My Big Sur workflow was great.Erase and Reinstall the OS either using Recovery or StartOSInstall, leave it to do it's thing, restart at the end of the build script and users can log in.I tried the same process on Monterey and every time it restarts after installing its config profiles.I had to do:  sudo profiles renew -type enrollment sudo jamf policy  for the EnrolmentComplete triggered policy to kick in.Has anyone got a fix for this?

I have an Extension Attribute that reports back the expiration date of a PIV Authentication certificate on a Yubikey.When inventory runs and a user has their Yubikey inserted it reports <result>YYYY-MM-DD</result>.This works very well. If the user does not have a Yubikey inserted when inventory runs the EA does not report any result back to the server.My issue is the EA then ends up being blank. I would prefer it to keep the old results if no result was reported.Is this the expected behavior?

Jamf Cloud: I deleted the ipad object out of Jamf but the actual ipad still has mdm profiles on it. How do I add it back to Jamf? I don't know the activation code so I don't want to wipe it.

Hello all,Question, Has anyone come across JAMF Pro blocking some system settings options such as User Groups, Network etc? If so, how do I remove it and still have MDM installed? Once I removed JAMFcompletely from the PROFILES option in System Settings, everything comes back normally. Here's a screenshot of the block. - Thanks.

Hi all,For a bit now our users have noticed that if they use chrome, they get prompted to sign into our various O365 logins over and over if they close their tab or window.   This doesnt happen if they "sign into google" and turn on syncing.  However anyone using a guest or unnamed profile in google loses their authentication once the window is closed.   We are in the process of requiring MFA for all our staff however anyone with google is getting prompted over and over to sign in and get their phone pin, since each time they close their window it requires re logging in. This does not happen in Safari or Firefox, where once signed in, and you close a window, it remembers that you signed in. I started playing with plists for chrome to see if we could get this to work as it used to and figured it was something with cookies or related to guest browsing and I have yet to find the right plist to make this work. Anyone else seeing this?

I know you can skip different setup assistant windows, but we still get an Analytics window that we'd like to hide.https://developer.apple.com/documentation/devicemanagement/setupassistantHas anyone come up with a way to hide the Analytics window?

Oops!  I deleted a computer from Jamf Pro by mistake.  The computer is still being used (I thought it was out of service).  What do I do to get it back into Jamf and managed?  I tried to manually enroll it but the MDM Profile that gets downloaded to the machine isn't fails to install ("New profile does not meet criteria to replace existing profile.")Help!Thanks! --Jeff

Hey all. I'm still fairly new to all this. I've been trying this for a couple of days now, and I cannot seem to get the proper permissions for AdminByRequest to work. Per this article, I need to allow SystemFilesAllAccess for ABR. I've been using PPPC Utility to created the profile, and I have tried a few different combinations of settings, but none of them have worked. I know it will not show in the Security settings on the Mac, but in profiles, my PPPC is there, and it still not working. I've uninstalled and reinstalled the app with the profile applied, still nothing.Has anyone had any experience like this, whether with ABR specifically, or another app, that could give me some pointers? This has all been on a singular test computer on Monterey, and I need to try to deploy this PPPC to about 80 or so machines, so the manual route is not really an option. Thanks,C

We are trying to deploy the Forescout connector on a Mac machine through a Jamf policy, which requires us to deploy a .pkg file, a script, and most importantly, the folder containing the Forescout agent on the desktop. This folder includes the launch daemon and a few other commands. However, we are encountering errors and are not able to successfully deploy the folder. Can you advise us on how to proceed?

Hey JAMF-er's. This is probably an easy one but I'm still not super versed in scripting. I've cobbled together an script that Makes calls the Classic API to get the position, building, and asset tag information from a computer record. Here are the lines I am using to accomplish this:position=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/position/text()")location=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/location/building/text()")asset=$(/usr/bin/curl -s -H "Authorization: Bearer $token" $jssurl:8443/JSSResource/computers/serialnumber/$serial -H "accept: text/xml" | /usr/bin/xpath -e "/computer/general/asset_tag/text()")It all works as intended, but s there a way to combine these lines so it's not authenticating to the server 3 times to

We use AD in our enviornment, but we have many local users with admin rights. Now that our use of Casper has become more robust. We want to take the local admin users and turn them into standard users. Any suggestions as to the best way to do this?

Hi All, I'm in the process of moving from JAMF Now to Pro. Currently have around 100 computers on JAMF Now and their FileVault key are store in the JAMF NOW Cloud. How can I migrate those recovery keys to Jamf Pro using profiles/policy script. I know that i could go on the host computer. Switch off filevault. Remove computer on JAMF Now. Enroll into JAMF Pro and use a policy/script to escrow key to JAMF Pro cloud. But thats very involved. Is there any other workflows that allow me to be more hands off.

@mm2270 I seem to recall you building some great API scripts previously...hoping you can help me figure out what is wrong here...Im trying to run a script that calls the remove mdm profile button api and had found this... however its giving me an error when I run it even if I try in one line typing the variables directly in: #!/bin/bash ## account with computer create and read (JSS Objects), Send Computer Unmanage Command (JSS Actions) uname="$4" pwd="$5" if [ "$6" != "" ];then server="$6" else ## get current Jamf server server=$(defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url) fi ## ensure the server URL ends with a / strLen=$((${#server}-1)) lastChar="${server:$strLen:1}" if [ ! "$lastChar" = "/" ];then server="${server}/" fi ## get unique identifier for machine udid=$(system_profiler SPHardwareDataType | awk '/UUID/ { print $3; }') ## get c

Can someone with more experience assist me in creating a package with Composer to install Velociraptor? Here is the information i was provided, the only thing i was given plus the client.config.yaml file.  Due to restrictions with Mac OS, a binary with a custom configuration file bundled is unable tobe compiled. For this reason, the install requires specifying a config file when launching theagent.The service install directive can be used to install the agent on Mac client. The followingcommand installs binary & config to /usr/local/sbin.• <velociraptor_file> --config client.config.yaml service installNote: The “client.config.yaml” file will be provided by Stroz Friedberg and included in the uploadportal.The service can be uninstalled with the following command:• /usr/local/sbin/velociraptor service remove --config=/usr/local/sbin/velociraptor.config.yaml• Confirm with ps -eaf | grep velo and sudo launchctl list | grep velo  I am assuming i need

Hi all, I'm back again with another question on how to implement some settings from the CIS Benchmark. We are stuck on requiring an administrator password to access system-wide preferences. I've been doing some research on the issue and I've been hitting a dead end. I found the extremely helpful blog of rtrouton (https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/), but this doesn't seem to be working in Sierra. Does anyone know a good way to script this change? Thanks!

How can one remove an Extension Attribute that was created from a "Patch Management Extension Attribute" template?I do not see how in the official Jamf Pro admin guide instructions.Admin Guide Link - Creating a Computer Extension Attribute from a Template Creating a Computer Extension Attribute from a TemplateJamf Pro has built-in templates for many commonly used extension attributes.Log in to Jamf Pro.In the top-right corner of the page, click Settings Click Computer Management.In the ”Computer Management–Management Framework” section, click Extension Attributes Click New From Template.Click the extension attribute template you want to use.(Optional) Make changes to the settings as needed.Click Save    .

I currently have policies and configs pointing to a static group.  I'd like to start using a smart group in place of it.   If I add all my devices to the new smart group and start pointing the policies and configs to it, will it redeploy everything?  I've added a few test devices to the new smart group (with criteria) and have not noticed any changes and do not get the prompt to push to only newly assigned devices, etc.  The logs also do not show any activity.   Just want to hear other peoples findings.   Thanks

Is there a way to enable reasonable security audit log retention via script to comply with CIS Level 1 requirements? Thank in advance

Hi, I would like to know which devices does not have a specific application for example keynote. Are there any ways to run a search and export the report using JAMF School?Thank you

Hello All,Apologies if this is the wrong audience. I am still fairly new to JAMF (and device management overall tbh).  Both Jamf Pro and Intune have the concepts of Extension Attributes (EA) however, from my limited experience i don't believe Intune can validate the status of EAs in the Intune Compliance Policies. Is my assessment true or does anyone know of a way for Intune to validate an EA allowing the admins to broaden the set of criteria included in the Compliance Policies. 

For new devices and troubleshooting older devices with an OS reinstall, we use the "enrollment" trigger for many of our Mac policies. We have been avoiding creating separate Intel and M1 packages for apps as much as possible. Rosetta has been capable of running all our Intel-based packages on M1s so it hasn't been an issue but I don't want to rely on Rosetta indefinitely. I would like to be able to install either the Intel or M1 versions of apps on enrollment. Is there any JAMF Pro setting I'm missing for the enrollment trigger being able to install the appropriate architecture/processor based package?Looking at alternative solutions: Eventually, our fleet wont have any Intel Macs but until then we still push a pool of default apps to our fleet and use Self Service to make non-essential/optional apps available. Without the enrollment trigger we have relied on having to flush once per computer policies for OS reinstalls or making policies set to "ongoing" at startup with smart groups to

The previous System Admin used a script to rename our laptops in AD, JAMF, and the local machine, which worked until a month or so back. I found the script we currently use in this thread answered by "luke_reagor" However, now, only part of the script works to rename in JAMF and the local machines, but, makes no changes in AD.Microsoft and Apple have been releasing more and more updates related to security and encryption and my thought is that the new updates have broken that script somehow. Has anybody seen or heard about this issue? I did notice that if I manually unbind/rebind to AD the computer name gets updated, but, that won't work in a 500+ employee environment. Any input will be greatly appreciated and if there are new ways to rename bound computers to AD, input your $0.02 cents here.

I have setup EFI password for a static group. The Policy was applied. I have pushed another policy to remove the EFI password. The 2nd policy not triggering:- Exclusions is not over scoping target.- No machine set in pending, no logs, sudo jamf policy "nothing found''.- Policy clone, retire exclusion, change target group to one signe machine : same- push another policy: ok

I have several users who do not want this option. We are using the AD functionality in JSS to bind the machines to the domain which creates mobile accounts. I have unchecked the "Use UNC path from Active Directory to derive network home location" But "Force local home directory on startup disk" is greyed out and selected. I am not sure if this is what is mounting that when they first log in and getting a "directory.org cannot be mounted" error. Any ideas?

In the last two weeks, this is the second time that I have seen multiple posts that have the exact same headline, body, and questions. It looks like Jamf nation is now a part of the global environment by getting trolled by spammers just wanted to give everybody a heads up in case they haven't seen this either. @jamf11 I know its hard, but maybe you can be the leader of the pack and find some way to avoid this?