Is it possible to completely disable iCloud all-together? I know we can disable elements of iCloud in a Configuration Profile, but if we wanted to force-sign-out users from iCloud, then prevent a user from logging into iCloud ever again, can we do this?

Hello, Question: How do you write the exact text to the file instead if it spelling out the $PATH ??I am trying to copy a line with the echo command to a text file. The command works, however it writes the actual path instead of the text itself. Example: echo "export PATH=~/.npm-global/bin:$PATH" | cat >> /Users/$CURRENT_USER/.profileWrites: export PATH=~/.npm-global/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/jamf/bin Instead of " export PATH=~/.npm-global/bin:$PATH " I am scratching my head on this and can't seem to find any answers online, running as the user does not seem to work either as Jamf still fills in the $PATH with it's own seen above. Running from terminal as user still fill's in the path instead of the exact text.  

I'm trying to create an extension attribute for the version of Xcode Command Line Tools that is installed on each machine.The goal is to eventually have a patch policy to regularly update the versions as needed.The closest I have found is this post, however the attribute seems to no longer work and I can't seem to find any documentation to gather the version of Command Line Tools.If anyone has had any luck with this recently I would greatly appreciate any guidance. 

Microsoft has a nice post here about the adding of Defender to the Office installer that many have used in the past.  I didn't catch the change in time to block the install with a profile, and about a dozen Macs picked up the Defender component with an Office suite install.  I've fixed the go-forward issue, but cleaning up the Macs that got Defender doesn't seem as straight forward as the mentioned   rm -rf /Applications/Microsoft\\ Defender.app  from the article. There's an uninstall that is laid down with the installer that appears to remove more than just the .app itself. There's a bit of crud left behind that gets cleaned up with Defender's baked in uninstaller mentioned here sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall' But I can't seem to run that remotely. I'd rather run the uninstaller, and let it catch things like LaunchAgents/Daemons/other crud that were installed with the installer but would be left be

Hello Jamf Nation,I had Jamf Connect configured to create the local user account as Administrator if the Azure AD user has the Admin role assigned in the Jamf Connect Azure AD enterprise application. This worked like a charm until we introduced an enrollment customization with Single Sign-On Authentication (with user information passthrough enabled).Now the user first has to authenticate with Azure via SSO before confirming the password once more in the Jamf Connect flow which then creates the local user. Although the user has to enter their password twice, the added benefit is of course the automatic "registration" of the user to the computer object in Jamf Pro.However, as the title of this post indicates, it seems the 'roles' attribute is now ignored and the local user is always created as Standard.Is there a way to benefit from the enrollment customization without losing the user roles functionality?PS. Using Jamf Connect 2.27.0.

I was looking at the list of Macs registered to JAMF in my company. Some get lost in international transport or are stolen etc.This can sometimes be verified by looking at the last IPv4 it used - if it is miles away I lock them with a PIN with a polite request to contact me.In this instance though, there was no record of the serial number logged in our hardware database - I locked it just to be sure.The person in possession of it has contacted me (months after I locked it), to tell me he cannot use the Mac. It turns out that he is a business partner but no reference to this was logged in JAMF.I gave him both of the two 6-digit codes I use to lock machines. Neither are being accepted.Can the activation lock bypass code (9RV5C-xxxxx-xxxx-xxxx-xxxx-xxxx) in JAMF be used to override this (by the user booting to the recovery environment and entering the code). MacBook Air (M2, 2022), macOS 13.2.1I don't want/need the user to wipe everything on the hard drive etc. Can he then just resta

We retired 200+ macs this summer.  How can I mass delete them from Protect? Doing it one at a time is not a viable use of time.

In my current tasks, have a challenge to find the way to detect all browsers installed on the JAMF Pro administered devices, do you have any idea about do it possible?.Regards,MR

Hello,I would like to know what the proper way is to reset a device while still keeping it under management.I have a MacBook that was added to ABM using Configurator 2 and was prestaged and is now managed in Jamf Pro. It has several policies and packages installed. Now, I want to take the MacBook back from a colleague and send it to a new colleague. He can then start with the MacBook as if it's new (=PreStage). It's important for me that the device is not removed from ABM, because everything is managed remotely.Should I simply click on "Wipe Computer"? Will the MacBook rerun the policies, etc., if it's still in scope? Or do I need to take further steps, such as flushing all policies for that MacBook?Best regards,Floh

We are having an issue with DNS in our environment.  Here's what happens:-We take the iMac out of the box-Run through set up wizard and set ladmin as administrator. When we launch terminal it already has a hostname called from another PC or Mac. This is before we name the computer L-###-M##, E-###-## or F-###-## or enroll it into JAMF Cloud.It got so bad that we started having our network team delete the DNS and AD records when we erased and installed our iMacs; no dice.We've been told they will look into it for years (since High Sierra).  I'm working with what little I know about networking so any suggestions are appreciated.

Looking for a deployment script for Dropbox, so far I have found out that Dropbox does not provide an easy way to deploy their applications. Maybe someone has encountered the same problem before and has script/pkg that could help?

ik can't find it in https://xxx.jamfcloud.com/JSSResource/computers/subset/basic and in https://xxx.jamfcloud.com/JSSResource/computers/id/$deviceid.where the heck is it? :)regards 

Hi All,I am curious if its possible to create a configuration profile using custom schema to modify the profile.xml settings?I know we can package it with installer etc and that's what I am doing but i want to know if there is an easier way to update the profile.xml when there is changes in the connection name or server etc? Thank you!

Hello,I've recently upgraded a MacBook to macOS 14, but Jamf Connect (2.27.0) is not working properly.When i log off, i see just the normal Sonoma Logon-Screen.Is there a new setting?Do i need to turn off Filevault?Thanks!

A tiny bit of a hiccup with JAMF that might affect one of the more 'special' users in my company!When deploying devices, we block practically all iCloud functionality. The user can log in, but document and data sync (such as photos, etc.) is disabled. All done out of security, I must point out that the iCloud accounts are just like any other iCloud account (not managed by the company). All new iPhones receive a configuration profile related to security and iPhone functionally. Let's just call this 'Standard'. For example, certain apps are not available to download. Screenshots cannot be taken, manual resets of the iPhone are not allowed, and so on.There is another config profile for 'Managers' who are afforded a little more freedom in terms of what they can do. Screenshots are allowed. Otherwise blocked apps from the App Store can be installed. WhatsApp is the best example.VPP apps auto-install on the iPhones soon after being enrolled. Nearly everything in the company is Microsoft rela

During Enrollment of a Sonoma MacBook, after Remote Management starts and our required Credentials are entered, it Skips creating the Local User Account. It goes straight to a Log-in Screen instead. We do push a hidden Admin Account via Script during Enrollment. I can Log-in with said hidden Admin Account at that new Log-in screen. We only see this issue with macOS 14.x (Sonoma). We can manually Enroll a Sonoma machine without issue. Only during Enrollment of a Sonoma system is it an issue.  For our current Setup, we need the ability to Create Local Users still.  Anyone else see this issue?  

Hello,I search if somebody knows where these informations are written in the mac. I don't find command line or path to import it. My purpose is to create an extension attribute in JamfPro with these data.If somebody could help me. :-)

Opened up a case with Jamf support, they are seeing this pop up . Check your devices, especially any new device enrolled into your Tenant.  I have tried all the previous possible commands to fix and none of them worked. 

I thought I would try to create a VM to test erase-install OS updates. I setup a VM enrolled it in JAMF, I had to do a few things, because it didn't enroll everything correctly. I'm not, trying to test erase-install, but it says, I'm not a volume owner. Any ideas or is it not possible via the VM using UTM?

I am the JAMF admin for my employer. When a Mac needs to be remotely wiped, marked as stolen, prompted to be updated etc such request come through me.I found a Mac a few months ago, that had been inactive for several months, had a name that differs from the convention set by the enrollment profile etc. No record could be found of it in the hardware database that we use for just about everything else in the company. Usually such devices are regarded as stolen/lost in transit etc. I was never informed that a device belonging to someone external to the company had a mac added to JAMF.I sent the command to LOCK it with a message to state my name and email address with a request to contact me to verify ownership. An external business partner contacted me yesterday looking for the unlock code. I had no reason to doubt he was indeed genuine. I shared with him what could only have been one or other of the two unlock 6 digit lock codes.He attempted them, but now he appears to be locked out of t

Hello!I have an iPad Pro that we have released from Apple Business Manager and removed from JAMF Pro. There is no longer a trace of it within our system. However, after the iPad was factory reset the MDM Profile was still there from Jamf.What would be the next step in this process? Thank You in advance! 

Hi All, Since Microsoft change to Entra, when we do PreStage with Jamf Connect (using Azure as Idp) it will ask the user to select an account to sync with your Microsoft Entra ID account.this is extra step in user enrollment (we want by default to just create account) how do we achieve this?    

Hi there,We seem to be having issues trying to SSH into devices with SSH enabled on a backdoor local admin account. This issue is only apparent when trying to connect over the internet to a host with SSH enabled. When that device is on the same local network I'm able to SSH fine without issue.I've tested multiple machines in the environment and issue is exactly the same on all machines.This is the script used to enable SSH on the target device: #!/bin/sh ssh_user="THE_USERNAME_OF_THE_ADMIN_USER_ACCOUNT" # turn ssh on systemsetup -setremotelogin on # append user to ssh group dseditgroup -o edit -a $ssh_user -t user com.apple.access_ssh # restart ssh launchctl unload /System/Library/LaunchDaemons/ssh.plist sleep 5 launchctl load -w /System/Library/LaunchDaemons/ssh.plist exit 0 And connect in Terminal using 'ssh THE_NAME_OF_THE_ADMIN_USER_ACCOUNT@targetIp' 

Hello community, I am stuck trying to figure out a way to reset password of forgotten computer password that is used to log in to the computer. I have read here that you could do reset a computer's password with local account policy and I have tried that and it is not working. i am not sure which triggers i should enable for this to work or any other option i should include. Also, the reset option in local accounts policy says: This does not update the account's login keychain password or FileVault 2 password.  can i update the those credentials later with the filevault recovery key that i hold?I also have tried the filevault approach, but i can only see the reset password with apple id option and not the using filevault recovery key. Thanks for the help in advance  

Need to know how to generate report for Mac users who left organisation?