I'm beginning to develop Self Service for a client and am wondering if anyone is finding the Flush System/User Caches at all useful? Or, is this in the same category as Repair Permissions, once in a while helpful but mostly not?

Hello JAMF NationAs the subject states I have been tasked to migrate about 50ish or so macs from one domain to another and was wondering how others like myself have got this to work as effortlessly as possible. I have some concerns and was hoping to get some Ideas on how to go about it and getting it all done properly.Currently: Machines are domain bound and in their perspective security groups and OU's and managed with (NoMad) for password changes. The usernames (mobile) currently on the machines have file-vault enabled and are the only accounts to have a secure token. Question? How or would it be possible to migrate to a new domain with a new username as the usernames do not follow the same convention as the previous domain, that would in part need to have a secure token passed to it as well as maintaining the File Vault structure already escrowed to JAMF and making sure these users are added to their new OU's and Security groups from within that New domain. Would it be eas

I was curious if anybody had additional information for a project I've been working on. I'm running into an issue where in some computer labs that see frequent use, there are often many users signed into a mac at the same time and the machine begins to slow down.What I was looking to do is setup a policy where users are automatically logged out after a certain amount of time of inactivity. I see that is a configuration profile option for this setting, however from my testing it seems that the inactivity timer is only active when somebody is not on the lock screen. Is there a way using the configuration policies to log out a user after a certain amount of time, even if they are at the lock screen?

I have a user who reports he is unable to boot into the Utility menu by holding Command + R on bootup.  Is this a feature of Jamf?  I have always been able to re-format when enrolled on my test machine but thought I would double check to see if there is an exclusions list users need added to to enable them to factory reset their Macbook.  I searched around online and the forums here at JN prior to posting but didn't see anything related. Thanks! 

Hi all! Just wanted to see if anyone else is running into issues patching Zoom with Patch Management on computers that have upgraded to Big Sur? I am getting a keychain prompt after the patch completes. I can run the same patch on a Catalina machine with no issue. I first noticed this on Zoom 5.5.2, but it has happened on every patch since. I just had the same thing happen with Zoom 5.5.5 today so it does not seem like the issue will resolve itself. These are all Intel machines. Thanks!

Hello there,I am a newbee to Jamf pro.I have downloaded "office 365", used Jamf composer to package it. Uploaded it to the Jamf server and created 2 policies.1: Install Office 365 (Make the policy available in Self Service is NOT TICKED)2: Self service - Office 365 (Make the policy available in Self Service is TICKED) I was told by a Jamf engineer, we need to create separate policies due to priority issues. I currently dont have office 365 in my Mac (I deleted it) & the app is showing in self service for me to install.I installed it through self service & its working fine but the app disappeared from self service. Why is that? Any help is appreciated.Cheers,Anam 

Hi,I either went crazy or something has changed? A simple smart group to show FortiClient 6.x version shows 7.x version as well and I can't figure out why. It's not just 1 mac, but all of the ones which have FortiClient 7.x, no version 6 present are shown as well... Has anybody seen such behavior before? This is like 101 smart group and I have no idea why is it not working like that.That smart group shows my own work mac as well, I can certainly confirm, I do not have FortiClient version 6 installed

Hi allWhen we build macOS devices we use DepNotify and Installomater to install around 10 standard applications including, Chrome, Office, iTerm, Docker and a few other things. We also allow a larger selection of applications to be installed using Installomater via Self ServiceIn order to manage updates we have a policy that checks a smart group for each application to see if it is on the latest version and if the smart group indicates the machine is behind, it calls installomater again to update the applicationThis is having limited success and I'm not sure why.Could anyone advise on whether there is a defacto standard way to update applications that would meet the following criteria:1. It should work for as many common applications as possible2. It should not require users to do anything:3. It should be able to guarantee that applications are updated within a handful of days of a security update being released4. There should be minimal involvement from IT in having to package, script

At our school we follow a "security through obscurity" policy regarding WiFi connections. I know, I know.The kids never see the actual password, it is just pushed using a profile in Jamf School. But in iPadOS 16 the user will be able to see all stored WiFi passwords.Does anybody know if Jamf will be able to block that feature?Thanks!

Hi, I noticed that all of my Macs had an old scope that pushed out a Device license to all of our Macs. The problem is that my school has moved over to User License accounts and as soon as this old policy was pushed through, the User License accounts no longer work (it's using the device license)*.Is there a way to permanently delete the device license (hopefully without removing all of the adobe apps) and have it re-trigger the user license instead? Thanks in advance! *sadly these old policies were pushed through after I cleared out 500K+ failed polices.

I have created this policy but it looks like it's not pushing the update thru jamf pro. Can anybody advise me on this?

In Jamfcloud, when configuring a new ADCS certificate authority (Global Management > PKI Certificates > New Certificate Authority > ADCS), the interface requires me to upload a Server Certificate file.  What are the requirements for the format of this file?Specifically, assuming that the file contains more than just a single, self-signed cert,Which elements of the full certificate chain should be included in the file?Leaf cert onlyLeaf cert + intermediate(s), but not root (This is what’s normal for a web server.)Full chain: Leaf cert + intermediate(s) + rootIf more than just the leaf is needed, should the elements should be provided in a leaf-first PEM bundle, as is typical (for example) for Apache?If the root isn’t included, is there someplace else where I am supposed to tell Jamfcloud to trust my internal CA root?Thanks,Chris

Hey Guys,I've run into a strange issue with people trying to Mount DMG Files. I've only experienced this with Monterey 12.5, regardless of whether it's a newly imaged machine, or an upgraded OS one. I've only noticed this with M1 Macbooks. When you go to open a DMG, it just doesn't do anything at all. Maybe a process inside Activity monitor loads up, then nothing. The only way I can get them to mount is if I go to Activity Monitor, select diskarbitrationd and diskimagesiod and force quit them. Then it will mount them for a while... Ultimately this comes back though.I've tried to use terminal to script this out so that some of my employees can install software, but killall doesn't seem to be having the same effect.Is this something you've been seeing? This has not happened in any other versions of Monterey. My computer used to mount them just fine, but now I cannot. Any ideas or suggestions? Thanks,Dominic

I have a static group that I wanted to add some newly imaged machines into but they're not showing up as an option. If I go to create a new group they show up there, but not in the already existing group. Is there a workaround for this? Thanks!

My question may have a ridiculously easy answer, but here goes. We have a lab environment with a teacher who works with grades Pre-K, K, 1, 2, 3.We have user accounts (standard user accounts in AD for these grades). The teacher wanted to have a specific dock configuration for these standard user accounts. After looking at a bunch of options I went with Dockutil. A friend of mine with considerably more scripting experience helped me create a single script that used case to configure the dock for those specific user accounts.The trouble is that script was made before Dockutil was rebuilt using Swift. How do I adapt the script to work now without Python??The script is below:#!/bin/bash #We need to wait for the dock to actually start until [[ $(pgrep Dock) ]]; do wait done #Get the current logged in user that we'll be modifying if [ ! -z "$3" ]; then user=$3 else user=$(python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDyn

Hey all, I took some time off during the summer and completed a tool that I have been thinking about for some time. I’ve fully tested it with Jamf Pro. Hope it helps! https://office-reset.com

We have Yubikeys paired keys with MacOS. I have to export Yubikey Cert infos to shared smb.Solution: I have a Powershell script to deploy on admin and non admin users.Requirements:  Brew /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"  Powershell  brew install --cask powershell brew install ykmanpws script.ps1These commands are working just fine locally. Am not able to write these commands using a script  to be deployed as Jamf Policy. Any idea?

Has anyone figured out how to use Erase All Content and Settings for computers running Monterey yet? Did they implement this feature yet? We have been wanting to test this on our computers running the beta, and now that the release is less than a week away and 10.33 just came out, we figured it would be in there, but all I'm seeing is the old Wipe Computer button requiring a six-digit code.

I'm trying to script a way to disable the Automatic Run Of Safe Files In Safari for a CIS Benchmark across our deployment. While we have a few versions of the OS in the wild, I'm mostly focused on Catalina. I tried the following, but it doesn't seem to change the preference. defaults write com.apple.Safari AutoOpenSafeDownloads -boolean false

Hi all - I'm looking for clarification on how the macOS Software update deferments work in relation to the Jamf software update MDM commands.Jamf states that “macOS can still be updated via an MDM command even if updates are deferred.” See Not clear on what this actually means. (See https://shrtm.nu/GQCu) Can someone add insight to this simple example scenario:-Let’s pretend a Mac has a deferment for the new macOS 12.5 minor update (deferred for 30 days in this example).-The Mac in question is currently running 12.3.-The Mac can see that 12.4 is available in software update (its been available for more than 30 days) but can’t see 12.5 yet (only been available for a week).Q: Given this scenario above, If I locate the example Mac in my JSS and issue the ‘download and install software updates’ command via MDM, what OS version will the Mac install? 12.4 (not deferred) or 12.5 (deferred)? Or none?

Hello, We just setup Jamf Connect on Friday. I pushed it out to one of my test machines and I cannot get it to merge with my local account. It pulls up the Azure Microsoft login page, I type in my email address, then it takes me to our Okta MFA page and I sign in there, the push is sent out and I tell Okta that it is me. Then it looks like it is going to log me in, but it doesn't. The next screen I get is to reenter my cloud password  to setup my new local account. I have tried every password for my iCloud, my AAD password, and my local Mac account password. Nothing will let me in. I have reached out to Jamf Support, but I am starting my Jamf 200 course on Monday and would like to have my MacBook working by then. Any suggestions or ideas on how to get passed that screen would be helpful.  Note: Yes I have typed my password in correctly and my account is not locked in AD or AAD.  Thanks!

HI,Users unable to change the notification option in system preferences its grayed out only for Microsoft outlook app. for rest of the apps its workingAny idea how to make it enable. 

Hi All,I'm currently trying to migrate all our users from Airwatch (old MDM) to JAMF. First step is to remove the MDM from the device and any old apps then perform the time machine backup. Some users are on Catalina or Mojave so remove old apps that need to be updated. After TMB is complete I wipe the disk and re-install macOS to latest version. When I enroll via DEP + Okta i get the option to restore data from Time Machine (other way is using Druva after config is complete). Once everything is configured I update the apps and sign the user in. Everything looks fine but when the user changes their password JAMF connect does not allow it to sync to the newly set password. I restart the device have the user log in with the last local password then get taken to the the JAMF connect Okta login screen. I connect successfully through okta with the new password but then when asked to enter last local password it says "Invalid". I suspect something in the keychain from the TMB so i reset defau

I have created a script to check for Architecture and snag the correct installer for Chrome. This is currently working, hope this helps others.There is a similar Topic here: https://community.jamf.com/t5/jamf-pro/install-latest-version-of-google-chrome-without-re-packaging/m-p/156742/page/2Wanted to start a new one with the focus on Intel and M1Thanks to @cbrewer for the solution I did not need to choose between and intel and an M1 installer, I also Changed the .dmg to a .pkg with the extra bit of agreeing to the license etc, with the appended URL. #!/bin/zsh # Changed the installer from .dmg to .pkg and took out the bit for choosing an architecture. # make temp folder for downloads mkdir "/tmp/googlechrome" # change working directory cd "/tmp/googlechrome" # Download Google Chrome curl -L -o "/tmp/googlechrome/googlechrome.pkg" "https://dl.google.com/chrome/mac/stable/accept_tos%3Dhttps%253A%252F%252Fwww.google.com%252Fintl%252Fen_ph%252Fchrome%252Fterms%252

I want to use the following adminguide to uninstall Adobe Acrobat XI Pro with a script, but can't seem to get it to work. The command line command is located at the just about the bottom of the following link. Does anyone know how to make this command run using a simple script #!/bin.sh ????? http://www.adobe.com/devnet-docs/acrobatetk/tools/AdminGuide/mac.html#what-s-new-for-11-x this is the command being performed via youtube video (substitue XI for the applications folder name) https://www.youtube.com/watch?v=Knvf7WZdP5w