Hi,I just noticed a bunch of my computers (about 75%) stopped checking in to Jamf Pro  (cloud) on a specific day in August:On running sudo jamf policy I get:There was an error.     Device Signature Error - A valid device signature is required to perform the action. Jamf log at /var/log/jamf.log on the client shows:Sat Aug 13 06:22:26 ServerXXX jamf[15424]: Error Domain=com.jamf.jamfsecurity.error Code=-25293 "unlockWithPassword:error: : The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=unlockWithPassword:error: : The user name or passphrase you entered is not correct.}Sat Aug 13 06:22:27 ServerXXX jamf[15424]: There was an error.Device Signature Error - A valid device signature is required to perform the action.  The problem seems to be fixed on each client by running sudo jamf enroll -prompt on the client. It's a lot of busy owrk to do this on each client - is there a better way?Also, since this is possibl

Hi all, Somehow I am unable to install this driver from Apple website: https://support.apple.com/kb/dl1867?locale=en_US We use Papercut as our printer management, but we are unable to proceed due to the driver issues. Even the PPD driver from Ricoh website does not seem to work. Anyone using Ricoh MFP in their environment? How do you install printers on your users Macbook?

I remember being able to bypass all of the new user setup steps in macOS in the past, but I don't see how that's done now on newer versions of macOS. I remember there was a payload we could deploy in a configuration profile. We can do this during PreStage but if I setup a hidden admin account, and I later need to login using it, I would like to not have to click through all of the setup steps just to get in and do what needs to be done. Does anyone have a process for this to avoid the setup steps?

We want to be able to send notifications to our iOS devices.  We have about 50 of them enrolled in Jamf Pro currently.  We have not tried to use self service until now.  I went to the settings and under the Self Service section went to iOS and selected the "Automatically install self service app" option, then on the app options selected "no login" as we have several devices where there isn't one user and those are setup sort of like a kiosk but with more than one app available.  Of all the devices, the only one that immediately installed self service was an iPhone 6 running iOS 12 (which is the latest iOS it will install).  All other devices are on iOS 15 and have a command under the completed commands in management history that says "Install App - Self Service" but nothing was actually installed on the device.  What do I need to do to get the self service app to install on all the devices?

We're experiencing NilObjectException Errors while imaging our MacbookAir6,2's using ThunderBolt to Ethernet from our 10.8.4 NetBoot Image. Is there any sufficient documentation to fix this on the 8.72 JSS. It's almost 50/50 as to when it occurs, I can image get the error then re-image and not get the error. It's then about 50/50 as to whether it will be able to recon and enroll itself properly. We've also seen a less common IOException Error. We've had to manually delete the JAMF Keychain in the Library/App Support/JAMF folder to get these machines to enroll. We're not sure if they're going to pose additional errors in the future. We thought it may have been a bad NBI so we built a second one, and same occurrence.

Hi there,I have tried to search for an answer but have not found anything relevant.  We are wanted to use the patch definition to find computers that need security updates applied.While Catalina and BigSur patch definition only contains their versionsApple macOS Catalina: 10.15 (19A583) to 10.15.7 (19H2026)Apple macOS Big Sur: 11.0.1 (20B29) to 11.7 (20G817)Monterey contains all macOS versions Apple macOS Monterey: 10.9.0 to 12.6.0This causes the UI to show more computers needing Monterey security updates than the number of computers actually running Monterey.Why the definition of Monterey does not follow the same patters as Catalina or BigSur where they only show the versions application to their own.Will it be possible for Jamf to fix the definition for either Monterey or Catalina and BigSur so they follow the same pattern.Note: We have used Smart Groups to find the actual numbers of computers needing security updates for Catalina, BigSur and M

Hi all,To appease our auditors, we need to add a custom text field to all our Laptop entries.  It simply needs to say "Data classification level: C2".I've tried to do it via Extension Attributes, but it won't print out what I need.  (I'm sure I'm not using EA correctly) Has anyone been successful in just adding a custom text anywhere?   Thanks in advance!  

I think this is a Catalina issue as I don't recall noticing it in Mojave. I just installed the recently released supplemental update for Catalina and have noticed that all the log files in /Library/Logs have been removed after the upgrade. I took a snapshot on a VM and ran the upgrade a few more times just to confirm this is happening - it is. Before the upgrade I have a folder /Library/Logs/MyComputerName. In this folder is where I put custom logs, including the log file for our update script. That entire folder is gone, and most of the log files under other folders in /Library/Logs are gone as well (though some empty folders still exist). I read that Catalina has moved system files to a read-only operating system. I'm wondering if that could be part of this problem. Does anyone know if this is the expected behavior? Is there a better/recommended place to store log files that will survive macOS updates?

Hello,I am currently working in a school that uses 900+ iPads and 300+ MacBooks and wanted to ask if anyone has used or is currently using Zero-Touch Deployment in their institutions? Every Academic year, we collect all the devices for wiping and reinstalling, which can be tedious with that many devices.I am fairly new to Jamf and would like some suggestions that may help ease in setting up devices through Jamf.Thanks!

Hi All i just wanted to know how people are managing turning on the firewall on your machines as i have 60 machines that i need to turn the firewall on but dont know the best way around this

Has anyone been this stuck with a locked computer? I locked a computer remotely using JSS and creating the 6 digit code. The computer successfully locked, the student then tried to guess what the code is and got it wrong. He then brought it to me with the screen displaying "Your computer is disabled. Try again in 60 minutes" Once that time runs out it just shows "Wrong passcode. Try Again" without ever giving me the option to enter a code. I have tried booting into recovery mode and doing an internet recovery. Both times it just boots to the same screen. I took it to the Apple store and they claimed they have never seen this screen before and could not help. I then spoke with my Casper rep. They had me do a PRAM reset and a SMC reset, both times it booted to the same screen. She then told me to call Apple Support and they had me try everything listed above again. Apple Care sent this issue to the engineers and I am waiting for a response. I am looking for any sug

Hello everyone,We use JAMF school to manage our iOS devices. We are primarily a Windows environment when it comes to laptops and desktops. We currently have new and older MacBook’s(iMacs too) that are not in the domain. They are stand-alone. For security reasons we need to start authenticating users when it comes to macOS devices. I have read some documentation regarding authentication via Azure or LDAP. What would be the pro and cons of going with either one? Also, would it join the domain after the Device enrollment? If so, would those configurations be done in the organization settings or within the profiles? I also read about directory binding. Would this need to also be configured, or is it something not related?I have several questions to have a better understanding before moving forward.Any help would be greatly appreciated.

Hello!Current Issue:Issued Command "Enable Lost Mode"iPad was found - However, when "Disable Lost Mode" is sent it does not get received. Nor does any other command.iPad was restarted - From what I read that does cause the wifi to shut off. I have downloaded Apple Configurator however, the computer does not see the iPad when it plugged into it. Any help would be much appreciated in this problem. Thanks! 

A lot of different students use the laptops where I work and we have one set profile for them to use. The idea is that when the laptop logs on we can disassociate from the WiFi and also delete the password key that sits inside of the keychain access so each student can use their own WiFi username and password. I've managed to do this and I can do it manually through these commands:#!/bin/bashsleep 30echo "sleep over"sudo /usr/libexec/airportd en0 disassocsudo /usr/bin/security -v delete-generic-password -l networkaliasecho "disassociated"First I give the computer about 30 seconds to reconnect to the wifi before disassociating and then I use the next command to delete the password that sits in keychain access. These commands work perfectly fine when I run each one manually, along with when I use "sudo jamf policy -event trigger" to force it for testing, but every time I let the command run itself on logon it disassociates but never deletes the password and lets you reconnect to the

Hey Everyone!  Running into a snag with the new v1.3.1 Okta Device Trust registration process.  There is nothing wrong with the script, rather i'm running into deployment issues of command line tools (python3). This is the script I'm using to get the command line tools:#!/bin/sh echo "Checking for the existence of the Apple Command Line Developer Tools" /usr/bin/xcode-select -p &> /dev/null if [[ $? -ne 0 ]]; then echo "Apple Command Line Developer Tools not found." touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress; installationPKG=$(/usr/sbin/softwareupdate --list | /usr/bin/grep -B 1 -E 'Command Line Tools' | /usr/bin/tail -2 | /usr/bin/awk -F'*' '/^ *\\\\*/ {print $2}' | /usr/bin/sed -e 's/^ *Label: //' -e 's/^ *//' | /usr/bin/tr -d '\\n') echo "Installing ${installationPKG}" /usr/sbin/softwareupdate --install "${installationPKG}" --verbose else echo "Apple Command Line Developer Tools are already installed." fi e

Hi everyone we are rolling out BT privilege management to our Endpoints and we are running into issues assigning the policies to different flex groups e.g high low and medium flex. We have the Azure AD connection enabled but we cannot assign AAD groups to Macs in the console(we can for Windows). When we assign policies via standard AD groups the policies don't filter down to the devices. Apparently this is a known bug. Ideally we don't want to use AD as we are trying to move away from Binding.We have reached out to our BT rep but we haven't made much progress. How are you all pushing policies to the different groups?

EDIT: This seems to be an issue effecting multiple JamfCloud hosted environments. I have Logged a support case with Jamf, as have other community members.I will keep this thread up to date with any information from Jamf Support. On two JAMFCloud Jamf Pro instances, running version 10.40.1-t1659581750 I am unable to save a particular script into Jamf, as every time I press Save it results in a 403 - Access DeniedWhilst debugging this I have found that there are certain character combinations that cause this error.If I try to save a script with the following text only, I will get the 403 error${a:}${}  the "a" parameter / var can be swapped with any letter or number and it will still cause the errorIf the curly braces are not touching the last $ it will save fine, if they are touching however it will error.There can be text in between the first ${a:} and the second ${} and it will still crash.The lines can even be commented out, and it will still crashe.g. the below w

Hi,We use a shared login for our Mac lab. When students log into Google services and close the Chrome window (but they don't quit Chrome), I'm finding that when the next student opens Chrome, the prior student's Google account is still logged in. Is there a way to force the Google account to logout when the Chrome window is closed (by hitting the red circle)? I've been able to partially achieve this by checking the "Keep local data only until you quit your browser" setting in Chrome settings, but that only works if the student quits Chrome through the menu, not if they just click on the red circle to close the window.

I have managed iPads that I have purchased the eBooks for on Apple and created Managed Apple IDs for in Jamf Pro. The eBooks are set to be available in Self Service mand scoped to be All Mobile Devices. The eBooks appear on the iPads inside Self Service, but the "get" button is grayed out. Can someone help me understand what I'm missing? 

I'm trying to get an APN Cert downloaded as a .p12 file instead of a .pem file. I'm trying to use [OneSignal.com](link URL). Anyone have any ideas how to do this? I tried downloading it from here but all I get is a .pem which doesn't work for me. https://idmsa.apple.com/IDMSWebAuth/login?appIdKey=3fbfc9ad8dfedeb78be1d37f6458e72adc3160d1ad5b323a9e5c5eb2f8e7e3e2

Hi all, I'm attempting to distribute free books via Jamf Pro to a set of 50 iPads at the school. I read that books are actually linked to users - not devices (very annoying) - so as a test I created a user (with the Role of Student) in Apple School Manager and synced & imported this into Jamf Pro so the user account now shows up in Jamf Pro as well. In Jamf Pro - I assigned this user account to one of the iPads being managed by Jamf Pro. For the eBook I then put the the user account in the "Scope" of the book.In the "General" tab I have made sure the book is Enabled, is set to Install Automatically/Prompt Users to Install (iOS only), and have selected Free (so no need for an VPP invitation). However - the book still does not appear in the Books app on the iPad. When I open the Books app under "Reading Now" it just says "Sorry ... Something went wrong. Please try again." with a Retry button that doesn't do anything when tapped. Under "Library" it says there are "No Books. To ad

(We use Jamf School, which has less flexibility with customizing deployment of scripts compared to Jamf Pro, but with the Scripting Module we are able to push out scripts normally.)SMART boards are used a lot in the building and we have had issues with all of them regarding screen sharing/mirroring. We are trying SMART's own screen sharing application and, like their other applications, require Privacy permissions that are requested at different times. With how many MacBooks we would be pushing this too, that will be a lot of times for us to type in the admin password and grant those permissions.Is there a way to script these permissions to be granted? They aren't requested all at once, which may make it more difficult. For example, connecting to the SMART board requests Accessibility permissions, then initializing the screen sharing requests Screen Recording permissions.Or if there is an alternative setting that I don't know of that would automatically grant permissions would be great

I'm reconfiguring Jamf Connect and am a little confused by the overlap of the com.jamf.connect and com.jamf.connect.verify application domains. It seems like you have to use both to fully customize the menu bar and password syncing functionality of Jamf Connect, but the existence of the same settings in both domains is stressing me out.Are they actually configuring the same thing? Does one take precedence over the other? Is there a set of best practices to follow? The Jamf Connect documentation isn't clear on this, and it doesn't even seem to reference the fact that you can configure it at the com.jamf.connect level.Long story short, I’ve got things working, but "A," I’m not sure I did it “right,” and "B," there’s no way anyone who looks at these configs after me is not going to have the same exact questions.Thanks, Matt

Hi,Google Drive File Stream has become Google Drive and all the scripts out there for installing are now defunct. Does anyone want to take a crack at updating the Script out there? I'd love one that works! DL location is now https://dl.google.com/drive-file-stream/GoogleDrive.dmgand the DMG opens to create GoogleDrive.pkg Note, this still does not run on M1 processor.

Googled.  Found this.  It doesnt reference anything like my Apple School Manager.Is there documentation for exactly how to do this now?Thanks for any help.