Going to upload the new device token and getting an error message "The File received is not valid".  Anyone got any ideas?  Sync is now failing due to downloading a new Token.

Wondering if anyone has come across this before; I've done a fair bit of searching, but haven't found anything. I’m trying to make a signed package for Jamf Connect Notify with a cert made against the Jamf CA (need to shoot off a support ticket for that one, but that can wait), but Composer crashes with it, and I’ve isolated it to the following:If I make the package in Packages, import and then try to convert it to source in Composer, Composer crashes at the end of itIf I make the package but edit the postinstall script to be #!/bin/sh prior to building, it will import/convert fine, but if I then edit it in Composer to be zsh, it crashes immediately upon saving.It seems that Composer cannot handle #!/bin/zsh at all - I've tested this with versions from 10.48 through to 11.0.1, with the behaviour repeating. Has anyone else come across this behaviour before? Very frustrating, as it's holding up getting the Notify panes tested. (M2 MBA, Sonoma 14.1, Composer 10.48 through 1

HI there,We've been using a script to set the computer name on devices in the format of 'fullname-model'. This script has been working fine up until Sonoma where it breaks by not providing the full name variable. The only script that seems to work at the moment is one that pulls the username instead but this is not ideal for our environment due to some historic devices having usernames completely unrelated to the user.Is anyone using a script that is able to pull full name from a source that works on Monterey, Ventura and Sonoma in the 'fullName-model' format?This is what we have now#!/bin/bash userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }') echo $userName model=$(system_profiler SPHardwareDataType | grep "Model Name:" | sed 's/.*://' | tr -d " \\t\\n\\r") echo $model serialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') echo $serialNumber name=$userName-$model-$serialNumber echo $name scutil --set HostName "${name}" scutil --set LocalHostN

Hello guys, I wanted to let you know that we are currently in the process of deploying the Kerberos Single Sign-on Extension profile. However, we have encountered a situation where some local macOS accounts do not match their corresponding AD accounts. For instance, the macOS local account is named "doe" while the AD account is named "jdoe". I am concerned whether this will cause any issues during the rollout of Kerberos Single Sign-on Extension. I have conducted a test with a user named "test" whose AD username also happens to be "test", and it worked without any problems as they match. Nevertheless, I remain worried about potential complications arising from mismatched account names

The script I run to enable Remote Login and Remote Management has been the following:#!/bin/sh # enable remote management for ardadmin /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users adminuser -access -on -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -restart -agent -menu #enable remote login for ardadmin sudo /usr/sbin/systemsetup -setremotelogin on sudo dseditgroup -o edit -a adminuser -t user com.apple.access_ssh exit 0We just upgraded many of our computers to macOS Ventura.  I've noticed with macOS Ventura that when tryin

We create a local user account for administrative tasks as part of our imaging. What we're seeing is that we'll receive a unit with some issues where we need to use that account, and the password won't work. This is not very common, but it is happening sometimes. We'd like to create an Extension Attribute that checks that account and validate if the expected password works, and if not, scope a policy to that smart group to reset it. I did see one slightly complex script here:http://www.yourownlinux.com/2015/08/how-to-check-if-username-and-password-are-valid-using-bash-script.html But it doesn't appear to work any more since the shadow hash is now under /var/db/dslocal/nodes/Default/users/<USERNAME>.plist Before I start working through that I wanted to check if anyone has any other suggestions/solutions. Thanks

As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I crea

I have a computer that is already in use, which just won't register correctly in Jamf. It's registered in DEP and assigned to Jamf Pro. In Jamf Pro, the serial number doesn't show up in device search. When I trigger the re-enrollement with the user ("sudo profiles renew -type enrollment") the enrollment-flow starts as expected.However, at the end it stops with an error message "Install profile failedYour computer is already enrolled in an MDM server and can only be enrolled in one MDM server at a time". In Jamf the serial number now shows up as "DEP - [SERIAL_NO]". The username in Jamf pro is not populated (though it was collected in the flow).Also, the `jamf` binary is not installed.In the user's System Settings, only 3 profiles are listed. They have names I don't recognize, but I can't remove them. However, it is stated that "This mac is supervised and managed by: Archipunt", so it might be old profiles from our MDM (the computer is bought in 2020, and we were using Jamf Pro bef

I have a policy in Self Service that deletes a "Temp" local user account and then recreates it. We use this for lending out laptops to students so that we can delete and re-add the account every time it is returned so that we can re-lend it out with a fresh account. I would like to apply a new policy that forces the "Temp" account user to reset their password once upon first login after the account has been recreated via self service. I was planning on using the command: pwpolicy -u "$LOGGEDINUSER" -setpolicy "newPasswordRequired=1"If I scope this command in policy to a smart group that looks for the Temp local account and then runs once per user at login will this accomplish what I need? The trick is I don't want this command to run when any other accounts login and only want it to run once when the Temp account logs in for the first time after being re-created and then only again when the account is removed and recreated and logged into for the first time once again. If I use a

Anyone have a script or extension attribute to pull this info, I am looking for the type of display connected i.e. Cinema, thunderbolt, other?

Hello i am in the process of mass deploying Checkpoint endpoint agent via jamf, how to enable full disk access via JAMF in system preference. Thank you in advance. 

I was always under the impression that managed Apple TVs required a MDM remote command to initiate a tvOS update but I recently noticed most of my fleet has automatically updated to tvOS 17 on their own.  Is there a way to prevent this as this causes disruptions in the classroom?

I would like to create a script that will allow us to run and confirm that our core apps like Outlook, Teams and others are installed before we give the machine to our normal users.Any help is greatly appreciated.

Hello,I was following this post: https://community.jamf.com/t5/jamf-pro/centos7-jss-file-distribution-share/td-p/227536 And set up all for sharing, but now when I access https://jamfshare.mycompany.com/CasperShare I do have Forbidden message: ForbiddenYou don't have permission to access this resource. Any thoughts ???? 

I have a strange issue when I am deploying a configuration profile in order for the login window to display name and password text fields instead of user icons on a Sonoma device. With the profile I created installed, upon restart it still shows our local admin account icon and does not display the username and password fields but when we login to the local admin account and then log out, then the username and password fields are displayed correctly instead of user icons.  This only works until the computer is rebooted. As soon as the computer is restarted again it goes back to displaying the local admin user icon again and no username and password field. Has anyone run into this on Sonoma? Is there another payload I am missing besides the login prompt payload being set to name and password text fields? My goal is to have the computer boot to username and password fields so that users can login using LDAP credentials upon boot.

I see a number of post on here with help about setting up AnyConnect with an On-Prem-Server. I am new to Jamf, and am using the cloud DP. I cannot for the life of me, figure out how to get Cisco AnyConnect with Umbrella to install via Jamf. I tried doing a snapshot and that did not work, but I don't know why. I have worked with Cisco and at this time, they do not know how to support Jamf Cloud. Their instructions, I don't know how to make that work for the cloud. These are the instructions they sent me: Mass-Deployment-Using-JAMF-Casper-Suite I need help, please and thank you!

We have recently started getting M2 Macbooks into our company.I have smart group which should pick them up based on it been a laptop.the Machine in question is Macbook Pro 16-inch 2023 It doesn't seem to be, surely Macbook should cover all Macbooks right?I'm I missing something.

Awhile ago I created a local JSS user that was solely for the purpose of using its credentials in scripts to perform actions via the API, namely updating the value for specific extension attributes within a computer record. I want this user to be as limited as possible since its credentials may be exposed in clear text in scripts. In 9.62 this was working fine with the user only having create, read, and update privileges for computer objects. This broke when updating to 9.81. Is anyone doing something similar and can verify what privileges are needed? I tried adding delete for computer objects, as well as CRUD for computer extension attributes, but still no luck. Here is the command I'm running and the associated output, which you can see states "Not authorized for a user PUT": curl -k -v -u username:password https://jss.url:8443/JSSResource/computers/name/TaggartJ-M0L5A /subset/extensionattributes -T /tmp/ea.xml -X PUT * Hostname was NOT found in DNS cache % Total % Rece

I'd love to be able to have a script to update the password for our local admin account on all devices. I know some people here were able to get this working, but that thread is a few OSes old and I assume based on the age that it's no longer applicable.

I thought I had the password syncing working in Jamf Connect with Google but it seems I don't.When I log in to the Mac via Jamf Connect Google I click the Connect button on Jamf Connect Menubar and I get this error.Yes, the cert deployed via Jamf Pro is set to Allow all app access. I have also tested running this command in terminal via @rabbitt LDAPTLS_IDENTITY="LDAP Client" ldapsearch -uLLL -w USERPASSWORDGOESHERE -D 'USERNAME@GOOGLEDOMAIN.EXT' -H ldaps://ldap.google.com -b 'dc=USERNAME@GOOGLEDOMAIN.EXT'I get this error when running this with my username and password replaced above.I have re-created the LDAP cert in Google over 4 times and Yes it's turned on. Is there anything else I'm missing to make this work?

Apple released macOS 14.1 today. On my Macs running Sonoma, this update is being deferred by our minor macOS update deferral profile. On Macs that have not yet been upgraded to Sonoma, macOS 14.1 is showing up in Software Update to install. Before today, Sonoma was being deferred. Why would 14.1 not be deferred? For a Mac running Ventura, any version of Sonoma should be considered to be a major macOS upgrade. Is there an adjustment that I need to make?

Heya folks. I had a previous post about Adobe CC with a lot of helpful feedback. I've gotten to a point where I was able to succesfully deploy and download applications via Mac Apps (Hooray!) but for individual Adobe products such as Photoshop and Illustrator, this was not working in that once installed the credentials I used to sign in was not recognized as being an Education account and I was granted only a trial.Whereas when I create a package via Adobe CC Admin portal, pick my apps and install, when I log into after an install this way, Adobe recognizes my credential. So, after setting up my distribution point with Jamf Cloud and creating a package with the .pkg from the latest package build in Adobe Admin, I pushed it down to Self-Service with a policy.I see Adobe CC in self-service and i go to install it and it takes about 8 to 10 minutes before it ultimately fails. When I go to the details in Jamf, all I get is...Installation failed. The installer reported: installer: Package na

Hello,I would like to know how to unenroll broken mobile devices in a clean way?I have no way to turn the devices on, or others have broken screens.I'd like to reset them and unenroll them to give them to the scrapyard.Do you have a procedure for this?Thanks in advance for any answers!

Hi - Simple question here, I'm just wondering if I can enable the self-service desktop app for just a subset of our users. We just recently deployed JAMF and I didn't have this turned on at the time. I'd like to flip it on now, but I'd like to do some testing and get things in there, and communicate what the new icon is before it shows up on everyones computer. Can I deploy it via policy or profile? Because it looks like a global setting.. Thanks!

Hi, We rolled out SentinelOne a couple of months ago, now we noticed users disabling SentinelOne underLoginItems>Allow in the Background in the system settings.  What is the best way to disable this?