Hello community, currently having the issue that we have two different accounts (asm/jamf). for a better experience we want to consolidate these, but not sure what the correct way is and I can't find any relevant articles. all iPads on both accounts are DEP registered. 1. adapt the DEP registration from ASM account 1) to account 2) - then the devices automatically end up in Jamf? (if yes, can we do this on our own?) 2. remove the devices from an account (via ASM) and add them to Jamf via Mac and Apple Configurator 2 or is there another way? Thanks in advance.

Just wondering if I missed something ... Could it be that Apps from the Mac App Store do not work with Smart Groups in Jamf Pro 11.11 ? Since changing the target for some MS Office Apps to a Smart Group, those Apps do not receive any Updates on the Macs in the scope of the Smart Group. The MDM Management history looks like this:   

I'm deploying the following PLIST config to Macs but users can still sign into other OneDrive Business accounts and they can still disable folder backup. Is there anything wrong with the below config?   <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>AllowTenantList</key><array><string>482a4ef9-66e4-4e76-9f24-6da09a713ee5</string></array><key>BlockExternalSync</key><true/><key>DisablePersonalSync</key><true/><key>DisableTutorial</key><true/><key> KFMBlockOptOut</key><true/><key>KFMSilentOptIn</key><string>482a4ef9-66e4-4e76-9f24-6da09a713e5</string></dict></plist>

Dear all, on our Jamf Pro installation, an upgrade from 11.7.1 to 11.9 fails:   1. We first try to follow the instructions here to migrate from Java 11 to Java 21 which is required for Jamf 11.9: Jamf Lernzentrum -> We are not able to stop Tomcat ("failed to stop. exit status 5"). Nevertheless, the uninstallation of Java 11 works, also the installation of Java 21.   2. The installation of JAMF 11.9 also works with no errors.   3. Out Jamf instace https://jss.<domain>:8443/ is not available after the upgrade.   Any ideas?

Hey,  We have multiple sites in our Jamf pro because we are a group of companies. Now we want to assign sites during the prestage enrollment. So, when the user will connect a new laptop with the internet, then it should pop up an option with site names so the user can select which site he/she belongs. Based on that, he will receive the enrollment customizations and policies made for that specific sites.  It is working fine with user initiated enrollment but I can't figure out how to do that with prestage enrollment. Can anyone help? Thanks

HiWe have one student whose iPad is locked down.  Obviously we have to allow access to certain apps so that the student can work, however we discovered today that even though the student has his web browser restricted they are still able to open it when accessing a link from the gmail application.Has anybody come across this before? Thanks in advance!

Just a quick question. I have a problem where I cannot login with a Pre-Stage Enrolled admin account any longer. I was at first but not now. https://community.jamf.com/t5/jamf-pro/cannot-login-with-local-admin/m-p/332899#M281166 I was in Zoom call with a Jamf tech and I am able to login with a Standard Student account. He had me run a command in Terminal and Secure token is enabled for both my Admin account and Student account. He asked for the logs on the mac but I can't navigate to /Var/Logs because we found out that a Standard User doesn't see "Go to Folder..." in the Finder Go. To help him out does anyone know a way around this? He escalated the call to an engineer.I could also create a new policy to create an admin but I thought I would ask her first before I do so. Thanks!

We have discovered a large number of Macs in our fleet that appear to no longer have the Jamf agent installed on them. This may be because users used the "jamf removeFramework" command on them. I have been working on figuring out how we can get these systems re-enrolled. For years I have used the command "sudo profiles renew -type enrollment" command to re-enroll Macs that are in Apple Business Manager. Running this command requires me to interact with the Mac to complete the enrollment process. I tested this a few days ago on my test Mac to take note of everything that happens after the profiles command is ran. We would like to do this in the background silently. We have an agent called Aternity installed on all of these Macs. We know they're in use and active. They're just not connecting to Jamf Pro. Aternity can send scripts to the Mac, and my thought was that we could run the profiles renew command in a script pushed out to these Macs. Are there any options that can be used with th

Hey Jamf Nation! I have a short script set to run once per computer at recurring check in. I am also about tell Jamf to update macOS from 14.7 to macOS 15. I believe individual Macs check for macOS updates as part of the recurring check in (very easily could be wrong!). My question is, which happens first? If a Mac contacts Jamf as part of a recurring check in, and finds out it is due for both a script to run and a macOS update, which does it do first? Thank you all!

I don't know if my subject made sense, but here goes... Most of the software installs we deploy go through a two-step process: cache the installers, then run the installers. I'm testing different ways to run the Adobe CS6 installation (at logout, in the background, at startup, etc.), but to save cooking time, I'd like to be able to cache the hefty-sized CS6 .pkg file from a Mac that has a local distribution point, over either a Firewire or Thunderbolt connection instead of letting it cache from our JSS server. Occasionally we'll push out cached .pkg files through Casper Remote, but it doesn't appear to interact with the local distribution point the same way that Casper Imaging can. Am I missing something or is this not possible through the standard Casper suite? Thanks! JSS 8.62, etc, etc.

Does anyone know if it is still possible to prevent the removal of management profiles on Jamf Pro for iPads?I believe there used to be a iPad restriction to do this. I can't seem to find it now.Any help would be most appreciated. 

How do you guys have your road warriors login to Jamf Connect from public wifi with captive portals?I only have a few users that do this but wonder what the Jamf Connect config setup is like.

I attended JNUC in both 2023 and 2024 and finally have got around to implementing Installomator as per https://www.youtube.com/watch?v=p2J6fTQXIwU.  Lots of people were talking about it and in 2024 was convinced to at least try it.  The implmentation in the video uses two Smart groups. Smart group targetting "Patch Reporting" for the targetted application.  For example, the criteria would be Patch Reporting: Google Chrome is less than Latest Version. Smart group targetting the above group because you can't target policies using Patch Reporting directly as per the video. The first group using Patch Reporting updates just fine.  My issue is the 2nd group does not update correctly.  When I initially save it the numbers match but after testing by updating an app the 2nd group will not update to reflect the number of the 1st group.  The only way to update it is to go in and edit and resave the group.  Then it will update correctly until the next time it

Hello everyone, For the Chrome browser, I've created a PLIST for installing the extension and a second one for configuring the extension, and it works perfectly. That's why I'd like to do the same for Firefox. The PLIST for installation works. But for the extension configuration PLIST I don't know how to do it? I can't find any information about this if it's possible. Here's what I did for Chrome : Preference domain : com.google.Chrome.extensions.IDextension   <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ConfigJson</key> <string> { "backend_servers": [ { "title": "Exemple title", "url": "https://exemple.com" } ], "base_url": "https://exemple.com", "allow_custom_server": false, "allow_registration": tru

I'm trying to install Nexthink by using the script that was provided that has all the information in it. I'm issues getting it to run.  In the path BASE_PATH="/Library/NexthinkInstall" should this be where I'm mounting the .dmg file? For instance, I created a composer pkg to add the Nexthink.dmg file to /private/tmp/Nexthink and then tried adding the completed postinstall script.   #!/bin/bash# v5i - nxt_collector_installer.sh## Nexthink Collector Installation script for macOS## This script makes the following assumptions:# 1) The 'csi.app' folder from the Collector DMG is deployed to the endpoint. The installation# only needs that folder and not the full DMG.# 2) The deployment directory is configured below as 'BASE_PATH'# 3) This script is located in the same directory as the csi.app folder from assumption 1.# # Instructions: # 1) Modify the Nexthink Instance Settings in the section below# COLLECTOR_ADDRESS - The data collection address from the welcome email# CUSTOMER

Here's one out of left field, from my security group... We have a number of computers (Macs, windows, etc) reporting in CrowdStrike, Axonius, and other services.  Not all of the Macs are enrolled in Jamf, for reasons good and bad, and we need to get them enrolled. The security team is looking for ways to deploy Jamf without needing to visit the computer (identifying user and location can be a challenge).  I know nothing about whatever process CrowdStrike might use for this.  I do know that installing MDM software on Windows computers can be done via Active Directory, and apparently CrowdStrike uses a some kind of method for deploying MSI or exe installers to Windows computers. I also know at one time Jamf had a quick add package that could, maybe, have been deployed from CrowdStrike or other tool that can support macOS pkg files, but today Jamf deployment depends on having the user, at the computer, download and install, with authentication, the Cert and MDM files. &nbsp

Got an odd one. Anyone had this issue where Microsoft Word won't save anymore?I tried uninstalling, re-installing. Killed preference files and Microsoft Container files. Just on this Mac after he updated to 15.1 and Word 16.91.24111020. Tried an older version. User is signed into M365 okay. Other apps are fine, like PowerPoint and Excel. Other Macs are fine. Happens on every Word file, even a new blank one. Once we click Save As, just beach ball, freezes for a bit. No prompt or options to save from Finder.

Hey Guys, Is there a way to export a report that confirms which users have the screen and system audio recording setting toggled on? The goal is to export a list of users with any settings enabled in that area. 

Greetings! Having a bit of trouble with a host name mismatch on a ceritificate that's causing an issue with Outlook on startup. So far, I've added and exported the certificate in Keychain Access, uploaded it to the JSS in a configuration profile, and then tried to deploy it to a test computer but the problem here is that the trust settings are set to Use System Defaults. Then, I tried packaging the certificate up with composer and copying it to /tmp and installing it with this command: /usr/bin/security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain /tmp/certificate.cer Which does add it and set to Always Trust... However, I still see the Verify Certificate message when Outlook is opened and Use System Defaults as the Trust settings even though the certificate is marked trusted for all users. Any thoughts on what I might be doing wrong or another way to go about adding this certificate to the keychain and setting it to Always Trust? Thanks!

How do I get rid of this message for good ? Even after I 'cancel all' the next day there are a bunch of them again. Is it trying to install a configuration profile that has been deleted from my configuration profile payload? What's actually causing this?  

I am experiencing an issue where iPad apps are not installing on certain devices. This issue started on November 12th 2024. The affected devices are only devices that have not been enrolled in Jamf before. If I wipe a currently enrolled device and reenroll it, the apps will load just fine.  All apps I have pushed are not installing (including self service).  The errors I get on the iPad are "sign into iTunes to allow domain.jamfcloud.com to manage and install apps" and "This Apple ID can not purchase App Store Apps" My organization has managed Apple IDs and we use VPP for all apps. I checked, and there are no apps that are not under VPP or have run out of licenses, despite Jamf Pro saying, "Pending - All licenses are in use or the license is not assigned yet" under pending commands. This has never happened before and I am extremely confused on why this is only happening to devices that have not been enrolled into Jamf before. Any ideas are appreciated!

I'm looking for an up to date extension attribute that checks to see if a mac has an account signed into iCloud and what that full account name is, if an account is signed in.   I've found several other EA's that look for this plist, MobileMeAccounts.plist. The mac I'm testing with is running on OS 15.1, and I do not see this plist under ~/library/preferences.   Any info on if the plist has changed or moved would be greatly appreciated as well.

I've been doing a bit of a clean-up on our Jamf Pro instance prior to us migrating to Jamf Cloud (which will hopefully be within the next month or two) and one of our extension attributes seems to be a bit out of date as I've noticed it's not been working properly.It's supposed to determine what the active/in-use network interface is (i.e. Ethernet or wireless) and has the following script:#!/bin/sh OS_MINOR=`/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2` if (( $OS_MINOR < 5 )); then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"`</result>" else echo "<result>The networksetup binary is not present on th

Just setup MacOS onboarding and working great for use.As anyone configured the MacOS Onboarding extension attribute mentioned here https://www.motionbug.com/jamf-pro-and-macos-onboarding/This does'nt appears to create tag usisng  touch /Library/Application Support/JAMF/.onboardingcomplete. I assume thats what its suppose to do, unsure if the path is correct shouldnt it be touch /Library/Application\\ Support/JAMF/.onboardingcompleteDoesnt create the file either way assuming thats what its suppose to do.Anyone got this working? think I missing something simple.   ThanksTom

Can some suggest how can we Managed Login Items to allow in background for the application Zscaler   We are implementing this in our company to ensure that users wouldn't have an option to turn off. We implemented something similar creating a Configuration Profiles for Ms defender using a some documentation from Microsoft but over ever I don't any documentation for Zscaler.