Hello,Question on the consequences of deleting a computer object in Jamf Pro, how will that affect Management commands sent to that computer? Context: For a missing macbook, I have sent a wipe command so that next time the macbook is connected to the internet again, it will erase sensitive data.In addition, to clean up our Jamf inventory, I want to delete the computer entry so it avoids un-needed. I'm wondering if I delete the computer object, it will cancel those commands. Currently they are pending when I check their status.Thanks 

Hello everyone, My company is transitioning from Malwarebytes to Jamf Protect by (hopefully) the end of the month. We need to uninstall the Malwarebytes endpoints from employees' machines but we're running into some issues. The Malwarebytes Nebula console allows us to delete endpoints and remove them from computers, but the user is prompted to enter admin credentials. Due to company policy, no computer has admin privileges. My question is if there is a way to either remove the Malwarebytes endpoint without needing admin credentials, enter admin credentials remotely, or some other solution that I haven't thought of. I did find this article but it seems that the type of Malwarebytes endpoint we have does not have these files in users' computers so the script doesn't work.The users do have the option to make themselves admin temporarily but I want to make this as zero-touch as possible since people can't be trusted to do this properly. It's very likely they'll cancel out of the

So i've been searching everywhere for a simplified answer (and maybe i did find it but am too dumb to realize) but does Nudge play nice with the Delay Major Update restriction payload? Basically what I am wondering is this: I have the major update delay set to 90 days.  This means Ventura will be allowed to be updated on Jan 22nd.I have Nudge setting the minimum required OS as 12.6.2. In a perfect world this means Nudge would upgrade any devices below 12.6.2 to that version and not anything newer.  I was reading however that the restriction payload simply hides the option to update.  Does this mean Nudge would override the restriction and simply update any devices to the newest OS?  I ask this because I saw a device go from 12.5 to 13.1 today.  I wasn't sure if that was from Nudge overriding or if it was due to the "feature" for devices running 12.3 to 12.6.1 which offers a different path for upgrading (https://support.apple.com/en-us/HT213471)&n

As some students have installed IOS 16.2, they now have access to Freeform. I want to place the app in our Apple folder for all of the students, which was created using the layout profile in jamf school.However, Freeform hasn't yet appeared in the internal apps section in jamf school, so I don't have the ability to currently place it in any folder of my choosing. Is there anything I can do to get freeform into jamf school or is it just a case of waiting?Any help would be much appreciated.Thanks

Hello, We need to have a package installed on our Mac fleet, and while it works when the users get on VPN, the package fails when they are not on VPN. Thank you, 

Hello,When enrolling Macs, a specific package is failing to install. In the Policy Logs I see - Installation failed. The installer reported: installer: Error - the package path specified was invalid: How do I change this path so I can direct it to Application folder? Thank you, 

We need to authenticate our Mac on WiFi using PEAP ( username & password ) and we have AD on-premise, is there way to accomplish that without binding our Macs to AD ( please say yes ) ??  

Hello Everyone,When we try to update many devices remotely or manually, we get a warning like the one below. we did the necessary research for this but we could not find an uptodate and useful solution.Error : (com.apple.OSInstallerSetup.error error 702.)Restarting in safe modefirst aidRedownload the packageprocedures have been tried. remote and manual result error is the sameAnyone want to make suggestions on the subject?

Hello all.I am working on getting a project to upgrade Macs to Ventura (or Monterey if they wont support Ventura) and I am having trouble. I have reviewed a number of posts on Jamf Nation and setup what others seem to mention works. However, I am not able to get it working and I am hoping someone can help me understand what I am missing. Intel Macs update w/o issue but M1s will not update and error with the "must be volume owner" error.I have created a policy to install, erase-install and dialog packages, and then start the erase-install with the --reinstall --current-user --depnotify switches using dialog as the prompt. The notification pops up to start the update then I get the error regarding volume owner. I also reviewed the Apple document https://support.apple.com/guide/deployment/use-secure-and-bootstrap-tokens-dep24dbdcf9e/web and it appears our keys are escrowed. We do bind our Macs and use mobile accounts and I am wondering if that is the issue.I am by no means a Mac or J

Hello Everyone,I am pretty new to JAMF so forgive me if I am not using terms correctly. I work at a college and we have Logic Pro installed on 15 2020 M1 Mac Minis. We recently were hit by a blizzard, a pipe bust, and flooded that lab. Now those machines have been lost due to water damage. Naturally we are trying to find an alternative set up with different machines. I need to free up those license and apply them to different machines. Currently, we apply these licenses via the "Assign Content Purchase in Volume" option (as opposed to the VPP codes). Is there a way, using JAMF Pro, that I can strip these licenses from the old machines and apply them to new machines?Can I just go to Mac Apps-> Logic Pro -> Scope and remove the broken machines to free up licenses? We are just a bit unsure and I don't want to make matters worse by just clicking around and seeing what happens.Let me know what you think!-Matt

We are reviewing the permissions given to people that need to enroll their device (macOS only) by either DEP/ADE or user initiated permissions.First question, do DEP/ADE and user-initiated require the same permissions?Second question, what are the minimum required permissions?The strange thing is that the permissions for :Allow User to EnrollAssign Users to ComputersAssign Users to Mobile DevicesEnroll Computers and Mobile Devicesare not assigned, but no one reports any issue.When looking to the default role that allows people to enroll their device it seems to assign way to much.Anyone that knows the ins and outs?

Hi, We have recently deployed Azure AD SSO (and Azure AD DS) to login to our Jamf Cloud instance. It works great apart from SSO, every 24 hours we have to reset our web browser data to login to Jamf Admin. Any ideas on how to make this more reliable? I's guessing its something to do with 'Token Expiration (Minutes)'. Should I just increase this to a few weeks?

Hi All,Wondering if anybody else is seeing this. On two Macs running Sierra - one is on latest 10.12.1 beta, I'm getting a Killed: 9 error when trying to create USB install media using createinstallmedia command: $ sudo /Applications/Install macOS Sierra.app/Contents/Resources/createinstallmedia --volume /Volumes/Install macOS Sierra --applicationpath /Applications/Install macOS Sierra.app Ready to start. To continue we need to erase the disk at /Volumes/Install macOS Sierra. If you wish to continue type (Y) then press return: Y Erasing Disk: 0%... 10%... 20%... 30%...100%... Copying installer files to disk... Killed: 9 I can run the command over and over, sometimes it is killed immediately, other times after a few mins. Can't find a single thing in the logs about this. Any ideas? Just me? Thanks!Matt

created a new policy for a 2023 version of some software. Tested new policy in prd in a limited scope. result=successThen widened the scope of the new policy to include the actual production machines. In the logs for the new policy, I'm seeing results from the old policy. it shows completed but the dates caught my attention so I looked at the details and sure enough it's the logs from the previous policy for an earlier (2019 software version) package install.  

Greetings Jamf Nation denizens, I've recently tried to begin utilizing Patch Management features within JAMF Pro but have met some issues. I'm attempting to use the automatic distribution method instead of administering it through Self Service. I have confirmed that the Patch Policy has a defined scope with an eligible machine, but it remains stuck on "Pending". In this particular example I'm trying to update Google Chrome. Upon reviewing the logs, it appears a patch policy called just called "macOS" is being distributed to the device. This particular patch policy is titled "Google Chrome Patch Policy" so I would expect to see that being pushed in the logs.  There are no Patch Policies set up called macOS in our JAMF Pro server. Other Patch Policy logs show this same policy. When running a sudo jamf policy command on the machine, it returns the "No patch policies were found" message, and remains "pending" in JAMF Pro. Is there a way to fully reset or flush

Im trying to create a self-service policy with a script that will disable the "smart quotes" system setting but am running into issues getting this to work.   defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false   Above command seems to work fine when using it on my local device but when trying to use this command in a jamf policy, no luck. any ideas on how I can get this to work? Thanks in advance. 

xpath is not super intuitive. Maybe I can clear up 1 tiny little thing here...First, a resource I go back to again & again: Xpath cheatsheetSecond, xpath is a querying language. It can look complicated, but, a way of simplifying it is to think of the syntax as an analogy: exposing xml data as a "file system" & the thing you want to "get" as a "file". Your xpath query is the "file path". Elements, in the analogy, are "folders" with stuff in them: one thing, many things, etc. E.g., you might want all IDs for some object in Jamf Pro (let's say policies) so maybe you tried: curl -Ss -X GET -H 'accept: application/xml' -u "$apiuser:$apipswd" "$jamfurl/policies" | xmllint --xpath "//id" - | tr '</id>' '\\n'​ Not great because you are stripping the xml data structure & tr often outputs strange results.Then maybe you looked at the xpath cheat sheet or took a Jamf course & discovered the magical text() command which strips xml tags! curl -Ss -

We had a really weird hiccup the other night - On the evening of the 13th I sent a command to our lab Macs to update to macOS 12.6.2.  I did this as I've always done in the past - by going to their smart group, viewing it, clicking "Action," selecting "Send Remote Commands," and then selecting "Update OS Version," "Specific OS Version," "12.6.2," and "Download and Install the Update, then restart."  Of the 80 computers I sent this command to, 65 of them successfully updated to 12.6.2.  Then, of that 65, 27 updated to 13.1 on their own.  At first I thought I may have accidentally told them to upgrade to 13.1, but If I look at the Hardware and Software History, I can see where they updated to 12.6.2, and the next entry is them updating to 13.1.  (That and the fact that many of them ended up on 12.6.2 as was desired)Needless to say, this is not good - our labs were held back on Monterey for various reasons, and now we'll have to wipe and re-provision 27 Macs.&nbsp

Hello. From my understanding after reading through many posts on here, it is possible to enroll a Mac running Monterrey or higher OS into Jamf and not ABM, is that correct? If so, I assume that you would need to send out user initiated enrollments via email? Now, my real question is - by enrolling in Jamf and NOT in ABM, what features/control would I be missing? I am more than happy to explain more in detail the scenario, etc if need be. Thanks.

I added an anchor certificate to a few of my PreStage Enrollments, but cannot delete it. When I click the Delete button, I only get the indefinitely spinning blue circle until JAMF times out and logs me off. Is my only option to delete and recreate the PreStage Enrollment?

I want to automatically install the Netflix app on all my Apple TVs.....but I only want to have it available for Self Service on my iPads.How do I go about doing this?Any help would be very much appreciated.

I'm getting very close to a true zero-touch deployment solution for our iPads, and I'm hoping the community can pull me across the finish line on a strange issue I'm having with managed apps. My test iPad enrolls via DEP/Prestage Enrollment fine, but the ensuing automatic install of the Self Service app is asking for iTunes credentials (I'd like this to not happen). In what might be a related issue, VPP apps set to "make app managed when possible" are not doing so, despite this option being enabled. Getting this working would be a great to have for an upcoming hardware refresh, and I appreciate all the help in advance.

Hi, I got some issues with the computer name changes in my environment. Changing the computer names directly after the prestage enrolment and changing the computers based on serial number (HMserial). Everything is correct except for the LocalHostName change. Unfortunately this does not happen for all devices but just for some of them. Script I use: #!/bin/bash #Get Serial number SerialNumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') scutil --set ComputerName "HM-$SerialNumber" scutil --set HostName "HM-$SerialNumber" scutil --set LocalHostName "HM-$SerialNumber" ComputerName and HostName are changing correctly but for the LocalHostName change I receive a failure: SCPreferencesSetLocalHostName() failed: Invalid argument The strange part is that this is not happening for al computers but just for some of them. Anyone has an idea what can be the cause of this error and how to solve it? Help is appreciated!

Hello all,I have gotten Notify and connect to work with my deployments. However user's screen are turning off when Notify is running. 1. Is the computer sleeping or is the screen just turning off?2. If it is sleeping I want to make config profile to turn off sleep that will push initially, but removed via smartgroup after Notify has finished. What would you suggest for the smartgroup criteria?

Started doing some initial testing with ZScaler ZCC and noticed that while the installer didn't prompt for it, under Security and Privacy > Full Disk Access there is a ZscalerTunnel binary that's unchecked. Does anybody have a config profile for enabling that or is it okay to just have it disabled?