I'm trying to script a way to disable the Automatic Run Of Safe Files In Safari for a CIS Benchmark across our deployment. While we have a few versions of the OS in the wild, I'm mostly focused on Catalina. I tried the following, but it doesn't seem to change the preference. defaults write com.apple.Safari AutoOpenSafeDownloads -boolean false

Hi all - I'm looking for clarification on how the macOS Software update deferments work in relation to the Jamf software update MDM commands.Jamf states that “macOS can still be updated via an MDM command even if updates are deferred.” See Not clear on what this actually means. (See https://shrtm.nu/GQCu) Can someone add insight to this simple example scenario:-Let’s pretend a Mac has a deferment for the new macOS 12.5 minor update (deferred for 30 days in this example).-The Mac in question is currently running 12.3.-The Mac can see that 12.4 is available in software update (its been available for more than 30 days) but can’t see 12.5 yet (only been available for a week).Q: Given this scenario above, If I locate the example Mac in my JSS and issue the ‘download and install software updates’ command via MDM, what OS version will the Mac install? 12.4 (not deferred) or 12.5 (deferred)? Or none?

Hello, We just setup Jamf Connect on Friday. I pushed it out to one of my test machines and I cannot get it to merge with my local account. It pulls up the Azure Microsoft login page, I type in my email address, then it takes me to our Okta MFA page and I sign in there, the push is sent out and I tell Okta that it is me. Then it looks like it is going to log me in, but it doesn't. The next screen I get is to reenter my cloud password  to setup my new local account. I have tried every password for my iCloud, my AAD password, and my local Mac account password. Nothing will let me in. I have reached out to Jamf Support, but I am starting my Jamf 200 course on Monday and would like to have my MacBook working by then. Any suggestions or ideas on how to get passed that screen would be helpful.  Note: Yes I have typed my password in correctly and my account is not locked in AD or AAD.  Thanks!

HI,Users unable to change the notification option in system preferences its grayed out only for Microsoft outlook app. for rest of the apps its workingAny idea how to make it enable. 

Hi All,I'm currently trying to migrate all our users from Airwatch (old MDM) to JAMF. First step is to remove the MDM from the device and any old apps then perform the time machine backup. Some users are on Catalina or Mojave so remove old apps that need to be updated. After TMB is complete I wipe the disk and re-install macOS to latest version. When I enroll via DEP + Okta i get the option to restore data from Time Machine (other way is using Druva after config is complete). Once everything is configured I update the apps and sign the user in. Everything looks fine but when the user changes their password JAMF connect does not allow it to sync to the newly set password. I restart the device have the user log in with the last local password then get taken to the the JAMF connect Okta login screen. I connect successfully through okta with the new password but then when asked to enter last local password it says "Invalid". I suspect something in the keychain from the TMB so i reset defau

I have created a script to check for Architecture and snag the correct installer for Chrome. This is currently working, hope this helps others.There is a similar Topic here: https://community.jamf.com/t5/jamf-pro/install-latest-version-of-google-chrome-without-re-packaging/m-p/156742/page/2Wanted to start a new one with the focus on Intel and M1Thanks to @cbrewer for the solution I did not need to choose between and intel and an M1 installer, I also Changed the .dmg to a .pkg with the extra bit of agreeing to the license etc, with the appended URL. #!/bin/zsh # Changed the installer from .dmg to .pkg and took out the bit for choosing an architecture. # make temp folder for downloads mkdir "/tmp/googlechrome" # change working directory cd "/tmp/googlechrome" # Download Google Chrome curl -L -o "/tmp/googlechrome/googlechrome.pkg" "https://dl.google.com/chrome/mac/stable/accept_tos%3Dhttps%253A%252F%252Fwww.google.com%252Fintl%252Fen_ph%252Fchrome%252Fterms%252

I want to use the following adminguide to uninstall Adobe Acrobat XI Pro with a script, but can't seem to get it to work. The command line command is located at the just about the bottom of the following link. Does anyone know how to make this command run using a simple script #!/bin.sh ????? http://www.adobe.com/devnet-docs/acrobatetk/tools/AdminGuide/mac.html#what-s-new-for-11-x this is the command being performed via youtube video (substitue XI for the applications folder name) https://www.youtube.com/watch?v=Knvf7WZdP5w

Hi all, Anyone know a way to install cached packages one by one? Not using a policy per package or install all cached.

Hello Jamf Nation.. Question: Can you enroll yourself if your not associated to any Company that Supports JAMF Certification? Self Certification? 

I need to copy a preconfigured *.app from a Windows share over to the /System/Application folder on a Mac.Unfortunately, I've been beating my head against how to do this and haven't come up with much.I'm really hoping that someone who knows more than I do would know if there's anyway to load that *.app into Jamf and it push it down to a Mac?Otherwise I can probably script it, but since it's Windows it's not exactly as easy as an scp command to copy from "//{fileserver}/MAC INSTALLS/PcounterClient.app" over to "/System/Application".Any suggestions would be highly welcomed!

My institution is moving to named licenses for Adobe, so I am trying to figure out an easy way to package the Adobe CC Desktop installer, and install it on Macs campus-wide. Does anyone have any advice, or know of a way to do this? I've tried to package through composer and then push it via policy, but it never installs the app.Thanks!

Hi All,I'm trying to work through an issue I'm having binding in Jamf Pro.  The issue is specifically, the directory option "Allow Administration by" is not working.  This option allows AD groups like "Domain admins" to be automatically local administrators on the MacBook.The strange thing is if I use that same AD admin account and unbind/rebind manually, the "Allow Administration by" option works.Here's what we are doing.1. I created a Configuration profile in the Jamf Pro Console for AD binding2. I created a Prestage enrollment profile selected the AD binding Config. profile3. At enrollment, I can see the AD bind Configuration profile runs.4. once the computer is enrolled, I can log in via my AD admin login, but it does not have administrative rights on the computer. here's some more points of data:1. I ran the command dsconfigad -show.  Verified the "Allowed Admin groups" in the Advanced Options section included all the AD groups.  In our case it's domain ad

I've got a Macbook joined to AD that won't let the user update the OS. The user account is an Admin/mobile account because it's joined to AD and our other MB's don't have this problem, and allow users to kick off the update.  While I could push the update, I'd like to know why this isn't working for this one account and address it before it becomes an issue elsewhere.

We can create device groups and assign app licenses on a per-device basis but is it possible to do that on a per-user basis?  I'm not seeing that as an option.  I know that is something that can be done in Jamf Pro but if there's a way to do it in Jamf School, I'm not finding it. Thank you!

!/bin/bash rm -rf /Users/user/Documents/rm -rf /Users/user/Downloads/rm -rf /Users/user/Desktop/rm -rf /Users/user/Pictures/rm -rf /Users/user/Music/* exit 0 *Hi all, First time posting here, so apologies if this has already been posted before. We are currently using the script above to delete unwanted files created by students in our institution. However, we'd like to exclude a sub-directory called 'Apple Music Apps' within directory /Users/user/Music which has a file called 'LoopsDatabaseV09.db' which we don't want to delete. Any help is greatly appreciated Thank you

I know with MacOS 12.3 the Python version changed and the python call for current user did not work. I changed that when 12.3 was released a few months back and depNotify worked again. Now with 12.3.1 depNotify will not launch with enrollment. I have followed the solutions in the following post with no luck on this MacOS version. Anyone find a solution for MacOS 12.3.1??https://community.jamf.com/t5/jamf-pro/dep-notify-and-monterey-12-2-3-python-call/m-p/258525  

The following script does not work in Extension Attribute but works with ran manually (with BBEdit)What am I missing#!/bin/bash SSKeychain=$( security find-certificate -a -c "Some Software, Inc" 2>&1 | grep labl ) if [[ -z $SSKeychain ]] then echo "<result>Some Software Certificate not installed</result>" else echo "<result>Applied</result>" fi

Hi,what’s the best practice for disabling root account in macOS?Script and Policy sound about right but what does everyone else use? 

I've been getting a notification that Microsoft Teams v330874 is available on my Jamfcloud instance for the last couple weeks, but can only find v328778 on macadmins.software and Microsoft's website. Anyone else having this issue with patch management or have a reliable download source for the newest version?

Hello all, Our organization is preparing to migrate from NoMAD to Jamf Connect. During our preparation, we created two Okta security groups where assigned users will either be granted "Standard" or "Admin" permissons on their local Mac. Once a user is added to the administrative group, their local Mac account is granted administrative permissions to their local machine as expected. However, we realized this user could login to any other Mac and gain local administrative permissions on that machine. In essense, they would potentially have root access to all Macs using Jamf Connect. How have you all navigated this concern? Are you aware of any method to limit the scope of permissions to specific computers?

Hello everyone Is there a way to verify if a Login Certificate is installed on a workstation?  Also to list the login certificates as I don't know the cert name

Hello,To provide some basic background, I am a former Windows desktop engineer that used Dell Kace to configure and deploy Windows images to a wide variety of desktops and laptops, so I do have familiarity with scripted software installations and deployments in so much as those would apply to understanding the overall concepts of how Jamf works to manage devices, but I am still new to Jamf. I have not yet performed any training and have relied on my rudimentary Google skills and some higher level support within my institution to get me where I am today.Here is my situation though that I don't yet know how to tackle. I have 18 iPads sitting on my desk that need to be used by students in a lab for teaching purposes and I've been asked to deploy VitalSource's BookShelf app to these iPads and then have two eBooks available in the app on all 18 devices. I also have been provided 36 VPP codes to cover this. However, I'm not sure where or how I'm supposed to be using these codes.I got confuse

Hi allI've searched high and low, but have been unable to find anything on this. We're looking to block the ability for devices to connect / mount shares using SMB / AFP.Has anyone done this, has a script or can point me in the right direction?Cheers!

Dear Experts, I 'bought' some licenses of a free app via VPP. I made sure the app is 'device-assignable'. I added the app to the Mobile Device Apps, I have set it to 'Install automatically'. But in the VPP pane it always tells me "Content not available to assign to mobile devices". I have made sure there is no user assignment for this app, 'Site' is set to 'None', so what else might make this content unavailable for device assignment? I also tried to assign it to a device in scope, but the result is that the user is asked to sign in to iTunes for the installation - this is exactly what I want to avoid. Any hints are welcome.

Hi,Just wondering how people have found the best way to get the Chrome Homepage through Casper. Our company is pretty new to Casper, we have only had it in for a few months. I'm pretty windows based myself.I did try using Composer, opening Chrome, setting the homepage etc. I found this worked however it override pretty much every personal setting the user had in Chrome so I wasnt really happy with that.How have people done here?Thanks in advance.