We use pre-stage enrollments to setup new Macs. One issue I've run into is with our CA Certificate for our Wifi network. If it installs before the Mac is bound to the domain it doesn't work. I have to remove the configuration profile, join it to the domain and then re-add the configuration profile. Is there a way to not let a configuration profile install until the computer is bound to the domain?

Does anybody know if there is a way to get a notification or email when a device is unenrolled? I know there is the webook feature, but is that the only way to get notified?

We use an S3 Cloud Share for packages that we can't install using scripts, and Jamf Pro running in AWS as well. We are now in the middle of starting to roll out Big Sur and would preferably do this through Self Service as our users are not administrators. Due to the size of the package (around 11-12gb), we couldn't upload the package through Jamf as we get an error message each time when trying to upload it. Therefore, it was uploaded directly to S3 and I can see the package there along with our other packages. Is there a way to make Jamf see this package as well? Currently I can see all packages but not that one. Unfortunately as I said, uploading it through Jamf itself or via Jamf Admin results in an error.

So I just today deleted the (legacy definitions) for Slack and Zoom in patch management. But the new ones are not populating at all. I also switched to the new definition for Firefox and chrome. Those are working properly. Has anyone seen that issue should I just go back to the legacy definitions?

I am trying to set up a VM to test JAMF Connect using Parallels 16 and Catalina. I have set up the VM to use the boot flags, devices.smbios.serial="C01VG0EFHGFVB"devices.mac_hw_model="MacBookPro15,1" The VM will enroll via the /enroll URL and show up under computers, it will then get the CA and MDM profile. Both of which show as verified. The computer record shows it as enroll but not managed and no other profiles will come down. If I run JAMF manage, it tells me the MDM profile is not approved. If I got back into the profiles pane. It is now unapproved. I have no idea how to fix this, I have never had an issue like this. Any Ideas?

We are replacing our fleet of classroom iPads with newer models.The new iPads have all been loaded in via DEP, and placed into PreStage Enrollment groups for each year/grade level. How do I get the new ones all going before unmanaging the old ones? Won't I exceed our Jamf Device Count? The plan had been to decommission all of the old iPads, then start up the new ones, allow them to enrol themselves and place them in the appropriate classroom.However, the delivery didn't arrive until after the holiday period and now we're faced with having no iPads for days while we roll over the new ones.

Hi, I have an app that I am trying to install, and I want to provide command line parameters for the install. I don't see an option for providing command line arguments in. JAMF Pro configuration sudo securityagent.pkg --key=XXX --env=XXX

I'm working on a script that is initiated through Self Service and Startup (ongoing). I want the script to know whether it was initiated from Self Service or if it just ran because of a restart. Right now I have the script detecting whether Self Service is running when the script starts which seems to work well, but I don't want Self Service to open up as soon as a user logs in and accidentally start the script. My question, is there an easy way for the script to know if it is being run from Self Service or not? Additional Information:I found that a process starts when a policy is run through Self Service called "JamfManagementService", but if I run pgrep "JamfManagementService" inside of the script, it doesn't find anything. If I run this same script through Terminal while a policy is running through Self Service it finds it every time. I'm not sure why this process can't be found when run from inside the policy, I think this would be the best way to resolve this issue if I could

Maybe I'm missing something really simple, but how do I access the global address book for my active directory in the "New Outlook"? An easy way used to be clicking the button next to the "To"/"CC" fields, but that's missing now:

Hi Everyone - I've been struggling with a computer for a good portion of this morning. I'm trying to push an app from the Mac App Store and have it assign VPP content to the computer. I've tried everything I can think of, including removing the MDM profile, re-reconign, sudo jamf enroll, etc...... and yes turning it off and back on again. Here is the full error: "VPP redownload call timed out <MDMClientError:72>" It just seems strange.... I tested pushing this app to another computer and it works totally fine and assigns the VPP content as it is supposed to. I tried looking this error up online without any luck. Does anyone have any ideas or suggestions for moving forward? Thanks!

I have about 100 M1 MacBook Airs to deploy and am working on my PreStage enrollment. Is it necessary to wipe and reinstall each time I want the ADE to run? In other words I make changes to the PreStage and fire up a MacBook - something doesn't work right, I make a few tweaks to the PreStage and want ADE to start over. I remember doing this a few years ago, not sure if it still valid given SIP, etc sudo rm /var/db/.AppleSetupDonesudo rm /Library/Keychains/apsd.keychainsudo rm -rf /var/db/ConfigurationProfiles/ thx

Hello all! We are doing a macbook refresh this summer and I am trying to figure out a way to wipe our current computers for the company buying them. I've done this before by utilizing the --eraseinstall function of the OS installers. However, the company we are using this time just wants them wiped, no OS needed. So essentially, the function of the Wipe computer command in Jamf would be perfect and save a lot of time from having to put an OS installer on the macbooks and wait for the erase install to finish. Unfortunately, this command is not available as a mass action. I'd prefer to not have to go into each computer in Jamf and do the Wipe command one at a time. I'd love to be able to avoid the eraseinstall method if possible. Is there another way to do the computer wipe as a mass action? Anyone have a different method of cleanly wiping 100's of computers quickly? Thanks in advance.

Hello Everyone, Does anyone know of a way to spec out a smart group that looks for the existence of a folder? For instance, if a directory such as "work" exists in /Users/Shared I can find all of the computers where this folder exists in /Users/Shared/work. I cannot find any criteria that seems to match up to this. Thoughts? Thank you as always!! Mick

I need help fixing a problem in a script that is supposed to trigger an osascript notification whenever a user tries to connect to a banned SSID. The notification should only occur when the user is either already connected or is trying to connect to one of the banned SSIDs. I though the problem was due to the fact that the script is being run by launchd, and so is running as root, however, even after running the notification command as the logged in user, no notification occurs even as the rest of the script works fine. Secondarily, we are also unable to remove credentials for a banned SSID from the local items keychain, but as is, the script has the desired effect of kicking the machine off a banned network if connected and preventing the machine from automatically connecting in the future. We are able to remove the credentials from the System Keychain, but it would be nice to find a way to also remove the item from the Local Items keychain as well. Anyway, the main issue occurs at

All,I'd like to install our wireless certificate on a group of managed Macbooks. The certificate is a valid third-party certificate and is required to connect to our 802.1x wi-fi. I'd also like to set the trust settings so the user doesn't get prompted (The users will not be admins on the machine so they can't trust the cert.) I tried using Configuration profiles in JAMF and deliver the certificate, the intermediate, and the root. that works, but the user gets prompted each time they connect as the trust settings are default. I found some articles on this site suggesting to do this task with a Composer package instead and using the 'add-trusted-cert' command. My question is:1. Is using a package still the best way to install a certificate with trust? Or is there a better way. I've never used Composer so I'll have to gain some skills.2. Is this normal behavior for a Mac to not trust a trusted third-party certificate? I've always tho

We've started ramping up our iPad fleet and have set up a block of 80 for a classroom in 4 iQ 20 pclocs carts. The carts are connected one at a time initially to an M1 Macbook Air with an HP USB-C dock which provides network access to the wired network and several USB-A ports to connect the 2 cables from the carts. The Macbook is set up to provide Internet Sharing and Content Caching via the dock to the carts Each cart has 4 USB IQ devices - 2 at each end. I'm only seeing 1 at each end actually providing network. When I subtsitute a USB C Multiport adapter for one of those USB A cables from the cart I get both IQ devices on that end providing network. I'm wondering if this is a bandwidth issue for the dock or a limitation on the macbook. Our only other setup like this uses an old intel iMac connecting direct to the cart via the 2 USB A cables and there are no issues at all. Has anyone seen problems like I'm seeing? Have you found any docks that do work in

Hi Ive noticed that some of our machines start this new behavior that they logout after 30 min of inactivity and it sets itself automatically in security and privacy setting. I did not set this up and I can not find anything in the policies or in configurations. Had anybody else has this problem? Thank you,-Popak

My company has a new directive that our intranet page must open on every system at login. We do not have to change/set the default page to our intranet, but each user is supposed to get it at least once a day. Simple. I created an ongoing policy that runs at login that does one thing–Run command "open http://ourintranet" I did this so that it would open in the default browser for each system. It works like our management has requested–the intranet page opens for every user at every login. However, it opens Safari, regardless of the default browser the user has selected. Why? There is nothing in that command or otherwise in the policy to specify Safari. Our users have Firefox, Chrome, Opera, RockMelt and several other browsers. Many of them never launch Safari. I want this script to open the page in their default browser, not something I have (by matter of policy) dictated. Any suggestions?

Hi,I'm looking for an extension attribute that displays if the computer name is set to $serialnumber of the computer. The purpose is to run a rename policy to machines that has not $serialnumber as computer name.

Hi, Given the latest vulnerability in Git, does anyone have a way of controlling the version of Git effectively from within Jamf? I found an extension attribute from 2014 (https://gist.github.com/homebysix/501a3bc5144b77aecc0c) that kind of works but only takes the Apple version of Git while ignoring whether a user has a version installed via brew for example. I also wanted to know how you're handling the built-in version of Git, is there any way to disable it and force users to use brew instead?

Hello everybody, does someone have a idea how I can remotely add a folder of pictures to the desktop pictures selection? Appreciate any ideas/feedback, thank you.

Any chance there is an easy way to fix config profiles which failed to install on a number of machines without having to redistribute the profile to all machines?

Hi everyone, I have mashed together the following script to report a managed device's current LAPS password, which is stored as an extension attribute on the JSS. Unfortunately, when I run the script, nothing is returned (no errors either). #!/bin/bash apiUser="" apiPass="" apiURL=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url | sed 's|/$||') udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') extAttName=""LAPS"" LAPS_Password=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}') echo $LAPS_Password Does anyone know what may be going wrong here?

Hi everyone,I've followed this guide: https://www.jamf.com/jamf-nation/articles/649/creating-a-signing-certificate-using-jamf-pro-s-built-in-certificate-authority And i'm signing my configuration profile with this command:/usr/bin/security cms -S -N "JamfSign" -i ~/Desktop/Custom.mobileconfig -o ~/Desktop/Custom-signed.mobileconfig I don't get any errors when signing but when I try and upload the signed configuration profile to Jamf I get a "File cannot be processed" error. If I double click on the signed profile to test it on a mac I get an error opening it. Any ideas what I'm doing wrong? Thanks,

Hey all,We are having an issue where an 802.11x network we push in a profile is getting removed from the preferred list of networks and then it breaks the profiles ability to join said network. My solution to this is to find all the devices that are missing that network and then exclude, then re scope them to that profile, but I need some help with the scripting of the EA. We have 3 networks all named similar. Each includes the name or our district so its making it hard for me to grep the exact network I need from the list without pulling all 3 of them. Then I just need a result that said" has the network" or "doesn't have the network". Two things not working is the grep for the specific network name and the if section if the result is blank.Any help would be greatly appreciated! Here is what I have so far: #!/bin/sh ##Get the wireless port ID WirelessPort=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}') #