My team is in the midst of migrating machines from our current Jamf Pro Server (ver 10.7) which is on a physical machine to our new Jamf Pro Server (ver 10.22.1) which is a VM in our data centre. We have tried using Jamf Migrator but we realized that only the data gets migrated but the machine is not installed with the new MDM from the Jamf Pro Server (ver 10.22.1). While researching on the ways to migrate, we chance upon the following guide from Jamf (https://www.jamf.com/jamf-nation/articles/122/migrating-to-another-server) but all three choices are not applicable to us as we are setting up from scratch. Another method that we are trying to figure out is to push out a script which removes the current MDM, profile, etc. and within the same script, route the machine to enrol it to the new Jamf Pro. However, we are not sure on how to do this or if it is possible at all. If we would like to enrol these machines (approximately 1100) to the new Jamf with none or little user interventio

Hello! When we run the CIS 10.15 hardening guide, the user sees 2 Macintosh HD icons on the desktop. I'm aware of the changes with Catalina on splitting System volume and Data volume. At first I thought it had to do with the Jamf config profile/Finder payload that we use to show items on desktop. But even after I remove the config profile, 2 Macintosh HD icons remain. Is anyone else seeing this? Are you using a simple script to re-hide one of the Macintosh HD icons?

I haven't been able to find a definitive answer to this as I research Jamf Connect for our environment (although I suspect the answer is "no"), so I thought I'd double-check here. When you have Jamf Connect Login deployed and enabled, are you still able to log in to a Mac when that device is offline? Or is there no credential caching of any sort, and you must be Internet-connected for each login, no exceptions? Let's assume that a) this is not the first time that this user is logging in, and that b) this is a primary user for the computer (if this matters). We are using OneLogin as our IdP. Also, can the user enroll/continue to use Touch ID with Jamf Connect Login (assuming all regular Touch ID requirements, i.e. no Touch ID after reboot, length of time since last authentication, etc.) Lastly, I'm assuming that if we decide to use Jamf Connect Login ONLY for onboarding (with Internet connectivity), and afterwards transition to using ONLY Jamf Verify fo

Anyone had any luck creating a PPPC profile for the Teradici PCoIPClient.app ? I am not having a problem deploying the .app, I basically have a policy to place PCoIPClient.app in /tmp and then copy the .app into the /Applications folder. PCoIPClient.app launches, but after quitting, I get this (see the attached .png): TeradiciUSBRedirection wants to make changes. So here's what I get dragging PCoIPClient.app into PPPC Utility: com.teradici.swiftclient identifier "com.teradici.swiftclient" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = RU4LW7W32C So that TeradiciUsbRedirection exists here: I have made a profile with the above information from the PPPC Utility, but it seems I get the same behavior with TeradiciUsbRedirection requesting administrator access to do something. Definitely have a case open right with the vendor but I figured

Hi Guys, We got the Kerberos SSO extension up and going on macOS Catalina, and so far so good on the initial login. After rebooting or just signing out and signing back in the extension says "Updating"... forever. Any ideas?

I have an extension attribute telling me if a configuration profile is installed and I have a smart group listing all the computers with this extension attribute. The problem is extension attributes populate with an inventory update (which we have set at 24 hours). Is there a way to trigger an inventory update when a computer gets the configuration profile so we do not have to wait?

Hey Guys, I'm unsure if this is a defect. We have a restricted software setup in our JSS where the installation of OSX 10.11 is blocked for computers that falls under two different smart groups. We see no issues with this. But when a computer was part of these smart group previously and now moved out of the group, the Restricted software should no longer be applicable for the machine. But when the user tries to install OSX 10.11.3 is still says its blocked. Even if I manually exclude the machine from this restricted Software and run a recon it still says its blocked. Any idea what is going on here? Please let me know. Thanks, Ravi

Does anyone have an updated method for disabling or suppressing the Keyboard Setup Assistant in macOS Sierra? The JAMF provided script no longer works (I get an "Operation not permitted" error). We're using third party wired keyboards as Apple removed the ability for resellers to supply wired keyboards with new Macs. Thanks,Dan Jackson (Lead ITServices Technician).Long Road Sixth Form CollegeCambridge, UK.

I’m getting installation errors from the Jamf push and trying to install the pkg manually. The admin machine I created the pkg on and my target laptop are on the same OS 10.14.6. I am using Jamf Admin and Composer 10.11.0. The application I’m trying to package is Cisco Anyconnect VPN with only Umbrella enabled, the rest of the modules are left disabled. Along with a json sheet that needs to be placed in opt/cisco/Anyconnect/umbrella folder for the Umbrella profile. On the target machine I get the same results no matter if a previous version of Cisco anyconnect is already installed or not. I have tried both ways with a direct install, cache first then install, cache then install at start up. I get the same errors each time. I have tried to use different Cisco Anyconnect version. The newest I have is 4.8.02042 and I also tried with 4.5.05030. Again with the same errors. On the target machine the Jamf log is similar to the message in the Jamf portal with a generic error. With

So I assigned a Mac via the Apple School Manager to our Jamf MDM server. In Jamf PreStage Enrollments I now see this newly assigned device. However, when I try to add this Mac to a Static Computer group I cannot see it. Our hope is that as we assign newly arriving Macs via the Apple School Manager they will show up in PreStage Enrollments and then we will add to a Static Group that has all the policies that we want to apply including AD binding. Of note, this newly assigned computer has not run through the setup assistant yet (for the purposes of this discussion let's say it is still in the box and never turned on) What are we doing wrong? Thanks.

Hi all, I'm curious to know if anyone ever successfully configured Outlook 2019/365 with G-Suite Email, Calendar, and Notes? Reason being, I am able to sign in (my institution uses SSO for authentication) which for some odd reason constantly requires me to authenticate repeatedly. I tried 365 support, and got nowhere with this. Hoping someone in the community has had better luck?

I'm having a problem where jobs sent to a printer on a Windows print server show "casperread" as the owner. This happens to be the username for my Casper File Share read only account. If I manually add a printer to a Mac, the owner displays correctly, but if I push the printer out through JAMF, the owner is casperread. I inherited this system and this has probably been going on for years, but it's suddenly a problem now that we're implementing Follow Me Printing from PaperCut. Any ideas why this is happening or where it's coming from? I assume the push from JAMF is somehow associating the read-only user name (used to retrieve the driver package) but I have no idea where that setting would be. JAMFPro 10.13.0MacOS 10.12-10.14Windows Print server 2008 R2

Does anyone have any experience managing the forticlient preferences? I've had success modifying the plist but the values are replaced. The plist is also stored non traditionally and is just called vpn.plist and I'm not sure if I can use a config profile to force it keep the values. On top of this the config profile will show the values being set like server ip, user, and password which I would like to keep hidden for obvious reasons.

Hi Everyone, I am looking to create a custom attribute to display "Citrix Files" version and was able to get the version by typing the following command: "mdls -name kMDItemVersion /Applications/'Citrix Files.app'" Any good documentation on how to display this to a custom attribute? My end goal is to create a smart group to show which computers has older versions of "citrix files"

Hello everyone! We recently deployed 250 iPads to students for distance education with another 600 coming down the pipeline in the next few weeks. As we handed out devices we made note of who picked them up by name / domain email address. Is it possible to convert this to a csv and upload it to JAMF alongside the corresponding device serial numbers? Also: How can we unassign users from an iPad in bulk? Right now our workflow is to click into each individual device, select User and Location on the left sidebar, then remove the 3 populated fields.

When I install an app via Self Service, I like to put a line in the 'Files and Processes' section to open that App after its installed. I was using 'open /Applications/Utilities/thouleapps/MyGreatApp.app' However, That app launches, but can't request admin rights - I suspect because it was no launched by the current GUI user, but launched by Casper. If I quit the app, then launch via double-click, then it works great. I've also tried osascript yada yada with no success. How do you guys open an application for the user via Casper?

I've been trying to adapt our computer naming script to wait for input from the user by cobbling together information fromhere and here and probably a few others, I can't seem to get it to work. I just can't seem to figure out what I'm doing wrong, maybe there's an easier way? Can someone take a crack at it? Original script that works (however if someone's not staring at the screen and they miss the prompts, then the names get messed up) Also, if you can happen to fix the part at the top I commented out that looked at the machine type (laptop/desktop) and automatically puts in the correct type - that would be awesome :). identifying data in script removed due to internal security requirements - but scrubbed version below retains the syntax and just made generic #!/bin/bash set -x # jamf recon loggedInUser=$(stat -f%Su /dev/console) loggedInUID=$(id -u $loggedInUser) if [[ "$loggedInUser" != "root" ]] && [[ "$logge

Hi Guys! I've been reading material, and watching the "Don't Forget Your Bade! | JNUC 2018" video, and I see the speaker did Attribute Mapping with this file: /etc/SmartcardLogin.plist Basically I'm trying to figure out how to get this information below into Jamf to deploy to systems... /usr/sbin/sc_auth identities | awk '/PIV/ {print $1}' | tr '[:upper:]' '[:lower:]' | sed 's/.{8}/& /g' | sed 's/.$//g' /usr/sbin/system_profiler SPSmartCardsDataType | grep -A5 "$hash" | awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/ {print; count++; if (count==3) exit}' | fold -w67 > /tmp/temp.pem UPN="$(/usr/bin/openssl asn1parse -i -dump -in /tmp/temp.pem -strparse $(/usr/bin/openssl asn1parse -i -dump -in /tmp/temp.pem | awk -F ':' '/X509v3 Subject Alternative Name/ {getline; print $1}') | awk -F ':' '/UTF8STRING/{print $4}')" /bin/cat > "/etc/SmartcardLogin.plist" << 'Attr_Mapping' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-/

I'm looking for suggestions or workflows on deploying network profiles before or after our enrollment process. Our setup:• Jamf Cloud• ADCS connector• DEPNotify We don't currently have a provisioning network yet but is in process, so we use dmz/external-facing network connections for enrollment but the network could switch during the enrollment if the profiles deployed during the enrollment or depnotify process and potentially cause an issue. I tried to find a way to trigger the config profile after depnotify but did not see a way to do using smart group criteria. any suggestions or ideas? Thank you!

Tell me if this is silly, but I use one machine (a Mac Pro) as my "master" machine to create packages (pkg and dmg) for use on my labs. This machine is getting a little conjested so I'd like to somehow backup all the items in Composer and move them to either another machine or wipe this machine and reinstall them back down. Am I crazy for having captured these packages this way or is there a way to "move" them? I'd really not like to have to re-package all of these tiny apps.

Hey Guys, We did our Jumpstart last week, and really happy with things thus far. We'd like to now try and do some logins against Active Directory, but are unsure on how to do this. We use on-premises Active Directory with smartcards for our Windows machines. In summary trying to accomplish the following:1) Login to Mac using AD credentials.2) Eventually do this with Smartcards. Any info or direction would help. Thanks!

Is it possible to mount SMB shares on to the dock using Dock items in Version 9.3 ? We have mapped them as a file so smb://URL/Folder but they never apply they're SMB due to our NetApp appliance being SMB only. If not does anyone have a better suggestion on how to do this effectively Thanks

Hi all, I'm looking for a way to find Microsoft Office 2016 application version numbers through terminal. I will be using this in a script to push updates. I'm thinking of having 4 scripts (one for each Office product - excel, word, ppt, outlook), and 4 Policies that have triggers to install each program. Ideally, the script will look for Application versions, if the version found is outdated, it'll trigger the JSS Policy to install the office pkg. Currently, we use smart groups that search for outdated version numbers and sort by departments, and it's a pain to change 50+ smart groups (due to the large amount of departments we have) when a new version comes out. We want to retain the option of doing by deploying by department.

Greetings,I'm trying to populate an EA by reading a string of text from the hidden .identity file (located in /Library/Application Support/CrashPlan) that is created when CrashPlan is installed and configured for a user. From what I can see, the user account that is configured is in the last line of the file. I need to get some of that string in an EA. The string looks something like this: "username=johnsmith@domain.edu". I only need the "johnsmith" part of the text. I believe this can be done using the cat, grep, or sed command(s) but I am not sure where to start. Any help would be much appreciated.

JAMF newbie here. This is my first post ever on JN...yay! Been using Munki for years, changed jobs and now I am becoming a JAMF guy. Ha. Anyway......... Has anyone used the jamf-migrator tool? (https://github.com/jamfprofessionalservices/JamfMigrator) When doing a migration, is the migrated data removed from the source server when it is moved to the destination? Thanks!Scott