Hello!I'm looking for a way to check when a device has moved from one smart group to another. In this case I am using an integer Extension Attribute to track a devices vulnerability compliance. If a device reports that a specific file is >0 it is put in a group that says there is a vulnerability. Once that EA drops to 0, that device is good. Is there a way to check which devices HAD an EA >0 but are now at 0 so I can track that the vulns are being remediated?Thank you!

Hi,Devices enrolled via ABM do not appear in Search inventory in Jamf Pro,But the device is available under scope in Pre-stage Enrollment Tab Is this how it works ? ADE enrolled devices wont appear in Search inventory?

Scenario:When Mac laptops are imaged and joined to the domain in our corporate environment the desktop support teams have the option of giving the domain user local admin rights on their Mac device. Unfortunately, more often than not, they do so. The Mac image comes with a generic local admin account that all devices have and needs to be kept in place. These rights need to be preserved. New policy has come from the top, all local admin rights for domain users are to be removed from all domain devices. I have been recently given the role of Casper Admin with zero experience in Casper or OSX after an engineer left. Questions:How do we remove these rights from each device centrally through Casper JSS? Is there a way to do so? If this has to be some sort of script, what exactly should it be and how would it be distributed to devices as they come online and continue to check the devices to ensure that there are no new local rights given? Any help is definitely appreciated and certainl

if someone can briefly explain to me the purpose of the 'Management Account' when creating a QuickAdd package and Configuration ? (We already create a local Admin on each mac prior to any enrollment in casper system) when creating your QuickAdd packages and/or Configuration, what are some of you choosing from the options below?Hide it or NOT hide itAllow SSH for management account only

Here what I am seeing, Version Anyconnect 4.10.03104 with Compliance Module 4.3.2161.4343 giving me a DNS Error "The VPN client agent's DNS component experienced an unexpected error.  The VPN connection has been disconnected.  Please restart your computer or device, then try again." Now this versions supports Catalina 15.7 no problem but also notice Socket Filtering is greyed out. When I upgrade the Catalina 15.7 to Monterey 12.1 I get the DNS trying to connect. I also needed to allow Socket Filtering. Not sure if anyone been running to a similar issue? 

Now I got a setup that works like expected. User boots his empty MacBook and Jamf installs all the applications and settings. After a while the Mac asks to log in. But in the background it’s still downloading and preparing stuff.So I would like to show  a Work in Progress screen to the user and prevent him to shut down or do anything with his computer until everything is ready.Any ideas how to do that?

At the company I work for, I.T. sets up all laptops for incoming employees and I'm trying to figure out how to automate as much of the computer setup as possible. One of the snags I'm running in to is that FileVault 2, when set up from the command line via sudo fdesetup enable doesn't provide an obvious way to escrow the recovery key to JAMF like it does when you do FileVault 2 setup manually through System Preferences (see image). Anyone know how to do this? All the computers this applies to are 10.13 or higher. Thanks in advance! .

Hello,I was wondering if anyone out there has run into an issue where they are working with networking issues on iPads and want to make/ push policy changes but the device is unable to connect to the wifi to get the new update?Is there a way to set a secondary wireless network to auto connect should the primary be unreachable?I was thinking this could be a "troubleshooting only" network that would be turned on when the main goes down. What are you doing in your environment to have:1) iPads auto connect to the wifi2) Prevent the wifi menu from being enabled so employees cannot switch to other networks3) In the event you need to reach devices that have gone offline I am trying to eliminate putting all of my eggs in one basket and touching 300 iPads at 10 locations.Any insight is greatly appreciated,Greg

Hello,The organization that I work for maps local samba shares to macs at login when on campus. We use the following script (which has worked flawlessly for years). Unfortunately when running from login hook, the username field now fills with "root" everytime, and the user has to re-input their username to map to the drive. Any ideas on how to fix this? username="$3" if [ -z "$username" ]; then # Checks if the variable is empty (user running script from Self Service) username="$USER" fi echo "User: $username" # Mount the drive mount_script=`/usr/bin/osascript > /dev/null << EOT delay 10 tell application "Finder" mount volume "smb://[SERVERIP]/[Drive]/$username/Documents" end tell EOT` exit 0 

We have an on-prem installation of Jamf Pro (latest version) and would like to deploy JAMF teacher. We've done this, but we've found that the teacher actions, such as setting an app lock for a specific app, only works intermittently (some devices can, others can't), regardless of which network the devices are on. However, control of devices always work, meaning that when a command has been sent by the teacher, the student always receives them and they work as expected there.I've been looking in the documentation to see what the network requirements are. The details are sparse, but the key phrase here seems to be "(On-premise only) Allow secure inbound connections from "student-api.services.jamfcloud.com". Does that translate to that whatever IP is behind "student-api.services.jamfcloud.com" needs to connect via HTTPS (TCP 443) to the tomcat server that we host on-prem? Or is there any other interpretation that can be derived from this? Any hints on what's going on here?How does the Jam

Hey everyone Hoping someone can help - I am in the middle of deploying MS Defender ATP and for this configuration policy, the Content Filter tab is nowhere to be found in my JAMF Pro! - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-9-configure-network-extensionI'm on version 10.25.2-t1605115216 - I know it is not the latest, but does anyone have know of a legacy method to perform this step if this specific to newer versions?

Every few months, I spend some time cleaning out old installer packages from my Jamf Pro servers. I launch Jamf Admin and start deleting the old packages while also making sure that the installer policies and patch policies are using the latest installer packages. This can be very time consuming. I'm wondering if anyone has a better way of doing this. 

I've noticed lately that ASM is not syncing with JSS intermittently, it will come up with the error: Sync failed. Awaiting next sync. I've already placed public token in ASM and have uploaded the ASM token to JSS. No changes have been made to our firewall or filtering system. We are on version 10.17.1 Is there anything I'm overlooking?

Have had multiple instances of users failing to give SS enough time to download and install apps, whether they be from a direct download package or VPP. It seems that the progress indicator is not tied to the actual progress of the installation, so in most cases it will say "Done" even when it's not. They click multiple times, see an error, and then send us a ticket that it's "not working". I've considered some sort of pop-up that tells them to be patient and even monitor the app icon in the Applications folder, wondering if anyone has any sort of method they're using that might be more precise. Like a pop-up when it starts and another when it's actually complete. I realize this might not be possible within a VPP-based profile, maybe that's reason enough to go the direct download path via script...

Hey Everyone,Pardon my ignorance, I'm trying to figure out how to install OS updates efficiently. Currently, I'm running the Software Updates Policy which installs the security updates just fine, but does not install the OS updates IE) Big Sur 11.5 on a machine running 11.4. I did come across another method to do this which is to run a second policy with the file and processes payload to run the software update tool, Softwareupdate -i -a, but I am trying to avoid situations where no warning or notification is given and a user restarts there machine and they have to wait 30 minutes for the upgrade to complete. Is there a way to obtain a dmg or pkg of these minor OS updates which I can send out or is there a better way of doing this? I've tried searching the forums for any more clues but haven't had any luck there or I'm searching for the wrong thing. Any help would be appreciated, i'm still learning. Thank You

on our devices (10.10.x) we have two local accounts, one "ITadmin" and one "enduser" (also admin level).We want to set a password policy that only applies to the enduser account as we need to keep the ITadmin accounts the same. I've tried creating a configuration profile that is set to be user level with only a password payload configured but it doesn't show as applicable to the scoped devices. If I change to computer level it deploys just fine, but is applied to all the accounts.I've tried using pwpolicy but I can't get the xml file to be in a readable format to be applied.there is very little help that I can find on how to make a working xml file for this, the man page is very dodgy to say the least and none of the few examples I can find seem to work.I don't really want to go down the line of using the deprecated command set as I want them to work on 10.11. Has anyone got a clear example of a working xml file to feed into pwpolicy?

Hi all,I'm new to Jamf Pro and am struggling to find out how I can exclude a machine before it's enrolled with Jamf.   We apply a few profiles and run a few policies on enrollment but I need to replace a few of them with the profiles/policies I am testing.  I have an unenrolled VM with a known hostname and serial number.  Is there any way to accomplish this? Thank you,-Doris

So I have a policy that runs  /usr/local/bin/RemoteUpdateManager once a week. I've noticed lately that not all apps are updating to the latest with this method but most are. So I ran it manually on a computer I know wasn't fully updated. The output said no available updates, you are fully updated. But I know that it's not, comparing it to Patch Management. What's weirder is that when I log into the machine and open Adobe CC Desktop app, it says it's up to date with an out of date version number. Has anyone else seen something like this or have a working process of keeping you Adobe CC products up-to-date? 

Has anyone managed to apply the following setting from the terminal? System Prefs > Notifications > Do Not Disturb > Check When the display is sleeping

HI,I'm a newbie here @ Jamf Pro. I need to deploy few .APP apps (like FileZilla). I've made a PKG via Composer 10.34.0, but It's failed during the installation. Can you provide me with some tips? Or Link if you have? I've tried to google documentation, but no luck with my case.B/RAlex

Hey everyone - total beginner here with very little scripting knowledge. I am currently in the middle of trying to remove Symantec from all our macs and have the script file to do it, however I need to install this file to a specific location on each mac and then run it. How would I do this? I tried to use composer and create a before and after image and then make that into a pkg but it didn't work and it did not add the file to my test machine in the location I wanted. I know there is a simple way to do it but cannot find a step by step guide online

Good morning all. I'm having issues getting JAMF to initialize after an update to 10.34.1 from 10.29. The update installs no problem, but it gets hung up on Initializing Change Management when attempting to complete.I tried a solution found here: https://community.jamf.com/t5/jamf-pro/jamf-server-hanging-on-initializing-change-management/m-p/243366I ran the steps involved there to run the MySQL command and while it does restart the initialization, it still hangs at the same spot.Has anyone run into this recently and have alternative options or solutions?

In Protect, when a Alert Auto-Resolves or just Resolves, what does that mean. Did a file get quarantined? Is the file/program blocked but still on the device? Did it get deleted? Do we know?

New info this morning regaridng log4J.  Version 2.15, included in the recent JAMF patch, is still vulnerable.  When is a patch incoming? Event Impact:CVE-2021-45046 was originally believed to allow a denial of service in Log4J 2.15.0 if certain non-default configurations were used. Security researchers have since found ways to leverage this vulnerability to allow remote code execution. Additional research on Log4J 2.15.0 also showed that previous mitigations (specifically setting system property log4j2.formatMsgNoLookups or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true) did not provide sufficient protection as there are still code paths in Log4J where message lookups could occur. References:https://logging.apache.org/log4j/2.x/security.html

I tried to deploy Jamf Connect with GoogleID as per the Jamf Connect admin guide but during login, I'm getting an error "Configuration is nil or invalid"Does anyone come across this issue? please suggest