I found this script for deleting accounts below which works a treat.However I work expect after a inventory update for Local User Accounts section in device record to be cleard also. But it still showing the delete accounts. Is there something I can add to the script or do to ensure this part of the device record get reset.# Get a list of all user accountsuser_list=$(dscl . -list /Users | grep -v '^_')# Specify the admin account(s) that you want to excludeexcluded_users=("admin1" "admin2" "root" "management account")# Loop through the user list and delete user profiles except admin accountsfor user in $user_list; doif [[ ! " ${excluded_users[@]} " =~ " ${user} " ]]; thenif [[ "$user" != "Shared" ]]; then # Exclude 'Shared' userecho "Deleting user profile for: $user"sudo sysadminctl -deleteUser "/Users/$user"sudo rm -rf "/Users/$user"fifidone

I am not having problems finding the JAMF Tools, but I am having an issue with providing administrative access to someone on my team.  They can login to the account.jamf.com but it doesn't show them as part of our organization. It shows they need to join an organization.

Hi,Our fleet has just jumped from Catalina to Monterey and our users are struggling to locate the screen mirroring "Show in menu Bar" tickbox.  Ideally I would just like a script to enable this or our users. I have trieddefaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist ScreenMirroring -int 18but it doesn't seem to work.weirdly sound and bluetooth work though which are controlled inside the same plist. e.g: defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Sound -int 18anyone got any ideas how the ScreenMirroring preference can be set via terminal script? Cheers, ES

I had some questions about the JC login page. It seems inconsistent in when it is shown. This is causing some issues when we are doing onboarding as some people see the JC login screen and some people see the local login page. I see it consistently immediately after logging out, but if i logout then shutdown and go to login again I am only presented with the local login screen

I’m having a strange issue that started within the last week or so. Some laptops are not receiving some configuration profiles. Two profiles in particular (maybe more but this is the first I have noticed), and not every laptop is affected. One is for Jamf Connect. It’s an uploaded profile straight from the Jamf Connect Configuration app. The other is for the Root3 support app.I have tried different versions of each profile, one using the built-in Jamf Connect schemas and one with the upload. I have tried the same with the Root3 app, one using their JSON schema and one with the plist.Neither will push down to some devices. Hardware doesn’t make a difference, and neither does os. It’s happening on Monterey and Big Sur, and intel or Apple processors.I am at a loss. Logs for both say failed on the device inventory page and pending on the profile pages.We’re on Jamf Pro Cloud.Is anyone else having issues?

Hi there,I'm working on a script to wipe out student mobile accounts from our lab machines.These machines are AD-bound, provisioning options are set to create mobile account at login with no confirmation.Here's the script I'm running. As you can see, very simple because all our student accounts contain the "." character (e.g. john.doe) -- # list all users with the "." character in their namesUSERS=$( dscl . ls /Users | grep -e "\." )# echo usersecho Deleting the following users: $USERS# delete users/usr/bin/dscl . delete /Users/"$USERS"echo User accounts deleted# delete home folders/bin/rm -rf /Users/"$USERS"echo User home folders deleted The script successfully removes my test student account, but then I'm unable to re-add the student to the device from the login screen after a reboot, which will prevent students from being able to use the computers.Any ideas where I could get more information on what is broken?Alternatively, if there's a smarter way I should be doing this, I'm also o

Hello Jamf experts, We have a weird issue that just started occurring which we're not sure if it's because of a recent update to our Jamf Cloud instance because we hadn't added new Macs over the past few months. Anyway, we have a Configuration Profile that generates and deploys a SCEP certificate along with the Wi-Fi profile that uses the certificate. All's been well until recently when we provisioned a new Macbook Pro and it just refuses to install any Configuration Profile at all (we check in the Macbook's History > Policy Logs page in Jamf). After a lot of troubleshooting which included a check on the firewall to see if anything is being blocked (there isn't) we stumbled upon the fact that when the SCEP is applied, the Macbook immediately switches to and connects to that Wi-Fi and then it fails to proceed. When I exclude the deployment of SCEP, everything works as before. Now the question is, how can I make it so that the SCEP is deployed last? I know we can d

Hi,I am trying to install Snapgene, which requires the license install script to be executed as the logged in user as described here: https://support.snapgene.com/hc/en-us/articles/10304162065172-Command-Line-Installation-and-ActivationMy first attempt was simply to index using Composer, install Snapgene, execute script, build package with composer. Didn't work.When I execute the script locally everything works as expected, whoever as soon as I try to deploy it using Jamf Pro it won't. I then tried to follow https://scriptingosx.com/2020/08/running-a-command-as-another-user/ to no avail. The license won't be installed. Is there another way, I'm not aware of, which would execute the script locally so everything works as expected?

Hi Guys, anybody can help me to go-through the AutoPKG.How it's work and step-by-step process to create packages and deployment to target machines.

We have been using Oomnitza to pull inventory records from Jamf for a while. Unfortunately it seems like this stopped working suddenly when we upgraded to Jamf 11. We have tried the following: 1. Enabling the user to have the SSO edit option. 2. Creating a new user specific for this. 3. Creating a full permission user to access the integration. 4. Changing the password for the integration user. nothing seems to be working. Is there an API change with Jamf 11? 

Hello! We've been using Installomator for automatically installing and updating some apps. It has been working well for us so far. One thing I was curious about is if there is a way for Installomator to write to the plist file of the app that it is working on. From what I could tell thru their github, I don't think there is and currently I am planning to just use config profiles to manage the plist files. But if there's a better way or if I could do it using the same Installomator script that would be nice.For context, the apps in question are Firefox, Chrome, and Zoom.Any advice would be appreciated or if anyone would be willing to give me some insight on how they do it.Thanks!-Frank S.

Hi Everyone. I'm running into an interesting issue (maybe?) with Jamf Connect and Ventura. I have my workflow setup and it is deploying correctly to my test machine. After initial login, the local and IdP account mapping/creation works and everything else seems fine. What's interesting is when I reboot my laptop: I get the local account login which accepts my IdP credentials, then it takes me to the Jamf Connect login screen where I have to sign into my IdP account twice (Once to log in and then second time to verify the password). It's like I have to unlock locally before Jamf Connect can take over. Has anyone run into this issue? I feel like I'm missing something simple...FWIW:I have my login agent delivered through the Jamf-provided pkg, not via config profile.The laptop in question has Jamf Connect deployed via workflow, not PreStage Enrollment.

Hello Jamf Community, I previously posted this a couple weeks ago but still am struggling to figure out exactly how to get it working. I am trying to create a script that will prompt a user with a popup box on which application they'd like to uninstall (only apps we deem approved). For example, a popup would come up and ask someone "Select an app you'd like to uninstall" with a list of apps such as, Google Chrome, Firefox, Adobe, etc. Currently I have script that I feel is about 90% of the way there but still can't figure out how to get it completely working. I'll post it below. Also, if there's any easier way to do this, please do let me know as well! Any help is greatly appreciated! There may be some unnecessary lines in the script just FYI. Here's the script: #!/bin/bash # Parameters app1="$4" app2="$5" app3="$6" app4="$7" app5="$8" appList="$4 $5 $6 $7 $8" uninstallApp="choose from list every paragraph of \\"$appList\\" with title \\"Application Uni

I have a pair of iPads where the device certificate has expired, and they no longer seem to be communicating with our instance.How can I renew these certs, or otherwise get these in working order again?

Greetings JAMF NationersI am looking to create a uptime Extension Attribute.I have created an Extension Attribute with the data type: IntegerInput Type: Populated by ScriptMac OS C Script Contentes: #!/bin/sh echo -n"<result>" uptime "</result>" exit 0 This results in:23:40 up 14:02, 2 users, load averages: 0.50 0.35 0.35 /private/tmp/extensionAttributeScript: line 7: I would like a simple number in days, so I need to edit the result.Something like:uptime | awk -F'( |,)' '{print $2}'Results in:up 45 mins or up 4 daysHow do I get a simple number in days? Thanks in advance for any help!

I'd like to set a photo that's in a specific folder on each computer in my environment to be the screensaver, with the "classic" style. I'd also like to set it once, and then allow users to change it if they wish. I thought this would be a simple endeavor, but have not had any luck figuring out a successful method. Has anyone done something similar in their environment?

My executive leadership requested that we deploy a desktop picture to all computers, but they do not want it showing on the lock screen. I created a package for the image with Desktoppr and it works perfectly... Except that it changes the default lock screen and screensaver to be the same image. We also do not want to lock the image, users should be free to change it to whatever they want. My question is does anyone know how to set the lock screen image independently of the desktop picture? Can it be done with a script or a plist? 

Hi All,With Installomator SAP Privileges is installed -> added to Dock. There is also installation of an PPPC with DockToggleTimeout.mobileconfig from the website. But If I want to Toggle to admin nothing happens. What am i missing?thanks

I am attempting to remove our guest wireless network (SSID) using WPA2 personal from all machines in my environment. I have scoured through JAMF Nation, in search of posts looking to achieve the same. I was able to find a handful of useful discussions but none were fully applicable to my current requirement. Some posts had suggested achieving this in a configuration profile and supplying a bogus password so the machine is never able to connect to the network. I would like to remove the guest wireless network from all machines rather than fully implementing an all out ban from ever connecting to it again. In short, I'd like to accomplish the following: Create a smart computer group which inventories all machines with the guest network SSID. That is, all machines that have the guest network saved as a preferred network. Remove the SSID from all machines in this smart computer group. Please let me know what your thoughts are and if this is best approached with an extension attribute

Sorry for the long title.We were doing some testing with Nudge and found out that once you hit the deadline and Nudge enters aggressive mode that it still pops up even after you click to update the device.  My manager said when he waited and got to that date he was unable to use his device while it updated since Nudge kept popping back up. Is there a way around this?  I just added a long refresh cycle in the user experience tab to test but wanted to check here in case that is wrong.

I am having an issue with Jamf having "Start screen saver after" unchecked within a configuration profile, yet after 20 minutes each one of the iMacs run their screensaver. Does anyone have a workaround to changing the screensaver time from 20 minutes to never without me having to apply it individually per workstation?

We are in the process of recreating policies and configuration profiles in preparation for a new lease cycle later this year and I have been testing on a couple of M1 machines using my login and have had good results. I just set up one of those MacBooks for another user and even though the screensaver is disabled it will still eventually come on and when it does it will close out of any browser that he has open. Has anyone seen anything like this before? We haven't found that any other app behaves this way, just browsers...

Can someone post how I add two dictionary items together?  From here, Troubleshooting_Microsoft_Azure_Login_Using_JamfAAD .  I don't know if I need an array added for both.  Also, can I add 2 of the same Preference Domain in a Configuration Profile?  An example of the below would be appreciated.  Thanks in advance!! <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>tokenRetryCount</key> <integer>3</integer> <key>tokenRetryWaitTime</key> <integer>42</integer> </dict> </plist>and <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>useWKWebView</key> <true/> </dict> </p

hi all,is there a way to enforce the setting "Private Address" turned off?We actually have a Cisco ISE in our internal network that uses mac address to detect if it is an iPhone (we push mac addresses in a specific group) and then moves the iPhones to another network. Since Private Address is on, it transmits to the network controller a different MAC address and breaks our rule.

I circulate MacBooks in a library context, so multiple users use the same machine throughout the day. I'm required to have my MacBooks disk encrypted, and I need my users to be able to login to these MacBooks wirelessly with their Active Directory accounts. But I think FileVault prevents users from authenticating to the network before they login to the MacBook, is that right? Is it possible for users to login to wifi before they login to the FileVault-enabled MacBook?