I have been using Installomator and it has been working great. However, is there an option for the app/script to perform a check-in and install the latest update only if the app is already installed. Currently, when I run Installomator, it installs the app regardless of whether it was previously installed or not.For instance, during my testing, I didn't install Google Chrome on one machine and installed it on another using Self Service. I would like Installomator to update the app, but only on the computer where it was installed by the user/Self Service. On the machine where Google Chrome was not installed previously, I don't want Installomator to perform any installation.Is there a way to modify the script so that it only runs when the app is detected on the system? This would ensure that Installomator updates the app only when it is already present. TY

Hello everyone, My company and I are looking to allow our users access to the print options on the mac with out full admin credentials. These users have local accounts on their computer, not domain based.I know the following script that most people have used on the forms is below, however, it uses the term everyone. /usr/sbin/dseditgroup -o edit -a everyone -t group lpadminI know that if I replace everyone with the specific user, e.g. Charlie, then Charlie would get access to the Printer group but not Anthony, even though they share the same computer. However, this would require me to replace the name every time I give the script to another user or run it in Jamf. Is there a way to specify that you only want the current logged in user to be added to this group? I have tried the following in replace of everyone but I end up with the error Record was not found:whoami`whoami`$USER$LoggedInUser Thanks in Advance

I'm getting worried about the future of the Jamf Admin and Composer apps. Composer is the only one that has been updated for Apple Silicon, but it is basically the exact same app it's always been since version 9. Composer's interface could use some updating. New package manifests are painfully out of date (My god, it still lists Shockwave!). Jamf Admin really is unchanged since version 9. Jamf Admin REALLY needs to be updated for Apple Silicon and to support Dark Mode. It also needs improved error reporting and recovery. When there's a problem (interrupted connection, bad pkg, wrong phase of the moon, I'm wearing the wrong aftershave to work...)  it can take hours for broken uploads to be removed so we can try uploading again.Jamf Admin is a far more efficient method of uploading and editing packages (when it works) than the JSS web interface. I like that I can upload multiple packages at the same time and then edit them afterward. The web interface only allows one upload at a tim

Afternoon All    Hoping someone can help who being using Jamf app catalogue longer than we have.We recently started using Jamf app catalogue to manage some of core apps for patching etc.   I noticed yesterday that there was a new update from chrome it appeared to install fine and chrome seems to be working on the latest version 126.0.6478.183.However we get below error message when going to About chrome, I have noticed it on a handfull of machines but I expect its probably on all of them.  Reinstalling chrome doesnt seem to help either have raised a ticket with Jamf support but that hasnt turn up much so far. The logs show chrome updating without error so I'm somewhat puzzled.As anyone else come across this issue with managing chrome via jamf App catalogue?Thanks

Hi all,We use NinjaOne RMM alongside Jamf PRO for remote management of our MacOS devices, and in order to provide remote support we use the NinjaOne remote access app (NC Streamer).It requires these permissions to run:I've created a configuration policy with the scope - Computers with NC Streamer, config below:It isn't applying the permissions remotely. Have I got the right configuration?Many thanks,

こんにちは！ Jamf Education User Groupページをご覧いただきありがとうございます😊 このページではiPadの運用管理に携わる全ての皆様への・最新情報のご提供・ユーザー間における情報交換の促進・効率的なデバイス管理の実現・Jamfからのお知らせ などを発信していきたいと考えております。 また、皆様からの質問も受け付けております。グループトップページ上部の「Joing Group Hub」をクリックして是非ご参加ください。 今後のアップデートをお楽しみに！

Scenario is this tried to add macbook to ABM via Apple configurator 2 it worked but checked mdm server it shows correctly, but when we boot macbook, after the wifi connection it doesn't redirect to the policy pop-up via jamfpro can anyone face with this issue? 

I discovered that this model only has an HDMI and power cable connection.  Previous TV models have connected to our network with a network cable, so how does one get this 3rd Generation connected and enrolled in JAMF? This new device configuration has prevented me from configuring them as I did before with a cabled connection.--The TV is present in Apple School Manager and enrolled in JAMF Pro.--I cannot find the TV in our JAMF inventory by searching on serial number. (makes sense as it has not connected to any WiFi yet)--When powered on and connected to a monitor, the TV sees but will not connect to our open guest network: " The WiFi network requires further authentication to connect. Use your iPhone or iPad to continue". Choosing this option goes nowhere.  So I then try a secured WiFi network... --We created a special wireless configuration for TVs to auto-join a secure WiFi network, but this is not automagically working as with previous generations.  It appe

I am unable to find a way to added Cisco Thousand Eyes Uninstall to Managed Login Items as it is a EXEC file it doesn't have a bundle id or team identifier. Hoping someone has setup a different EXEC that might know what I need to add the config profile. Thanks  

Hi Guys, We are building out our login workflows, and a good question was asked. Why are we going Local and not using Mobile Accounts when we bind anyway? Most videos seem to hint that local accounts are the recommended option, but I can't seem to find a hard list of Pro/Cons for reasons to go local over mobile. Any insight as to why we would go local over mobile would be helpful. We are using the Kerberos SSO Extension to give user's Kerberos tickets after they login. The concern is that user's don't get a Kerberos ticket upon login which I believe is what a mobile account would do for us. Thanks in advance!

Have a lab of 20 Mac Minis using Jamf Connect & Google IDP.  The login screen shows Sign in with Google as it should but it'll randomly resize the login window which is behavior we're not looking for.  Sometimes it'll show the complete Sign in with Google box including the Create Account & Next button, and further down.  Other times it'll load a much smaller cropped window with a scroll bar (showing the field for the e-mail or phone login but missing the ability to see the Next button without scrolling down) and place it towards the bottom of the screen instead of centering it on the screen.  All systems are using the same model of monitor, same resolution. Not sure if anyone else has experienced this behavior?  My thought is maybe it's the newest version of MacOS as they've now been upgraded to 14.5 and this was not happening on 13.x.  Just very odd behavior that it'll sometimes load properly then you reboot the machine and it's a 50/50 chanc

Hello,We are currently working on the macOS Beta program and would like to remove the Feedback Assistant from the Beta testers. However, the Restricted Software option to remove or kill the process is not working. We also attempted to uninstall the application using the script below, but nothing seems to be effective. Do you have any suggestions or alternative methods to achieve this?Remove script:sudo rm -rf "/System/Library/CoreServices/applications/Feedback Assistant.app"

I am trying to create a PLIST for global protect to have the portal address populated so that our users do not have to enter it manually.  Any suggestion?Current version of GP is v6.0.2

Hi all, Relatively new User to JAMF Pro here, I'm looking to enable access for users for multiple tenants.Within our business we have 10+ JAMF Pro instances and a user has requested access to administer machines in another tenant to what his account is created in.After doing some research I can see the best way to accomplish this appears to be to create some access groups, one for the domain they are not currently a part of (I plan on creating a 'enrollment only' group and a 'admin' group for each) and give it the requisite level of access, that's all fine until I come to add the user as a member, the user in question is not visible in the subset of users.If I change the 'site', the list from the 'Members' section doesn't change, so I can only assume this list is static.So I have a few questions:• Why doesn't the user I need to administer appear in the 'members' user list for any of the groups and are these lists specific to the tenant?• How can I make them available to this selec

Hello Teams, Kindly help me with a script to remove admin right on some of our MAC managed by JAMF.

Hi there,we are trying to set up the Jamf-Proxy for Venafi PKI and we are running into issues. We set up everything according to the manual. From my understanding Jamf-Cloud is getting connected to the Proxy as I can see a request on the Proxy itself. There is a POST command in the direction of the Venafi PKI which then is stopped with an error : x509: certificate signed by unknown authority.Also we are able to connect to the Venafi PKI from the Proxy via API. Has anyone ever seen the same error and knows what we might have to configure? 

Hello Experts,  I am trying to run the subject scriptJAMF ECOSYSTEMI have been struggling since yesterday to run the script and getting the following error even my username and password are correctUser Input is NOT OK, we cannot connect to JAMF API and now will EXIT! status_code: 401Could you please help me out what I am doing mistake?

I need to pull a report of all MAC addresses for the computers in my environment and the built-in reporting only can display the Primary MAC address. From other posts it seems the only way is with Extension Attributes but the few scripts I've found (https://community.jamf.com/t5/jamf-pro/how-to-customize-what-gets-inventory-for-primary-mac-address-and/m-p/193541#M182332) don't return any results when creating extension attributes. Does anyone have any ideas on how I can grab this info?Thanks!

So I need to renew the VPP certificate for our cloud server and we don't have access to the apple id last year's was created with.  I tried uploading one from the main apple id that is admin for Apple School Manager but it says it doesn't match.I know you can add another VPP token, do i just make a new one?  Will i have to reassign all the app licenses?Suggestions? Thoughts? Prayers?

Good morning all!I just had a couple of questions.I have been task to add hardening to the Macs. It occurred to me that it would be easier for the users and to me, for troubleshooting purposes, to deploy 14 rules per week and see how the users get affected.so at first I starting typing the rules that shows under the profile then going to the files and adding the configs one rule at the time. Now, reread the how to use the tool and the only part that it mentioned to do manually if I use the Jamf Pro Upload is to add the Json, which I did. However, Im seeing that the Json is only for exceptions.I'm a bit lost if I have to also do a new policy and runt he script that is uploaded.?Or by using only the profile and allocating it to the machines is enough and I can ignore the Json unless I have to do an exception?I would appreciate if someone can assist me shed some light on the question.  

Hello,Looking for a way to disable end users from changed the Name field on MacBooks using Ventura.System Settings /  General / About .....NameI set the name for my student machines and don't want them changing it.

I have noticed, when user start Microsoft teams screenshare for 1st time it asks for 'screen & System Audio Recording' permissionWarning box shows message as below"Microsoft Teams (work or school)" would like to record this computer's screen and audio.grant access to this application in privacy and Security settings, located in system settings.As a user I am allowed to give this necessary permission, is this can be automated, so users don't have to perform additional step in 'privacy and Security settings' while they are on call?

I'm working on a client setup right now where the computer goes through ADE/DEP and a tech logs in as the administrator account. That kicks off the DEPNotify Helper script and that workflow. This includes the naming of the computer which, in turn, scopes the FileVault Configuration Profile to the computer. It also includes binding the computer to AD. At this point, if I check fdesetup for a list of enabled users, I just get the admin account. So far, so good. After that the admin logs out (but doesn't reboot or shut down or other wise go back to the FileVault lock screen) and a staff person logs in which creates the mobile account. Now if I run fdesetup I see the admin account and the staff account are both enabled. Jamf confirms the same thing. Both accounts are enabled and FileVault is turned on at this point. However... if I reboot, only the admin account is visible on the lock screen. If I don't reboot, but instead log in as either the staff account or the admin account again and j

We have an annual PCI audit that we have to run on randomly selected Macs once a year. After the Macs have been selected, I scope those Macs to a policy that runs the script below. Everything works up to the point of uploading the resulting .zip file to the computer record on the Jamf server. I keep getting a "curl: (26) Failed to open/read local data from file/application" error. Unfortunately my curl skills are weak and I can't figure out what I'm doing wrong. I think I'm doing something wrong with the -F option or I'm not using the variables correctly in the curl command (line 91).#!/bin/bash # this script s used to collect a full system profiler dump in txt format # as well as user accounts, groups, crowdstrike info, open ports # it will put all the files in /Library/company/PCI/<computername>/ # for later retrieval and submission for PCI audit # Set variables for the JAMF API jamf_url="https://company.jamfcloud.com" jamf_user="API-only-account" jamf_password="password_here

I'm kind of confused here about this version of FileZilla in Jamf.  I 'purchased' about 300 "FileZilla Pro - FTP and Cloud" licenses. I created the available FileZilla app in Self Service from the Computers - Mac Apps - App Store. It installed fine and works, as I transferred files just fine. But I don't see anywhere that it is restricted nor where one would enter a subscription, it did not notify me anywhere that it is a trial.  Does it act like the free app?  It says it is a free app in the Jamf setup (see picture).  In the app blurb it says "Subscribe to FileZilla Pro to begin your 7 days free trial." If I don't subscribe does it just act like the free app? I did build a FileZilla package and had the free app available, but wanted something that would update the app, as many of the Jamf Mac apps do.  Any thoughts are appreciated!