Hi all, we are currently using Jamf Connect 2.5, deploying via DEP enrollment. Our config profiles are 2.4.4. I have 3 separate profiles for connect, 4 if you count the notifications payload. One for Login, one for Menu bar and one for the license.  I would like to upgrade to 2.8. What is the best practice for doing so? I see form the Connect 2.8 admin guide there is settings to upgrade in Settings > Jamf Connect >, but I'm a little grey on this, does it upgrade the Connect installed on the machine or just the config profile versions? 

We are looking to restrict the use of all USB external storage for our users. I made a Configuration Profile with a Restriction payload that has all types of hard disk media access unchecked. On the Macs that are in the scope, the policy only works for those with standard level access, admins can still use USB drives. Is there a way to have it apply to the machine as a whole, regardless of the user level?

Unable to find an adequate script to make all Standard users Administrators.  I am new to scripting and have only been able to find a script that does it temporarily and reverts the account back to standard.This is what I have found so far.https://github.com/jamf/MakeMeAnAdmin I also need it to run without user prompting

We use JAMF Pro, and are having increased demand for parent control at home. We already run a transparent global HTTP proxy for students, but lots of parents want to control YouTube access or have other granular control with apps. I tried to enable JAMF Parent, but when scanning the QR Code within Self Service from a parent device, I get "An Error has occurred. Please contact your school IT admin". It's certainly possible this is a simple fix, we haven't used the apps in the past. We meet all the requirements set out in the guide (e.g. Account admin, valid 3rd party SSL certificate, unblocked jamfcloud traffic). Is there a setting I'm missing to enable this access?Thank you!

I'm suddenly seeing the above error on a number (most) of our lab-based iMacs running macOS Big Sur v11.6+ which are bound to AD.I noticed on the affected systems that our root certificate is no longer trusted in the System Keychain even though it has an expiry date in 2037. However setting this to be trusted again doesn't improve things. We are also seeing similar messages when attempting to launch other applications such as Chrome etc. and Adobe Creative Cloud applications no longer launch, claiming they are unable to contact the Adobe licencing servers. Users don't seem to be able to write to the Desktop either. I've tried removing the computer objects in AD and rebinding, and also removing previously created user directories in /Users and rebooting. We are about to begin a trial of Jamf Connect and come away from binding but for now the issue is disrupting our teaching, so any advice around how I might overcome these errors would be greatly appreciated!

Hey Everyone,I have probably missed it right under my nose but is there any documentation on how to call jamf helper in a script?

Hey Everybody,Quick question for you API experts, and apologies in advance.  I'm new to this.  I'd like to update a specific attribute.  I've included some sample XML that's close to what would be grabbed from a specific iPad.I'd like change "Mrs. Jane Doe" to "Mr. Jon Doe" in "SD-Full Name" of extension attributes.<?xml version="1.0" encoding="UTF-8"?> <mobile_device> <general> <id>2035</id> <display_name>School Staff iPad Mr. Jon Doe</display_name> <device_name>School Staff iPad Mr. Jon Doe</device_name> <serial_number>B28JDKL1J0CDM</serial_number> ... etc. </general> <extension_attributes> <extension_attribute> <id>2</id> <name>SD-Full Name</name> <type>String</type> <multi_value>false</multi_value> <value>Mrs. Jan

I know this is probably a long-shot... but has anyone figured out how to block Monterey from appearing in Big Sur's Software Update pane after 90 days? All of our Big Sur machines seem to have lit up this morning with the "Install Monterey" feature. We still have it restricted, but I'd hate to have someone get all excited and download it just to have it deleted...

Greetings! I recently enrolled in the Apple Developer program so I could obtain an Installer Certificate for JAMF Composer.  I was finding that more often than not, whenever I pushed a third-party app out via Self Service, it would look like it had installed, but wouldn't.  Upon checking the install.log file, it showed that the package was not signed and therefore was not installed. Obtaining the Installer Certificate has helped, but I've noticed a new issue when trying to install an app on an Intel-based MacBook Air.  The app installs fine, but when I try to open it I get the "You do not have permission to open the application..." error.  I thought installing through Self Service would prevent this since the apps are supposed to be installed as root, or SU? Anyway, I've tried this on an M1 machine with no problems.  It appears to be limited to the Intel-based laptops, regardless of what macOS version is installed.  Anyone have any ideas?&nb

Our school has 450+ MacBooks and 150+ iPads. At the moment I have one iPad that will not install the profile. The CA certificate is being installed before the profile with no errors. I'm not sure what could be stopping this one iPad from enrolling. I've followed the steps in the article below with no luck. Also, the iPad is set to the right time. https://www.jamf.com/jamf-nation/articles/192/mobile-device-enrollment-error-invalid-profile-or-invalid-certificate

Hi all, Which application format is better DMG or PKG ? Can anyone provide more details I understand to add scripts in application - PKG is best and for indexing DMG PKG installs for all users in home directory  

I'm looking for a simple way to allow members of my org's Field Support group to enable software in Self Service for any of our managed Macs without actually giving them access to our JSS. I use a Static Group as a target for each installation Policy that isn't scoped to all computers, so what I'm envisioning is a shell script that will run an AppleScript to display a popup listing the available titles, and then prompt for the serial number of the computer to be added to the appropriate Static Group using the Classic API (that's the easy part). I thought I'd seen something along these lines posted on Jamf Nation before (looking at you @dan-snelson), but darn if I can find it now. Before I re-invent the wheel I figured I'd see if it rang a bell with anyone else. Please post a reference if it does Thanks!

I've been asked to report on users who have iCloud Drive enabled. I found an older EA on the board but that doesn't seem to work on El Cap even if I amend the file path. This is what i'm using. !/bin/sh if folder exists, then iCloud Drive is enabled iCloudDriveFolder="~/Library/Mobile Documents/com~apple~CloudDocs" if [ -e "${iCloudDriveFolder}" ]; then echo "<result>Enabled</result>"else echo "<result>Disabled</result>"fi Seems to be that the ~/Library/Mobile Documents/com~apple~CloudDocs isn't recognised using the above. I can cd to the folder and terminal sees it as a directory. Now am i missing something or is it something else? Thanks Al

Hey Everybody,I'm having some trouble with my scripting.  I'm attempting to view an iPad's extension attributes, and then update them if needed, but my cURL request always come back with the same error: "The request requires user authentication" -- which I'm using.  Works for everything else, but not for extension attributes.  Maybe my code is wrong?  Here's what I have:curl -X GET -H "accept: application/xml" -H "authorization: Basic ${jssAuth}" "${jssURL}/JSSResource/mobiledeviceextensionattributes/id/$deviceID"  Thanks,-Rob

Hey all,I've been seeing an issue where my Zoom for IT client opens the sso page in Safari when zoom is first opened on a new users device.  My plist for zoom settings seems to be set correctly to use the embedded browser in the client but it continues to open a browser window when trying to login to SSO in zoom.  This only started a few months ago from what I can tell, or perhaps it is only since we started updating to 11.4.   I've since tried edited all the setting in the plist, however it still keeps opening a web browser when the user attempts to  first login to SSO.Anyone else seeing this or have a work around?

In JAMF school how can I configure the control center for my managed iPads?

We have a lab full of Macs, and I'm going to start managing them with Jamf. I put them in a prestage which works fine. But I'd like to skip the create computer account screen all together. I am already setting up a local admin account, so I don't need to create another account on each machine. Is there a way to do this?

What is the best way to make a .dmg of Office 2011 with only certain apps installed (Word, powerpoint, excel etc) and not all that other garbage that comes with it, basically I can pick/choose what applications will be installed, then create the .dmg I am saying .dmg because I also want to have it be uninstalled via policy, so my understanding is to create a .dmg and index it ?? what about FTU/FEU ?

Hey Everyone,Not sure what version this happened on, but we thought to do a test on new enrollments and since 2.4.5 on the part where a user logs into azure and then asks to enter their network password. We get an "Invalid Request". We we're on 2.2.2 before this. Some have suggested to change this to true."Create a Separate Local PasswordIf set to true, this key prompts users to create a new password for their new local account. If set to false, this key prompts users to re-enter their network password, which also becomes the local account password. This ensures a user's network and local password are synced during user creation." We don't want to do this as it creates confusion when it's time to reset the password back to Azure. Unless something changed, Jamf connect cannot write back directly to Azure. We've been needing to go through the SPR.

The prefix is showing up on the device, but it's not pulling down the serial. I've even tried a few commands I've seen on these forums, and it still won't grab the serial. I am learning scripting, and only know basic commands. I took over for the previous sys admin who left, and he could never get the script to work either. MODEL=$(sysctl hw.model)if [[ $MODEL == *"Book"* ]]thenPREFIX="TRML-"elsePREFIX="TRM-"fiSERIAL=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformSerialNumber/{print $7}')COMPUTERNAME="${PREFIX}${SERIAL}"/usr/sbin/scutil --set ComputerName $COMPUTERNAME/usr/sbin/scutil --set LocalHostName $COMPUTERNAME/usr/sbin/scutil --set HostName $COMPUTERNAME  

We need to use API to identify if a computer is a member of one of five existing Static Computer Groups (StCG), on the client side, using an API script. The value is used locally to feed other non-JSS related workflows. The StCG names would look like these: MyGroup_01 MyGroup_02 MyGroup_03 MyGroup_04 MyGroup_05 We typically use UUID to find the computer, and this API call seems to work: staticComputerGroup=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers/udid/${uuid} | /usr/bin/xpath '/computer/groups_accounts/computer_group_memberships[1]' 2>/dev/null | /usr/bin/sed -e 's/<group>//g;s/</group>/++/g' | /usr/bin/tr '++' ' ' | /usr/bin/sed '/^$/d' | /usr/bin/grep MyGroup ) After wrestling with this for a couple hours, I wonder if the above is as convoluted as it seems. I created a few other API scripts that were easier and less of an eye sore: assignedUser=$( /usr/bin/curl -s -k -u ${apiUser}:${apiPass} ${jssURL}/JSSResource/computers

I downloaded the macOS installer via Apple's App Store. I tried to install using a policy but the policy-- following the white page found here: https://docs.jamf.com/technical-papers/jamf-pro/deploying-macos-upgrades/9.96/Packaging_and_Deploying_the_macOS_Installer.html . That has just failed each time I tried to install via policy.So today, I packaged the installer via composer. Put the pkg into my JAMF distribution point via Admin. Changed the definition of 12.1.0 to the pkg. When trying to upgrade via Self-Service to test the patch I get Error: Package was not successfully downloaded. 400 on my test machine.  I have read so many other forums here on JAMF Nation about different ways people are installing the upgrade. Brain is kind of soup from all of them. Assistance in installing the latest MacOS would be appreciated. I need to push it to a fleet of 300 + Macs. 

I am running a script that will ask the end user to enter the machine name. It will not work through Casper (remotely or in a policy) but will work fine if I run it locally. Any ideas why it may not be running? I have included the script below. !/bin/bash ComputerName=`/usr/bin/osascript <<EOTtell application "System Events" activate set ComputerName to text returned of (display dialog "Please Input New Computer Name" default answer "" with icon 2)end tellEOT` Set New Computer Name echo $ComputerNamescutil --set HostName $ComputerNamescutil --set LocalHostName $ComputerNamescutil --set ComputerName $ComputerName echo Rename Successful exit Very odd the script runs fine when ran locally through the terminal. But stalls and never runs and never errors out when ran through a policy or through remote. Thank you.

Hi folks, with Python deprecated and throwing scary warnings to users when it's invoked by Jamf, we're looking to replace our trusty logged-in-user detection command that we use in scripts.  Self Service scripts work reliably with $3, but what method are you all using to detect the logged-in user for other scripts?  What works reliably every time, and doesn't pick up _mbsetupuser or similar accounts? Thanks in advance for any suggestions!

Hello,Seems that Jamfnation pages now interpret code in messages incorrectly as described in this page.https://community.jamf.com/t5/jamf-pro/best-way-to-demote-user-from-local-admin-to-standard-on/td-p/154332 The page converts code into emojis.This should be turned off for text entered as code.Is this possible that this happened after the forum conversion? As an example if I type the following two characters : / together I see this: 😕😕Even in code:: / :/ Perhaps it needs to be change how it's interpreted from HTML to something else...