Hello all you friendly Jamf admins! I've got a problem that's stumping me and my colleague, hoping somebody here can shed some light.Recently (starting last week), I have begun encountering an issue where running sudo jamf policy produces unexpected results. When run locally, policies will fail. They attempt to run, and produce the following output, using Firefox as an example:Installing Firefox ESR 115.4.0...Installation failed. The installer reported: installer: Package name is Firefoxinstaller: Upgrading at base path /installer: The upgrade failed. (The Installer encountered an error that caused the installation of fail. Contact the software manufacturer for assistance. An unexpected error occurred while moving files to the final destination.)This occurs with both Chrome and Firefox, both of which I recently packaged. This occurs with both Patch Management Policies and regular Policies. I created the packages in Composer from my Applications folder, with 755 root:wheel permissions,

Hello, I found some duplication in the inventory which looks like ghost record. It shows up in the list but never opens; and I am not able to delete it in JSS web interface. Is there any easy way to delete computer inventory record via Terminal by ID #? Some command like: sudo jamf delete_computer ID=XXX Or should I deep down to MySQL? Any suggestions are highly appreciated!

In our environment we use user certs for Cisco AnyConnect. I'd like to have a policy that runs on recurring check-in that alerts the user if the cert is about to expire so that they don't lose VPN access. I thought I had this working but I think I'm running into issues accessing the user's keychain. I can understand why that's a touchy thing. However, what's curious is that I can access the user's login keychain when running the script via Self Service or if I run the policy via the command line. However, when the script is triggered via check-in, it seems to have issues accessing the user's keychain. Even doing a simple "security default-keychain" is struggling. Here's some example code: #!/bin/sh # Let's set a log file to write to logFilePath=/tmp/test.log # Get date/time stamp and kick off log file dateTimeStamp=$( date ) printf "!! Script Execution Date/Time Stamp = $dateTimeStamp !! " >> $logFilePath

Hi everyone, I am stuck at this step: https://www.youtube.com/watch?v=4vCzG_Zdelkuntill 04:19 everything is allright. (Server token is uploaded and in: (Settings/global) Automated device enrollment I see the MDM server and also 2 computers assigned.But when I go to: Devices -> PreStage Enrollments (See 06.48 of the video) I dont see the same. I see: I am new to JAMF Pro and am stuck at this point.I hope someone can explain why I am unable to do the steps shown in the video.kind regards

Happy Monday All!My organization has about 40 TVs scattered across 21 locations all over the Upper Midwest (Minnesota, Illinois, Iowa, Missouri, North Dakota and Wisconsin). TVs are generally used in the common areas of our locations to display video content for customers and in employee break rooms.Less then a dozen of the TVs were purchased through our business account with Apple and show up in ABM and JAMF. The other 30 or so TVs were purchased from various 3rd party retailers and of course do not show up in ABM or JAMF.We've recently learned that employees at our locations have been signing into their personal AppleIDs on the TVs and signing into their personal Netflix/Hulu/HBO accounts. We want to prevent this and standardize the video content experience at each location. (We have a solution in place for the content part.)So my question is this--how can I add all of these rouge 3rd party purchased TVs to JAMF? I am hoping that it can be done remotely and that I do not have t

Hello Jamf Protect Community, I received an alert with the Description: JamfProBinaryModified.... Jamf Pro Binary Modified or Removed. Below I will copy information from the first two pages of the of the alert. Has anyone encountered this before and if so what resolution did you come to with it? It seems to be related to the appstore but I'm not sure why exactly this is happening and why Jamf Protect isn't simply marking this as Informational if that's what it is.----  Summary Page:JamfProBinaryModifiedThe Jamf binary is responsible for most of the actions taken by Jamf Pro. It is located at /usr/local/jamf/bin/jamf (alias at /usr/local/bin/jamf). If this file (or its alias) is moved or damaged, Jamf Pro will be unable to perform remote management actions. While an attacker might theoretically disable Jamf Pro to subvert its security controls, this detection is aimed at the end user disabling Jamf Pro without authorization. This detection alerts when the Jamf Pro binary

Uploading any packages via the web interface immediately fails when clicking "Save" with a message, "Package failed to upload". Tried different browser, different computers, different PKGs, all the same result.The packages are not large or exotic. Any ideas?

We successfully upgraded our on-prem environment to 11.0.1 last week and have noticed an odd issue with a number of machines showing no values for any extension attributes. Out of about 2000 current machines, it only appears to have affected about 180 or so. Manually running a recon on the machines has fixed most of them and I created a policy to just run recon as a process (not from maintenance) adn that seems to be slowly whittling them down and getting most of them back. Anyone else seen anything like this?

Hi all,We're trying to hide the "Your screen is being observed" message on the lock screen while using ARD. This message also appears when using a DisplayLink dock:We've tried the command below, but it doesn't affect the lock screen:/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -config -clientopts -setmenuextra -menuextra noIs it possible to hide this?

We have folder restrictions on student's laptops. Anyone knows the location to this Photoshop PSCustomHook that I can whitelist?

My school is facing a management issue where many students are using Google Chrome's extensions feature to download VPN software. Is it possible to disable the installation of extensions from the Web Store on all student computers using Jamf Pro? Also, is there a way to disable the Chrome auto update? 

Going to upload the new device token and getting an error message "The File received is not valid".  Anyone got any ideas?  Sync is now failing due to downloading a new Token.

Wondering if anyone has come across this before; I've done a fair bit of searching, but haven't found anything. I’m trying to make a signed package for Jamf Connect Notify with a cert made against the Jamf CA (need to shoot off a support ticket for that one, but that can wait), but Composer crashes with it, and I’ve isolated it to the following:If I make the package in Packages, import and then try to convert it to source in Composer, Composer crashes at the end of itIf I make the package but edit the postinstall script to be #!/bin/sh prior to building, it will import/convert fine, but if I then edit it in Composer to be zsh, it crashes immediately upon saving.It seems that Composer cannot handle #!/bin/zsh at all - I've tested this with versions from 10.48 through to 11.0.1, with the behaviour repeating. Has anyone else come across this behaviour before? Very frustrating, as it's holding up getting the Notify panes tested. (M2 MBA, Sonoma 14.1, Composer 10.48 through 1

HI there,We've been using a script to set the computer name on devices in the format of 'fullname-model'. This script has been working fine up until Sonoma where it breaks by not providing the full name variable. The only script that seems to work at the moment is one that pulls the username instead but this is not ideal for our environment due to some historic devices having usernames completely unrelated to the user.Is anyone using a script that is able to pull full name from a source that works on Monterey, Ventura and Sonoma in the 'fullName-model' format?This is what we have now#!/bin/bash userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }') echo $userName model=$(system_profiler SPHardwareDataType | grep "Model Name:" | sed 's/.*://' | tr -d " \\t\\n\\r") echo $model serialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') echo $serialNumber name=$userName-$model-$serialNumber echo $name scutil --set HostName "${name}" scutil --set LocalHostN

Hello guys, I wanted to let you know that we are currently in the process of deploying the Kerberos Single Sign-on Extension profile. However, we have encountered a situation where some local macOS accounts do not match their corresponding AD accounts. For instance, the macOS local account is named "doe" while the AD account is named "jdoe". I am concerned whether this will cause any issues during the rollout of Kerberos Single Sign-on Extension. I have conducted a test with a user named "test" whose AD username also happens to be "test", and it worked without any problems as they match. Nevertheless, I remain worried about potential complications arising from mismatched account names

The script I run to enable Remote Login and Remote Management has been the following:#!/bin/sh # enable remote management for ardadmin /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users adminuser -access -on -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -restart -agent -menu #enable remote login for ardadmin sudo /usr/sbin/systemsetup -setremotelogin on sudo dseditgroup -o edit -a adminuser -t user com.apple.access_ssh exit 0We just upgraded many of our computers to macOS Ventura.  I've noticed with macOS Ventura that when tryin

We create a local user account for administrative tasks as part of our imaging. What we're seeing is that we'll receive a unit with some issues where we need to use that account, and the password won't work. This is not very common, but it is happening sometimes. We'd like to create an Extension Attribute that checks that account and validate if the expected password works, and if not, scope a policy to that smart group to reset it. I did see one slightly complex script here:http://www.yourownlinux.com/2015/08/how-to-check-if-username-and-password-are-valid-using-bash-script.html But it doesn't appear to work any more since the shadow hash is now under /var/db/dslocal/nodes/Default/users/<USERNAME>.plist Before I start working through that I wanted to check if anyone has any other suggestions/solutions. Thanks

As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I crea

I have a computer that is already in use, which just won't register correctly in Jamf. It's registered in DEP and assigned to Jamf Pro. In Jamf Pro, the serial number doesn't show up in device search. When I trigger the re-enrollement with the user ("sudo profiles renew -type enrollment") the enrollment-flow starts as expected.However, at the end it stops with an error message "Install profile failedYour computer is already enrolled in an MDM server and can only be enrolled in one MDM server at a time". In Jamf the serial number now shows up as "DEP - [SERIAL_NO]". The username in Jamf pro is not populated (though it was collected in the flow).Also, the `jamf` binary is not installed.In the user's System Settings, only 3 profiles are listed. They have names I don't recognize, but I can't remove them. However, it is stated that "This mac is supervised and managed by: Archipunt", so it might be old profiles from our MDM (the computer is bought in 2020, and we were using Jamf Pro bef

I have a policy in Self Service that deletes a "Temp" local user account and then recreates it. We use this for lending out laptops to students so that we can delete and re-add the account every time it is returned so that we can re-lend it out with a fresh account. I would like to apply a new policy that forces the "Temp" account user to reset their password once upon first login after the account has been recreated via self service. I was planning on using the command: pwpolicy -u "$LOGGEDINUSER" -setpolicy "newPasswordRequired=1"If I scope this command in policy to a smart group that looks for the Temp local account and then runs once per user at login will this accomplish what I need? The trick is I don't want this command to run when any other accounts login and only want it to run once when the Temp account logs in for the first time after being re-created and then only again when the account is removed and recreated and logged into for the first time once again. If I use a

Anyone have a script or extension attribute to pull this info, I am looking for the type of display connected i.e. Cinema, thunderbolt, other?

Hello i am in the process of mass deploying Checkpoint endpoint agent via jamf, how to enable full disk access via JAMF in system preference. Thank you in advance. 

I was always under the impression that managed Apple TVs required a MDM remote command to initiate a tvOS update but I recently noticed most of my fleet has automatically updated to tvOS 17 on their own.  Is there a way to prevent this as this causes disruptions in the classroom?

I would like to create a script that will allow us to run and confirm that our core apps like Outlook, Teams and others are installed before we give the machine to our normal users.Any help is greatly appreciated.

Hello,I was following this post: https://community.jamf.com/t5/jamf-pro/centos7-jss-file-distribution-share/td-p/227536 And set up all for sharing, but now when I access https://jamfshare.mycompany.com/CasperShare I do have Forbidden message: ForbiddenYou don't have permission to access this resource. Any thoughts ????