Has anyone had success with the EraseDevice API call?I have the shell command: /usr/bin/curl --silent --show-error --connect-timeout 30 --request POST --user "username":"password" "https://site.jamfcloud.com/JSSResource/computercommands/command/EraseDevice/passcode/123456/id/#" but I keep receiving the error: <html> <head> <title>Status page</title> </head> <body style="font-family: sans-serif;"> <p style="font-size: 1.2em;font-weight: bold;margin: 1em 0px;">Unauthorized</p> <p>The request requires user authentication</p> <p>You can get technical details <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2">here</a>.<br> Please continue your visit at our <a href="/">home page</a>. </p> </body> </html> The user account making that API call has read, update, and delete permissions on the JSS Object, Computers, and it has the JSS Action, Send Comput

iPadOS 17.* with Jamf Safe Internet. Under VPN, DNS, & Device Management Content Filter reads Invalid. Anyone know what causes this and or how to fix?

This may not be specifically about Jamf School but looking for a general recommendation and I think Jamf School users would be most likely able to relate.Our school division is trying to re-use older iPads which use iOS v12.5.7 as the latest OS.  The iPads are being used for communication devices for limited use cases.  Places where only 1 or 2 apps are needed so we can lock these apps down.The use case I'm trying to address is where teachers need to lock the app down to a video library where only the 5 or 6 videos can be accessed and nothing else.  If the students in this case have access to any other apps they will get distracted and sometimes combative.One idea was to use something like Microsoft Stream in Single App Mode but it isn't compatible with iOS v12.5.7.  It works in Google Chrome and I'm currently looking into using Chrome Browser Cloud Managment along with a content filter to lock the student into Microsoft Stream web version.  I don't really pref

Hi there !Currently got a frustrating bug in Jamf Pro as it happens as soon as I log off (manually or via auto logout).I'm used to the interface in english but since the version 11 of Jamf and the new interface with translations, it keeps ignoring my setting to keep the interface in english and shows me french as soon as I login.Computer language is french, Chrome is used and empty cache/private navigation/Firefox got same issue.Timezone in Paris/Monaco does not change anything. How to reproduce:On top right corner lick on Account Settings when logged/Language & Region/ set language to english, save and logout.When I log back interface is back in french even if setting is still in english. Workaround:Set langage to french (but anything should work I think), save, set it back to english, save, interface back in english until next logout.Hope it can be fixed soon ! 

I've been trying to created a managed folder of bookmarks/favorites deployed via Configuration Profile to Microsoft Edge. It isn't available via the JSON custom schema.    I've uploaded this plist, borrowed from Talking Moose, using the com.microsoft.edge domain. This info outlines how the setting should work:https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#managedfavoritesMaybe I'm missing how to make the setting "mandatory".Thanks for any help.

Have an application that I  want  to use with that (EndNote) but it needs some extra scripts to run (with SmartGroups) after installation but I cannot find the "Update Inventory" option after this application is installed. (manually) is that not available if you use Mac Apps ?thanks

I've been down the rabbit hole of deploying Cisco's new Secure Client and I am running into an issue that I cannot find any documentation on. Some context: we only need the Umbrella Module for our school and nothing else that is loaded within Cisco's PKG. I have been successful with deploying the choice XML file, but I get the following pop-up in the installation:  I would like this permission to be enabled within the config profile I built in jamf, but I can't seem to locate any of the info I need to do so. I already have gone through Cisco's docs and pushed out the System Extensions payload, but that seems to be just for the Cisco Secure Client itself and not this "AnyConnect VPN Service." If I manually toggle it on, the Umbrella Roaming Module will activate and work as it should, but if this is not toggled on, then the roaming stays inactive.   Any ideas? I am assuming there is something I am missing in the System Extensions payload, but I could be wrong... 

Hi everyone, We just implemented Jamf Connect and are still testing it. We had issues with devices randomly getting kicked off AD, so since we are on AzureAD now, we decided to get Jamf Connect. When we set everything up when a user logs in, we can reboot the machine, and someone else can log in. Now, after a reboot, no one else but the last user can log in. How can I get out of this? What are your best practices for using Jamf Connect in a lab environment?  Thank you

Is there any benefit or drawback to installing config profiles through prestage (where it says "Use this section to add configuration profiles to the PreStage enrollment") vs. after enrollment (a config profile scoped to all computers)?If the former is advised, would I then remove all scopes in the actual config profile(s)? As it stands, right now we don't install via prestage. Rather it enrolls, it does its thing, then installs policies and config profiels.Thanks folks! :)

I am unclear as to how to keep licensed Apps, like FileMaker Pro, up to date with "Apps" in the JSS. I found lots of good stuff like Adobe Reader and I see FMP in that list too but how does it handle licensing? Testing with Reader worked flawlessly. But its a free app. It would be nice to use that Apps - JAMF apps area to keep as many apps up to date as possible to avoid packaging etc. Can anyone point me in the right direction for that, video on TY or something? Cheers.. 

We've got a Journalism cart that has about 26 MacBooks in it. Some issues popped up and I wanted to test clearing out the profiles daily because some students just don't listen and keep ~50GB in their profile even though they have external drives for their work.I have a pretty simple script that just makes sure to ignore our admin accounts and runs a..for a in $userListsysadminctl -deleteUser $aThis seems to work and the home folder is gone but the account is still technically there when you go into users and groups. So when we try to login the MacBook just hangs since there's technically an account still there but no home folder.These users are not secure token holders since only students use them so it's not that and they are Jamf Connect created accounts.Is this just not possible on M1s? They had Intel Macs before I got here and said they used this script all the time but now it just falls a little short with fully removing the account from the device.

Hi, We have a Configuration Profile pushing out our WiFi settings with certs currently, but recently the first batch started expiring. They get renewed, no problem, but the expired cert is left in the keychain. I'm trying to script the removal of them using the following script, so they can't be selected for the wireless profile. #!/bin/bash # Grabs the expired certificate hashes expired=$(security find-identity | grep EXPIRED | awk '{print $2}') # Check for certs if [ -z "$expired" ] then echo "No expired certificates, we're all good" else # Deletes the expired certs via their hash echo "Deleting expired certs" security delete-certificate -Z $expired fi exit 0 #success If I run these commands locally on the machine, then it works no problem, but via a policy it always fails with: 'Unable to delete certificate matching "XXXXXXXX..." Any thoughts? Is there a better way to manage certificates for WiFi profiles? ThanksChris

Details Executing Policy Install Cisco Secure Client 5Downloading Cisco Secure Client 5.1.pkg...Downloading https.jamfcloud.com/jcds/downloads/Cisco%20Secure%20Client%205.1.pkg...Verifying package integrity...Installing Cisco Secure Client 5.1.pkg...Installation failed. The installer reported: installer: Package name isinstaller: Installing at base path / installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. The package is attempting to install content to the system volume.)

Greetings all,We are in the very earliest stages of setting up Okta.  I'm currently working on configuring our JSS Dev environment to use Okta for SSO.I'm working directly with our internal Identity Management team who manages our Okta instance.  They setup the integration on the Okta side, but I have no idea how they went about it.In the JSS dev, I've enabled SSO using Okta, added the necessary metadata URL provided by the IAM team, etc.When attempting a login, I am presented with the expected Okta user name screen, followed by the password screen, suggesting that the login process is working (and I've received notifications of a successful login), but then directed to an error message:Safari can't find the server.Safari can't open the page "https://https//<mysandbox>.jamfcloud.com/saml/SSO" because the Safari can't find the server "https".Note the extra "https// in the Url.The Okta team says everything is OK on their end, and I've reviewed the JSS SSO settings with th

Hi,if i want to be sure that after deployment with Jamf a file (i.e /usr/local/bin/dockutil) persists on the mac, what is best practice to accomplish that with jamf?I think a combination of Extension Attributes, Smart Groups and Policies will work, but I'm wondering if anyone has figured out what works best yet. Maybe so that it is universally applicable and easily reusable.Maybe someone has written an article about it?Many thanks in advance 

whats the best appoach to deploy new Jamf Protect plan in to machines?currently we have a Default plan that is deployed to all Macs using configuration profiles in Jamf Pro. I want to either deploy a new plan that has tamper prevention enabled or edit an existing one to enable it.what is the best way to fix this?it’s enough to edit the current profile and deploy it in Jamf Pro and I don’t have to create a new one?

Hi I'm wanting to create a smart computer group in JAMF Pro, for any Macs we enrol after a specific date. This is so I can scope a policy I have created to only deploy to Macs enrolled on or after the date set in smart group. I cant see an option to do this, any advice or help would be great.Thanks

Can someone tell me what Jamf Pro can do that Intune cannot for iOS devices?I am struggling to fin and documentation to support this online. thanks in advance for the support!

I'm trying to hide FileVault option from being offered in setup assistant during pre-stage, and when I go to customize what steps I want to show, it's greyed out and I cannot skip it. Currently testing on a Mojave machine, but we also are deploying Ventura machines. Looking at Jamf and Apple documentation it seems I should be able to block this, but I can't figure out why its not allowing me to. 

I have searched for a discussion about this and not find this problem, so I am raising a new twist on and old issue. I am trying to advertise some printers in Self Service and cannot get the drivers. I have uploaded the ppd files and I have policies to push out the printers etc. The issue I have is getting the drivers up into JAMF. This is where it gets complicated. HP has decided to not make their drivers available. Instead you can only download an install assistant called Easy_Start.app which will go out and download the drivers for you, install the printer you need, then remove downloaded drivers, thus leaving you without a copy of them to use in JAMF. I need to find a way of packaging the drivers that got installed on my machine so that I can upload them to JAMF instead. I did try reaching out to HP customer support twice for help in getting just a copy of the divers but that seems to be impossible. I have been assured that nobody in the printer industry does that. You cannot do

In the UI my users are _absolutely_ assigned computers, yet they do not appear in my API response. This shouldn't be a permissions thing. I'm very confused. Anyone seen this before?

I'm looking to see if anyone has a configuration profile created that gives ALL Adobe Apps access to Desktop, Documents, Downloads, and External Media. We're managing classroom computers with the Adobe Suite and each time a new user logs and launches an Adobe application it asks for access to those folders.Thank you!

I am trying to get this script to work for this extension attribute. It's just not pulling anything in Jamf Pro. But when I run the same commands in terminal on the local machine, as root, it works. Any suggestions?   

Howdy!I am trying to install an app called SwitchResX on some Macs to allow more control over resolutions for the end users. All my other apps have been installing fine within Self Service, but I can not get this one to install at all after setting it up in Composer and then deploying it. The only difference is this app does not install in the Apps folder but in the System Settings/Preferences on the Mac. Are there any additional resources or things I should look out for when trying to install this type of application? 

Is there a way to either create or assign an admin account as the "management account" after enrollment? We were told by Jamf to turn off that feature in the user-initiated enrollment settings due to the recent issues that setting presents when enrolling (PI113195 - Account Creation is skipped if a management account is enabled under UIE on Mac OS Sonoma).Obviously this isn't ideal but since we've had to turn it off, wondering if we can create an admin policy on newly enrolled machines and somehow make that the management account? Hoping that can be done. Creating the account is easy but unsure if able to tie it as the management account ¯\\_(ツ)_/¯