Hello Jamfnation! I just got back to work from JNUC 2018 and I'm very excited to put into use all the new things I learned. I manage a small fleet of 25 MacBooks, this is expected to double next year. We're using DEP to enroll our machines but would like to stop binding to AD and start using NoMad for AD authentication and local account management. Now there are a few tutorials and different ways to do this. Would anyone recommend a specific "simple" way of doing this, or point me in the right direction to get started. Thanks in advance!

I am trying to set up DEP on our JSS and when ever I get to the point where I have to upload the server token file, I get the error "Problem contacting Apple services" I've redownloaded the private key, deleted and recreated the Management server on Apple's side and tried again but always this error. Anyone got any idea why?

Hi team,Is there any way to suppress the notification asking permission for Falcon to filter network content (screenshot below).Our fleet is on either Catalina or Big Sur. I have created the relevant Configuration Profiles as per the deployment guide supplied by CrowdStrike. Functionally everything works as expected. I am wondering if it is possible to have that message automatically approve or if this is just part of macOS?Thanks!

My DEPnotify policy is set to trigger on "Enrollment Complete". It seems as though the trigger only works half the time. I just tried enrolling 3 machines and the policy never ran. I ended up having to run the "DEPnotify (do not delete)" policy manually from Self Service. Any tips? I already tried disabling "Network State Change" Attached is a screenshot of one of the machines.

Dear Jamf Community,I've created a custom desktop wallpaper and have there components: 1.) Desktoppr2.) A LaunchAgent plist3.) A shell script that the launch agent callsOwner and permissions are correctly set: root:wheel 644 for launch agent and script. Locations:Launch Agent is is: "/Library/LaunchAgents" Script in is in "/Library/Scripts"Desktoppr is installed in default locationLocation of wallpaper: "Library/Desktop Pictures/" Here is the plist and the script:PLIST<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.BoltonCSD.set-wallpaper</string> <key>ProgramArguments</key> <array> <string>/Library/Scripts/set_wallpaper.sh</string> </array> <key>RunAtLoad</key> <true/> <key

We're using cloud and just receiving this generic "Cannot toggle feature. Try again." message when pressing "Use the new experience" button in the new software updates experience page:Anyone else having the same issue or am I missing something? 

Hi everyone,I'm currently working on a custom desktop wallpaper and have learned a lot from reading older posts on here for it. My next question, or a second part of this project would involve using the same wallpaper as a login background. We currently AD bind our macs, if that's relevant.I have made the wallpaper 4480x2250 (same as Apple wallpapers). DPI 300. Any thoughts? Also, the simpler the better and to avoid me asking dumb follow-up questions, please provide explicit steps to accomplishing the solution :-)Thanks!Phil

Just this week, we are noticing that many Macs, but not all of them, are not able to print via our Windows print server. Nothing has changed on our Mac side.We are printing via PaperCut, so using SMB on a printer installed via JAMF and no changes to the setup.Macs not joined to the domain and not using the AD Username as the machine or profile name in many cases, but likely in many others.I can add PaperCut LPD to the print server and print via LPD - but no authentication, so the job gets stuck with no way to get it to print from Papercut, unless the users profile on the Mac is named the same as their AD username.The issue looks very similar to this one:https://community.jamf.com/t5/jamf-pro/mac-printing-issue-after-microsoft-windows-print-server-update/m-p/246842However, we don't have the server updates referenced in the thread or PaperCut advisory.Affected systems are running Monterey, Big Sur, and Catalina.One Mac that was able to print, stopped printing immediately after upgrading

Hello EveryoneWhen I select a group in Software Update payload, and select Download, Install and Restart install option with Latest version based on Device eligibility, the device does download and install however it will not restart the computer.The local IT team has to touch each computer to click the Sys Pref > General > Software Update > Restart. All computers are on at least 13.4.xCurrent Jamf Pro ver 10.50.0Anyone else having same issues or know the fix

We have about 200 employees with all 100% WFH. On paper, I think our patching numbers looks good relative to our user count each week, but my boss isn't buying it as optics are funneled all through Slack and each week, we have about 3 - 5 people complain an app broke during patch. My boss also gets hit up with anecdotal issues of someone complaining to him something broke during patching, and all of that is coming to me. We are using just policy based scripts with smart Groups, instead of leveraging Patch Management, Installer, and 3rd party tools. My question is what does a healthy patching environment look like in terms of statistics? Do you have complaints each week that an app broke? What percentage just fixed an app themselves without reporting or complaining? What are you using to patch our heavy hitters: Zoom, Chrome, and Slack?

Any AppleScript people out there that can help me figure out why the "open location" part of the script is failing to open to the URL?This works:osascript -e "tell application \\"$browser\\" to activate"This does not work:osascript -e "tell application \\"$browser\\" to activate open location "https://www.yahoo.com""  loggedInUser=$(echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ && ! /loginwindow/ {print $3}') # identify default browser defaultBrowser=$(plutil -p /Users/$loggedInUser/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, "\\""); print arr[2]}') if [ "$defaultBrowser" = "com.google.chrome" ]; then browser="Google Chrome" elif [ "$defaultBrowser" = "com.apple.safari" ]; then browser="Safari" elif [ "$defaultBrowser" = "org.mozilla.firefox" ]; then browser="Firefox" elif [ "$defaultBrowser" = "com.microsoft.edgemac" ]; then brows

Hi folks,Does anyone know a way to enforce the screensaver after 20 minutes of inactivity and require password to unlock in Ventura?I've been trying through a script but it doesn't seem to work, and end-users are still able to change the settings through System Settings.Thank you!

Long Story will try to keep it brief. 1,900 iPads enrolled into Jamf  were set up as single use Devices for training. Restricted to Safari and a couple of apps. No Apple ID, no need to connect to Azure Entra.Project gets put on hold, everyone forgets about iPads. Two years later project no longer on hold. Pull them out and all sorts of fun including expired MDM profile and Certs.  We have figured out most of the issues in reenrolling or DFUing the iPads.Except this one: After iPads went into storage we started enrolling Macs. Have pre-stage enrollment setup with Jamf Connect and Entra and SSO. Everything going great.. until.. iPad Project no longer on hold. When we go to DFU and re-enroll the iPad we are prompted for SSO. We do not want this. The hope is I can create an enrollment for the iPads that does not require SSO authentication. Ideas?

Hi all,Is there a solution to mark several iPads via Jamf and trigger a LostMode?e.g. 20 or more 50 iPads are stolen from a school and you want to activate the Lostmode with the appropriate message.How could we trigger this as quickly as possible and without much time expenditure with a message?Without having to set the LostMode on the iPad individually?Nice RegardsPeter

Hello together,Is it generally possible to assign the same app from two different ABM in same JAMF environment?Maybe is a stupid question but would like to know if it is possible.I have booked the app from two different ABM and assigned to the same JAMF but can only see booked app from one ABM!Thanks already for your help 🙂

Hello There,I am wondering if anyone having same issue that I am facing regarding Nudge.  Somehow when I am launching it the Nudge window doesn't show Deferral dropdown box as it is suppose to, So user can't defer the app any shap or form and it stays on window until user updates their compurter. All settiing for deferral are in JSON file. Deferral dropdown doesn't show on buttom right as it is suppose to. Any help appreciated.  {  "optionalFeatures": {    "acceptableApplicationBundleIDs": [],    "acceptableAssertionUsage": false,    "acceptableCameraUsage": false,    "acceptableScreenSharingUsage": false,    "aggressiveUserExperience": true,    "aggressiveUserFullScreenExperience": true,    "asynchronousSoftwareUpdate": true,    "attemptToBlockApplicationLaunches": false,    "attemptToFetchMajorUpgrade": true,    "blockedApplicationBundleIDs": [],  &nb

Hello,I want to use PreStage to enroll my macs that I already purchased.So I use Apple Configurator 2, they are registered in ABM but they don't appear in Jamf.Then I saw on ABM they are enroll with the Apple Configurator MDM server. I change the server to Jamf pro. I set by default that all macs added to ABM have to automatically use Jamf pro MDM server. But same issue, they use : Apple Configurator MDM server.My question is : is it possible to successfully enroll a mac with Apple configurator with Jamf pro? 

With Apple's changes to who qualifies for the Developer beta (as well as how it is installed), does anyone have advice on how to block users from installing it? In the past we always created a Restricted Software policy that restricted and then killed the process named "Install macOS <this year's name> Beta.app", but it looks like Apple is no longer deploying these in that way anymore. Granted, I could be wrong on that haha.We've created a similar policy for Sonoma, as well as an additional policy that blocks "macOSDeveloperBetaAccessUtility*" -- since it looks like that is the new deployment method. Have any of you come across a better solution?

I have been testing the Jamf compliance editor, and the scripts for the extension attributes are reporting 0 when the files the script is reading has a few failures and 2 exemptions. I am not seeing anything out of place in the script, any help? Here is the script for the Failure Count Attribute:  #!/bin/bash# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ### Copyright (c) 2022 Jamf. All rights reserved.## Redistribution and use in source and binary forms, with or without# modification, are permitted provided that the following conditions are met:# * Redistributions of source code must retain the above copyright# notice, this list of conditions and the following disclaimer.# * Redistributions in binary form must reproduce the above copyright# notice, this list of conditions and the following disclaimer in the# documentation and/or other materials provided with the distribution.# * Neither the name of the Jamf nor the names of its cont

I have combed through all the threads here before posting, I am trying to figure out why this is happening to all unencrypted Macs on this server. The user gets a pop-up to enable FV, enter password, and then the following shows up in the logs: All the users have Secure Token, and they are enabled for FV2. Any help would be appreciated.  Here is the setup we have:    

Our Jamf environment requires that all Macs have FileVault enabled and we recently discovered that all of our Ventura systems can no longer unlock the drive with any administrator accounts. The only ones that can are standard accounts. We we're able to reproduce this issue on both an existing system that was upgraded to Ventura and a brand new MacBook Pro. To clarify:- FileVault is enabled on Mac OS Ventura.- Administrator accounts are unable to unlock the drive at startup/reboot.- Only Standard accounts are able to unlock the drive at startup/reboot.- We were able to reproduce the issue on both an older Silicon Mac and a brand new Silicon Mac out of the box. Any advice is greatly appreciated.

We've successfully deployed the reissue FileVault key script in our environment to send FV recovery keys to Jamf Pro to 99% of the Macs in our fleet. However, we have one Mac whose user is unable to send the key to Jamf Pro due to the following error: Error: User could not be authenticated. Error: Unable to unlock or authenticate to FileVault.To be sure, the user is using his Mac password to unlock System Settings, unlock FileVault at login, etc. But it's unable to generate a new FV key. Any suggestions on how to troubleshoot this sort of thing? I would prefer to avoid having to wipe/reinstall the OS unless it's the only option. 

Hello all! I'm new to JAMF. We have installed Mac Mini machines to be content caches for our iPads in the school system. They are set to configure themselves when they are plugged into the network and powered up. The default name is mac mini. I go and manually rename each one after it comes up. But for some reason, a couple of days later, the name has reverted to mac mini. I look in the history in JAMF and it only shows when it was created and each time I have renamed it. Any logs I can look at other than the history for the machine? Any ideas?

We use Jamf Pro Cloud to manage our Mac fleet but would like to hybrid join our Macs to Intune as a method to control who can use Office 365.  I see that Conditional access is being Deprecated.  Can I accomplish this with just using Device Compliance?  I keep getting Notifications in endpoint stating that an Intune update is coming concerning Intune device compliance.  I’m new to Azure / Intune so I apologize for my ignorance on that side.

Hello, Currently our staff have admin privileges on our Mac OS X Machines. We would like to take this away and make them a standard user. The only thing preventing us from doing so is adding Wifi Networks either at work or home. Does anyone know a way we can give permission to add wifi networks to a standard user without admin privileges? Any help is much appreciated. We are typically a OS X 10.10.X or 10.11.X environment. Thanks in advance