We're trying to scope smart groups based on Patch Reporting: {Application} Less than Latest Version. Currently we only have Patch Reporting: Google Chrome in there. How do we add more for other applications, or am I mistaken and Google Chrome is the only one supported by JAMF?

I'm trying to set up and test LogCollection. I created a Jamf user account and want to give it the barest privileges, only what is needed to connect and upload the logs. The only privileges I have configured for this account is create/update Attachment Assignments and create/update File Attachments. When I run the policy, I get the error "The request requires user authentication". What else do I need to provide this account to be able to connect and upload the log files?

Hi Team,Does anyone know how to enforce the screensaver after 15 minutes of inactivity and require a password to unlock in Sonama?I've been trying through a script but it doesn't seem to work, and end-users are still able to change the settings through System Settings., even after the screen lock Password is required need to unlock the screen

JAMF newbie here...Our K-12 school is looking at a hybrid approach in terms of technology and I'm wondering if somebody could share their experience or thoughts around this.Current situationTeachers are all assigned a laptop device (Microsoft OS) and we use Microsoft as our primary platform in the school.We have a BYOD policy for students and they are opting more and more to bring iPads to the school.  As a result, we considering rolling out JAMF to manage the iPads.  The majority of the apps we use are Microsoft (e.g. Teams, OneNote, etc)From a management perspective, could the teachers still engage with JAMF features such as lock screen, etc from their laptops or would they need an iPad as well to do this?

Hi Guys,I've been following the documentation and training videos for setting up a limited access DMZ deployment of Jamf Pro, which for the most part has been easy to follow. I've updated web.xml to block access to the api servlet, but wanted to remove the documentation as well. The relevant step in that training instructs you to remove the API directory from the web root to stop the API documentation being accessible... only there is no API directory on my deployment. If I access: https://jamfproserver:8443/api I'm presented with a page that allows me to choose between "classic API" and "JAMF Pro API" pages. I've removed the classicapi directory, so it 404s, but the JAMF Pro API link takes me to active documentation. I assume this folder has simply been moved and the training / documentation is lagging behind, in which case I'd love to know where it's now located. Any help appreciated!

Hi friends,I am new at Jamf and appreciate your help.We use Jamf Pro in the cloud and we have a local Microsoft CA server.My goal is to install certificates from the local CA using Jamf pro cloud on the mac devices.I understand there are two ways to do this:1. Using Jamf ADCS Connector2. Using Jamf SCEP with local NDES serverAm I right?What is the right and secure way to do it?We also have Azure and Intune if that can help. Thanks  

Our previous Jamf admin showed me how to package Citrix Workspace for Jamf, but at that time it was a PKG file. Now it's a DMG. The Installer PKG (in the DMG) bundles Citix Workspace and something called "Citrix Enterprise Browser". There's a way to install just Citrix Workspace, according to https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html (search for "Install only Citrix Workspace app" on that page). You need to download an XML file and then can run a Terminal command line that installs the Citrix Workspace.app file in your desired location.So my bright idea was to take that .app file, drag it to Composer, then build a PKG to get just a clean install of Citrix Workspace that I could then deploy via Jamf, but it doesn't work. The app installs, but when I attempt to connect to Citrix, the cursor just spins forever and doesn't connect. But when I launch the app using the build instructions from Citrix, I can connect just fine.I'm not sure

I have a bit of dilemma where I need to remove Jamf Framework and enroll many devices at once. I was thinking we can do something with a script:#!/bin/bashsudo jamf removeFrameworksudo jamf enroll -prompt -nopolicy #After this is run, it would request for JSS and password.  This is where I am stuck. I understand this is a bad Security practice. But I still want to do this. I was thinking of creating a one-time account to do this push and removing the account.With that said, my question is:Is there a way to add the username and password inside the script so that when "sudo jamf enroll" runs, it uses the credential to bypass it? I don't want the users to enter the credentials instead use a one-time script to run everything and complete it.

Hi all,We have tested out the Jamf Compliance Editor and it works wonderfully till the point that we wipe the laptop and re enroll it. In order to better understand and troubleshoot the availability of the policies, we have set the remediation and compliance policies to ongoing and also added them to self service so that we can see when we run run them. For some reason, on a wiped laptop the remediation policy will be made available only one time after i ran the audit policy. However, the laptop wont be scoped to the remediation policy after that no matter what we did: Restart, waiting for 24-36 hours, reset baseline, ran audit policy again, delete the device from Jamf before enrolling, erasing the Macbook reinstalling OS from scratch and enrolling. The only thing that did work, was to install the compliance editor on the wiped laptop locally => create a new project => select the standard that we are aiming for (CIS1 in our case) => Create Guidance => Cl

Testing installing this app https://github.com/root3nl/SupportApp and something isn't quite right that I can't figure out.  1. I have a Policy with this package where the Scope is my test computer.2. I have a Configuration Profile using Application & Custom Settings > External Applications using this json file.The Scope is a Smart Computer Group.3. The Smart Computer Group uses Criteria where the Profile Identifier "is" the Value of "149694A2-D63C-4195-94C6-26B778EFA58D" which is the Identifier of the application. The app is installed on my test computer but it is not picking up any of the settings from the json file. Any input would be appreciated. 

I am looking for a solution to disable/hide the ability to activate Airplane Mode on iPadOS. I work in a K-12 school district and we have lots of devices around for various needs. Some offsite as well. Students and/or parents are turning on airplane mode and not allowing us to communicate with the device. I understand they can just disconnect from their own network but I'm trying to mitigate possibilities for no connection. If there is a way, pleas let me know what you got. 

I am in the process of installing Sophos using a policy. Sophos has several PPPCs, and Kernels that need to be put in place. These are being pushed by a configuration profile.I do not want the install of sophos to happen before the configuration policy is on the system, yet I do not see any option when creating a smart computer group to determine if the configuration policy has been applied.  How do I verify the policy is in place before the install? Thanks in advance for your help!

Is there a way to control notifications settings for apps deployed from Jamf Pro via something like a Plist file?

I am having issues updating a classic API script with the bearer token. Testing the script below I seem to have an issue somewhere as the variable will not propagate accordingly. I am getting "MBA-1" every time I run the script.   # Getting the computer's serial number to make the API call serialnumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') # Decrypting the string above function DecryptString() { echo "${1}" | /usr/bin/openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } string=$(DecryptString $EncryptedString $Salt $Passphrase) model=$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk '{print $3}' | sed 's/[1-9].*$//') case $model in MacBookPro) short=MBS ;; MacBook) short=MB ;; MacBookAir) short=MBA ;; iMac) short=IMC ;; *) short=UNK ;; esac # A basic API Call that's getting information for the computer. # computerxml=$(curl -s -H “Authorization: Bearer ${token}” -H ${jamfurl}/JSSRes

Each week we go through and find the machines that have a 'Filevault 2 Individual Key Validation' of 'Unknown' and reach out to those users to resolve (via check in, reboot, etc). My confusion is why they validations becomes 'Unknown'. I imaged a machine recently and the validation was 'Valid' and everything was fine, but after turning it off for a few days it later became 'Unknown'. What causes Jamf to no longer recognize the key is valid? The machine was imaged and had a valid key then only a day or two later it became 'Unknown'.Did it try to rotate itself and the new key just needs to be validated by Jamf? If that's the case, how can we change the rotation frequency?Does it regularly need to check-in with Jamf to validate the key even though it hasn't changed? If so, how can we tell it to validate the key less frequently?We have a smart group enabled and use the 'Issue new FV key' policy on it but we aren't sure if that's helping at allhttps://learn.jamf.com/bundle/jamf-pro-doc

I am seeing this issue with Macs running Sonoma and Connect 2.27.0. I am not sure if Connect is actually causing this but it is currently my prime suspect.What is happening is this. The Mac boots up, asks for a PW to decrypt the drive and then opens to the Finder no problem. I can also log in using the Local Login option. If I then log out, it brings up Connect and I can log back in no problem.But (you knew this was coming) if I lock the screen or put the machine to sleep from the Finder, when it wakes up and asks for a password, it will not accept whatever I enter. It acts like I'm entering the wrong password and I can't get past this and must reboot the machine to get back in.Anyone else seeing this? I have't seen it on any of my machines before Sonoma.

When enrolling a computer I have the need to automatically add the device to an AD security group after the AD bind. I attempted to use dseditgroup for this but it does not seem to recognize computers (even though there is a "-t computer" option). Has anyone done this or know of a way to automate this via a script as part of the enrollment process? Thanks.

Hello All,In our environment the Loggen in User name is in firstname.lastname format and I am trying to figure out how to extract the first name with a script. Till now what I have is below #!/bin/bash#gets current logged in usergetUser=$(ls -l /dev/console | awk '{ print $3 }')Echo $getUser#gets namedfirstName=$(finger -s $getUser | head -2 | tail -n1 | awk '{print toupper($2)}')computerName="ABCD-ABM-"$firstName"-MacBook"Echo $computerName#set all the name in all the placesscutil --set ComputerName "$computerName"scutil --set LocalHostName "$computerName"scutil --set HostName "$computerName" sudo Jamf reconAnd the result I am getting is - ABCD-ABM-LASTNAME-MacBook I am not good with scripting however what I understand is the 'firstName' is unable to fetch first name from firstname.lastname however same works good when the name is like firstname lastname. 

Hi,  How can I create new admin user using command line and user home will be delete automatically when remove from System Preferences?I successfully create new admin user using the following command but when I delete this user from system preferences the home folder will not delete automatically compare to users create manually from system preferences.Any advice?Thank yousudo sysadminctl -addUser Admin -fullName "Admin" -password admin123 -home /Users/admin -shell /bin/zsh -admin

Heard today that there is no option for Virtual Attendance at JNUC 2024. ------------------------------------------------------------------------- EDIT 02/15/24 - It appears that recorded sessions will be made available in November. Information regarding this was buried in the FAQ for the event.  Still a bummer though.    The original message below may be ignored.  ------------------------------------------------------------------------- This development saddens me, and I'm sure it will make others sad as well. Charge us more to attend virtually if you must to make things happen this year. Many customers cannot attend live for whatever reason. Some may not be able to get hotel rooms to make the stay, others may not be able to break away from work. Having the virtual option keeps us all in the loop, without it, it is like being on the outside of a movie theater during a major summer release.     Don't shut out your customers Jamf. Be more inclusive tha

When I filter a list of computers in Jamf Pro there is a column heading that says BOOT FULL. What does this mean? Thanks,Jim

I have been able to successfully add dock items but I would like to remove several default items from student users docks.  Do I need to add them to the Dock Items and then delete them?  I don't see any information on how to remove default items like facetime, etc. I am new to jamf and have new macs to set up for our classroom labs.  Any help is appreciated. 

I updated 4 MacBook's and a Studio that where still running macOS 12 about 3 weeks ago, and JAMF still show them running the old OS how can i force the full scan of the systems

Hello !First of all, please excuse me if the questions are found somewhere else, but I can't find clearly the informations needed. Please note that I'm not familiar with API.As the basic authentication will be soon removed, I already disabled it in Jamf Pro. I checked all my scripts and it seems that it's working fine. However, I have some questions:1) I read that classic API uses JSSResource as part of the URI. And I have this example to get the department of a computer. I would like to change that so I can use the api/v1 URI but I can't find the exact path. Actually, I get the department this way:department=$(curl -H "Accept: application/xml" --header "Authorization: Bearer ${token}" "${jssURL}JSSResource/computers/serialnumber/${macSerial}" | xmllint --xpath "string (//computer/location/department)" -)How should I change this ? And first of all, is it still possible to do this way ?2) I use keywords in the position and room fields of a computer's inventory. It allows me to put those

The new user interface for devices remembers the filter and even the selected iPads even if the filter is changed.  I accidentally erased 20 devices inadvertently before I realized what I was doing.  The previous interface did not behave this way.  Could there be some sort of UI toggle that disables this functionality?  I'd hate to forget what I had selected and erase or do some other function before it's too late. After the fact I did see there is a warning that says: "After filter, some selected devices may not display in the table.  Your previously selected devices will still be scoped."  I'd rather this not be the case. I always want to see what my scope is.  At the very least I should be able to deselect items that are in scope.  At least in Jamf Pro I can clear the filter and sort by selected to unselect items.