is there a way to remove the recovery lock password on Apple Silicon Macs without unenrolling/erasing them?

I've been trying to find a way to package Logic and GarageBand with all of the loops installed and indexed for each user. The apps install fine, nothing weird/crazy to deal with. I download all of the loops and extra content with both programs and make a package from them after installed; I grab /Library/Application Support/GarageBand, /Library/Application Support/Logic, and /Library/Audio, another 46GB of data there. After that I use composer during the indexing and grab a bunch of database files there in the user directory. After making a configuration installing the apps, then the content, then the index I am able to log into users and not have GB or Logic run the index (which is actually what I was trying to do in the first place); however, when I open GarageBand it tells me that a bunch of extras are missing and I have to re-download them. I run through the 6-10GB download process (with composer open) and let it install but composer only shows a few files being touched.

Hey all, anyone know of a way to prevent any and everyone from enrolling a macOS device through https://our.jamfserver.com/enroll without disabling ABM/DEP enrollments? I want to make DEP the only option for anyone to enroll into our jamf and would prefer that the web address just be invalid. But turning off user initiated enrollment breaks macOS ABM/DEP enrollments.  Essentially I want to hide http://my.jamfserver.com/enroll completely or make it non-functional when accessed via a browser, while still allowing everyone in our domain to enroll a new macOS device via ABM/DEP.Any tips? EDIT 12.3.02021: This comment hopefully better explains what I'm looking for. Also updated post title.

Asana application does not have a .pkg file inside the .DMG? any suggestion  Here is the download link: https://asana.com/download 

Preface: Maybe I'm missing something obvious... For DEP deployments, we have an Enrollment Complete policy that waits until a user is logged in to throw up a splash page and custom triggers our big config policy to then do the configuring we want, then it reboots, etc. Here's the logic in the Enrollment Complete script that confirms the user is logged in before kicking off the config: #!/bin/bash until [[ $LoggedInUser != "_mbsetupuser" && $LoggedInUser != "loginwindow" ]]; do LoggedInUser=$(defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName) sleep 1 done echo "$LoggedInUser has logged in, beginning configuration..." The issue is that the login process begins immediately after the Create User screen, thereby updating LoggedInUser to pass the until loop. This would be fine, but following Create User is the Choose a Time Zone screen. So sometimes, if a user doesn't pick a Time Zone quickly enough, the splash

Hello!I registered 11 new iPads with JamfSchool.After that I wanted to install 8 apps. 5 of the 8 apps installed without any problems.But for "Stop Motion", "Book Creatoer" and "IMovie" I got the message:"This app is not yet in scope for this device, please wait for the update to finish".Which update should I wait for and what happens now?Its iOS 16.1.1Best Regards,Ralph

I have a smart group that looks for invalid FV keys to determine if the key needs to be redirected to JSS: Based on that, it'll run the following script (https://github.com/JAMFSupport/FileVault2_Scripts/blob/master/reissueKey.sh): #!/bin/bash #################################################################################################### # # Copyright (c) 2017, JAMF Software, LLC. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. #

Hi Everyone, I was wondering if you can assist me on this matter. I'm trying to setup Nudge and I'm going with option 2 on the GItHub site. My question is, how do I add a Smart Group into a Scope? The only options I have are All Computers or Specific Computers? I was trying to attach a photo to this post as an example but community.jamf.com website is not letting me upload a screenshot. I hope this made sense.   Thanks,Rony    

Hi everyone, We have 2 JAMF Pro environments that are mirrors of each other – DEV and PROD.Our endpoints or DEP enrolled and FV keys are stored per environment. Without wiping and re-DEPing can anyone advise on an automated workflow to move devices?Some insight in re-escrowing the FV keys without decrypting and encrypting would be a win.*We are enabling FV using config profiles. If anyone can provide some insight, that would be much appreciated.

Hi All,looking for some guidance,I have approx 200 systems that where removed from JAMF via script but still have a old MDM profile. I need to get these back into a working state with a valid mdm profile. Is the best way to fix = Wipe / Re-image -> DEP enrolment  or is there another way to fix it ? via script or local steps?ThanksRob

The latest version of Chrome is 114.0.5735.106 (released 6/7) but Jamf is only showing the prior one that was released on 5/29.  Granted we are only a few days out from its release but wondering if that is normal/expected behavior.  

Hi, we have some MBP 16" we purchased in Dec 2022. we were able to deploy a few using the auto-enroll process. we have a couple of devices left. when we try to auto-enroll them now, we are stuck at the remote management screen - when I click on continue, it says retrieving enrollment profile and nothing happens. we are stuck at this stage. I have confirmed the token has not expired. I have put in a new token just as it was to expire after a couple of days.I have confirmed the network setting are OK. I checked the devices under the --> Settings --> Global --> Automated Device Enrollmenthere I can see the serial numbers for the 2 MBPs in question, which shows enrollment done on 17/12/2022. it is assigned to the correct group - SG-MacBook Pro - M1. however, it does not have a device name for these 2 machines. how can i resolve this?

Recently, my organisation had experienced theft of their property on site - an iPad was stolen. In the JAMF dashboard you can see the iPad has been wiped several times and on each occasion it would pull down our MDM profile and all apps that have been allocated to it. How does one go about trying to locate the physical location of the said item?

Hello, everyone,we added our existing MacBooks to jamf via UIE. The devices still have manually installed user profiles under System Settings - Profiles. Certificates were distributed with the configuration profile. Is there a way to uninstall this profile via jamf?Cheers

I did a search and found a couple of scripts, but they look like they're older threads so I figured I'd ask again. I'm doing some tests in Composer with various packages for a few different audio plugins, including Native Instruments. All computers in this lab have Native Access installed (the Native Instruments installer) and then several different instruments/effects/etc such as Kontakt, Reaktor, Guitar Rig, etc. I'm assuming if I package Native Access to be available in Self-Service, it's pretty straightforward and users can then just install Native Access as normal and pick whatever instruments they need to use, and so on...right? Or...am I better off making a package of Native Access + ALL their applications, instruments, etc...which is what we'd ideally like to provide on each workstation)? It would be sizable (like 80G) but we have plenty of hard drive space, so :shrug: .In either case, it seems like it's a pain to uninstall instruments, like if there's some kind of issue a

We have JAMF Pro running for a couple of years, we recently exceeded our licence count so purchased additional licences and applied the new Activation code to our instance. Our instance shows a total devices purchased as 30/270, managed devices as 26/264 and unmanaged devices as 0/0 so we do have a surplus of licences.BUT we have an alert through the lightning bolt to tell us we have exceeded our device count.Has anyone else had this issue? Any ideas on how to resolve the annoying error?

Hi all,Is there any option to play with Screen Saver time to enforce maximum minute and let users to set it up by themself, instead of enforcing a policy with fixed timing as attached screenshot?Thank you! 

We're in the process of testing the Device Compliance piece in our Jamf QA and after making the changes, we get an error when we click on the Device Compliance setting. The error comes up right after clicking on it.  

I am attempting to deploy Slack to our macOS Ventura devices via a curl script. When a user launches the app for the first time, they get a pop-up that says '"Slack" is damaged and can't be opened. you should move it to the Trash. '  This is only occurring in Ventura. If I download the software manually through the same URL I am calling in the curl script and install it normally, it works fine. Is there something new I have to do to get past the gatekeeper in macOS Ventura? This worked in Monterey. The script in question:#!/bin/bash # this is the full URL url="https://slack.com/ssb/download-osx-universal" # change directory to /private/tmp to make this the working directory cd /private/tmp/ # download the installer /usr/bin/curl -L $url -o slack-desktop-latest.dmg # mount the dmg hdiutil attach slack-desktop-latest.dmg -nobrowse # check if ~/Applications exists and create it if not DIRECTORY=~/Applications if [ -d "$DIRECTORY" ]; then echo "$DIRECTORY exists" elif [ ! -d "$

I'm trying to set up a configuration profile to put some iPads into Single App Mode. Every time I go to Options > Single App Mode, it freezes.  Even when nothing else has been configured in the profile, it will freeze as soon as I go to the Single App Mode setting. I've tried multiple browsers but it happens no matter what.  Any suggestions?

I have an app PKG file to deploy as a Policy in Jamf Pro.  The app requires a certificate be placed on the Keychain and some System Extensions be configured.  I can deploy the certificate and extensions as part of a Configuration Profile.  Is there a way I can deploy both to a user's Mac so that they will have them at about the same time?  

Does anyone know of a way to make the Autolock time longer than default on a shared iPad deployment? Students are complaining that it locks the device too quickly when they are referencing it as a textbook.

Hey everyone, I have a question about Jamf Pro hosted on site. Currently, we host Jamf Pro on a Windows Hyper-V instance with the public IP address directly on the network adapter of the virtual server. Our Internet Service Provider has informed us that we will no longer be able to have a public IP address on the physical adapter on our equipment without major changes to our network. If we did not want to make these major modifications, we’d need to set a private IP address internally/on the adapter and use a translated address for outside access to Jamf Pro and Web services. I am curious how if we went to this Private IP how it would affect our Jamf installation. I know that I can set a custom Forward Lookup Zone in our Windows server DNS servers to make the domain work internally, but will this have any drawbacks if our Jamf Pro URL is resolving to different IP addresses internally versus externally? Is the Jamf Binary, Apple MDM, and/or macOS DNS smart enough to re-resolve the

Hi, I have written a script to install CS falcon on Mac via JAMF, but script successfully install the CS falcon on Mac system but "Falcon” Would Like to Filter Network Content" in network extension and "The System Extension Blocked message" in Security & Privacy, which need to "Allow" manually.   Need help to correct the script for automatically run the process without user interaction, following script. #!/bin/bash # Set the installation parametersCLIENT_ID="YOUR_CLIENT_ID"CLIENT_SECRET="YOUR_CLIENT_SECRET"INSTALL_TOKEN="YOUR_INSTALL_TOKEN" # Define the installation directoryINSTALL_DIR="/Applications/Falcon.app" # Define the Crowdstrike bundle identifierBUNDLE_IDENTIFIER="com.crowdstrike.falcon.Agent" # Define the Crowdstrike team identifierTEAM_IDENTIFIER="X9E956P446" # Copy the Falcon Sensor packagecp /private/tmp/ # Install the Falcon Sensor packageecho "Installing Falcon Sensor..."sudo installer -pkg "/private/t

Hi everyone, I just reinstalled Mac OS on my MacBook Air, when I tried to enroll my MBA to JSS, it tells me MDM Capability: No I've checked my certificates, none of them expired. and just did a push diagnostic and it pass too Any idea?