I've tried any and every manner of method to unlock the System Preference for the 3rd party pane of Wacom Pro tablets. It's ranged from variations on this: #!/bin/sh security authorizationdb write system.preferences allow security authorizationdb write com.wacom.settingsPrefPane allow exit or #!/bin/sh security authorizationdb write system.preferences allow security authorizationdb write /Library/PreferencePanes/WacomTablet.prefPane allow exit to something like this: ``` !/bin/sh security authorizationdb write system.preferences allowsecurity authorizationdb write /Library/PreferencePanes/WacomTablet.prefPane/Contents/MacOS/WacomTablet allow exit to pushing the MCX unlock of either: ``` <key>allow</key> <string>com.wacom.settingsPrefPane</string> or <key>true</key> <string>com.wacom.settings.PrefPane</string> Tried both as computer and user level enforced. At this point, I'm scratching my head and wondered

Since we are not moving to Big Sur anytime soon, I wanted to keep pushing the older version of Garageband 10.3.5. Trying to find a way to push this with VPP instead of the newest version but not having much success. Since the release of 10.4.1 VPP wants to push that to all the computers to upgrade them but its not compatible. Wondering if I can just change the version number and turn off auto updates. Gabe ShackneyPrinceton Public Schools

Hello I am setting up our Jamf environment for managing phones but I noticed that it does not pass user info to JAMF after its assigned. Is there anyway to have Jamf ask for credentials or recon some sort of credentials to Jamf? we use OneLogin with jamf Connect on our laptops Thanks!

Are there any sites or tools out there that help email users about macOS updates, including security updates? I don't recall getting any notifications from Apple in their Newsletters (Announcements specifically) regarding security patches or other updates from their 1st party tools like Xcode or Xcode command line tools. Thanks!

Hello,can I set the permission to use Camera here? At the moment, when I activate the mode, and then try to activate the permission via app, the error message comes

I am trying to check if a user is signed into Box on their machine but the script doesn't seem to be accessing the correct directory. Here is what I haveI believe the script isn't detecting the users account correctly like the $USER variable would if it was run locally. so my question is: Is there a way to have the script detect the current logged in user so it can access the users account directory?  

We are using Jamf School to manage our student iPads. We currently have a profile in place that forces students to have a passcode. At the end of the school year, we have students turn their iPads for safekeeping. At the start of the next school year, we return the same iPad to the student. The problem we experienced this past year was that some kids forgot their passcodes. Devices were no longer connected to our wifi (their batteries depleted) so we were forced to wipe them manually by connecting them to a computer which took too much time.What is your practice for storing devices over the summer months? How can I eliminate this problem in the future? 

Seeing an error running Recon on two Monterey laptops - "A connection error occurred: SSH failed to create session with host 127.0.0.1 (Error retrieving last session error due to absence of an active session.). Both computers are M1, one is M1 Macbook Air (macOS 12.0.1) and the other is M1Pro Macbook Pro (macOS 12.1).  Other M1 laptops (on Big Sur) are not having issues with Recon.  JSS is cloud hosted, version 10.35.Double checked that the management account and password are correctI am able to SSH in to the machines from another MacSudo jamf recon workssudo jamf manage completes with no issuesAny thoughts on where to look next?

Hi We push our software updates through self service for a few days before installing automatically on user's machines. We are trying to set it up so that the end users get a notification (either push notification or on the self service icon itself) but are running into issues. We don't get any notifications from self service unless self service is open; and even then it's not a push notification but an indicator on the app icon. We have our push certificates up to date and we have a configuration profile that allows for Jamf notifications. Are we missing anything else here?  

Hi- I'm trying to use AD for my users and group logins to the JSS. My user mappings seem to be correct. I can test users, I can add a user from AD, give it JSS permissions and my AD user and PW work nicely. My User Group mappings seem to be correct, as my test shows the groups in my AD environment. When I add one of these groups to the JSS and give it permission, I cannot login as one of the users in the group. after speaking to support they asked if my "User Group Membership mappings" saw that my user was in that AD group. The result is NO. I've tried different combinations and have not had any success. Any suggestions?we are on 9.32 ThanksDan

For the past week we've seen an increased frequency of "Could not mount distribution point" errors in our Jamf Pro policy log notifications.We tried reaching out to Jamf support but this was unsuccessful as they are in the middle of migrating support to a new platform and no human response is available for my query at this time.Can anyone suggest where we might find more details about why the distribution point could not be mounted? The policy log on the Jamf Pro web interface does not have any further detail.Our Jamf Pro instance is version 10.35.0, on-premise. Our client Macs are on macOS 10.15.7 Catalina. Our distribution point is an SMB share on a Windows Server, we checked it was still shared and that the file and folder permissions were still set correctly. We checked that the service accounts used to read and write the distribution point are still correct and not expired or disabled. The computers raising the error are not off-site (they are mostly fixed desktop iMacs).

Our JAMF Pro server is on version 10.25 and I am starting the process of doing an upgrade. It currently has Java 8 and Amazon Corretto 11.0.9.12. Am I correct in assuming since it has AC 11.0.9.12 that the Java version is 11 as well and the older version of Java will have no effect on the current environment?

Hi We have just started using Reftab asset Management software, to manage loans of equipment. It has settings for integrating with JAMF. I can get it to connect to our JAMF server, but when we try to sync there is an error that JAMF is not set up correctly.Has anyone used this software? And have you got it to sync devices from JAMF to Reftab? Any help will be appreciated.Cheers

I'm trying to update the hot corners using a script pushed as policy from JSS. The script runs as the management user and doesnot set the hot corners for the user. When I run the script on the mac as user, it seems to work. Here is part of the snippet. The su currentuser prompts for a password. Is there a way to run the snippet below without a password prompt !/bin/bash currentuser=/bin/ls -la /dev/console | /usr/bin/cut -d " " -f 4su "$currentuser" -c 'defaults read /Users/$currentuser/Library/Preferences/com.apple.dock | grep corner'

We are looking into implementing Nomad Login. I used ProfileCreator to create the Configuration Profile. Applying the configuration profile manually works. However, the issue is when I try to deploy the configuration profile from Jamf. When I created the CongifurationProfile I used the "Upload" option. I am using menu.nomad.login.ad ad the "Preference Domain". However, when I upload the file nothing happens. I then started signing the mobileconfig file, and I get an error message: "XML format is incorrect..."Same thing happens if I use the "Custom Schema" option. "JSON format is incorrect..."Any suggestions?

Hi, We're trying to get all computers in our jamf pro instance using the classic API, but it seems like the "/JSSResource/computers" endpoint does not return computers that are in pre-stage enrollment. Can someone please confirm if this is intended functionality, and if so, what is the solution. Thanks! 

For multiple reasons (mostly legal) we do not want users erasing data from their machines. I've looked but don't see anything obvious in Configuration Profiles in Jamf 10.32 so I'm guessing at best there might be a custom MDM config.

Hello all I was just wondering if anyone has the difference in the two pkg's we are primarily an M1 shop and I just noticed that we are currently deploying ZoomforIT. I was looking to update it and used the m1 pkg (not IT one) and ran into an error when trying to update. Id like to use the regular pkg as that seems to update with pkg pretty seamlessly. 

Preface: this is currently affecting a test JSS environment and is not in production. Our test JSS environment has LDAP integration configured and the service account that is in use had its password recently reset by another party. As of the password reset, I am no longer able to log into the test JSS using any domain accounts. To make matters worse, I do not have the passwords to the two local JSS accounts. What I do have access to is the host machine where this JSS resides. This is hosted on a virtualized Windows Server 2012 R2 server. Pretty bad stuff, huh? Plot twist: I also do not have the password for the SQL database password. I was able to find this JAMF article found here but again, those default credentials did not work. Any ideas, thoughts or prayers?

Hi everyone!I was wondering if someone knows of a tool or repository where we can find configuration profiles that match the CIS Benchmarks for macOS. At my organization we have JAMF protect and we can see compliant/non compliant devices in regards to the CIS benchmark (But no "remediate" option! So I would like to correct those non compliant devices via config. profiles).

We are looking for a way to Restrict Third-Party Preference Panes created by Backblaze. Any suggestions?I found a way to hide it but we want to restrict it so it cannot be accessed. We use restriction payload to restrict the inbuilt Preference Panes but not finding a way to do this. Thanks.

Hello Guys,As title ,We encounter this question very similar to this post https://community.jamf.com/t5/jamf-pro/xcode-running-as-a-non-admin/m-p/211456Cus we have to remove admin right form users, so we're using script to solve most issues on Xcode like license agree ,add users to _developers and something like that.But when we want to download iOS simulators ,it prompt out a window "Xcode is trying to install apple software"and ask for admin password.We've tried the solution mentioned in that post, but encounter a error when extracting the payload of the .pkg .Is there any method that we can solved this by script or other way?Thank you guys for reading and answering this post.*We're testing with Xcode12 on MacOS 10.15

Is there a way to get the user's data that is in Jamf Pro system from Terminal?I have a script that writes into the System.log and has the host name but they also want the user's name (which I have) and Dept. (which I need) and possible other fields

I have a macOS Big Sur upgrade script that has worked perfectly in my testing on dummy machines but when I have it pushed via policy, everything works, except for the part after they click upgrade. It's as if the script just halts and exits. However, when I run it through self-service as that same user on their machine, it works normally and begins the upgrade! Any ideas on why they are different? Apologies for the caveman scriptBelow is my script; after the user accepts the upgrade, is when it stops (line 77 or ## Upgrade Here ##):#!/bin/bash if ! [[ $(sw_vers | grep ProductVersion | awk -F ":" '{print $2}' | awk '{$1=$1};1' | awk -F "." '{print $1}') == 11 ]] then if [ -e "/Users/Shared/deferrals_MacOSUpgrade.txt" ] then deferralsleft=$(cat /Users/Shared/deferrals_MacOSUpgrade.txt) else echo 3 > /Users/Shared/deferrals_MacOSUpgrade.txt deferralsleft=$(cat /Users/Shared/deferrals_MacOSUpgrade.txt) fi if [[ $(sudo find /Users -name "In

I was wondering what people thought about the current state of Jamf - Intune Co-existence, having the device managed by Jamf but sending inventory info and compliance for CA to Intune?  Our grand plan is to have the M365 suite accessible off VPN by utilizing CA and compliance with Intune, has anyone else really explored all the features of this pairing and what are your thoughts?  Thanks!