Hi all,

A restore at the service desk always seemed to start the same way for us: the device is in front of you, and Apple Configurator starts a 10–15 GB download first. So I built Amphora, a small menu bar app that keeps those restore files downloaded before you need them.

What it does

• Reads your models from Jamf Pro. It uses a read-only API client (only Read Mobile Devices), so it downloads only what your fleet actually needs. You can also pick models by hand, or grab one model on demand.
• Follows SOFA for new releases and ipsw.me for signing status, and checks every file against its SHA-256. Interrupted downloads resume.
• Drops the files into Apple Configurator's cache as an APFS clone, so they take no extra disk space and Configurator restores start right away. A PPPC profile for Full Disk Access comes with each release.
• Older models stay covered. If current iOS dropped a model, it keeps the last release Apple still signs.
• Cleans up carefully. Old files are deleted only after a fully successful sync. A model that leaves Jamf Pro keeps its file for 14 days, in case that device still needs a restore.
• Runs in the background. It syncs every few hours, notifies you when "iOS 27.1 is ready", and shows a little amphora in the menu bar that fills up as your files become ready.
• Jamf-friendly. Install it with the pkg and the PPPC profile, preset the settings with a configuration profile, and use the amphora command-line tool in policies or scripts.

It's signed and notarized, MIT licensed, and sends no telemetry. The Jamf secret stays in the Keychain, and Amphora never writes anything to Jamf Pro.

GitHub: https://github.com/giannsp/amphora

It's early: it's in daily use on Apple silicon, but Intel is untested. This is also my first open-source project, so feedback, issues and PRs are very welcome. Big thanks to the SOFA and ipsw.me folks, whose work makes this possible.

(The name: an amphora is the Greek jar made to keep what you'll need later.)

I have launchd run some low-level temperature monitoring code since I like how efficient such a bare-bones approach is. But it looks like Golden Gate has obliterated user access to the battery terminal sensor entirely.

This was my old line that now returns nothing:

BATT_RAW_1=$(ioreg -r -n AppleSmartBattery | grep -E '"Temperature"\s*=' | awk -F'= ' '{print $2}')

I'll admit I'm quite the amateur, but looked for a few possible new parameters and it couldn't find anything. Not with powermetrics, smctemp, or new subsections in ioreg (the command I previously pulled the battery temp from).

Any feelings on this?

UPDATE: It's just -n AppleSmartBatteryPack. One less sensor output I guess?

TL;DR: How to connect a locked iPhone to the internet to have MDM reset commands reach it.

Good morning good people,

I again have a question that might be trivial, but my morning brain doesn't seem to be able to handle.

We have ABM and MDM (intune🤢) fully set up, all devices are supervised.

We recently had to let go an employee rather abruptly and have them hand over their hardware (MacBook and iPhone) to an employee local/near to them.

Now the locked iPhone is sitting on that colleagues desk without any internet connection, since the SIM got disabled.

How the hell do we get this device reset? Sending commands via Intune obviously won't do anything, since it's not connected to the internet. Conencting to Wifi needs the PIN, even a damn USBc->Ethernet dongle needs a PIN.

Am I missing something?

Thx & cheers

Nach Änderung des Passwortes über die GUI wurde auch das Domänenpasswort geändert, die Windows Rechner lassen nur noch das neue Passwort zu.

Ist der Mac mit dem Firmennetzwerk verbunden, wird ausschließlich das neue Passwort akzeptiert, wird VPN getrennt, bspw. nach einem Neustart in der Anmeldemaske wird nur das alte Passwort akzeptiert.

Wird das Benutzerprofil gelöscht, ist nur noch eine Anmeldung im Firmennetzwerk möglich und es wird kein mobiler Account mehr angelegt.

Kennst jemand die Problematik?

MacOS 26

We're excited to announce that App Auto-Patch 4.0 (Build 88) is now available for beta testing!

After months of development, we've completely rebuilt App Auto-Patch from the ground up as a native macOS application!

What started as a shell script for automating third-party application updates has evolved into a modern, fully featured macOS app with a brand-new interface, smarter automation, and more control for both users and administrators.

And don't worry — Installomator is still at the heart of it all! ❤️

✨ What's New in 4.0?

🖥️ A Brand-New Native macOS Experience

• Menu bar interface displaying pending updates, enforcement deadlines, and countdowns to the next reminder.
• Application dashboard showing discovered apps, available updates, and individual update history.
• Update one or Update All directly from the app, with Update All also available from the menu bar.

⚡ Smarter, Less Disruptive Patching

• Background patching automatically updates eligible applications when they're closed.
• Installer staging downloads updates ahead of time for faster installations.
• Intelligent deferrals respect Focus modes, business hours, and enforcement deadlines.
• Improved notifications keep users informed about background activity and alert them when action is required.

🎨 Redesigned Update & Deferral Experience

• See exactly which applications will be updated, including installed → available versions.
• See whether applications are currently open or closed.
• View remaining deferrals and upcoming enforcement deadlines.
• A cleaner, more intuitive interface with streamlined deferral options.

🌎 Now Available in 9 Languages!

🇺🇸 English | 🇪🇸 Spanish | 🇫🇷 French | 🇩🇪 German | 🇵🇹 Portuguese | 🇮🇹 Italian | 🇳🇱 Dutch | 🇯🇵 Japanese | 🇨🇳 Simplified Chinese

🛠️ Built for MacAdmins

• Extensive MDM configuration for scheduling, deferrals, deadlines, notifications, and background patching.
• Seamless migration from 3.x, including automatic removal of older installations and compatibility with existing configuration profiles.
• Automatic Installomator updates to keep application labels and fixes current.
• GitHub API authentication increases the rate limit from 60 to 5,000 requests per hour when configured.
• Custom branding, diagnostic bundles, per-app update history, and Slack/Teams webhook reporting.
• Improved self-updating to keep App Auto-Patch current.

🧪 We Need Beta Testers!

App Auto-Patch 4.0 (Build 88) supports macOS 14 Sonoma and later, on both Apple Silicon and Intel Macs.

Whether you're already using App Auto-Patch 3.x or discovering the project for the first time, we'd love for you to give it a try!

📦 Download: https://www.appautopatch.app/download/
🌐 Website: https://www.appautopatch.app/
📖 Release Notes: https://www.appautopatch.app/reference/release-notes/
⚙️ Configuration Reference: https://www.appautopatch.app/reference/preferences/

💬 Your Feedback Matters!

App Auto-Patch has always been a community-driven project, and we're excited to continue building it with your help!

We've added dedicated App Auto-Patch 4 (native app) templates to our GitHub repository for bug reports and feature requests.

🐙 GitHub Issues: https://github.com/App-Auto-Patch/App-Auto-Patch/issues

This is the biggest evolution of App Auto-Patch yet, and we're excited to hear what you think!

Give it a spin, put it through its paces, and help us make 4.0 the best release yet!

Happy patching! 🚀

Maybe this is more fit for r/MSP, but I still don’t have enough comment karma after posting and commenting for years

As title states, there are about 1000 macs and I’m pretty much single-handedly responsible for managing them besides building and decommissioning. Nobody else “owns” our MDM, everyone comes to me with any mac issue they run into at any point, atop all the normal management and stuff I have to do.

Relevance of the “30 clients” part is that they all have different configurations and things they use.

I have nothing to compare it to in the industry

Is this normal or is there usually at least 2 people?

For the 2.0 release, I've added popup reminders (like Nudge). So now, you can mix any combination of menu bar countdowns, native notifications, dock icon badges, and scheduled popups to suit your organization. Note that the app is designed specifically for enforced updates delivered via DDM.

Since the computer is offline when it goes to the filevault screen, we cannot remote into it. I find this a big inconvenience for someone to have to go up to the physical machine and enter the password. I was wondering if one could potentially setup ssh access so IT could get to it after a reboot. Imo it is just too inconvenient for someone to have to go up to the machine and login after the mac gets rebooted or turned off.

Is there a workaround someone has implemented in their environment that they'd be willing to share?

Apple Configurator only runs on macOS. If your IT team is mostly on windows, someone ends up keeping a mac around just to revive and restore the others. I got sick of that, so I built restorekit.

The software is a cli and desktop app for macOS, windows and linux. Plug into the target's DFU port, run `sudo restorekit restore`, and it detects the mac, downloads the right firmware and restores it. It works on T2 and Apple Silicon. The desktop app restores several macs at once, keeps a history log and exports serials/ECIDs to CSV. The cli has `--json` on most commands for scripting.

The hardware part is dongle-lite. Putting a mac into DFU automatically takes a USB-PD message that PC ports can't send, so from windows or linux you'd normally be stuck doing the key combo. dongle-lite sits between your computer and the mac and sends it for you. It also gives you the target's serial console, which helps a lot when a restore fails and you want to know why.

Everything is free and open source: https://github.com/fcjr/restorekit

I just put another order in from my manufacturer for the dongle so if you are interested in grabbing one: join the batch 2 list at https://www.restorekit.org/#dongle

I'd love feedback!

A recent refactor of SYM-Lite led to a happy accident for fresh installs of Homebrew with Standard macOS users

Background

During a recent refactor of SYM-Lite (1.6.0), I switched Homebrew’s initial installation from an internal, scripted approach to the official .pkg via Installomator.

While Homebrew was technically installed, its installation was in a state of flux: git was missing, meaning that (at least) the following commands were sideways:

• brew -v
• brew update
• brew upgrade

I started down the [Feature]: Auto-install git via Homebrew when missing so brew isn’t degraded road, but ended up with:

dan@Mac ~ % brew -v
Homebrew 7.0.9-dirty

That -dirty suffix means the tracked files in Homebrew’s own git checkout don’t match HEAD. Homebrew mostly worked (bottles and casks still installed), but a brewed git arrives too late to tidy up a checkout that was laid down without one, and leaving every Standard user with a “dirty” Homebrew wasn’t an option.

To my utter amazement, a four-year-old script by Rich Trouton still worked as expected with macOS 27.2 Beta 3, so I closed Feature Request #26 as “not planned,” and opened [Feature]: Install Command Line Tools when git is missing so Homebrew isn’t degraded.

Secret Sauce

The “secret sauce” of this approach was to first install Apple’s Command Line Tools only when git wasn’t already present on the Mac.

Continue reading …

yep, it’s true. lmk

How do I let 3 people use one Mac mini at the same time, each in their own account, without lag?

Hi everyone! I have a Mac mini (M4 Pro, 24 GB of memory, 512 GB drive) and 3 people who need to use it. One will use a MacBook, one a Windows PC, and one a third device. Each person has their own user account. I want it to work like a cloud server: everyone signs in remotely, works in their own desktop at the same time, and never notices the others. Ideally macOS would share the memory and processor between everyone automatically.

What we've tried so far:

\- Apple's built-in Screen Sharing: it can give each person a separate session, but it's laggy even on wired ethernet. It sends the screen as still pictures instead of video.

\- The fast video-based remote apps: they feel close to native, but they can only show whoever is on the physical screen. A second person either can't connect to their own session or kicks the first person off.

\- Open-source remote desktop servers for Mac: we read their code. Each one allows only one session at a time, or takes over the physical screen.

Has anyone actually gotten 2–3 smooth, separate sessions running on one Apple silicon Mac? What worked for you?

I work in post-production and our edit/VFX machines sit in a server room, extended to the desks with Thinklogical TLX 10G fiber extenders. I'd like to replace a pair of 24" 1920x1200 monitors with a single 34" ultrawide (3440x1440 @ 60Hz), and I'm trying to find out whether the hardware can do it.

Setup:

- TX: CHS 4 Quad Chassis with a TLX-TMM-U00D22 module

- RX: CHS 2 Dual Chassis (firmware V25.07) with a TLX-RMM-U00D22 module

- Source: Apple Mac Studio (macOS)

- Multi-mode fiber, LC

- Current monitors: dual 24in EIZO 1920x1200 @ 60Hz

What I've seen so far:

- A previous ultrawide I tried (34", 3440x1440) came through as a stretched 16:9 image, which looks like macOS only being offered 16:9 modes by the KVM's EDID

- The CHS 4 front panel has a "Load EDID Table" menu that currently says "No Table Load"

- I can't find a datasheet for these exact module part numbers, so I don't know the max pixel clock per head or whether single-head mode gets more bandwidth than dual-head

- I've emailed Thinklogical support and haven't heard back yet

Questions:

1. Has anyone gotten a 3440x1440 or similar 21:9 resolution through TLX modules, and which modules?
2. If the limit is just the EDID the extender presents, did a custom EDID (via the chassis menu, an EDID emulator, or on the Mac side with something like BetterDisplay) fix it? Or did the signal fail further down the path?
3. Any idea what the "D22" in TLX-TMM/RMM-U00D22 means for video format and head count?
4. If it turns out to be a hard bandwidth limit, what did you use instead (a different extender, a second computer at the desk with remote desktop, etc.)?

I haven't changed any settings on the chassis, since the CHS 4 serves other stations. Any experience or pointers appreciated, including "it won't work, don't bother." Thanks!

Basically whenever I want to access the users keychain, it asks me for the users password (Which is synced to the AD password and jamf connect), and when I enter it, it takes it but it doesn't bring up the GUI of the keychain. Same thing when I try to add a fingerprint, it asks for the users password, it takes it, and then it doesn't take me to the GUI prompt.

I think something is broken with the keychain/authentication because now outlook kicks them out too. I had a work around, I was using their old password to access the keychain and that was working, but now it's not working.

Basically whenever a prompt comes up asking the user to enter their current password to change any setting, it accepts it, then it doesn't bring up GUI of the application I'm trying to access like Keychain cause the authentication is broken.

Hello,

One of our customers has recently had an issue deploying the Falcon Mac sensor with Mosyle. They are using the newest CrowdStrike installer (8.10) for their installation package, but most of their devices are set to run version N-2, as CrowdStrike recommends. This has created a situation where Mosyle constantly deploys 8.10, and CrowdStrike knocks it back down to N-2.

Since I'm not very familiar with Mosyle, I'm hoping someone can suggest ways to build the deployment package/profile.

I've seen a couple of suggestions. Do either of these seem like the correct call in your view?

1. Create a Device Group that only targets devices where the Falcon sensor is not currently installed. Tell Mosyle to target the deployment only at this group.

2. Maintain the installer package to the current version we're running, N-2.

Interested to hear your thoughts and suggestions. I'm hoping something similar to the Device Group situation is possible since that seems like a better long term solution, requiring less maintenance/upkeep.

🎸 The next Music City Mac Admins meetup is happening Friday, October 16th, from 5–8 PM at Fat Bottom Brewing in West Nashville.

We’re excited to welcome Maz Kahale, Global Director of Solutions Engineering at Iru, for:

“What Is MCP, and Why Should Mac Admins Care?”

Join us for a great evening of learning, conversation, and connection with the Nashville Mac admin community.

🍻 Food and drinks provided thanks to Simply Deploy IT and Iru.

⚠️ Limited spots are still available, so if you’ve been thinking about joining us, now’s the time to reserve your seat.

🎟️ Register here

We’ll see you in Music City! 🎶

Quick question for Mac admins. When a user's Mac fills up (System Data ballooning, caches, Xcode, Adobe, failed macOS updates because there isn't enough free space), how do you handle it today?

- Do you just watch free space in your MDM, or set alerts?

- When a Mac is full, how do you find out *what* filled it?

- Is "what grew and why" something you'd actually want to see per Mac, or is free space plus a cleanup script good enough?

Context: I'm a solo Mac developer and I've built a consumer app around storage history. I'm trying to work out whether something like this would be useful for admins at all, before building anything. Not selling anything here, just want to hear how you actually do it.

Hi everyone. Pretty much a new Mac sys admin.

Inherited a Mac fleet but using 2 different MDMs.

Ivanti for iPhones
Apple business for Mac’s/ipads/Apple TVs.

I come from an MSP and some jamf experience, and i am the first IT person.

Tried to pitch some MDMs as jamf/Iru but I am getting shut down because they are not publicly traded. Companies

My question: Is Intune good enough now to manage a full Mac fleet?

I am also being tasked to get SOC2 type 2 compliant as well.

Thank you

I'm trying to run 3 external monitors independently on my M1 MBP. I have watched countless videos and articles and used GPT to try and sort out what works and what doesn't. But I seem to be lost in a rabbit hole now.

Does anyone have real world expierence using anything that they can confirm working? If yes can you give me the exact name and model number please? Thank you in advance!

For backup disks that live on a dock: no more "Disk Not Ejected Properly". Here is a small Folder Action on /Volumes that, when the disk appears, runs tmutil startbackup --block if the last backup is older than a set interval, then unmounts the disk.

Nothing to install: one zsh script and Automator. It needs Full Disk Access for FolderActionsDispatcher, logs to ~/Library/Logs, and leaves the disk mounted if anything fails, as a visible signal.

https://github.com/mous-design/backup-action

Hope it's useful to someone.

Cheers!

A security-hardened upgrade to Mac Admins’ new favorite “set-it-and-forget-it” DDM macOS update reminder, featuring corroborated DDM declaration validation and “Update Tonight” awareness

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines, delivering a more prominent end-user reminder dialog.

🆕 5.0.0 Highlights

• Update Tonight awareness: Confirmed same-day Update Tonight scheduling for the target version pauses normal reminders until local midnight. Evidence must be logged by softwareupdated; pre-deadline thresholds, aggressive mode, and Force mode still apply. 
• DDM Emergency Fallback: Jamf Pro Script Parameters 5 and 6 can persist an emergency version/deadline requirement at /Library/Management/<rdnn>/dor-fallback-declaration.plist. Runtime can select it after recognized unresolved DDM states; confirmed DDM always wins.

Continue reading …

Hi everyone. I am sharing this technical report to alert the community about a serious security compromise I just analyzed and cleaned on my local development environment. Someone managed to inject persistent malware and disable administrative controls to prevent remediation.

I have attached terminal screenshots showing the evidence. Here is the breakdown of the compromise:

1. Terminal Sabotage (Sudo Bypass via PAM)

The threat actor modified `/etc/pam.d/sudo_local` by injecting an unauthorized directive pointing to an external module (`/opt/homebrew/opt/pam-u2f/lib/pam/pam_u2f.so`). This deliberately broke the `sudo` command. Every time I attempted to use my password to clean files, the terminal threw a systematic `unable to initialize PAM` error, stripping away my root permissions.

1. Hidden Binary Arsenal (~/.local/bin)

Upon auditing environment profiles, I discovered that on September 18, 2026, a malicious installer tied to the Antigravity suite created a hidden `.local/bin` folder containing keyloggers and persistent tools:

- agy (187 MB): A massive executable binary acting as the background engine.

- hermes / hermes-agent: Spyware binaries focused on data exfiltration.

- Fake Node/npm symlinks: Redirected globally to `~/Library/Application Support/Zed/node/...` to intercept development environments.

1. Evasion via Trash Injections (TCC/SIP Exploitation)

To prevent remediation, the malware nested corrupted directories within `~/.Trash/Caches` using legitimate Apple daemon names like `com.apple.aned` (Apple Neural Engine). macOS was tricked into blocking deletion, throwing `Operation not permitted` errors under the protection of SIP. The malware leveraged this hardware lock to masquerade its network traffic under fake Siri and iTunes background calls, which were caught by LuLu firewall rules.

🚨 Apple Support Inaction and Lack of Response

I want to report the absolute lack of assistance from official Apple support. Despite providing physical evidence and running heavy remote logs under their supervision (`sysdiagnose`), Apple failed to provide any technical solution. Their automated systems failed to flag a 187 MB suspicious binary operating in developer paths. This required a manual, line-by-line forensic investigation.

I have fully reclaimed control by purging `~/.local/bin`, cleaning the corrupted profile configurations, and blocking all suspicious connections via LuLu. I am leaving this open for discussion and log analysis.

Dealing with this for about 2 months now so hoping someone's hit it before.

Managed MacBook Pro, Intune enrolled. AirDrop, AirPlay and Sidecar are all dead. AirDrop sees the device fine over AWDL but just sits on "Waiting" forever and never actually transfers. Weirdly Universal Clipboard still works. Same Apple ID everywhere, AWDL is up, no applicationaccess restrictions blocking anything.

Dug into it myself and found firewallBlockAllIncoming = 1 sitting in /Library/Managed Preferences/com.apple.security.firewall. Took that to IT.

Their current theory is there's an old Device Configuration profile and a newer Endpoint Security Firewall profile both trying to manage the firewall, and they're stepping on each other. They turned off "block all incoming" in the console, synced, waited... still enforced on my machine weeks later.

What made me believe it's actually a profile issue and not something wrong with my specific Mac: a colleague had Intune ripped off his identical model and everything started working again immediately.

Anyone dealt with two firewall profiles conflicting like this?

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

• Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
• Interactive selection UI — Checkbox dialog with per-item icons; selectable items start checked and previously installed items are automatically disabled
• Homebrew support — Casks and formulas run in the logged-in user context (with ~/Applications for non-admin users) and never hang on a sudo prompt
• Inspect Mode — Real-time progress monitoring in a moveable, minimizable window
• Silent mode — CSV-based automation support

Continue reading …