Hello, I am working on a faster deployment for the end user but I am hitting a snag. We are manually creating the user account after the computer is set up. However, the problem is that Jamf is taking the admin Account and using that as the Fields for User and Location. Is there a good way that I can have the newest created account be imported and change these fields? (snapped a pic just to make it more clear).--This method is still in the testing stage so luckily zero headaches yet :D Just some extra info:No user account is created when we enroll the computer (Admin account is Added).I have chopped DEPNotify in Half. This way we can do the 30-40 minute install without the person needing to be here. Once the first half of DEP is installed, we create their account, i.e. appleguy13 and generic pw.Once they're here, we have them update the PW and run DEPNotify part two which grabs their name and computer name etc. However, I'm not getting this info imported in Jamf As alway

Following a twit by Richard Trouton, I thought it would be good to implement sudo in Touch ID authentication for our developers as one of the benefits to Sonoma, since Sonoma makes the change persistent even when updates are made.If you are interested follow the link to Richard Trouton's Wordpress site (https://derflounder.wordpress.com/2023/10/14/enabling-touch-id-authentication-for-sudo-on-macos-sonoma/)However, upon implementation I needed an EA to check if the authentication had been enabled or not since I implemented two self service policies; one to enable and the other to disable.Since the policies are ongoing, I needed smart computer groups to exclude enabled computers when the policy was enabled and only present the disable policy and vice versa.this is the EA that I used which reports if Touch ID has been enabled or not-------------------#!/bin/bash# Check if the file existsif [ -e /etc/pam.d/sudo_local ]; then# Check if the specific line exists and is uncommentedif grep -qE

Hi everyone,I'm working on setting up an Apple Configurator 2 laptop, from which we can bulk restore and enrol Macs (over DEP). I take it others are already doing this, so I'm wondering if so, which Thunderbolt/USB-C hub have you been using, and what your overall experience with AC2 and Apple Silicon Macs has been? Thanks!

Ever since edge switched to the new 113 updater I have run into a few macs that edge refuses to update.I am already using the plist to update<dict> <key>updatePolicies</key> <dict> <key>global</key> <dict> <key>UpdateDefault</key> <integer>0</integer> </dict> </dict> </dict>And it works fine. The macs that have the issue I noticed the EdgeUpdater folder is locked out and therefore blocking edge itself from updating.Macs that are updating ok,  this folder does not have a permission block.I even manually updated to version 117 and it does not fix the folder permission and edge is still not updating.Not sure if anyone has run into this or if they have a way to fix the folder permissions using Jamf. 

Has anyone had problems with Google Workspace failing authorization on a page refresh?This is the error we get. I've captured HAR logs and sent them to support and they've concluded "..this looks to be designed this way" so I'm asking Jamf Nation in an act of desperation if anyone else experiences authorization issues with Google workspace similar to this one while using JAMF Pro or have any idea what could be causing this issue.I have full access to the SAML request and Response and can share any other transaction errors upon request. 

Hello Community, I have an issue with one employee's computer so I decided to solve it by deleting her computer from jamf then asking her to enroll again with an invitation link. After she installed jamf, her computer seems to have all profiles installed and shows that it is managed by jamf, but in Jamf Pro I cannot find her computer. I have asked her to run few commands in her computer terminal like : jamf recon and jamf enroll but they are not fixing the issue.  Any idea? Thank you, 

Hi there,Recently (within the last 3 months) we've noticed that devices would randomly stop checking in for weeks at a time. We have confirmed that these devices are connected to stable internet that is not blocking connections between the device and Jamf. The particularly odd behaviour is that after a 2-3 week delay the device would then just checkin as per usual and then continue the same trend of not checking in again.This behaviour is seemingly intermittent without any obvious reasons as to why it's happening. Usually to force a checkin I would have to use the Jamf Pro API to force re-deployment of Jamf Pro software binaries on the device this however does not resolve the issue permanently. The device continues to follow the above mentioned trend.

Hello Community,  I am using JCE to upload configuration profiles automatically to our computers.  and for getting the client ID and secret, I believe its done through creating a new API Role, but I am wondering what are the least necessary privileges needed for this role. any one has an idea?  Thanks,

Is it possible to completely disable iCloud all-together? I know we can disable elements of iCloud in a Configuration Profile, but if we wanted to force-sign-out users from iCloud, then prevent a user from logging into iCloud ever again, can we do this?

Hello, Question: How do you write the exact text to the file instead if it spelling out the $PATH ??I am trying to copy a line with the echo command to a text file. The command works, however it writes the actual path instead of the text itself. Example: echo "export PATH=~/.npm-global/bin:$PATH" | cat >> /Users/$CURRENT_USER/.profileWrites: export PATH=~/.npm-global/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/jamf/bin Instead of " export PATH=~/.npm-global/bin:$PATH " I am scratching my head on this and can't seem to find any answers online, running as the user does not seem to work either as Jamf still fills in the $PATH with it's own seen above. Running from terminal as user still fill's in the path instead of the exact text.  

I'm trying to create an extension attribute for the version of Xcode Command Line Tools that is installed on each machine.The goal is to eventually have a patch policy to regularly update the versions as needed.The closest I have found is this post, however the attribute seems to no longer work and I can't seem to find any documentation to gather the version of Command Line Tools.If anyone has had any luck with this recently I would greatly appreciate any guidance. 

Microsoft has a nice post here about the adding of Defender to the Office installer that many have used in the past.  I didn't catch the change in time to block the install with a profile, and about a dozen Macs picked up the Defender component with an Office suite install.  I've fixed the go-forward issue, but cleaning up the Macs that got Defender doesn't seem as straight forward as the mentioned   rm -rf /Applications/Microsoft\\ Defender.app  from the article. There's an uninstall that is laid down with the installer that appears to remove more than just the .app itself. There's a bit of crud left behind that gets cleaned up with Defender's baked in uninstaller mentioned here sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall' But I can't seem to run that remotely. I'd rather run the uninstaller, and let it catch things like LaunchAgents/Daemons/other crud that were installed with the installer but would be left be

Hello Jamf Nation,I had Jamf Connect configured to create the local user account as Administrator if the Azure AD user has the Admin role assigned in the Jamf Connect Azure AD enterprise application. This worked like a charm until we introduced an enrollment customization with Single Sign-On Authentication (with user information passthrough enabled).Now the user first has to authenticate with Azure via SSO before confirming the password once more in the Jamf Connect flow which then creates the local user. Although the user has to enter their password twice, the added benefit is of course the automatic "registration" of the user to the computer object in Jamf Pro.However, as the title of this post indicates, it seems the 'roles' attribute is now ignored and the local user is always created as Standard.Is there a way to benefit from the enrollment customization without losing the user roles functionality?PS. Using Jamf Connect 2.27.0.

I was looking at the list of Macs registered to JAMF in my company. Some get lost in international transport or are stolen etc.This can sometimes be verified by looking at the last IPv4 it used - if it is miles away I lock them with a PIN with a polite request to contact me.In this instance though, there was no record of the serial number logged in our hardware database - I locked it just to be sure.The person in possession of it has contacted me (months after I locked it), to tell me he cannot use the Mac. It turns out that he is a business partner but no reference to this was logged in JAMF.I gave him both of the two 6-digit codes I use to lock machines. Neither are being accepted.Can the activation lock bypass code (9RV5C-xxxxx-xxxx-xxxx-xxxx-xxxx) in JAMF be used to override this (by the user booting to the recovery environment and entering the code). MacBook Air (M2, 2022), macOS 13.2.1I don't want/need the user to wipe everything on the hard drive etc. Can he then just resta

We retired 200+ macs this summer.  How can I mass delete them from Protect? Doing it one at a time is not a viable use of time.

In my current tasks, have a challenge to find the way to detect all browsers installed on the JAMF Pro administered devices, do you have any idea about do it possible?.Regards,MR

Hello,I would like to know what the proper way is to reset a device while still keeping it under management.I have a MacBook that was added to ABM using Configurator 2 and was prestaged and is now managed in Jamf Pro. It has several policies and packages installed. Now, I want to take the MacBook back from a colleague and send it to a new colleague. He can then start with the MacBook as if it's new (=PreStage). It's important for me that the device is not removed from ABM, because everything is managed remotely.Should I simply click on "Wipe Computer"? Will the MacBook rerun the policies, etc., if it's still in scope? Or do I need to take further steps, such as flushing all policies for that MacBook?Best regards,Floh

We are having an issue with DNS in our environment.  Here's what happens:-We take the iMac out of the box-Run through set up wizard and set ladmin as administrator. When we launch terminal it already has a hostname called from another PC or Mac. This is before we name the computer L-###-M##, E-###-## or F-###-## or enroll it into JAMF Cloud.It got so bad that we started having our network team delete the DNS and AD records when we erased and installed our iMacs; no dice.We've been told they will look into it for years (since High Sierra).  I'm working with what little I know about networking so any suggestions are appreciated.

Looking for a deployment script for Dropbox, so far I have found out that Dropbox does not provide an easy way to deploy their applications. Maybe someone has encountered the same problem before and has script/pkg that could help?

ik can't find it in https://xxx.jamfcloud.com/JSSResource/computers/subset/basic and in https://xxx.jamfcloud.com/JSSResource/computers/id/$deviceid.where the heck is it? :)regards 

Hi All,I am curious if its possible to create a configuration profile using custom schema to modify the profile.xml settings?I know we can package it with installer etc and that's what I am doing but i want to know if there is an easier way to update the profile.xml when there is changes in the connection name or server etc? Thank you!

Hello,I've recently upgraded a MacBook to macOS 14, but Jamf Connect (2.27.0) is not working properly.When i log off, i see just the normal Sonoma Logon-Screen.Is there a new setting?Do i need to turn off Filevault?Thanks!

A tiny bit of a hiccup with JAMF that might affect one of the more 'special' users in my company!When deploying devices, we block practically all iCloud functionality. The user can log in, but document and data sync (such as photos, etc.) is disabled. All done out of security, I must point out that the iCloud accounts are just like any other iCloud account (not managed by the company). All new iPhones receive a configuration profile related to security and iPhone functionally. Let's just call this 'Standard'. For example, certain apps are not available to download. Screenshots cannot be taken, manual resets of the iPhone are not allowed, and so on.There is another config profile for 'Managers' who are afforded a little more freedom in terms of what they can do. Screenshots are allowed. Otherwise blocked apps from the App Store can be installed. WhatsApp is the best example.VPP apps auto-install on the iPhones soon after being enrolled. Nearly everything in the company is Microsoft rela

During Enrollment of a Sonoma MacBook, after Remote Management starts and our required Credentials are entered, it Skips creating the Local User Account. It goes straight to a Log-in Screen instead. We do push a hidden Admin Account via Script during Enrollment. I can Log-in with said hidden Admin Account at that new Log-in screen. We only see this issue with macOS 14.x (Sonoma). We can manually Enroll a Sonoma machine without issue. Only during Enrollment of a Sonoma system is it an issue.  For our current Setup, we need the ability to Create Local Users still.  Anyone else see this issue?  

Hello,I search if somebody knows where these informations are written in the mac. I don't find command line or path to import it. My purpose is to create an extension attribute in JamfPro with these data.If somebody could help me. :-)