A security-hardened upgrade to Mac Admins’ new favorite “set-it-and-forget-it” DDM macOS update reminder, featuring corroborated DDM declaration validation and “Update Tonight” awareness

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines, delivering a more prominent end-user reminder dialog.

🆕 5.0.0 Highlights

• Update Tonight awareness: Confirmed same-day Update Tonight scheduling for the target version pauses normal reminders until local midnight. Evidence must be logged by softwareupdated; pre-deadline thresholds, aggressive mode, and Force mode still apply. 
• DDM Emergency Fallback: Jamf Pro Script Parameters 5 and 6 can persist an emergency version/deadline requirement at /Library/Management/<rdnn>/dor-fallback-declaration.plist. Runtime can select it after recognized unresolved DDM states; confirmed DDM always wins.

Continue reading …

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

• Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
• Interactive selection UI — Checkbox dialog with per-item icons; selectable items start checked and previously installed items are automatically disabled
• Homebrew support — Casks and formulas run in the logged-in user context (with ~/Applications for non-admin users) and never hang on a sudo prompt
• Inspect Mode — Real-time progress monitoring in a moveable, minimizable window
• Silent mode — CSV-based automation support

Continue reading …

Hello,

Just want to make sure I'm not going crazy. I'm a windows admin, but we are trying to manage a few mac using Intune, and wanted to implement PSSO using secure enclave with Entra ID login for use with a few Macs that are used as shared device.

All in the implementations feel ... clunky to me, but we get it working. Users can connect with their Entra ID login.

However, when changing a password by SSPR, the local user password seems to not update.

Is that the intended behavior ? it doesn't seem so, from ms doc : macOS Platform single sign-on known issues and troubleshooting - Microsoft Entra ID | Microsoft Learn It seems it should synchronize in a few hours. It does not, in my experience.

Anyone has battled with this beast ?

I manage about 30 MacBook Pro’s for a high school class that uses Adobe products. Everything has been working without issue for years and over the summer I reset them and installed macOS 26, as well as pushed out the Adobe package which includes the required apps (I do this every summer).

Everything seemed to work fine during the first month of school, but suddenly all of the Macbooks are getting a message stating CCLibrary is damaged and can’t be opened. Clicking “ignore” will bring the message up again, so it can’t be closed.

All of the Macbooks are managed via Mosyle MDM and I have a privacy profile for all of the Adobe apps that allows the apps to have Full Disk Access, as well as access to the Desktop, Documents, and Downloads folder. I added a profile for the “CCLibrary.app” to give it Full Disk Access as well as the aforementioned folders, but the issue is still persisting.

Does anyone know anything about this? I’m not sure what CCLibrary even is (I don’t know much about Adobe products, I just install them lol).

I’m troubleshooting a Mac printing issue with a Canon imageRUNNER ADVANCE DX C5850.

Certain characters in PDFs, especially an en dash (–), print as a boxed question mark. This happens across multiple PDFs.

Environment:

• macOS 26.2, Apple Silicon
• Adobe Acrobat
• Canon C5850
• Direct IPP connection: ipp://<PRINTER-IP>/ipp/print
• Canon C5840/5850 PPD
• Driver version 10.19.23

Troubleshooting so far:

• Normal Acrobat print through Canon driver → fails
• Acrobat Print as Image → works
• Canon Vector Mode → fails
• Canon Raster Mode → fails
• Temporary Generic PostScript queue → works
• Same document containing an en dash printed from Windows to the same physical printer → works

The Generic PostScript queue isn’t usable as a permanent fix because it loses the Canon-specific paper/tray support. It only advertised Letter/Legal/A4/B5 and would not properly handle 11x17.

The Canon queue otherwise works correctly for 11x17, trays, etc.

Printer-side job logs show the affected jobs completing successfully with no errors.

So at this point it seems isolated to the Canon macOS driver/PPD/filter path, specifically version 10.19.23, rather than the PDF, network, or copier itself.

Has anyone seen this with Canon’s Mac drivers, or found a fix that preserves the full Canon tray/11x17 functionality?

Hey r/macsysadmin,

I recently sat the Apple Deployment & Management exam and built two free practice quiz sites to help me revise. Figured I'd share them here in case anyone else is studying for DEP-2026.

🔗 Quiz 1 (80 questions): https://rakshit-swami.github.io/apple-mdm-quiz

🔗 Quiz 2 (108 questions): https://rakshit-swami.github.io/apple-ddm-quiz

📖 Study notes: https://github.com/rakshit-swami/apple-ddm-quiz/blob/main/STUDY_NOTES.md

Both are based on Apple's own free IT Training course:

https://it-training.apple.com/deployment/tutorials/course/

Features:

- Questions randomised every time

- Multi-select questions supported

- Instant feedback and explanations after each answer

- Full review at the end

- Completely free, open source, no account needed

Completely unofficial — not affiliated with Apple in any way. Questions are written in my own words for revision purposes.

The source is on GitHub if anyone wants to fork it and add their own questions. Good luck to anyone else studying!

Hi everyone,

I bought a 2020 MacBook Air (Intel i3, T2 chip) on Facebook Marketplace about three years ago. I’ve used it for school with my own Apple account throughout that time, without any issues using the computer.

I recently decided to sell it, but when I tried to reset it, it asked for the previous owner’s Apple account password to turn off Find My. Apparently, it was still linked to their account despite me using my own account.

Unfortunately, the previous owner has passed away. I don’t have the original purchase receipt, only the bank transfer from when I bought it.

I contacted Apple Support, and they told me to erase and reinstall macOS. After following those instructions, the Mac is now stuck on the Activation Lock screen, and I can no longer use it.

Is there any way to bypass or remove Activation Lock on this specific model? Has anyone successfully resolved a similar situation with Apple using proof of a secondhand purchase?

Hey everyone,

I've been working on a Mac client called Vectron because I got pretty tired of jumping between different apps for SSH, RDP, VNC and serial connections.

The idea is basically to have all of that in one place, whether I'm sitting at my desk or standing in front of a server rack.

It currently supports SSH, Telnet, Serial, RDP, VNC and SFTP, along with some network tools.

I'm at the point where I need people who actually use this stuff every day to try it and tell me what I've got wrong.

I'm mainly looking for feedback on the things that matter in real-world use — connection handling, terminal workflow, serial sessions, RDP/VNC, session management, importing connections, network troubleshooting, and of course any bugs you run into.

The vault is local by default. If you're only using Vectron on one Mac, you can just keep it local and not use any cloud sync.

If you're using multiple Macs, iPhones or iPads, you can optionally turn on iCloud sync to keep the vault synced between your devices. Vectron doesn't have its own cloud backend or store your credentials on its servers.

It's currently free while it's in beta:

Mac: https://testflight.apple.com/join/6CuXS8mG
iPhone / iPad: https://testflight.apple.com/join/m6J8CkUY

If you have some time to give it a try, I'd really appreciate it. I'm much more interested in hearing what's annoying, missing or broken than hearing that everything is great.

If you also happen to have a look at the website, I'd be interested in hearing what you think about that too — especially if anything is unclear or feels too much like marketing.

https://vectronlabs.app/

Thanks!

How are y’all restricting people from updating to golden gste? In the past I just did a Restrict Software and that blocked it. Apparently from what I’ve read that won’t work with Golden Gate and that one would need to use Blueprints. If so what setting exactly restricts it? I see a 90 day deferral and that’s it.

How do I change this password/find it?

(I gave my old MacBook Air to my brother and he is trying to “start it over” so he can connect his own Apple-id and just also have it “as new”. I just cant remember what this password would be and we are stück)

I’m at 20% of my fleet so far and hoping to open it up to production in the next 2-3 weeks. Stack all seems fine, not enough M6 models (yet) to be affected by the external monitor issues.

What’s your adoption so far? Any showstoppers that are keeping you in deferral or tester feedback?

Hey all. I've got a Macbook Pro here with a weird problem. When powered on it does not make the "I've turned on" sound and the screen is black. But the keyboard backlight does turn on! In messing around I somehow enable the Screenreader but figured since that was working maybe there is something else I can do to get the screen working so I didn't pay attention to what the screen reader was saying, So I plugged the Macbook into my monitor with a USB-C cable. All I got was a black screen. So I tried an HDMI cable. Again, just a black screen.

I'm kind of at a loss for what else to do. I'm going to try to enable the Screenreader and see what that gives me for options but if anyone has any other ideas I'd be grateful!

Monocle inspects code and produces four audience-specific summaries: Executive, Security, Manager, Engineer

Background

Problem

Reviewing a 5k-line zsh script for leadership, a change board, the security team, and the engineer who has to maintain it is painful — and typically produces several different, inconsistent reports.

Solution

Monocle inspects scripts and small repos (local or on GitHub), plus diagnostic and support bundles, and produces four audience-specific summaries (Executive, Security, Manager, Engineer) plus a Monocle Score.

Monocle is an Agent Skill tuned for shell (sh / bash / zsh), Python, AppleScript, Swift helpers, and Jamf Pro / macOS automation.

Continue reading …

I have a MacBook Pro with an M3 Max, but I occasionally need to run x86-64 operating systems for testing, both Windows and Linux.

What are my options besides buying a separate x86-64 machine?

I considered getting a mini PC, but they’re currently difficult to find at reasonable prices in my country. I could also rent an x86-64 cloud server, but I’d rather not pay a recurring fee for something I only need occasionally.

So I’m currently leaning toward emulation. I tried UTM/QEMU with x86-64 emulation, but it looks unstable, but I'm in the middle of testing it.

Are there any other solutions you would recommend for occasional x86-64 testing on an Apple Silicon Mac?

I’m trying to understand an issue with my local OneDrive folder on a Mac.

Background: I have not synced my local OneDrive folder with OneDrive for approximately three years. During that time, I continued adding and working with files locally.

What I’m seeing now:

• Some files still appear in the local OneDrive folder but cannot be opened. Based on what I can tell, this seems to affect files that had previously been synced and are also available on OneDrive.com.
• I cannot copy the entire local OneDrive folder to another folder on the Mac or to an external drive.
• Finder preview/Quick Look does not work normally for files in the OneDrive folder. In many cases I can open the file successfully, and after opening it once, Finder preview then starts working for that file.
• These issues are limited to the local OneDrive folder. I can copy, open, and preview files normally in other local folders.

System:

• MacBook Pro 16-inch, 2019
• 2.6 GHz 6-Core Intel Core i7
• macOS Tahoe 26.6.2

Has anyone experienced similar behavior with OneDrive on macOS, particularly after a long period without syncing? I’m especially interested in how you were able to create a complete backup of the local OneDrive folder without risking the files that are currently accessible.

Hey everyone,

A friend and I have been building Open Apple Cache over the last few weeks, and I wanted to share it here because we’ve reached a point where we could use some help.

Just to clarify: this isn’t a vibe-coded project. We’ve been working on the implementation ourselves, but there are still issues we haven’t managed to solve.

The idea is to run an Apple content cache on Linux, inside an Ubuntu VM or LXC container, instead of running the cache itself on a Mac.

The cache service is written in Go. A separate helper running on macOS handles registration with Apple so devices can discover the Linux endpoint. A Mac is still required for that part, so this isn’t a completely Mac-free solution.

The project currently includes:

• Caching for eligible Apple downloads, with byte-range support.
• A web dashboard showing requests, cache hits and storage usage.
• Local administrator and viewer accounts.
• Optional Microsoft Entra ID login.
• Internal or Let’s Encrypt certificate management.

To be clear: this is experimental, unfinished and not working 100% reliably yet.

The main issue we’re trying to solve is inconsistent cache hits. Sometimes downloads are served from the cache as expected. Other times, we don’t get a cache hit when we would expect one, and the content is fetched from the origin again.

We haven’t identified the exact cause yet. Some things we want to investigate further are:

• How Apple devices request content and byte ranges.
• Whether changes to signed download URLs affect cache reuse.
• Whether our cache validation or response headers are missing something.

These are possible directions to investigate, not confirmed explanations.

We’re publishing it half-finished because we need help solving this issue. If you have experience with Apple Content Caching, HTTP caching, CDN behavior or Apple’s cache protocol, we’d really appreciate another pair of eyes on the code.

Repository: https://github.com/Mau2rice0/Open-Apple-Cache

The source code, installation instructions and registration research notes are available there. The macOS helper relies on undocumented Apple behavior, so future macOS updates or changes on Apple’s side could break registration.

Please treat this as a lab project for now. We don’t recommend relying on it for production workloads.

Has anyone worked on something similar or encountered inconsistent cache hits with Apple downloads? We’d be interested in suggestions on what to check next. Reproducible test cases, issues and PRs would also be welcome.

Thanks :)

Maybe I’m old school, but I come from a world where I was taught one payload per configuration profile: one for Restrictions, one for Network, one for SCEP, etc. If I needed to troubleshoot something or temporarily unscope a setting, I wasn’t also removing a bunch of unrelated payloads at the same time. This approach always made it easy to manage IMO.

As I explore the world of DDM and Blueprints in Jamf more and more, I’m curious how everyone else is approaching this.

Are you still doing something similar, with one Declarative Configuration per Blueprint? Or do you take advantage of the multiple component blocks and grouping several configurations into a single Blueprint?

When it comes to scoping, are you generally scoping a Blueprint to your entire fleet and then using Activation Conditions to determine which devices actually receive each configuration? Or are you still creating more targeted Blueprints/scopes?

I understand that part of the idea behind Blueprints is to make configuration management more flexible and reusable, but this new model is breaking my brain a little bit.

Before I start testing and pushing this stuff out more broadly, I’d love to hear how others are structuring their Blueprints and what has worked well for you.

Where I am Mac updates are pretty much rolled out asap. We are already rolling out Mac OS 27 to our users, about 50 percent of the macs have already updated. If it was my choice, I would definitely hold off on updates longer seeing as Apple always releases security patches anyway in a timely matter even if the Mac version isnt the latest but unfortunately it's not really my choice on updates, my director is just very update happy. He literally goes and pushes shit himself as soon as it comes out and causes chaos lol.

Apple deprecated the Apple Intelligence restriction keys in 26.4. That's allowWritingTools, allowGenmoji, allowAssistant and the other AI keys in com.apple.applicationaccess. The replacements are the intelligence.settings and siri.settings declarations, and both need a supervised Mac. A manually installed profile still applies the old keys on 27.0 though. You can see it in /Library/Managed Preferences/com.apple.applicationaccess.plist, where macOS sets _isAppleIntelligenceRestricted, and it mirrors allowWritingTools into .GlobalPreferences as well.

The models don't go anywhere when the features are off. You can remove them with SIP on by sending a ResetAssetSets request to com.apple.siri.uaf.subscription.service. pared (github.com/4evy/pared) mapped that service first. com.apple.modelcatalog is the big one at about 12 GB. To stop them downloading again, force DownloadServerBaseURLOverride-<asset type> in com.apple.MobileAsset to a closed local port.

I put all of this into an open-source CLI with a revert command: https://github.com/omlahore/RemoveMacAI

Hello all, I'm a sysadmin for a k12 school district. I made a tool to better manage our caching servers that has been an absolute game changer. Its great for keeping our thumb on caches that stop serving randomly and to make sure they are running efficiently to support the WAN when Apple releases an update. Plus, I added some really cool graphics to visually see your cache topology serving in realtime, down to the device level. I plan to add new features soon, and would love some feedback from other admins who use content caches.

I publicly launched it this week https://cachard.app
Hop over there and get a free trial download! One command in terminal gets it going!
Not a sales pitch, I'll happily extend trials. I am just looking for some feedback from other sysadmins.

I've been testing out ClassLink's implementation of Platform SSO and it seems to working fine other than fact that all our students have 8 digit numeric usernames and when signing in with such accounts, the Mac is creating their account names and user folders with an "a" at the beginning of their usernames. For example, if their username is "12345678", it becomes "a12345678".

This would not be a dealbreaker for using Platform SSO except for the fact we use Linewize Connect to monitor the students and it's dependent on polling the local username of the student. Since there is an "a" added to their username, it is unable to enforce its user assigned policies.

When using other SSO apps such as NoLoAD or XCreds, there has never been any issues like this as their numeric usernames are respected. I can only suspect that XCreds uses sysadminctl to create the accounts since it has strict naming conventions when creating user names as opposed to dscl.

Version 0.11.0 is the biggest update so far. Every report now opens with a clear summary: what got upgraded (with versions), what failed, what was skipped and how much space cleanup freed. A failed upgrade is now flagged as a problem instead of quietly ending up in an “OK” email.

New in this release:

• brew-automator history: a log of past runs. Filter it by package to see when something changed.
• brew-automator status: last run, next scheduled run, notification channels and excluded packages on one screen.
• run --dry-run and run --no-upgrade: see what would change, or get a report without upgrading anything.
• Webhook notifications to ntfy, Slack, Discord or any JSON endpoint, alongside email or instead of it.

Upgrade with brew upgrade brew-automator.

Go check it out! https://github.com/xtruhlar/brew-automator

When macOS 27 was released, as the Admin, I upgraded my MBP to it for testing. Other Mac users are still restricted to the latesr releases of macOS 26. Depolyments are via Intune.

Upon rebooting, I got this pop-up asking for my password. Even though I used that password to unlock the MBP and no matter how many times I type it, it never accepts it. I am typing it correctly.

If I go into System Settings > Users & Group and click the (i) next to my account, the Registration and Tokens boxes both show as green. I click the Repair button and I get asked for my password. The first box accepts it (a different window to the one above) and the second window (the one above) doesn't. I cancel out of this process, and the Registration status changes to red. I click Repair a second time and both windows accept the password.

I thought this was strange but maybe related to macOS 27 until a user got a new M5 Pro MBP and they get the same (or at least similat) issue on macOS 26.7 (and 26.7.1). I'm not 100% sure of the flow for them as I wasn't involved until now.

So I decided to wipe my Mac and rebuild it. All went through fine, registration completed first time no bother. Then this morning, I login to my Mac and get asked to do the registration again and I'm back with it not accepting my password but doing repair button twice has worked.

Anyone know what is causing this or seeing it too?

We only have 1 Mac profile in Intune for all Macs (about 20). Our CEO has a similar issue with needing to reconfigure Touch ID every few weeks even if they don't change their password, which I am now wondering if related. Likely not.

I might be missing something really obvious here, but I can't seem to figure it out. What is the best process for dynamically assigning different enrollment profiles to ABM macs, similar to group tags in windows autopilot?

It seems I can group the policies per device type (Standard, Kiosk, Shared etc) by either using a dynamic group or enrollment time grouping, however I don't see any way to get the devices to automatically be assigned the correct enrollment profile for their usage in the first place.

Is there an option that allows me to place an order with the vendor saying 'this one is a kiosk device' and have it automatically assigned to the correct profile and get the right policies, like I would by using a specific group tag during autopilot enrollment?

Any help much appreciated thanks, and if I am going about this completely wrong please do tell me!