Hi Everyone!I help manage macs for a university and lately we've been having some issues with our local admin account created during prestage enrollment. It's become an issue where the account will create, and we will be able to login to the local account for a while and then suddenly without any indication we won't be able to login to the account or use it for admin privileges. Has anyone else had this issue? I haven't been able to find anything in the records for computers that this happens on and am lost now.

Hi all,We've recently deployed Jamf Pro on-premises and made it available on the DMZ. We're planning on having an HTTPS DP available on the DMZ (Apache running on Debian) However, when I try to add the DP to Jamf Pro, it keeps asking me for the SMB Share info and credentials which this distribution point doesn't have. Is there any workaround for this issue? We do have a samba share on the internal network but I can't have an SMB share on the DMZ and even if I could our security team will laugh in my face. Does anyone know how to get around this issue? Cloud Distribution points are not an option for us.Thanks in advance!

Hey EveryoneI am working in a multiuser lab environment and I have been asked to create a shared folder space on the local machine then provide a desktop shortcut/Dock icon to this folder. What is the best way to achieve this? 

I was wondering if we can build a smart group for devices based on the devices country?at the moment, we have our devices scattered around the globe (USA[Chicago/NewYork/SanFrancisco/Florida/Houston], United Kingdom, South Africa, Japan, New Zealand, Australia [Sydney/Melbourne/Brisbane/Perth]

Here's the scenario:We have a classroom of computers. Between class sessions, we run a restart on those computers. This happens at varying times.To run this restart we used to use Apple Remote Desktop. Since that is becoming/is unsupported, we want to move away from it.To run the command to restart/shutdown, etc., we have a staff computer that is separate from the other classroom computers.So... from what I've read it is possible to call a policy from a separate policy. Say:(Policy 1) has a custom trigger, and(Policy 2) uses Files and Processes to call the custom trigger 'sudo policy -trigger [triggername]'I created (Policy 1) to deliver a restart command. I scoped it to all of the computers that I want to have restarted. I created a custom trigger 'restartComputers10'I created (Policy 2), have it call the 'restartComputers10' trigger, scoped it only to the staff computer, made the command available in Self Service.Now that policy is only visible in Self Service from the staff computer

I noticed Crowdstrike Falcon was added to Third Party Products. It was added by @pingebrigtsen who works for the company. Is anyone using it? Asking because there are no discussions about it on this forum. Zero. Nada. Zilch. Did you replace another solution (McAfee, Symantec, etc.) with it? What does it do that you like? What does it not do that you hoped it would? How is it working out for your environment? Just curious, not trying to start an anti-malware war. :)

Hey! I thought I'd try my luck here as well. Im trying to use checkJSSconnection in a while loop but the computer just get stuck in the loop. This happens after setup assistant is complete and the account is logged in.Code:jamf checkJSSConnection -retry 0 >> null status=$? until [[ $status == 0 ]]; do jamf checkJSSConnection -retry 0 >> null status=$? echo "$(timestamp) Unable to connect to Jamf, retrying ..." | tee -a $log /bin/sleep 2 doneThe exit code returned is 1, and never stops being 1 so the loop continues forver.The thing is, I do have connection to jamf. If I start a new terminal window and run checkJSSconnection it will return 0. If I kill the jamf process and rerun the script via manual trigger, checkJSSconnection will return 0 on the first try.This happens every time I run a new test enrollment via prestage, so its not a one time thing.If I disconnect my wifi, start the loop and then reconnect the wifi the loops exits as soon as the connection is established,

Hey hey!Is there any way to get a report spit out that shows, for example, all iPads with Room Controller on them that are less than version X? I've found that our Zoom Room controllers get cranky about updating when we have them locked in guided access mode, so I'd like to be able to check now and again to make sure they're all on at least version X for specific security/features that dropped with it. In this case I want to make sure they're all on 5.13.X for Teams compatibility.It doesn't seem like Smart Groups has a 'less than' functionality, and I've seen mention of using Patch Reporting but that only seems to work on the macOS side of things. I'd even be happy if I could just have it spit out a .csv file with device name and version number on it as I can quickly sort that.Thank you for any info or tips!

Bonjour,Je ne trouve pas comment forcer la réinstallation d'une Apps Mac dans Jamf Pro.J'ai déployé Adobe InDesign sur un poste en passant par un SmartGroup. L'app a bien été déployée.L'utilisateur final a désinstaller l'app par erreur mais elle apparait toujours en état installée dans le status de déploiement.J'ai sorti le poste du groupe puis remis sans effet.Quelqu'un aurait une idée ?

I made a Package (named Receipt March2023.dmg) and made a Policy (named Receipt March 2023) that installs it.  I scoped it to one computer and the Policy successfully ran and the Package was installed.  I want to save an Advanced Search in Jamf Pro that will, among other criteria, search for computers that have installed this package.  I see that there is a Search criteria named Packages Installed by Casper.  If I choose that criteria and enter Receipt March2023.dmg for the Value, the search doesn't find any computers.  If I click the three dots to see the options for the criteria, Receipt March2023.dmg isn't in the list of Packages.  Why not?

We had been making use of the Content Caching Module in Jamf School for many years to take pressure off of our Internet, however this is still in beta and has been failing to cache files for some time (I can't be certain of the exact date). I have since uninstalled the Caching module as it does not appear to work anymore and appears to have been installing older settings and profiles on our devices that were cached before the module stopped working.At this time I have configured 2 Mac Minis and an iMac with Content Caching in order to take pressure off our Internet. I would like to make use of the Content Caching module rather as this was more efficient and reliable than the Content Caching feature available on networked Mac OSx devices. Is there any way to speed up the process of fixing this module? The message I have on the module (when enabled) is:Due to recent changes in the macOS system store download process, the Jamf School Content Caching daemon cannot currently deliver pa

Hi all, we are trying to finalise a roll-out of Jamf for Mac management, with zero-touch from IT. Devices are enrolled automatically to our Jamf MDM server in Apple Business Manager, and ideally we'd like to send devices directly to users, for them to unbox and run through Jamf Pre-Stage Enrollment.The issue I have seen, maybe one in every 10 builds, is enrollment will not complete correctly. We have a device at the moment that hasn't renamed correctly, hasn't deployed all Enrollment Complete software/policies, and hasn't deployed all config profiles (including FileVault enablement).Running this command locally on the device will essentially re-run enrollment:sudo jamf policy -event enrollmentCompletebut my concern is sending a device to an end-user, the device doesn't enrol correctly, the user tries to work on the device but doesn't have Office apps, or the device doesn't meet security requirements, such as disk encryption.Does anyone have any advice please?Thank you

Hello Everyone,I am still pretty new here so bear with me on this one. Our organization uses binds our Macs to AD and people sign in to create mobile accounts. These accounts have admin privileges but some things are restricted. For example, terminal access on mobile accounts is deactivated. When you open a prompt, the terminal window says "process complete" and doesn't let you enter anything. What kicked this all off is that we recently installed SPSS v. 29 on a machine and noticed that the local Admin account can run it fine but the mobile account cannot. In the local account, we noticed that SPSS launches a few terminal commands to load Java and launch SPSS. We suspect that the mobile account can't launch SPSS b/c the mobile account access to terminal is blocked.In the process of troubleshooting, we used the chmod 777 command on the SPSS folder in Applications to make sure the mobile user had rights to this program. Then we tried a few ways to modify access to Terminal (with a root

Hi all, I have a application that is a DMG, and I have a license file that i need to drop into the users application folder. Any suggestions on the best way to deploy this app? I am not sure if using the built in payload in policy would be enough or to use composer? Any guidance appreciated. 

Hi there,We have some users who needed to run Mojave until recently. We went to upgrade them (all users are remote) and I noticed that every system running Mojave stopped checking in with Jamf on 8/13/22.We disable Admin access for end users and use either the Jamf Admin user or a policy to temporarily perform admin procedures.Unfortunately both of those options are not working (Jamf admin refuses password and zero policies in Self Service will work, they just error out).The last thing I want to do is ship the computers back in and manually wipe them and restore them. Does anyone have a solution for forcing check in on systems that seemed to have dropped off?

Hi All,I'm trying to use this script to determine if a Mac's uptime is 5 days or longer, then output results as "Yes" if so, and "No" if not. But when configured as an EA, it only gives the "No" result. What am I missing?#!/bin/bash# Get the system uptime in secondsuptime_seconds=$(awk '{print $1}' /proc/uptime)# Calculate the uptime in daysuptime_days=$(echo "$uptime_seconds/86400" | bc)# Check if the uptime is greater than or equal to 5 daysif [ $uptime_days -ge 5 ]; thenresult="Yes"elseresult="No"fi# Output the result in the correct format for Jamf Proecho "<result>$result</result>"

A lot of my enrolled macs are not updating the user field. Its random but its really an inconvenience to have to update them manually.any command out there to update users and location field? when the field is not populated? My macs get named after user ID. We run a script to rename them and bind to AD based on LDAP userID.Again this is random as some work and others dont. Dont even know where to begin to look as to why.Im running latest but this happened before on all versions 9.x

Is it possible to only use the Guest account on Business Shared iPad? Not allow any user to log into a managed Apple ID, but allow the use of the Guest account. We still want the Guest account to log in and log out, which will erase the patient data. We just don't want patients logging in with an Apple ID.

Hello group, I'm attempting to create a custom ForcePoint ( WebsenseEndpoint ) installer for hosting on Self Service and automated deployment via policy. At present installing ForcePoint is a manual and tedious process that involves installing two separate packages with administrative privileges. These two packages require launching and installation to be done from within the directory that contains the required " ca.cer " , " DLPClientConfig.hsw " and " localConfig.xml " files ( listed below ) .... I've used ForcePoints " WebsenseEndpointPackageBuilder.exe " package builder application on Windows which creates the folder contents listed below, great but still requires manual installation ... Does anyone have any insight or had luck creating a custom package in composer ? I've tried multiple times with little to no luck...Any help would be greatly appreciated. ForcePoint direcoty contents - 1) ca.cer2) DLPClientConfig.hsw3)

We got some problems a way back when enrolling devices. We only get the MDM Profile, nothing more. Normally you should get about 8 to 15 profiles depending who you are and where you work. Anybody have any idea what causes this problem? For one week ago we moved to Jamf Cloud and I thought the problem should disappear, but it didn't.

When wiping iPads and selecting the option to clear the Activation Lock on ADE iPads, the device wipes as normal, but then users are prompted to enter the organization's Apple ID to unlock the device. The recorded bypass code in Jamf Pro still works, but I cannot figure out why it keeps failing to clear it. Server logs show this error message (serial has been removed):   2022-08-29 02:59:03,208 [ERROR] [ina-exec-45] [ActivationLockService ] - Failed to clear activation lock for (SERIAL). ActivationLockResponse [status=404, message=Device not found or activation lock bypass is invalid.]  Is anyone else experiencing this problem or know what could be causing it? It's happening on multiple iPads.

I'm in a little predicament whereby we receive "new user" requests that contain a display name (first and last) and email address (not connected to our Corporate domain) which is followed (once approved) by a Jamf enrollment invitation sent to said email address.Once the enrollment (of a device of which we currently have no information) is complete our process dictates that we continue to create email account and other app accounts for the new user.I'm using webhooks (computerAdded, and computerCheckin trigger=enrollmentComplete) to try to kick off the second part of the process, however I currently can't think of a way to link the enrolled computer to the invitation. I don't have the computer serial number from the request, and the local username won't necessarily equal what we will create for the user.I know I can see enrolled computers from the computerinvitations.html page in the Jamf console. Can I get this via the API?

Is there a way to get all of our LDAP users into the Jamf Users section? We have a Jamf Infrastructure Manager with the LDAP proxy set up, and it can search for users and find them from the test, but I can't see anyplace to import the users that we will be assigning devices and software to.

Hello everyone,I am still in the evaluation phase of JamfPro. While testing, I came across a question about whether the devices on which you want to perform Secure Erase must also be registered in the Apple Business Manager, or whether you only need to register devices in Jamf Pro to perform a Secure Erase. Devices that are already in use can only be registered in the Apple Business Manager if you completely erase them. This would not be feasible for my colleagues, so I would want to avoid registering in the Apple Business Manager. Therefore, it is important to know whether self-enrollment in Jamf Pro is sufficient for Secure Erase.Here a screenshot:Does 'Wipe Computer' in JamfPro perform a secure erase of the entire hard drive (i.e., the Secure Erase command built into macOS), or does it simply delete data from the device?Best regardsFloh

We seem to have an issue with the configuration of our Jamf Connect.We are using the connection with Azure to create our users.Some Macs login with the Jamf Connect window, but some show the native MacOS window with 3 buttons. This last is not desired, since most of our users do not know their Local User account.The native MacOS login window only appears after a reboot. When the Mac sleeps, it pops up with the desired login window (the one with the user icon).The thing is that this does not happen on all our Macs. Out of about 30 Mac, this has happened once on a M1 13" pro running Monterrey and this week on 2 new M2Pro 16" machines.Our configuration has not changes, since we onboarded to Jamf last October.I am sure we are doing something wrong here, but I have no idea where to start looking. Hopefully someone can point me in the right direction.