We have about 50/50 M1 vs Intel chip Macbooks.We are using Jamf Connect as well (not sure if relevant)We have a standard Admin account created and loaded for every computer during prestage enrollment.We are not able to run the MacOS Ventura Installer on the M1 macs because it does accept the Admin credentials provided. These same Admin credentials are working for installing apps, etc. The update does work if you switch to the mentioned Admin account on the computer and then run the update.The update has none of these issues for the Intel macs. I can run the update from the user's account using the same Admin credentials. Anyone know why the M1 would not let us run this update from the user's standard account, even providing the correct Admin credentials?

Hey I want to achieve the following. If a certain local user logs in to open a terminal window and show the jamf.log file.What I have done so far create a policy. with the trigger Login that executes a script that looks the following  #!/bin/bash# Check if the user is sadminif [ $(whoami) = "admin" ]; then# Open a new Terminal window and run 'tail -f /var/log/jamf.log'osascript -e 'tell app "Terminal" to do script "tail -f /var/log/jamf.log"'fi the policy is executed when user "admin" logs in and gives no errors but there is no terminal window being opened and displays the jamf.log fileI dont know where the error is or why it won't work!? How can I achieve this?

Hello everyone, I am trying to configure Screen Saver Corners Are Secure -tr-corner ( https://www.tenable.com/audits/items/CIS_Apple_macOS_13.0_Ventura_v1.0.0_L2.audit:d8e594473ad878254160a22990e7bb3a) and for solution I can create a profile.But there is mentioned that "the key to include is Forced". Can someone please explain what is this key and how you use it?Thanks,Traian

Hello All,We use a proxy on our network and we are trying to come up with a solution to allow devices to establish a connection to Apple without bypassing that proxy. Has anyone encountered a similar situation and has come up with a way to resolve it? Any and all help is appreciated. Thank you

I am trying to remove stale / inactive mobile acct from the workstations after a certain time period.I tried a script but for some reason it also seems to delete the accts that are not in the time range ( e.g. set to delete acct after 14 day and the current user that logged in yesterday gets deleted also )I am trying to use a Config Profile > Mobility > Account Expiry payload but whenever I save the CP, it reverts back to 0 Hours.I've downloaded the .mobileconfig file and checked with a CP editor and it also shows 0 sec.I've created an new .mobileconfig file with 604800 ( 7 days ) and upload to Jamf Pro. The uploaded CP shows up with the correct duration ( 7 days ) but when I click Save, it reverts back to 0 hours.

This appears to be happening to all our devices. Many times when a user or even myself goes to our iPhone and open up teams it is grayed out and is need to update. This is happening constantly, at first i thought "oh wow, they are doing lots of updates to this app." but that isn't the case. when this happens we are not getting notifications for the app. When i checked my phone, i am on the latest iOS still the issue.I do have in JAMF setup to push updates automatically, make app managed if not managed, and the scope of the app is for all devices. We are not out of licenses as i still have around 198 available still.

I'm publishing an EDGE plist, that were created by iMazing Profile Editor.  Defined the "RestoreOnStartupURLs" setting. Set to 4 (open a list of URLs). Additionally added the setting "RestoreOnStartupUserURLsEnabled" = true. Problem is: The User can add & remove their own startup urls, but not remove the defined ones from "RestoreOnStartupURLs". Is it possible to accomplish that?On Windows you can change this behavior. Microsoft Edge Browser Policy Documentation | Microsoft Learn 

Hi all,I hope someone can help me to find a solution.Within FireEye HX I could create an alert with "fileWriteEvent/fileName starts-with xxx"I try to rebuild this within Jamf Protect.I have created a custom analytic with the following analytic filter: (($event.isNew == 1 OR $event.type == 0) AND$event.prevFile == "protecttest")I have also added this to a smart group called "protect-ProtectTest". I have created a smart group with the criteria Jamf Protect smart groups like protect-ProtectTest and assigned this smart group to a policy where a script removes the group from the client: rm /Library/Application\\ Support/JamfProtect/groups/protect-ProtectTestI don't know where my fault is that it doesn't work.I hope for your answers or hints what I did wrong.Thx, Mario.

We're trying to setup an ipad to use to track some airtags but we can't add them. We get "Cannot set up AirTag. Your device management settings do not support AirTag pairing on this iPad." We have no restrictions in JAMF for this yet sure enough if you look at the profiles there's one that says "Devices tab in Find My app is disabled" but we don't have any restriction for that turned on. If we wipe it and remove it from our enrollments it works fine but then we're not managing it.

I'm looking to transition from having our MSP provision brand new laptops to having the end-user run through the setup. We look to be all setup for auto-enrollment into our MDM. I don't see any reason not to go this route other than we can't seem to setup a local admin account remotely that has access on machines with filevault enabled. Any other reasons not to go this route? 

For individual computers we gather application usage logs. For every computer I can check what applications have ran at: Computer > History > Application Usage Logs.Is it also possible to query these logs over all computers? I want to know if an specific application (Microsoft Outlook) is actually being used, say last month. 

Hello, I am looking to see if there is a way to rename devices in Jamf Pro's Devices tab. I have looked all over and have found no way to rename the iOS and iPadOS devices. I must be missing something. Would anyone be able to guide me through this? I have DEP devices in Jamf so I should have access to change the device name.

I'm looking for recommendation for scripting installs with Brew to deploy software.  Whenever I try to do an install from Jamf using brew it fails stating cannot be run as a root user or something like that.  I've found several recommended ways do it but never seem to work.

We have an interesting situation.Last year we discovered an issue where about 630 of our devices never renewed their mdm profile, and they are now unable to get any management commands or profile updates.  We have a decent solution that takes about 5 min per device to turn of csrutil and then remove the profiles and then re-enroll, however we have also found that one of the profiles is causing issues for testing that is currently going on.  The profile in question adjusts the "Parental Controls" to try to block adult websites with its content blocker.  We turned this one on back in 2020 and it originally allowed parents of students to use the screen time function.  This appears to no longer be necessary since you dont now need this feature on to turn on screen time, but now since the mdm is expired we cannot remove or adjust this setting without many steps. Im hoping someone in the community can tell me a way to write the plist or a defaults command that can su

 Here's what I'm talking about: I've tried several Configuration Profile configurations and followed the instructions as provided by Cylance, but what's pictured above still appears. For now, we've been manually hitting the "Allow" button to ensure that Cylance fully installs. Any advice would be appreciated!

Hey,is there a possibility to disable the Guided access? The students are frequently setting codes, which is very annoying...

Should I create smart computer groups for each of my licensed software that I want to keep updated with Jamf App catalog? I am concerned that if I choose all of my managed clients, the catalog will install licensed software on my assets that did not purchase a license. Also curious that if I use Jamf App Catalog to keep Google Chrome or Mozilla Firefox updated will it only update the assets that have it installed or will it install the latest version on all of my assets?

Hi, In searching for a better way to install Apple Loops and other post-install downloadable content from apps like Logic Pro and  GarageBand, I see that Carl Ashley has created a new tool called loopdown. It basically downloads all the loops based on the app's plist and creates smaller packages (I believe based on folder structure) ready for uploading to MDMs like Jamf. It appears to work great. The only problem is that it produces a lot of packages (840 for Logic Pro and 707 for GarageBand) and I was wondering whether there is a way to bulk upload these packages? I'm not asking about deploying all these packages in 1 policy. I know we can do that but rather upload them to the cloud repo.

We have been using JAMF for a few years now and have quite a few leased and purchased Macs in our system but a lot of deprecated policies, profiles, and other settings that we are wanting to rebuild mostly from scratch. We are going to be entering into a new lease later this year so rather than try to go through each item one by one we are wanting to rebuild the system for the new lease while still being able to support the existing leased and purchased Macs.I know how to create a new PreStage Enrollment but most of our policies and profiles are set to "All Computers". I know that I can make an exception in each one by using a smart group but is there a way to immediately separate the new PreStage devices without creating a new JAMF environment to where they won't get any of the old stuff?

Hi folks,I'm currently creating a new process for user initiated enrollments using DEPNotify. For testing, I'm removing all local device jamf components and running API scripts to unmanage/ un-enroll the device and de-selecting the "Allow Jamf Pro to perform management tasks", but keeping the JSS record intact. Then performing changes to the build script / procedure and re-enrolling again for testing purposes.However, what I've found is that if I don't delete the JSS record for the device, although the the device successfully appears to re-enroll, the actual script that is supposed to run and start DEPNotify on the Enrollment complete trigger does not startup. It's as if it performs a "silent" re-enroll. I'd like the build process to be consistent regardless if it's a new enrollment or a re-enroll. We may have instances where devices have their management disabled in the JSS and need to be re-enrolled, and if it's end users performing the enrollment then it would be helpful to have on-

Searched Jamf Nation but couldn't find anything close enough to my use case. I'm querying the Jamf API for computer IDs by way of usernames:jamfUserURL="https://[company].jamfcloud.com/JSSResource/users/name/$username" computerID="$(curl -X GET -s -k -u "$jamfUser":"$jamfPass" "$jamfUserURL" | xmllint --xpath '/user/links/computers/computer/id/text()' - )" echo $computerID This works great except for end users who have more than one computer in the environment. Then I get a result with all IDs combined into one return. Would it make sense to stick this in a for loop to iterate through the multiple IDs? If so, can someone please assist?

Where do we find the download link for the Jamf Pro admin tools?

I have scoured the threads and the inter-webs and can't find much on this. I know how to show the uninstall package option on on-prem, I index the package in admin and voila.But such option is not possible on cloud.Please advise. Thank you, 

Is Jamf Migration specialist is part of license plan or need to pay for Jamf migration specialist?

Hi Everyone!I help manage macs for a university and lately we've been having some issues with our local admin account created during prestage enrollment. It's become an issue where the account will create, and we will be able to login to the local account for a while and then suddenly without any indication we won't be able to login to the account or use it for admin privileges. Has anyone else had this issue? I haven't been able to find anything in the records for computers that this happens on and am lost now.