Hi all,Im starting to play with the SSO for Microsoft and the Kerberos Apple pieces.  Since we are trying to move away from binding, I'm love to find a solution that allows the user to login using their AD credentials (or office 365 credentials which then just adds our domain name to the end of their login) and then keeps them signed into to anything that can use those credentials.  We cant afford Jamf Connect, so thats out...but noMad or something else that isnt expensive would work.  Since we use federated and managed Apple IDs, I found I could tie into the Microsoft SSO during the user sign into to their iCloud accounts on the computer, which then gets them pre-logged into our Zoom accounts and the microsoft office online logins.  The Microsoft apps are still currently requesting that they type their user name(email address) into the app, and then it lists their account to click on and doesnt require their password, but I'd love to get it to already be pre-logged

We’re currently battling an issue whereby some (but not all) of the configuration profiles we are deploying do not reach our Macs, instead they are stuck in a ‘pending’ state. One of them is our 802.1X Wi-Fi profile which is causing us serious problems.I’ve tried the following:Deleting failed and pending commands via Mass ActionRe-enrolling an affected deviceVerified communication to mdmenrollment.apple.com & *.push.apple.comRenewing the APNS token…and unfortunately currently drawing a blank with support. Trawling through the client and server logs haven’t turned up anything useful. It was suggested that we might be hitting PI-009854, but the MySQL command provided by support disproves that theory.We have a (non-clustered) on-premise instance of Jamf Pro v10.30.1 – we recently upgraded from v10.28.0. We’re only managing Macs with Jamf (no iOS).Any suggestions would be greatly appreciated! 

Hi all, I am trying to use this script Install or Defer however it looks like it will not find any updates once the mac reaches 10.15.7 and as per what i found on jamf nation discussions was that it was a bug in that release causing softwareupdate --list not to find any updates. May I know what kind of workarounds did you all use to move past this via that script? I mean my goal is to get all the macs to 11.4 but without using any kind of complicated script. This was fine but now it just wont find any updates on 10.15.7 -.-

Hello,I have followed a script that allows a user to display details of their computer and submit a new Support Desk Request by pressing a button.  This appears to work fine on MacOS Mojave, but for some reason, any version beyond this, displays and error that the file cannot be found.Code used:  currentUser=$( stat -f "%Su" /dev/console )  sudo -u "$currentUser" /usr/bin/open -b com.microsoft.outlook "mailto:$supportEmail?subject=Support Request -    $currentUser ($computerName - $serialNumber)&body=$displayInfo" It seems to be an issue with spaces in the displayInfo section, because if I remove the &body=$displayInfo section and add %20 into the spaces of the Subject Line (after making it more simple) it seems to work. "mailto:$supportEmail?subject=Support%20Request"Error Received:  The Files /Users/{username}/Desktop/mailto:.... does not exist.I have tried moving the mailto: to outside the quotes, and convert these to single quote

Hello Jamf community, is there a way to create a dynamic computer group that shows me the computers that have more than 35 GB of free hard disk space? The criteria " Drive Capacity MB" does not seem to work here, if I enter the value "35000", almost all computers are displayed to me except for 2 - if I enter "350000", it is still over 90% of the computers, what is actually displayed here? However, a test with 3500000 (3,500,000) shows me 0 computers. So is my way the right one or not? Thank you and best regards,Michael

Hi everyone! I'm working with another admin trying to clear up some database issues and one of the suggestions is to try to resolve some issues with stuck commands on a bunch of devices. The MySQL database output only gives us the "device_id" field as a unique identifier. But I can't seem to use that in the device search, as all of our devices have apparently blank fields for that. Is this a bug? Something we didn't implement correctly when adding the devices to Jamf?

Is there some simple thing I can look for on a system to decide if they are using Office 2019 or Office365?

We have Macs and iOS devices in use by developers and they periodically need to enter an AppleID to install or update apps from the app store or Self Service. Is there a way to bypass this with Jamf Pro? If not, I would like to know how others handle this type of thing on your instance? Like, would it be better to lock down iCloud and any sharing and allow users to use there personal appleids in app store only? Or would it be best to create an appleid for each device and assign it to the user? OR... Would it be easier to create one appleid for every 5 computers or 1 for every 10 ios device?  Really hope someone can help here. Device deployment and App management is, I assume, supposed to be far simpler than what I am making things out to be, LOL Thanks in advance, Cooley

Just wanted to walk through a scenario with file vault. I have user A login with Jamf Connect to Mac and setup file vault. User A works for a few months then gets a better job and user B starts. User B logs in with Jamf Connect Creds. Does FileVault need to be reset for User B?

Hi, I'm having trouble getting this script working. It test successfully when running the script locally on my machine, but when run through the JSS the change default location isn't working, screenshots still go to Desktop, and the script throws no errors. Any suggestions? #!/bin/sh loggedInUser=$( ls -l /dev/console | awk '{print $3}' ) sudo -u $loggedInUser defaults write com.apple.screencapture location ~/Downloads mv /Users/$loggedInUser/Desktop/Screen* /Users/$loggedInUser/Downloads 

Is someone willing to help me out? I've been using a similar script for google drive for sometime now. But with the release of backup and sync I can't seem to make this work. #!/bin/sh -x logfile="/Library/Logs/jss.log" user=`ls -l /dev/console | cut -d " " -f 4` PRODUCT="Backup and Sync from Google" # installation /bin/echo "`date`: Installing Backup and Sync for $user..." >> ${logfile} dmgfile="image.dmg" volname="Install Backup andy Sync for Google" url="https://dl.google.com/drive/InstallBackupAndSync.dmg" /bin/echo "`date`: Downloading $PRODUCT." >> ${logfile} /usr/bin/curl -k -o /tmp/image.dmg $url /bin/echo "`date`: Mounting installer disk image." >> ${logfile} /usr/bin/hdiutil attach /tmp/image.dmg -nobrowse -quiet /bin/echo "`date`: Installing..." >> ${logfile} cp -R /Volumes/Install Backup an

Hello, I recently migrated an employee to a new laptop. I used migration assistant to migrate the files over to the new machine. I ensured I removed all MDM profiles with the old machine to ensure certificate from the previous machine don't land on the new computer. The new computer was DEP device so it enrolled it self before the migration started The migration was successful however the new computer isn't taking management tasks. Check screenshot of management commands pending. These commands have been pending for days now. Odd thing, the computer updates inventory and check in entirely fine Here's what I tried Command Runsudo jamf reconsudo jamf managesudo jamf policysudo jamf enroll -prompt (to see if the CA certificates will help)

Just thought I'd throw this out there since it was driving me nuts. Had a bunch of Teacher machines not showing any classes in Apple Classroom. Finally realized that it was because we migrated from an older local server to a new cloud hosted server and none of the pushed apps are actually being managed. So my solve was to make a policy to remove the Classroom app then run a recon which would push it back. Gabe ShackneyPrinceton Public Schools

Hey all,I'm trying to confirm the behavior I'm seeing.Right now I have the 10.15.7 Catalina installer scoped Via the app store to self service. I've helped a few staff members click on the install button for this for self service and then it downloads the installer to their computer. Then once it completes, it shows the open button in self service. Once this is clicked, it used to ask for an admin users name and password to start the install process, but now it seems to let the user run though the upgrade with out prompting for this. Is this how it works now? Is this a new feature? If so then great and I can just scope the Catalina update to 10.15 through self service and not have to worry about it. I just know when I've scoped the Mac OS Installers previously through the app store, it still required an admin to run it. Gabe ShackneyPrinceton Public Schools

Hey all,I've been starting to play around with putting an acceptable use policy pop up during the login process. Unfortunately we cannot afford JAMF connect, and I don't love the Apple Policy Banner that displays each time the machine reboots. I'd rather have a pop up (maybe with JamfHelper) that states the AUP and then gives the option to accept it during the first login. Then at least I'd have a log file showing the policy ran and they clicked accept. Anyone doing this sort of thing already so I don't have to build it from scratch? Currently we are using DEP notify to do the naming of the computers and cannot have end users dealing with this step of the process, but I do know that depnotify has this feature as well. I'm also aware of the enrollment customization piece, however since it cannot accomplish the naming of our computers, it's still not a good solution. Gabe ShackneyPrinceton Public Schools

Anyone encountered this issue before? How can we get it to show the correct fonts properly?

Hello,Is there a way to delete duplicate certificates? - Today we push out our AD & Wifi certificate with a configuration profile, and had to do some minor changes on the settings for the certificate. The result is we now have two certificates with exactly same name $SERIALNUMBER.Domain.Companyname.comand we would have to delete the older one, something like "...delete certificates created before December 16th.." Is there any "smooth"" way to do this?

Hi all, we want to deploy some 'Software-Stacks' e.g. 'Software-Stack IT' which installs Remote Desktop and iTerm2. We already tried a Policy which installs all needed Packages. It works without a problem, but it has one small downside: If the by the Stack installed Software (iTerm2) is also available in Self Service as a standalone Installation, the Item is not marked as 'Installed'. The Button stays at 'Install' and does not switch to 'Reinstall'. So i am on the search for some kind to initiate the self service install via a script or something. My idea was to let the Software Stack only execute a Script which call Self Service to install the needed package. 'open "jamfselfservice://content?entity=policy&id=86&action=execute"' sadly did not work. Any other way? Thank you very much!

I need to make an extension attribute to check for a certain group on our AD. I can list all groups based on user but no luck basing it off computer name. Any ideas?

Hey everyone.  Looking to create a smart group, via an Extension attribute, that looks for every MacOS device that has the home folder 'test'.  So /Users/test.  Having trouble putting together the script for the extension attribute that can look or every device with this home folder.  Would appreciate some help.I then want to delete that home folder for all confirmed devices by scoping the smart group and using the command 'sudo rm -rf /Users/test'.  Does this seem like a reasonable way to accomplish this?I guess I could just blast every device with this command, but that seems a little unwise...  😉 EDIT- I got the script figured out (see below), but still looking for advice on best approach for deleting the home folder on devices that have it.  Thanks. #!/bin/bashif [ -d /users/ ]; thenecho "<result>Has test Folder</result>"elseecho "<result>Does Not Have test Folder</result>"fiexit 

I've been using a process that was developed by macmule. It's mostly still working across the various OS's. However, I'm trying to get it to sync to an external drive rather than an internal drive. When I point the script to the external drive, the script seems to be running prior to the drive being registered, so the script is creating a folder in /Volumes and starts replicating. The drive then finishes mounting, but has a 1 appended to the end which makes it the wrong path. I tried adding a sleep timer but it didn't seem to work (shown).I've tried'"/Volumes/Peg...."'and with various versions of ", `, and even manually putting the path in with \\ commands (.../Pegasus\\ -\\ SA) Here's how it's setup now.sleep 15 emailAlert=$(/usr/bin/rsync -avrpogz --delete --log-file=/private/var/log/rsync.log -e ssh ':"/Volumes/Promise RAID-File Share/CasperShare"' "/Volumes/Pegasus - SA") 

Might anyone have any experience deploying AnyConnect 3.1+ using Cisco's installer but without the Web Security module? Cisco mentions something in their documentation regarding a configuration file for the installer named ACTtransforms.xml but I cannot find any examples of this file, nor any info for how to create one. I have tried searching and have found no additional info. There is a script that can be run after the installation that will remove this module, but I'd prefer for it never to be installed in the first place.

We are seeing this popup here and there in our environment and I am afraid it will become more widespread. I have configured settings as recommenced to prevent it but it does not work. The worst part is clicking OK does not let the user continue, nothing happens. They are basically blocked from using any Office apps as you can't get pass this popup. We are also using the VL license. It started showing up with version 16.50.21061301. Has anyone else seen this? I tried solutions as recommended by Paul Bowden's PDF https://www.kevinmcox.com/2019/08/privacy-and-consent-changes-in-microsoft-office-16-28/ Config Profile looks like this: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>HasUserSeenEnterpriseFREDialog</key> <true/> </dict></plist> and I have also tried Paul's profile found here:https://g

Hi Jamf Nation! We’re excited to announce new enhancements are coming to the community! We don’t want to spoil the surprise, so we’re not sharing details…yet. But we do need your help. If you could hold your thoughts and not post new comments, answers or feature requests from 11:30 a.m. CST on July 12 through 9:00 p.m. CST on July 13, we’d be especially grateful. This will help us ensure nothing is lost while we implement some notable changes. Also, if you have content within the Jamf Pro Add-Ons space, we ask that you move anything you want to keep to another location (e.g., https://marketplace.jamf.com/, if your organization is in our Marketplace or on a personal GitHub page). Jamf Pro Add-Ons, and the content that lives within it, will no longer be available starting July 13. As a reminder, you can continue to access our Support team (https://account.jamf.com/support) through Jamf Account (https://account.jamf.com), should you have a question arise that can

Hi Guys, We are getting ready to deploy Pulse Secure to our Mac systems. Is there recommended process that host checker should look for to verify a system has our Jamf MDM installed and ultimately allow the connection? Hopefully this question makes sense :) Thanks!