Hello We have started to enroll our macbooks for our employees without adminrights. Yes we have the privilege access configured in jamf connect, but don't want use it for everyone :) So i started to configure what is necessary for our employees that they can work without adminrights. So far so good. Now i am actually helpless with this one problem about creating a symlink via jamf pro policy after installation of Visual Studio code. What i need is: A symlink in the directory /usr/local/bin/code which points to /Applications/Visual Studio Code.app/Contents/Resources/app/bin/code   So i am able to create it, but it isnt working. Checking it on a testmachine the symlink shows me in the "get info" as "Original" the path /usr/local/bin/code  instead of /Applications/Visual Studio Code.app/Contents/Resources/app/bin/code   So its not the first symlink i create but its the first in this location /usr/local/bin/code so maybe i am doing something wrong. I am using this sho

Hello Jamf family, Is there a script that can uninstall apps like in Intune? Thanks, JM

I have deployed BeyondTrust's remote support client to my test machine. However, if I set the configuration profile to Allow Standard Users to Allow Access for ScreenCapture, the app doesn't seem to realize it's been authorized. It continues to prompt to allow. Even if I check it with an administrator account. As you can see in the screenshots, even the Accessibility and Full Disk Access are also showing denied, even though they are set to allow in the configuration profile.The fun part is (on a fresh image) if I set the ScreenCapture to Deny, then use an administrator account to allow while on the computer, it actually does allow it.

Has anybody been able to configure the Apple Intelligence Report section in Privacy and Settings?

Hi eveyrone, Rookie here. how can I upload a larger than 5GB pkg to jamfCloud?  With Jumf Sync the max is 5GB. I checked the log and I get below. Failed to copy Adobe_AE to JCDS (Jamf Sync): dataRequestFailed(statusCode: 400, message: Optional("EntityTooLarge: Your proposed upload exceeds the maximum allowed size - max allowed size = 5368709120")). Adobe After Effects on its own package is 6.38 GB.    

I am trying to renew the certificate on my IIS distribution point on a Windows server.  The documentation has changed recently and the new documentation seems to have left out the part of making that request in the Certificates snapin in mmc. I can get part way through from memory but I know there were some other settings that I cannot recall.  This is the documentation updated in October of 2024... https://learn.jamf.com/en-US/bundle/technical-articles/page/Using_IIS_to_Enable_HTTPS_Downloads_on_a_Windows_Server_2016_or_2019_File_Share_Distribution_Point.html Does anyone have a printed out copy of this page prior to the update?  I recall that it was step 4 where they talked about making the request that I need to do.   Thank you in advance for any help.

May be a silly post but I thought I post here for some ideas if any. So i been tasked to create a green colored folder on users desktop that contains "X file". I can get this working on my local system but when I package it and deploy it to another system when the folder installs on the new system the color reverts back to default. Basically it seems like the custom folder color settings don't carry over. I've tried installing the folder in a shared location then creating a colored alias still no go. I've also tried creating a custom green icon folder and trying to redirect that icon to the shared folder location but even that is proving to be challenging. has anybody ever had to tackle a silly task like this? I've been at it for a few days already maybe I'm overthinking?

Hi everyone, Does anyone have experience switching Apple accounts when renewing a VPP Server token? What is the impact on applications? Can we have more than one Apple account for the VPP Server token? Thank you.

Hi all,    can someone confirm this for me, (those who use sandbox) Does this have it's own JCDS??   so, if i connect via the sanbox, it's not conecting to our live cloud jcds??   TIA

In Apple's macOS Sequoia 15.0 release notes the following is mentioned: "Executables, scripts, and launchd configuration files can be installed using MDM and stored in a secure and tamper-resistant location." How does this work in Jamf? I have searched but could not come up with the answer. Has anyone been using this and if so how do I configure a tamper resistant location?

Greetings admins! I wrote a custom migration script that reads several aspects of the users home folder and backs them up to a user specified destination.  That part seems to be working OK, but when I go to write this data back to the same locations on the user's new system, it needs full disk access to work.  My idea was to have the script run directly from Self service (Policy > script execute), but in order to do so, Self service needs full disk access to be able to write back to the users Library folder.  What PPPC do I need to create to allow Self service to have full disk access?

Just thought I'd loop you guys on a nice tool. If you're here, you're running an MDM with probably a high amount of Apple devices. Your enterprise is then too probably running macOS caching servers to save on bandwidth etc. Currently there's a couple widely used tools for monitoring your caching servers like ErikNG's Cacher (https://github.com/erikng/Cacher) and krypted's precache (https://github.com/krypted/precache). Just wanted to let you guys know about one more that I found particularly helpful. Netdata (https://github.com/firehol/netdata) by ktsaou at Firehol is a free/great tool for monitoring all types of Linux/Unix type devices. It also can monitor some more basic functions of macOS machines. Recently he assisted me with writing a plugin to also help with monitoring the caching function on our caching servers. (https://github.com/firehol/netdata/issues/2766) This in conjunction with prometheus and grafana, has allowed me to monitor historicals, create alerts when something

I've setup an API role to Read Smart Computer Groups + Read Static Computer Groups but when I try the script (at bottom) following I get this result:-  Access token obtained successfully. {   "httpStatus" : 401,   "errors" : [ ] } I'm fairly new to the API side of things so might be the script is inaccurate.  My Questions are:- 1) If I go to JAMF_PRO_URL/Api what do I put for username and password (screenshot below)? Is this an account that has access to the Jamf Pro instance or should this be client id / secret or something else?  2) What privileges do you need as a user in Jamf Pro to be able to run these API calls?  3) Is there something wrong with the script below? If I do echo "$access_token" should it show details or would it be normal to get a response like "Could not extract value..."    For the script below I changed JAMF_PRO_URL to URL for Jamf Pro instance and CLIENT_ID + SECRET to details of the API Client.      #

What is Sovereign Cloud in the Setting > Global > Device Compliant used for?Is it just a text box that we enter anything or leave blank or the connection setting to ITunes  

Guys, In my environment I got 85 devices enrolled in Jamf using User initiated Enrollment because my organization did not have ABM and that's why user initiated enrollment did for those 85 devices. Now my organization going to bring rest 30 - 40 devices unmanaged devices to jamf through ABM by enrolling through ADE. In case If I bring those 85 devices to ABM and assign the ADE profile to those 85 devices, shall I run the reenroll command to enroll through ADE or I've to do the factory reset and initiate the ADE. Kindly advice

Jamf Connect has been working in our environment for a few weeks, but we've run into some issues with MFA with security keys.On a computer undergoing prestage enrollment, an SSO window appears prior to configuration. MFA works without issue. After prestage completes, the SSO window appears again. At this point, it should be creating the local account, and connecting to AzureAD. However, if the account is authorized to use a FIDO2 security key, the MFA page will hang.Following this guide, I was able to get MFA working successfully for most logins without issue even with a security key authentication available except when logging into the computer. For all other logins, I don't run into any errors on MFA unless it's when I actively choose Windows Hello/Security Key.

Hello,   I work for a large Fintech company and currently we have our macs enrolled in their JAMF with all their security endpoints. The company I work for is splitting off from the larger company. Me and another guy have been building out our JAMF and it's going well, it's looking to go live May 2025 with some of the first actual enrollments as the migration kicks off but obviously will be testing it more thoroughly first.   The discussion now is how to create the smoothest transition for the users. One method is to erase all the macs and have them enrolled clean in our JAMF. This is the one we want to do. The second method being pushed by the higher ups is to remove the JAMF framework, get all the security software uninstalled and leave no trace and make sure they all work. The issue with that one is we are not admins in the current company and do not have access to the removal of the security endpoints so we either need to ask for the all the passwords (not likely) or have

Does any one happen to know how to structure a config profile for plist settings for Microsoft edge https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies   The aim at present, is to enforce safe browsing, prevent incognito mode and prevent deleting browsing history. As this helps curb miss use of web browsing as kids realise, they can't hide where they have visited.

Part of our Mac hardening, we have to have the BT icon show on the menu bar. All our Mac's are mostly Ventura with a handful of Sonoma. I don't see anything in to Jamf to allow this. I have a command that when ran locally via terminal, it'll add the icon, but if I create a policy using the Files and Processes>Execute Command, it won't add it, but the according to the log on the device, it was successful.  I've also tried using a script, but the script won't add it either.defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Bluetooth -int 2

Job posting: "... You can write production-quality code for automation in Python, Bash, or similar languages" I've written some scripts, but nothing significant like the open-source projects we all use. I can modify what I need from other sources to get stuff done. What sort of 'production code' have you used or written? Where would I start to write something?  Seems everything I can think of exists I'm not nearly experienced enough to contribute to nudge or super, etc. If you have a code repo, where'd you get the experience? I guess I'm having a rough day after being passed on job after job and the only factor I can figure is I don't have the programming experience as a sysadmin

I am having a little brain fart here, but I'm sure it's simple. When I run this jamf policy using the event flag from Terminal, it runs just fine (probably because it prompts for my credentials). But if I try to run it from self service, I get an error that a Terminal is required for the password. Script: #!/bin/bash #Find current logged in user loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) #Runs SysDiagnose as Current User su $loggedInUser -c "sudo /usr/bin/sysdiagnose -u -f ~/Desktop/" Error: I want users to have the capability to run SysDiagnose from Self Service, without it prompting for a password.

We have a user who wants to run iMovie and Music on an iPad managed by JAMF.  They want to make promotional videos with iMovie and use Music to create playlists for events at our on-campus art museum. Both require the user to sign in with an iCloud account to launch the App (correct me if I"m wrong, I'm not a wiz at all this).  I don't want to encounter Activation Lock with this iPad so I'm wondering if a Managed Apple ID is the solution or if an email address that we create for the user (and know the password once they use it to create an AppleID and iCloud account) is the correct method. WWW research has not yet revealed this particular situation; can someone wiser than me offer help?

There is a notification in the Jamf Pro console showing that the Push Notification cert will expire in x days, but I can't find the option to send me an email to prompt me to take action. I do not live in the Jamf console! If this does not exist, does anyone have any suggestions for implementing a reminder/alert/notification externally to Jamf?  Thanks! 

Hi there,Does anyone have a working method of disabling FileVault maybe through a script? The FileVault user is not the prestaged local admin account but the users themselves. Most likely this will require input from the user which is completely fine.One of the ways of doing this I thought of but may not work is to enable FileVault on the prestaged local admin through a script and then turn off FileVault alltogether but I'm just checking if anyone else dealt with this issue in a more graceful way.

My district has been using Jamf School for several years now and we love it.  It is much better than the MDM we had previously, and made our transition to 1:1 very easy.  We are considering an upgrade to JAMF Pro to get access to possibly some more features.  I would love to hear some feedback from some who maybe have used or have knowledge of both and get your thoughts on whether we should do the upgrade.  What are some of the perks of pro that would make the upgrade worth it. Thanks in advance.