Disable

Disable

Switch things off on a Jamf Pro server without deleting them: disable policies, Jamf Pro accounts and App Installers, and remove the scope from profiles, restricted software and apps.

⚠️ Disable changes your server, and your devices, straight away. Nothing is deleted, but removing scope uninstalls the configuration profiles and managed apps from every device that has them, and disabled policies stop running. Before anything changes, Disable saves an encrypted undo backup of the original enabled state and scope, so you can put it all back with Undo from backup….

Use Disable when you want something to stop taking effect but may want it back later, for example before a clean-up, while you investigate a problem policy, or to lock out old admin accounts. If you want objects gone for good, use Wipe instead.

What can be disabled

Type	What Disable does
Policies	Turns the policy off (Enabled unticked)
Jamf Pro Accounts	Sets the admin login account to Disabled
macOS Config Profiles	Removes all scope
iOS Config Profiles	Removes all scope
Restricted Software	Removes all scope
Mac App Store Apps	Removes all scope
Mobile Device Apps	Removes all scope
App Installers	Turns the App Installer deployment off (Enabled set to off). Its scope and other settings are left as they are

Removes all scope clears everything under the object's scope: targets, exclusions and limitations. It also turns off All Computers, All Mobile Devices and All Users, so an object scoped to everyone is unscoped too. The object stays on the server but no longer applies to any device or user, so profiles and apps are removed from devices and restricted software stops being enforced.

How to use it

1. Connect

Enter the server details and click Connect & Check Permissions. Disable checks Read and Update for every type, then click Continue → (or Proceed Anyway → if some checks failed).

2. Select what to disable

Disable lists every object of each type. Nothing is selected by default.

• Tick a type to include all of it, or click Choose… to pick individual items. In the item list, Use All selects every item of that type.
• Select All / Select None work across all types.
• Each type shows what will happen to it: disable or remove scope.
• Enabled full-access administrator accounts are marked Admin.
• The account this session is signed in with is marked Signed in and can't be disabled.
• An account whose details couldn't be read is marked Unknown and can't be disabled. Untick it to continue.
• A type that couldn't be loaded shows Couldn't load.

Click Continue → when you're ready.

3. Confirm

The confirmation screen shows the server, the total number of objects affected and a list of everything selected, grouped by type. If you're removing scope, it warns that this uninstalls those profiles and apps from devices.

Enter an Undo backup passphrase (at least 12 characters) and confirm it. Tick "I understand this will immediately disable the selected policies/accounts/App Installer deployments and remove scope … which removes them from devices.", then click DISABLE SELECTED. Cancel — Go Back returns to the selection.

Disable then asks where to save the undo backup (Disable_Undo_<timestamp>.json). Nothing is changed until it's chosen. Disable reads each item's current enabled state and scope, writes the backup, and reads it back to check it. If an item's current state can't be read, that item isn't changed.

4. Disabling

Objects are changed one at a time, and each change is written to a journal file. Abort asks for confirmation. The current item finishes, then the run stops and shows what was done so far. Items that weren't reached are shown as Skipped – Not attempted.

5. Results

Counts for Disabled / Unscoped and Failed, and a list you can filter by All, Disabled/Unscoped or Failed/Skipped. Failed rows show the error from Jamf Pro. The undo backup and journal locations are shown, with Show in Finder.

Export HTML saves DisableResults_<server>.html, with the totals and a section per type. Done returns to the start.

Undoing a Disable run

1. Connect to the same server the Disable run was made on.
2. On the Connect screen, click Undo from backup… and choose the Disable_Undo_*.json file.
3. Enter the passphrase and click Decrypt & Undo.

Every item in the backup gets its original enabled state or scope back, and the results show each one as Restored. Export HTML saves DisableUndoResults_<server>.html.

An undo backup made on a different server is refused. If you open an undo backup in Restore by mistake, Restore tells you to use Disable instead.

Administrator lockout protection

Disable won't let you disable every enabled full-access administrator account. If your selection would do that, or if every Jamf Pro account is selected, a red warning appears and Continue → and DISABLE SELECTED stay disabled until you untick at least one enabled administrator.

An account counts as an enabled administrator when it has Full Access, the Administrator privilege set and is Enabled.

Tips

• Disabling the account behind the API client you're using can stop the run partway through. (Your own username and password account can't be selected.)
• Keep the undo backup and its passphrase until you're sure you won't need to reverse the run.
• To find candidates, run Unused or Account Audit first.

Permissions: Read and Update for each type you disable: Policies, Accounts, macOS Configuration Profiles, iOS Configuration Profiles, Restricted Software, Mac Applications, Mobile Device Applications. For App Installers, any one of Read Mac Apps, Read Mac Applications or Read App Installers counts, and the same for Update.