Ever since we upgraded to macOS Sonoma, the following script is no longer working that is used as an Extension Attribute within Jamf Pro to report if TouchID is Enabled and Disabled:#!/bin/shTouchIDStatus=`bioutil -rs | grep functionality | awk '{print $4}'`if [[ "$TouchIDStatus" = "0" ]]; thenresult="TouchIDDisabled"elif [[ "$TouchIDStatus" = "1" ]]; thenresult="TouchIDEnabled"elseresult="Error"fiecho "<result>$result</result>"What I see for TouchID is Error.Any advice is very much appreciated!

I am getting an error -1 The cert for this server is invalid.  I am not sure what cert its talking about.  Im thinking I dont have the app configuration.  Has anybody used it and what did you do to get it running

Has anyone put together a policy/script to uninstall homebrew with Jamf?They have an uninstall script located here:https://github.com/homebrew/install#uninstall-homebrew But if I upload that to Jamf and run it with "--quiet --force" it throws an error shown below.  Seems like something from Jamf is adding a "/" argument to the script and it's causing it to fail.  Script exit code: 1 Script result: Warning: Unrecognized option: '/' Homebrew Uninstaller Usage: /Library/Application Support/JAMF/tmp/uninstallHomebrew.sh [options] -p, --path=PATH Sets Homebrew prefix. Defaults to /usr/local. --skip-cache-and-logs Skips removal of HOMEBREW_CACHE and HOMEBREW_LOGS. -f, --force Uninstall without prompting. -q, --quiet Suppress all output. -n, --dry-run Simulate uninstall but don't remove anything. -h, --help Display this message.

Dear Jamf Team, We are an IT service provider managing multiple Jamf Pro Cloud Instances for our clients. Over the past few weeks, we have encountered significant technical issues that have disrupted our services and negatively impacted our client relationships. Below is a detailed description of the problems we faced: Technical Issues Encountered: • Previously uploaded and functional packages suddenly became unavailable. Within the Jamf Pro Web Interface, these packages displayed a status of "Availability pending."• Client-Side Errors: "Error: Package was not successfully downloaded. 500", "Error: Package-2.1.1.pkg is not available on the HTTP server."• Server-Side Errors: Unable to get download URL from JCDS 2. Falling back to JCDS 1.x. org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found: "Not Found" Possible Cause and Support Interaction: • We suspect these issues stem from an infrastructure change implemented by Jamf in mid-Decem

Hi, we are very new to JAMF pro having recently updated from JAMF now.  We've just had to share our local admin password with a remote user and would like to now have this changed. Can this be changed manually without any need for scripting if so how? Thanks in advance

I changed my password via Jamf Connect yesterday, but when the prompt to sync passwords appeared it did not accept my previous password, giving me the "Your local password is incorrect" message. Rebooting showed that I needed my previous password to log in to FV. Once at the desktop, logging into Jamf Connect used my new password but still would not accept the old one when trying to sync passwords. Based on this Jamf Nation thread (https://www.jamf.com/jamf-nation/discussions/35744/jamf-connect-login-with-okta-local-password-issues), I manually changed my local password using the diskutil apfs changePassphrase command. This worked in that my FV password now matches my Jamf Connect password, but after the FV login I now get a Jamf login screen, where the old password is required. When I get to the desktop, Jamf Connect works with the new password as before, but still prompts to sync passwords. I've tried multiple passwords to no avail. As a result, I cannot complete a login to Ja

What are the ways to manage software updates for non-supervised mobile devices? We have several hundred mobile devices enrolled using the UI method and would like to keep their iOS versions up-to-date. I understand that the "Update iOS Version" remote command only works on ADE/Supervised devices. Is there a way to manage software updates for non-supervised mobile devices?

I am testing a reset local user password Policy in case a user forgets his macbook login password. I see this as a trigger option: "Startup - When a computer starts up. A startup script that checks for policies must be configured in Jamf Pro for this to work"What kind of Startup Script would I need for this policy to take effect? This may come up in the future and would like to have this available for a real situation. OTW, the trigger is Recurring Check-in but it doesn't seem to check-in after I reboot ans wait 15 minutes. I don't believe Recurring Check-In will happen until after the user logs in. This won't help if I can't reset the password through Policy. Any help/advice is always greatly appreciated. 

We have an odd behavior in our environment for some of our machines.  If you try to shutdown/restart using the GUI method - it hangs.  What happens in you see the background and the mouse cursor...and it just stays there.  Screen never goes black and doesn't shutdown/restart.  So because it's stuck you can still SSH into the machine and run commands.  So I wrote a script to kill processes to try to figure out which process might be hung.  While I didn't figure out which process is causing this I did learn that if you kill the following processes(AppleUserHIDDrivers, IOUserBluetoothSerialDriver, IOUserDockChannelSerial) four times it will kernel panic your machine.  Tweaked the script to avoid processes that will kill the remote session...but it doesn't seem any process I kill causes it to move forward and shutdown/reboot. Anyone experience anything like this?        

 We have a user who's time zone is set wrong..if we try to change it we can't as it is greyed out."This setting has been configured by a profile"I assume this is a JAMF Profile?

Is it possible to use a pre-downloaded version of Sonoma and install it for standard users by using Nudge?My workflow at the moment is I am using Nudge without the erase and install script, because I am using a policy I run beforehand with only a single command line to fetch full installer in the processes and files tab. Nudge then opens system settings -> softwareupdate, but it looks like it is re-downloading even though there is a 'install macOS Sonoma' in the applications folder. Maybe I am missing something. I have watched several videos and read thru the wikis for Nudge and the erase and install script, but I can't find anything saying for sure there is way to do this for standard users.

I recently had to configure Zscaler for my environment and I figured I would share incase it helps anyone.Prior to 3.9 Zscaler was configured with a script, the JAMF documentation is eh and the got the script they provide from someones GitHub repo.[Guide] Zscaler Client Connector Deployment with JAMF Pro for MacOS - Connectors / Client Connector - ZenithWith 3.9 Zscaler is now configured with a configuration profile, which at the time of writing is documented for intune and not JAMF. Zscaler has advised they will update their JAMF Documentation, but as of 6 weeks and they still have not updated their documentation. The intune docuemtantation is simple enough to use with JAMF. Deploying Zscaler Client Connector with Microsoft Intune for macOS | ZscalerThe Zscaler app can be provided in 2 ways. The non-managed app which will not respect any configuration profiles, and a deployable .pkg which is what you want to use. Build the policy to deploy the package as usual, nothing screw

How to stop all adobe products when installing a new version of adobe 2019

Hello. I am fairly new to Jamf Pro and in the process of learning while cleaning up some of the work that was created before me. I have a question regarding pre-stage enrollments and the best practice for moving forward. Currently, our iPads are not automatically assigned to a pre-stage enrollment as we have 4 different pre-stage enrollments. This leads to devices never being enrolled in Jamf as they are shipped out to the end user. I would like to automatically assign all iPads to our generic DEP pre-stage enrollment and then manually move the ones we need in a different pre-stage enrollment. We will not need to do this often and this will at least allow us to have all iPads enrolled in management. Am I correct in thinking that devices already assigned to a different pre-stage enrollment will stay there after this change is made, even if wiped? It is my understanding you can only have devices in one pre-stage enrollment at a time and you have to unselect the one it is currently assign

Hey all I'm new to Jamf School. I'm trying to do a pilot program this year for Jamf Teacher and Jamf Student for our ipads.  I currently have Jamf teacher and student working well. However, I can't get Apple Classroom "View screen" to work. I went through the Jamf Restriction settings and allowed for Apple Classrooms to view the screen.  Anything I'm missing, any settings that are hidden on the jamf school side?

So in https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/Apple Says: "Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on."It seems like we would want to keep the end user from enabling this on MDM devices.  Has anyone seen any documentation on how to disable Lockdown Mode?  I can't see any in any MDM reference publicly available.

Hello,I have added 1Password8 to the Jamf App Catalogue in our Jamf Test instance, On the Deployment status tab I'm getting App Installer deployment status Unavailable The App Installer deployment status cannot be retrieved. Check your configuration settings or refresh the page.I have verified all the settings and it seems correct to me. I'm not sure what if I'm missing something or?Can I get some assistance on this to fix this issue?

We have a local administrator account created as a part of our prestage and manual enrollment processes. It has no counterpart in our IdP (Azure in this case). However, the Jamf Connect Menu Bar app launches and demands a username and password.Dragging the window off the side of the display is an ugly solution. Is there a way to exempt a specific user/group from needing to connect with (or even launching) the menu bar? I thought it might be a Login Item, but no such luck.

​Greetings, Jamf Community.I'm looking for guidance on how to efficiently capture and correlate logs and events from a MacBook device. Specifically, I want to track user login events, device reboots, and open applications, for example, "Chrome." Can anyone recommend whether Jamf may be able to achieve this? Thank you.

Has anyone seen this before? Suddenly when trying to sign in(for the first time) to newly enrolled AD joined macs, I am getting this lego block icon with an OK option. Click it, screen goes black then hit any key and youre back at the login screen.The only changes I made yesterday were with application policies. I would start there, but first I need to know what this icon is? Literally cant find anything about it online. Pretty frustrating. Has anyone seen this before? I also dont follow the logic of "removing old app policies and fixing ones that havent been working" breaks AD logins? I join new devices manually. I set primary domain controller, add directory admin group, create local account at login without confirmation, dont set UNC path, home directory is /bin/bash. Nothing has changed. I just set one up yesterday and its fine.Im assuming its related to policy changes I made, some how, but I cant find anything about this useless error icon. Has anyone seen this? Thank you.

Hi there, is there a way to get an extension attribute in Jamf to report a target file's last modified date?

Mostly Sonoma 14.4.1 OSWe have a Configuration Profile that has Require Passcode, Complex Passcode and Alphanumeric Value along with values in the rest of the settingsThis prevents the users from changing values in Lock Screen for Start Screen Saver when inactive, Turn display off on battery inactive, Turn display off on power adapter when inactive and Require password after screen saver begins or display is turned offI removed this from a target computerI cloned this configuration profile and added the clone to a target computerThis resulted in users being able to change the values for all of these itemsFor compliance we need to set Require password after screen saver begins or display is turned off to Immediately and prevent users from changing this valueI have been looking in Apple documentation and Jamf Community but the closest I have found was an un answered question at the bottom of the post from 03-27-2024 https://community.jamf.com/t5/jamf-nation/don-t-require-password-after-s

I have tried to create a PPPC config with the utility and given a couple apps "allow" for accessibility, and "let standard users approve" for input monitoring and screen recording. while I understand these settings will not show in the macOS GUI, the users are still not able to enable these settings without admin prompt. I have only tested on Ventura, but we have a few machines (with more to come) running Sonoma. Is there something I'm missing?

We may be getting some new users joining from outside the USA. We are using JAMF Pro. I am guessing it will work OK in other countries, but looking for any sage advise from others who may be going this route.For example - we are about 80% zero touch deployment, but have a few things still to manually set up and check by hand. We won't be able to do a hand check for these things for people outside the USA, but we can likely remote in and manually do those things.I am curious if/how we can arrange for a Mac to be purchased and added into ABM in a foreign country. Will we need to contact an Apple rep that is local to the user? Or is it just as easy as finding a reseller locally who can do it? We want to avoid having to walk the user through connecting the Mac to ABM via Configurator.

Hi all, I see that there is an option to prevent changes to bluetooth for iOS devices.My question is, does the Jamf have the ability to disable bluetooth entirely? We have a security requirement to disable it.Thanks!