I'm surly missing something simple. I am trying to update the Adobe CC and Adobe Acrobat (with CC) packages in JAMF. They keep failing with the response being to contact the vendor, and the install log is saying there was an error with executing the packages scripts. Downloading the downloader for a managed package from the Adobe Admin CenterDoing all the random steps to download the package with the adobe package downloader app that comes in the .dmgUploading the install.pgk to JAMF (JAMF auto zips the file when uploading)Putting the install.pkg.zip in a policyTrigger the policy and fails every time.If I run the package locally on the device it works like a charm. Before I break down and put the installer pkg in a pkg and run it with a script, does anyone have any idea what I missed?

Any one notice if you install Self Service+, it re-triggers enrollment complete / first time login policies?

I am using the Make Me an Admin : https://github.com/jamf/MakeMeAnAdmin I'm having 3 questions/concerns:• It is not reliably creating a log?• Is there a way to get the log to me or at least a notification that the policy was run?• Is there a way to block them from creating additional admin accounts while they are an admin? Thanks!

Hi all,Im looking for a simple and easy buy user friendly way to restart a mac .. I know there is many options out there .. script .. jamf policy , DEP Notify . .. but have always had feedback from business saying that there are not very user friendly. I have been tasked to see if i can find a friendly way to restart with less user interaction or at least a deferral ..Any idea is much welcomed..rk 

Hello Guys,   We are using Jamf Pro as an on prem. Tomcat ssl certificate's expires very soon.I did renew the ssl  new certificate than restart tomcat service. But users were not able to connect to self service. Actually I deploy the new certificate to clients via  config. profile. I can see the current new Certificate in the keychain. For testing, test device was connected to self service when I set the new certificate to always trust.            

Hey all, I've been stuck on this for quite a few weeks. Our JSS servers were moved from one location to another. Since then we've had to redo numerous things. The last being TomCat. The boxes used to be behind a load balancer, now they are not. Anytime we navigate to our jss site, it says it is not secure over https and another issue is any policies with packages trying to push, fail due to it not being secure and not being able to make the connection. If I go into TomCat and "Change the SSL certificate used for HTTPS" -> Next -> I've tried "Generate a certificate from the JSS's built-in CA. Restarted the box. No different " Same steps as above, only this time, "Upload an existing SSL Certificate" -> our network guy pulled the cert we use for other servers. Anytime I try to upload, the second part where it asks for the password, it does not go through. This password works on everything else. Tried redownloading it from the s

Hello, We need to have ways to troubleshoot SSO connections. It is activated on my beta instance since it's available. I log in though SSO, yet, Compliance Benchmarks or Blueprints tell me I need to log in through SSO... This is not only annoying, there is absolutely no way or log to understand why this happens. I can only imagine issues when this rolls out at scale. Who should I talk with to troubleshoot ?

I am trying to figure out a way i can use the profile command to remove a user profile that was installed by JAMF. The profile is used to add a AD generated user cert to connect systems to our . WiFi. For various reasons this cert breaks or gets removed. I was hoping to build something in self service user can use to remove the profile and re-add it forcing a new user cert to be generrated. But im having zero luck i get a profile not found error using sudo profiles -R -p "profiles ID" Error:profiles remove for identifier:'Profile ID' and user:'Username' returned -205 (Unable to locate configuration profile.)

Hey, since last week we can not remove the Restriction Software settings from Mac Clients. We run Jamf Pro Version 11.13, most Clients are on macOS 15.3.1 Removing Clients from the Scope does not remove the Restriction Setting from the Clients. New Clients enrolled to the Site formerly in Scope of the Restriction get the Restriction Setting ... Should I delete the Restriction Rule to remove it from the Clients? Thanks in advance!

HiI can't find any documentation on the new "Autonomous Single App Mode apps" restriction in the iOS Profiles. Can someone explain me what it does? Thanks in advance!

Basically the title, does pushing the same config profile with different settings applied cause conflicts? Here is a very specific example: Security and Privacy One profile has the firewall turned on and another has the firewall off (not checked). Basically, which wins? Do they fight? We had some weird behavior happen when pushing the same payload multiple times with different settings. Any advise or guidance is appreciated.

TLDR: If Jamf Connect's password countdown isn't updating or Kerberos tickets aren't being received, turn off iCloud+ Private Relay. We recently solved a puzzling issue affecting a small number of users. After password changes, their Jamf Connect Menu Bar wouldn't refresh the expiration countdown (even showing negative numbers) and they weren't receiving Kerberos tickets, despite the new passwords working correctly in Entra and AD. After hours of investigation - trying different Jamf Connect versions, reinstalls, profile changes, and terminal commands like klist and kinit - we discovered the culprit: iCloud Private Relay was rerouting traffic, preventing proper domain resolution needed for Kerberos tickets. The simple fix: turn off iCloud Private Relay and restart Jamf Connect. Both issues resolved instantly!

Aloha Everyone! Account type: Jamf School Not sure if this is the proper place to ask, but I've been working on deploying a custom wallpaper to all of our student MacBooks for a few months now and am hitting a wall. Our previous rep, Christina was looking into this, but all we could find was a solution for Jamf Pro.  I've tried the following: Setting a path and inputting it into a Jamf School Profile Using composer to create a DMG to upload to Jamf School but the file is not supported Using composer to package the image file and deploying through Jamf School - still no luck Script to push out the image file and still no luck (would reset the desktop picture with a stock image) Current environment: Student Restrictions Profile is installed on all MacBooks where they cannot change the Desktop picture. However, this was not in place for years until I deployed it recently. We want to reset all of the wallpapers before the end of the school year, if possible.  If anyone has

Hi all, Looking to upgrade several Ventura machines to Sonoma. Plan is for JP to issue commands to download and install Sonoma and users receive a prompt to reboot to finish the upgrade. Testing hasn't yielded expected results. Leveraging Software Updates in JP with "download and install" + Target version > specific version deploys the upgrade but the machines automatically reboot with no warning or user interaction. Duplicated experience with 14.7.3 then 14.7.4 (after the latter was released last week). Happens with Intel-based and Apple silicon machines. Noticed some prior discussion on the forums recommend using MDM commands. Not sure if the above scenario meets the criteria. Appreciate the assistance.

Hi Nation, does anyone know why some iOS devices are able to set the screen lock time to never and other ones not?I have no idea if there are some configuration profiles or anything else in jamf PRO wich causes this. Thanks for your help :)

Recently I've been trying to extract infos of which extensions our users have on their browsers.I have a script running for our major browsers and it's working great but now I'd like to get more infos that are sealed inside a .json file.Is there a way to extract specific lines from a .json file such as the "manifest.json" you can find in every Chrome extension's folder?Specifically I need only the rows talking about which permission does the extension have as seen below.

Sorry if a little off topic but I need to change my email address assoicated with this Jamf Nation Community.I have looked everywhere but can't see the option.

We’re using JAMF Connect to manage our logins for our school iMac lab, and we’re having a bit of an issue with students changing passwords. I understand that if their network login is changed, they are prompted to enter their most recent local password to sync them up. The trouble is, students typically only have their network password changed if they forget it, meaning they effectively become locked out of that particular iMac.I was thinking that if I can detect which accounts have mismatched passwords, I could write a script to remove the local profile entirely, and allow the student to log in with their network password again. Does anyone know of a way to detect whether or not an account has a mismatched password via a script? My initial plan was to read PasswordCurrent from the local account’s com.jamf.connect.state plist, but that variable only updates while JAMF Connect is running while the user is logged in.

After the upgrade to MacOS 12.3, the Jamf login screen went away, i found that running this command would fix the issue : /usr/local/bin/authchanger -reset -jamfconnectAlthough after creating a policy and trying this through execute command i get the following error:LLVM Profile Error: Failed to write file "default.profraw": Read-only file system I tried the command in terminal manually with sudo permissions and it did work. How can i fix it ? 

Hi all,I just migrated from JamfNow to JamfPro and Im very new here. Im addressing computer's name by a Smart Group with a policy to execute this Script, which is not working for me.Basically I want to use the prefix MBP or MBA, depending on the model, following the SN of the laptop. Any advice or help will be highly value.  #!/bin/sh# Get laptop modelmodel=$(system_profiler SPHardwareDataType | awk '/Model Identifier/ {print $3}')# Get Serial Numberserial=$(system_profiler SPHardwareDataType | grep Serial | awk '{ print $4 }')# Assign a prefixif echo "$model" | grep -q "MacBookPro"; then    prefix="MBP"elif echo "$model" | grep -q "MacBookAir"; then    prefix="MBA"else    prefix="APPLE"fi # Generate computernamecomputerName="$prefix-$serial"echo "$computerName" # Rename computerscutil --set ComputerName "$computerName"sleep 5scutil --set HostName "$computerName"sleep 5scutil --set LocalHostName "$computerName"s

Hello everyone, still a beginner with the 14 days trial.   I know what I want but I don't know how to archive that. I would like to give out a device and the user logs in with his MSO365 account. (name@comapny.com) So the device gets entrolled to "his name".   - Cloud Services connection is on. - Cloud identity provider is configured with our Entra ID. The test shows I can search for users and groups and see if they are part of a group   How do I need to proceed to get the users in Jamf Pro?   Thanks a lot in advance.

Hello - we have iCloud accounts disabled for our staff. However, many of them would like to use Apple Music as a quality of life issue, and some have a longstanding workflow of purchasing music from iTunes for work functions. In my restrictions profile I have "allow Apple Music" checked, however, in my testing I still cannot log in to either Apple Music with a subscription account, or even the iTunes section of the app.  Is there a way to enable Apple Music and iTunes for users without enabling iCloud accounts? Thank you!

We upgraded our on prem Jamf Server from 11.1.5 to 11.13.1 and after that when open Self Service is says "Self Service Cannot reach a JAMF MDM server".When I download a new Self Service from JAMF I just got version 11.1.3? 

We have a lot of users who aren't updating Chrome. How are you enforcing updates and relaunches to apply the updates? 

Morning AllGearing up to role out Adobe 2025. Does have anyone have an EA which would show if a machine has no Adobe installed.I have done this using smart groups before, but gets a bit complicated given the amout of Adobe packages we push out.I already have script to remove Adobe, I was thinking I could then use the EA to build a smart group of machines with no Adobe installed.Thanks