Looking for ways to push OS updates to users i tried nudge way to hard to setup for a novice user, so i tried the JAMF Pro software update and i get the ScheduleOSUpdate Missing 'ProductKey' error every time i try a Minor or Major update any other way to push the updates? or fix this error

Hello Jamf Nation, I am trying to implement the nist macos security compliance project into our organization devices, https://github.com/usnistgov/macos_security .  I have read through the wiki and it keeps saying in each page that: We recommend working off of one of the OS branches, rather than the main branch I am wondering how can i generate the script and configuration profiles and put them in jamf while we have different mac os versions, i.e. ventura, monterey, sonama. I hope i am expressing my self clear. Please any guidance on that?  Thank you, 

Is there a script to set up the home page for Microsoft Edge ?

Looking for some help with a script issue please.I've written a script based on Charle Edge's https://github.com/jamf/MakeMeAnAdmin to use in a Cyber Essentials Mac build. Whilst the original script temporarily elevated the users privileges I want to create a temporary separate admin account.Everything works well apart from the final stage (lines 50-65, labelled "# Write a script for the launch daemon to run to delete the temporary admin account if it exists, delete the launch daemon then provide feedback to user.") to cleanup the admin account. This part of the script does work when run manually so I'm thinking it's an issue with permissions and/or ownership.Any advice would be appreciated. Thanks#!/bin/bash ############################################### # "I need admin". # John Moore, April 2024. # Based on "MakeMeAnAdmin.sh" by Charles Edge, see https://github.com/jamf/MakeMeAnAdmin. # This Jamf Self Service script will provide the user with access to a separate admin ac

Hi,for some time now the Management Commands on my Jamf Pro instance have not been working. They are staying on the "Pending" status. This also affects the installation of Mac Apps (the ones with the VPP licenses). As far as I can tell all of my devices are affected? Is there anything I can do about this?Kind regards

Good morning!Relatively new and inexperienced MAC admin, so please be gentle and feel free to talk to me like you're talking to a 5th grader!In troubleshooting MDM communication with a large number of our Macs, the support tech I was working with suggested adding some EA's to assist in seeing what was going on. It definitely helped to identify and point us to a resolution, but one of them doesn't appear to be working the way I think it should? Note, that my background is mostly Windows enterprise, not any Bash, so I'm not sure exactly how to troubleshoot and resolve to get this particular EA to display what I want.Here's what was provided: #!/bin/bash theIDs=$(security find-identity -v | awk '{print $3}' | tr -d '"' | grep -E '^[A-Za-z0-9]{8}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{12}$') echo "$theIDs" if [ -z "$theIDs" ]; thenecho <result>"ERROR - No keychain identities matching a UUID found on this system.</result>"exit 1elseecho "At

I saw 2 accounts listed under Managed Local Administrator Accounts, 1 labeled as "jamf binary" and the other being "PreStage". I looked for where the 1st account was defined and I found it under User Initiated Enrollment > Computers > Managed Local Administrator Account > Create Managed Local Administrator Account I have a feeling that this was defined when we were going through the initial training with Jamf and something we don't really need because we don't allow user initiated enrollments and all our devices are enrolled from Apple School Manager. I'm not sure why Jamf would create this account on devices that have undergone ADE (I've confirmed its presence in our ADE devices with a dscl read). Would there be any issues with me removing that account?

I've often read on posts (or heard on YouTube videos) the admonition that one really shouldn't have many PreStage Enrolments without really being told the reason why not. Here I am looking at 8 of them and I can see that apart from one (Staff Macbooks which require Jamf Connect Config Profiles in PreStage), there really isn't that much difference between Lab 1, Lab 2, etc PreStages so I could technically combine them to just Lab PreStage. However, I assign computers to each PreStage and use the PreStage "membership" to populate our Smart Groups (e.g. Lab 1 Smart Group has criteria of memberof Lab 1 PreStage). If you are using a single PreStage for all your devices, how do you populate your Smart Groups? The only way I can see is if you make multiple criteria using "Serial Number equals XXXX" with the OR operator which I find more tedious than just checking them under the correct PreStage. Keen to hear how others are doing it.

Hi All,This one has come up before in the forums, but I am trying to determine why my script has stopped working in my test environment but still is working fine in production.  It's the same script and I made sure to change the script to reflect the API user in test.  We have a field in our preload called AssetTag which the script should be reading and then renaming the device to based on serial.  This script is failing with the following error:  Asset Tag is being set in the preload and is being seen by JAMF on the record but is not completing the change. Script exit code: 1Script result: Asset Tag is empty. Exiting...Error running script: return code was 1.  /bin/bash #set the variables for the server and API account jssUser=APIUSER jssPass=PASSWORD jssHost=https://jamfcloudinfohere.jamfcloud.com #get the serial number serialNumber="$(ioreg -l | grep IOPlatformSerialNumber | sed -e 's/.*\\"\\(.*\\)\\"/\\1/')" #get the asset tag from jamf asse

Greetings! I'm trying to create an EA that detects when a user has added their own user to a device. We need an indicator of "setup-ed-ness" on laptops. A device that a user has never powered on, or has but never logged in to, needs to not run a couple policies, but once someone has their user account (John Doe), it should be in a "ready" state.So I'm searching for "Machines with known accounts, plus more." We have two accounts fleet-wide, with predictable names. Once someone logs in with Jamf Connect, there should be a third account. But I can't write a one-size fits all for known1, known2, as well as unkonwn1, unkonwn2, unknownN in a Smart Group, at least not that I'm aware. I can create a smart group that checks for the presence of the expected users.I was thinking I'd need to write an EA, but zsh is giving me a devil of a time taking dscl's output and putting it into an array I can cross-check.Anyone have any guidance on a pre-existing EA that's c

We've noticed that since upgrading to Sonoma we are unable to push commands to laptop that is not logged in. If it is still on the log in window (Displaying list of users) we are not able to push Lock or Wipe Commands, they stay on pending. This is happening even if we plug a network cable in. 

Hi AllI use App installers in Jamf Pro to install and update apps. I have end user experience enabled to notify users on new updates and when an app will auto quit to apply the patches .I need to use IBM notifier for this and I need help in setting this up .Thanks

Hello,I would like to have your opinions on a subject concerning FileVault computers that need to be sent to an external customer after-sales support.What is the best procedure knowing that our managers want the devices to be sent to the external support service encrypted.These Macs only have one FV user account and SecureToken, that of the end-user whose password we don't know.The only local admin account created during the prestage is managed by LAPS.What would you advise me?Thank you

Hi, I am trying to deploy Office 2021 (VolumeLicense) and with that I want do disable the ability for users to login to office and use their private Office 365 licenses.On this site (https://learn.microsoft.com/de-de/microsoft-365/enterprise/network-requests-in-office-2016-for-mac?view=o365-worldwide) I found three preferences witch to my understanding should just do that:  defaults write com.microsoft.Word UseOnlineContent -integer 0 defaults write com.microsoft.Excel UseOnlineContent -integer 0 defaults write com.microsoft.Powerpoint UseOnlineContent -integer 0  But they don't seem to work (not when deployed through Jamf or run locally).Has anyone been handling this?

Hi all!We are currently testing our implementation of Jamf Pro Cloud. I am trying to set Chrome as the default browser for my organization, but I cannot find the option to do that through Jamf. And anything online about this is over a few years old. I just wanted to check in and see if there has been a change to this, or if anyone has a clever way of getting around it!Thanks!

Hey guys, our users have no admin rights on their Macs. Is it possible to allow them to use the Erase option in settings app (General =>  transfer and reset => erase all content and settings? It seems like the erase app actively needs admin rights, and these things seems like cannot be handled using privilege management systems like BeyondTrust. We tried to run the commands stated here from self service, but also there same message as stated above. Any hints / proposals? If not, I guess the only way for users is holding down their power button and reinstall from there, right? However we would prefer the way from settings app since it's more convenient. Thank you so much for your thoughts on that. bestFlory

Got Regex?

So I am working on getting all of our Mac devices registered with Entra ID. I have set up the notification to let the users know that they need to register and then it directs them to self service to do so. This is great , however my issue is with the triggers, I'm looking for a way that if the Mac such as mine currently is registered with Entra ID, how can I no longer have my device receive the pop up notification. I only want the pop up to trigger if the device is not registered, so this will help with current Macs as well as new macs when they come into our environment. I've looked every where for solutions and could not find any hoping someone here has found a way to get this done. 

I am on JAMF Pro 11.5.1 and I am having a strange issue on a number of macs where Self Service is crashing immediately but only for Mobile accounts. Local Accounts can open Self Service without any problems. Has anyone run into this before? I have tried re-installing Self Service and re-running recon and policy but its still persisting. 

We are relatively new to Jamf Pro.  NFR/Test was set up for us to use by Jamf staff.  Now that we have a few devices in our PRODUCTION instance and ABM setup along with that, I decided to stand up the Test/NFR environment.  When I get to the point of creating the new MDM server in ABM, I am prompted to download a new "MDM Server Token."  However, I am warned that doing that will result in my existing token being reset.  I do not want to break Production.  Is there a way around this?  Thanks.

So I wanted to push an OS update to my test Macs, which I have previously done via Inventory, pick the machines I want, Actions, Update OS version etc.It's still there, I can still choose its radio button, but a blue box appears saying "You can now use Software Updates to manage OS updates". But the Software Updates feature appears to be a beta, and I don't particularly want to use a beta. I would like to use the existing Update OS Version mass action.The blue box says that I can continue using the existing feature, but that it will be deprecated in a future version. But the "Next" button is greyed out, with no indication as to why.So, despite the wording, is it already deprecated? Or should the Next button still be available, and if it should be, has anyone got any ideas about why it isn't?Thanks,Lisa.

Hey guys, we're looking for an opportunity to grey out the option "Allow this user to administer this computer" in system settings. Our users are no local admins and we do not want them to enable that option. Any ideas? thank you so much, Best, Florian

I know that most folks are recommending user-driven provisioning where the end-user gets to enjoy the process of being involved in setting up their Macbooks. Our org is not one of those. Our users prefer to get their Macbooks and get to work immediately and not have to wait for apps to install or things to be configured while they sit and do nothing. We achieve this in Windows by pre-provisioning (Microsoft calls it white glove) where we assign common apps (Office, Chrome, VLC, etc) to the devices rather than the user and we leave user-specific apps (not all users get Adobe Creative Cloud for example) to be installed after the user logs in. This way, we can get a fleet of Windows laptops ready for use by anyone with very minimal delays experienced by the user (they can work in Outlook and Chrome while Adobe CC is being installed in the background). I plan to achieve the user side of things using DEPnotify but any suggestions how to pre-provision common apps? Is putting the comon a

I'm looking for a way to not have Keynote, Numbers, and Pages install on enrollment. Is there a way to do this? Or do I just have to remove them afterward?

Lately, every Mac that has tried to perform user-initiated enrollment in Jamf has been met with "Device Signature Error in the jamf log. To resolve, we perform these steps:1. Remove Jamf Framework2. Remove Jamf CA certificate3. Remove contents of /Library/Application Support/JAMF/Downloads/4. Run this command: sudo update_dyld_shared_cache -force5. Delete the mac from Jamf console6. Run the QuickAdd package on the mac7. Approve the Device Management Profile on the Mac8. Assign the user to the Mac in the Jamf Pro console This issue seems to have started with MacOS 10.14.5, but that may be coincidence. I have attached screenshots from an affected Mac. We have 3 macs that are broken right now, and 2 that were repaired using the procedure above. Anyone else seeing encountering this?