Hey JAMF-er's. This is probably an easy one but I'm still not super versed in scripting. I've cobbled together an script that Makes calls the Classic API to get the position, building, and asset tag information from a computer record. Here are the lines I am using to accomplish this:position=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/position/text()")location=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/building/text()")asset=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/general/asset_tag/text()")It all works as intended, but s there a way to combine these lines so it's not authenticating to the server 3 times to

We use AD in our enviornment, but we have many local users with admin rights. Now that our use of Casper has become more robust. We want to take the local admin users and turn them into standard users. Any suggestions as to the best way to do this?

Hi All, I'm in the process of moving from JAMF Now to Pro. Currently have around 100 computers on JAMF Now and their FileVault key are store in the JAMF NOW Cloud. How can I migrate those recovery keys to Jamf Pro using profiles/policy script. I know that i could go on the host computer. Switch off filevault. Remove computer on JAMF Now. Enroll into JAMF Pro and use a policy/script to escrow key to JAMF Pro cloud. But thats very involved. Is there any other workflows that allow me to be more hands off.

@mm2270 I seem to recall you building some great API scripts previously...hoping you can help me figure out what is wrong here...Im trying to run a script that calls the remove mdm profile button api and had found this... however its giving me an error when I run it even if I try in one line typing the variables directly in: #!/bin/bash ## account with computer create and read (JSS Objects), Send Computer Unmanage Command (JSS Actions) uname="$4" pwd="$5" if [ "$6" != "" ];then server="$6" else ## get current Jamf server server=$(defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url) fi ## ensure the server URL ends with a / strLen=$((${#server}-1)) lastChar="${server:$strLen:1}" if [ ! "$lastChar" = "/" ];then server="${server}/" fi ## get unique identifier for machine udid=$(system_profiler SPHardwareDataType | awk '/UUID/ { print $3; }') ## get c

Can someone with more experience assist me in creating a package with Composer to install Velociraptor? Here is the information i was provided, the only thing i was given plus the client.config.yaml file.  Due to restrictions with Mac OS, a binary with a custom configuration file bundled is unable tobe compiled. For this reason, the install requires specifying a config file when launching theagent.The service install directive can be used to install the agent on Mac client. The followingcommand installs binary & config to /usr/local/sbin.• <velociraptor_file> --config client.config.yaml service installNote: The “client.config.yaml” file will be provided by Stroz Friedberg and included in the uploadportal.The service can be uninstalled with the following command:• /usr/local/sbin/velociraptor service remove --config=/usr/local/sbin/velociraptor.config.yaml• Confirm with ps -eaf | grep velo and sudo launchctl list | grep velo  I am assuming i need

Hi all, I'm back again with another question on how to implement some settings from the CIS Benchmark. We are stuck on requiring an administrator password to access system-wide preferences. I've been doing some research on the issue and I've been hitting a dead end. I found the extremely helpful blog of rtrouton (https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/), but this doesn't seem to be working in Sierra. Does anyone know a good way to script this change? Thanks!

How can one remove an Extension Attribute that was created from a "Patch Management Extension Attribute" template?I do not see how in the official Jamf Pro admin guide instructions.Admin Guide Link - Creating a Computer Extension Attribute from a Template Creating a Computer Extension Attribute from a TemplateJamf Pro has built-in templates for many commonly used extension attributes.Log in to Jamf Pro.In the top-right corner of the page, click Settings Click Computer Management.In the ”Computer Management–Management Framework” section, click Extension Attributes Click New From Template.Click the extension attribute template you want to use.(Optional) Make changes to the settings as needed.Click Save    .

I currently have policies and configs pointing to a static group.  I'd like to start using a smart group in place of it.   If I add all my devices to the new smart group and start pointing the policies and configs to it, will it redeploy everything?  I've added a few test devices to the new smart group (with criteria) and have not noticed any changes and do not get the prompt to push to only newly assigned devices, etc.  The logs also do not show any activity.   Just want to hear other peoples findings.   Thanks

Is there a way to enable reasonable security audit log retention via script to comply with CIS Level 1 requirements? Thank in advance

Hi, I would like to know which devices does not have a specific application for example keynote. Are there any ways to run a search and export the report using JAMF School?Thank you

Hello All,Apologies if this is the wrong audience. I am still fairly new to JAMF (and device management overall tbh).  Both Jamf Pro and Intune have the concepts of Extension Attributes (EA) however, from my limited experience i don't believe Intune can validate the status of EAs in the Intune Compliance Policies. Is my assessment true or does anyone know of a way for Intune to validate an EA allowing the admins to broaden the set of criteria included in the Compliance Policies. 

For new devices and troubleshooting older devices with an OS reinstall, we use the "enrollment" trigger for many of our Mac policies. We have been avoiding creating separate Intel and M1 packages for apps as much as possible. Rosetta has been capable of running all our Intel-based packages on M1s so it hasn't been an issue but I don't want to rely on Rosetta indefinitely. I would like to be able to install either the Intel or M1 versions of apps on enrollment. Is there any JAMF Pro setting I'm missing for the enrollment trigger being able to install the appropriate architecture/processor based package?Looking at alternative solutions: Eventually, our fleet wont have any Intel Macs but until then we still push a pool of default apps to our fleet and use Self Service to make non-essential/optional apps available. Without the enrollment trigger we have relied on having to flush once per computer policies for OS reinstalls or making policies set to "ongoing" at startup with smart groups to

The previous System Admin used a script to rename our laptops in AD, JAMF, and the local machine, which worked until a month or so back. I found the script we currently use in this thread answered by "luke_reagor" However, now, only part of the script works to rename in JAMF and the local machines, but, makes no changes in AD.Microsoft and Apple have been releasing more and more updates related to security and encryption and my thought is that the new updates have broken that script somehow. Has anybody seen or heard about this issue? I did notice that if I manually unbind/rebind to AD the computer name gets updated, but, that won't work in a 500+ employee environment. Any input will be greatly appreciated and if there are new ways to rename bound computers to AD, input your $0.02 cents here.

I have setup EFI password for a static group. The Policy was applied. I have pushed another policy to remove the EFI password. The 2nd policy not triggering:- Exclusions is not over scoping target.- No machine set in pending, no logs, sudo jamf policy "nothing found''.- Policy clone, retire exclusion, change target group to one signe machine : same- push another policy: ok

I have several users who do not want this option. We are using the AD functionality in JSS to bind the machines to the domain which creates mobile accounts. I have unchecked the "Use UNC path from Active Directory to derive network home location" But "Force local home directory on startup disk" is greyed out and selected. I am not sure if this is what is mounting that when they first log in and getting a "directory.org cannot be mounted" error. Any ideas?

In the last two weeks, this is the second time that I have seen multiple posts that have the exact same headline, body, and questions. It looks like Jamf nation is now a part of the global environment by getting trolled by spammers just wanted to give everybody a heads up in case they haven't seen this either. @jamf11 I know its hard, but maybe you can be the leader of the pack and find some way to avoid this?

I have an (non admin) end user using VMware Fusion 13.0.2 on a MacBook Pro M1 13.3.1.I've used PPPC Utility to set up a Configuration Profile that has "Accessibility - Allow" for Fusion.The end user still gets an error when they start Fusion to allow Accessibility. They are getting the profile and other profiles are working. Any insights would be appreciated. 

Hi allIs there any way that we can find out what is the current Apple ID on the Mac ??

We are attempting to build a compliance dashboard for senior leadership.  One of the top compliance items is that macOS be up to date.  That criterion is defined as that the endpoint must be on the latest patch and version of macOS within 30 days of release.  What we need is a data source that we can poll for the most recent version of macOS and when it was released so that we can feed the logic in the dashboard.Has anyone put together something like this, and if so, what did you use for the data source for the current version and patch level of macOS?

I use a Policy that runs the script below to name our MacBooks to the machine's S/N that runs after enrollment and lately it stopped working.  It might be since Ventura came out or one of the revision, but I cannot confirm.  I can run the commands manually so they commands haven't changed.  Any suggestions would be great. #!/usr/bin/env bash# Get the Serial Number of the Machinesn=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}')# Set the ComputerName, HostName and LocalHostNamescutil --set ComputerName $snscutil --set HostName $snscutil --set LocalHostName $sn

Have issue with Sophos signed mobile config profile. Have uploaded the mobile config file provided by sophos into jamf and it works fine. I need to add the profile to another site but I can not clone the profile (which is fine) but when I try to upload the mobile config file to the other site it will not let me. I am assume since it signed and its name can not be changed this is why it would not let me upload it to another site?

Hey all, I'm looking to restrict our users (K-12 students) from enabling Full Keyboard Access in System Preferences - Accessibility - Keyboard. I've identified the plist key value, FullKeyboardAccessEnabled and FullKeyboardAccessFocusRingEnabled, created a plist and set the -int to 0 and uploaded it to Jamf in a profile with Application & Custom Settings. While I'm used to custom .plist files "graying out" the option to enable/disable items, this one doesn't seem to do anything to restrict the user. Thoughts? This would only be a temporary management profile to get our district through state testing. I don't like locking down Accessibility options, but a request has been made.

If you have multiple virtual MDM's in apple school manager linked to different sites in Jamf, you assign a device to one of the MDM's in ASM and you have the setting Automatically assign new devices that is in the assigned MDM/Site's PreStage will it only assign devices linked to that MDM/Site in ASM? I.E. does the PreStage setting "Automatically assign new devices" work when you have more than one MDM in Apple School Manager?

Is there a way to remove the news previews from the Today View widgets? There are inappropriate news articles that show up for students and parents are wanting this blocked. I have the widgets blocked but it doesn't remove them from that view.

Hi, I know some of you are using Installomator to update third party software and since I need to clear some time I decided to give it a go on a small part of our Macs. They are more or less all the same under ventura. Works great on most of our macs, but for some reason, it does not work on several of them, the logs is giving the same error : firefoxesrpkg : ERROR : Error veryfying Firefox.pkg error : Firefox.pkg: rejectedsource =no usable signature.  Any recommendations ?