Trying to get users upgraded to the latest Big Sur. Software Update shows a red button indicator, but on opening it never finishes looking for updates. The softwareupdate -l command shows a similar result... it just sits until it's cancelled.I thought it was a configuration profile, but I excluded my test machines from any OS deferral.Next I thought that it was because we had been using the --ignore-update switch in softwareupdate command to ignore OS updates in Catalina or earlier. But if that carried over I can't undo it (--reset-ignored is no longer a switch) and it probably wouldn't even try to look for Big Sur updates if it was still applied.Looking into a way to upgrade the OS to Monterey and the erase-install project isn't immediately possible because softwareupdate --fetch-full-installer just seems to spin its wheels as well.I guess I can download Monterey, and push it up to our Jamf server, and deploy that down to the clients when they're ready to upgrade.No alternative s

We are testing the viability of replacing our current VPN with a L2TP VPN handled through the network settings of the Mac, dropping the need for a software client. Everything is up and running and works wonderfully, deploying the VPN setup via a configuration profile. However, I am having trouble figuring out how to change two settings (short of doing it through the GUI) - System Preferences->Network->Select VPN, Advanced Settings->Options Tab, Session Options I would like to uncheck the "Disconnect when switching user accounts" and "Disconnect when user logs out" settings. I do not see anything in the configuration profile to accomplish this. I found the settings in /Library/Preferences/com.apple.networkextension.plist, but cannot figure out how to change them there either. Additionally, it might be nice for users to be able to toggle "Send all traffic over VPN connection" depending on where they are - but users cannot access this advanced menu - so if it might be cool t

Good Afternoon,I've looked under Config Profiles > Restrictions, but can't find it.  Is there a way to disable AppleID Sign in in settings?  We don't use managed apple ID's and don't want the students logging on to the devices.Thanks for your help

creating a policy for carbon black sensor. you need to modify the script to give it a path the the package. "CBD_INSTALLER="/Path/Where/PreinstallScript/Downloads/Installer.pkg" Jamf is running on a windows server and i tried the location "\\\\vsrvjamf\\jamfshare\\Packages\\CBCloud3.7.1.12 Install.pkg" and "D:\\jamfshare\\Packages\\CBCloud3.7.1.12 Install.pkg" but those didnt work. what should i put there?

Happy Monday everyone, I'm currently going through the process of implementing the CISCAT benchmarks for Security, you can take a look at some of the features here if you are unfamiliar. I am trying to make it so that I can deploy SecureKeyboardEntry to the terminal. The best I could come up with is making a script to edit the PLIST and then pushing that script via policy. defaults write /Users/$USER/Library/Preferences/com.apple.Terminal.plist SecureKeyboardEntry 1 The bit seems to work in having the setting checked off, however it also seems to remove whatever terminal customizations the user has. Anyone have any recommendations for implementing this?

I've had an issue crop up today where devices (specifically iOS devices) are not getting VPP licenses assigned to them when an app is in scope. I've confirmed we have thousands of extra licenses available but each device is stuck in this state:Pending - All licenses are in use or the license is not assigned yetWhen checking the Volume Purchasing logs this message is repeated endlessly:[ERROR] [ralPool-309] [VppCommService ] - Error managing licenses. ErrorNumber: 9600 , ErrorMessage:Either an associate or a disassociate array is required.I've got a ticket in with Jamf, but I'm a newer Jamf administrator and wasn't sure if this is a Jamf/Apple problem or something I might be able to fix. 

I'm beginning to develop Self Service for a client and am wondering if anyone is finding the Flush System/User Caches at all useful? Or, is this in the same category as Repair Permissions, once in a while helpful but mostly not?

Hello JAMF NationAs the subject states I have been tasked to migrate about 50ish or so macs from one domain to another and was wondering how others like myself have got this to work as effortlessly as possible. I have some concerns and was hoping to get some Ideas on how to go about it and getting it all done properly.Currently: Machines are domain bound and in their perspective security groups and OU's and managed with (NoMad) for password changes. The usernames (mobile) currently on the machines have file-vault enabled and are the only accounts to have a secure token. Question? How or would it be possible to migrate to a new domain with a new username as the usernames do not follow the same convention as the previous domain, that would in part need to have a secure token passed to it as well as maintaining the File Vault structure already escrowed to JAMF and making sure these users are added to their new OU's and Security groups from within that New domain. Would it be eas

I was curious if anybody had additional information for a project I've been working on. I'm running into an issue where in some computer labs that see frequent use, there are often many users signed into a mac at the same time and the machine begins to slow down.What I was looking to do is setup a policy where users are automatically logged out after a certain amount of time of inactivity. I see that is a configuration profile option for this setting, however from my testing it seems that the inactivity timer is only active when somebody is not on the lock screen. Is there a way using the configuration policies to log out a user after a certain amount of time, even if they are at the lock screen?

I have a user who reports he is unable to boot into the Utility menu by holding Command + R on bootup.  Is this a feature of Jamf?  I have always been able to re-format when enrolled on my test machine but thought I would double check to see if there is an exclusions list users need added to to enable them to factory reset their Macbook.  I searched around online and the forums here at JN prior to posting but didn't see anything related. Thanks! 

Hi all! Just wanted to see if anyone else is running into issues patching Zoom with Patch Management on computers that have upgraded to Big Sur? I am getting a keychain prompt after the patch completes. I can run the same patch on a Catalina machine with no issue. I first noticed this on Zoom 5.5.2, but it has happened on every patch since. I just had the same thing happen with Zoom 5.5.5 today so it does not seem like the issue will resolve itself. These are all Intel machines. Thanks!

Hello there,I am a newbee to Jamf pro.I have downloaded "office 365", used Jamf composer to package it. Uploaded it to the Jamf server and created 2 policies.1: Install Office 365 (Make the policy available in Self Service is NOT TICKED)2: Self service - Office 365 (Make the policy available in Self Service is TICKED) I was told by a Jamf engineer, we need to create separate policies due to priority issues. I currently dont have office 365 in my Mac (I deleted it) & the app is showing in self service for me to install.I installed it through self service & its working fine but the app disappeared from self service. Why is that? Any help is appreciated.Cheers,Anam 

Hi,I either went crazy or something has changed? A simple smart group to show FortiClient 6.x version shows 7.x version as well and I can't figure out why. It's not just 1 mac, but all of the ones which have FortiClient 7.x, no version 6 present are shown as well... Has anybody seen such behavior before? This is like 101 smart group and I have no idea why is it not working like that.That smart group shows my own work mac as well, I can certainly confirm, I do not have FortiClient version 6 installed

Hi allWhen we build macOS devices we use DepNotify and Installomater to install around 10 standard applications including, Chrome, Office, iTerm, Docker and a few other things. We also allow a larger selection of applications to be installed using Installomater via Self ServiceIn order to manage updates we have a policy that checks a smart group for each application to see if it is on the latest version and if the smart group indicates the machine is behind, it calls installomater again to update the applicationThis is having limited success and I'm not sure why.Could anyone advise on whether there is a defacto standard way to update applications that would meet the following criteria:1. It should work for as many common applications as possible2. It should not require users to do anything:3. It should be able to guarantee that applications are updated within a handful of days of a security update being released4. There should be minimal involvement from IT in having to package, script

At our school we follow a "security through obscurity" policy regarding WiFi connections. I know, I know.The kids never see the actual password, it is just pushed using a profile in Jamf School. But in iPadOS 16 the user will be able to see all stored WiFi passwords.Does anybody know if Jamf will be able to block that feature?Thanks!

Hi, I noticed that all of my Macs had an old scope that pushed out a Device license to all of our Macs. The problem is that my school has moved over to User License accounts and as soon as this old policy was pushed through, the User License accounts no longer work (it's using the device license)*.Is there a way to permanently delete the device license (hopefully without removing all of the adobe apps) and have it re-trigger the user license instead? Thanks in advance! *sadly these old policies were pushed through after I cleared out 500K+ failed polices.

I have created this policy but it looks like it's not pushing the update thru jamf pro. Can anybody advise me on this?

In Jamfcloud, when configuring a new ADCS certificate authority (Global Management > PKI Certificates > New Certificate Authority > ADCS), the interface requires me to upload a Server Certificate file.  What are the requirements for the format of this file?Specifically, assuming that the file contains more than just a single, self-signed cert,Which elements of the full certificate chain should be included in the file?Leaf cert onlyLeaf cert + intermediate(s), but not root (This is what’s normal for a web server.)Full chain: Leaf cert + intermediate(s) + rootIf more than just the leaf is needed, should the elements should be provided in a leaf-first PEM bundle, as is typical (for example) for Apache?If the root isn’t included, is there someplace else where I am supposed to tell Jamfcloud to trust my internal CA root?Thanks,Chris

Hey Guys,I've run into a strange issue with people trying to Mount DMG Files. I've only experienced this with Monterey 12.5, regardless of whether it's a newly imaged machine, or an upgraded OS one. I've only noticed this with M1 Macbooks. When you go to open a DMG, it just doesn't do anything at all. Maybe a process inside Activity monitor loads up, then nothing. The only way I can get them to mount is if I go to Activity Monitor, select diskarbitrationd and diskimagesiod and force quit them. Then it will mount them for a while... Ultimately this comes back though.I've tried to use terminal to script this out so that some of my employees can install software, but killall doesn't seem to be having the same effect.Is this something you've been seeing? This has not happened in any other versions of Monterey. My computer used to mount them just fine, but now I cannot. Any ideas or suggestions? Thanks,Dominic

I have a static group that I wanted to add some newly imaged machines into but they're not showing up as an option. If I go to create a new group they show up there, but not in the already existing group. Is there a workaround for this? Thanks!

Hello togetherWe have since a few months a strange problem on a few managed Macs, which we manage with Jamf Pro:Sometimes the login is denied with a correctly entered password. The users are sure that they enter the correct password (stored in PW-Safe).It should also be said that we have a relatively strict password policy.Resetting is now only possible using the recovery key from FileVault.Have you had similar experiences? What could be the problem?Translated with www.DeepL.com/Translator (free version)

My question may have a ridiculously easy answer, but here goes. We have a lab environment with a teacher who works with grades Pre-K, K, 1, 2, 3.We have user accounts (standard user accounts in AD for these grades). The teacher wanted to have a specific dock configuration for these standard user accounts. After looking at a bunch of options I went with Dockutil. A friend of mine with considerably more scripting experience helped me create a single script that used case to configure the dock for those specific user accounts.The trouble is that script was made before Dockutil was rebuilt using Swift. How do I adapt the script to work now without Python??The script is below:#!/bin/bash #We need to wait for the dock to actually start until [[ $(pgrep Dock) ]]; do wait done #Get the current logged in user that we'll be modifying if [ ! -z "$3" ]; then user=$3 else user=$(python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDyn

Hey all, I took some time off during the summer and completed a tool that I have been thinking about for some time. I’ve fully tested it with Jamf Pro. Hope it helps! https://office-reset.com

We have Yubikeys paired keys with MacOS. I have to export Yubikey Cert infos to shared smb.Solution: I have a Powershell script to deploy on admin and non admin users.Requirements:  Brew /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"  Powershell  brew install --cask powershell brew install ykmanpws script.ps1These commands are working just fine locally. Am not able to write these commands using a script  to be deployed as Jamf Policy. Any idea?

Has anyone figured out how to use Erase All Content and Settings for computers running Monterey yet? Did they implement this feature yet? We have been wanting to test this on our computers running the beta, and now that the release is less than a week away and 10.33 just came out, we figured it would be in there, but all I'm seeing is the old Wipe Computer button requiring a six-digit code.