Hello I'm still learning. I have created a smart group with systems that were compatible with Big Sur which I got this value(MacBook(10|9|8)|MacBookAir(10|[6-9])|MacBookPro1[1-7]|Macmini[7-9]|MacPro[6-7]|iMacPro1),\\d|iMac(14,4|1[5-9],\\d|20,\\d) I was wondering how I could get the opposite of it. Like create a smart group with systems that aren't compatible with Big Sur. I'm still new to this well at least with the regex stuff on finding the hardware. Thank you any help would be greatly appreciated.

I have a test macbook that was enrolled into JAMF. I reimaged it via macOS Recovery, which installed a fresh new OS for Ventura. I thought maybe this was a Ventura issue, so I rolled back the OS to an earlier version (Big Sur) and the same issue occurs. I get this error: " An error occurred. Contact your IT Administrator "  Note: For clarity, the MacBook installs any macOS just fine, and seems to gather the enrollment profiles/policies from JAMF, but upon first boot (when the user should enter their SSO credentials), it gives this screen.

So we have Installomator setup to install Office 365 to all devices.  This seems to work without a hitch on newly enrolled M1 and M2 devices, however always fails when installing on an older Mac.  After checking the logs I saw the error where it couldn't connect to https://go.microsoft.com/fwlink/?linkid=525133.  I decided to manually navigate to the site on the device to see what happens and when i do, I get prompted to allow download on "officecdnmac.microsoft.com" with the option for me to allow.  I choose Allow on the device, manually delete the pkg once it downloads, refresh Self Service and the script ends up working fine.  Does anyone know a way around this?  Is there a way i can automatically allow downloads?

Hey Folks,I’ve had multiple conversations with both Jamf and Apple about their recommendations here, but neither have been able to give a definitive answer:We’re migrating iOS devices from Intune to Jamf, one-at-a-time as people come up for refresh.- All devices are DEP. We have “light touch” management: our company doesn’t push apps/data to devices that we’re concerned about, and users are technically able to remove Intune from their devices.- We are not moving existing devices to Jamf (only brand new or wiped devices)- We’re concerned with this being as seamless as possible for our users and getting their purchased apps and personal content positioned as they would expect.Our initial plan, that we now know won’t work (because the backup retains the device's Intune Enrollment):   Intune Phone -> iCloud Backup -> Restore to brand-new iPhone -> Enroll in Jamf Initial tests indicate that Option 1 (below) does work, that Jamf correctly interacts with the device, an

I have found a number of older discussions asking for a way to allow non-admins the ability to manage individual system preferences but I'm not having luck on utilizing them on 10.13 (did not try all recent macOS major releases). Hoping to find something that can apply to machines running macOS 10.10-10.13. Does anyone have a up-to-date script or configuration profile to all non-admin users (not sure if it matters but they are also AD mobile users) to control Network System Preferences? Specifically hoping to allow non-admin users to be able to remove remembered networks. When trying this process I get an error: bash: /tmp/system.preferences.plist: Permission denied

Hello, I have an EA which reports back the version of Firefox installed on client machines in JAMF. The question is, what do you do with that once you want to take action (such as updating the version)? JAMF does not allow one to test the version for greater than or less than, only "is/is not" "like/not like" or regex, which is not helpful here that I can tell. The goal here is to get everyone running less than Firefox 108 to be updated, but I'm not seeing how to do that with JAMF—at least not in a straightforward way. I'd appreciate any insight, thanks.

HiHelloI am looking for a solution to the problem of retrieving user information from google cloud.The problem is that I am connected to Cloud Identity Providers -> company name - mapping. I can perform a test and find people from my organization there, there is a full list of data from google cloud - what I need.However when enrolling a laptop where the user has to log in after SSO. Policies are downloading, laptop is configuring but I don't have any information either in user data or in Computer -user and location.What could be wrong here?I tried to wait, wait a long time (more than 24 hours even though I have a checkin for 5 minutes) - I tried sudo jamf recon and nothing.   

I've added "Number of Available updates" to my Computer Inventory display, and noticed every computer lists 0 for SWUS. This is very suspicious and in my experience pretty improbable with over 75 computers. On my own laptop I can see in system preferences:"Updates are available for your mac"macOS 10.14.5 UpdateiTunes Device Support Update After running a sudo jamf recon and policy for good measure, I've confirmed my computer information is up to date in jamf, but still says SWUS = 0. I'm not sure whats going on here, I've never had this problem with past organizations.

I'm wondering if there's the ability to apply a Mac's previous name as it is in Jamf, at the time it is reenrolled or as a post-re-enrollment process after it has been wiped and reloaded with a fresh OS.  Right now there is the ability to create a policy to run with the “Enrollment Complete” trigger and possess a Maintenance payload with the “Reset Computer Names” checked.Unfortunately though when enrollment completes, before the aforementioned policy has a chance to run, an inventory update is run (a built-in part of the enrollment process) which of course causes the Mac’s existing name in Jamf to be changed and overwritten to the default “iMac” name it automatically gets when installing an OS.By the time the above "Reset Computer Name" policy runs, the Mac’s name in Jamf has already been set to the generic “iMac” due to the forced inventory update at the time of enrollment.We currently name our Macs based on location (building and room number) along with the asset tag

We are trying to find a way to block the Freeform app on iPadOS 16.2 for our K12 District. We normally would use a Restriction Profile using the SafeList and Blocklist Payload but I do not see an option for that app. Does anyone have a script or way to block?

So I was getting this error constantly on every machine.When I checked the Approved System Extensions, I noticed there was 'Allowed Team Identifiers' for a few Applications, one being Cisco AnyConnect. So I created a new Approved System Extensions policy and removed the 'Allowed Team Identifiers' portion for Cisco AnyConnect. As you can see in the NEW policy, the 'Allowed Team Identifiers' is gone. Question for clarity... I assume if the Team Identifier is already being entered within Allowed System Extension Types, it would be unnecessary to also add Allowed Team Identifiers. That option seems to be for applications that do not need System Extension or System Extension Types. Is this correct? After I removed the Allowed Team Identifiers in the NEW policy, I didn't see anymore errors... So for clarity, is Allowed Team Identifiers necessary, or can I delete that portion without causing any harm?

Sending the Enable Lost Mode, Lock Device, Wipe Device or Unmanage Device commands do no good if the mobile device is not checking in with Jamf.  Until it checks in (which may be never), it continues to use a Jamf license.  I don't see a way to release the Jamf license without deleting the record from Jamf, which I'd rather not do (as then we no longer have a record of the device).  Or am I missing something? 

Looked at dsconfigad hoping it would point upward to dsconfig.Looked at dscl which I think just lists them in alphabetical order.Looked at odutil which seems to only list connections and statistics. Any help appreciated.

I've following the instructions from the documentation to create a OS Ventura installer to test out manual OS Upgrades for our organization. I'm having issues with the command execution. The packager installs correctly and can be found in the /private/var folder, I can even go in and start the install from there. But I'm struggling with the command to get it to install. I've tried:  /private/var/Install\\macOS\\Ventura.app/Contents/Resources/startosinstall --agreetolicense. This yield a result of: No such file or directory. This was how one of Jamf's training video said to do it and I followed the instructions exactly.I've also tried /private/var/Install macOS Ventura.app/Contents/Resources/startosinstall --agreetolicenseand the result of the command is: is a directory. I'm very inexperiences with the command line so any help is appreciated.  

I can't seem to find the answer to this on my own. If I set a deferral type of Date and set a date a month in the future, how do clients handle that policy when no user is logged in? Does the policy just run, or does it wait for a user to be logged in so they have the option to defer? 

After 2 full days of tinkering around with Jamf Connect, I successfully got it all working for our fleet of machines. I currently have a question: I wondered if it is possible to launch a browser window during the enrollment process. I ask this as since the MacBooks are utilizing Okta as an IdP for logging into Jamf Connect. The initial login would technically fail as the new user doesn't have a way to set his/her password until they are in the machine. Of course, they could do this on their laptop, but I would like to move from utilizing personal devices for Onboarding new employees. Launching a Browser window during enrollment would alleviate the issue of having Okta credentials synchronized which would be helpful when making the first login for the machine.

Hi there,We've recently migrated from Meraki to Jamf Pro using the jamf migration tools. Issue we're seeing is that for devices that are moved they exist in an unsupervised state and therefore we cannot do anything with the activation lock. i.e when we wipe devices and they trigger activation lock, we would have to contact apple and wait 2 weeks to get the activation lock removed.Our users use MAIDs which cannot release devices from activation lock and activation lock does not prompt local account credentials to release devices. If anyone has dealt with this issue what is the best practice in dealing with these devices or process to get around it?

Okay all.  I searched through the community forums and saw some very helpful information but it also added more questions.  I figured I'd make another post  and detail everything out.  Any help would be appreciated. Goal:  Move around 280 MacOS devices from Intune to Jamf with as little interruption to the end user as possible.I know one of the first things that will need done is un-enrolling from Intune but this is where I start to get confused on best practice.  I am new to both Jamf and Intune but one thing I understood from my previous company is that the check-in time for Intune could take as long as 24 hours.  I also see how the MDM profiles are not removable by the end user for our Intune managed devices.  While i totally understand why this needs done this leads me to my first question.What is the best way to allow for User-Initiated enrollment so that there can be a seamless transition from Intune to Jamf?If I am understanding what

I've noticed this on several units, an iMac, some MacMinis, and my MacBook Pro, half are on Monterey, and the others on Big Sur, all have a version of the M1 Chip, this also happens across accounts, both Admin and Standard. When the system is restarted OR on a Logout/Login several of the settings reset to the defaults. The ones I've specifically noticed are as follows. Mouse ScrollLight/Dark ModeLanguage Settings*There may be others but these are the settings I've personally confirmed between my own settings as well as what my impacted users have told me.Just wondering if anyone else has seen this.

Does anyone one have any learning resources for Jamf Pro, we recently got Jamf pro off the back off our parent company so we didn't get the whole integration thing or the mandatory training process, I managed to get a server up and running but now not sure how to configure certain things, so would like to find some self study material.

We added a new VPP account to our JAMF instance this morning and since then, I've been repeatedly spammed with a pop up from the app store. (changed my organization name to "myorgname" but it really shows our actual org name)Invitation from "myorgname""myorgname" wants to make apps available to you. and then there's a "Not Now" and "Accept" "Not Now" causes the pop up to reappear 1-60 seconds later and it never stops."Accept" throws me to an apple page with the URL that includes "associateVPPUserWithITSAccount" and then launches the app store.I verify my email address and password and get an Apple Media Services agreement.  I click "Agree" after checking the "I have read..." box and a window opens with the title "Allow Assignment" and the text "The organization can now assign apps and books to you".I click done and 0-60 seconds later the same darn pop-up appears and if I click "Accept" it starts the whole thing over and if I click "Not Now" it comes back again and again.

Hello Community! We are facing with a "problem" with expiring local administrator account password.From security reasons we have set Maximum Passcode Age option to 180 days, but local administrator account is under this policy too.We are not using any SSO accounts.How can we exclude this account from this policy?

 Followed the instructions and everything appears to be working the status says completed, but I checked the logs and it appears I am getting the below error message.

I'm trying to figure out how to install apps for users that are not local admins. Of course they can install from Self Service just fine, which puts the application into /Applications.The problem is that many apps (Chrome, Firefox, Signal, etc.) will periodically try to update themselves, but the user does not have permissions to /Applications, so the app can't update itself.I was considering installing apps to ~/Applications insteadMaybe something like:Package action=cachethen a script that will runinstaller -pkg /Library/Application Support/JAMF/Downloads/application.pkg -target ~/ApplicationsBut I wanted to ask community first. Is there a "best practise" for installing apps so that non-admin users can update them?

We are starting to use Printerlogic for printer installing across the company.  Manually installing the pkg or via a Policy install from a script I found on the forums here it doesn't install the needed Safari extension.  Found 2 commands to run from Printerlogic's forum that enables it.sudo killall PrinterInstallerClientopen $(cat /etc/pl_dir)/service_interface/PrinterInstallerClient.appI tried adding the commands as Exexute Commands under Files and Processes in the Policy. Watching the install on a MacBook it looks like it works but when I open Safari and check the extension it isn't there.  I can then run both commands manually in terminal and it works as intended.  Has anyone else been able to successfully push out Printerlogic?