First a warm "hello" to the community ;)I hope, someone can help me, to find a solution for my question:On Windows® environment, it is possible to set up, that only signed Office macros (for example Word®,Excel®) are allowed to run. Unsigned macros can be denied for running by setting up a Group Policy.We also use Microsoft Office® 4 Mac and now, I am looking for a way, to prevent our users from running unsigned Office macros.I did a search here and found a couple of contributions about Office macros (for example, how to disable all office macros) , but no one, wich handled exact this case.Is there a possibility, to set up, that only signed Office macros are allowed, and if, how could I set this up?I would be glad, if someone could help me here.Thank you very much for reading my question and thanks a lot more for answering :)Greetings, NOVELLUS

Hi all,I've been handed a LONG list of Usernames, and I need to make a list of any computer serial numbers associated with those Usernames.I'm assuming this is a custom API call, does anybody have anything cooked up and ready to go?Thanks!

We have an employee that left our org, and the user was issued the laptop permanently for their personal use. Best way to accomplish them not being managed anymore would be to give them instructions for "jamf removeframework" and then delete the device from our JSS I am thinking. Any other recommendations or something I'm missing? The user is across the country now so I'll have to give them detail on how to do this themselves. Any pkgs around that would automate this so I don't have to have them using Terminal? Thanks, Tom

I am trying to get a configuration profile built to manage com.cisco.webexmeetings.config.plist so we can define our Organization ID. If I manually create the plist everything works fine, but when I try to use a custom settings configuration profile it is not taking. I am figuring I am just missing something dumb. the JSON works fine.  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OrganizationID</key> <string>super secret information</string> </dict> </plist>   Shoved this in to a configuration profile and its not working.Anyone have any ideas? 

Hey everyone! I have a bit of a non standard request...Basically I would like to limit my own personal mac computer and I am seeking have admin privileges whilst preventing my self from changing user settings (adding/editing/deleting accounts) or altering network settings. Ie I would like an admin account with the network preferences and user pane disabled in system preferences - or some variant of this where I can access these settings but can't modify them etc. Currently I'm getting around this by using blocking software to block all of system preferences and modifying the settings as needed using passwords given to family members but I'm sure you can see that this is super frustrating at times! Is this possible with any Jamf products? I found it a bit overwhelming scrolling through all of the offerings and as such I'm asking here. I'm more than happy to pay for the product I'd just like to know which one if any would best suit my needs. Please let me know any other po

Hi,in our environment all of the devices stopped checking in into Jamf. What did we do since the last check-in?There were three issues, which we think we have fixed: Resolved The .. @... service token expired 23 days ago.Resolved The ASM token of '...@...' expired 23 days agoResolved The APNs certificate of 'appleCert@...' expired 23 days ago. How do we get the devices back into Jamf without reinstalling/resetting the devices? Any hints?

I just turned on Patch management for these apps yesterday. I google searched this error but didn't get far. Anyone know what this is about? 

I couldn't find any extension attribute in the templates or in any forum for showing the local timezone of a computer in jamf, so I wrote my own. It's just a simple script to pull the info from the localtime file, and cut off the first part that is always the same, then return the result to the jss. example: TimeZone:/America/New_York Script:#!/bin/bash # Extension attribute to return current TZ localtime=`/bin/ls -n /etc/localtime` TimeZone=${localtime:79} echo "<result>$TimeZone</result>" exit 0 Here's the full .XML file for importing to jamf directly:<?xml version="1.0" encoding="UTF-8"?><extensionAttribute> <displayName>TimeZone</displayName> <description>gets time zone</description> <dataType>string</dataType> <scriptContentsMac>#!/bin/bash
 
 # Extension attribute to return current TZ
 
 localtime=`/bin/ls -n /etc/localtime`
 
 TimeZone=${loca

Hello, I've been asked to change our JSS URL without migrating our server. Is this possible? Current: jss.crop.domain.com Outcome needed jss.domain.com What I was thinking: Add a DNS entry = jss.domain.com Create a policy changing the URL on the clients: defaults write /Library/Preferences/com.jamfsoftware.jamf.plist jss_url https://new.jss.url:8443 3.Change the URL in the JSS settings and change Tomcat certificate. If anyone has done this before, would this work? In my mind, it seems like it would. Thank you.

I have a question regarding the "Enrollment Only" Privilege Set in Jamf Pro User Accounts & Groups, and I'll try as be as clear as possible. Can anyone clarify if all users who are invited to enroll in Jamf (i.e. by email invitation or via the enrollment web console) need to first be added in Jamf with Enrollment Only privileges?I know this isn't needed for Macs setup via Prestage enrollment, but in order for us to be able to assign a (LDAP) user to a device during User Initiated Enrollment, we first have to add them to the user group in Jamf Pro with the Enrollment Only privilege set. Otherwise we don't get the 'Assign to User' option when they go through the User Initiated Enrollment Process.I know we can edit the user information post-enrollment (via the Jamf Pro interface), so I'm not sure if it is necessary to even use this 'Assign to User' step? Can anyone explain why either way is better? Thanks!

Hi all,I'm really just posting this to document the long journey that I've had to creating a new enrollment workflow for our district.GoalTo have one universal enrollment for new Mac's that auto name themselves based on the user logging in, with the least amount of signing in as possible.Requirements1.  A Jamf Infrastructure Manager (JIM)2.  Microsoft Azure/Active Directory3.  Jamf Connect (Installed in Prestage Enrollment as well as config profiles)4.  PPPC Utility and TCC profiles covering Jamf (and jamfDaemon), osascript, including all system events and accessibility also installed with prestage enrollment5.  Configuration Profile for Microsoft SSO extension that includes apples setup assistant also installed with prestage enrollment6.  Microsoft Company Portal App (in Prestage Enrollment)7.  Managed Apple ID's that are federated to Microsoft loginsStepsPrestage Enrollment:After much testing our prestage enrollment includes all the installers for a

Hi guys, I have certain polices that need to be added after the prestage enrollment on certain machines.We have couple of MacMini used for marketing purposes and we have about 3 policies that are only meant for these machines. What is the best way to attach these policies so that once they are scoped in prestage, it also gets scoped on the policies. My though was using a smart group and having it linked via serial numbers but not sure if that's the best or efficient method. 

Hi, I want to remove the current login user as admin and I tried this command and it seems not to working. #!/bin/bash/usr/sbin/dseditgroup -o edit -d "$currentUser" -t user admin is anyone can help me with this?Thank you

Hi all, I've noticed an issue recurring in a number of our managed Jamf Pro instances and just wanted to see if anyone has had similar experiences.A Jamf Pro tenant will have 32bit apps configured and scoped to a number of iOS devices. These apps are EOL as they can only be installed on iPads running 32bit architecture which as a company we do not manage unless absolutely necessary.I've found with a lot of these apps, once the app is removed from the app store, that app simply disappears from Jamf Pro and is unable to be managed. I haven't been able to 100% prove if these apps have been manually removed by another administrator or the apps are removed from Jamf as soon as the app is removed from the App Store. Although the app is no longer in Jamf Pro, the app will stay installed on all devices it was scoped to. Due to the fact I can no longer remove devices/buildings/departments etc from the scope of the app, these legacy apps will then appear in the "Other" list as "Managed

Hi all-Been awhile since I've been round these parts. Trying to work out a scenario for a customer and I'm having a heck of a time getting a VM properly enrolled into Jamf Pro. I thought I was doing all the magic things needed, but perhaps missed something. Host platform: Intel (16" MacBook Pro i9)Hypervisor: VMware Fusion Pro 12.2.3Network: BridgedGuest OS: macOS Monterey 12.3.1in the VM's vmx file I have:hw.model = MacBookPro16,1smbios.use12CharSerialNumber = "TRUE"serialNumber = C02CF0CVMD9R (very close to my actual serial number. The 9 at the end is a different digit on the actual hardware)I thought those in the vmx file would allow MDM to function properly but when I do a user-initiated enrollment I get the CA profile, the MDM profile and that's it. In the computer's inventory I get "MDM Capability:No"I feel like I must be missing something dumb as a result of being out of this game for awhile. Thanks!

I can't seem to find documentation, or I'm just not using the right search criteria. I just added a few extension attributes for our devices and was hoping to be able to pull a report of all the results. Is it possible to export a list of each device and the results of their extension attributes?

So it was decided at our school to do Drive for desktop as everyone's backup solution. However once everyone installed it, our Wifi performance crashed because Drive was taking up all of our bandwidth. After speaking with our Google agent, they suggested running the following commands in terminal in order to throttle the amount of bandwidth Drive for Desktop uses.defaults write com.google.drivefs.settings BandwidthRxKBPS 100 defaults write com.google.drivefs.settings BandwidthTxKBPS 100. I have confirmed that the commands work when entered in terminal, but I can't get the policy to execute properly on the scoped machine. here is my script: #!/bin/bashdefaults write com.google.drivefs.settings BandwidthRxKBPS 100defaults write com.google.drivefs.settings BandwidthTxKBPS 100exit 0 it runs on the machine, but nothing changes or happens with the preference file, and jamf shows no details about why the script didn't execute when I look at the policy logs. I should m

I'm attempting to install Covalence from Field effect that is a cyber threat monitoring. I'm trying to install the agent and push the licence from Jamf. I'm following the article they gave us (See "Deploying the Endpoint Agent via Jamf" below). So I push the three configuration profile like they suggest, copy the information from the licence XML file in the Configuration profile like they suggest.When my test MacBook have receive the configuration profile and can confirm they are there, I push the agent. The installation is completed, but the agent won't take the licence.I've already created a ticket with Jamf and Field Effect, but I take a chance with the Jamf Nation community Deploying the Endpoint Agent via JamfWhen deploying the Covalence package file (.pkg), the license needs to be distributed prior to installing the Covalence agent using a device configuration profile.  Additionally, you’ll need two other MDM configuration profiles: one for explicitly allowing

Hi,I have a script that prompt users to register their Macs to Intune. I would like to run the policy every 60 minutes. What's the best way to get this done ?Thanks!

I modified an existing script (credit to Richard Purves) that runs successfully to change the computer name to the barcode using the Pro API on Monterey machines.  My same script does not seem to work on Big Sur machines.  I use the API to pull the barcode and then use that barcode to rename the computer.  I initially thought it was because I was using the #!/bin/zsh shell, but I have switched it back to #!/bin/bash.  Same error.The error I get from the logs is as follows:"Script result: execution error: Error: SyntaxError: JSON Parse error: Unterminated string (-2700)"Clearly has something to do with the JSON Parse, but this is my first Pro API script so I have very little experience here.Copy of my script:#!/bin/bash# POC script for Jamf Pro API# Variables first# API user accounts here. One for reading, one for writing back. Security.# Generate API base64 credentials by using:apib64="xxxxxxxxxxxxxxxxxxxxxxx"PREFIX="UH"SUFFIX="UOC"# Current JSS addressjss

I am trying to get "one-button reinstall" working on a student laptop, and I am following this guide here: https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/ However, at one point it says: "When it finishes, upload the InstallAssistant pacakge directly to Jamf Pro and deploy to your Macs using a policy. It’s OK to rename the package file before uploading.",  but I have no idea where in Jamf to do that.I tried using the Packages widget within settings but even when I add a name and upload the package there, click save, it doesn't show up in the list.Any advice on this?

So I'm finally getting around to working with iPad wallpaper features and love that you can do this en masse with the remote commands for a group of iPads, however I cannot seem to get the wallpaper to show properly on the screen. Been playing around with resolution sizes and using ipad Air's right now. I've just tried 1024 x 1024 and its cutting the image off. I saw something about forced perspective, so should I try shrinking it to 768x768? Just curious if anyone has some tips. Gabe ShackneyPrinceton Public Schools

Trying to run this as the user but im losing my mind: osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/Desktop Pictures/Solar Gradients.heic I just want to wrap that in a shell and have it use the logged in user to run it. I know I've done this before...but I can't seem to do it right now. Ive been playing with profiles managing the desktop pic, however this seems to lock it and won't let the user change it which Im not fond of.Any other solutions would be wonderful if anyone has any.Gabe ShackneyPrinceton Public Schools

Anyone seeing Composer v10.36.1 crashing when attempting to create a DMG on a M1 Mac? I've tried running as native app and through Rosetta and getting the same result.I redownloaded 10.35 and that version is working fine.

Jamf Newbie here - we've deployed Jamf on our fleet of about 2.6K machines, for creating the Local IT Admin account we used a policy in the Jamf GUI that simply ran/runs during enrollment and check-ins to create this account, nothing else was configured and accounts were created ok.Problem we are having is that users are complaning because of this second account showing on their computer, is there a way to hide it completely and still be able to access it for IT?If so, is there an easy way to do it? considering almost 95% of all these machines already have this admin account created? Thank you.