Hey-oh JAMF nation. I am a new JAMF admin coming previously from a Helpdesk role. If I ask or say anything that doesn't make since please  bare with me, I'm trying to learn the ropes.I am trying to get an extension attribute setup in JAMF to query what AD groups have been setup with local admin rights to our computers. This command outputs the information that I am trying to query:dsconfigad -show | grep "Allowed admin groups"  When I set it up as an extension attribute in JAMF, it doesn't actually return a result in JAMF. I'm sure it's something simple I'm missing. Any help would be greatly appreciated. I've tried a few different variations:     Thanks all!

Does anyone know the correct Bash command to upgrade the OS on a M1 device via self-service, we currently been using the following Execute command as part of the Policy that is made available via Self Service:/Applications/Install\\ macOS\\ Big\\ Sur.app/Contents/Resources/startosinstall --agreetolicense --forcequitapps --nointeraction however this doesn't work with M1 devices as we get an error Error: failed to authorize for installation. Provide a password with --stdinpass or --passprompt.we have attempted to try the following but still no luck?Applications/Install\\ macOS Big Sur.app/Contents/Resources/startosinstall --agreetolicense --forcequitapps --nointeraction --user <admin account> --stdinpass <admin password>has anyone been successful on creating a policy that works in a similar way for m1 devices?  

Hi all,looking to see if anyone has successfully setup / deployed the config profile for disabling the gatekeeper override?i have tried both JAMF UI and Apple doc - https://developer.apple.com/documentation/devicemanagement/systempolicymanagedbut both seem to be not applying ...Back story - Im tasked by security to see if i can remove the "open" button when a user downloads a unidentified developer app and either right clicks and open or control clicks and opens ..Any pointers are much welcomed.. rk

I am not a network engineer or MS tech, so I don't know much on that end.   I have looked through the posts and can't seem to find any definitive answer on how I get the User and Location info populated in Jamf Pro when my Macs check in, if even possible.  I have spoken to our lead systems engineer and he does not want to maintain an LDAP server.  We are running a hybrid AD, as have on-prem AD and Azure.  Jamf Pro is federated, so techs log in using SSO.  From a high perspective, any advice on how to get this info from Azure or AD?  Is LDAP a game breaker for this or do I have other options I am obviously unaware of?   Thank You.

Hey there, i cant find the documentation. Can someone point me to where things are defined for the "login window" payload? Ideally when you mouse over items in the UI, it would give you a small description of what the property does. One can dream! Specifically, "enable console login" and "enable external accounts". What do those options do? does anyone have a manual link? Also this one under the access tab, Combine available workgroup settings:    

Hey everyone, wondering if anyone is running into similar issues with the brand new MacBook Pros.we got a shipment of these devices yesterday and, for some reason, they do not automatically enroll with our JAMF server. We can see the devices in Apple Business Manager with their serial numbers etc. (they are shown as "iMac 21.5inch" but that shouldn't matter, right?) and they are clearly assigned to our JAMF environment according to the enrollment history etc.. However, when we to set them up they just do the regular Apple end user installation.Anyone else with that issue or an idea on how to approach this? Could this be an issue with our JAMF setup (which works just fine with any other Mac) or rather an issue with our Apple Business Manager account? Thanks in advance!  

Hi ,trying to help with some JAMF bundling, and I would like to know how to do the following if possible.Im used to building the standard .pkg into jamf but not using specific commands to install the .pkg from within JAMF. We have a client installer for Thinkbox Deadline render Client which requires a bunch of parameters to be set during install.I was able to get the install working using their provided "installbuilder.sh" that resides within the .PKG"sudo /Volumes/Deadline-10.1.21.4-osx-installers/DeadlineClient-10.1.21.4-osx-installer.app/Contents/MacOS/installbuilder.sh --prefix /Applications/Thinkbox/Deadline10 --setpermissionsclient true --unattendedmodeui minimal --mode unattended --connectiontype Direct --repositorydir /Volumes/net-render-repo/ --licenseserver @ 10.200.235.200 "What I need to do now is incorporate that command so that it can be used direct from JAMF to push to 50 or so clients. Any help appreciated Thanks  

Hi all,Sorry, I'm new to Jamf, web applications and proxy deployment so if you have a better idea, feel free to chime in.We are working on deploying our Jamf Pro and making it available over the internet. We are planning on having two servers in cluster mode and deploying both of them behind a reverse proxy (with load balancing), the reason for us to go with this model is that we want to make the main server with the admin console accessible only if the device is connecting from our company's IP (plus we don't want to expose the admin console to the internet), now the two servers currently don't have DNS records only IP addresses which I'm thinking to use on the reverse proxy. (One of the major problems for us is that we can't have the same FQDN on both the internal and external DNS and split DNS is not an option, our External DNS reroute to our internal)Has Anyone configured Jamf Pro behind a reverse proxy before, who can share how they did it?What settings have to be change

Hello! Anybody using a Carbon Black extension attribute that reports the version/installation? Mind sharing? Thanks!

With the goal of having better user interaction options that what is provided within Jamf's Patch Management Policies (not having the app quit 5 minutes later without warning) I have been testing different options with my existing update workflow and open source tools like Yo. I ended up using Alerter which will wait for user interaction within a script and allows the calling of a command with sudo permissions in order to execute a policy trigger. I haven't deployed it to my fleet yet but figured I would see what feedback the community might have. It takes a 2 policies and 1 smart group per software title, which is a bit cumbersome, and currently never forces the update as the user could infinitely defer the installation if the app is never quit. I use a deferral counter for macOS software updates that could be integrated but I have not taken the time to do so yet. I'm open to any and all feedback, thanks! Setup Prior to Workflow ScriptBy setting up the Script Parameters it can

I'm working off 4G for sometime and have installed the Tripmode app to selectively allow and deny traffic. When I leave it open (like today) my JAMF client suddenly uses huge data download (>7GB in one day.Can someone explain what is happening here?

Hello, Somehow we are losing app license in our Mobile Device Apps.Anyone a clue how to get them back? 

Hi all,I have downloaded two DMG files for the same application. One for Intel and one for ARM64.I have created two PKG files with Composer from two DMG files.When I add the 2nd PKG file, I get an error that says that the app already exists in my library.How do I correctly handle having installation files for the same app, but for different architectures?Br,Rasmus

Can anyone help me identify the best means to create a smart group that will allow me to  group systems by Release names?  Ultimately I need to quickly identify which systems are affected by the latest CVE (i.e 2022-22675).   Currently I am creating new smart groups with each new zero day but I know there has to be a better way. 

Hi, I have a google drive link that I made into a website HTTP file and I want to populate it on the desktop for all users who log in to our computers with their active directory account. What is the best way to go about this? 

 Hi everyone!I have enrolled a MacBook (Apple Silicon) via PreStage Enrollment with jamf Connect and Google as IDP.After a fresh enrollment the Google Login window shows up, everything is fine.However the window stays blank and an error occurs when I don't log in initially. After a few days I finally try to log in with a Google Account I get an error message:your mac is not connected to a network try using local login   andan error occurred contact your it administrator When I boot into recovery mode the Wi-Fi is connected.I still can send MDM commands (Lock Computer etc.).Any ideas why jamf Connect won't work if I don't use immediately it after a fresh installation with prestage enrollment?Thanks! 

Take a look at this article https://discussions.apple.com/thread/253598128 I'm experiencing the same thing on MANY Big Sur Macs looking for the 11.6.3 update. In the Software Update pane of System Preferences, it just sits there searching for updates with the spinning gear.  I let it sit for many hours and in one case I let it sit overnight with absolutely zero indication of it doing anything. When I run softwareupdate -l in Terminal, it just sits there looking for updates and it never finishes. It doesn't happen on every Mac. There are some Macs that have absolutely no problems whatsoever finding, downloading, or installing the update. The OS versions of Macs having this problem range from 11.6.0 through 11.6.2. All various hardware configurations. I've tried it from the LAN in the office and I've tried it from home networks. Numerous reboots have no effect.  Is anyone else here in JamfNation experiencing this? if so, how are you handling it? Before the 11.6.3 upda

Our cloud instance was recently updated to 10.38.1. Several of our Monterey 12.3.1 devices are now throwing this error during every "sudo jamf policy":Mon May 16 18:27:51 Mac jamf[2965]: Upgrading jamfHelper.app... Mon May 16 18:27:51 Mac jamf[2965]: The checksum of /Library/Application Support/JAMF/tmp/jamfHelper.app/Contents/MacOS/jamfHelper did not match. (e9f50a7ece8405a055dd51c6d0dd0011 != 10e2dbc116ae688e4d9dc71ea1821ec2) Mon May 16 18:27:51 Mac jamf[2965]: Upgrading JAMF notification service... Mon May 16 18:27:51 Mac jamf[2965]: The checksum of /Library/Application Support/JAMF/tmp/Management Action.app/Contents/MacOS/Management Action did not match. (d54c78581d0ff3eb8211d274d127de97 != 052c39f5ef4e7fef8248d9adb3c4bab9)Every policy that runs from SelfService throws a "Policy Failed" message even after a successful deployment as these 2 commands run after every policy and "fail." JamfPro web interface does show them as successful, however. Tried rebooting, removing framewor

I have Google configured as Identity Provider in Jamf and until this morning, the search of users was working without any issues. Right now, the connection seems to be working, but when I try to test it and search for a user, it doesn't return anything. Is anyone experiencing the same issue? It is affecting the ability of enrolling new devices in order to assign them to users.

I think I already know the answer to this but wanted to ask here.  Is it possible to have multiple LDAP servers and have it cycle through them as one is unavailable.  We currently have four servers we can use for LDAP.  All four of those are in System Settings:LDAP Servers and they all test and work.  JAMF only uses one of those though.  If I bring that one down it doesn't ever go to any of the other three.

Hi,As we all know the JamfAAD Integration with Intune / Endpoint Manager isn't that great at all.All browsers are failing to finish the registration properly except Google Chrome. So we used Mac-Set-Default-Apps to set Chrome as default in our DEPNotify Script and the user is able to register it's device at Intune without any issues. So far so good.  Now with MacOS 12.3+ Mac-Set-Default-Apps fails due to the lack of preinstalled Python.We're installing MacAdmins Python  for other purposes at enrolment, but MSDA still fails with this Python Version and a symlink.So I search the web for useful alternatives but it seems like there is no proper way to set the default browser without any user interaction, pop-up's or restarts? Thought about the official way with a .plist configuration but then Chrome simply asks after the first start if it should be the default browser. So not useful for the first redirection from Self Service regarding the AAD r

Hi. We need to create a special "sharing only" account on some of our computer. Users should be able to share the screen using that account – but not to login to that same local account (they are supposed to used their AD logins instead).Creating a local account with a Jamf policy doesn't give me the option to create  "sharing only" account as in System preferences. So how do I create one with Jamf?

Hey all,I’m wanting to install the creative cloud desktop app as a prestage package, however Adobe seems to continue to suck at making things. Without breaking their bizarre installer, I believe their “pkg” needs to be flat and also needs to be signed to be used as a prestage enrollment package. Im able to sign it no problem, but to get it to act like an actual package (meaning it doesn’t try to zip itself when dumped into our cloud distribution point) is my current problem. Anyone else figure out a way to utilize the Adobe installer as a prestage package?

Hey everyone - I'm very much a newbie here but would love some advice - at the moment I am uninstalling Symantec from all our macs and installing Windows Defender. I'm using the command script from here to uninstall Symantec - https://knowledge.broadcom.com/external/article?legacyId=TECH103489My policy places the command file at a local location on each mac and then runs it from there, however on my test mac I've found I'm still being prompted if I want to uninstall Symantec and  1 or 2 other prompts that I have to click on before it runs...is there anyway to make it fully silent without any interaction from a user?

I know this properly very easy to do, but i pretty new on the jamf . if anyone can assist that would be very appreciated!we have patch management setup by jamf trainer that we setup earlier, it shows below and remind me to update the package. I have downloaded the latest dmg form jamf account , i mount it and put the "jamf connect configuration.app" to the application folder .  one of the jamf connect updated, but the other still 2.12. same with the patch management too. please advise.