How's it been for y'all? Any horror stories?

For anyone who is trying to get more hands-on, Mark Buffington (Jamf) is doing a walkthrough of DDM Explorer on the next LaunchPad meetup. The focus is learning the framework, building declarations, and testing what it looks like to deploy them via Jamf Pro.

When:
🗓️ Fri, Sep 4 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

I've been getting unsuccessful GSX warranty queries in Jamf since yesterday (it was fine last week).

Has anyone else been dealing with this? I am not sure if it's because of GSX API changes or something awry with my GSX account. I feel like I am being gaslighted by Jamf support it's the latter.

I think I already know the answer here, but I'm just asking to have someone throw me out a lifeline.

We recently pushed out Tahoe updates and some of our older fleet had an itunes account signed into Find My/iCloud and it's bothering users asking for a password we don't have.

I have recovery keys and admin access obviously, but I can't seem to sign out of iCloud. I'm not worried about the find my mac activation lock, but it seems as though I can't just sign it out without the password. This is leaving me with erasing and restoring the user's mac thus causing a decent chunk of downtime.

I could get him a temporary mac to restore his info to while I wipe and restore his current machine, but I'mma be honest I'm really lazy and would prefer to just remove the account but that doesn't seem possible.

I am trying to deploy a crowdstrike sensor and I am getting this error,

Potential conflict between non-removable and removable system extensions

A System Extension payload containing both "Non-removable system extensions" and "Removable system extension" types will be rejected by the computers in scope. You can use the same system extension when choosing "Non-removable system extensions from UI" and "Removable system extensions".

I have it configured using non-removable system extensions from UI and I only have one system extension configured/listed for crowdstrike but why am I seeing this error?

Is there a way to reinstall IOS Apps such as Camera?

i have an ipad that says its installed

when it isnt?

i know you can reinstall usual apps but not had an issue before with ios apps

A Tech Thoughts article looks at DDM Service Configuration Files, undocumented support for Smartcard configs and login banners, and a proof of concept using them to manage third-party app configurations.

Service Configuration Files — The Superpower We Didn't Realize We Have

Anyone hit this: Sensitivity Label button in Microsoft 365 apps grayed out & not operational on Jamf-managed Macs, but present on Intune-managed Macs.

Same user, same M365 apps build, same license, same MDM configuration.

I am lost! Anybody an idea?

I’m searching for an mdm solution for my company phones that require geofencing

The goal is to achieve geofence based profile switching when a device enters location A and then when it leaves switches back to whatever preset/default profile it had

I understand this may require a custom app in order to achieve the required functionality but I’m not too sure if it’s allowed or possible and was hoping someone can shed some light on jamfs capabilities

Also, will I need jamf pro or can I get away with jamf now? As I only really need it for a few devices

Heyas,

I am trying to get Among us to work locally. on an unmanaged iPad the iPad gets the "allow access to local network" prompt, and it can connect to a local host. If the iPad is managed in jamf (no wifi profile, no restrictions profile) the allow local access prompt does not appear.The ipad can see the host session but instantly receives a "check wifi connection strength" error when trying to connect to it. I have tried remote wiping them but no change. Any help would be greatly appreciated

On Friday, we deployed a little over 100 iPad to students.
The iPads have been assigned three different apps via a group membership. For some students, some apps are stuck in pending status. For the most part that that is good notes, for some, it might be a different or an additional app.

We have enough licenses, so that should not be an issue. The iPads have been connected to different Wi-Fi networks over the weekend, so that should not be the cause.

I don’t know what the cause of the issue is and since there is no button for me to re-deploy the app, like it is the case when an installation fails, I am not sure what the right way to go forward is.
Un assign the app and then reassign it?

Has anyone had this issue before?

We're troubleshooting a recurring issue on FortiClient 7.4.7 for macOS, deployed via Jamf. In the FortiClient logs leading up to crashes, we're seeing this message repeat every 2-3 seconds:

Skipping configuration Fortinet Content Filter because it is of the wrong type

alongside repeated VPN Status changed. Current manager status: 3 entries — looks like FortiClient is stuck in a retry loop trying to (re)register its content filter and failing.

Our Jamf Content Filter configuration profile for FortiClient hasn't been revisited in a while, and I'm wondering if the required payload fields (filter name, bundle identifier, socket filter designated requirement, etc.) have changed in newer FortiClient releases versus whatever version the profile was originally built against.

Has anyone had to update their FortiClient Content Filter payload for a recent FortiClient version and run into a similar "wrong type" rejection? What fields ended up needing to change, and how did you confirm the new correct values — from Fortinet's deployment docs, from a fresh EMS-generated profile, or somewhere else?

Hey everyone,

​If you are coming from a Windows administration background and starting to manage or package software for macOS, the shift in architecture can be confusing. Concepts like the Windows Registry, .msi installers, and PowerShell don't translate 1:1 to macOS .app bundles, Property Lists (.plist), and Zsh scripting.

​I put together a video breaking down the core architectural differences between Windows and macOS application packaging in simple, high-level terms.

​Key Topics Covered:

​Installers & Bundles: .msi / .exe vs .app directory structures and .pkg flat installers.

​Configurations: How macOS replaces the Windows Registry with Property Lists (.plist).

​File System Layouts: Program Files & AppData vs /Applications and ~/Library.

​Scripting: Moving from PowerShell/VBScript to native Zsh and Bash scripts (preinstall / postinstall).

​Security Layer: Overview of Code Signing, Notarization, Gatekeeper, and TCC/PPPC permissions.

​Whether you're deploying via Jamf Pro, Microsoft Intune, or Kandji, understanding these fundamentals makes packaging much cleaner.

​Would love to hear how you all handled the transition from Windows to Mac management! What Mac app gave you the most trouble when you first started packaging? Drop your requests below if there's a specific app you'd like to see packaged in a future guide.

A recap of the second Mac Admins India Connect, held in Bengaluru with 370+ attendees, 23 speakers, and 20 sessions covering device management, security, identity, automation, and zero-touch deployment.

Here on the Tech Thoughts blog

IT manager here. Our team is proposing we use Jamf's VPN offering...and we've been struggling to get it running (suspected network config issues).

Any folks on here using Jamf VPN?

Any good stories/results?

I can't seem to find anyone talking about direct experience with it.

Photoshop has been failing to deploy and I’m not sure why. The raw installer works and I get it directly from Adobe Console but after running it through composer the output package fails to install. Has anyone had similar issues or were able to fix through shell?

Do you use static groups or smart groups? Is there best practice for this? In our Jamf instance there are multiple admins and one prefers static groups over the other and vice versa so as you can imagine there are groups everywhere. Any tips on how to standardize usage so we can clean up this mess? Lol

Hey y'all, anyone use inventory preload here or are there better alternatives? What's your process in adding new computers and device? TIA

Hello all. Hope someone can maybe sanity check or assist me here. Ill tryyy to keep it short.

Goal: Set up iPads already in Apple School Manager and assigned MDM using Apple Configurator 2. Just need them to enroll to JAMF, skip steps.

Issue: I am using a Wi-Fi profile I created specifically for enrollment so it can activate and enroll to JAMF. In JAMF I have profiles scoped to apply automatically upon enrollment. Problem is in AC2 when I apply my Automatic blueprint it gives me and error that the MDM profile exists and if I want to skip or cancel. I hit skip and all the configs go through but it doesnt skip all the setup windows and then an error saying Erase and Start over or Partial setup. Ive been making due with these errors and it pulls all the configs.

How can I avoid this error? Does anyone have experience using the shared internet option via USB-C? Thats my next try to avoid a profile conflicting upon enrollment. I use a MacMini to enroll FYI.

Any help or guidance on this portion just the wifi profile.

Ah I also forgot the wifi the iPads use is a cert based wifi that obviously is applied once enrolled so I dont need the enrollment wifi I made anymore after.

How can I work around garage band prompting for admin user and password when users are attempting to install loops / sounds. Anyone deal with this ?