Hi, I have a technical question on locating a particular setting that we are looking to show evidence of in our JSS configuration.  Our fleet requires an Admin account to install applications on all of our endpoints. This is a setting that we want to keep, but I cannot find where to show evidence of this. The official Apple documentation shows Standard Users are able to install applications, so it seems this is not an inherent limitation of a standard user account. I also do not show this setting is enabled anywhere in our Configuration Profiles. Where else could this restriction be? Thank you,Jon

My company is using Jamf Cloud and we were upgraded to 10.33 over the weekend. Since then, when using the MDM command to install updates, Macs keep reinstalling 11.6.1 even if it's already installed. The situation is as such:I am using a modified version of this - https://github.com/kdrwygvh/Sunstein_macOSUpdates. The softwareupdatecommand runs and shows these two updates* Label: Device Support Update- Title: Device Support Update, Version: , Size: 191029K, Recommended: YES, * Label: Safari15.1BigSurAuto-15.1Title: Safari, Version: 15.1, Size: 118254K, Recommended: YES, So the MDM command runs, but it finds that 11.6.1 is available, despite it already being installed, and reinstalls it.This has happened once a day starting early on the 31st and my instance was updated on the 30th. The first entry is when the update was originally installed, via the same script (less a few tweaks).I suspect the issue is that Jamf isn't properly evaluating what updates a Mac does and does not h

Hey,I have a problem in my environment where I have a Smart Group ("FileVault Eligible Devices") set up according to best practice. (https://docs.jamf.com/technical-papers/jamf-pro/administering-filevault-macos/10.30.0/Creating_Smart_Computer_Groups_for_FileVault.html)FileVault 2 Eligibility Is EligibleANDFileVault 2 Partition Encryption State Is Not EncryptedJust like it states. My problem is, however, that devices that already have FileVault enabled get put into this group. Now I no longer know which devices had FileVault enabled by JSS and which had it enabled prior to enrollment. (Most of the devices either report PRK as unknown/invalid or report encryption state as Unencrypted despite being encrypted, even FileVault enabled by JSS.) I have created a Ticket to Jamf support about this, they elevated it to their Tier 2 team but they stopped responding to me. Could someone here have any insight? Thanks!

Does anyone know what happened to all the sites on what used to be communitypatch.com? We used them for software Jamf still doesn't have, like Microsoft Edge and our VPN software. Are there any alternatives? If not, how do I set up our own patch definition sources?

I am setting up 2 new policies to (1) uninstall and the old Bitdefender Onprem client and then (2) install the new cloud client.the first works fine and silently uninstalls the old Bitdefender client.The second policy fails. The error given is related to the download target location of the package.This is the simple script that worked previously.installer -target / -pkg /Users/Shared/antivirus_for_mac.pkg We are running Jamf 10.27 still on macOS Catalina and I think there may have been some changes creep in such as inability to write to system volume which might be what is causing the download failure.

I have erase-install.sh (version 25.0) deployed to a computer for testing and get an execution error when running a script with commands.The script with commands:sh /Library/Management/erase-install/erase-install.sh --version=11.5.2 --check-power --erase --depnotifyThe result:execution error: /Library/Management/erase-install/erase-install.sh: line 1578: syntax error near unexpected token `>' /Library/Management/erase-install/erase-install.sh: line 1578: `exec > >(tee "${LOG_FILE}") 2>&1' (2)I am quite green when it comes to scripting languages, so this is over my head other than my understanding there may be a bad syntax somewhere. Can anyone give me some guidance on if I need to edit the script or if I need to adjust a setting somewhere?For context, these are the couple of lines above the line with the error:# all output from now on is written also to a log fileLOG_FILE="$workdir/erase-install.log"exec > >(tee "${LOG_FILE}") 2>&1 

Hi all,after updating to the latest macOS 11.5 my current way to check if Rosetta2 is installed no longer works.I used to check for:/Library/Apple/System/Library/LaunchDaemons/com.apple.oahd.plistBut now that particular plist file doesn't exist anymore.❯ ls -l /Library/Apple/System/Library/LaunchDaemons/ total 16 -rw-r--r-- 1 root wheel 606 1 Jan 2020 com.apple.MRTd.plist -rw-r--r-- 1 root wheel 925 1 Jan 2020 com.apple.usbmuxd.plist 

Currently in the process of deploying FortiClient 6.4.x to macOS devices, however after installing FortiClient 6.4.x, users are seeing a prompt to allow "com.fortinet.forticlient.macos" to filter network content. Does anybody know how to create a configuration profile for the delivery of a payload which adds the web content filter for FortiClient, pre-allowing it and thus avoiding the users being prompted?

We have some generic account used by different people, like a "student" account that is used by all of our elementary students. If a user opens a ton of apps, logs out and doesn't uncheck the "Re-open windows when logging back in" option, all of these apps would open the next time someone logged in with this account. In 10.7 and 10.8, we avoided this by having a policy that runs at every logout and deletes the user's loginwindow byhost pref file (~/Library/Preferences/ByHost/com.apple.loginwindow*). This file contains the data about which apps need to be re-opened. Even though the pref seems to be doing the same thing in 10.9, deleting it at logout doesn't appear to be sufficient to not allow the apps to re-open. If the machine is rebooted it appears to work but not if it's just logged out. I haven't been successful in determining where else the data is getting stored... it's almost like it's caching it somewhere outside of

Hello,I'm fairly new to Jamf Pro and there is still A LOT to learn, but I seem to be getting an error that I cannot resolve when adding the .pkg definition for Python version 3.10.0:"You do not have permission to save a patch with an unacknowledged extension attribute"However, I'm unable to change any extension attribute from the "Extension Attributes" tab as it seems they have resolved here.This problem is directly keeping us from deploying the software policy and therefore updates via Jamf Pro are on hold. Please see attached screen snips in regards to this problem.FYI, the .pkg installer does come with two .apps; "IDLE" and "Python Launcher" which i'm not used to seeing before (not saying much); So maybe it has something to do with this (?).Maybe i'm just overlooking something simple, but I just cannot see it at this point in time.Thank you,

I still have problems with jamf connect 2.6.0 and the message Invalid Request: when <key>OIDCNewPassword</key> <false/>As soon as is change to true it works correct.What am I doing worng?  Here is my Plist:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OIDCDefaultLocal</key> <false/> <key>OIDCNewPassword</key> <false/> <key>OIDCUsePassthroughAuth</key> <true/> <key>OIDCProvider</key> <string>Azure</string> <key>OIDCClientID</key> <string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string> <key>OIDCROPGID</key> <string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string> <key>OIDCRedirectURI</key> <string>https://

Hello! Looking for detailed options, preferably native or free, to deploy HPLJ printers with Jamf School. We are a primary Windows environment. Our print server is Server 2016 and mostly leverages a universal windows driver for the HPLJ printers on our Windows workstations. Our goal is to reliably deploy printing to MacOS when in network for HPLJ printers. Open to direct to printer, or through hosted queue on the print server, we currently do not need to account for printing to these. Our Macs are not domain bound and use local non-admin user accounts. Current method, and challenges:Deploy an In-House Enterprise app package of the HP 5.1 Driver Pack (forum stripped the link here, but it's Apple KB dl1888) to a supervised Mac on various minor versions of Big Sur. Deploy a Profile with the Printer Management payload defined and an lpd:// path for the queue on the Windows Print Server. lpinfo -m is run to find the specific model name for the profile field. Often, there is n

I am somewhat new to making API calls. I am trying understand why the following API call won't return the value held by the "name" field of an extension attribute. However, running the same call, but targeting the "id" field does return the expected value.Things to note:Permissions are correct on the API user account.I am able to return the raw XML via curl using the API user account.Running on Big Sur & Monterey, and the xpath command is adjusted to reflect syntax changes beginning with Big Sur.I am able to retrieve all nodes on the name field using "//extension_attribute[name()]".Can someone more experienced with API calls throw me a bone? apiUser="username" apiPass="password" apiURL=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url | sed 's|/$||') udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') eaName=""insert EA name string value"" eaID=""insert EA ID numeric value"" fromName=$(curl -

We had an incident that required us to do a snapshot rollback on our Jamf Pro instance (snapshot was about 32 hours old and no major changes happened before it) and since doing so, no one is able to log into the Jamf gui (users attached via LDAP if that matters), and we just get a standard 401 error.I have no idea what to do about this or where to even start looking.

Hi Im looking for composer as app packaging tool.So I can understand when it needed "Normal snapshots" and the other snapshot.But "Monitoring the File System" is not.What is the appropriate case for this function? and how its different with snapshot? I need your help Thank you

Hello, I am facing an issue with Bitdefender on Monterey, seems when I upgrade from Big Sur it works fine. But when I remove Bitdefender and push it via Jamf the Network Extension throws an error and seems that the Config Profile is changed or not working as expected.If I open Bitdefender it shows that Network Extension needs to be allowed and Installed, this is already allowed and works on the previous version, when I click "Install now" nothing happens because the Security & Privacy Payload is empty and there is nothing to install or allow.Anyone have any ideas on how to allow Bitdefender Network Extension to be allowed with no user intervention? Thanks

Hello community,is there anyone using Windows smb printer shares on Windows Server 2019?Since the last Windows patchday, we face an issue, that the Macs are no longer able to communicate over smb with our spooler servers. If I am right, at the servers smb version 2 is activated. The behavior is, that when a printer job was sent, the job is shown inside the local spooler of the Mac and then it should be sent to the spooler server. This fails. The installed printer is getting to pause immediately.We did not change anything in our "Mac World", but only installed the Windows updates on the spooler servers.Reset the Mac printer system and reinstall the printer did not work.If we install a printer manually, the message appears "communication via smb with the server impossible" .Have anyone a suggestion ?Thank you for your answers andstay healthNOVELLUS

Hi y'all,Currently in a strange project: For one of our new daughter companies we are trying to move from Intune to Jamf for managing their Mac devices.So we moved the Intune MDM server in Apple Business Manager to Jamf, erased and reinstalled MacOS and did the usual stuff.The problem is that the device does not turn compliant. The device is created as supposed in Intune, all the Compliance settings turns green & compliant but the device itselfs keep getting 'Not Compliant' state.When looking at the Company Portal Web Portal, it gives us the message not compliant because password was recently used. We changed all the passwords to random generated passwords, so this must be an error.We have some experience with Jamf, we have just completed a separate project with one our other daughter company.So we know the setup as designed should work. We compared all the settings, but can't find any differences. Right now we are completely lost!Praying that someone has some ideas.... Please help

Hi all,Is anyone having issues with Jamf Cloud at the moment? I can't login at all.  Thanks

Hello!We are in the process of moving from Apple Profile Manager to JAMF School. In the process, I've been trying to migrate the VPP licenses into JAMF for days. Unfortunately without success.My problem is that our Apple Profile Manger is no longer running because my colleague has upgraded the Mac Mini to Monterey. Unfortunately, Apple's server app is not compatible with Monterey.Is there any way to transfer the licenses to JAMF if the old MDM server is down? I am grateful for any tips!Best,Uwe

Hey all! What sort of solutions do folks use if they want to take a simple shortcut to a webpage, add an icon to it, and place it in the dock through either a policy or PKG? We want some felxibility over how we deploy it and while I have used Dockutil/Profile creator and the web clips option as a config profile in JAMF...i've been wondering if there was a way we can deploy via policy or even standalone PKG, and without having to deploy it with a third-party app like dockutil.

I try to manage the settings of my clients Finder. I found a way to put a plist into a profile. It looks nice but cannot be modified by the user later on. So I’m looking for a way to set some defaults but let the user modify it if he or she likes.The same with the dock. I prefer to set up the dock but the user should be able to add new items and get rid of some others.Every hint I found is with older versions but none of them works on Big Sur.Please help. I don’t think I’m alone with this issue.BTW. I’m very new with JAMF, so be kind with a newbie. Thanks.

Hi everyone,Just wondering if anyone else has seen an issue with Jamf Connect not automatically launching into the menu bar after login?Only observing this behaviour on Monterey. Jamf Connect is performing the user login, because I'm logging in with my Azure user account. If I launch Jamf Connect manually via Applications, it then shows in the menu bar.Wondering if I'm now missing something in one of the config files that is causing this not to auto launch. This is also tested against a completely fresh install. Regards,Mark

Hello All, Wondering, is there a way to restrict an application from being able to look/share contact information?Example:A user downloads Whats App on their phone, can we stop Whats App from seeing company owned contacts? But if a user wants to share their personal, that is okay.

Hi there ,I am using a script to erase install Big Sur on our machines.I was testing out the script and it works fine for all devices with Big Sur or previous version above 10.9. But it doesn't work for Laptops which are already in MontereyActual script which do my erase / install process"$installer_path" --eraseinstall --agreetolicense --forcequitapps --newvolumename "$computername" & "$jamfHelper" -windowType hud -lockhud -heading "ERASING AND INSTALLING" -description "$erase_dialog" -icon "$mac_os_installer_path" If pass this command on Monterey device , it doesn't give no output. Any suggestions on how to make it work?