I am piloting Jamf Connect with Google as our IdP for some students in K-12. (with the hope of also doing staff)Currently if they forget their password, we need to reset their Google password, and then, as admin reset the local password on their computer.This requires physically having access to their computers. There's almost no point to have Jamf Connect if a password reset requires local login to finalize. (Further, after this process, it always requires the "verify" step... I think that's a different issue, but now some students have to type their PWs twice to get in.)Is this everyone else's experience too?  Seems pretty untenable. What would people do with a globally disperse workforce where IT can't physically have access to the machine?)Would Azure or another IdP handle this better?

I feel like I'm missing something fundamental about plist files and I could use a little education. I understand plist files are basically settings files with key value pairs so you can save/push configurations for the system and apps. What I don't really understand is how you would determine what settings are supported? For example, if I want to allow Microsoft Teams access to screen recording for all users; how would I know what key:value pairs are? I found JAMF's privacy preferences control utility, but is that showing me every option? Is it up to an individual app to publish it's settings somewhere? Does Apple publish there's for Screen Recording for example? I can find lots of how-to's on creating/editing plist files, but I think I must be missing something fundamental.

HEy jamfnation we are having a major issue with clients not being able to mount the share 4 out of 5 times. I have been working with JAMF support and they thought it may be related to a patch but I removed that patch and I am still having issues. The system log on the client shows: Sep 18 11:03:40 ARNC02P904PFVH7 kernel[0]: smb2fs_smb_validate_neg_info: Server capabilities do not match Sep 18 11:03:40 ARNC02P904PFVH7 kernel[0]: smbfs_mount: smb2fs_smb_validate_neg_info failed 80 Sep 18 11:03:40 ARNC02P904PFVH7 mount_smbfs[81969]: smb_mount: mount failed to 10.40.34.26/CasperShareNBK, syserr = Authentication error Has anyone else run into this?

Hi everyone, acutally I got the problem, that on FileVault encrypted Macs the input menu for keyboard layouts won't show up in the boot screen. The setting for the keyboard input menu is located in /Library/Preferences/com.apple.loginwindow with the key showInputMenu and a boolean value. If I try to set the value via defaults write, the checkbox in System Preferences is active and the input menu is shown in login window. BUT if the computer is FileVault encrypted, the input menu won't show up in the boot screen. Only if I set the checkbox manually in System Preferences, the input menu shows up in loginwindow and in boot screen. I tried Composer to evaluate which files are changed during clicking in System Preferences. The only valuable file is /Library/Preferences/com.apple.loginwindow. Does anyone have the same problems? Thanks in advice,Michael

Hello Everyone,My company is slowly moving into the Apply ecosystem and I was put in charge of setting up MDM with Jamf. I do already have some good experience with Apple itself from previous days working at the Genius Bar. But, not at the enterprise level. I want to set this up right initially so that it makes the lives of everyone else that interacts with it easier.I've gotten the bare minimum done(Setup Apple Business Manager, Jamf 100 cert). And we plan on using In-Tune for identity management. Which, at the moment will mainly be used for iOS devices.As the title says above, what are some best practices that I can follow now? What Automation's feel like magic? What pitfalls should I expect to run into?Any tips would be greatly appreciated.

Hi All,We have been able to get our AAD Registration to work again, so users can enrol their device with Azure, Azure deems the device is Compliant, and satisfies Conditional Access/allows users to sign in.Prior to the 10.43 update, this process would create an object in Azure AD under the user's name, and it would also show in Intune, with the "Managed by" field showing as Jamf. It would also create an attribute in Jamf Pro for the "Computer Azure Active Directory ID".After the 10.43 update, an object is still being created in AAD, and marked as Compliant, but I'm now not having anything come up in Intune. Not the end of the world, but we're also not getting an attribute in Jamf Pro now for the "Computer Azure Active Directory ID" - this is more problematic, as we use Smart Groups to determine which devices have registered - now we don't have any visibility of this in Jamf Pro.Has anyone seen this since the update?Thanks in advance.

We're using erase-install v.28.1 and in testing so far it's been great, really enjoying the new script and swift GUI.  I want to know if anyone else has used this or something similar in conjunction with a terminal command to delete the machine calling the script from Jamf.  In this use case, the machine in question has a Self Service button to initiate a Factory Wipe, and we would like to call --postinstall-command that essentially runs: sudo jamf delete_computer ID=XXX where the machine we're running the command from is the one in question.  I've tested a few 1 line commands in " "s and they work, but I've not tried including a small script inside yet.  Unless there is an already easy way to show the machine's ID in a single line, I figured it would have to be nested in a small script, I just haven't put down the time yet to test, curious if anyone else has already done this or something similar.

Good morning, I've been looking into ways to get away from AD binding and have had some mild success in testing the SSO extension with Kerberos. I've found that i'm successfully getting a ticket and the majority of functionality is working as intended. However, I for the life of me have been unable to get it to prompt me to sync my local password with my AD password. I've created a brand new local account, and signed in via my AD account to the Kerberos app. I've tried this in Catalina and Big Sur to no avail. I've never been able to get that dialog to appear. Anyone run into this and have any ideas on how to resolve?

Hello,We have an issue where we have an old version of Sophos which encounters automated installment issues when encountering Ventura versions of MacOS or carbon chipsets.  In order to update the current 'SophosInstaller.pkg', do I need to manually create the new .pkg file?  I downloaded the current version of Sophos Endpoint Protection but there are no .pkg files in the zip.  Then I am reading that I need to create the package that contains all the necessary components and scripts.  Is this something I can find that is pre-created to mitigate the hassle of figuring out how to create the .pkg file myself? Thank you for any help!Kerry

using jamfpro with office 365 for mail/calendar/contacts syncing and using the built in mail/calendar app for apple iPhones. How do I go about seeing shared calendars. Is this a issue with the apple built in calendar app? Would we have to use outlook app to be able to see shared calendars?

Hi folks, looking for a bit of help. I’m trying to update a custom extension attribute called "Lifecycle Status" for Jamf Pro Classic API by its serial number. xml = """<extension_attributes><extension_attribute><id>67</id><name>Lifecycle Status</name><type>String</type><multi_value>false</multi_value><value>Active</value></extension_attribute></extension_attributes>""" headers = {"Authorization": f'Bearer {token}', 'Content-Type': 'application/xml', 'Accept': 'application/xml'} res = requests.put(url, data=xml, headers=headers)res status from PUT is 409 error - "Conflict" : The request could not be completed due to a conflict with the current state of the resource You can get technical details http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.10

We recently setup federated MAIDs using MS Azure. We have a group of users needing to use iMessage on their district iPhones. iMessage and FaceTime are allowed in the profile restrictions. iMessage is enabled in ASM. Toggle is grayed out on phones. In ASM users are listed as students, but are in fact staff. Any help would be appreciated.   

How can we get a User Group started in our area? Thanks in advance!

I want my computer groups to list the computer name, username and last check-in.A while back a co-worker showed me how to list the username, it was some sort of global settingbut I can't remember where it was.Can somebody point me in the right direction to set it so that when I create a computer group it will display the computer name, username and last check-in.Thanks

Hello, I had a config profile in place to disable Find My Mac in all company Macs. This was working as the option was greyed out for all users. With the release of macOS Ventura, this is no longer working and the option is not longer greyed out, and has become clickable. Has anyone else encountered this? Thank you!

I have been testing the Intune registration with Jamf and ran into a bit of an issue.Trying to do the correct workflow for the end user (install company portal in one policy, Self Service to register)However once I start the registration process:Safari Openscert is downloaded (always allow)brings you to a Jamf Self service splash screen about registering a device, where you can select "Register My Device"At this point, Self Service opens and nothing happens.  I can click "Register my Device" over and over again, but it just keeps opening Self service and not completing registration.Not sure what is wrong in this process.  Any insight would be helpful 

I need to find a way to turn on the setting in Chrome:  "Always use secure connectionsUpgrade navigations to HTTPS and warn you before loading sites that don't support it"  Has any one tackled this before or know a command or plist to edit that will enable it remotely? Any help is very much appreciated.

Hi,I'm trying to set the preference for Safari via a configuration profile. Is this possible with a config profile? I can't get it to take on Ventura.Many thanks in advance.  

One of the many tasks under my scope is patching of vulnerabilities on macOS systems. Recently every single machine has been flagged for having a vulnerable version of "httpd" to which there doesn't appear to be a path toward remediation aside from upgrading to Big Sur. Alternatively I have been digging through options to see whether I could create an extension attribute which would check and alert me of any systems that have apache running. Sadly all command line options seem to be a dead end as the likely option of running "sudo apachectl status" will just return the following "Go to http://localhost:80/server-status in the web browser of your choice.Note that mod_status must be enabled for this to work." Has anyone else had to deal with addressing this vulnerability, and how have you gone about remediating the issue? Apache 2.4.x < 2.4.46 Multiple Vulnerabilities(Report on Tenable's website regarding the vulnerability)https://www.tenable.com/plugins/nessus/139574 Upgrade or R

Is there an API script that will un-enroll macs from jamf pro? Similar to web Management Commands of "remove mdm profile". I don't need the mac to be deleted from jamf entirely.I want to use the API so that jamf itself sends the MDM command to uninstall the profile. If I create a policy, it will package it up and run it on the device.Is it possible to use the API script to check for machines in a smart group? I want the script to be executed only on macs that have a certain PKG installed on it. Thank you

Up to now, we've been scoping apps either to everyone or to grade level, building, or individual users where applicable. But lately we've been getting a lot more requests from our teachers wanting us to assign apps specifically to their classroom students, and we've been telling them that it just isn't possible currently. Most departments understandably don't want to pay for licenses they don't actually need in order to accommodate 1,400 students across two grade levels when they've only got 150 students taking their class. It's frustrating that a smart device/user group has 200 criteria to filter by except something as useful as "Belongs to Class Name". We've got all our class rosters imported from our SIS into Jamf Pro, and it's unfortunate that nothing can really see them outside of specifically the Classes tab. Am I just dumb? Is there a way to do this that I'm not seeing? If not, I'd love if this could be a feature added in a future update.

We have purchased iPhone upgrades for a few of our users.  They all came out of the box with iOS 16.X. They are setup in Jamf Pro with prestage enrollments with configurations that do not restrict using messages or having their own individual Apple ID's on the device.  We have 1 user who has reset and switched phones 3 times and had their messages populate on their "new" device (which was supervised in Jamf Pro with the same configurations) successfully with the only difference we can find being that those devices were on iOS 15.x at the time.  We now have 4 users who have not been able to get their messages to load on their new device and have halted the remaining users from swapping until we can figure this out.  Those users all have their settings->iCloud->messages turned on (sync this iPhone) and the manage storage is showing an amount that seems reasonable to what they have with messages.  They all are either under the 5GB free limit for iCloud or ar

Hello all,I have a strange behaviour here: I have enough licences of Pages, Numbers, Keynote and iMovie via Apple School Manager and assigned them to two Smart Computer Groups via "Mac Apps". So far this has always worked, even without the computers being logged in with an Apple ID.Now, however, I update the computers to Ventura and suddenly the Mac Apps no longer install automatically. I have also set the distribution method to "Make available in Self Service" as a test, but nothing happens other than the circle turning.Under the Mac Apps in the History tab, the software is set to pending. I also removed my test computer from the scope, executed "sudo jamf policy", brought the computer back into the scope and executed "sudo jamf policy" again. The programmes still don't want to install.Do I now have to give the computers an Apple ID for this to work or can this also have other causes?Thank you in advanceRobert

Hi all,I will like the help some help in getting Extension Attributes up to grep SSHD. /bin/launchctl print-disabled system | grep sshd com.openssh.sshd => true Sorry that scripting is new to me.So the <result>True<result/> or False. Please help. 

We are testing Jamf Connect 2.20 using OKTA and configured OIDCAdminClientID to a group of approved admin users but we noticed that when we update to a computer that had the admin user to Jamf Connect 2.20 they lost there admin rights and are not sudoer anymore as well. This has been working fine in 2.18. Seems to work fine when creating a new user but existing users they lose it.