I am working on an Update Script to get our fleet of Macs (M1/M2/Intel) upgraded to Ventura. I am using swiftdialog to notify the users that they may need to input their password and erase-install to actually run the process. I have tested it on 3 or 4 Macs (Apple silicon) and the process worked without a hitch. However, on my last two test machines (we have a variety of hardware configurations) the process fails.I added the --overwrite and --cleanup-after-use flags but they do not seem to help. Any idea what I am missing Here is the script command I am using../Library/Management/erase-install/erase-install.sh --reinstall --os=13 --update --overwrite --current-user --min-drive-space=60 --check-power --depnotify --cleanup-after-use  and here is the error in the log...Result of command:[erase-install] v27.1 script execution started: Mon Dec 12 08:16:10 CST 2022[erase-install] Caffeinating this script (pid=1207)[check_free_space] OK - 447 GB free/purgeable disk space d

Can someone please advise how or where to get this .pem cert? Do I need to be a dev? Thank you, 

I have a fun situation.M1 macBook Pro, Enrolled into JAMF, with a 5 day deadline for Pairing a SmartCard before automatic enforcement kicks in.The intel macBooks haven't been an issue, since once enforcement kicks in, the user can still login to FV2 using their PW and then the machine can get policies from JAMF. (Removing the configuration profile if we so choose)The M1 macBooks appear to finally support SmartCard login at the FV2 screen, the problem with this is that we cannot use a PW or the Recovery Key from JAMF to bypass this screen. As the macBook doesn't have network connectivity while at the FV2 login screen, we cannot remove the config profile.We tried booting into Recovery, unlocking the disk, opening terminal, and removing the folders below with no luck. /private/var/db/ConfigurationProfiles/Library/Managed Preferences Any suggestions? I both love and hate the FV2 support for SmartCard as it greatly simplifies login, but now means that getting past recovery has bec

When trying to wipe and restore a couple of DEP/JSS managed iPads I am getting a message: "The configuration for your iPad could not be downloaded from Long Road Sixth Form College" "cancelled" Does anyone know what might cause this? There's no firewall between the iPad and our JSS, they're both on the same network, same subnet. Is there some Internet related thing that has to happen when downloading a configuration profile via DEP? We already set up our JSS with an externally-trusted HTTPS certificate, and it hasn't expired, so it shouldn't be that. Thanks,Dan Jackson (Senior ITServices Technician)Long Road Sixth Form College

We're making changes to how we manage Outlook/Exchange data, and are implementing a policy on PCs where users will only be allowed to read PST files. They won't be able to attach new ones, and already-attached ones will only allow them to read and they'll get a message that they don't have rights to add new data to it if they try (using the PSTDisableGrow setting).I'm implementing the DisableExport and DisableImport preference settings on Mac, but I'm not finding a macOS/Outlook setting that corresponds to the PSTDisableGrow setting in Windows. Is there such a thing on Mac?What else can we do to keep users from adding emails to local storage on their Macs?

Looking at Mac Apps section to update Acrobat Reader DC.  If I set it to all managed computers, does it only update the devices that actually have it installed or does it install on 'all' of devices, regardless of if Acrobat Reader DC is installed or not? 

Hi all!We are working on creating a pretty basic hostname convention: setting it to [firstname].[lastname][#]While it's of course simple enough to set the first.last and append with a number, the hard part is if a user receives a second machine (or 3rd, 4th, etc).If Bob Smith is hired and we set his machine to bob.smith1, that's fine, but if in 3 years he qualifies for a new machine, we don't know how to automatically have it set to bob.smith2.Is there a way to read hostnames from Jamf Pro? I've looked into reading from a csv or Google Sheet, but the problem is then keeping either of those regularly updated.We've also looked into [first].[last].[serial], as the serial is of course unique, but we occasionally have users with longer names and would run into issues trying to append the whole, or even parts, of the serial number.We're open to hostname conventions others use, but we found this to be the easiest to manage as everything else we need can be pulled from the Jamf entries of each

Hello All,I am having a very weird issue where all of a sudden, out of nowhere, all users that have the AuthoritzationAuthory attribute on their account within Directory Utility are having issues logging in. It just doesn't want to authenticate. users without this attribute work just fine.Here is a photo of the Attribute:Here is a photo of the account not allowing us to login:Here is a photo of a user without the attribute. When we log in it prompts us to enter a password:We are connected to the AD domain using the native Active Directory tool on MacOSNone of these accounts are locally cached/built on this machineI am able to create mobile accounts via terminal for both of the accounts but I am still unable to log into the account that has that AuthenticationAuthority attributeHas anyone seen anything like this? I feel like something changed on our Active Directory side and how accounts authenticate to it since we have accounts from 2018 with this same attribute and they don't work.&nb

Hi everyone, Pulling my hair out in regards to implementing Jamf Connect in a PreStage Enrollment. The SSO mechanism is using Azure. If we don't implement any PreStage Enrollment, the DEP MacOS device will prompt for our Azure credentials and then prompt for a Local Account to be created.  Once logged in, we can then push all the Jamf Connect profiles and policies to the device, reboot and Jamf Connect works like a dream. This is the same for User Enrolled devices using the web enrolment URL. The issue comes when I try to get it built closer to a Zero touch solution by adding in the PreStage enrollment. It goes through the Azure Authentication prompt, installs all the profiles (can't see if it is installing the Jamf Connect package, but I'm guessing it is because it is in the PreStage).Then I get a prompt, "Hello (User).  Please re-enter my password". I can see that this is pulling the correct User from Azure because I've changed the claims to ve

Hi, we are currently using our jamf pro istance to manage some iPads. They are shared among our users (mainly as drawing devices for our graphic designers or to present the proposals to the clients).The issue i would like to solve is this: sometimes users downlaod and log in to gmail or to the synology drive app with their personal account. This is correct because they are sometimes needed.I would like to reset those apps every day or when needed. Is there a way to do that without resetting the ipad each time?

So I'm looking at this guide on Office templates. I created a DMG and did FUT/FEU to deploy the templates. I see them in the "/Users/username/Library/Application Support/Microsoft/Office/User Templates/My Templates" folder. But I want my end users to just open Word, Excel or whatever and have the templates show up in the main screen along with the rest of the templates: Has anyone done this before in Office 2016?

Hey Guys,is there a way to build a smart group for "not used" Apps in the last (maybe) 10 days?We want to shorten our Browser List and remove Firefox, but first to all Devices that don't use Firefox.I checked the box for "Collect Application Usage" and we see the Usage Information in the Computer Objects. I just need a way to collect all information into one Group to scope the removal script.Thanks for some Advice!

Hi all We have an EA in place to retreive the Apple update server CatalogURL that's set on each Mac, it works consistantly on all our 10.9 machines but i'm getting incosistent results from 10.10 and 10.11 machines. We're pushing out the CatalogURL in a computer level Configuration Profile so it adds the CatalogURL to /Library/Managed Preferences/com.apple.SoftwareUpdate.plist andnot to /Library/Preferences or /var/root/Library/Preferences If i run jamf recon the EA reports back with no result on about half of the machines if i then run the command directly on that Mac in terminal (the plist definitely has a CatalogURL key within it) As root defaults read /Library/Managed Preferences/com.apple.SoftwareUpdate CatalogURL i get Segmentation fault: 11 as admin sudo defaults read /Library/Managed Preferences/com.apple.SoftwareUpdate CatalogURL i get no result as admin without sudo defaults read /Library/Managed Preferences/com.apple.SoftwareUpdate CatalogURL i either

Dear Community! I am having a hard time finding a solution for scheduled machine restarts. I have plenty of mac devices in my fleet and my users tend not to restart their machines once in a while so I wish to set a two week / 1 restart schedule for instance every second week wednesday 17:00 in the afternoon - so they dont come complaining that they are out of memory and their machines are slowing by the day. Does anyone have any ideas on how to do this? I even wish to have a countdown and a notification to save everything because your machine will automatically reboot in 30 minutes (for instance).  Is this possible to do in Jamf?  Thank you in advance!David

 We typically use Jamf to send a lock command to our MacBooks on. We have one MacBook that has the "Incorrect PIN entered too many times. Please try again in x minutes" where x = 24,321,071.Does anyone know of a way to get past this besides waiting 46 years?

Trying to write a replacement for SetDefaultMailApp which implies LaunchServices but seems to be part of CoreServices now and I've installed the python module but have no idea how to import it so I can use LSSetDefaultHandlerForURLSchemeThanks for any Python 3.11 help.

Hi AllI am facing challenges in setting up conditional access for JAMF Pro on premise instance with intune as we are seeing following error. Could not retrieve the access token for Microsoft Graph API. Check the configuration for macOS Intune Integration.This connection was working before and it started showing terminated in intune and we couldnt figure out the root cause for the same as the terminal timelines are not matching with any other changes performed on the jamf side. We have tried deleting the old connector and settings in intune as suggested by Microsoft teams and recreated another app with fresh id and secret keysJAMF pro is hosted in windows environment and connecting to azure via proxy ( SSL inspection is bypassed and there are no blocking logs seen in proxy for the mentioned traffic)proxy setting is configured via JVM properties and we dont see any issue with the proxy setting as jamf pro application can communicate with jamf cloud and ABM using the same channe

My Push Certificate is expiring in several days. I have access to the account used for the certificate, however when I try and sign in to the Push Certificates portal I'm given the error "Your Apple ID is not allowed to sign in to this application":I have no issues using this account to sign in to other Apple services such as Apple School Manager. Apple has no idea what is causing this. I'd rather not re-enrol devices as this would be a huge amount of work. Has anyone had a similar problem? What can I do to fix this?

Hey Everyone!I want to grey out the "remote login" option under Sharing preferences for users so they won't be able to switch it on again.can someone please advise what is the best way to make it with Jamf pro?thanks!

When I look at individual computers I'm able to see the installed applications, however, when I use the 'Search Inventory' feature and the 'Applications' filter there are no results. It's the same if I enter a known application or leave it blank. Any suggestions? 

We use Google login to enroll our users in JAMF.  We were told by JAMF engineers during our setup, that we could use Google SSO for the login OR leverage Google LDAP.  If we setup LDAP, then we'd have an extra step of pre-populating users and groups in the JAMF settings in order to use SSO.  We don't want to have to pre-populate or manage users in the settings.  So LDAP is not currently enabled. When our users login through SSO for the first time, their Username (which is their email address) is automatically captured in "User and Location", which is great.  However, we have another system that will sync asset information, but it is hard coded to use the Email Address field.  Is there any way to easily script setting the Email Address field to what is already populated in the Username field?

Looking through the archives has done me no favors, I need a way to find out which users/Macs have iCloud enabled. At some point I need to disable iCloud outright and knowing how many users have it enabled would be extremely helpful.

How are others installing Adobe CC Shared packages in school labs? When I build the package within the Adobe Admin console, the pkg with almost all the products (media lab) is 28.2GB. 

Hi, I have just run into this issue recently whereby I try to remove vulnerable apps that are not installed to /Applications folder but copied and being run from Desktop or Downloads folders.Tried this easy command in terminal locally and worked like charm:rm -R ~/Downloads/Visual_Studio_Code.pkgSo then I created a policy that would use a script with the same exact command to remove the file and ended up having this:Script result: rm: /var/root/Downloads/Visual_Studio_Code.app: No such file or directoryCannot I just use tilde for specifying the currently logged in user's Download folder? Why does it say /var/root?I have 100+ users and not fancy writing a separate script for each of them where I just use the full path.I'm sure I'm overlooking some obvious scripting rules here so all advice would be greatly appreciated! 

We just discovered that the portion of our fleet still running macOS Mojave (10.14.6) are no longer checking in, updating their inventory, or of course executing any policies or receiving any patches.When manually triggering a policy check-in or recon, we get this error:There was an error.Device Signature Error - A valid device signature is required to perform the action.This appears to have happened to all of these machines around the same time, all showing a last check-in/update on Friday 8/12 or Monday 8/15. It doesn't appear to be happening on any of our machines on 10.15 or later.The computers all still show they are managed, supervised, enrolled, and have MDM profile expiration dates far in the future.Initial spot testing using the Jamf binary self-heal with Jamf API seems to get it reenrolled successfully. Unfortunately we're unsure if this will stick since we have no idea what the cause was, nor do we know if there will be any other ill effects from this error or from the self-