Hi, I have just run into this issue recently whereby I try to remove vulnerable apps that are not installed to /Applications folder but copied and being run from Desktop or Downloads folders.Tried this easy command in terminal locally and worked like charm:rm -R ~/Downloads/Visual_Studio_Code.pkgSo then I created a policy that would use a script with the same exact command to remove the file and ended up having this:Script result: rm: /var/root/Downloads/Visual_Studio_Code.app: No such file or directoryCannot I just use tilde for specifying the currently logged in user's Download folder? Why does it say /var/root?I have 100+ users and not fancy writing a separate script for each of them where I just use the full path.I'm sure I'm overlooking some obvious scripting rules here so all advice would be greatly appreciated! 

We just discovered that the portion of our fleet still running macOS Mojave (10.14.6) are no longer checking in, updating their inventory, or of course executing any policies or receiving any patches.When manually triggering a policy check-in or recon, we get this error:There was an error.Device Signature Error - A valid device signature is required to perform the action.This appears to have happened to all of these machines around the same time, all showing a last check-in/update on Friday 8/12 or Monday 8/15. It doesn't appear to be happening on any of our machines on 10.15 or later.The computers all still show they are managed, supervised, enrolled, and have MDM profile expiration dates far in the future.Initial spot testing using the Jamf binary self-heal with Jamf API seems to get it reenrolled successfully. Unfortunately we're unsure if this will stick since we have no idea what the cause was, nor do we know if there will be any other ill effects from this error or from the self-

Hello All, Please help me to get the MS link to download the latest version of office package for macOS so that I can make a script and use in my policy to install on macOS. I don't to do it from https://macadmins.software only MS link is needed. I will do curl to it.

Hello everyone,can someone tell me why the observe feature only exists in the classroom and not in the Jamf Teacher? Is it an apple thing?Thanks for clarifying.Peter

We just set up a cloud distribution point in AWS but no objects are replicating.  The S3 bucket was created successfully and JAMF Admin says replication successful.  It even showed the individual packages copying over the first time.  However, there are no items in the bucket so something is failing somewhere along the way.  I did find this (https://ideas.jamf.com/ideas/JN-I-16521) that appears to have similar issues but a fix was implemented.  Still, the top comment is the only place I've seen the exact same problem listed.  Plus, while server side encyption is enforced on AWS side I have nothing in any policies regarding encryption like they did.  At this point, the only policy I have is the following test policy which is about as wide open as it gets:{"Version": "2012-10-17","Statement": [{"Sid": "AllowFullS3JAMFBucketsOnly","Effect": "Allow","Action": ["s3:*"],"Resource": ["arn:aws:s3:::jamf*"]},{"Effect": "Allow","Action": ["cloudfront:*"],"

I'm trying to restrict access to Freeform on our K12 lab iMacs using Restricted Software payload in Jamf Pro. I was able to block the app on iPads in Jamf School using com.apple.freeform but that has not worked on Jamf Pro.I tried to block Freeform.app but have not had success. Anyone able to block this app from appearing?

When I trie to import placeholders I get an error.Could not update placeholder 'iPad xxxx' for serial 'XXXXXXXXXX', the DEP placeholder doesn't existCSV file for testing isSerialNumber,Identification,AssetTag,AssignToUser,MemberOfGroups,AutomatedDeviceEnrollmentProfile,DeviceName,LocationXXXXXXXXX,iPad xxxx,PADSX02,,BBBBBB - CCCCCC D,BBBBBB – DEP-profile,%AssetTag% - %SerialNumber%,Location XI have 'BBBBBB – DEP-profile' in Automated Device Enrollment Profiles and this works If I manually assign it to the devices. Profile name is double checked.AutomatedDeviceEnrollmentProfile is descibed in the documents https://docs.jamf.com/jamf-school/documentation/Placeholder_Devices.htmlThere's a CSV template in xxxx.jamfcloud.com/impex/devices.html but there's no AutomatedDeviceEnrollmentProfile and there are 7 labels but 8 colums???SerialNumber;Identification;AssetTag;AssignToUser;MemberOfGroups;DeviceName;Location2019XXXZDSK;Device001;Optional;Optional;Optional,Optional2;Optional;Optional2019X

Hello and Thank you in advance for any assistance. I purchased some apple devices through my apple business account at full price. Two of the devices need to be handed off to others outside of the company and we no longer want to manage the devices or have anything to associate us with them. I was able to remove the profile from the devices and no longer can see them in our inventory of devices. They are effectively unmanaged through JAMF. In the settings on the actual device there is still a flag at the top that says "device is being managed by... (and our company name)" How do I remove this flag from the device?

Hi,I'm trying to disable the sync options in the browsers mentioned above.For Chrome I've found <key>SyncDisabled</key> https://chromeenterprise.google/policies/#SyncDisabled but for some reason is not working, not sure if this is happening because I'm not editing the correct file or saving in the correct path.Can somebody help me out with this issue?Thanks in advance.

good day.after applying the Policy to enable the FV2 in JAMF, when the user restarts the machine he still have to 1- login to decrypt the disk2- sign in again with the AD user name and password.can someone offer a solution to have the password registered?well, let me break it down in other words.1- the devices/laptops are connected to the AD.2- users always use there AD credentials to login.3- the user now login twice, first login is to decrypt the disk and the second one is to login to the device itself.4- so the problem is what if the user forgets his AD password and i did a reset on the AD, he will not be able to decrypt the disk in order to login. so my question is that if i can just bypass the 1st login requested to decrypt the disk or i should be switching to a different method of enabling the FV2.

It's been a while and I have a question about Self-Service.Can Self-Service be accessed by a user via a URL on an unmanaged computer or even a mobile app on an unmanaged mobile device?Ideally, there are some areas that would be great to make available via Self-Service for a user when they're not necessarily on their managed Mac.  For example, after being strongly authenticated into Self-Service, I would like to get my personal FileVault recovery token because as a user, I forgot my local password to my managed Mac.Please let me know if you have good direction here or if this just doesn't exist today.  Thanks All!

I am doing testing and I don't want to wait for the recurring checkin trigger to time out. Is there a command that forces a checkin right now?

so after applying the Policy for enabling the FV2, all works fine but the user password isn't synced with the AD, in another word, when the user restarts the machine he still have to 1- login to decrypt the disk2- sign in again with the AD user name and password.can someone offer a solution to have the password registered?

Does anyone have a script to set Outlook 365 to the default mail client on Big Sir and Monterey? I have the native mail program locked out so it can't be done through there. 

We recently purchased 3 x M2 Macbook Airs with 256GB of storage. They were installed and has been used by a single user on each machine between November 11th and December 1st.Within the last couple of days all 3 users have complained about disks running full. Neither user has large files, the one with the most data uses ~40Gb in total (*including* applications!). I have tried running both CleanMyMacX (yuck!) as well as Grand Perspective. Both apps show ~40GB storage used, and the rest is "invisible". We are running Jamf Cloud and Jamf Connect on all machines. Disk Utility shows no APFS Snapshots.All of them are running macOS 13.0.1 and neither user has enough available space to update to macOS til 13.1. What to do? I seem to be looking at 3 reinstalls, but I would REALLY like to avoid this option :-)

I'm relatively new to PPPC configs. I ran across a PPPC config profile for some old software that had been renamed, but the profile hadn't been updated. It's a softphone client and requires Accessibility permission and access to the mic. Since macOS doesn't allow us to enable the mic, this PPPC should only have one property to set. I figured this would be easy. 😂I used the Jamf PPPC Utility to create the config profile. I added the application on the right panel, picked the Accessibility property, set it to Allow, then uploaded it to our Jamf server. On the Jamf server, I assigned the config profile to my test laptop (running Ventura). On the laptop, I verified that the profile had been installed. When I check my work in System Settings -> Privacy & Security -> Accessibility, the toggle for this softphone is still disabled.Am I doing something wrong? It's a fairly simple workflow. Maybe my expectations are off? I expected to see the Accessibility toggle for the s

Hey guys, hopefully a quick and easy answer to this one. Looking to bring a new client into Jamf Pro (+Connect) who has around 25 existing Mac's deployed nationwide. If we go through user-initiated enrolment, would those devices then be Supervised in the same way they would had they gone through Automated Device Enrolment (DEP)? Or will the answer to that vary by end-user OS? All new Mac's purchased will of course be put through ADE/DEP to ensure they're Supervised from the outset. This is purely to onboard the clients existing devices with minimal disruption. Thanks in advance 🙂🙏

Hi Did any one use zoom schema as configuration profile. I just create that and deploy to a test machine but following window pop up when policy pushed and zoom app is runningI use schema from here: https://github.com/talkingmoose/jamf-manifests/blob/master/Zoom%20(us.zoom.config).json and configure some instances and leave null others. And then I create a policy to deploy latest zoom to endpoint. But after deploy the policy if user click "Not Now" then policy will failed. The workaround I found that if Kill the process before run policy then that window will not pop up again. Did anyone face same issue? Any suggestion will helpful

good day, i have created a new policy under JAMF which it activates the filevault disk encyption which works fine. when i go and uncheck ENABLE under the policy OR remove the unit from the SCOPE, when i restart the designated unit it keeps showing the POP-UP message on login that Administrator is requesting to Enable the filevault, noting that if i press ENABLE button and then i go to system pref, the filevault is not enabled. so to brief how to get rid of the pop-up message after disabling the Policy OR at least removing the unit from the Policy scope. thank you in advance

We are deploying FMPro 19 to various groups within our org.  I am using the script provided by Claris to build a custom built package, which is working fine, however one ask we have from the program manager is to try to set a Host URL in the client so that they do not have to assist every user in doing so. Its not that its terribly difficult to instruct users how to do this, but there is only 1 person to support nearly 1k users for this project. I found one document, referencing FM Pro 15, that suggests adding the following attribute to the Assisted Install.txt file:AI_PREFERREDSERVERFORCONNECTION=<host URL>Unfortunately this is not working, at least not in FMPro 19. I've tried the usual format of fmnet:/<hostdnsname> and just entering the dns name without the leading fmnet:/Neither worked.Has anyone had any success in setting the Host URL via Jamf?FWIW, when set manually the host URL is listed in a Pref file within ~/Library/Preferences.

This is probably something very simple, we never really utilized SS but I would like to start. I can't seem to figure out how to add custom apps to SS. I know how to do it for App store apps as it's pretty just right there. Example, I want to make Skype for Business available in SS, how do I get it to show up under software. It's probably something I am missing but I really don't see where to add it.

When I enrolled a mac on my jamf portal before I had an mdm profile that I could install on a mac, now it only propose me a quickadd.pkg, where could this come from? 

We've recently run into an issue where a user accidentally logged in to their personal Microsoft 365 account rather than the company account, which creates some data headaches as company files were syncing to a personal account. I'm trying to find a way to collect the Microsoft 365 and OneDrive usernames into an Extension Attribute so we can audit them, but I haven't had any luck. They don't seem to be stored in a plist anywhere, and I haven't been able to find a terminal binary that will report the login names. Any ideas? Thank you!

I wanted to be able to have quick way of finding all of my managed Macs with a T2 chip. I made a smart group that tracks by model and it seems to work well, but I don't know if there's a way to use an extension attribute to query each system for the presence of a T2 chip. We can do this with the processor architecture. Can we do this to detect a T2 chip?

I have a user who is encountering a Jamf Connect window that will not go away.  There is no option to exit out of the window, it is also grayed out so he cannot enter any credentials.  I searched the forum for similar issues but couldn't find anything.  Has anyone encountered this?  I confirmed he is in the AD security group for Jamf Connect, and he is the first user to run into the issue.  Any advice is greatly appreciated! Thanks, Kerry