Hey All,Not quite JAMF specific, but wondering if anyone has found a workaround to an issue that came up last week. Since then any of our users (as well as peoples personal machines in their homes) who are using Safari and running 10.14.6 are having issues connecting to outlook. They can all sign in to the main page for 365, but when you click on outlook it just hits loops of redirects it seems like. Only answer I've found is to use chrome or firefox. This does seem like something got changed on Microsofts Server side though since it is affecting machines that have not had a change or update. I saw a piece on Teams specifically having an issue with the "cross-site tracking" feature, but turning that off also didnt resolve the issue. Anyone have a solution? Gabe ShackneyPrinceton Public Schools

We are currently using our test environment for the first time so we can test some things with JAMF Parent, Azure AD integration, etc. In setting it up we need to have a VPP account to the test environment so we can push out the self-service app etc. In Apple School Manager how do we create a new VPP account? We tried using an existing, but we can’t in the test environment unless we move it off of the production server. I have attached our Azure AD to our ASM, we have NOT yet reclaimed the itunes accounts waiting until a message is sent to our community first. In ASM we have created a new MDM for the test instance, downloaded the token etc. I have one of our IT members account created and in ASM already, but his is the only one that does not have a token to download.

Trying to correctly create a profile for Faronics Insight to work properly on 10.14. I tried with the PPPC Utility but it doesn't seem to allow everything that Insight should be allowed to do. Anyone already done the work on this and feel like sharing lol? Gabe ShackneyPrinceton Public Schools

Hello All, Very new and still learning to scripting but I came across this restart reminder script and having issue with the script not restarting the Mac. I want to add a hard shutdown comment due to FileVault and T2 chip but can't find a spot to add it.thanks for you help in advance.

Background:I have a policy in the JSS that runs a script with a series of Jamf Helper huds. These walk a user through the instructions for enabling FV2. However I cannot figure out how to force a logout of the current user. I had this all working really well through self service but our users are being very naughty and not running it from self service. We need to move to something more "forceful". However in our environment we, do a lot of hand holding, as in we have to get as close to 100% of the process being automated or we just make tickets for ourselves. ‘tell application “System Events” to log out’ compiled into an applescript app works in 10.9 but not 10.8, or 10.7 - we are mostly 10.8 with some 10.7 and very few 10.9 machines.Reboot does not kick off the deferral asking the user to enter password.killing the login window is too dirty it also does not ask for the password.local bash scripts don't work.su -u $(currentUser) type stuff is also not working. It

Hi I am looking at using Kanaka for authentication with Catalina. I have the New version of Kanaka, and it works.My problem now is being able to push it out to all of our Macs. I can install it no problem, I think I can get my server list out to the Macs and use them. However I have hit a snag when it comes to the last step in the process...The instructions say to open Directory Utility, and then unlock and in Search Policy, set custom and add /Kanaka/Auth.I have tried to script a replacement of the Plist, but Catalina isn't having any of that. It used to work in older OSX versions.I am left with scripting the change with "Defaults" "PlistBuddy" or "plutil".Any assistance with scripting the change will be greatly appreciated. The un messed with plist from /Library/Preferences/OpenDirectory/Configurations/Search.plist { comment = "Default search policy"; mappings = { }; modules = { session = (

Hello! I am relatively new to Jamf, so I am currently exploring all of the ways I can use it to customize the user experience for my university's computer labs. I have been working with Profile Creator to make custom Configuration Profiles and then uploading them to Jamf. This works great for third party applications, but when I try to use some of the System Settings payloads (for settings that do not seem to exist in Jamf), the payloads disappear when I upload the .mobileconfig file. It is possible that some of these settings are deprecated, but they should in theory be modifying common .plist files. I have tested this with both signed and unsigned profiles. Any suggestions, insight, or advice would be much appreciated! (Please none of the "why do you want to lock down the user experience" comments -- we all have our reasons for managing our spaces the way we do.)

hi, mac os server 10.14.6Jamf Pro 10.15.1 we had to move all our data from old SAN to new one. This has been done and working. We updated to mojave our server with the Jamf pro 10.15.1 We wanted to use now SMB be cause of the new APFS machine we are getting with our new DEP process in place. here what's happening i CAN mount the share manually with SMB credentials i CAN user Jamf Admin and the share CAN be mounted no problem Jamf Remote : error could not mount distribution point Self service : error could not mount distribution point policy with login ; error could not mount distribution point any help ? i tried many things...

I wish there was a way to search inventory just by serial number. I have yet to have that work correctly. Am I missing something, or should I put this as a feature request?

Hi Jamf Nation, We're excited to announce that Jamf Pro 10.17 is now available! This is a significant release for us and we're excited for you to get your hands on the new Google Secure LDAP integration and enhancements to User Enrollment and Enrollment Customization. Read the full release notes here. Garrett Update: On Tuesday, December 3 we released Jamf Pro 10.17.1, a version that mitigates an issue impacting EDU Profiles. Standard Cloud customers will be upgraded to this new version during the previously-scheduled mass cloud upgrade on December 6-7. The new version is available for download on the My Assets page on Jamf Nation. Customers can also request an upgrade by contacting their Jamf account representative. Release notes for this version are available here. Cloud Upgrade ScheduleYour Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.17.1 based on your hosted data region: Hosted Region Begins Endsap-southeast-2 Dec

This just started happening last week. Wipe an iPad, start the DEP/setup process and get to the Remote Management screen. It goes past the screen fine>LDAP account sign-in screen, fine> Profile Installation screen fails with "Invalid Profile" Never had it fail 1/2 way thru the DEP process. I have tried:new prestagereboot primary serverrefresh token on DEP instance Anyone else seeing this? Any ideas?

AD Users. So i have seen this issue on a few of my machines. Were the user is authorized to unlock the machine from file vault but on restart only the local admin is showing up. Turning File Vault off and back on, on the user i want to be able to get in does work. But thats like a day process. Anyone else have any thoughts?

Hi everyone, We're currently testing a modified version of a script (presented below) which we originally found here: https://github.com/Yohan460/Automatic-Secure-Token-Granting-Workflow. To put it simply, this script grants the local admin account (which we deploy and manage via a LAPS workflow on Jamf) a SecureToken via the sysadminctl -secureTokenOn command. The script: #!/bin/bash apiUser="" apiPass="" apiURL=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url | sed 's|/$||') udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') extAttName=""LAPS"" LAPS_User="LAPS" LAPS_Password=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}') Local_User=$(ls -l /dev/console | cut -d " " -f 4) Output="" while [[ $Output ==

I have certain ldap users I need to give access to more than one Site - and don't want to give access to all Sites.. I therefore created a Jamf Pro User Group (non ldap) and gave it specific permissions. The members tab is blank and shows no way to add members. Is there a way to add members?

Trying to block the Vuze torrent app on our machines. I have a Restricted Software policy set up however the process id for Vuze is called JavaApplicationStub, a generic Java application process. I can restrict the JavaApplicationStub process and is works however that also blocks some of the finance software the team uses. I am currently excluding the finance department from this so they that run there software. This is not ideal because no finance department could run Vuze as well. Has anyone found a better way to use the Restricted Software policy to block Vuze in a more precise manner and not block JavaApplicationStub as a whole?

We've run into this frequently enough that I feel like some good feedback might be nice. We don't put local user accounts on our Macs, everyone uses mobile AD accounts. On occasion, we'll have a user complain that their machine is slow/not performing/etc, so we offer to put them into a fresh machine with new OS, typically an SSD, etc. In the past, to migrate their user account, we've just copied files from their user home directory to a network share or to an external drive, then had them log in on the new machine to create their account there, and then bring the data down into the newly created network account on the new machine. I've tried using Migration Assistant in the past, but I've noticed it struggles with the migration and changes the computer name to match the old machine, and sometimes it flat out doesn't work. Does anyone have a good solution for migrating an AD network account from one Mac to a new one, while preserving the user data?

Hi Everyone, I'm having an issue, I know that I can always exclude computers that are provisioned with depnotify to not run these policies in jamf... but I would have to exclude on every policy that runs at the networkstatechange trigger. Just wondering if this is a possibility... while depnotify is going through my installation workflow the networkstatechange trigger happens for some reason (not sure why, i'm connected via Ethernet (wifi is also on but Ethernet should take priority)) Is there a way to ignore the networkstatechange trigger while the dep user is logged in? Also another piece of info... the dep user is not an AD user.

Hi Nation, does anyone know how to activate FaceTime and iMessage for our managed Apple ID in ABM?My searches are not successful at this time and maybe some of you have some experience with it.

Hey guys,I'm need to run security show-keychain-info command to query Keychains information of endpoints. Some of them return User interaction is not allowed although their Keychain is unlocked.Other security commands don't work on those endpoints.How can I fix this now?

I'm trying to create a workflow for our school in which a computer can be booted, will check for available software updates and apply any necessary, and then check in with our JSS once no more software updates are identified. I'm curious if anyone has a solution for capturing the server response from the softwareupdate command? So far when I run: #!/bin/bash su=$(softwareupdate -l) echo "$su" The terminal output is: No new software available. Server response and then: Software Update Tool Finding available software Output of echo "$su" With the server response "No new software available." printing first and without regard for the output of the echoed variable. In other words I only ever seem to be able to programmatically capture "Software Update Tool" and "Finding available software". Does anyone have a solution for capturing the server response from the softwareupdate command?

Hello, I'm very new to scripting and need help getting a specific line from a txt file. I need to get an Adobe Challenge Key for our License renewal process. I figured out a way of packaging the terminal tool kit and running a script to get a text file as the output. Now I'm struggling to figure out a way to get key back from each computer. I just need the fourth line.

Hi, I'm attempting to deploy an Adobe CC Shared Device package through a Jamf policy. The .pkg installer fails however, and /var/log/install.log tells me that the CCP Package Installer (which is invoked in the preinstall script) fails with exit code 81 and the following log messages: 2019-11-18 11:16:51+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : InstallLanguage specified in Info.plist in preinstall...() 2019-11-18 11:16:51+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Launching AdobeDeploymentManager... 2019-11-18 11:16:56+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Exit code of AdobeDeploymentManager is (81) 2019-11-18 11:16:56+01 C02N61WZG3QJ installd[1100]: ./preinstall: CCP Package Installer : Exit ... The package works when downloaded and installed manually. I have also tried to manually compress the .pkg (as both .zip and tarball) before uploading to Jamf Admin, but no success. Adobe's documentation d

In Restricted Software, I am able to block certain apps like Terminal from being launched. I also have exclusions for certain computers as well as local users that are on the computers. The exclusions worked great until I upgraded to JAMF Pro 10.15.1. Excluding computers continues to work fine, but excluding a LDAP/Local account does not seem to hold anymore. With that local account excluded, I used to be able to bypass the restriction and launch the app in question, just like I could with excluding computers. Has anyone else run into this problem?

Hello, I'm about to enable filevault disk encryption for our company's macs, but I wanna make sure I do everything correctly to avoid any problems. And I quite puzzled on what some parameters mean I the filevault configuration profile payload: We chose to only use individual recovery keys for more security so i ticked Require File Vault 2 and Create individual recovery key.Since we need to get those recovery keys back to Jamf, I obviously ticked Enable Escrow Personal Recovery Key but then here's where I get lost.I don't know what is the Escrow location description and the "Record number" message. Plus, I don't know what difference it makes to select whether automatic encryption or manual encryption (then the JSS redir cert). I can't seem to find any infos about this in the documentations.Any clues on what those informations are ? And any advice on how I should proceed to deploy such a thing ? Thanks in advance.

Hi all- ever since xcode 11.x.x I have been having issues with multiple installs of xcode installed on a machine. Sometime it works and my users have no admin prompt to install mobile pkg Other times they are faced with the admin promote to install the mobile pkg. How can there be a consistent way to get MULTIPLE XCODE installs to work on 1 given machine without the requirement of admin rights. I used rbouton scripts and they're have worked till recently... But now it's inconsistent Please help and share any scripts you use to make this happen and use xcode 11.x with admin rights Thanks