if your intune ios compliance floor is worked out by arithmetic, the 18 to 26 jump probably broke it
ran into this a couple weeks back. we keep apple devices on n-1 for corporate and n-2 for personal, and the minimum version was getting worked out by subtracting from the current major. fine for years.
then apple moved to year based numbers and ios went 18 straight to 26. so "current minus 1" is now 25, which never shipped, and the floor ends up pointing at a version that doesn't exist. devices that should be non compliant just quietly are not.
there are already a few runbooks that auto-update the policy off the SOFA feed (rozemuller and skiptotheendpoint both have good ones). those are solid. i just didn't want mine writing to intune, so i went the other way: a power automate flow that reads the SOFA feed every morning and emails the service desk the day after a new major ships. a human makes the actual policy change. no graph scopes, no write access, it literally can't touch a compliance policy.
two things that got me if anyone builds the same:
read the version by position in the feed (OSVersions[0], [1], [2]), not by subtracting. after the jump, position is the only thing that stays right.
apple's own gdmf feed wouldn't work from power automate's http action, the cert chain isn't trusted and there is no skip-cert option. SOFA served over a normal cert so it just worked.
wrote it all up with the expressions, jcan drop the link if it's useful.

https://ketankamble.com/blog/apple-os-release-watch-for-intune-compliance/

Ay, as a part of admins that got hit by the Meraki MDM EoS, im currently trying out the new built-in MDM in Apple Business.

So far it works like a charm, deploying configs via mobileconfigs and apps, be it from app store or third party. The only issue i couldn’t get around so far, some enterprise applications from certain vendors require config files to be created under /opt/, which aren’t bundled with the provided pkg installer.

So far i tried:

- small package with payload containing the path and files, didn’t work
- patching the installer provided by the vendor, repack and sign, no luck either

In both cases a self-issued cert was used for signing, which was deployed on the test device via pem deployment directly from the MDM. Cert is trusted, manual install of .pkg via installer works flawless.

Does anyone else have experience in that area? Kinda out of ideas for now :(

Hi All,

Looking for some advice and similar experiences as googling has unfortunatley come up dry.

I'm seeing issues using migration assistant both as part of setup assistant and post setup. The error i'm seeing is the below
This Mac can't be used to migrate data: Due to an issue with unlocking this system, you can't migrate. Please update this Mac and retry.

Most troubleshooting steps recommend updating to same OS (have done 27.0.1) and same network (have tried both wi-fi and cable) but still seeing the same thing.

I am using Platform SSO with secure enclave activated during setup assistant. The user accounts are also not local admin and instead, migration assistant is opened using the local LAPS account. I'm starting to think its one of these configurations which is causing the issues but just wondering if anyone else has got this working in a similar scenario.

TIA

Transitioned my main work setup to my Macbook but i still have 2 or 3 Windows utilities i cant replace with Mac equivalents. Now im looking into Parallels vs Crossover to bridge the gap. Im not into gaming, this is strictly for documents, desktop specific extensions and legacy client software.

I like that Parallels desktop sets up an officially supported windows 11 instance where peripheral support, print drivers and shared folders work right out of the box without tweaking configs. But im wondering if spinning up a full VM is too much if i only open these tools a few times a day. How are you guys handling windows-only software on macOS? Is having the complete windows environment in Parallels worth the extra drive space for peace of mind?

What is everyone using to lock this down? (block lists, Security Cloud, config profiles, Jamf AI Governance... hoping nobody installs Claude Code, lol)

Have you seen anything still get through?

Claude Code, Copilot, ChatGPT, browser extensions, local models, something weird?

Eric Abel (Jamf) is covering Jamf's AI Governance on the next LaunchPad meetup if you want the walkthrough.

Would love to read your war stories here though.

When:
🗓️ Fri, Nov 6 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

Hi everyone,

I'm managing 100+ student MacBooks through Mosyle MDM and trying to force-update them to macOS Tahoe 26.7.1 (Build 25G241).

I've tried running the following command with sudo:

sudo softwareupdate -i "macOS Tahoe 26.7.1-25G241"

The update downloads successfully, but it doesn't proceed with the installation. The output is:

Downloading: macOS Tahoe 26.7.1
Downloaded: macOS Tahoe 26.7.1

After that, the update doesn't appear to install. I've also tried running the command through Mosyle, but I'm having trouble getting the installation to complete.

My questions are:

• Is there a Terminal command that can force the installation of a specific macOS version and build?
• Since these Macs are managed through Mosyle, is there a reliable way to trigger the installation remotely without requiring students to authenticate manually?

I'd appreciate any advice or recommendations from anyone who has dealt with this in a managed Mac environment.

Thanks!

i'm trying to figure out what makes sense for antivirus on a small fleet of macs.

we already have the usual stuff like keeping macos updated and using the built-in security features, but i'm wondering if there's still a good reason to run third party protection on managed machines.

mcafee is one of the options i've been looking at, mostly because it's easy to find, but i'm not sure if it's actually a good fit for macs in a work environment.

for anyone managing macs, what are you using for endpoint protection these days? also curious whether you think a dedicated antivirus is worth the performance and management overhead, or if the built-in macos protections are enough.

Hi all,

A restore at the service desk always seemed to start the same way for us: the device is in front of you, and Apple Configurator starts a 10–15 GB download first. So I built Amphora, a small menu bar app that keeps those restore files downloaded before you need them.

What it does

• Reads your models from Jamf Pro. It uses a read-only API client (only Read Mobile Devices), so it downloads only what your fleet actually needs. You can also pick models by hand, or grab one model on demand.
• Follows SOFA for new releases and ipsw.me for signing status, and checks every file against its SHA-256. Interrupted downloads resume.
• Drops the files into Apple Configurator's cache as an APFS clone, so they take no extra disk space and Configurator restores start right away. A PPPC profile for Full Disk Access comes with each release.
• Older models stay covered. If current iOS dropped a model, it keeps the last release Apple still signs.
• Cleans up carefully. Old files are deleted only after a fully successful sync. A model that leaves Jamf Pro keeps its file for 14 days, in case that device still needs a restore.
• Runs in the background. It syncs every few hours, notifies you when "iOS 27.1 is ready", and shows a little amphora in the menu bar that fills up as your files become ready.
• Jamf-friendly. Install it with the pkg and the PPPC profile, preset the settings with a configuration profile, and use the amphora command-line tool in policies or scripts.

It's signed and notarized, MIT licensed, and sends no telemetry. The Jamf secret stays in the Keychain, and Amphora never writes anything to Jamf Pro.

GitHub: https://github.com/giannsp/amphora

It's early: it's in daily use on Apple silicon, but Intel is untested. This is also my first open-source project, so feedback, issues and PRs are very welcome. Big thanks to the SOFA and ipsw.me folks, whose work makes this possible.

(The name: an amphora is the Greek jar made to keep what you'll need later.)

I have launchd run some low-level temperature monitoring code since I like how efficient such a bare-bones approach is. But it looks like Golden Gate has obliterated user access to the battery terminal sensor entirely.

This was my old line that now returns nothing:

BATT_RAW_1=$(ioreg -r -n AppleSmartBattery | grep -E '"Temperature"\s*=' | awk -F'= ' '{print $2}')

I'll admit I'm quite the amateur, but looked for a few possible new parameters and it couldn't find anything. Not with powermetrics, smctemp, or new subsections in ioreg (the command I previously pulled the battery temp from).

Any feelings on this?

UPDATE: It's just -n AppleSmartBatteryPack. One less sensor output I guess?

TL;DR: How to connect a locked iPhone to the internet to have MDM reset commands reach it.

Good morning good people,

I again have a question that might be trivial, but my morning brain doesn't seem to be able to handle.

We have ABM and MDM (intune🤢) fully set up, all devices are supervised.

We recently had to let go an employee rather abruptly and have them hand over their hardware (MacBook and iPhone) to an employee local/near to them.

Now the locked iPhone is sitting on that colleagues desk without any internet connection, since the SIM got disabled.

How the hell do we get this device reset? Sending commands via Intune obviously won't do anything, since it's not connected to the internet. Conencting to Wifi needs the PIN, even a damn USBc->Ethernet dongle needs a PIN.

Am I missing something?

Thx & cheers

Nach Änderung des Passwortes über die GUI wurde auch das Domänenpasswort geändert, die Windows Rechner lassen nur noch das neue Passwort zu.

Ist der Mac mit dem Firmennetzwerk verbunden, wird ausschließlich das neue Passwort akzeptiert, wird VPN getrennt, bspw. nach einem Neustart in der Anmeldemaske wird nur das alte Passwort akzeptiert.

Wird das Benutzerprofil gelöscht, ist nur noch eine Anmeldung im Firmennetzwerk möglich und es wird kein mobiler Account mehr angelegt.

Kennst jemand die Problematik?

MacOS 26

We're excited to announce that App Auto-Patch 4.0 (Build 88) is now available for beta testing!

After months of development, we've completely rebuilt App Auto-Patch from the ground up as a native macOS application!

What started as a shell script for automating third-party application updates has evolved into a modern, fully featured macOS app with a brand-new interface, smarter automation, and more control for both users and administrators.

And don't worry — Installomator is still at the heart of it all! ❤️

✨ What's New in 4.0?

🖥️ A Brand-New Native macOS Experience

• Menu bar interface displaying pending updates, enforcement deadlines, and countdowns to the next reminder.
• Application dashboard showing discovered apps, available updates, and individual update history.
• Update one or Update All directly from the app, with Update All also available from the menu bar.

⚡ Smarter, Less Disruptive Patching

• Background patching automatically updates eligible applications when they're closed.
• Installer staging downloads updates ahead of time for faster installations.
• Intelligent deferrals respect Focus modes, business hours, and enforcement deadlines.
• Improved notifications keep users informed about background activity and alert them when action is required.

🎨 Redesigned Update & Deferral Experience

• See exactly which applications will be updated, including installed → available versions.
• See whether applications are currently open or closed.
• View remaining deferrals and upcoming enforcement deadlines.
• A cleaner, more intuitive interface with streamlined deferral options.

🌎 Now Available in 9 Languages!

🇺🇸 English | 🇪🇸 Spanish | 🇫🇷 French | 🇩🇪 German | 🇵🇹 Portuguese | 🇮🇹 Italian | 🇳🇱 Dutch | 🇯🇵 Japanese | 🇨🇳 Simplified Chinese

🛠️ Built for MacAdmins

• Extensive MDM configuration for scheduling, deferrals, deadlines, notifications, and background patching.
• Seamless migration from 3.x, including automatic removal of older installations and compatibility with existing configuration profiles.
• Automatic Installomator updates to keep application labels and fixes current.
• GitHub API authentication increases the rate limit from 60 to 5,000 requests per hour when configured.
• Custom branding, diagnostic bundles, per-app update history, and Slack/Teams webhook reporting.
• Improved self-updating to keep App Auto-Patch current.

🧪 We Need Beta Testers!

App Auto-Patch 4.0 (Build 88) supports macOS 14 Sonoma and later, on both Apple Silicon and Intel Macs.

Whether you're already using App Auto-Patch 3.x or discovering the project for the first time, we'd love for you to give it a try!

📦 Download: https://www.appautopatch.app/download/
🌐 Website: https://www.appautopatch.app/
📖 Release Notes: https://www.appautopatch.app/reference/release-notes/
⚙️ Configuration Reference: https://www.appautopatch.app/reference/preferences/

💬 Your Feedback Matters!

App Auto-Patch has always been a community-driven project, and we're excited to continue building it with your help!

We've added dedicated App Auto-Patch 4 (native app) templates to our GitHub repository for bug reports and feature requests.

🐙 GitHub Issues: https://github.com/App-Auto-Patch/App-Auto-Patch/issues

This is the biggest evolution of App Auto-Patch yet, and we're excited to hear what you think!

Give it a spin, put it through its paces, and help us make 4.0 the best release yet!

Happy patching! 🚀

Maybe this is more fit for r/MSP, but I still don’t have enough comment karma after posting and commenting for years

As title states, there are about 1000 macs and I’m pretty much single-handedly responsible for managing them besides building and decommissioning. Nobody else “owns” our MDM, everyone comes to me with any mac issue they run into at any point, atop all the normal management and stuff I have to do.

Relevance of the “30 clients” part is that they all have different configurations and things they use.

I have nothing to compare it to in the industry

Is this normal or is there usually at least 2 people?

For the 2.0 release, I've added popup reminders (like Nudge). So now, you can mix any combination of menu bar countdowns, native notifications, dock icon badges, and scheduled popups to suit your organization. Note that the app is designed specifically for enforced updates delivered via DDM.

Since the computer is offline when it goes to the filevault screen, we cannot remote into it. I find this a big inconvenience for someone to have to go up to the physical machine and enter the password. I was wondering if one could potentially setup ssh access so IT could get to it after a reboot. Imo it is just too inconvenient for someone to have to go up to the machine and login after the mac gets rebooted or turned off.

Is there a workaround someone has implemented in their environment that they'd be willing to share?

Apple Configurator only runs on macOS. If your IT team is mostly on windows, someone ends up keeping a mac around just to revive and restore the others. I got sick of that, so I built restorekit.

The software is a cli and desktop app for macOS, windows and linux. Plug into the target's DFU port, run `sudo restorekit restore`, and it detects the mac, downloads the right firmware and restores it. It works on T2 and Apple Silicon. The desktop app restores several macs at once, keeps a history log and exports serials/ECIDs to CSV. The cli has `--json` on most commands for scripting.

The hardware part is dongle-lite. Putting a mac into DFU automatically takes a USB-PD message that PC ports can't send, so from windows or linux you'd normally be stuck doing the key combo. dongle-lite sits between your computer and the mac and sends it for you. It also gives you the target's serial console, which helps a lot when a restore fails and you want to know why.

Everything is free and open source: https://github.com/fcjr/restorekit

I just put another order in from my manufacturer for the dongle so if you are interested in grabbing one: join the batch 2 list at https://www.restorekit.org/#dongle

I'd love feedback!

A recent refactor of SYM-Lite led to a happy accident for fresh installs of Homebrew with Standard macOS users

Background

During a recent refactor of SYM-Lite (1.6.0), I switched Homebrew’s initial installation from an internal, scripted approach to the official .pkg via Installomator.

While Homebrew was technically installed, its installation was in a state of flux: git was missing, meaning that (at least) the following commands were sideways:

• brew -v
• brew update
• brew upgrade

I started down the [Feature]: Auto-install git via Homebrew when missing so brew isn’t degraded road, but ended up with:

dan@Mac ~ % brew -v
Homebrew 7.0.9-dirty

That -dirty suffix means the tracked files in Homebrew’s own git checkout don’t match HEAD. Homebrew mostly worked (bottles and casks still installed), but a brewed git arrives too late to tidy up a checkout that was laid down without one, and leaving every Standard user with a “dirty” Homebrew wasn’t an option.

To my utter amazement, a four-year-old script by Rich Trouton still worked as expected with macOS 27.2 Beta 3, so I closed Feature Request #26 as “not planned,” and opened [Feature]: Install Command Line Tools when git is missing so Homebrew isn’t degraded.

Secret Sauce

The “secret sauce” of this approach was to first install Apple’s Command Line Tools only when git wasn’t already present on the Mac.

Continue reading …

yep, it’s true. lmk

How do I let 3 people use one Mac mini at the same time, each in their own account, without lag?

Hi everyone! I have a Mac mini (M4 Pro, 24 GB of memory, 512 GB drive) and 3 people who need to use it. One will use a MacBook, one a Windows PC, and one a third device. Each person has their own user account. I want it to work like a cloud server: everyone signs in remotely, works in their own desktop at the same time, and never notices the others. Ideally macOS would share the memory and processor between everyone automatically.

What we've tried so far:

\- Apple's built-in Screen Sharing: it can give each person a separate session, but it's laggy even on wired ethernet. It sends the screen as still pictures instead of video.

\- The fast video-based remote apps: they feel close to native, but they can only show whoever is on the physical screen. A second person either can't connect to their own session or kicks the first person off.

\- Open-source remote desktop servers for Mac: we read their code. Each one allows only one session at a time, or takes over the physical screen.

Has anyone actually gotten 2–3 smooth, separate sessions running on one Apple silicon Mac? What worked for you?

EDIT: MIGRATION COMPLETE. YOU CAN LOG BACK IN.

EDIT: i can't add. It started at 3:30 AM UTC for all the people in /r/yurop

https://macadmins.org/community/slack-migration-faq/

After 11 years and nearly 85,000 users later, the MacAdmins Slack instance is boldly going where no community instance has gone before: to Enterprise Grid!

TL;DR: if you didn't set a password on your Slack account and were only using sign-in with email, you'll need to reset it after the move.

If you have lost access to the email used to sign up for the MacAdmins Slack, well, you will probably need to contact the admins to get back in.

Profile customizations won't carry over, but virtually everything else will.

EDIT @ T+2:30:00

You may receive an email from Slack indicating that you have joined the MacAdmins Organization, and inviting you to open the app. SLACK IS NOT READY. This is just one effect of the Slack migration. Order of receipt is either alphabetical by username, or tied to when your member ID was created in the Slack instance, so it's impossible to know when exactly you'll receive yours.

I work in post-production and our edit/VFX machines sit in a server room, extended to the desks with Thinklogical TLX 10G fiber extenders. I'd like to replace a pair of 24" 1920x1200 monitors with a single 34" ultrawide (3440x1440 @ 60Hz), and I'm trying to find out whether the hardware can do it.

Setup:

- TX: CHS 4 Quad Chassis with a TLX-TMM-U00D22 module

- RX: CHS 2 Dual Chassis (firmware V25.07) with a TLX-RMM-U00D22 module

- Source: Apple Mac Studio (macOS)

- Multi-mode fiber, LC

- Current monitors: dual 24in EIZO 1920x1200 @ 60Hz

What I've seen so far:

- A previous ultrawide I tried (34", 3440x1440) came through as a stretched 16:9 image, which looks like macOS only being offered 16:9 modes by the KVM's EDID

- The CHS 4 front panel has a "Load EDID Table" menu that currently says "No Table Load"

- I can't find a datasheet for these exact module part numbers, so I don't know the max pixel clock per head or whether single-head mode gets more bandwidth than dual-head

- I've emailed Thinklogical support and haven't heard back yet

Questions:

1. Has anyone gotten a 3440x1440 or similar 21:9 resolution through TLX modules, and which modules?
2. If the limit is just the EDID the extender presents, did a custom EDID (via the chassis menu, an EDID emulator, or on the Mac side with something like BetterDisplay) fix it? Or did the signal fail further down the path?
3. Any idea what the "D22" in TLX-TMM/RMM-U00D22 means for video format and head count?
4. If it turns out to be a hard bandwidth limit, what did you use instead (a different extender, a second computer at the desk with remote desktop, etc.)?

I haven't changed any settings on the chassis, since the CHS 4 serves other stations. Any experience or pointers appreciated, including "it won't work, don't bother." Thanks!

Basically whenever I want to access the users keychain, it asks me for the users password (Which is synced to the AD password and jamf connect), and when I enter it, it takes it but it doesn't bring up the GUI of the keychain. Same thing when I try to add a fingerprint, it asks for the users password, it takes it, and then it doesn't take me to the GUI prompt.

I think something is broken with the keychain/authentication because now outlook kicks them out too. I had a work around, I was using their old password to access the keychain and that was working, but now it's not working.

Basically whenever a prompt comes up asking the user to enter their current password to change any setting, it accepts it, then it doesn't bring up GUI of the application I'm trying to access like Keychain cause the authentication is broken.

Hello,

One of our customers has recently had an issue deploying the Falcon Mac sensor with Mosyle. They are using the newest CrowdStrike installer (8.10) for their installation package, but most of their devices are set to run version N-2, as CrowdStrike recommends. This has created a situation where Mosyle constantly deploys 8.10, and CrowdStrike knocks it back down to N-2.

Since I'm not very familiar with Mosyle, I'm hoping someone can suggest ways to build the deployment package/profile.

I've seen a couple of suggestions. Do either of these seem like the correct call in your view?

1. Create a Device Group that only targets devices where the Falcon sensor is not currently installed. Tell Mosyle to target the deployment only at this group.

2. Maintain the installer package to the current version we're running, N-2.

Interested to hear your thoughts and suggestions. I'm hoping something similar to the Device Group situation is possible since that seems like a better long term solution, requiring less maintenance/upkeep.

🎸 The next Music City Mac Admins meetup is happening Friday, October 16th, from 5–8 PM at Fat Bottom Brewing in West Nashville.

We’re excited to welcome Maz Kahale, Global Director of Solutions Engineering at Iru, for:

“What Is MCP, and Why Should Mac Admins Care?”

Join us for a great evening of learning, conversation, and connection with the Nashville Mac admin community.

🍻 Food and drinks provided thanks to Simply Deploy IT and Iru.

⚠️ Limited spots are still available, so if you’ve been thinking about joining us, now’s the time to reserve your seat.

🎟️ Register here

We’ll see you in Music City! 🎶

Quick question for Mac admins. When a user's Mac fills up (System Data ballooning, caches, Xcode, Adobe, failed macOS updates because there isn't enough free space), how do you handle it today?

- Do you just watch free space in your MDM, or set alerts?

- When a Mac is full, how do you find out *what* filled it?

- Is "what grew and why" something you'd actually want to see per Mac, or is free space plus a cleanup script good enough?

Context: I'm a solo Mac developer and I've built a consumer app around storage history. I'm trying to work out whether something like this would be useful for admins at all, before building anything. Not selling anything here, just want to hear how you actually do it.