I apologize if this was answered already elsewhere, but most of the answers I saw looked MacOS related, not iOS. I somehow missed the expiration for our apple push certificate, so by the time I renewed it the old one was no longer valid. When I renewed it, I saw a message that because the old one had expired, I wouldn't be able to use that to push commands to our currently enrolled devices. So, I assume I'll need to touch each device to solve my blunder. What exactly do I need to do? These were all enrolled via DEP initially. If not for the need to update the DAC app for AP testing, I would just wait for the summer and factory reset all of them. If I could at least do 20 of them that would get me through AP testing next week. Thanks

Just setting up zero-touch deployment for our company that went full remote. I know that profile configs are unique to each org's requirements, but I wanted to get a feel for what people had implemented, and if there were any suggested profile configs to look into. For example, blocking user's system preferences access, or security profiles? 

I've been taking a look at about a dozen restart scripts that have been shared with the community over the last several years.  Unfortunately it's looking like forcing a restart on a MacBook with an M1 processor is no longer a viable option?  Is there a new way to do this through JAMF with a simply policy, or with a script compatible with the new macs?What we find is students rarely restart their devices, and sometimes we need them to (to force quit certain apps for instance so policy changes can be made).  We aren't talking about post software updates, just a way to scope a policy to prompt the user to restart their device, and offer some sort of short deferral, but ultimately enforce the restart with an automatic shutdown, if the last deferral expires.I've tried the one from @m_donovan at https://community.jamf.com/t5/jamf-pro/jamf-helper-reboot-script-with-deferral/td-p/188511#responseChild164611%3Cbr%3E but that does not seem to work anymore.  If anyon

I'm trying to write a script to unzip a zip file from tmp to a user Library, the exact path is:unzip /tmp/MicrosoftChartTemplates.zip -d /Users/USERNAME/Library/Group Containers/UBF8T346G9.Office/User Content/Chart TemplatesThe issue seems to be spaces, like for "Group Containers". From what I understand you need quotes, but that doesn't seem to work either. Once the file is in that folder I need to unzip it to that location. Any help would be much appreciated. Also, a DMG is not an option since we will be updating these files regularly and would like to only update the zip file and the not the entire package. This wasn't my decision, just what I have to work with.Thanks to all who take the time to reply.

I need to explain to some colleagues the technical details of what exactly happens on a Supervised iOS device when an app that has been blocked by a Restrictions profile is installed. I know that restricted apps already installed on a device when the Restriction profile is installed are "hidden" from the user, rather than uninstalled from the device, and the user can still search for and install blocked apps on the App Store but they are immediately hidden.My question is: how does iOS accomplish this? I think it is revoking all permissions to blocked apps from the User profile on the iOS device, and I swear I read those words somewhere at one point, but today I could not find anything online to support or refute my assumption. All the Apple and Jamf docs that I read simply refer to the allow/block list in general terms, and nothing about what happens under the hood--e.g., "Any apps other than Settings or Phone (on iPhone) can be placed on either an approved list or a disapproved one."

Hello All I am deploying Falcon from Crowdstrike and we have all the config profiles scoped out correctly for M1 machines and Intel machines. PPPC, sys ext, content filter and kernel extension all installing succesfully.However when i go to install the sensor ive had about 80 fails out of 100 say "error to reload sensor", i check the CS dashboard and thos same machines are showing up there, so it seems the app is installing and licensing but exiting with an error of 1. This is making tracking harder for us to go back and see which machines failed to remediate since so many "failed" machines actually seem to be ok. Anyone else run into this? I have a ticket with CS but they have not responded The other 20 show succesful and licensed in Jamf and are good to go in CS as well, no major differences in machines from fails and success. Many of the same OS versions and architecture across both categories

Hi All of our users in JSS come from our LDAP (Active Directory). In the LDAP, students are organised into OUs based on year groups, e.g. Year4 etc. Is there a way I can make a smart user group based on the year that a student is in? This way, when they log in as part of the iPad setup (DEP), I can then scope apps etc to students automatically. Any help would be appreciated! I suspect it might be something to do with extension attributes but I am a bit stuck. Tim

Hi all, We have enabled EFI for our mac users. Randomly some machines are locked and require EFI pwd. Issue happens often after a reboot.Anyone faced the issue ? Any tricks here?Regards,Mohamed

Trying to update google chrome via script is anyone implementing this already?

We use one of the custom active directory attributes to designate if someone is a Student, Faculty or Staff. I created a smart group to look at that attribute, so I could have two lists, one list of all the student iPads, and one of all Faculty/Staff iPads. The two smart groups are working, but only with newly activated devices. For example, the faculty/staff smart group has 3 members in it, but all three were iPads that got set up in the past 3 days or so. The group SHOULD have something like 400 iPads in it though. Any idea why the group is only grabbing new iPads, and not all, with the attribute that I designated? 

I know this is a common topic but I feel like I am a weird issue that may help someone in the future that I was wondering someone can help. I created a Configuration Profile to have an Application to start up every time the computer starts up.I did the following Configuration Profile -> Login Items -> Items -> Path to Application Now the app that I want to open is called Optisigns Digital Signage (Has total of 3 spaces).Problem I am having is: if I tried /Applications/Opsigins\\ Digital\\ Signage.app, or "Applications/Optisigns Digital Signage.app", the login item menu in User and group does not recognize the app name.   Now I can manually do the adding from the computer itself but I would like to figure this out via JAMF so I can save my time lol. Anyone have any ideas.  

The picture above shows how the recon, policy and manage commands are failing. What do we do if these commands are not taking affect immediately ? Can anyone please help ?

So I've enrolled a few iPads into JAMF Pro manually and everything goes okay......until I try to launch Self Service. It tells me that "this app must be associated with a Jamf Pro Server".  Kind confused, as I thought it would know that by default? As in, that's where I enrolled it from, right?  Bangin' my head against a wall here. :)

Hi!   Our University is using Jamf Pro 10.37.2 On Prem.We have a few different DEP Prestages.  I needed to move 24 computers from one Prestage to another.  I filtered the computers by name, for example 'LO214', which gave me 24 results.  With my results filtered I then chose 'deselect all', and the 24 computers that were listed were deselected, which was the correct behavior.  However, when I chose Save, all 785 of my remaining computers were also unassigned from that DEP prestage!  This must be a bug...  I can replicate it.

I am looking after MDM solution for my employer.We have decided (for most things) to keep the setup as 'uniform' as possible for all users.For some things, such as app functionality and the App Store 'blacklist' we have recently decided to introduce some subtle distinctions between normal users and managment. Right now, it's the difference of one chat app.I duplicated the existing profile and changed its scope to exclusively 'Managment' devices. This is a static group, btw. My test device was in this group the entire time (before any changes to app policy were even hinted at) and got the new profile immediately. I could also verify this from lock screen text. Installing the otherwise 'blocked' app was not a problem.I added a colleages iPhone to the management group but it seems that he is not receiving the new profile. There is no text on the lock screen to indicate which device management group he belongs to either. More worryingly it seems he can install just about any app (from the

Hi Everyone, Fresh installation of 10.16.0 on a new Server 2019 virtual machine and i'm getting a fatal error with a notice saying that : "To upgrade from versions earlier than Jamf Pro 9.98, you must first upgrade to Jamf Pro 10.0.0, and then upgrade to the current version" This isn't an upgrade though - it's a fresh installation Server 2019 , Java 11 x64 , MySQL 8.0 I have followed the installation documentation to the letter several times. Does anybody have any suggestions? I have already tried going through the JAMF support article on the issue. Strange how it's thinking i'm doing an upgrade when Jamf has never been installed on this server ever? Ideas?

I'm running into an issue when i'm pushing out Slack to users.  I create the package using Composer and then do the usual process of uploading it into JAMF.  In the screenshots below you’ll see how i’m doing that process.  And in the final screenshot is the error showing up in the logs that is preventing the successful install.  Any help with this would be greatly appreciated!

Hi, As of Monday, any device that runs our Self Service policy to bind to Active Directory immediately loses access to Self Service with the message that the MDM Server is not available. We can manually bind to AD in System Preferences which works fine, but using the built in Directory Binding has suddenly stopped Self Service working. Has anyone else experienced this?Thanks,

Has anyone been able to successfully accomplish this? I have tried several scripts ive found on these discussions as well as AutoBrew. The end result is the same, and its always a lack of permissions.Error: /usr/local is not writable. You should change theownership and permissions of /usr/local back to youruser account: sudo chown -R $(whoami) /usr/local So, is it possible to install this for a Standard user and allow them to update and install via brew, or does this require Admin?

Hello there, we've been using ZuluDesk and now jamfSchool for quite some time now. Over time the number ov iPads grew to 34 and the number of installed Apps is over 50 now. Everytime I need to update those devices our Internet connection is blocked for a long time due to every iPad downloading everything directly from Apple. I heard of the possibility to use a Mac Mini as "Caching Server" but I found no documentation as how to implement it with jamfSchool. Do I need to set up something in jamfSchool or just plug the Mini in, activate Caching in the Mini and plug it to the same subnet as the iPads run in?

Just wondering from those that have gone zero touch on MacOS devices, are all of your users then local admins? Just in the work flows I have tested, the person setting up the device is a local admin. Yes I realize that could likely be scripted post setup to change memberships, but was wondering what others were doing. Not to say its that much of an issue at my organization, we do not have the need to drop ship new devices, and set up is down to just a couple hands on steps. 

Long subject i know lol.I am trying to make a script that will take the user logging into the computer for the first time and name the computer appropriately based on that users info.I.E.  If the user is a high school student, it would assign HS-StudentAssetTag#, if a Middle School teacher, MS-TeacherAssetTag#, or if a Principal or other Administrator of one of the grade schools GS-AdminAssetTag#I think I have the commands already to pull the building name (which @mm2270 helped me figure a way to assign that based on the students "Grade" populated in our "Position" field) but I'm needing it to be a bit more robust since that would only work for middle and high, if its a Grade school it could be 1 of 4 different buildings.  All the info is in our AD and pulled from PowerSchool (and we also use One Sync/Class Link Roster Server), I just need to find a good way to pull that info with a script that grabs the building(which could be based on security groups or OU), the t

Hi all,Our Prestage Enrollment process involves deploying 6 profiles, adding 1 admin account, and installing 4 packages: branding, DEPNotify, Jamf Connect Login, and Jamf Connect Sync. As of 2021-07-09, none of the packages appear to install as part of Prestage Enrollment. Looking at /private/var/log/jamf.log, it appears policies triggered by "enrollmentComplete" do kick off, but policies triggered by "start-depnotify" (which is a command in the DEPNotify post-install script) do not. I have created a brand new Prestage Enrollment using the same packages, and it also does not work. I have removed all packages except DEPNotify, and that also does not work. Technically, the other packages do install, but only because they are also triggered by "enrollmentComplete." DEPNotify is not, as that's not the recommendation per the setup guide.In searching, it seems the most common issue was unsigned packages, but again these were working fine until 2021-07-09, so that isn't it.I did consider recr

Hello everyone,I'm having some issues with the "Restricted Software" on JAMF Pro where  I can restrict 1 word app fine with the "Restrict exact process name", but not with 2 or more words.working example:Process Name: MessagesChecked with "Restrict exact process name"and all messages (even if you copy paste app and rename, still gets blocked.)but something with 2 words doesn't.not working example:Process Name: FileZilla ProChecked with "Restrict exact process name"if I put "FileZilla Pro.app" in process name, it gets blocked but with that exact file name from applications.any ideas how to block process name that is more than 2 words?Thanks in advanced.

In my organization, we use Citrix SSO for VPN. It's available in the Apple App store for free. When users go to install it, instead of installing, Jamf Self Service opens the APPLE App Store and demands and AppleID to proceed. This isn't how it used to work, and isn't how it is supposed to work. How do I find out what went wrong? this App used to just install. but as soon as I started working here, I get told that it doesn't work anymore.