD integration prior to migration may break your environment." This warning doesn't appear in the documentation after v10.30.  We're in the cloud on v

Computers will not enroll today, when we enter any username and its password (Active Directory) it gets stuck 'retrieving enrollment profile' then returns to the login screen as if the username and password are incorrect, no errors. We verified usernames and passwords (including reseting passwords in Active Directory) and used multiple accounts with the same results. We do not recall any notifications for service interruption or have seen any outage reports as of today 11/29/23.The last time we were successfully able to enroll a laptop was 11/20/23

I have a test JSS server that was running 9.22 and installing the Wireless configuration profiles so I could start testing my profiles and policies to make sure everything would be working when we upgraded our main server to version 9. Everything was working fine until I upgraded my test JSS server to 9.23 then the wireless configuration profiles would fail saying "Some required information in the profile is missing." I've recreated the JSS certificate, un-enrolled and re-enrolled the computer, tried different fresh installs of the OS, I also downloaded the profile to install it and it still came up with the same error. This configuration is scoped to all computers. I'm testing a user initiated enrollment, so once the enrollment is finished the computer can then access our wireless. The machines I've tested this on are a MacBook Air (11-inch Mid 2013), an iMac (21.5-inch, Late 2012), and an iMac (Late 2009). The MacBook Air is running 10.8.5 and the iM

Hello everyone,I'm currently encountering a difficulty and would be grateful for your assistance. I'm attempting to determine which clients have iCloud Drive activated, particularly with the synchronization of desktop and documents.I've conducted thorough research online and within this forum, but it seems that the solutions provided are not applicable to the newer versions of macOS.Could anyone offer guidance or suggest an effective method for the latest macOS versions (Ventura, Sonoma)?Any help would be highly appreciated.

Hello I was wondering if there was any way to disable the automatic run of safe files in safari using a configuration profile/policy, I can't find a setting for it and need to disable it for compliance reasons.

Hi All, We are working on removing Docker desktop from Macs, tried few scripts for uninstalling through Jamf Pro however we are getting an error stating root access is needed. Wanted to check if anybody knows of a way to remove docker through jamf.The script user#!/bin/bash # Uninstall Script if [ "${USER}" != "root" ]; thenecho "$0 must be run as root!"exit 2fi while true; do  read -p "Remove all Docker Machine VMs? (Y/N): " yn  case $yn in    [Yy]* ) docker-machine rm -f $(docker-machine ls -q); break;;    [Nn]* ) break;;    * ) echo "Please answer yes or no."; exit 1;;  esacdone echo "Removing Applications..."rm -rf /Applications/Docker.app echo "Removing docker binaries..."rm -f /usr/local/bin/dockerrm -f /usr/local/bin/docker-machinerm -r /usr/local/bin/docker-machine-driver*rm -f /usr/local/bin/docker-compose echo "Removing boot2docker.iso"rm -rf /usr/local/share/boot2docker echo "Forget packages

hello,We migrated our JSS from an LDAP connection to Azure AD (Cloud Identity Providers).But we are unable to map certain AzureAD attributes such as 'businessPhone' or extensions such as 'extension_3bf6422528194f1aae559105e4bace82_division'.Have you ever had this type of problem?Thanks for your help

Even though MacOS Ventura 13.6.2 was released over 20 days ago, Patch Management in Jamf Pro says that 13.6.1 is the "latest version" of Apple MacOS Ventura. This is a little annoying as we have different Smart Computer Groups and reports that depend on this "latest version" status to notify users (and us) that their OS is missing security updates. As a workaround, we can change the Criteria of the Smart Computer Group and the reports, but this will be annoying to do every time an update is released.I submitted a ticket with Jamf, and they said they are seeing the same thing on their side. Is everyone else seeing this too? Anyone find a fix for this? We have a managed instance of Jamf Pro, so not much we can do on the back-end side of things.Pardon my naivety--this is my first post--if this question isn't useful to the community in any way, please let me know nicely:)

I'm trying to use the *.jce file I created on my main machine to a test machine so I can run the audit there. I've copied the app, the *.jce file, and the macOS_security-sonoma folder created when I chose my baseline to the same location on my test machine. I've also copied the Jamf Compliance Editor folder from Application Support and even the com.jamf.complience.plist file from ~/Preferences.When I run the audit on my test machine however I don't get a usable result just a result with practically nothing in it and NaN% for the score (which makes sense since there's no number).My custom baseline looks to have been loaded correctly. The modified and disabled rules are all correct. The audit just doesn't work as expected.

We are attempting to configure devices going forward without logging them into Apple IDs and having all contacts come from the outlook contacts sync feature.  However, when we attempt to turn on contact sync in Outlook without being logged into an Apple ID we receive the following error message: "Couldn't Sync Contacts, Try turning on contact syncing on your iPhone from Settings > Your Name > Contacts. If that doesn't work, contact your IT admin as your organization might not allow syncing."I can't imagine the issue being the later because our policies allow this and we are able to do this on devices that are logged into an Apple ID.Microsoft documentation claims "If there is no account connected to the device, then your Outlook contacts will be saved locally but will not be synced to other devices."So according to that we should be able to sync contacts from Outlook to the device without the need for an Apple ID.Has anyone else run into this and come up with a sol

We have an issue where some machines keep prompting the user that their IdP password does not match their local password and are given the option to sync. However, when you hit sync, the login popup is completely greyed out (as shown below).In all cases, we have verified that the password is in fact the same. I'm assuming this is cached somewhere and maybe needs to be cleared? Has anyone seen this?

When a user with a managed iPad starts Self Service, the app complaints it should be linked to a Jamf Pro-server. And you can't do anything with the app. See screenshot (Dutch localization):This is weird, because the iPad is listed between the devices in Jamf Pro.I do notice two pending commands from yesterday and the day before yesterday (inventory update and a time zone settings update).I tried to quit self service and relaunch: did not work. I also switched the iPad off and back on.What could be wrong? Edit: could it have to do with the license? I get this notification now (I'll ask my boss about this):Device count exceeded Purchase additional licenses.

since implementing jamf connect, we keep randomly getting 403 forbidden errors after trying to login (we use azure). has anyone else ever run into this before? we're not sure if it's on the jamf side or the azure side that's causing the issue.