Hello Jamf Nation! I am trying to update all of our Macbook OS to the latest version. We run a 24/7 operation so I don`t have a set time that I can push this out and not disrupt our business. So I send a remote mass command to a saved search with all the users that have outdated OS. I selected "download for user to install" so our users can update at their convenience. I am wondering once the OS is downloaded where do our users go to initiate the update? It might be a dumb question but a definitive answer would help a bunch. Thanks everyone!

Hi All,We have a iMac mac lab for students.  Computers are running Monterey.  Is there a way I can allow plugging in an iPod with admin rights?  How bad could it be?

I'm trying to install Barracuda Backup Agent via JAMF to my macs, but the only installation Barracuda provides is an .app file within a .dmg.  In the past, I'd just capture the installation in Composer and deploy. But now with the wonderful Read Only System volume, I get the error that the package is attempting to install content to the system volume.The installer places the app in the Applications folder, as well as some config settings in /Library/Application Support and a plist in LaunchDaemons.  I've tried modifying the permissions within Composer so they are all root/wheel and applying it to all enclosed items, but it still doesn't help.  Even manually running the package it creates gives the same error.  This is going to be a pain moving forward.  Does anyone have a solution?

 I'm completely lost here, I have tried PPPC utility  (downloaded from jamf github), manually creating PPPC in other tools and jamfcloud console, and even tried to edit tcc.db in /Library/Application Support/com.apple.TCC/TCC.db .I tested few apps among many packages i need to install with jamf, and had no luck with any of them. Any suggestions? Here's one thing i tried for Symantec Endpoint Protection    

I have done my due diligence to find an answer to this across this forum and the internet as a whole and I am stumped. Basically, I want an out-of-box experience for the end user, and that's all working great. The problem is, since the user enables FileVault when they sign in, the local admin account is not FileVault enabled, meaning if a machine is powered off, I can't log in without the user being there to sign in. I know I could use the recovery key to get in, but I'd rather avoid that if possible.I considered using fdesetup, but given that it will be a different user setting up FileVault every time, there's no way to automate adding our local admin account as a FileVault approved user since fdesetup requires the password of an account that already has FileVault access.Basically, my end goal is 1. User logs in for the first time2. User is prompted to enable FileVault, and does so.3. Using current logged in user, add local admin as a FV2 enabled user Is this possible in any

Is there a way to swap one configuration for another, depending on if a user is signed in or not?We have some laptops, and really want to set them up as multi user devices, which for us will mean signing in using NoMad. For this to work, we will need a WiFi configuration to give access to our network, so that the NoMad system can authenticate and log in the user account.Once the user is signed in, we want the WiFi configuration to switch over to using our main WiFi network. Then when the user logs out, we want the WiFi to switch back to the previous one, totally forgetting the user credentials.I guess a way to create a smart group based on if there is an account logged in or not will be a good place to start. Then all I would need to do is create the 2 configurations and set them to apply or exclude as required.But this would need to be done as the user logs in, or as they log out. And the configuration doesnt want to get caught in the middle - One WiFi configuration removed before the

In my config,Device Restriction Profile Payload- Apple store is enabled but device it gives and Error on device that Apple Store is not available. From profile deployment status it does say that profile is applied to device. Before the apple store was blocked & now I want to enable it? Any idea? Thanks

We currently are trying to setup Crowdstrike Falcon to deploy to all of our end users. We are running into an issue with the Configuration profile we setup for falcon (guide provided by CS) where it's not providing FDA access to the Agent. It places the Agent in the FDA area in System Prefs -> Security & Privacy -> Privacy -> Full Disk Access but it leaves it unchecked.  Does anyone know a solution to getting this checked with JAMF? Here is a screenshot of what  I'm referring to:  Please find screenshots of our current config profile for Falcon in JAMF below:     

Say I have a config profile for com.apple.loginwindow that enforces the value DisableFDEAutoLogin (which disables the automatic login option when using FileVault).If I had a completely separate config profile, also using com.apple.loginwindow, that enforces SleepDisabled (which disables the sleep buttton), will both of these values be enforced? Or does one profile override the other?  

Ipad gets resetstart the setup process.On the home screen I can see the self service portal start to install then it disappearsIf I open up settings, I can see it installed on the left side at the very bottom. Shows me what version is installedIf I open the device in Jamf Pro and look at the profiles, apps installed, and management command historyIt shows our profile as successful and it shows Jamf Self Service is installed, but it's not.verified the self service app and distribution -- scoped to all mobile devices, no exclusions, 1000 licenses, 508 in use.Here's the strange part. If I move the device to a different site with the exact same setup the app shows up; move the device back to the original site with the same config profile, the self service app disappears. any ideas?

jamf Pro now makes available a section called "Mac Apps" with a huge catalogue of ready to use applications.This works really well - I can very quickly get new applications installed on machines.What I'd like to do is make some of the applications available via Self Service (not everyone needs the entire Adobe Creative Cloud suite) but I can't see how to do that. Am I just being really stupid or is it not possible to target Mac Apps for Self Service?

Under contract with our cell carrier, we swap out the old iPhone with a new iPhone.  We keep the old iPhone and reuse those iPhones as a WiFi only device.  The issue we're running into is the old iPhone are still showing the phone number under the Network tab in Jamf Pro mobile devices.There are way to remove the phone number from the old iPhones in Network tab in Jamf Pro?

We've disabled all iCloud settings for all Macs.Restrictions > Functionality > All Allow ICloud are unchecked.On the Mac we're still seeing access to Photos.  How is Photos access disabled? 

Hey there Jamf people! I am currently hitting a wall during Okta Device Trust Enrollment. ERROR: Command '['launchctl', 'asuser', '502', 'sudo', '-u', 'jcombs', 'security', 'default-keychain']' returned non-zero exit status 1. ERROR: Error in accessing default keychainDuring my testing, I had it set to a custom trigger so I could invoke the policies I need whenever, and that all worked great. I would get the certificates downloaded just fine. However, since replacing the policy with run on either enrollment complete or recurring check-in, I get the above error "Error in accessing default keychain."If I switch it back to a custom trigger to test again though, it works flawlessly and enrolls/downloads the certificate no problem. I am using the scripts and guide from Okta, and can't find anything like this in their troubleshooting section and tried searching here on Jamf if anyone else ran into this, but can't seem to find anything that is similar. Does anyone by chan

Hello Does anyone had any issue with Cisco AnyConnect 4.8 deployment on Catalina?So far I had no problem deploying this policy or previous versions on Mojave and below. Manual installation works well.I collected log files from installation process.Appreciate any suggestion.

Hi,when I assign a profile to our Macs with system preferences items disabled, it installs the profile and reloads the dock but doesn't actually disable the selected items.Is this a known issue or am I doing something wrong? 

Hi everyone,We've been experiencing issues with consistency of deployments of Mac App Store apps to our users' laptops. Our users are standard/non-admin users, and in addition to that, we are restricting the usage of the App Store. What can we do to achieve reliable deployment of these apps?Thanks!

Hi there,Some Adobe Lightroom users are seeing the permissions error below when launching the application on Monterey. Adobe provided fixes here. A script sets the permissions correctly.If we follow the instructions by downloading the shell script, dragging it into the Terminal window, and executing it under the current user with the issue, the problem is resolved.If the same script is uploaded to Jamf and run, the script tries to correct the root user and not the user logged in. The policy errors out with return code 1.Here are the script and the log results.LightroomCorrectPermission.sh#!/bin/bash# reclaim Inactive memory due to memory leaks by Jenkinsecho === `date`id=`id -u -nr`home=/Users/$iddeclare -a arr=( "Documents/Adobe/" "Library/Preferences/Adobe/" "Library/Caches/Adobe/" "Library/Application Support/Adobe/" )for i in "${arr[@]}"doecho "----------------------------------"echo "Process folder: $home/$i"echo "Restore owner: sudo chown -R $id $home/$i"sudo chown -R $id "$home/

Hello,I'm looking for suggestions on stopping Mac OS  software updates?  We try to maintain control of what updates go out when because of our classes and such, and was looking for thoughts on ways to achieve this.  It drives me crazy when an issue comes up and I look at a lab and there are 2 or 3 different OS versions on different computers.Thanks for your suggestions!

We have a MBP M1 Max running Monterey 12.4 that checks in to our cloud fine, but it won't apply policies, profiles, or App Store apps. The profiles and policies are listed as pending in Management Commands, and the computer is checking in just fine (it checked in 6 minutes ago). I've tried "sudo jamf recon" and "sudo jamf policy" in the Terminal, but no joy. sudo jamf policy reports: "No policies were found for the "recurring check-in" trigger." even though the assigned policies are there, and they run without incident on other computers, so I know it's not a misconfiguration with the policy. Scoping has also been triple checked, and like I said everything is listed as pending.My usual fix would be to remove the framework and reinstall via QuickAdd, but from what I've read that's no longer an option. I'm stumped as to how to get this laptop working again, other than a wipe and re-enrollment in the MDM. 

Does anybody know how to surpress/bypass this notification after the installation finished? It's only occurs with Catalina built.

Hi all,T2 laptop, staff member left and Activation lock was enabled. Contact user and he removed the device from his Find My/iCLoud.I am able to wipe and restore the device now, but it will not go back into DEP, either during setup or after setup with: sudo profiles renew -type enrollment.I have tried both With Prevent Activation lock checked and unchecked in my prestage. So now this one is enrolled, not in DEP, not supervised. in Jamf, record shows Activation Lock Not Enabled. Also, I have smart groups: 1 for Activation lock Enabled (thankfully only 8) and 1 for not enabled. When I send either option to either group, I get Command Failed to Send I am Jamf ProCloud 10.29.2

Hi Everyone, I feel bad making this post as its been hashed over quite a few times but I cant seem to get what was working, working again now. I am seeing an issue with freshly imaged laptops on 12.4 running the latest Teams version 1.5.00.17261 where the app does not seem to respect the allowed screen recording permission. We've had a pppc in place for some time now and to my knowledge its been working. I recreated the PPPC, with various combinations of settings, downloaded the all apps PPC from github and also had the same behavior. Teams prompts for permission, but when system prefs is viewed its already set. You can toggle it off and on, reopening the app but we are still seeing the prompt. Is there something that's recently changed I'm missing here? No change with restarting nor reinstalling teams.   Profile 1: Profile 2, with the same behavior as above. 

Hey guys,I'm horrible at scripting and I was wondering if I could get some help setting the homepage on Firefox with a Configuration Profile. The XML comes back with no errors but it still doesn't seem to work. Do you see what I'm missing or doing wrong?Thanks!

Hi All, We've packaged numerous applications which have a dependency on other packages. I'm just wondering how you might handle this easily? I could resort to scripting, but that adds another dimension of complexity. example: numerous applications are dependent upon the JRE or VirtualBox. At the moment I simply have these available as a package which is working for most people, but I'd like to streamline the installation of some applications that require these prerequisites to be installed. Thanks, James.