Lightspeed just released the newest version of filter agent that completely changes how it works based on Apple's system extensions. This is completely different from the way it worked before. If I were to update it via auto update it would give the users a number of permission prompts that they could decline. LS released some documentation for updating these permissions automatically via MDM but frankly the instructions are kind of confusing for a relative newb. Could one of you kind experts perhaps take a look at these instructions and boil down what I need to do? Thanks in advance!

Hi everyone, I am hoping someone might be able to help me out with an issue I just started running into. Also wondering if anyone else is having this problem.We have been using the built in "Software Updates" policy in Jamf for years now, and it has been working great for installing macOS updates for our end users. However, the last couple of months, something has changed where the policy no longer only installs security updates and feature updates for the current OS, but will force the device to upgrade to the latest macOS without any warning or prompts. This is problematic for us, as some of our users have software that has not been made compatible with macOS Ventura yet. The only way to downgrade from Ventura is to wipe the computer, so that becomes extremely time consuming and annoying for our users.Is this a bug with the Software Updates policy or is this now the intended design? If it is the latter, does anyone have a better way to run updates for the current OS the user is on, i

Hi,I try to install VPP apps on an iPad, but the following message appears: Device was busy. Will try again. It is the same with the automatic installation of the Self Service app. iPad : battery :more 90%unlocked, but temporary session onlyconnected on WiFi (Internet access ok) I try : Clear code : Bad requestSend blank notification -> nothing on the iPadRestart : work I don't see the problem. Thanks for your help.

Hello Community, At the moment we have 50 Macs. On all Macy, the user are local admin. On all Devices we have a local account with admin rights, too. Now we want to delete the local admin rights for all user. Only our local account geht local admin rights. My question is: Can every help me to delete the local admin rights with a script? That only our local admin get the admin rights? Many Thanks for help!Christian

Hi All,We suddenly have few Macs, after restart/shutdown, user not able to login to their account.All Macs are Filevault enable and users are default added into Filevault (we use AD – mobile account). Our local admin, is also Filevault user and disk owner. But we can’t even login as our local admin. It just will then show a black screen and then will loop back to the login page.We are able to temporarily fix this by reinstalling macOS (without erasing the disk).Has anyone experienced the same issue?There were no changes to any of our exsiting policies in JAMF.We are also using McAfee as our endpoint security, including the encryption as well.

I am looking for suggestions on the best way to disable the touch ID / fingerprint prompts that come up when a new user logs into a Mac for the first time.  This is specifically on an iMac with the new keyboards with the fingerprint reader, I'm not sure if this differs from the MacBook Pro so I thought I would mention that.

Hi all,  I am new to jamf and still understanding the intricacies with deploying config profiles using smart groups. I have a config profile being deployed to computers via a smart group.  The smart group is defined as computers that dont have the config profile installed.  Its been working well, but due to changes in the way we are installing a particular application,  I no longer want that config profile active in the environment for net new devices but I dont want the profile removed from the computers that already have it.  How would I go about doing this?   thanks

Hi, I'm new to Casper (hi) and I'm a bit confused about the Policy FUT and FEU options. Do I just use Composer to capture user-level preferences etc. from whatever account I'm logged into, then create a DMG from the result, or do I have to place user items in a particular place? Is it possible to mix user files and non-user in the same DMG? Sorry for the silly questions, but this doesn't seem to be covered in the Casper manual. Cheers, a|x

In the midst of testing and we have a Mac at the client site that was not properly assigned to a department when DEP enrollment completed (and the department being blank meant that the computer was out of scope). Since Enrollment is the only trigger, I'm trying to figure out another way to push all of the policies that should have fired under normal circumstances. Due to the lack of mass-editing functionality in Jamf, I'm not really excited about the thought of creating Self-service versions of the same policies or making dupe policies with only that machine in scope. Is there any non-destructive way to make JSS think that the device just completed enrollment so all of these policies will fire?

We have about 50/50 M1 vs Intel chip Macbooks.We are using Jamf Connect as well (not sure if relevant)We have a standard Admin account created and loaded for every computer during prestage enrollment.We are not able to run the MacOS Ventura Installer on the M1 macs because it does accept the Admin credentials provided. These same Admin credentials are working for installing apps, etc. The update does work if you switch to the mentioned Admin account on the computer and then run the update.The update has none of these issues for the Intel macs. I can run the update from the user's account using the same Admin credentials. Anyone know why the M1 would not let us run this update from the user's standard account, even providing the correct Admin credentials?

Hey I want to achieve the following. If a certain local user logs in to open a terminal window and show the jamf.log file.What I have done so far create a policy. with the trigger Login that executes a script that looks the following  #!/bin/bash# Check if the user is sadminif [ $(whoami) = "admin" ]; then# Open a new Terminal window and run 'tail -f /var/log/jamf.log'osascript -e 'tell app "Terminal" to do script "tail -f /var/log/jamf.log"'fi the policy is executed when user "admin" logs in and gives no errors but there is no terminal window being opened and displays the jamf.log fileI dont know where the error is or why it won't work!? How can I achieve this?

Hello everyone, I am trying to configure Screen Saver Corners Are Secure -tr-corner ( https://www.tenable.com/audits/items/CIS_Apple_macOS_13.0_Ventura_v1.0.0_L2.audit:d8e594473ad878254160a22990e7bb3a) and for solution I can create a profile.But there is mentioned that "the key to include is Forced". Can someone please explain what is this key and how you use it?Thanks,Traian

Hello All,We use a proxy on our network and we are trying to come up with a solution to allow devices to establish a connection to Apple without bypassing that proxy. Has anyone encountered a similar situation and has come up with a way to resolve it? Any and all help is appreciated. Thank you

I am trying to remove stale / inactive mobile acct from the workstations after a certain time period.I tried a script but for some reason it also seems to delete the accts that are not in the time range ( e.g. set to delete acct after 14 day and the current user that logged in yesterday gets deleted also )I am trying to use a Config Profile > Mobility > Account Expiry payload but whenever I save the CP, it reverts back to 0 Hours.I've downloaded the .mobileconfig file and checked with a CP editor and it also shows 0 sec.I've created an new .mobileconfig file with 604800 ( 7 days ) and upload to Jamf Pro. The uploaded CP shows up with the correct duration ( 7 days ) but when I click Save, it reverts back to 0 hours.

This appears to be happening to all our devices. Many times when a user or even myself goes to our iPhone and open up teams it is grayed out and is need to update. This is happening constantly, at first i thought "oh wow, they are doing lots of updates to this app." but that isn't the case. when this happens we are not getting notifications for the app. When i checked my phone, i am on the latest iOS still the issue.I do have in JAMF setup to push updates automatically, make app managed if not managed, and the scope of the app is for all devices. We are not out of licenses as i still have around 198 available still.

I'm publishing an EDGE plist, that were created by iMazing Profile Editor.  Defined the "RestoreOnStartupURLs" setting. Set to 4 (open a list of URLs). Additionally added the setting "RestoreOnStartupUserURLsEnabled" = true. Problem is: The User can add & remove their own startup urls, but not remove the defined ones from "RestoreOnStartupURLs". Is it possible to accomplish that?On Windows you can change this behavior. Microsoft Edge Browser Policy Documentation | Microsoft Learn 

Hi all,I hope someone can help me to find a solution.Within FireEye HX I could create an alert with "fileWriteEvent/fileName starts-with xxx"I try to rebuild this within Jamf Protect.I have created a custom analytic with the following analytic filter: (($event.isNew == 1 OR $event.type == 0) AND$event.prevFile == "protecttest")I have also added this to a smart group called "protect-ProtectTest". I have created a smart group with the criteria Jamf Protect smart groups like protect-ProtectTest and assigned this smart group to a policy where a script removes the group from the client: rm /Library/Application\\ Support/JamfProtect/groups/protect-ProtectTestI don't know where my fault is that it doesn't work.I hope for your answers or hints what I did wrong.Thx, Mario.

We're trying to setup an ipad to use to track some airtags but we can't add them. We get "Cannot set up AirTag. Your device management settings do not support AirTag pairing on this iPad." We have no restrictions in JAMF for this yet sure enough if you look at the profiles there's one that says "Devices tab in Find My app is disabled" but we don't have any restriction for that turned on. If we wipe it and remove it from our enrollments it works fine but then we're not managing it.

I'm looking to transition from having our MSP provision brand new laptops to having the end-user run through the setup. We look to be all setup for auto-enrollment into our MDM. I don't see any reason not to go this route other than we can't seem to setup a local admin account remotely that has access on machines with filevault enabled. Any other reasons not to go this route? 

For individual computers we gather application usage logs. For every computer I can check what applications have ran at: Computer > History > Application Usage Logs.Is it also possible to query these logs over all computers? I want to know if an specific application (Microsoft Outlook) is actually being used, say last month. 

Hello, I am looking to see if there is a way to rename devices in Jamf Pro's Devices tab. I have looked all over and have found no way to rename the iOS and iPadOS devices. I must be missing something. Would anyone be able to guide me through this? I have DEP devices in Jamf so I should have access to change the device name.

I'm looking for recommendation for scripting installs with Brew to deploy software.  Whenever I try to do an install from Jamf using brew it fails stating cannot be run as a root user or something like that.  I've found several recommended ways do it but never seem to work.

We have an interesting situation.Last year we discovered an issue where about 630 of our devices never renewed their mdm profile, and they are now unable to get any management commands or profile updates.  We have a decent solution that takes about 5 min per device to turn of csrutil and then remove the profiles and then re-enroll, however we have also found that one of the profiles is causing issues for testing that is currently going on.  The profile in question adjusts the "Parental Controls" to try to block adult websites with its content blocker.  We turned this one on back in 2020 and it originally allowed parents of students to use the screen time function.  This appears to no longer be necessary since you dont now need this feature on to turn on screen time, but now since the mdm is expired we cannot remove or adjust this setting without many steps. Im hoping someone in the community can tell me a way to write the plist or a defaults command that can su

 Here's what I'm talking about: I've tried several Configuration Profile configurations and followed the instructions as provided by Cylance, but what's pictured above still appears. For now, we've been manually hitting the "Allow" button to ensure that Cylance fully installs. Any advice would be appreciated!

Hey,is there a possibility to disable the Guided access? The students are frequently setting codes, which is very annoying...