So we're all remote yet may still be hiring and may need to roll out new hardware.All of our Macs are bound to AD and all users are mobile accounts.My question is how do I remotely have a user login to create a mobile account at login when outside our firewall. We don't have external access to our AD although we do have Azure AD if there's some way to leverage that. Any help is greatly appreciated.

None of our users are admins of their computers; however, some do have legitimate needs to run some terminal commands like tcpdump and a few others that can only be run as root. Is there a way to allow specific users to do that with whatever switches and paths they need to? Some of the commands need to be interactive so I can't just setup a single command in Self Service and run that as root.

I have a bunch of fonts that are in multiple Font Suitecase files. I can copy them into /Library/Fonts just fine but MacOS does not see them for use. I need to push these out as a .pkg with JAMF School. Thank you for any ideas!

I have a Catalina upgrade policy without --eraseinstall in the command. So computers running 10.13 or 10.14 can do in place upgrade to 10.15. No problems. I'm wondering if the --eraseinstall command is also added will this then result in the computer to then be unenrolled? since it's being erased I would think so, but I haven't tried it yet.

DEP previously configured using DEP, device then unchecked in DEP to not use DEP.Removed device from inventory. Removeframework command executed.All configuration profiles still listed.When i boot to an external boot drive it wont let me because of managed preference. How do i get rid of this so i can boot to external boot drive and wipe drive and install new macOS?

Anybody notice a change today in the interface to Apple School Manager / Apple Business Manager?

Hello, Does anyone experiencing Adobe Acrobat DC activation issue by Adobe Enterprise licenses assignment? On some Macs, we see Acrobat not wanting to validate licensing, receiving the "something went wrong" message. Users successfully login to Creative Cloud with accounts, and have all other assigned applications working activated but Acrobat. In same time, Acrobat Reader works well, accesses to Creative Cloud account and files. By troubleshooting, we deleted all Acrobat preferences, uninstalled-reinstalled Acrobat, logout-login to CC Client; on Adobe portal side, deleted-reassigned Acrobat per Adobe ID. Still getting the same error opening Acrobat app. Wonder if someone knows how to fix, maybe some hidden files to delete, etc. Thanks!

I have a package that I need to replace/edit a couple of files in, is there a quick/easy way to do this without having to install the package to its absolute destination location? Specifically, I have a package that contains a folder "/Library/Application Support/ABMaintainer" with a binary file ABMaintainer and a plist file com.abtutor.permanentPreferences.plist, I need to be able to replace those two files with the newest versions without having to actually copy them locally to their final "/Library/Application Support/ABMaintainer" location on my Mac. I tried using Composer but it didn't seem like it would let me replace the files unless I had them already in their destination locations.

Hey all, since the migration today we aren’t able to login via manage.zuludesk.com anymore (this was expected). But we aren’t able to login at our .jamfcloud.com Domain either, instead we only get an 503 Service Unavailable error page. Is this due to unfinished migration and is expected to fix itself over the weekend or should everything work by now?

Hello, How do I check which versions I have of gatekeeper AND xprotect in macOS Catalina? Before I use these commands to check version in older systems: /usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" /private/var/db/gkopaque.bundle/Contents/Info.plist /usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" /System/Library/CoreServices/XProtect.bundle/Contents/Info.plist ThanksCamelia

Hi. I am running into an issue that has become more prevalent with our DEPNotify workflow. Our enrollment policy is failing out when the DEPNotify-Starter script tries to open the app. It errors out with LSOpenURLsWithRole() failed for the application /Applications/Utilities/DEPNotify.app/Contents/MacOS/DEPNotify with error -54. I'm told its a permissions issue but I'm not sure with what. The app is installing to /Applications/Utilities as the script would expect and all the permissions are the same as when this actually worked. I've seen it happen on both Catalina and Mojave clients. The only way I actually get it to work is by manually clicking the DEPNotify app to launch it. Anyone else seen this? Oh I'm using DEPNotify 1.1.5 and DEPNotify-Starter 2.0.1 FYI

Hello everybody. At my school we've been using Zuludesk / Jamf School for 3 years and we really like it. We have a mix of perpetual and annual licenses and every September, when we restart the school, we get a notification and we make the decision of which iPads to drop because they are too old, which ones to migrate to a perpetual license and which ones should get the annual one. However we've discovered that this year we can't do anything at all on the Jamf School console until we buy all the missing licenses. We can't even manage the iPads whose licenses are already paid. Is this the expected behaviour? Thanks in advance.

I have a computer that sees 0 software updates. I have a script that automatically prompts users to run them, and it wasn't prompting this user. I reached out and confirmed that if the user goes to system preferences>software updates they do not see any updates. this computer is on 10.15.3 so there are definitely updates available. I've removed the profile that delayed software updates, though it was only 7 days. I've run the reset ignored software update command many times, i've ensured that the date and time are correct on the computer. We never configured a software update server so all of our computers are just going directly to apple for that. any ideas as to what else to try?

I have a Jamf instance that i am using for testing. I have SSO setup with Azure AD and have SSO enabled for User Initiated enrollment. Previously, when I would log in with Azure AD credentials, the computer would automatically be assigned to the Azure AD user (and a User created with the Azure AD UPN as the user ID). Now, when I try to enroll a computer, I am prompted to assign the computer to a user. And, it will not accept my Azure UPN as the User ID. I didn't intentionally change anything, but something changed on me. Any suggestions?

Using regular local user accounts with Jamf Connect (Azure). Not mobile, or network accounts. When first logging in to machine with Connect, the local user account is created as an admin (per Jamf Login config) as expected. When the computer is restarted, the account is demoted to a Standard account until manually given admin rights. We want admin rights to be permanent. I see this line in the Connect Login logs:NoLoSwiftMech: Removing user from admin group Any ideas? Thanks!

https://github.com/Honestpuck/PatchBotHi anybody using this tool ? I have a few doubts. Is it 100% free tool. ( as per the blog, he Bought "Kinobi" tool to quality patch definition.) is there any flow chart of PatchBot, how it works? is it auto create package and deployment for new version of applications?

I am new to Jamf and was hoping to find a way to do the following or ideas on alternatives. I would like to set the distribution method of an app based on static device groups. For example, say I have two static groups: staff iPads and student iPads. I want to have one app but two different install methods based on group membership. Let's say the app is Google Classroom. For devices in the static group "staff iPads" I would like to have the distribution method for Google Classroom as "made available in self-service" and not have the app automatically installed so the staff member does not have Google Classroom on their iPad unless they want it there. For devices in the static group "student iPads" I would like to have the distribution method for Google Classroom as install automatically because the students will not have access to the self-service portal. Is something like this possible? Thank you in advance!!

Not Jamf related... but we have a weird issue. The user's password works to log into her laptop (10.15.6), but when the screen saver starts (as required by security), the password does not work to unlock the device. The user needs to power off and back on to get back into her device. What would cause that?

Hello, We are looking to allow our users access to the print options on the mac with out full admin credentials. I was going to throw this: /usr/sbin/dseditgroup -o edit -n /Local/Default -a 'Domain Users' -t group lpadmininto the jss scripts but I saw a post that lpadmin also gives users root. I want to make sure that adding users to lpadmin will only allow print administrative changes and nothing else.Throwing that into the scripts and pushing it out should accomplish our task though correct?

I have found many scripts here and on the internet but I am not having luck creating a policy to mount a network share. We have a basic drive that everyone has access to, I want to basically have a script that mounts this drive automatically for our Mac users. I want to start off here. Each department has their own network share and their own personal drive which I would also like to mount eventually but that seems a bit more complicated as access to those drives are based off of AD group membership. Can someone throw me a script that will simply map a network share? Currently I tried using #!/bin/sh protocol="$4" # This is the protocol to connect with (afp | smb) echo "Protocol: $4" serverName="$5" # This is the address of the server, e.g. my.fileserver.com echo "Server: $5" shareName="$6" # This is the name of the share to mount echo "Sharename: $6" # Mount the drive mount_script=`/usr/bin/osascri

Looking to build a smart group based on the criteria of Available SWUs, but not defined to a specific update. I'd like to have a smart group that collects Macs that have any Security Updates pending. Previously a wild card search might be able to do the trick, but that's no longer an option. And the operator for the criteria "Available SWUs" is on "Has" and "does not have". The goal is to have a monthly policy that runs software updates to only Macs that have a Security Update available and have it be hands off... new Security Update is released and the Mac is added to the smart group and the policy runs.

Good day,In our environment, there is a distribution group, if a user is part of that group he/she can use user-initiated option to enroll MacBook. Some users are using this option to enroll their personal devices. We were planning to use "Remote Lock" option under management commands in Jamf portal for devices that are not owned by our organization. My question is since these are not owned by us what will happen to data on device if users gets it unlocked from apple or apple authorized store. These devices are FV2 encrypted. I would appreciate your thoughts on this.Cheers!

I created a smart group for finding computers that have Box drive installed. the application title is Box.app. The results of the smartgroup are finding 19 macs, but only 2 have it actually installed. I go through each resulting computer in the smartgroup and check it's list of installed applications. Only 2 of the 19 have Box.app installed. I moved my test macs box.app to the trash and did a recon, and the smartgroup went down from 19 to 18. anyone else have a similar issue? Application Title HAS Box.appI also have a smartgroup for Box Sync, the application title is Box Sync.app and this is populating correctly. Application Title HAS Box Sync.app

Anyone have any luck with SecureAuth SSO integration with their Jamf Pro Software Server? I am not our SecureAuth engineer but I have been advised that they followed the Ping Identity (https://www.jamf.com/jamf-nation/articles/439/configuring-single-sign-on-with-ping-identity) guide for configuring SecureAuth as closely as they could and then I took care of the JSS side. When enabled, I am getting SSO error when hitting our instance. Here is the log information- Caused by: org.opensaml.common.SAMLException: Response doesn't have any valid assertion which would pass subject validation at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:229) at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:87) ... 46 moreCaused by: org.opensaml.common.SAMLException: Assertion invalidated by subject confirmation - can't be confirmed by the bearer method

Hello, does anyone know how to include a custom image on a JAMF helper prompt. Im able to view the custom image we have for self service branding in ~/Library/Application Support/com.jamfsoftware.selfservice.mac/Documents/Images/brandingimage.png I tested with another user and they also have the image in that directory, but when I push the policy for JAMF Helper, the message displays but with no image below is the script #!/bin/sh /Library/ApplicationSupport/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType hud -icon ~/Library/Application Support/com.jamfsoftware.selfservice.mac/Documents/Images/brandingimage.png -title "Title" -heading "Welcome to JAMF Self Service" -description "You can use the JAMF self service portal to install software, update software or troubleshoot your device" -button1 "OK" -button2 "Cancel"