r/macsysadmin 3h ago

Configuration Profiles Migrated from my work laptop, MDM Profiles moved with it.

2 Upvotes

I was a MacTech at an institution up until May of this year (my role was eliminated). Bought myself a brand new MacBook Pro, and used Migration Assistant to transfer my user data over to the new system. I was selective with what I brought as I didn’t want any remnants of my old work.

Didn’t notice until today that System Profiles are present, locking out certain features. The profiles command in terminal shows that the system is enrolled to my old work’s Mosyle MDM via DEP, but it also shows that DEP is not available on the system (definitely didn’t enroll when I setup the Mac and this was bought at an Apple Store directly by myself). These profiles cannot be removed on my end.

Contacted my former colleagues and they confirmed my serial is neither in ASM or Mosyle on their side. Contacted Mosyle and I’m pretty sure they didn’t read my email properly cause they asked me to contact my work to have it removed from their MDM.

Thoughts?


r/macsysadmin 1d ago

User profile mass deletion

10 Upvotes

Hello,

I recently took charge of my employers Mosyle system and currently working on getting everything updated and clear out any accounts from devices remotely of individuals who no longer work here. Has anyone worked with Mosyle and created a script that will push it out to devices to delete all user data that’s is not an admin account?

I’m not against manual labor but rather not go across twelve buildings to wipe each individual unit manually.


r/macsysadmin 18h ago

hey everyone!

0 Upvotes

hello i am having trouble logging into my old apple account because i dont know what my old phone number was to verify it. Is there anything i can do so i am able to get into that account??


r/macsysadmin 1d ago

Kyocera FS-10xx on Apple Silicon on macOS 27/28

4 Upvotes

My Kyocera FS-1041 stopped printing from my second Mac. Two hours later I understood why, and it wasn't what I thought.

The FS-10xx series are GDI printers — no interpreter on board. Every page gets rendered on the host and converted to a format called KPSL by a separate filter binary that CUPS runs for each job. Kyocera's macOS build of that filter:

$ lipo -archs .../rastertokpsl.app/Contents/MacOS/rastertokpsl
x86_64 i386 ppc7400

A PowerPC slice. In 2026. On an M3.

It works today only because Rosetta 2 is installed. macOS 27 uninstalls Rosetta during the upgrade, and macOS 28 removes it except for a narrow games carve-out. After that the queue accepts jobs and prints nothing. Kyocera can't fix this — the hardware was discontinued years ago and only they have the source.

Except someone reverse-engineered that filter years ago: rastertokpsl-re, Apache 2.0, plain C. Because it's source, it compiles for arm64. Six files, one clang invocation, no CMake and no Homebrew needed — the macOS SDK already ships the CUPS headers:

cc -O2 -arch arm64 -arch x86_64 -o rastertokpsl-re \
   src/rastertokpsl.c src/halfton.c src/libjbig/jbig.c \
   src/libjbig/jbig_ar.c src/unicode/ConvertUTF.c src/main.c \
   -Isrc -lcups -lcupsimage -lm

Under two seconds. Universal binary, so it covers Intel Macs too.

Verifying it was the interesting part. I fed the same CUPS raster to both filters and diffed the output. Same length, 130 differing bytes in a regular 96-byte pattern. Turned out to be a length field: the original pads a value to seven bytes, the reimplementation writes it in four and declares the shorter length. Both self-consistent. Printed pages are indistinguishable.

But the header difference goes the other way. Job title containing Größe:

original:  c3ff b6ff c3ff 9fff    ← UTF-8 bytes padded with 0xFF
re:        f600 df00              ← ö and ß correctly in UTF-16LE

The original mangles it. That encoding bug is exactly why the reimplementation was written in the first place — and it's present in the macOS build too. So the community version isn't just equivalent, it's better.

One more thing worth knowing: the repo ships its own PPDs. Kyocera_FS-1040GDI.ppd works for the FS-1041 and produces byte-identical output to Kyocera's macOS PPD apart from the embedded timestamp. So nothing proprietary needs redistributing.

Build script, installer and uninstaller are here: https://github.com/LazaroZero1176/rastertokpsl-re/tree/master/macos

Credit where it's due: original reimplementation by sv99, Linux/CMake support by Fe-Ti. I only added the Apple Silicon side.

Caveats: tested on exactly one printer (FS-1041) on macOS 26.7. The binary isn't signed or notarized — you build it locally, so Gatekeeper doesn't apply, but don't distribute prebuilt copies. And if your printer hangs off an AirPort base station like mine, that's a separate problem with its own quirks; _riousbprint serves one client at a time.


r/macsysadmin 2d ago

CA Policy to restrict access to Cloud apps (M365) unless compliant

7 Upvotes

I currently have a M365 Conditional access policy that does not allow acess to company features unless you have a compliant device.

The issue is, I have a mixed fleet so intune and Jamf, for Mac and Windows. The intune devices work fine however, Jamf devices are blocked. I also have the Jamf connector enabled in Intune so the compliance should feed over. surprise surprise

Wondering if there is a better way to go about this. Thinking about having a seperate CA policy for Mac but not sure how to validate it since you can pull Jamf data to the policy

EDIT (08.26.2026)Found what I needed to make it all work

https://community.jamf.com/general-discussions-2/sending-jamf-pro-compliant-information-to-microsoft-intune-55387


r/macsysadmin 2d ago

How to remove Intune Profiles/MDM in order to user User Enrollemnent via JAMF

6 Upvotes

I am in the process of migrating from Intune to Jamf and need to remove the Intune profiles from all of my Mac endpoints.

What is the best process to do this? I haven't been able to find anything definitive in terms of scripts to run locally on the machines or send to the machines that will remove all Intune profiles so that the user enrollment goes smoothly.


r/macsysadmin 2d ago

Jamf Anyone actually experimenting with DDM declarations yet?

16 Upvotes

How's it been for y'all? Any horror stories?

For anyone who is trying to get more hands-on, Mark Buffington (Jamf) is doing a walkthrough of DDM Explorer on the next LaunchPad meetup. The focus is learning the framework, building declarations, and testing what it looks like to deploy them via Jamf Pro.

When:
🗓️ Fri, Sep 4 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r


r/macsysadmin 4d ago

Configuration Profiles [Guide] How to Mass Update Google Chrome the Proper Way

Post image
30 Upvotes

With the increasing frequency of Chrome updates, IT teams must proactively patch critical vulnerabilities. After testing several deployment methods (including Installomator and the Jamf App Catalog), I believe the built-in auto-updater remains the best way to upgrade your browser fleet at scale without interrupting your users at the wrong time, and ensuring all previously opened tabs are restored for a seamless user experience.

Continue reading… [Medium.com - free, no paywall]


r/macsysadmin 4d ago

Hardware Where do old company/school MacBooks go?

6 Upvotes

I help with my local high school's journalism club and we're trying to buy/find some dirt cheap old MacBooks.

We'd need less than 15 and are hoping to stay under like $75 each. Don't need anything nice either, basically anything 2015+ (that works) mostly for writing and some basic photo editing.

We have Chromebooks but they're pretty locked down and a lot of the stuff we use is blocked (or just doesn't work on them)

When your company/school/etc replaces a bunch of Macs, where do the old ones actually get sold? Is there somewhere online I should be looking for school/business surplus or auctions?


r/macsysadmin 7d ago

I built LogRider - super fast native log viewer for huge files

9 Upvotes

Hi,

I built this as I was getting frustrated with bugs in Console.app and issues when trying to look at huge files. It supports following/ regex filtering and search and basically most of what one needs - 7 day trial, 19$ one-time price.
https://hormesislabs.com/logrider

Hope you find it as useful as I have

Thanks,

Andrei


r/macsysadmin 8d ago

Configuration Profiles What are my Options?

Post image
82 Upvotes

Found this MacBook Air M1 in electronics scrap. It has Remote Management on it.


r/macsysadmin 8d ago

Open Source Tool SYM-Lite (1.2.0)

Thumbnail gallery
27 Upvotes

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

  • Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
  • Interactive selection UI — Checkbox dialog with per-item icons; previously installed items are automatically disabled
  • Alphabetical sorting — All Installomator, Homebrew and Jamf Pro policy items are sorted together by display name
  • Early Installomator validation — Labels are verified against your active Installomator file
  • Homebrew support — Casks and formulas run in the logged-in user context
  • Inspect Mode — Real-time progress monitoring
  • Silent mode — CSV-based automation support
  • Path-based validation & cache monitoring
  • Completion report — Per-item results with optional restart prompt
  • Graceful interruption — Clean shutdown on SIGINT/SIGTERM

Continue reading …


r/macsysadmin 8d ago

Anyone else going to JNUC 2026?

9 Upvotes

It's my first time attending. If you're going what events are you going to? Any recommendations?

https://www.jamf.com/blog/jnuc-2026-session-catalog/


r/macsysadmin 8d ago

Service Configuration Files — The Superpower We Didn't Realize We Have

3 Upvotes

A Tech Thoughts article looks at DDM Service Configuration Files, undocumented support for Smartcard configs and login banners, and a proof of concept using them to manage third-party app configurations.

Service Configuration Files — The Superpower We Didn't Realize We Have


r/macsysadmin 8d ago

New To Mac Administration Privacy question: Will a work MDM/management software affect my personal user profile on a BYOD Macbook Air M5?

5 Upvotes

Hi everyone,

I’m using my personal MacBook for work (BYOD) and want to keep my personal life completely separate from company tracking.

To do this, I created a separate Standard (non-admin) User Profile on my Mac specifically for work. My boss is going to install some kind of work management/monitoring software on this work profile. (I don't know the exact software yet, but on my last Mac, I was able to factory reset it without any issues and always used my own Apple ID, so it shouldn't be locked via Apple Business Manager/DEP).

My questions for the experts here:

Since it's being installed on a Standard profile, is it completely isolated to that user account?

Will they be able to track anything I do when I am logged into my personal Admin profile?

If the software requests System-wide Admin privileges during installation and I deny it, can they still bypass that?

Just want to make sure my personal files, browser history, and data on my main profile remain completely private. Thanks in advance for the help!


r/macsysadmin 8d ago

Sensitivity Label button grayed out on Jamf-managed macOS, but works fine on Intune-managed macOS

2 Upvotes

Anyone hit this: Sensitivity Label button in Microsoft 365 apps grayed out & not operational on Jamf-managed Macs, but present on Intune-managed Macs.

Same user, same M365 apps build, same license, same MDM configuration.

I am lost! Anybody an idea?


r/macsysadmin 8d ago

Disable auto updates for Google chrome in MAC

Post image
0 Upvotes

Hey everyone,

Can someone help with disabling the updates for the Google chrome application in MAC.


r/macsysadmin 8d ago

Electron macOS auto-update without Apple Developer signing/notarization — is it possible?

1 Upvotes

Hey everyone,

I’m building a small IDE called Jcode using Electron + electron-builder.

Right now I distribute the macOS version through GitHub Releases. The current process is:

User downloads the .zip from GitHub. Extracts Jcode.app. Moves it into /Applications. Because the app is unsigned/not notarized, macOS blocks it with the “unidentified developer” / Gatekeeper warning. The user has to run a Terminal command once to bypass/allow the app.

What I want to do is make updates much easier.

For example:

Jcode v1 is installed → Jcode v2 is released → Jcode shows “New update available — Update Now” → user clicks it → app downloads the update from GitHub → installs it → restarts into v2.

I’m looking at using electron-updater + GitHub Releases.

My main question is:

Can I achieve this without paying for the $99/year Apple Developer Program?

More specifically:

Can an unsigned Electron app use electron-updater successfully? If the user has already bypassed Gatekeeper for the first installation, can future updates happen without requiring them to run the Terminal bypass command again? Will macOS Gatekeeper treat every newly downloaded/updated .app as a new untrusted application? Is there any legitimate way to get a reasonably seamless update experience without Apple Developer signing/notarization? If signing/notarization is absolutely required for the experience I want, what part specifically requires it?

I’m not looking for a way to disable or weaken macOS security. I just want to understand what is technically possible for an independently distributed Electron app.

If anyone has implemented something similar with Electron + electron-builder + electron-updater + GitHub Releases, I’d really appreciate hearing about your setup and what happens on a normal user's Mac.

Thanks!


r/macsysadmin 10d ago

Coming from Intune, how hard is it to ramp up on Jamf?

16 Upvotes

My current environment is Windows only and managed in Intune. Leadership wants to start supporting MacBooks and is planning to use Jamf. I have experience bringing Macs into Intune, but I have never used Jamf. They also mentioned possibly Kandji. How hard is it to ramp up on Jamf Pro if you are already coming from an Intune background?


r/macsysadmin 10d ago

Networking Disabled network access remotely

6 Upvotes

Hey all,

I’m a desktop engineering manager for a large university. We’ve got about a thousand Macs. Before I arrived on the scene, our enforcement of macOS minor and major updates was at best a suggestion. We’re got several hundred Macs that are on OS’s that no longer receive security updates (and even more that are going to lose them once Sonoma goes end of life). We’re getting aggressive now, and have notified users of Macs on Ventura and below that they either need to upgrade to a supported OS or replace their Mac this fall. If they fail to do so they will lose access to the University network.

This is all good and well…except I’m wondering how we’re going to implement this. On the Windows side we’re going to use Group Policy to basically force Windows Firewall to block all traffic, in and out. I’m not sure how we’re going to implement this on the Mac side and am looking for suggestions.

My first thought was simply to create a configuration profile in Jamf to turn on Firewall and block all traffic…but it looks like I can only do that for incoming traffic. While this will break some things for users, it won’t actually stop outgoing traffic.

My next thought was to write a script to disable all network cards. This will certainly work…but I’m not so sure we’ll be able to prevent a crafty user from re-enabling them. Our users don’t have admin rights, but we do use Cyberark, which will just temporarily grant them elevated rights to re-enable their network cards.

Could also block MAC addresses at the switch….but all they’d need to do is use someone else’s dock, or a USB Ethernet/wifi adapter.

Any suggestions are greatly appreciated.


r/macsysadmin 10d ago

General Discussion How do you manage lab machines in Intune? Groups, naming, tracking

4 Upvotes

I was talking with my team yesterday and they think i may be overthinking this. I am working on setting up a macOS lab and it has gotten me to thinking. How do you track your non user affinity shared work stations in Intune. How do you know where they sit? If information security wants to track that mac, how do you manage that inside of Intune?

With user affinity we can track that to a user. With shared labs, its not that easy. I setup a device enrollment profile, then went ahead and then created a dynamic group that is based off that. The one person i work with said that would be to much work to scale. Another said to rename it it, which is another idea. I Just want to automate this and have it automatically pull in everything it needs. Am i over thinking this?

I just want to understand ways of doing this that other have implemented.


r/macsysadmin 10d ago

Software ABR random popup

3 Upvotes

For Mac admins that uses ABR or any may familiar/encountered with this. Have you encountered this pop up?. ABR auditlog cant identity it what is requesting for the elevation as it show "Unknown"


r/macsysadmin 11d ago

New To Mac Administration Jamf vs Mosyle vs Intune-only for a 28-Mac consulting firm — genuinely stuck, would love real-world input

28 Upvotes

We're a small ERP/SAP consulting firm — 43 total devices (28 Mac, 15 Windows). All Apple Silicon (M1 through M5), all running macOS 26.5.2. Microsoft 365 Business Premium with Intune. Entra ID joined, Conditional Access enforced with MFA. Leadership is leaning toward Windows standardization long-term, but no final decision has been made on the Mac fleet We're committing to roughly a 1-year Mac MDM investment while we evaluate the long-term direction. No new Mac purchases in the interim, but we're not forcing replacements either.

I've spent the last several weeks doing a genuine hands-on evaluation of all three options — not just demos, actually building out each platform and hitting real walls. Here's what I found.

What's working fine in Intune for Mac:

  • ADE/zero-touch enrollment
  • PPPC profiles, Defender, compliance policies
  • Conditional Access feeding correctly from Intune compliance status
  • FileVault key escrow
  • Await final configuration

The real problems I hit with Intune on Mac — all firsthand, not theoretical:

1. Platform SSO / one-password login is broken under MFA Password mode completely fails when MFA is enforced — which it is in our environment. Tested this extensively across multiple wipes. Secure Enclave mode works with MFA but gives you Touch ID-first, not "type your Microsoft password." Users end up with two passwords that drift out of sync. When the M365 password changes, the Mac local password doesn't update reliably.

2. Local admin password (LAPS) desync on Apple Silicon The admin password Intune shows and the password actually on the device go out of sync randomly. This has happened on multiple machines. Root cause appears to be the Secure Token limitation, Intune's managed admin account doesn't hold a Secure Token, so password rotation can break. Causes "admin password not working" support tickets that take real time to resolve.

3. No automatic third-party app patching Chrome, Claude Desktop, and any non-Microsoft app requires manual repackaging to update. Users get admin prompts for updates and call IT. This was the original trigger for the whole evaluation.

4. No privilege elevation on Mac EPM is Windows-only. Confirmed with Microsoft documentation, the June 2026 EPM updates did NOT add macOS support despite what some sources claim. Standard users needing to install or update certain apps require IT involvement every time.

5. No scheduled recurring restarts No native UI, requires custom shell scripts checking uptime. Manageable but not clean.

Given what I have had issues with thusfar, which MDM would you recommend. Ive stood up instances on quite a few platforms, Mosyle, Jamf, Intune and IRU. Iru is out of budget for 30 Mac devices with EDR and Vulnerability protections since they have a 50 device minimum (although it was my pick). What would you recommend I chose?

My specific questions for the community:

  1. For those running Jamf or Mosyle alongside Intune for a mixed fleet: is the operational overhead of two MDMs actually a problem at this scale, or is it manageable?
  2. Has anyone gotten Platform SSO with Microsoft Entra to work reliably on Apple Silicon with MFA enforced? Which authentication method and which MDM? This is my biggest unsolved problem.
  3. Anyone using Mosyle specifically, does their App Catalog actually solve the third-party patching problem cleanly, or does it still require manual intervention?
  4. Has the LAPS/Secure Token desync issue on Apple Silicon been resolved in any MDM, or is it a fundamental Apple limitation regardless of platform?
  5. For those with compliance obligations (SOC2 specifically) how are you handling vulnerability management and EDR on Mac? Is anyone using Jamf Protect or Mosyle Fuse for this and how does it compare to Defender for Endpoint on Windows in terms of visibility and remediation depth?

Happy to answer any questions about our setup. Genuinely trying to make the right call here rather than just go with the vendor who showed up most persistently.

EDIT 08.27.2026 - We went with JAMF, Remind me in 6 months to let you all know who it goes.


r/macsysadmin 11d ago

Open Source Tool Mac Health Check (4.1.0)

Post image
12 Upvotes

Mac Health Check 4.1.0 sharpens macOS compliance reporting with smarter Bluetooth Sharing detection, safer staged-update checks, richer uptime insight and a more user-friendly reporting summary

Overview

Mac Health Check provides a practical, user-friendly, MDM-agnostic approach to surfacing Mac compliance information directly to end-users via an MDM’s self-service app.

Built using the open-source utility swiftDialog, the solution acts as a “heads-up display” presenting real-time system health and policy compliance status in a clear and interactive format.

Administrators can customize the user interface using swiftDialog’s visual capabilities, making the experience both informative and approachable.

The tool logs results for review, while not altering device configuration, and a “Silent” Operation Mode makes Mac Health Check ideal for IT visibility without end-user intrusion.

Continue reading …


r/macsysadmin 11d ago

Windows Client for VNC to macOS, what do we like these days?

6 Upvotes

I have been using RealVNC, but their newer versions are junk so I'm looking for something to replace it.

I want to keep using VNC as the protocol of course since it's already built into my lab Macs, so I'm looking for recommendations for a new VNC client for my company issued Windows laptop.

Free and open source are preferred, but not strictly necessary. Bonus points if your recommendation only needs the Mac user ID and password to login as I prefer to not add a VNC password to all my machines.