Opened up a case with Jamf support, they are seeing this pop up . Check your devices, especially any new device enrolled into your Tenant.  I have tried all the previous possible commands to fix and none of them worked. 

I thought I would try to create a VM to test erase-install OS updates. I setup a VM enrolled it in JAMF, I had to do a few things, because it didn't enroll everything correctly. I'm not, trying to test erase-install, but it says, I'm not a volume owner. Any ideas or is it not possible via the VM using UTM?

I am the JAMF admin for my employer. When a Mac needs to be remotely wiped, marked as stolen, prompted to be updated etc such request come through me.I found a Mac a few months ago, that had been inactive for several months, had a name that differs from the convention set by the enrollment profile etc. No record could be found of it in the hardware database that we use for just about everything else in the company. Usually such devices are regarded as stolen/lost in transit etc. I was never informed that a device belonging to someone external to the company had a mac added to JAMF.I sent the command to LOCK it with a message to state my name and email address with a request to contact me to verify ownership. An external business partner contacted me yesterday looking for the unlock code. I had no reason to doubt he was indeed genuine. I shared with him what could only have been one or other of the two unlock 6 digit lock codes.He attempted them, but now he appears to be locked out of t

Hello!I have an iPad Pro that we have released from Apple Business Manager and removed from JAMF Pro. There is no longer a trace of it within our system. However, after the iPad was factory reset the MDM Profile was still there from Jamf.What would be the next step in this process? Thank You in advance! 

Hi All, Since Microsoft change to Entra, when we do PreStage with Jamf Connect (using Azure as Idp) it will ask the user to select an account to sync with your Microsoft Entra ID account.this is extra step in user enrollment (we want by default to just create account) how do we achieve this?    

Hi there,We seem to be having issues trying to SSH into devices with SSH enabled on a backdoor local admin account. This issue is only apparent when trying to connect over the internet to a host with SSH enabled. When that device is on the same local network I'm able to SSH fine without issue.I've tested multiple machines in the environment and issue is exactly the same on all machines.This is the script used to enable SSH on the target device: #!/bin/sh ssh_user="THE_USERNAME_OF_THE_ADMIN_USER_ACCOUNT" # turn ssh on systemsetup -setremotelogin on # append user to ssh group dseditgroup -o edit -a $ssh_user -t user com.apple.access_ssh # restart ssh launchctl unload /System/Library/LaunchDaemons/ssh.plist sleep 5 launchctl load -w /System/Library/LaunchDaemons/ssh.plist exit 0 And connect in Terminal using 'ssh THE_NAME_OF_THE_ADMIN_USER_ACCOUNT@targetIp' 

Hello community, I am stuck trying to figure out a way to reset password of forgotten computer password that is used to log in to the computer. I have read here that you could do reset a computer's password with local account policy and I have tried that and it is not working. i am not sure which triggers i should enable for this to work or any other option i should include. Also, the reset option in local accounts policy says: This does not update the account's login keychain password or FileVault 2 password.  can i update the those credentials later with the filevault recovery key that i hold?I also have tried the filevault approach, but i can only see the reset password with apple id option and not the using filevault recovery key. Thanks for the help in advance  

Need to know how to generate report for Mac users who left organisation?

Is there a way of passing the "Latest Version" variable from Patch Reporting of an application into a script in a policy? Thanks

Hello, I have enrolled an user in JAMF pro before enrolling the device in Apple Business Manager. I have removed the MDM profile and reset the Mac. so should I delete the user from JAMF pro before starting the device enrollment in Apple business manager? or I can enroll the device in apple business manager then delete the user from JAMF Pro? 

App Installers are new to Jamf School.  I have been experimenting with Chrome on a test device.  Since I installed Chrome using the App Installer there has been an update to Chrome.  How and when will this update be loaded into Jamf School and pushed out to any devices the app is scoped to? 

We normally block URL's via our firewall but wanted to test blocking a specific URL for just one lab and figured I'd just use the Parental Controls in the JSS to do it. I've added both the www.domain.com and domain.com to the deny list and pushed it to my test iMac and MacBook but they can still visit the URL's. I've even rebooted the systems and flushed the cache but the URL is still not blocked. What am I missing?

Hello Everyone,  Is anyone else seeing macOS Sonoma not respecting the delay within the restrictions payload?I have the delay for Major software updates set to 90 days. In addition I also have a software restriction setup for "Install macOS Sonoma.app". Not sure how my users / systems are being updated?   

Hello everyone,I use a device smart group that includes all iPhones to push a background image. The criteria I am using is Model > is > iPhone. This pushes every month to make sure anyone that changes it will have it set back to the correct background. For some reason, some users reported that their iPhone background has changed to a blank, black background. Pushing the wallpaper change directly to a user's device using the wallpaper change command fixes the issue no problem. What I am trying to find out is why it's happening in the first place and how to prevent it from happening again. Thanks,Matt

We run a script through self service that migrates data from a user's old computer to their new computer (computers connected via target disk mode). Data copies perfectly, however, Jamf throws up some messages like the attached for things like Documents, Desktop, Downloads, Reminders etc. Any idea of how to allow that in advance without having to click OK every time? Config profile maybe?

I have tried writing a script about four different ways simply to report what version cURL is installed on Macs. I am scratching my head why the value is blank after running recon on various Macs.  Below is the script:#!/bin/bash if command -v curl >/dev/null 2>&1; then curl_version=$(curl --version | awk 'NR==1{print $2}') echo "cURL is installed. Version: $curl_version" else echo "cURL is not installed." fi

Hello! I сan't erase all content on macOS Ventura, I tested PreStage (cleaned the test mac several times), and it looks like I didn’t delete the profiles from the test device at some point. And now i can’t erase all content from the test device. I tried to add the device again through User-initiated enrollment, but it shows up as UNMANAGED, and I can’t delete profiles or wipe the device.Please tell me how to clean the device.

I'd like to find a way to allow users to change the following things, either without a password or using their own, instead of needing admin rights.Power settings, like how long before turning off the display on battery or power adapterNetwork settings, like changing wi-fi networks Auto-Join settingPrinting settings, like updating Options and Supplies (this only started asking for an admin password since I think Ventura)Privacy and Security, like adding an app to Accessibility.Does anybody know a good way to do this? I wish the config profiles were a bit more like GPOs in this regard because I suspect I need a script instead of a checkbox.

We seem to be running into an issue with Secure Tokens. Searching has made me realize this is something most people are having difficulty with but it's usually with the Admin account not having a token but ours is sometimes the other way around.Long story short a second admin account that was added during the enrollment stage was getting the token then other users logging into the device would not get a token, now really showing itself with updates and the users getting a "You need to be an owner" error.So I created a script to run from Self Service that just prompts the user for their password then runs the command and passes the credentials of the Admin with the secure token. However, it always errors out saying the users password is incorrect but when I test and run the same thing from the terminal on the test device it works fine. Is there something I'm missing here? Does apple do something to restrict this kind of access from a script?   #!/bin/bash # Prompt the us

My Google-foo is failing me.  Although my script works to trigger the Jamf helper window - I get 'posix_spawn(): 2: No such file or directory' <-- And as far as I can tell it's because i'm trying to call launchctl -but - can't figure it out.  Is this an error I should be concerned about?JHELPER="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" LOGGED_IN_USER=$(stat -f%Su /dev/console) LOGGED_IN_UID=$(id -u "$LOGGED_IN_USER") echo $LOGGED_IN_USER WELCOME=$("$JHELPER" -windowType utility -windowPosition lr -heading "Urgent message from Mac Desktop Services." -alignDescription natural -description "An urgent OS update is needed on your system. Please run sofware update at the end of the day (Apple Menu --> System Settings --> General - Software Update) and install Ventura macOS 13 updates to bring your system to 13.6 if it is not already. Please do not click Upgrade to Sonoma, only updates for macOS 13 Ventura " -button1 "Go to u

Buen día, por favor alguien sabe cómo aplicar bloqueo de pantalla, al cerrar la tapa y abrir ya tenga el bloqueo para ingresar password, esto desde jamf pro. Saludos!!

We have just started using Jamf Pro.  We were using Meraki and some of our iPads are in there.  What is the best (or proper) sequence for getting these into Jamf Pro?  My thought was to do this in the following order but was hoping someone could confirm this will successfully move this from Meraki to Jamf Pro.1.  In Meraki under DEP, select the device and click Remove Device2. In ABM, go to the device and choose edit Device Management and change it to our Jamf Pro MDM from the list.3. Wait for Jamf Pro to sync with ABM and the device should now be in my list in Jamf Pro to assign to a prestage enrollment.

Hi After updating to iOS 17 the wallpaper we use suddenly started zooming in after it's added to the phone.It looks correct for around 1 second and then it zooms in on the image.Anyone else had that issue and found a solution? Worked perfect using the same image on iOS 16.I have not changed anything to the smart group we used for iOS 16, since it's just set up to add it to all enrolled devices.//Kenneth

We use Jamf School to manage iPads and will be using Jamf Pro to manage Mac Minis for a high school computer lab. Can these two use the same VPP token and the same Apple ID? In my research, I'm finding that we can use the same Apple ID but need to create a different location with a seperate VPP token. Is this correct? 

hey guys,  I was trying to make computers compliant with cis level 1 hardening standards. Although i have solved some of the standards with configuration profiles, but many remained and i thought automating the process with a script would be easier.i found this great project https://github.com/usnistgov/macos_security.git  and i have tried it on my computer, though it did not fix everything, but it improved my compliance. I created the below bash script and tested it. but when i created the script in jamf and went on and made it a policy on one computer, it failed.any one please have an idea to solve this? or maybe i could change my approach. the script is :#!/bin/bashcd /Users/$USER/Applicationsmkdir cis_compliancecd cis_compliance/macos_securitygit clone https://github.com/usnistgov/macos_security.gitcd macos_securitygit checkout montereypip3 install -r requirements.txt --userbundle install --binstubs --path mscp_gems./scripts/generate_baseline.py -k cis