I need to allow only access to certain webpages and block Safari in general and have not found a way yet.  In doing webclips I know have 6 bookmarks on the homepage that can't be deleted either with the removable feature checked. Here is the list you get when you add the  com.apple.webapp  to the allowed apps list and it's not in it.  Whats Web .com.qiu.scanVideo Grabbercom.ls.VideoGrabberWhats Web App ·com.zhou.whatswebEasyCloud WebDAV - Access your server on Apple TVcom.sam.easycloud.webdavMoboReader: eBooks & Webnovelscom.changduhk.ereaderiCurlHTTP AppleTVcom.jasonacox.iCurlHTTP.tvosAirWeb - Web Browser for Apple TVcom.obj-factory.AirWebA-Cast Playercom.appestry.A-Cast-PlayerSamsung Remote: ControlMeisternet.meisterapps.samsungcmQRTVcom.hjartholm.QRTVMiracast Smart View TV Castcom.qiulian.MirrorWhats Web +com.zizhong.whatswebNovel cool - light novel comiccom.novel.novelcoolWeb Video Player & Castercom.mdcmedia.webplayer.iosWristWeb - Web Browser

Hi everyoneI need some help with a configuration setting (Sleep Mode), so that the mac could be accessed remotely:Does anybody have a configuration profile for that or tell the best practice?I am confused whether to set only "Prevent Computer from sleeping automatically when display is off" and "Wake for network access" in system preferences/Battery to true? is it enough? or should I set the display never turn off, to able to use the mac remotely.I have also created a configuration profile in jamf but I can't find the setting for "Prevent Computer from sleeping automatically when display is off".thanks alotBest regardsMehdi

HiNOT jamf related.... the auto-sync between ASM and IC stopped happening as of 10/29..... anybody happen to know how to get this to resume?

Hi All, I created a Pre-Stage Enrollment that includes a local administrator account on all of the MacBooks in the Pre-Stage enrollment. I now want to update that admin password on all of the affected devices.I have updated the password on the Pre-Stage Enrollment but I am not sure that will change the MacBooks that are already setup. Is there a process to update that local admin password (silently hopefully) that I am overlooking?

I've got a bunch of MBAs that I am upgrading to Big Sur, and then checking that the Bootstrap Token is enabled.  They typically have a user Admin account on which the Secure Token is enabled, or that I can get to the point that it's enabled.  The enabled user Admin account shows on the fdesetup list, as well as the cryptousers list.However, the enabled Admin account is frequently a user account that will be removed at some point.  So I am also enabling the Secure Token on the system Admin account that's kept on the computer permanently.  Frequently the system Admin account is on the fdesetup list, so it's easy enough to use sudo profiles install -type bootstraptoken to enable the Token on the system Admin account.I have successfully used the below command on several MBAs when the system Admin account was not on the fdesetup list:sysadminctl -adminUser user -adminPassword “password” -secureTokenOn "admin account" -password “password”This usually runs successfully.&nb

Does anyone have a script that they use to run sysdiagnose from Self Service? Just having the command in a script, it requires you to press "enter", and gives an error in the logs stating:Script result: Triggering sysdiagnose programmatically from CLI with incorrect arguments. Exiting. This tool generates files that allow Apple to investigate issues with your computer and help improve Apple products. The files might contain personal information found on your device or associated with your iCloud accounts, including but not limited to your name, serial numbers of your device, your device name, your attached peripheral devices, your user name, your email address and email settings, file paths, file names, Siri suggestions, your computer's IP addresses, and network connection information. This information is used by Apple in accordance with its privacy policy (www.apple.com/privacy) and is not shared with any other company. By using this tool and sending the results to Apple, you consen

Since Jamf Pro lacks any useful way to generate reports, and our ability to use the API right now is limited (long story, don't ask), I need a way to generate the same list of Services that can be found in the Computer records. I thought launchctl might do it but there's a lot that's missing.  I tried using ps aux | grep -v '/Applications' and that seems to be a bit closer to what I want, but it's still not the succinct format Jamf displays.  Any clues?

Hello :)I've set up a Smart Group, which displays the correct Macbooks when viewed in the dashboard. However, when I use the Smart Group as a Scope Target for configuration profiles, with Specific Computers and All Users selected, I get a different set of Macbooks that fall in scope of the profile. It also seems to be a little random i.e. I have 266 computers in the Smart Group, but have a profile with 95 computers and others with upto and over 300.

Our district houses our classroom iPads in carts, which we plug our MacBooks into and use AC2 to restore the entire carts' worth of iPads in one go. I've been having to tap "Trust" on each device before I can restore iOS on them, which is aggravating. How do I go about bypassing this? I've already added the Supervision Identity and server information in AC2, tried creating Blueprints, and can't seem to get the right information added to Keychain on my MacBook...need some guidance here.

First a warm "hi" to all :)Is someone using Microsoft Intune® , too and would be able to help me to solve my question?Our Mac®  Clients are installed and enrolled via jamf pro® and we are registering our clients at Microsoft Intune® too, to be able to use SSO for our Microsoft Office365® accounts. To use SSO, we are using the APP "company portal" from Microsoft and the described way to handle the implementation of SSO with Intune(R).The first client registration at Microsoft Intune®  is working, but a former registered Client cannot be registered again at Intune® again, after it was reinstalled with Jamf pro® and given to another employee.In Jamf pro®, there is a setting to clear all data from a former registered client, if the client was already registered.I believe, that the client has to be deleted in Intune® first, if it should be registered again, but I can't find a way to do this automated. Is it necessary to delete the already registered clients in Intune® manually or

Greetings,I created a Config Profile to set a particular JPG to open at login.  Using "Login Items", and then "Items", I have the correct, complete path entered for said JPG.This works - but only for users that are admins on the Macs.  Standard users are not having it opened at login.I've searched high and low for answers, but have only found folks don't know why it's not working, and in turn recommend doing the same thing via scripts.Without resorting to creating a login script to do this (which I'm not exactly a scripting Jedi), it there a reason why doing it this way this is not working for standard users?  I even moved the JPG to a directory that standard users had read/write access to, to rule out it being some sort of weird permissions issue (which seemed unlikely as the login process is only reading that JPG), and not surprisingly that did not resolve anything.Clients I'm testing on are running Big Sur 11.6.1Thanks in advance for any assistance.Matt

Does anyone know how to disable auto-fill and saving of passwords and credit cards in Chrome?  I saw another thread here from a couple years ago saying to utlize Chrome managed prefs, but there's really no guidance other than that.https://community.jamf.com/t5/jamf-pro/restrict-browser-password-saving/td-p/169381Anyone with any ideas?Thanks! 

Hello,I'm trying to create a policy in Jamf to change the wallpaper on the computers I manage.But when executing this policy, sometimes, a message appears asking the user if he allow Jamf to perform this action.I would like to hide this window from the user and automatically validate the execution.Do you have a solution to my problem please ?

Hi all, has anyone been able to delete local users via policy where the local user is the MDM Capable User and the enrollment method was user initiated?  I keep getting failed to delete and failed to change password for this user.

anyone has issue on deploy the zscaler app with the root cert not trust ? I recently deploy Zscaler , but root trust show red "x" on the keychain access. anyway to get it around by putting command in jamf policies ? 

Hi Everyone -We are going to be deploying Macbook Airs to some students in our high school in the fall. I am curious how those of you that already have this in place deploy them. What your workflow in Jamf looks like, how do you handle distributing the Macbooks, and how do you handle the student's first sign-on?We moved to Macbook Pros for the teachers 2 years ago so I am still relatively new to Jamf. The workflow I used for the teachers was to run them through a prestage which pulled down the configs, policies, and Jamf Connect (with MS AAD). Once the teacher logged in, DEPNotify handled the rest of the process such as having them enter their name, building, etc., and then it finished up the software installs. DEPNotify was not running 100% of the time for some reason, but that was easy to fix with only a few teachers. I don't think this approach would be successful with students, 450 of them at that. Thank you in advance!

I have a service account which is locked down to the bare minimum privileges and I'm trying to make a web request to:https://companyxxx.jamfcloud.com/api/v1/jamf-management-framework/redeploy/xxxxwhere xxxx is the computer's Jamf ID.It works perfectly using my own account which has full privileges but the service account is returning Forbidden.I am having trouble finding the correct boxes to check to enable the service account to do this.Any help is appreciated.

We are facing issue with screen recording permission. To unlock security and privacy the device is asking for admin username and password. First of all, we don't know who those admin creds are. Second, we want to allow all users to be able to access security and privacy. This issue arrived only after we configured jamf connect with Azure AD. Not sure how to resolve it.

Did the latest Chrome (101.0.4951.41) break anything in your environment? In particular, SSO/SAML?

Hi all, I am trying to enable the Guest User for our machines to have it reach a point where users can use the Guest account, and then log out without the Mac having any memory of their session. My machine is up to date with the latest version of macOS, and I currently have one configuration profile enabled: Login Window.Under the Login Window payload, I have the following set-up:Window:Options: Access and Script are unchanged.  The problem is, that even with this set-up, the machines I have in the static group that are scoped to this payload, do not get the Guest User on the Login prompt at all. I just see "Others...". Was curious to see if anyone may have seen this and has a solution to help out? Thank you!

Hi, I'm new to Jamf Pro and the Apple world and I'm utilising this fantastic API script here. I am wanting to see if a Computer object is a member of a Static group, if so, remove that object from that group. Is this possible?  I'm assuming that I can use this to GET the object (variables are defined at the top of my script):apiURL="JSSResource/computergroups/id/${StaticGroupID}" apiData="<computer_group><id>${StaticGroupID}</id><name>${StaticGroupName}</name><computer_additions><computer><name>$ComputerName</name></computer></computer_additions></computer_group>" group_check=$(curl -s \\ --header "Authorization: Bearer ${api_token}" --header "Content-Type: text/xml" \\ --url "${jamfpro_url}/${apiURL}" \\ --data "${apiData}" \\ --request GET > /dev/null) if [[ ${group_check} -ne 200 ]]; then echo "Device is no longer assigned to static group. Will not proceed." fi exit 0Next, if tha

Hello, I need help with scripting an installation. Forgive me for my lack of skills in the area. I was given an agent to install. The package and config. file is within the .dmg file. When I try to extract the package to push (ARD or Casper) it fails. The negative package is just a preflight and postflight script. How would you install this leveraging Jamf Pro? Could I get help with scripting this? My thought was to: • Copy the .dmg file to a tmp folder• Open the .dmg• Install the package within the .dmg• eject the FireEye Agent installer• delete .dmg file I saw this link too, but still need help:Jamf Post

Curious if anyone knows of a way to via script, command line, or JSS to check the last time an application was opened/run. After some digging on the inter-webs, I couldn't find much. Only way I read was through the finder using the "Date Last Opened" category. We have a few computers out there that have 2 versions of some applications and rather than going to each of the users and asking them, I wanted to see if the older version had been used. If not, I could delete it. The JSS also has the Application Usage Logs, so maybe the data is there, but not sure how I'd use that.

Hi there,I have some machines with standard accounts and users are being prompted to install the helper tool which is frustrating them...I was under the impression that installing apps via polices / self service would prevent this from happening? The main culprits being ClickShare & Slack!  My apologies if this is basic stuff, I'm a Windows guy transitioning over to Mac! Any guidance is seriously appreciated. Thanks in advanced,K 

Hi,I was able to save a website as a PWA on an iPad using the instructions under the "Installing a PWA on iOS" section on this page. Once saved, I attempted to deploy it to other iPads using the Add In-House iOS App option in Jamf School but the install fails with the following error: Could not install./Invalid manifestHas anyone successfully deployed a PWA via Jamf School. If so, are there any instructions available? Or any guidance you can share?Thanks,Bill E.