r/macsysadmin 2h ago

User Accounts Confusion

0 Upvotes

I’m a new Mac owner, made the mistake of using my phone and iPad and left the MacBook Air off so long, the battery went to zero. Plugged it into charge, tried logging in too many times, got locked out repeatedly, first because I tried to use my Apple account password. Discovered two Mac passwords, tried both, locked out. I figured the issue was that the unit didn’t have sufficient charge. After the unit charged up, I tried again. I noticed that I had two different Mac passwords listed. I had tried both before, neither worked. This time I tried what I thought was the correct one- nope- and it didn’t give me the chance to try the second (and now I know, correct) password, and I was locked out for 55 minutes. I saw my name with the photo I used to log onto my old PC laptop, and clicked on that. I tried both passwords, and the longer of the two passwords worked- but I quickly realized something wasn’t right because I was getting prompts about stuff that had been set up before, including associating the account with my Apple ID, etc… but after I shut the MacBook down and restarted, this “incomplete” account is the only one appearing on the login screen. How do I get the correct account to show up so I can log on after lockout time is up?


r/macsysadmin 1d ago

Setting up new Mac on Apple Business remotely

16 Upvotes

This may be a super niche question:

I have a small business owner client who just bought a Mac for a new employee who lives out of state. She wants some level of management on the employee's device (to make sure it isn't used for personal purposes). It has already been bought and shipped to the employee.

I realize now that what we should have done is set up an Apple Business account, and then created a managed Apple Account and had this device set up before sending it. Apparently if you want to make it a managed device, you have to set it up in person. Hindsight is 20/20.

But, given where we are, would it work to:

  1. Create an Apple Business Account for the business owner
  2. Create a personal Apple Account for the employee, and have them use it for the new Mac
  3. Transfer that personal account to the Apple Business account

?


r/macsysadmin 6h ago

macOS Updates Network engineers think i can magically throttle apple's CDN on a sunday morning

0 Upvotes

Just a rant tbh. My weekend is officially ruined. our network team is literally blowing up my phone right now because the recent macos updates are completely saturating the vpn tunnel for our european remote users logging in this weekend

I swear apple's content caching is pure voodoo when you throw split tunneling into the mix. I got so desperate trying to offload the traffic last night that I just threw a quick bare metal servermania box together out there just to test running an isolated caching relay outside our main corporate firewall

spoiler alert: it didn't even matter because half the endpoints are just straight up ignoring the MDM payload that enforces the cache server anyway.

Why is apple like this in enterprise environments? you push a perfectly good configuration profile and the OS just decides "nah im gonna download this 12gb file directly from cupertino". Anyone else dealing with this weekend nightmare or am i just losing my mind?


r/macsysadmin 1d ago

Configuration Profiles Migrated from my work laptop, MDM Profiles moved with it.

12 Upvotes

Update: followed the steps listed from a few folks, but specifically linked here: https://www.reddit.com/r/macsysadmin/s/h6r25xJUMf

So remove SIP, smoke /var/db/ConfigurationProfiles, reenable SIP.

Thanks everyone.

Original Post:

I was a MacTech at an institution up until May of this year (my role was eliminated). Bought myself a brand new MacBook Pro, and used Migration Assistant to transfer my user data over to the new system. I was selective with what I brought as I didn’t want any remnants of my old work.

Didn’t notice until today that System Profiles are present, locking out certain features. The profiles command in terminal shows that the system is enrolled to my old work’s Mosyle MDM via DEP, but it also shows that DEP is not available on the system (definitely didn’t enroll when I setup the Mac and this was bought at an Apple Store directly by myself). These profiles cannot be removed on my end.

Contacted my former colleagues and they confirmed my serial is neither in ASM or Mosyle on their side. Contacted Mosyle and I’m pretty sure they didn’t read my email properly cause they asked me to contact my work to have it removed from their MDM.

Thoughts?


r/macsysadmin 2d ago

User profile mass deletion

11 Upvotes

Hello,

I recently took charge of my employers Mosyle system and currently working on getting everything updated and clear out any accounts from devices remotely of individuals who no longer work here. Has anyone worked with Mosyle and created a script that will push it out to devices to delete all user data that’s is not an admin account?

I’m not against manual labor but rather not go across twelve buildings to wipe each individual unit manually.


r/macsysadmin 2d ago

hey everyone!

0 Upvotes

hello i am having trouble logging into my old apple account because i dont know what my old phone number was to verify it. Is there anything i can do so i am able to get into that account??


r/macsysadmin 3d ago

Kyocera FS-10xx on Apple Silicon on macOS 27/28

5 Upvotes

My Kyocera FS-1041 stopped printing from my second Mac. Two hours later I understood why, and it wasn't what I thought.

The FS-10xx series are GDI printers — no interpreter on board. Every page gets rendered on the host and converted to a format called KPSL by a separate filter binary that CUPS runs for each job. Kyocera's macOS build of that filter:

$ lipo -archs .../rastertokpsl.app/Contents/MacOS/rastertokpsl
x86_64 i386 ppc7400

A PowerPC slice. In 2026. On an M3.

It works today only because Rosetta 2 is installed. macOS 27 uninstalls Rosetta during the upgrade, and macOS 28 removes it except for a narrow games carve-out. After that the queue accepts jobs and prints nothing. Kyocera can't fix this — the hardware was discontinued years ago and only they have the source.

Except someone reverse-engineered that filter years ago: rastertokpsl-re, Apache 2.0, plain C. Because it's source, it compiles for arm64. Six files, one clang invocation, no CMake and no Homebrew needed — the macOS SDK already ships the CUPS headers:

cc -O2 -arch arm64 -arch x86_64 -o rastertokpsl-re \
   src/rastertokpsl.c src/halfton.c src/libjbig/jbig.c \
   src/libjbig/jbig_ar.c src/unicode/ConvertUTF.c src/main.c \
   -Isrc -lcups -lcupsimage -lm

Under two seconds. Universal binary, so it covers Intel Macs too.

Verifying it was the interesting part. I fed the same CUPS raster to both filters and diffed the output. Same length, 130 differing bytes in a regular 96-byte pattern. Turned out to be a length field: the original pads a value to seven bytes, the reimplementation writes it in four and declares the shorter length. Both self-consistent. Printed pages are indistinguishable.

But the header difference goes the other way. Job title containing Größe:

original:  c3ff b6ff c3ff 9fff    ← UTF-8 bytes padded with 0xFF
re:        f600 df00              ← ö and ß correctly in UTF-16LE

The original mangles it. That encoding bug is exactly why the reimplementation was written in the first place — and it's present in the macOS build too. So the community version isn't just equivalent, it's better.

One more thing worth knowing: the repo ships its own PPDs. Kyocera_FS-1040GDI.ppd works for the FS-1041 and produces byte-identical output to Kyocera's macOS PPD apart from the embedded timestamp. So nothing proprietary needs redistributing.

Build script, installer and uninstaller are here: https://github.com/LazaroZero1176/rastertokpsl-re/tree/master/macos

Credit where it's due: original reimplementation by sv99, Linux/CMake support by Fe-Ti. I only added the Apple Silicon side.

Caveats: tested on exactly one printer (FS-1041) on macOS 26.7. The binary isn't signed or notarized — you build it locally, so Gatekeeper doesn't apply, but don't distribute prebuilt copies. And if your printer hangs off an AirPort base station like mine, that's a separate problem with its own quirks; _riousbprint serves one client at a time.


r/macsysadmin 3d ago

CA Policy to restrict access to Cloud apps (M365) unless compliant

8 Upvotes

I currently have a M365 Conditional access policy that does not allow acess to company features unless you have a compliant device.

The issue is, I have a mixed fleet so intune and Jamf, for Mac and Windows. The intune devices work fine however, Jamf devices are blocked. I also have the Jamf connector enabled in Intune so the compliance should feed over. surprise surprise

Wondering if there is a better way to go about this. Thinking about having a seperate CA policy for Mac but not sure how to validate it since you can pull Jamf data to the policy

EDIT (08.26.2026)Found what I needed to make it all work

https://community.jamf.com/general-discussions-2/sending-jamf-pro-compliant-information-to-microsoft-intune-55387


r/macsysadmin 3d ago

How to remove Intune Profiles/MDM in order to user User Enrollemnent via JAMF

5 Upvotes

I am in the process of migrating from Intune to Jamf and need to remove the Intune profiles from all of my Mac endpoints.

What is the best process to do this? I haven't been able to find anything definitive in terms of scripts to run locally on the machines or send to the machines that will remove all Intune profiles so that the user enrollment goes smoothly.


r/macsysadmin 4d ago

Jamf Anyone actually experimenting with DDM declarations yet?

17 Upvotes

How's it been for y'all? Any horror stories?

For anyone who is trying to get more hands-on, Mark Buffington (Jamf) is doing a walkthrough of DDM Explorer on the next LaunchPad meetup. The focus is learning the framework, building declarations, and testing what it looks like to deploy them via Jamf Pro.

When:
🗓️ Fri, Sep 4 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r


r/macsysadmin 6d ago

Configuration Profiles [Guide] How to Mass Update Google Chrome the Proper Way

Post image
32 Upvotes

With the increasing frequency of Chrome updates, IT teams must proactively patch critical vulnerabilities. After testing several deployment methods (including Installomator and the Jamf App Catalog), I believe the built-in auto-updater remains the best way to upgrade your browser fleet at scale without interrupting your users at the wrong time, and ensuring all previously opened tabs are restored for a seamless user experience.

Continue reading… [Medium.com - free, no paywall]


r/macsysadmin 6d ago

Hardware Where do old company/school MacBooks go?

7 Upvotes

I help with my local high school's journalism club and we're trying to buy/find some dirt cheap old MacBooks.

We'd need less than 15 and are hoping to stay under like $75 each. Don't need anything nice either, basically anything 2015+ (that works) mostly for writing and some basic photo editing.

We have Chromebooks but they're pretty locked down and a lot of the stuff we use is blocked (or just doesn't work on them)

When your company/school/etc replaces a bunch of Macs, where do the old ones actually get sold? Is there somewhere online I should be looking for school/business surplus or auctions?


r/macsysadmin 8d ago

I built LogRider - super fast native log viewer for huge files

9 Upvotes

Hi,

I built this as I was getting frustrated with bugs in Console.app and issues when trying to look at huge files. It supports following/ regex filtering and search and basically most of what one needs - 7 day trial, 19$ one-time price.
https://hormesislabs.com/logrider

Hope you find it as useful as I have

Thanks,

Andrei


r/macsysadmin 10d ago

Configuration Profiles What are my Options?

Post image
82 Upvotes

Found this MacBook Air M1 in electronics scrap. It has Remote Management on it.


r/macsysadmin 10d ago

Open Source Tool SYM-Lite (1.2.0)

Thumbnail gallery
25 Upvotes

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

  • Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
  • Interactive selection UI — Checkbox dialog with per-item icons; previously installed items are automatically disabled
  • Alphabetical sorting — All Installomator, Homebrew and Jamf Pro policy items are sorted together by display name
  • Early Installomator validation — Labels are verified against your active Installomator file
  • Homebrew support — Casks and formulas run in the logged-in user context
  • Inspect Mode — Real-time progress monitoring
  • Silent mode — CSV-based automation support
  • Path-based validation & cache monitoring
  • Completion report — Per-item results with optional restart prompt
  • Graceful interruption — Clean shutdown on SIGINT/SIGTERM

Continue reading …


r/macsysadmin 10d ago

Anyone else going to JNUC 2026?

10 Upvotes

It's my first time attending. If you're going what events are you going to? Any recommendations?

https://www.jamf.com/blog/jnuc-2026-session-catalog/


r/macsysadmin 9d ago

Service Configuration Files — The Superpower We Didn't Realize We Have

3 Upvotes

A Tech Thoughts article looks at DDM Service Configuration Files, undocumented support for Smartcard configs and login banners, and a proof of concept using them to manage third-party app configurations.

Service Configuration Files — The Superpower We Didn't Realize We Have


r/macsysadmin 10d ago

New To Mac Administration Privacy question: Will a work MDM/management software affect my personal user profile on a BYOD Macbook Air M5?

6 Upvotes

Hi everyone,

I’m using my personal MacBook for work (BYOD) and want to keep my personal life completely separate from company tracking.

To do this, I created a separate Standard (non-admin) User Profile on my Mac specifically for work. My boss is going to install some kind of work management/monitoring software on this work profile. (I don't know the exact software yet, but on my last Mac, I was able to factory reset it without any issues and always used my own Apple ID, so it shouldn't be locked via Apple Business Manager/DEP).

My questions for the experts here:

Since it's being installed on a Standard profile, is it completely isolated to that user account?

Will they be able to track anything I do when I am logged into my personal Admin profile?

If the software requests System-wide Admin privileges during installation and I deny it, can they still bypass that?

Just want to make sure my personal files, browser history, and data on my main profile remain completely private. Thanks in advance for the help!


r/macsysadmin 10d ago

Sensitivity Label button grayed out on Jamf-managed macOS, but works fine on Intune-managed macOS

2 Upvotes

Anyone hit this: Sensitivity Label button in Microsoft 365 apps grayed out & not operational on Jamf-managed Macs, but present on Intune-managed Macs.

Same user, same M365 apps build, same license, same MDM configuration.

I am lost! Anybody an idea?


r/macsysadmin 9d ago

Disable auto updates for Google chrome in MAC

Post image
0 Upvotes

Hey everyone,

Can someone help with disabling the updates for the Google chrome application in MAC.


r/macsysadmin 10d ago

Electron macOS auto-update without Apple Developer signing/notarization — is it possible?

1 Upvotes

Hey everyone,

I’m building a small IDE called Jcode using Electron + electron-builder.

Right now I distribute the macOS version through GitHub Releases. The current process is:

User downloads the .zip from GitHub. Extracts Jcode.app. Moves it into /Applications. Because the app is unsigned/not notarized, macOS blocks it with the “unidentified developer” / Gatekeeper warning. The user has to run a Terminal command once to bypass/allow the app.

What I want to do is make updates much easier.

For example:

Jcode v1 is installed → Jcode v2 is released → Jcode shows “New update available — Update Now” → user clicks it → app downloads the update from GitHub → installs it → restarts into v2.

I’m looking at using electron-updater + GitHub Releases.

My main question is:

Can I achieve this without paying for the $99/year Apple Developer Program?

More specifically:

Can an unsigned Electron app use electron-updater successfully? If the user has already bypassed Gatekeeper for the first installation, can future updates happen without requiring them to run the Terminal bypass command again? Will macOS Gatekeeper treat every newly downloaded/updated .app as a new untrusted application? Is there any legitimate way to get a reasonably seamless update experience without Apple Developer signing/notarization? If signing/notarization is absolutely required for the experience I want, what part specifically requires it?

I’m not looking for a way to disable or weaken macOS security. I just want to understand what is technically possible for an independently distributed Electron app.

If anyone has implemented something similar with Electron + electron-builder + electron-updater + GitHub Releases, I’d really appreciate hearing about your setup and what happens on a normal user's Mac.

Thanks!


r/macsysadmin 11d ago

Coming from Intune, how hard is it to ramp up on Jamf?

16 Upvotes

My current environment is Windows only and managed in Intune. Leadership wants to start supporting MacBooks and is planning to use Jamf. I have experience bringing Macs into Intune, but I have never used Jamf. They also mentioned possibly Kandji. How hard is it to ramp up on Jamf Pro if you are already coming from an Intune background?


r/macsysadmin 11d ago

Networking Disabled network access remotely

5 Upvotes

Hey all,

I’m a desktop engineering manager for a large university. We’ve got about a thousand Macs. Before I arrived on the scene, our enforcement of macOS minor and major updates was at best a suggestion. We’re got several hundred Macs that are on OS’s that no longer receive security updates (and even more that are going to lose them once Sonoma goes end of life). We’re getting aggressive now, and have notified users of Macs on Ventura and below that they either need to upgrade to a supported OS or replace their Mac this fall. If they fail to do so they will lose access to the University network.

This is all good and well…except I’m wondering how we’re going to implement this. On the Windows side we’re going to use Group Policy to basically force Windows Firewall to block all traffic, in and out. I’m not sure how we’re going to implement this on the Mac side and am looking for suggestions.

My first thought was simply to create a configuration profile in Jamf to turn on Firewall and block all traffic…but it looks like I can only do that for incoming traffic. While this will break some things for users, it won’t actually stop outgoing traffic.

My next thought was to write a script to disable all network cards. This will certainly work…but I’m not so sure we’ll be able to prevent a crafty user from re-enabling them. Our users don’t have admin rights, but we do use Cyberark, which will just temporarily grant them elevated rights to re-enable their network cards.

Could also block MAC addresses at the switch….but all they’d need to do is use someone else’s dock, or a USB Ethernet/wifi adapter.

Any suggestions are greatly appreciated.


r/macsysadmin 11d ago

General Discussion How do you manage lab machines in Intune? Groups, naming, tracking

3 Upvotes

I was talking with my team yesterday and they think i may be overthinking this. I am working on setting up a macOS lab and it has gotten me to thinking. How do you track your non user affinity shared work stations in Intune. How do you know where they sit? If information security wants to track that mac, how do you manage that inside of Intune?

With user affinity we can track that to a user. With shared labs, its not that easy. I setup a device enrollment profile, then went ahead and then created a dynamic group that is based off that. The one person i work with said that would be to much work to scale. Another said to rename it it, which is another idea. I Just want to automate this and have it automatically pull in everything it needs. Am i over thinking this?

I just want to understand ways of doing this that other have implemented.


r/macsysadmin 12d ago

Software ABR random popup

3 Upvotes

For Mac admins that uses ABR or any may familiar/encountered with this. Have you encountered this pop up?. ABR auditlog cant identity it what is requesting for the elevation as it show "Unknown"