Is it possible to only use the Guest account on Business Shared iPad? Not allow any user to log into a managed Apple ID, but allow the use of the Guest account. We still want the Guest account to log in and log out, which will erase the patient data. We just don't want patients logging in with an Apple ID.

Hello group, I'm attempting to create a custom ForcePoint ( WebsenseEndpoint ) installer for hosting on Self Service and automated deployment via policy. At present installing ForcePoint is a manual and tedious process that involves installing two separate packages with administrative privileges. These two packages require launching and installation to be done from within the directory that contains the required " ca.cer " , " DLPClientConfig.hsw " and " localConfig.xml " files ( listed below ) .... I've used ForcePoints " WebsenseEndpointPackageBuilder.exe " package builder application on Windows which creates the folder contents listed below, great but still requires manual installation ... Does anyone have any insight or had luck creating a custom package in composer ? I've tried multiple times with little to no luck...Any help would be greatly appreciated. ForcePoint direcoty contents - 1) ca.cer2) DLPClientConfig.hsw3)

We got some problems a way back when enrolling devices. We only get the MDM Profile, nothing more. Normally you should get about 8 to 15 profiles depending who you are and where you work. Anybody have any idea what causes this problem? For one week ago we moved to Jamf Cloud and I thought the problem should disappear, but it didn't.

When wiping iPads and selecting the option to clear the Activation Lock on ADE iPads, the device wipes as normal, but then users are prompted to enter the organization's Apple ID to unlock the device. The recorded bypass code in Jamf Pro still works, but I cannot figure out why it keeps failing to clear it. Server logs show this error message (serial has been removed):   2022-08-29 02:59:03,208 [ERROR] [ina-exec-45] [ActivationLockService ] - Failed to clear activation lock for (SERIAL). ActivationLockResponse [status=404, message=Device not found or activation lock bypass is invalid.]  Is anyone else experiencing this problem or know what could be causing it? It's happening on multiple iPads.

I'm in a little predicament whereby we receive "new user" requests that contain a display name (first and last) and email address (not connected to our Corporate domain) which is followed (once approved) by a Jamf enrollment invitation sent to said email address.Once the enrollment (of a device of which we currently have no information) is complete our process dictates that we continue to create email account and other app accounts for the new user.I'm using webhooks (computerAdded, and computerCheckin trigger=enrollmentComplete) to try to kick off the second part of the process, however I currently can't think of a way to link the enrolled computer to the invitation. I don't have the computer serial number from the request, and the local username won't necessarily equal what we will create for the user.I know I can see enrolled computers from the computerinvitations.html page in the Jamf console. Can I get this via the API?

Is there a way to get all of our LDAP users into the Jamf Users section? We have a Jamf Infrastructure Manager with the LDAP proxy set up, and it can search for users and find them from the test, but I can't see anyplace to import the users that we will be assigning devices and software to.

Hello everyone,I am still in the evaluation phase of JamfPro. While testing, I came across a question about whether the devices on which you want to perform Secure Erase must also be registered in the Apple Business Manager, or whether you only need to register devices in Jamf Pro to perform a Secure Erase. Devices that are already in use can only be registered in the Apple Business Manager if you completely erase them. This would not be feasible for my colleagues, so I would want to avoid registering in the Apple Business Manager. Therefore, it is important to know whether self-enrollment in Jamf Pro is sufficient for Secure Erase.Here a screenshot:Does 'Wipe Computer' in JamfPro perform a secure erase of the entire hard drive (i.e., the Secure Erase command built into macOS), or does it simply delete data from the device?Best regardsFloh

We seem to have an issue with the configuration of our Jamf Connect.We are using the connection with Azure to create our users.Some Macs login with the Jamf Connect window, but some show the native MacOS window with 3 buttons. This last is not desired, since most of our users do not know their Local User account.The native MacOS login window only appears after a reboot. When the Mac sleeps, it pops up with the desired login window (the one with the user icon).The thing is that this does not happen on all our Macs. Out of about 30 Mac, this has happened once on a M1 13" pro running Monterrey and this week on 2 new M2Pro 16" machines.Our configuration has not changes, since we onboarded to Jamf last October.I am sure we are doing something wrong here, but I have no idea where to start looking. Hopefully someone can point me in the right direction. 

Hi All,I'm new to Jamf pro and heard about the re-enrollment. However, I got a question that if we delete the entry of the device rather than enabled the re-enrollment option. What makes the difference? Kindly help me to understand. Thanks.

Morning!I'm currently trialing Jamf School.  Want to test how to use Google authentication during enrollment.  I believe I have everything set up: Built Google API Console Project, created credentials, added redirect URIs, copy and saved client ID/secret, then added all that into Jamf School under Authentication method.On iPads I'm using for trial, I wiped and reset.  iPad went through enrollment easily enough.  But I expected to come up on a Google sign in page which needed authentication.  But nothing shows up.  Just normal enrollment steps.My questions - What should I be expecting?  How can I use Jamf School and Google in a 1-1 iPad setting? Thanks!- Kevin 

I am starting to use Self Service to push out Office Updates (primary concern), Flash player updates, run RUM to update CS 6 installs...pretty much all updates (even Apple Software Updates soon). I do this by promoting the updates through a series of smart groups. Is there any good way to notify a logged in user that they have new Self Service items waiting? So far I'm having no luck with scripting a decent solution.

I'm attempting to create a Smart Group for "desktop Macs." We have a number of different iMacs and minis in our environment. But it appears I have to choose from predefined models (e.g., "Model IS iMac Intel (21.5-Inch, Late 2015) OR Model IS iMac Intel (21.5-inch, Mid 2017)," etc., in order to start seeing the Smart Group get populated.I was hoping/expecting to be able to construct criteria such as "Model LIKE 'iMac' OR Model LIKE 'Macmini' OR Model Like 'MacPro'" since the official Model Identifiers under the hood all use such strings, and they're unique enough across product lines. That way it wouldn't matter what exact iMac or mini models I've got in our environment, and don't have to add new Model criteria when, say, the M3 minis start showing up at some point.I don't think I'm missing anything obvious, but it wouldn't be the first time something escaped my eye.

I'm trying to get a smart computer group running to check for Java/java version. I can't seem to get it working. I use the script below in an Extension Attribute and have the group set for "is not" Java 8 Update 131 build 11 Any ideas? #!/bin/sh version=`defaults read /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleShortVersionString` echo "$version"

Hi gang,I'm trying to accomplish two things with Self Service. One policy will open Google Drive (this I have working in my script) followed by launching the location in a new Finder window upon clicking (ie: //Users/$loggedInUser/Google\\ Drive/Shared\\ drives/) for when people tell me "they lost their Google Drive." This new finder window is the piece that is not working. My error says location does not exist even though it does. So sounds like a permissions error?For my next trick I want to have a policy that opens a PDF file stored on a shared Google Drive.I have tried lots of ways to script this which all work locally for me fine but not when calling the policy through JAMF. I'm thinking permissions here too. Maybe a PPPC that I need to allowed Files and Folders access to JAMF or something else?Thanks!

Both CIS and Tenable provide a configuration profile method to undo any hot corner set to disable screen saver.CIS uses <≠6>Tenable uses <!=6>Neither seem to work. Anyone have any luck with this?

hi all,Jamf just spin off 1 free dev sandbox for me and i am looking to copy everything from my production jamf pro cloud to this cloud dev sandbox using jamf migrator. I am new to github - so can anyone help me on how to use Jamf Migrator in github (https://github.com/jamf/JamfMigrator)?I download the zip code and extract it but could not find any apps inside

tl;dr: I want to write a script to monitor the log JAMF generates when executing a policy.We are deploying macOS updates by pushing the installer version we want down, then executing "/Applications/Install macOS Monterey.app/Contents/Resources/startosinstall" --agreetolicense in the Files & Processes policy module. The problem with this method is that there is no feedback shown to the user to provide the status/progress. I'm going to write a script to use in combination with Octory & octory-notifier to display the current progress. I'd like to use the policy log output as it is generated, and monitor it with less -f -n0|grep... to trigger whatever update I want in Octory.Is it possible to monitor the policy log as it's generated?

Hello,Can anyone get Google Chrome to install from the Jamf App Catalog? I have three different Macs, and it doesn't work on any of them. I get the error "Unqualified for App Installer" on all three. I am deploying Microsoft Teams the same way, which works perfectly without any issues. I've tried many things and continue to get the same error. Thanks in advance for any help!Steve

In the olden days (Catalina and prior) we used the Software Update option to let users install any Apple software updates available (this doesn't include upgrades like 10.15 to 11.x, but just 10.15.x to 10.15.x+). But obviously this doesn't work now with Monterey (apparently).I'm aware of configuration policies to force updates down onto machines, but we can't do that. We're a 24/7 organization with users in every time zone, and many do not have Silicon Valley quality internet (literally leasing lines from sheep herders in some countries or using mobile satellite terminals with bandwidth measure in KB not MB or GB). So we've trained the users to run the update regularly from our self service portal.I've tried using the Files and Processes with... softwareupdate -iaR...but that doesn't even seem to work for Monterey.Any suggestions? Can't use a caching server, as sometimes these are the only users of ours in a location. Maybe a policy to cache the update and then install but they s

Hello Everyone,We have a department paying for a language interpretation service that comes with a corresponding iOS app (LanguageLine Insight). Currently we have the iOS app set to automatically install on all devices for that department, and if anyone in that department wants to use the app they must contact the department administrator for the authentication (license) code. They chose not to have us configure the auth code into the app during deployment for unknown reasons.Other departments have shown interest in this app so we are now looking at purchasing a site license for everyone to use. In order to facilitate easier billing for each department, the company is going to provide unique authentication codes for each department. The department heads however have shown interest in having the authentication codes pushed out with the app.The app itself does not support this feature. It supports a single authentication code during deployment only. My question is, can I simply add multi

I am setting up Nudge to be deployed via the Jamf App Catalog to facilitate keeping it up to date, but it does not appear to be installing the LaunchAgent even though the listing says it will 1) is this (or should it even be) the intended behavior? 2) Who manages the Jamf App Catalog entries?  Honestly, I think having a separate Nudge Launch Agent in the App Catalog may be better (in order to Balance the ease of Auto-Updates and deployments vs managing the Agent separately if that is also wanted) 

I have been trying to get a script working that will run jamf Helper and if the user agrees to the upgrade it will open Self Service at the policy and either view or install the app. So far I have the below which works. #!/bin/zsh ### msg="$4 $singleApp " singleApp="$5" jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" currentuser=$(stat -f "%Su" /dev/console) policyid="$6" action="$7" timeout="$8" title="Application Update" iconLoc="/private/var/tva/casper/scripts/mickey.png" userResponse=`$jamfHelper -windowType utility -title "$title" -description "$msg" -icon $iconLoc -button1 "Dismiss" -button2 "Upgrade Now" -defaultButton 0 -cancelButton 1 -countdown $timeout -timeout $timeout` #Self Service = 2 #OK = 0 if [[ $userResponse = "2" ]]; then su "$currentuser&

I'm trying to automate our deployment process using Jira webhooks and the Jamf API and webhooks.I want to generate a unique invitation URL when a user is added using our existing Jira workflow.Jira (fully approved) > Webhook to cloud function > Call Jamf API computerinvitations and send to user > Jamf webhook on computer added to site > cloud function to complete user setup. The docs for the computerinvitations endpoint are sparse (https://developer.jamf.com/jamf-pro/reference/computerinvitations). My particular question is related to the XML payload i need to pass in the request body. There is a sample in the docs, however I'm wondering what of this sample is required/mandatory and what is optional?For instance the SSH user/password and some other details are set at the org level in settings in "User-initiated enrollment". Also when setting the site in the XML payload, the invitation info in the portal does not show the site i set in the payload. Any help is appr

Since I migrated Jamf to a Windows 2019 server two weeks ago, I have been troubleshooting the primary distribution point. The distribution point and jamf server are running on the same VM. I have tried and failed with https, probably because of the same root cause... so I am trying to simplify the issue by first troubleshooting the SMB dist point problem.I am able to mount the share both from Windows and Mac clients using the jamf service accounts. I have been able to validate that the accounts work as-should... one read-only, the other read-write. I don't know what the jamf binary and jamf admin do differently to mount the distribution point, but both fail without any helpful messages.I'm wondering if any of you have had a similar experience, and whether you have been able to locate your root cause and resolve. I have a packet capture out to Jamf support right now. I have been working with them for two weeks without resolution. I just re-built my Jamf server a second time with the sam

Hello, recently I've been asked to take over Jamf due to losing our Jamf admin at my work.I already have a little experience with Linux and Bash scripting but the administration of the tool is what I need to learn.Any suggestions on what resources would help me learn Jamf, outside of Jamf themselves?