I am looking for a way to remove a firmware password via JSS policy. I work for a school district and we try to lockdown the computers so that the student don't have access to the recovery panel amongst other things. The problem is that there seems to be an issue with at least one of the computers not recognizing our firmware password, so we have no access either. Is there a way to do this using the built in policy (under accounts), or am I going to want to write a script based on the firm passwords article? Possibly helpful information:MacBook Airs (Mid-2011)Lion 10.7.4 and some 10.7.5current JSS 8.61

Hello !I made a smartgroup for macOS greater or equal to 15 Sequoia. It should be simple:Criteria: Operating SystemOperator: matches regexValue: ^1[5-9]I have NO computer running Sequoia, but I have 3 results. 3 Intel computers with macOS version 10.14.6 (2 of them) and 10.15.7 for the last one.I searched all around and can't find where is the problem. I'm not really used with regex, but this one should be simple.Any help is welcome

Hi! Please! I'll need to know what SQL syntax I need to run in the Mysql database to get the scope (and also exclusions) of profiles and policies. Thank you very much

When we open a policie and look at the logs which computers are completed or failed the button under actions called details is not working anymore. The button next to it called flush i functioning just fine. Does anybody noticed the same problem ?? we are using jamf pro cloud and i got some mails that there was a update so not sure if it has anything to do with that.

I set up a push certificate with the intention of being able to send non invasive messages to IOS devices through the APN and Self Service app as opposed to locking the screen on a user. Notifications are typically temporary so in order to verify they are seen by the user, I would like to change the notification to persistent so it doesn't go away until the user views the message. I see in the IOS settings menu for the Self Service app, I can manually change the notifications to persistent but I don't want to touch each device. Is there some XML I can add the Self Service app in Jamf that would be associated with the app level notification settings? Or is there another way to do what I want?Thanks,Rob 

we execute a script that prompts them to enter their current Mac login password along with the 6-digit PIN they wish to use as their password moving forward. Upon setting the Mac login password to a 6-digit PIN using the script "sudo dscl. -passwd /Users/"$LoggedInUser" "$currentPassword" "$newpin, successful password conversion occurs. However, post-restart, users who are logged into iCloud receive a prompt stating "This Mac can't connect to iCloud because of a Problem" and are asked to log in to iCloud again. Additionally, the Touch ID configuration removes previously added fingerprints, necessitating the need to reconfigure Touch ID and log in to iCloud after setting the password as a PIN and rebooting. Has anyone seen this or any hints about this

What is the best way to stop the macOS Sequoia install app from downloading automatically? The problem that this creates is when non-admin users try to upgrade to macOS Sequoia, the install app launches. The install app requires an admin user to run the install. If the upgrade is done entirely through Software Update, a non-admin user can run the upgrade. The install app doesn't launch since it wasn't downloaded. This was an issue last year when I opened up upgrades to macOS Sonoma. I had to create a policy that would temporarily elevate users to admin. They would be demoted back to a standard user at the first check-in after the upgrade. This worked well, but I prefer not to have to do this again.

I believe Scheduled updates should work, but I probably did something wrong.So, I created a smart computer group where I added my machine. Then, I opened software updates and tried to force macOS updates for this group (I have used different flags to force the update). My machine is Apple Silicon (m1). I don't see a proper way to check scheduled updates on my machine, so I use API (v1/managed-software-updates/plans) for it.In answer, I see already 14 plans, and most of them failed with the error "EXISTING_PLAN_FOR_DEVICE_IN_PROGRESS" .That means at least the plan should be executed, but nothing happened.What did I do wrong?{ "totalCount" : 14, "results" : [ { "planUuid" : "09487431-7d17-4c4f-baa2-5b5d03f7c076", "device" : { "deviceId" : "579", "objectType" : "COMPUTER", "href" : "/v1/computers-inventory/579" }, "updateAction" : "DOWNLOAD_INSTALL_SCHEDULE", "versionType" : "LATEST_MAJOR", "specificVersion" : null, "maxDeferrals" : 0

Hello,   Apologies if this is not the right place to ask questions like this. I tried searching before posting, but did not find anyone else already asking about this recently.   I have set up a prestage enrollment with the option "Minimum required macOS version" set to "Latest version based on computer eligibility". I thought that this would update a computer to the latest version of macOS that is compatible with the device, but it seems to just install the latest version of macOS that came with the device. In my test case, I am using a MacBook Air (M1, 2020). When I get to the desktop after the Setup Assistant finishes, the first thing I get is a notification about a macOS update available, which is not what I expected. Here's what I did:1) the MacBook Air had Sequoia installed before, and I used the Jamf management command "Wipe Computer" from the web interface2) the computer reboots, does its thing, and brings up the Setup Assistant3) the prestage enrollment seems to be w

Good morning, simple question about Jamf Connect Deploy & Updates integration in Jamf Pro. Currently my configuration is: deploying Jamf Connect not in the prestage via .pkg (only launch agent) but via the integrated functionality of Jamf Connect combined with the Jamf Connect Login Configuration Profile, as shown in the screenshot. It works. Two questions. 1) In your experience is it a stable configuration? Up to now it has never given me problems, but I would like to update to 2.44 (I'm stuck on 2.39) and since the profile is in scope on All Managed Clients I'm wondering if it's stable and the best option. 2) If I remove this integration in the configuration profile, nothing would happen to existing clients, right?That way I could simply deploy the update via policy and reinsert the Connect .pkg in the Prestage, just to have more control. What do you suggest? If the integration works well in your experience i could simply choose the new version and keep this configuration :)Tha

I've tried deploying Mohs Surgery iOS app(https://apps.apple.com/us/app/mohs-surgery-appropriate-use-criteria/id692790649) to managed Macs through Jamf Pro w/o success. I've made sure to match the short version, bundle ID, and app link. I can deploy this to iOS devices just not Macs.I've confirmed on a vanilla M1 unmanaged Mac that it works through App Store.Through self-service it attempts to install but spins infinitely.Through automatic install it shows 1 license used but never shows up in /Applications.Included below are the configs for Mac and iOS:

Very recently we've had some users who have upgraded their version of macOS beyond Monterey up to Ventura or Sonoma (I know, we need to get away from it ASAP, but we're stuck a bit longer because of the Microsoft/Adobe SMB hidden file issue).Our staff are all standard users and do not have admin access to their computers. In the past, any attempt to upgrade macOS to a new version would not be possible without entering admin credentials.Why is this suddenly being allowed to happen and what is the best practice using Jamf to prevent it?

Hi all, Having a bit of a struggle figuring out how to package and send out an application without having user have to sign in to an apple account. See image attached. Is there anyway in composer to bypass signing with an apple account to open the app?

Hi  Can someone please help me with the nudge custom launchagent? I am trying to run Nudge in every 3 hours instead of default 30 mins.  So far, I tried to edit the .plist file in /library/Launchagents and repackage Nudge from Composer and deploy from JAMF, but no luck so far. Got the error saying unable to move files in final destination while running policy.   

Background information: I need to mass remove all devices from all groups via api I've been reading through all the API Calls available from jamfs /api page, i've come to the conclusion if it would be anywhere, it would be here [https://ENTERJSS.URLHERE] :8443/api/#!/mobiledevicecommands/createMobileDeviceCommandURL_post but via "Delete" (assuming a Remove From Groups Option is an available command) instead of "Post" but "Post" is all that's available. Am I missing something? Does anyone know of a way to remove an iOS Device from all static groups via API Call? Thank you

Hello everyone, I hope you are well and can answer my questions.   We are currently on-boarding a new client and they are using MaaS360 at the moment with another MSP. I have everything just about finished up in JAMF, except Auto-Enrollment which requires connecting to the Apple Business Manager Server. Once I do, that is usually what bring in the devices (If I remember correctly). If the devices are currently already setup with a MDM profile on them with another MDM service provider, would that be interfered with if I would setup the connection between ABM and JAMF? I am wanting to make this transition seamless and have zero down time as the customer works 24/7 and needs access to these devices.  I have only done setup of new users to JAMF and not migrated from another MDM Provider. Any insight would be helpful.    My Plan was to have the users setup and tie that to Groups and profiles so that when he sees the users account it downloads the appropriate profile and

We are a young company and have been on Jamf Pro for less than a year. We were not able to start our operations with Apple Business Manager (ABM) so we will need to bring our existing inventory (all purchased direct from Apple) into ABM. I have been reading about the process here and I am concerned about the part that says:If you want to add a Mac that’s currently configured, you must first erase all content and settings.Important: All your data will be erased. Make sure you have an up-to-date backup of your data because it will all be erased.We have more than 100 active computers in Jamf. Is there a way to bring them into ABM without erasing everything? I can't see how that is going to go over well with one user, let alone 100+.Needless to say I am looking for some guidance (and hopefully some reassurance) that there is a better way.

I would like to stop spotlight from indexing certain locations across all my Macs. I need it to stop indexing the mounted network shares. Is there a way to do that? I could not find a setting regarding that in Jamf Pro.

Would there be any issues with using the same ABM account to manage volume purchasing across multiple Jamf Pro servers/instances? Any particular reason you would want to avoid doing this? I tried searching for similar questions here and information in the docs, but didn't find anything relevant. Thank you.https://docs.jamf.com/10.26.0/jamf-pro/administrator-guide/Integrating_with_Volume_Purchasing.html

Hi folks Has someone found a solution to disable the auto update check function in deepl.app?I tried already with  preference domain: com.linguee.DeepLCopyTranslator <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>autoUpdateEnabled</key> <false/> </dict> </plist>  and searched also for some other plists but had no luck to disable this function. The problem is all releases which are published to the user via app directly do not correspond with the main releases which are published directly from the developer.And our user without admin rights cant update it.Privilege Access via jamf connect is not an option for this :) I cant use also Installomator for it, because the URL is the one for the main releases. THank you in advance J

My end user noticed the option to type part of a URL or term doesn't function after I configured Chrome as she requested.  Either I'm enforcing something that disables it or I have to enable a key, but can't find what it's called in the Enterprise documentation.    <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>AutofillAddressEnabled</key> <false/> <key>AutofillCreditCardEnabled</key> <false/> <key>BrowserAddPersonEnabled</key> <false/> <key>BrowserSignin</key> <integer>0</integer> <key>DefaultBrowserSettingEnabled</key> <true/> <key>DefaultSearchProviderEnabled</key> <false/> <key>DefaultSearchProviderName</key> <string>Google Search</string> <key>DefaultSearchPr

I am looking to change all of my users System preferences --> General --> set 'Show scroll bars' to 'Always'. I didnt see it in "managed Preferences" so I am wondering how to set this in jamf for my users.

We have been working with Jamf Pro / Jamf Connect for a while now. Jamf Connect is set up with our Azure instance and works perfectly well. Now we also have a separate Google Workspace and we are trying to configure Jamf Connect for it. I have downloaded the latest version of Jamf Connect which i'm pushing to the devices which will need to log in with their google credentials. However, upon installing Jamf Connect and restarting the device, the apple logo appears and the loading bar gets stuck mid way. After some time, the logo and bar dissapear and I can see the mouse, however the rest of the screen is black. When I click on the keyboard I can hear sounds. Anyone else encountered this issue and managed to solve it? Or maybe someone can assist me with what I can troubleshoot? The Jamf Connect Package is being deployed via Jamf Pro policies. Mac OS versions tested on Sonoma and Ventura (both same result)

Hi All   is there anyway that Email address in entra can be claim on credential for Jamf connect instead of the UPN in entra? or have both? Thanks

Hello Team,  What a good new !?  Security and Identity teams will certainly appreciate the implementation of an AD CS connector utilizing outbound communication. Excellent ! 🥳 As explained on the release note, the outbound mode requires Jamf AD CS Connector 2.0.0.  Could you please make this version available, at least on the feedback program ?