Tag: jamf pro

• Jamf Remote Assist is here!
  Today’s release of Jamf Pro 11.1.0 includes the much anticipated release of Jamf Remote Assist.

  This is a feature I’ve been looking forward to since the deprecation announcement for Jamf Remote. I think having some kind of built-in remote control functionality is a must for a MDM in this day and age.

  The new tool is a little on the bare & buggy side, but I have a feeling that it will be something that the engineering team at Jamf will be giving some extra love to in the coming months.

  Enabling the feature is pretty straight forward. Sign into your Jamf Pro portal and navigate to Settings > Computer Management > Security. Click Edit (lower right-hand corner), select the Jamf Remote Assist checkbox, and click Save.

  

  To initiate a Jamf Remote Assist session, find the computer you wish to connect to in the Jamf Pro portal and navigate to the Management tab and click the Start Session button under Remote Assist.

  

  If the user is logged in to their computer, the remote session starts as an attended screen sharing session. The user is notified that a screen sharing session is about to begin and that they can Accept or Decline.

  

  

  When the session is ended the user gets a nice message with some summary details:

  

  The updated section in the Jamf Pro Admin Guide that covers Remote Assist also mentions unattended sessions:

  The Jamf Remote Assist session cannot start if the user declines or ignores the prompt. The session opens in a new browser tab with a spinning wait cursor shown. The admin is prompted for a set of local account credentials. If the user is not logged in to their computer, the remote session starts as an unattended session. No action is needed from the user.

  https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Jamf_Remote_Assist.html

  In testing, on both virtual and physical machines, I wasn’t able to get an unattended session working. I’d click Start Session and the wheel would just spin endlessly. Nothing would happen on the target machine and a new browser tab never launched.

  Additionally, I saw all kinds of weird behavior with the Profile that installs allowing Remote Assist to work. Sometimes the Profile would appear multiple times on the list of Profiles installed on the machine.

  On other machines it would appear to remove and reissue the Profile over and over again, but fail each time:

  

  And then sometimes Remote Assist would just fail to start:

  

  Conclusion?

  I think Remote Assist is an excellent addition to Jamf’s ever-growing suite of tools. However, it needs a little more work before it can be used as a reliable troubleshooting tool. I’ll be playing with it more throughout the week and will probably update this post as I go. I’m especially interested in trying out the file transfer feature!

  What are your thoughts on Jamf Remote Assist?
  23 November 2023

  Review, Spotlight

  enterprise, jamf, jamf pro, jamf remote assist, macos, mdm

• Jamf Pro 10.49.0 – Upcoming Features & Deprecations!
  Today I was going through the release notes for Jamf Pro 10.49.0 (almost a week late to the party, I know) and was pleasantly surprised by the number of meaningful changes in this release. From LAPS to the mention of Jamf Remote Assist to a bunch of deprecations.

  There’s some awesome stuff in there and I really want to share it!

  Let’s talk about LAPS and the deprecation of the Management Account Password

  In previous versions of Jamf Pro, you could choose to set the management account password (Settings > Global > User-initiated Enrollment > macOS, if I remember correctly) instead of having it randomly generated. From here on out, you won’t have the option to set a static password on the Management Account and will instead need to leverage LAPS.  

  You’re able to implement LAPS using either, or both, of the following methods:

  MDM Command – Introduced with Jamf Pro 10.46.0, this method leverages Apple’s SetAutoAdminPassword command, which allows management of the managed administrator account created during the PreStage enrollment process using MDM. This method rotates the managed administrator account password using the MDM command. LAPS is disabled by default using this method. The managed administrator account is created via a PreStage enrollment (Automated Device Enrollment) during the macOS Setup Assistant.

  Jamf Management Framework – Starting with Jamf Pro 10.49.0, this method automatically rotates management account passwords using instructions from the Jamf management framework. LAPS is always enabled using this method. You can create the management account on all enrolled computers using either Automated Device Enrollment or user-initiated enrollment. Some advantages of this method include the following:

  • Automatic password rotation is always enabled.
  • You can enable LAPS even though the management account was not originally created via PreStage during the macOS Setup Assistant.
  • If the management account had cryptographic privileges with a secure token, those privileges are maintained during password rotation.

  One thing to note here is that an account that has become encrypted with a secure token will result in the login password being changed. However, the new password will not work for user authentication purposes. Bottom line is that Jamf does not recommend using this account type for LAPS password rotation if the account needs to use FileVault or authorize software updates on computers with Apple silicon.

  Read more here: https://learn.jamf.com/bundle/technical-paper-laps-current/page/LAPS_Mechanisms.html

  Jamf Remote Assist Announcement

  Jamf Remote Assist, a new screen-sharing feature, will be coming in a future release of Jamf Pro for both on-premise and cloud-hosted environments. Remote Assist will allow you to securely initiate a session to remotely manage computers and help users troubleshoot issues. Using the Jamf Pro interface or the command line, Remote Assist sessions will allow you to connect to an end user computer even when the user is not on the internal network. Additional details will be included in the Jamf Pro release notes in the future.

  https://learn.jamf.com/bundle/jamf-pro-release-notes-current/page/Important_Notices.html

  This one is huge, in my opinion.

  In today’s world, remote capabilities should be built into the foundation of any MDM and for the longest time this was, arguably, Jamf’s weakest area.

  When I started my current career in 2019, Jamf Remote was still being provided in the DMG of tools in your product dashboard but during jump start my Jamf engineer cautioned that there was a plan to retire it, so I shouldn’t rely on it too heavily. As a result, I only used Jamf Remote a handful of times during my first year of managing macOS devices and primarily leveraged Microsoft Teams for screensharing (definitely not ideal).

  Then, in 2021, Jamf announced TeamViewer integration! At the surface level, this was awesome but it also meant that additional licensing would come into play. Since my organization didn’t already use TeamViewer, the thought of purchasing licensing for just our Mac fleet didn’t fly.

  Fortunately, I run a well-oiled and reasonably sized machine, so the need for screen-to-screen troubleshooting is almost nonexistent. Still, any improvement in this area would be a welcome one. I’ve talked to other admins who work in education, and I KNOW they’re dying for something like this.

  READ MORE
  14 August 2023

  Blog

  jamf, jamf pro, macos, mdm, release notes

• Jamf 300 Certified! 🥳
  

  My two-cents: The 300, like the 200, contains a lot of surface level content. There is certainly more “meat” to this course/exam and the little bit of API content that is covered is great! I thought they could have spent more time on plists, as I’ve found them to be immensely useful for things like deferrals.

  JamfHelper gets a fair chunk of time (I get it, it’s a built-in tool – let it shine), but I’m not sure who is still leveraging it in a world where things like swiftDialog exist.

  (Don’t worry, I hear all of the people still on Catalina screaming in the back of the room. My response: Update already! 😂)

  Anyway, my favorite part of these courses has been listening to other students talk about their environments, the issues they run up against, and how they go about solving those issues.

  I love getting a different perspective on problems and their solutions!

  

  19 May 2023

  Blog

  jamf, jamf pro

• A Simple Method for Keeping Gatekeeper enabled with Jamf Pro
  Gatekeeper is a security feature on macOS that is designed to protect your system from malicious software by limiting the apps that can be installed and run on your system. Only allowing apps that are downloaded from either the Mac App Store or from those who have signed their apps with a certificate issued by Apple.

  While it’s extremely useful for keeping your macOS environment secure, there are times when a user may need to disable Gatekeeper temporarily.

  My organization’s use-case for this is that we have a team of developers who are often running test builds of applications that are unsigned because they’re in development. So we have a process for user’s to go through to disable Gatekeeper temporarily.

  However, we want to ensure that there are no gaps and that Gatekeeper will always be re-enabled across the environment.

  To accomplish this, we leverage Jamf Pro’s Smart Groups to detect if Gatekeeper is disabled (the status of machines in this group will update after an inventory scan on each device) and a script deployed via a Jamf policy to re-enable it on the machines that show up in our smart group.

  READ MORE
  24 April 2023

  Tutorial

  apple, gatekeeper, jamf, jamf pro, macos