Hey My JAMF People! We've been noticing lots of issues with re-enrolled devices hanging on random VPP apps. So far 95% of the time if we delete a device record and re-enroll the device it fixes the issue. We're about to have a bunch of computers go through updating the OS to Monterey because they are a few versions out of date.I've packaged up a version of the Eraseinstall script by Graham Pugh that has a post install script baked into it to kick off the Erase install process automatically after running the package. I also have made a Self-Service script for our Field techs that makes an API call and deletes the device record of the computer that it is run on.My Plan would be to have a self-service policy to drop that Erase/Install package on the desktop and then have the techs run API call to delete the Device Inventory Record and then run the package on the desktop to actually perform the erase/install of Mac OS. What I am having trouble figuring out is getting a the p

The following is a conversation between myself and Jamf, trying to get some more detailed information surround the Jamf Installer Preview. I hope this conversation is helpful to other admins who are exploring this new functionality.Me:I know that this feature is still in preview and more work is still being done before Jamf pulls it out of Preview.I've been communicating with other Mac Admins within the MacAdmins Slack Community regarding app installers and there was a little bit of confusion regarding some of the backend processes of how Jamf App Installers are being pushed down to end-user systems.I've read through the following links trying to dig deeper into app installers:https://community.jamf.com/t5/jamf-pro/jamf-pro-10-37-is-now-available/td-p/261726https://www.jamf.com/solutions/app-lifecycle-management/https://www.modtitan.com/2022/03/in-weeds-with-app-installers-preview.htmlhttps://www.jamf.com/blog/jamf-app-installers-faq/So my question presently, is if Jamf can provide eit

Hi folks, just curious if anyone has come across an easy graphic matrix indicating the difference between Jamf Now and Jamf Pro licenses?Thank you!

Hi there, I'd like to know if it's possible to configure smart groups in a way to apply a specific smart group ONLY when a device has just been enrolled. The issue we're having is Sophos Endpoint has 2 custom mobileconfig policies. 1 for MacOS Monterey and 1 for MacOS Ventura. I have a simple smart group setup that separates Monterey and Ventura devices Problem is, if someone were to upgrade their OS, their current Sophos installation will still be installed but the configurations for Sophos mobileconfig for Monterey will be removed and replaced with the Ventura mobileconfig. Since the configs are applying AFTER Sophos has already been installed this would undoubtedly break Sophos' permissions on the machine. Is there any way to have a smart group only apply immediately after enrolment and no other time? This is to make sure that when devices with Ventura installed have been freshly installed that they get the Ventura configuration only and not devices that upgrade

I am fairly new to Jamf and inherited a system that someone else set up. I am looking for guidance with regards to Local Admin accounts.We have one account that is set up in Global > User-initiated enrollment > macOS. This works fine on enrollment.However, there is a second Local Admin account that is created by a Policy that runs at enrollment, startup and check-in.To me this seems like overkill, but to make sure I wanted to get some insights from the community.Do we need two Local Admin accounts? Would the first one be sufficient? What are the advantages and disadvantages of having two?Thanks.

I have a user that made an iCloud backup before wiping his iPhone 12 and reinstalling it. During the following setup the device was enrolled into Jamf (DEP + prestage). He also restored the iCloud backup and everything seemed to work ok. I can see it was enrolled 9/7/22 0907 am and last inventory update was 9/7/22 0908 am. Since then the iPhone doesn't communicate with Jamf anymore.It's running iOS 15.0, Jamf is v10.39.1. the device is still managed and supervised.

Hi all,Just started using Jamf connect with Google login.  Our Jamf Connect login configuration profile is using the option to "Create all new users as local administrator."That is working.  When it creates a new user it makes them a local admin.  problem is if you do a "Network login" with the same user, it converts it back to a Standard user.If you do a "Local login," it works and does not remove administrator rights

Apple has changed where Time Machine data is stored in the latest OS and how that data is organized. I've modified the original JAMF Extension Attribute to accommodate Apple's changes in Mavericks. The XML is ready for upload. I've only tested this in the Casper Suite 9.2 but it should work fine in any version that supports Extension Attributes. https://dl.dropboxusercontent.com/u/874171/TimeMachineLastBackupCompleted.xml.zip Cheers,Chad NielsenForget Computers

Hi,since our mac mini caching servers are run out of storage we're curious if it's possible to have an external volume for cache storage or other options. We#Ve already tried to use the "Content Caching" payload and entered Data Path "/Volumes/nameofexternaldisk/Cache" which didn't work with the error that the profile wouldn't install because of a wrong Data Path. Does anybody have a suggestion here?Best RegardsJonas

I have a policy to install a package, which I want to make available to all computers via Self Service, but I only want it to automatically install (e.g. via enrollment trigger) for some computers only.Can this be done somehow, without having 2 different policies? (e.g. 1 policy for Self Service, another policy for enrollment trigger) I presume, when configuring the scope of a policy, it applies to both 'trigger' and 'Self Service' scenarios.

I am setting deferred updates from jamf the com.microsoft.autoupdate2 configuration profile and typically pause the updates to give time for testing.   Does anyone know if I send select to Pause the update at like 16.66 will jamf profile push any of the patches for that version?Recently Office 16.66.0 was released and the next day the 16.66.1 patch came out to resolve a launch issue.   I rather not pause at 16.66.0 and then have a bunch of launch issues since it doesn't send the patch update.  

While trying to send data from Jamf to SCCM, I am getting the following errors:-  [ 5] ERROR Jamf.ProxyService.Plugins.SCCM.SccmReports - There was an unexpected error sending the device to SCCM.- System.InvalidOperationException: Invalid registration state: Error. Cannot continue.We are using version 3.70 of the plug-in and SCCM version is 2111I have look through quite a few of the support articles and I am seeing various information, but none of them ever offer a solution and they just end. When I use the Jamf SCCM Proxy Service Helper and try to just send one machine manually I get different error.- [ 67] ERROR Jamf.ProxyService.Plugins.SCCM.Utilities.Certificates - There was an unexpected error sending the device to SCCM.- System.InvalidOperationException: Invalid registration state: Error. Cannot continue.

i have a script that runs software update via JamfHelper, however I cannot get the actual software update command (via API) to run untiless the JamfHelper window is quit. Anyone know how to run a process while still keeping the JamfHelper window open/active?  my syntax is as follows: /Library/Application\\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper \\ -windowType hud \\ -lockHUD \\ -title "macOS Security Updates" \\ -heading "macOS Updates Now Installing" \\ -description "Installation can take up to 45 minutes.. Close and save your work now." /usr/bin/curl -s -X POST -H "Content-Type: text/xml" -u ${apiUsername}:${apiPassword} ${jamfProURL}/JSSResource/computercommands/command/ScheduleOSUpdate/action/install/id/${jamfProCompID}

Hey all!I'd like to have an alias that points to Self Service available on the desktop of all Macs across our fleet. I guess there are several ways of doing this. Just looking to get some ideas on what a quick and easy method would be.Thanks!

I am at a loss with this issue. I have uploaded a PLIST to JAMF and I am scoping it to my test machine. Chrome is showing that the policy is taking affect but it is not being enforced. ( I have attached a screen shot of the policy within Chrome). Here is the PLIST that I have configured <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>RestrictSigninToPattern</key> <array> <string>scsd2.com</string> </array></dict></plist> Anyone who could offer some advice would be greatly appreciated.

We have implemented Shared iPads in our environment, and for some reason the Markup feature in Safari has disappeared. We've found that our normal 1:1 iPads in the environment have the feature, so we're trying to figure out if this is another Shared iPad "quirk" or if it's merely a setting we have that's accidentally restricting the feature.

Sorry, If this is a simple one. From Where I can download the Jamf Composer? I want to use the composer to package the Self Service application. 

Greetings,I'm familiarizing myself with PreStage Enrollments, and while for the most part it's going well, there are a couple things I was hoping to get some feedback on.The first may be a simple setting that I'm just missing - applying a Mac's previous name once the enrollment is complete (or during if that's where it needs to take place).  For example if I had a Mac called "Mac-99" that's in my Jamf Pro system, and I wipe it, once the PreStage Enrollment is complete (or during) is there a way to apply it's previous computer name "Mac-99" to it?  Right now, it gets placed back into it's previous groups, and it get its previous Config Profiles applied back to it.  However it does not receive its previous name, and now has the default macOS assigned name of "iMac".The second conundrum I'm facing it trying to get a post-enrollment script to run that correctly enables ARD, and grants all access to the local admin account that gets created during the enrollment.  The ac

When I click on a device in Jamf Pro, some of them refuse to open.  All I get is the spinning wheel.  Some devices I click on do open.  It's rather hit or miss.  I've left the page open for 30 minutes hoping it would eventually open...nope.

Might overlap https://jamfnation.jamfsoftware.com/discussion.html?id=4701 In the past when we made monolithic images (before the enlightened days of Casper) I would install the OSX Server tools and then use it to add all domain users - an AD group - to the local printer admin group on a bound machine. Then I'd unbind, remove the Server Tools, do all the other prep and make an image of it all. When the image was applied and the target Mac rebound to AD the Print Admin group was happily respected and I'd never get calls about paused print queues. Yay! I win!Ok, so now I want to push a configuration out via Casper. How do I emulate this process? I want to make an AD group a member of a local group during imaging or pushed out with Casper remote or Self Serve or maybe even good old' ARD.Can I? Thanks for reading.- Scott

Hey all,Has anyone started using the new command in 11.5 as shown here:https://developer.apple.com/documentation/devicemanagement/set_recovery_lock_command  It looks like its been set up on Apple's side, but I don't see any documentation in the Jamf Admin guide related to it?  Looks like this is the closest we will get to having a firmware password on M1's.

Why is it not possible to migrate static groups to dynamic groups but the other way around?Nice RegardsPeter

Does anyone have a script that will name a Mac, and then keep the computer name and host name synced up? We typically name our Macs as app-serialnumber. The "app-" designates that it is an Apple, but the serial number is just that. Any help?

Hi together. Are there any topics you can recommend for someone like me who is attending JNUC for the first time?

Hi everybody, I would like to know if it is possible to find the latest available version of Cocoadialog?If so, please, where will I find it ?Is it compatible with Mojave (10.14) ? Finally, do you recommend Pashua or Cocoadialog ? Thanks for your help and i wish you all a happy new year...