I'm trying to figure out how to install apps for users that are not local admins. Of course they can install from Self Service just fine, which puts the application into /Applications.The problem is that many apps (Chrome, Firefox, Signal, etc.) will periodically try to update themselves, but the user does not have permissions to /Applications, so the app can't update itself.I was considering installing apps to ~/Applications insteadMaybe something like:Package action=cachethen a script that will runinstaller -pkg /Library/Application Support/JAMF/Downloads/application.pkg -target ~/ApplicationsBut I wanted to ask community first. Is there a "best practise" for installing apps so that non-admin users can update them?

We are starting to use Printerlogic for printer installing across the company.  Manually installing the pkg or via a Policy install from a script I found on the forums here it doesn't install the needed Safari extension.  Found 2 commands to run from Printerlogic's forum that enables it.sudo killall PrinterInstallerClientopen $(cat /etc/pl_dir)/service_interface/PrinterInstallerClient.appI tried adding the commands as Exexute Commands under Files and Processes in the Policy. Watching the install on a MacBook it looks like it works but when I open Safari and check the extension it isn't there.  I can then run both commands manually in terminal and it works as intended.  Has anyone else been able to successfully push out Printerlogic?

Hi,I believe I used to set the "Show item info" preference with a Configuration Profile in the Finder payload. Or the old Global Plist payload.Can't recall. It doesn't appear there anymore.Is anybody using a script to check this off? 

Hello guys, any news with screen recording privacy preferences via MDM in Big Sur/Monterey? Is there a way how to enable teamviewer recording without user allowing to? 

we have a policy to restrict access to "Users & Groups" under system preferences, but we do allow the user to be local admin, and I used to be able to use the following script so users can give themself local admin right from self service, but it stopped working.we are using MacOS 10.12.x (x=3,4,5,6) and 10.11.x (x=5 and 6) and JSS 9.96 does anyone have a different way of creating a self service policy so the users can make themself local admins ? thank you in advance for your help. #!/bin/sh if [ -z $3 ]; then currentUser=`stat -f '%Su' /dev/console` else currentUser=$3 fi # Add the current user to the local admin group on the Mac dseditgroup -o edit -a $currentUser -t user admin if [ "$?" == "0" ]; then echo "Successfully added $currentUser to admin group" else echo "ERROR: Unable to add $currentUser to admin group" exit 1 fi exit 0

Hi everyoneCan someone suggest me a good script to change my mac's name to "username-serialnumber" ?Thanks

Any advantages in using a custom trigger to trigger policies vs. using their IDs? Just curious if I can skip a step in adding all the policies I want to call in the script a custom name when they already have an ID attached to 'em. Thanks!

I am currently studying for my Jamf 100 and have ran into a couple question on the Jamf 100 practice test and I am not sure I understand the material or understand the questions. Can you all give me a hand?Supervision is available as part of a computer PreStage Enrollment configuration. a. True (my answer)b.False  (answer according to the answer sheet) Which method can be used to enroll a mobile device with Jamf Pro? a. Apple School Manager  (correct answer according to the answer key)b. Recon c. Volume Purchasing of Apps and Books d. User-Initiated Enrollment  (my answer)

Before Ventura was released, we were testing out erase-install.sh and it worked pretty good and updated from to 12.6 pretty fast. We had to set to just install the latest version, but since Ventura is considered a minor update on 12.6, I had to change some of the install options. I added the os option, but the download is now installing the full installer and takes about 1hr and 15min to complete. Below are the options I'm using to install 12.6.1. In way to get this to update faster?/Library/Management/erase-install/erase-install.sh --pkg --reinstall --os=12 --update --min-drive-space=35 --current-user --check-power --no-fs --depnotify --cleanup-after-use 

Having a bit of a weird issue. So I have this script that pops a notification box open on check-in, and it's working fine, except that it won't display the branding icon in the box. It's probably easier to show than to tell, so see below (executing this script in macOS Ventura 13.0.1): jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" windowType="hud" description="Insert description here (edited for the sake of this forum post)" icon="~/Library/Application\\ Support/com.jamfsoftware.selfservice.mac/Documents/Images/brandingimage.png" #this path is accurate title="macOS Update Required" alignDescription="left" alignHeading="center" button1="OK" timeout="600" window=$("$jamfHelper" -windowType "$windowType" -lockHUD -title "$title" -timeout "$timeout" -icon "$icon" -description "$description" -alignDescription "$alignDescription" -alignHeading "$alignHeading" -button1 "$button1") What am I doing wrong?

We have deployed microsoft defender via Jamf. However it seems they got deployed in standalone mode and not managed mode.In defender portal the count is zero for MacOS. we followed https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwideany suggestions?

I am looking for a way to create an extension attribute to show when the last inventory (Recon) was done on a computer.  Any assistance would help and is appreciated.

Hi,I have a question about Apple IDs. I am moving my group to JAMF as we purchase new Macs. I have restricted the Apple ID pane in the PreStage config. When migrating end user data from their old Macs their Apple ID info is automatically coming over as well. Is there a way to avoid this on future installs and how would I remedy this situation on the machines that are currently affected? Thanks for the advice. 

My apologies if this exists elsewhere, I looked through the forum, but nothing seemed to match my scenario. I currently have been deploying OneDrive for Business via VPP (device), but I'm looking to migrate our users to the standalone version. In my experience it seems that the OneDrive VPP app doesn't update via Jamf/MAS, mainly because OneDrive needs to quit to perform the update. Since there is never an alert to the user to quit OneDrive, the app never updates. From my understanding the Standalone version keeps itself up to date, so no need for me to manage updates on it (outside of finding a user very out of date for whatever reason). So here is my question's, has anyone migrated their users from the VPP version to the Standalone version successfully? Are there any pitfalls or things that should be considered for such a change? In your opinion is the Standalone version better/easier to manage as it appears from my findings? Thank you for any help that you can provide!

Hi,Please check and suggest. getting the below error while running script for mac os ventura updateError running script: return code was 2. Install finished successfully Scanning for 13.0.1 installer Install finished successfully /Library/Application Support/JAMF/tmp/MacOSUpgrade.sh test 2: line 6: /Applications/Install macOS Ventura Beta.app.app/Contents/Resources/startosinstall: No such file or directory /Library/Application Support/JAMF/tmp/MacOSUpgrade.sh test 2: line 7: syntax error near unexpected token `|' /Library/Application Support/JAMF/tmp/MacOSUpgrade.sh test 2: line 7: `echo <password> |'/Applications/Install macOS Ventura Beta.app/Contents/Resources/startosinstall' --agreetolicense --nointeraction --forcequitapps --user <admin> --stdinpass'

Hi there, I know this topic was covered quite a bit but I'm not able to find something that fits our requirements.I'm looking for a script that will rename a devices on jamf to the following format:"FirstName LastName - MacBookModel - S/N"And what is the best methodology to trigger this script, I found that with the previous script when the policy is set to run during enrolment and I left the device at the account creation page for 5 minutes, the device would be named "_mbsetupuser" so to avoid that is there any way to create a custom trigger for a device that was logged in for the first time and have the policy and script run on that trigger? 

Hello,Looking for guidance. My co-worker who was supporting Jamf left so I have taken over. Our MDM Push Notification Certificate expires the first week of January.  I was reading the guides on how to renew the certificate (see steps below) But I'm confused on step 4. How do I know if the server hosting JAMF has an outbound connection? Also do I need to download the token from ABM prior to renewing the certificate.  In Jamf Pro, click Settings  ,in the top-right corner of the page.In the Global section, click Push certificates  Click the push certificate, and then click Renew  Choose a method for renewing the push certificate:If the server hosting Jamf Pro has an outbound connection, select Download signed CSR from Jamf Account.
 Jamf Pro connects to Jamf Nation over port 443 and obtains the signed CSR.If the server hosting Jamf Pro does not have an outbound conn

I've had this come up a number of times on the admin site, but this is a first for the Self Service app. I don't want my users to have to run into this.  When I run into it, I have to clear all cache related to login.microsoftonline.com, or open in private/incognito. Not something that can be done with the app. What can I do to keep this from happening in the app at least?We're Azure IdP. I have Self Service set to require login, and to use SSO. 

I have tried to upload the Adobe template pkg to Jamf cloud, but for some reason, the upload is always stuck at 99% no matter how many times I have tried.Is there any better way to deploy Adobe Acrobat DC here? Thanks!

Hey Everyone,I'm trying to find a way to suppress the new account setup assistant when logging into accounts for the first time. I'm currently using DEP with a pre-stage deployment profile to bypass the initial setup assistant and log in straight to the administrator account. When I create a users account, be it through Users & Groups or Jamf Connect, I'm greeted by the new account setup IE) Accessibility, Data & Privacy, Touch ID & Theme. Is there any way to skip this when signing into new accounts the first time?Thank you for your help!

I would like to trigger the same policy using different custom events.For example -jamf policy -event triggerAjamf policy -event triggerBwill both trigger policy XYZI've tried adding the custom event triggerA, triggerB to policy XYZ, but it didn't work.Is it a syntax issue, or is it simply not supported and I need to clone the policy instead? 

Does anyone know of an effective way to Disable the Message app? It seems there is no way within a config profile to disable just the Messages app. I was able to "Disallow a folder" instead of an app which seems ridiculous. From what I have been reading the Software Restriction section looks for the actual binary being used, which is named "Messages" in /Applications/Messages.app/Contents/MacOS/Messages. This blocked the app but I then it gave me the option to allow it with admin creds. Some of our users have access to a Grant Admin rights policy which shuts off automatically after 24 hours so it would not be useful to them if they could allow it.  Disabling Messages should be easier. Any thoughts?

Hello all, We're seeing iBoss causing issues when students are trying to load ANY page. We no longer use iBoss and were attempting to move over to Linewize. It worked perfectly fine and then stopped. We've narrowed it down to leftover iBoss files somewhere on the machines. If we use the iBoss uninstall script, it'll work for a short period, but then returns. Does anyone have a script or know of anything that we can use to COMPLETELY remove any instance of iBoss without having to wipe the machines? Wiping the machines does resolve the issue. TIA!

Hello!We are looking to federate our domain in Apple Business Manager so that our users cannot use their work emails as personal Apple IDs and to then create managed Apple IDs for all users in our enterprise. Currently, our Developers had Apple IDs created through App Store Connect. When we try to setup accounts in Apple Business Manager with Apple IDs for those developers, we receive errors about them already being created. Are these Apple IDs considered personal Apple IDs, or are they managed Apple IDs that do not populate in Apple Business Manager?

What is the best way to try and debug an EA script? I’ve implemented logCollection https://github.com/kc9wwh/logCollection/wiki , and that works fine, but I’m trying to make a smart group that reports on Macs that have an attachment. The EA from https://github.com/kc9wwh/logCollection/wiki/Reporting doesn’t seem do anything. https://github.com/kc9wwh/logCollection/blob/master/EA-NumAttachments.sh shows... "jamfProURL="https://jamfpro.acme.net:8443"I've tried that format, plus...https://jamfpro.acme.nethttps://jamfpro.acme.net/...and none of those work (of course I'm using my own JPro instance address). Is there a log I can check to see where this is failing? Also, I know the api_user works, because that is the same user + creds that runs logCollection in the first place, and adds the attachment to the Mac.