Jamf 300 Certification – Complete Reference Guide

1. Go to Settings → System → LDAP Servers and click New.
2. Enter the classroom LDAP server information provided by the instructor.
3. Important: Do not select “Use SSL” when entering the classroom LDAP Server Information.
4. Map the following attributes exactly as listed:
   • Email attribute → LDAP mapping mail
   • Building attribute → LDAP mapping division
5. Save the LDAP server connection.

1. Edit the LDAP server you just created.
2. Change the Display Name to Faculty.
3. Under User Mappings, change the LDAP search base so that it queries only the Faculty organizational unit (OU).
4. Save.

1. Go to Devices → Configuration Profiles → New.
2. General tab:
   • Distribution Method: Install Automatically
3. Payloads → Web Clip:
   • Label / Name: anything descriptive
   • URL: https://community.jamf.com/
4. Scope:
   • Targets: All Mobile Devices
   • Limitations: Support LDAP group
5. Save the profile.

1. Go to Settings → Computer Management → Inventory Collection.
2. Enable the checkbox Collect user and location information from Directory Service.
3. Go to Settings → Device Management → Inventory Collection.
4. Enable the same option for mobile devices.
5. Save both pages.

1. Create a Computer Extension Attribute that pulls the LDAP attribute carLicense (used for the tech agreement).
2. Create the same Extension Attribute for Mobile Devices.
3. Both should be configured to collect the value from the directory service.

1. Navigate to Settings → Server → Cloud distribution point.
2. Verify that it is configured to use Jamf Cloud.

1. Go to Settings → Network → Sites.
2. Create three new sites with these exact names:
   • AMER
   • APAC
   • EMEIA

1. Create a standard Jamf Pro user group.
2. Give the group site access to the AMER site.
3. Assign the group administrator privileges.

1. Create a standard Jamf Pro user account.
2. Assign the account to the group you created in Task 3.
3. Choose any fictional username and configure a password.

1. Locate the built-in smart computer group named All Managed Clients.
2. Duplicate it three times – once for each site (AMER, APAC, EMEIA).
3. Locate the built-in smart mobile device group named All Managed iPads.
4. Duplicate it three times as well (one copy per site).

1. Run the provided script printNetworkSegment.zsh to obtain the correct IP range / values.
2. Go to Settings → Network → Network segments.
3. Create a new network segment named Class and fill in the values from the script output.

1. Go to Settings → Jamf Apps.
2. Select Use Self Service+ as the default end-user application.

1. Go to Settings → Self Service → iOS (or the equivalent Self Service settings page).
2. Confirm that the distribution method for the Self Service app for iOS is set to Automatically install Self Service app.

1. Download the file referenced in the lesson Files section (usually named something like zshShellScript.crLanguage.zip).
2. Import that language definition into the CodeRunner application so you can write and run zsh scripts for the rest of the course.

1. Go to Settings → System → API Roles and Clients.
2. Create six separate API roles. Each role must contain exactly one of the following privileges:
   • Read Activation Code
   • Read Computers
   • Read Sites
   • Read Smart Computer Groups
   • Read Static Computer Groups
   • Read Mobile Devices

1. Create a new API Client and name it Lesson 3 Tasks Client.
2. Assign it the following five roles that you created in Task 2:
   • Read Activation Code
   • Read Computers
   • Read Sites
   • Read Smart Computer Groups
   • Read Mobile Devices
3. Save the client and keep the Client ID / Secret if you need them later.

1. Create another new API Client.
2. Assign it privileges required for package and cloud-distribution operations:
   • Create Packages
   • Read Packages
   • Update Packages
   • Delete Packages
   • Jamf Packages Action
   • Read Distribution Points
   • Read Cloud Distribution Point
   • Update Cloud Distribution Point
   • Read Cloud Services Settings
   • Create Jamf Cloud Distribution Service Files
   • Read Jamf Cloud Distribution Service Files
   • Delete Jamf Cloud Distribution Service Files
3. Use this client to establish the integration between Jamf Sync and Jamf Pro.

1. Locate the LAPS (Local Administrator Password Solution) settings.
2. Enable LAPS for PreStage accounts.
3. Set the Rotation Interval to 7 days.
4. Note the available options for “Rotation After Viewing Interval”.

1. Go to Settings → Global → User-initiated enrollment.
2. Enable user-initiated enrollment for computers.
3. Enable the option to create a managed local administrator account.
4. Set the username of that account to jamfManage.

1. In the enrollment access settings find the group All Directory Service Users.
2. Deselect the checkbox Allow group to enroll institutionally owned devices.

1. Add Enrollment Access for the Support LDAP group.
2. Select Allow group to enroll institutionally owned devices and set the destination to Any site.

1. Add Enrollment Access for the Information Technology LDAP group.
2. Allow the group to enroll institutionally owned devices, but restrict them to the EMEIA site only.

1. Enroll both your test computer and your test mobile device using the LDAP user kcox.
2. During the enrollment process assign:
   • Computer → AMER site
   • Mobile device → APAC site

1. Open the Jamf Pro API documentation (usually at https://your-jamf-pro-url/api/doc).
2. Locate the endpoint PUT /v2/local-admin-password/settings.
3. Set the value of passwordRotationTime to 300 (seconds = 5 minutes).

1. Open the inventory record for your computer.
2. Go to General → Managed Local Administrator Accounts.
3. Click View accounts and passwords, then click the View button.
4. You should receive a notification that the password will be rotated in 5 minutes. Copy the current password and note the time.
5. Wait at least 5 minutes, view the password again, and confirm that it has changed.

Create an agent whose label is com.Lesson5Task1.agent and that opens https://learn.jamf.com when it loads.

#!/bin/zsh --no-rcs

label="com.Lesson5Task1.agent"
plistPath="$HOME/Library/LaunchAgents/$label.plist"

# Clean up any previous version
launchctl bootout gui/$(id -u)/$label 2>/dev/null || true
rm -f "$plistPath"

# Build the plist
defaults write "$plistPath" Label -string "$label"
defaults write "$plistPath" ProgramArguments -array \
    -string "/usr/bin/open" \
    -string "https://learn.jamf.com"
defaults write "$plistPath" RunAtLoad -boolean TRUE

chmod 644 "$plistPath"

# Load it into the current user's GUI session
launchctl bootstrap gui/$(id -u) "$plistPath"

The script must run jamf manage and append the current UTC date/time to /Users/Shared/managementTime.txt.

#!/bin/zsh --no-rcs

/usr/local/jamf/bin/jamf manage
date -u +%F\ %T >> /Users/Shared/managementTime.txt

Recommended way to place it on disk (adjust the path if your instructor prefers the Desktop):

sudo tee /usr/local/bin/managementUpdate.sh << 'EOF'
#!/bin/zsh --no-rcs

/usr/local/jamf/bin/jamf manage
date -u +%F\ %T >> /Users/Shared/managementTime.txt
EOF

sudo chmod +x /usr/local/bin/managementUpdate.sh

Create a daemon with label com.Lesson5Task3.daemon that executes the script from Task 2 every 1200 seconds.

#!/bin/zsh --no-rcs

label="com.Lesson5Task3.daemon"
plistPath="/Library/LaunchDaemons/$label.plist"
scriptPath="/usr/local/bin/managementUpdate.sh"

sudo rm -f "$plistPath"
sudo launchctl bootout system/$label 2>/dev/null || true

sudo defaults write "$plistPath" Label -string "$label"
sudo defaults write "$plistPath" ProgramArguments -array \
    -string "/bin/zsh" \
    -string "$scriptPath"
sudo defaults write "$plistPath" RunAtLoad -boolean TRUE
sudo defaults write "$plistPath" StartInterval -integer 1200

sudo chown root:wheel "$plistPath"
sudo chmod 644 "$plistPath"

sudo launchctl bootstrap system "$plistPath"

1. Make sure both the agent and the daemon have been bootstrapped (commands are in the scripts above).
2. Restart the computer.
3. After login the Jamf Learning Hub should open automatically.
4. Confirm that timestamps are being written to /Users/Shared/managementTime.txt.

# Useful verification commands
launchctl list | grep Lesson5Task1
sudo launchctl list | grep Lesson5Task3
cat /Users/Shared/managementTime.txt

1. Go to Devices → Configuration Profiles → New.
2. General:
   • Give the profile a clear name (e.g. “Self Service Notifications – APAC”).
   • Site: APAC
   • Distribution Method: Install Automatically
3. Select the Notifications payload and click Configure.
4. Fill in the settings exactly as required:
   • Bundle ID: com.jamfsoftware.selfservice
   • Notifications: Enabled
   • Banner alert type: Persistent
   • Notifications on Lock Screen: Hidden
   • Notifications in Notification Center: Displayed
   • Badge app icon: Displayed
   • Play sound for notifications: Enabled
5. Scope: Supervised mobile devices that have the Self Service app installed.
6. Save the profile.

Step A – Create the property list on your Mac:

defaults write ~/Desktop/com.apple.Safari ShowFullURLInSmartSearchField -boolean true

This creates a file named com.apple.Safari.plist on your Desktop.

Step B – Build the configuration profile:

1. Go to Computers → Configuration Profiles → New.
2. General:
   • Site: AMER
   • Distribution Method: Install Automatically
   • Level: Computer Level
3. Select the Application & Custom Settings payload.
4. Choose the Upload method.
5. Preference Domain: com.apple.Safari
6. Upload the com.apple.Safari.plist file that is sitting on your Desktop.
7. Scope: computers running macOS 15.3.1 or later.
8. Save.

1. Open the Managed App Schema Builder application (or use the provided com.apple.dock.json.zip if the instructor supplies it).
2. At the top of the window set:
   • App Title / Preference Domain → com.apple.dock
   • Domain Description → Dock Orientation
3. Click the + button to add a new key and fill in the fields:

   Field	Value
   Key Name	orientation
   Key Friendly Name	Dock orientation
   Select Key Type	string (from list)
   List of options (human-readable)	Screen Left, Screen Bottom, Screen Right
   Associated list of values	left, bottom, right

4. Save / export the resulting JSON schema file.
5. In Jamf Pro create a new Computer Configuration Profile:
   • Site: AMER
   • Distribution Method: Install Automatically
   • Level: Computer Level
   • Payload: Application & Custom Settings → External Applications
   • Preference Domain: com.apple.dock
   • Upload the JSON schema you just created
   • Use the Orientation pop-up menu that appears to choose your preferred dock location
   • Scope: All Computers in AMER
6. Save the profile.

First discover the Team ID on a Mac that has Chrome installed:

codesign --display --verbose /Applications/Google\ Chrome.app 2>&1 | grep TeamIdentifier
# You should see: TeamIdentifier=EQHXZ8M8AV

1. Create a new Computer Configuration Profile.
2. Distribution Method: Install Automatically.
3. Add the Managed Login Items payload.
4. Rule type: Team identifier.
5. Rule value: EQHXZ8M8AV.
6. Scope: All Managed Clients.
7. Save.

1. New Computer Configuration Profile → Managed Login Items.
2. Rule type: Bundle identifier.
3. Rule value: com.obsproject.obs-studio.mac-camera-extension.systemextension.
4. Scope: All Managed Clients | Install Automatically.
5. Save.

1. Rule type: Label.
2. Rule value: com.Lesson5Task1.agent.
3. Scope: All Managed Clients.

1. Rule type: Label.
2. Rule value: com.Lesson5Task3.daemon.
3. Scope: All Managed Clients.

1. Install and launch the OBS application.
2. On the “Review App Permission” screen click Continue (do not grant any access yet).
3. Note the macOS alert that a system extension tried to load and requires user consent.
4. Open System Settings → General → Login Items & Extensions and confirm that OBS has installed an extension.

# Information about the main OBS application
codesign -dv /Applications/OBS.app

# Information about the camera system extension (this is the one you need)
codesign -dv /Applications/OBS.app/Contents/Library/SystemExtensions/com.obsproject.obs-studio.mac-camera-extension.systemextension

Typical values seen in class:

• Team Identifier → 2MMRE5MTB8
• Bundle Identifier → com.obsproject.obs-studio.mac-camera-extension

1. Go to Computers → Configuration Profiles → New.
2. General: Site = AMER, Distribution Method = Install Automatically.
3. Select the System Extension Types payload.
4. From the pop-up choose Non-removable system extensions.
5. Enter the Team Identifier: 2MMRE5MTB8.
6. Critical UI step: Click the small + (Add) button that appears next to the Team Identifier field. A new text field for the Bundle Identifier will appear.
7. Type the Bundle Identifier: com.obsproject.obs-studio.mac-camera-extension.
8. Click the small Save button that sits next to that field (do not rely only on the big Save button at the bottom of the page).
9. Scope:
   • Targets: Supervised computers in the Minneapolis building
   • Exclusions: Less than macOS 26
10. Save the whole profile.

defaults read /Library/SystemExtensions/db.plist

# Alternative readable form
plutil -p /Library/SystemExtensions/db.plist

# Also useful
systemextensionsctl list

# Create a new folder on the Desktop via AppleScript
osascript -e 'tell application "Finder" to make new folder at desktop'

# After the dialog appears, open System Settings → Privacy & Security → Automation
# and confirm that Terminal has permission for Finder.

# Reset all privacy decisions for the Terminal app
tccutil reset All com.apple.Terminal

1. Create a new Computer Configuration Profile.
2. Distribution Method: Install Automatically | Level: Computer Level.
3. Add the Privacy Preferences Policy Control payload.
4. Identifier: com.obsproject.obs-studio
5. Identifier Type: Bundle ID
6. Code Requirement (copy exactly):

identifier "com.obsproject.obs-studio" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2MMRE5MTB8"

7. Under the Services list set:
   • Accessibility → Deny
   • Screen Capture → Allow Standard User to Set System Service (wording may be “Allow Standard Users to Allow Access”)
8. Scope: All Managed Clients
   Exclusions: macOS 15.6 or earlier that belong to the Information Technology department.
9. Save.

1. Download the file JamfAppleEvents.mobileconfig from the lesson Files section.
2. In Jamf Pro go to Computers → Configuration Profiles and choose Upload.
3. Upload the mobileconfig file.
4. Set Distribution Method to Install Automatically and Level to Computer Level.
5. Scope the profile to All Managed Clients.
6. Save.

1. New Computer Configuration Profile → Privacy Preferences Policy Control.
2. Identifier: com.google.Chrome
3. Identifier Type: Bundle ID
4. Code Requirement:

(identifier "com.google.Chrome" or identifier "com.google.Chrome.beta" or identifier "com.google.Chrome.dev" or identifier "com.google.Chrome.canary") and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV

5. Services:
   • Camera → Deny
   • Microphone → Deny
6. Scope: All Managed Clients | Exclusions: New York building.
7. Save.

1. Devices → Configuration Profiles → New.
2. Site: APAC | Distribution Method: Install Automatically.
3. Payload: Restrictions
   • Under Apps → App usage choose Some apps not allowed.
   • Add these three bundle IDs:
     • com.apple.mobileslideshow (Photos)
     • com.apple.MobileSMS (Messages)
     • com.apple.facetime (FaceTime)
   • Under Functionality restrict:
     • Modifying Personal Hotspot settings
     • Network drive access in Files app
4. Scope: All Managed iPads.
5. Save.

1. Create another Mobile Device Configuration Profile (Site APAC, Install Automatically).
2. Payload: Restrictions → Functionality.
3. Enable the restrictions that control:
   • Managed apps using iCloud sync
   • Documents from managed sources opening in unmanaged destinations
   • Pasteboard respecting managed/unmanaged boundaries
   • Managed apps writing contacts to unmanaged accounts
   • Unmanaged apps reading contacts from managed accounts
   • AirDrop treated as an unmanaged destination
4. Scope: All Managed iPads.
5. Save.

1. Go to Computers → Restricted Software → New.
2. Give the record a clear name (e.g. “Block FaceTime”).
3. Site: AMER.
4. Process Name: FaceTime.
5. Check the box Kill process.
6. Check the box Display a notification / message to the user.
7. In the message field type exactly:
   Please use approved conferencing software.
8. Scope: All Computers in AMER | Exclusions: Development department.
9. Save.

1. Settings → Computer Management → Extension Attributes → New.
2. Display Name: e.g. “Apple Beta Software Program Status”.
3. Data Type: String | Input Type: Script.
4. Paste the following script:

#!/bin/zsh --no-rcs
if [ -f "/Users/Shared/.BetaEnrollmentData.plist" ]; then
    echo "<result>Enrolled</result>"
else
    echo "<result>Not Enrolled</result>"
fi

5. Save the extension attribute.

1. Computers → Configuration Profiles → New.
2. Site: AMER | Level: Computer Level | Install Automatically.
3. Add the Software Update payload and deselect “Allow installation of macOS beta releases”.
4. Add the Restrictions payload and under Functionality set “Defer software updates” to 90 days.
5. Scope: All Managed Clients
   Exclusions: Computers that are enrolled in the Apple Beta Software Program.
6. Save.

1. Computers → Configuration Profiles → New.
2. General:
   • Site: AMER
   • Distribution Method: Self Service +
   • Level: Computer Level
3. Select the Security & Privacy payload and configure the FileVault options:
   • Enable FileVault: Include
   • Event to prompt FileVault enablement: At Login
   • Recovery keys: Personal Recovery Key
   • User adjustment of FileVault options: Include
   • Escrow Personal Recovery Key: Include
   • Escrow Location Description: Jamf Pro
   • “Record Number” Message: $SERIALNUMBER
4. Scope:
   • Targets: All Managed Clients
   • Exclusions: Computers that are not Supervised
5. Save.

1. On the test Mac open the Self Service+ application.
2. Locate and install the FileVault profile you created in Task 1.
3. Log out of the current user account.
4. Log back in.
5. macOS will prompt you to enable FileVault – complete the encryption process.

1. Force an inventory update with sudo jamf recon (or wait for the next check-in).
2. In Jamf Pro open the computer’s inventory record.
3. Look in the Security / FileVault section for the escrowed Personal Recovery Key and confirm it is present.

#!/bin/zsh --no-rcs

echo "Please enter a Policy ID: "
read policyid

sudo jamf policy -id "$policyid" > /Users/Shared/policy"$policyid".txt

#!/bin/zsh --no-rcs

sudo tee /Library/Scripts/Lesson12.zsh << "EOF"
#!/bin/zsh --no-rcs

echo "Please enter a Policy ID: "
read policyid

sudo jamf policy -id "$policyid" > /Users/Shared/policy"$policyid".txt
EOF

sudo chmod +x /Library/Scripts/Lesson12.zsh

#!/bin/zsh --no-rcs

echo "Google Chrome last used:"
mdls "/Applications/Google Chrome.app" -name kMDItemLastUsedDate

echo ""
echo "Firefox last used:"
mdls "/Applications/Firefox.app" -name kMDItemLastUsedDate

#!/bin/zsh --no-rcs

if [[ -f /Library/Scripts/Lesson12.zsh ]]; then
    echo "File exists"
else
    echo "File does not exist"
fi

#!/bin/zsh --no-rcs

sudo tee /Library/Scripts/Lesson12Task5.zsh << "EOF"
#!/bin/zsh --no-rcs

if [[ -f /Library/Scripts/Lesson12.zsh ]]; then
    echo "File exists"
else
    echo "File does not exist"
fi
EOF

sudo chmod +x /Library/Scripts/Lesson12Task5.zsh

/Library/Scripts/Lesson12Task5.zsh

#!/bin/zsh --no-rcs

jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"
"$jamfHelper" -windowType hud -description "Hello world"

#!/bin/zsh --no-rcs

jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"

returnCode=$("$jamfHelper" -windowType utility \
    -description "Would you like to perform an inventory update?" \
    -button1 "Yes" \
    -button2 "No")

if [[ $returnCode == 0 ]]; then
    # User clicked the Yes button
    sudo jamf recon
else
    # User clicked the No button
    "$jamfHelper" -windowType utility \
        -description "Inventory will not be updated." \
        -button1 "OK"
fi

#!/bin/zsh --no-rcs

osascript -e 'display dialog "Hello world" buttons {"OK"} default button 1'

If you encounter quoting problems, use a here-document instead:

#!/bin/zsh --no-rcs

osascript <