Does anyone have, or can anyone advise on how to create, a manifest file for installing the Python 3.12.1?Pretty new to macOS administration, and very new to Jamf Pro, but would like to be able to deploy the Python 3.12.1 package through Self Service but not been able to get it to work. I'm presuming it is because I've not declared a manifest file, and using Composer reports a whole load of Deleted Files and Modified Files which I think are unique to my machine configuration and even the Files For Package seems to include a whole load of irrelevant files.Any help will be gratefully received.

Hi All,I will be taking Jamf 300 training and certification in a couple of weeks and it would be really helpful if anyone could give some tips for that.

Our school division is pushing for Filevault 2 on all Macs.  I'm tasked to figure out how to deploy this if it is feasible.  Our school division uses Active Directory.  I have so far tested enabling Filevault with a Configuration Profile configured as follows:I have also turned off automatic login while FileVault is on as per https://support.apple.com/en-vn/HT207431.sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YESI have tested this with Catalina, Big Sur and Ventura Beta, I haven't got around to Monterey yet.  What I have found in Catalina and Big Sur is that only the Filevault users are listed and there is no username and password prompt for new users.  Ventura Beta does have a username and password prompt but even with automatic login turned off the computer does not connect to Wifi until someone logs in.This would be fine if it was a one-to-one computer deployment but I need to deploy this to lab computers and lapt

Hello everyone and thanks in advance. I'm just looking for a little guidance in what avenue to pursue for upgrading my fleet and keeping everyone on the same page moving forward. Jamf Pro seems to have a few different methods for doing this. Documentation found here shows using Smart Groups and Mass Actions to upgrade devices. That's a simple enough method and I would love for it to be that easy. My experience with the Mass Action "Update OS version and built-in apps" is that it is a black box that I have no idea of whether or not it is working. With a >12gb download, it's a little aggravating to just fire off the command and hope that as long it ends up in the History > Management Commands > Completed list, that it worked properly and the computer will... update itself at some point? Option 2 seems to be that a lot of people are using scripts like the ever-popular erase-install to handle upgrades. Is this because the Mass Actions don't work? People would rather

Hello everyone,We've been using Jamf for half a year now, and we got most of it working with scripts and other hacks, but one thing we still struggle with is updates.We have 2 issues with software updates, 1. how to force install them without user interaction.2. how to prevent Major updates like Ventura before they are approved.And I'll explain.1. I've tested a few scripts and methods that I found/created, but apple has made our lives harder requiring user authentication for major updates, and does not install updates that require restart at all, just downloads them.Has anyone managed to force update install and restart from Jamf via script? or is this locked now and must involve user interaction? 2. I've seen countless posts saying: "block InstallAssistant, and defer updates for 90 days" I don't know how no one mentioned this, or thought of it, but that will not apply only to the update you're thinking of, it applies to every update.For example, let's say I want to block Ventura

Howdy folks!  I am looking to add a few native apple apps back to my devices (I was a little too restrictive in my initial set-up) but now that I am adjusting my config profiles to include these apps (specifically Clock and Translate) they aren't showing up. . . is that because I haven't purchased them and scoped them to my devices? I would have thought that just by adding them into App Usage section of the payload (and home screen layout) it would add them in. I tried adding them manually into the Mobile apps section, but when I scope them to the device its prompting for the user to sign in with an AppleID. I looked for them in my Apple Business Manager Account, but I can't find the native apps listed in there at all. Am I missing a key step here? Do these apps live elsewhere in the restrictions and I'm missing it?   

Hello,I clicked "Unregister" in JamfSchool on an iPad as a test. Now the device in JamfSchool displays: "The device is no longer managed! The management profile was removed from the device on Tue Jan 9 19:15:30 2024. The device can only be managed again after it has been re-registered."The question for me now is how I can register the iPad again without using Configurator 2. Or does this only work with Configurator 2? But that would mean that I would have to connect the device to a Mac via USB.Ralph 

We use JAMF and Microsoft to integrate device compliance for many of our devices. However, in the last two weeks, we have observed that some devices randomly lose the 'Microsoft Intune' field in Azure and become non-compliant. When we check the company portal, the compliance managed by JAMF is also missing.Due to the lack of compliance, these devices start to show conditional access errors. We can fix this quickly by running the azure registration policy again, but we don't know the root cause of this problem. For example, one device had to be re-registered three times in two weeks. Others only once, and some never.We did find this MS known issue with Intune and macOS:Known issues with Microsoft Intune - Intune | Microsoft LearnCould this be the cause of our problem, or is there something else I might have overlooked?

Hi all,i am installing a security Appstore app (Tailscale) by default profile. I want this app to be started at login. Therefore mac has settings -> logon objects. How can i add an app to this via policie?Have a nice weekFrank

Hello, is there any way to make multiple computers unmanaged in JAMF without unticking the box for each of them individually or deleting them completely?Previously, there was a way to edit management account via mass action and set it to blank, but now that's not an option anymore.All those computers are un-enrolled already, however still listed as managed in JAMF database, and we are talking about hundreds of those - going through each of them would a pain..Thank you.

Dear Jamf Pro Support Team,I hope this message finds you well. My name is Somnath and I am a user of Jamf Pro currently working on the integration of our system with the Jamf SaaS App.I am currently facing an issue when attempting to update a user's password through the Swagger interface. The error message received is: "You cannot change information in an LDAP account or change the password."Upon further investigation, it appears that the Swagger API does not currently support the updating of user passwords through an admin user. As part of our administrative requirements, we need to perform password updates via the API using administrative privileges.Could you kindly assist in providing the necessary API endpoint or guidance on how we can achieve password updates for users with administrative credentials?Your support in resolving this matter is highly appreciated. If there are specific details required from my end or if further clarification is needed, please let me know.Thank you for

Hey everyone... I wanted to make Google Chrome a part of my automated deployment process and also be available within Self-Service. Why? Users can just download from Google on their own. True dat. But hey, one-stop shopping in Self-Service, right? As we all know, Google deploys Chrome via a DMG file. The Google Chrome.app file must be dragged to the /Applications folder. You could effectively re-package everything using Composer, but then things get REAL STALE, REAL FAST - Google updates Chrome frequently. So stale software is bad software. So how can we deploy Google Chrome with the freshest of the fresh so we don't get that not-so-fresh feeling? Well, lemme share my story, morning glory. . THE SCRIPTI wrote a simple script that does the heavy lifting... I tossed this script into System Settings > Computer Management > Scripts within the JSS... NOTE: Yes, I am aware that I don't have any error checking taking place. This is v1.1 - quick and dirty. Feel free to add som

I use a script to update Zoom to what ever version the app owners at my company say we are allowed to install. The script runs a curl command to download the installer for the version we want, then it installs the package. It first checks if Zoom is running. If it's not, it runs the install. If it is, it does not install the newer version of Zoom. The policy runs at check-in scoped to all comptuers with an exclusion for computers already running the version of Zoom we want to install. I have been trying to figure out how to detect if Zoom is running a meeting or not. Somoene may simply have Zoom launched, but not have a meeting running. I know a lot of my users just keep Zoom running. This results in the update taking longer to get done on all of my Macs. Does anyone know what process to look for if Zoom is in a meeting?

Situation: In Apple Business Manager we have two MDM server settings. We want to migrate our Mac laptops from the America MDM profile to the India MDM profile. What is the best approach for this?According to me first change the MDM setting from America to India in Apple Business Manager then reset the device and enroll the device again. Or do we have any other way of doing it?

Hi all, Fairly new to Jamf, having an issue getting a Self-Service installer for Citrix Workspace to function.I have downloaded the .dmg file from Citrix, packaged it up, and added it to an install policy. I've enabled FUT and FEU as it's a .dmg and not .pkg. But on installing from our Self Service, the application isn't actually installed despite self service saying install complete (not appearing in Applications list). Any guidance on where to go? Thanks!

Hello everyone,I hope you are doing well. I have Okta integrated with Jamf through Jamf Connect, I am wondering is it somehow possible to pass user's Full Name or at least Username in Okta to Jamf / Mac.What I am trying to do is to change computer name to be the same as the name of the Okta user.So far my closest success to this was to create script that takes username or alias(alias has precedence) of the currently logged in user and sets it as computer name. Code is below: #!/bin/bash admin1="admin1" admin2="admin2" # get username of the currently logged in user username=$(/usr/bin/logname) # get currently logged in user's alias if alias is not available, username will be used instead alias=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name && ! /loginwindow/ { print $3 }' ) # If logged in user is not one of local admins that are for IT personel if [ $username != $admin1 ] && [ $username != $admin2 ]; then if [ $username == $alias ]; then

Hello, Using hybrid joined Azure, we appear to have an issue with our Conditional Access configuration between Jamf and Entra. We have configured Jamf Device Compliance with a Compliance Test Group and an Application Group, the connection verification status: Success between Jamf and Intune is confirmed and partner compliance management configured.A group of test Mac’s in Jamf have Company Portal and Intune integration policies installed and they are registered in Entra We have configured Conditional Access policies in Intune and targeted all cloud apps but when we run the CA policy we are locked out of Cloud Apps because according to Entra Sign-in logs the Mac is non-compliantAm I missing something?

Not sure what I am doing wrong here. I have created a Supervision Identity in JAMF Pro. But when I try to add it to my keychain, the password I provide is invalid. I've deleted and recreated the identity many times. Any idea what is going on? 

Hey I seem to be having issues with end users being able to install osx updates on their macs managed by jamf, the users are prompted for the password to upgrade to 14.0 but won't accept the user's password when being prompted is anyone seeing this or have we set this somewhere in jamf pro. I am having to log them out login as admin and update the mac Thanks  

I was just wondering if it was possible to release devices in Jamf Pro instead of doing it through Apple School Manager?I don't see a way to do bulk releases in Apple School Manager.I noticed under the connection to Jamf in ASM (Settings > MDM Server Info) - we have 'Allow this MDM Server to release devices.' checked.Just wanted to see if there was a way of bulk-releasing devices in Jamf. Otherwise I will do them one-by-one in Apple School Manager.

When initiating a user enrollment it prompts for the device to Assign to user. Though I have created a number of users under Settings > User account and groups entering the username, full name or email address of any of the users is never accepted, and selecting the search option, i.e. the magnifying glass, the resulting drop-down list has no users. What value is meant to be entered in response to this prompt?

Feel like I have to be missing something obvious here... but I can't seem to get this to behave. Trying to make an extension attribute that checks if homebrew is installed, and outputs the result of "which brew" if so.... pretty basic. This works perfectly from terminal both as my standard user and as root... but when jamf runs it... all that's returned to the extension attribute is "Installed: " with no file path listed.From terminal, i get what seems to be a proper output jamf should be happy with:sh-3.2# ./test2.sh <result>Installed: /opt/homebrew/bin/brew</result>Extension Attribute Code:#!/bin/bash if [[ $(which brew) != "brew not found" ]]; then brewstatus="Installed: $(which brew)" else brewstatus="Not installed" fi echo "<result>$brewstatus</result>" exit 0 

For stolen computers I used to push out Prey and I'd be able to get location, screen shot, camera shot. The location is always sketchy in terms of being able to actually track a computer, but the web cam pictures and the screenshots were great in terms of being able to get names and other reportable information for the police.With latest systems though we need to give permission from the computer for camera access as well as screen recording access, which we can't do since it's no longer in hand.I know I can firmware lock the computers and provide a message to return the device, but it's more likely the computer will end up in the trash than returned.What is anyone doing now to track/recover computers other than locking and providing a message to return?Again, this is after the fact... I don't want to have spying software on my student laptops before the fact (for various reasons.)Thanks!  

Hi guys, how we can enable Enhanced Protection in the Chrome browser via JAMF? I tried some Plist files but its not working on my end 

After several years of more or less being neglected Jamf has announced they are archiving NoMad. I figure NoMad is worthy of a moment of remembrance. How did you guys use NoMad and how many of you still use NoMad?   Strangely enough we used NoMad to make the domain bound life easier giving our users by giving a more stable way to update passwords and map network drives, never mind NoMad was designed to be used without domain binding. We moved off NoMad about 3 years ago.  https://www.jamf.com/blog/jamf-to-archive-nomad-open-source-projects/