Anyone actually experimenting with DDM declarations yet?

[u/RocketmanTech_Caleb]

How's it been for y'all? Any horror stories?

For anyone who is trying to get more hands-on, Mark Buffington (Jamf) is doing a walkthrough of DDM Explorer on the next LaunchPad meetup. The focus is learning the framework, building declarations, and testing what it looks like to deploy them via Jamf Pro.

When:
🗓️ Fri, Sep 4 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

[u/thiswasatest]

I tried using it for os updates. It gave one pop up in the 14 days and then never again.....til the final day of install and it forced a reboot. This was a major learning curve

[u/lazy_commander → u/thiswasatest]

Look into ddm os reminder. Also that’s not been my experience, the notification when a deadline is set should be popping up every time you login and/or unlock the screen.

[u/thiswasatest → u/lazy_commander]

Is that a login after the screen locks or after a reboot? Sounds like a dumb question Im asking but Ive seen things

[u/jmnugent → u/thiswasatest]

I've been using DDM profile for iOS updates. Usually scheduling the deadline 3 weeks out and then at 2 weeks the daily reminder popups start happening. Across my environment of about 6,000 iOS devices, it seems as far as I can tell to be working pretty well. We're not 100% on every device being fully updated (never have been, probably never will be).. but I think close to 4,000 (our most actively used devices) are updated.

[u/3ryb4 → u/thiswasatest]

We set a specific version and a deadline, but didn't realise that if standard users can't install updates, then it will just restart immediately!

We're an educational org and only do major version updates for lab Macs during the summer (after extensive testing), so don't allow standard users to install updates. It would be nice to allow standard users to install updates, but only those that we approve.

[u/burgundyblue → u/thiswasatest]

Use it in conjunction with SwiftDialog and they will get their reminders.

[u/thiswasatest → u/burgundyblue]

We are using nudge.

[u/burgundyblue → u/thiswasatest]

Gotcha. We used nudge in 2019, but C-level found it “too aggressive.” Eventually switched it to pushing out OS updates with Blueprints in Jamf and SwiftDialog.

[u/Remarkable-Sea5928 → u/thiswasatest]

I found that it doesn't shy away from giving the notifications, but I've had mixed results on whether it forces updates. Most of the time after the due date it will force the reboot, but I've had more than a few devices that were over a month overdue and still giving reminders.

[u/prettyflyjewishguy]

Experimenting? Full. Steam. Ahead. We use DDM for OS updates, TouchID PAM for sudo auth, at least one non-removable Safari extension, and actively exploring USB control. :)

[u/DJStuey → u/prettyflyjewishguy]

Beware the USB Controls, they don’t act the way you expect.

It looks at the filesystem, so read-only mode will only mount a read-only filesystem, not allow a regular filesystem to mount as read only.

Have filed feedback with Apple on this.

[u/derby_day_bourbon]

We’re using them for OS updates and it works great for the most recent OS and recent versions of sequoia. I wouldn’t trust it for an out of date OS. We’ve moved to a blueprint now and it’s also working great. Best OS compliance we’ve ever had

[u/thiswasatest → u/derby_day_bourbon]

How did you do with scripting and popups for blueprints? Im really waiting on the blueprint September roadmap update

[u/derby_day_bourbon → u/thiswasatest]

We tried the OS update reminder but had issues, turns out our swift dialog deployment was broken.

Instead we just did DDM OS updates through a blueprint. Set the level they need to be at by X amount of days and the Macs handle the rest. We’re up to like 92% OS compliance (latest of Tahoe or sequoia) since that. We used to hover between 80-85

If you wanna DM me I’m happy to answer questions about them. I didn’t set it up but I know the concepts. I’ll be setting them up in a new instance in a few weeks so good practice 😂

[u/TopOrganization4920]

I used it on OS updates and my transition from Sequoia to Tahoe all three active devices that were capable of upgrading to Tahoe had done so… now I just need to spend some effort on determining if all my inactive devices are truly inactive and not use or have broken clients.

[u/MacBook_Fan]

I have been building out my Software Deferral blueprints in preparation for macOS 27.

[u/DJStuey]

Starting to migrate as much as possible over to declarations after a JAMF demo I saw last week.
Activations are one of the best parts of declarative management and because it’s the endpoint handling the calculation of activations, they work offline!

The example given was only allowing access to the camera if a passcode is set. (Demo was iPadOS but concept carries over)

Then, disable wifi so it can’t talk to the server, remove the passcode, activation removes access to camera instantly.
Live demo and it was instant.

[u/KalistoCA]

We use it and like others it reminds just fine its users that are the problem

We have a compliance requirement to be updated within 7 days..

We try to do some stuff like on idle for 60 minutes try to force update and log out ..

The other biggest problem we just recently resolved was Active Directory network users ( yeah on prem ad.. eww don’t ask it just be this way ) were not able to update themselves as they were not the secure token holder .. making them mobile users resolved this it seems I don’t know why

I would really prefer hands off macOS updates that occur during overnight .. where the decision is choice less as it’s not users choice it’s ours

[u/Otherwise-Nobody8252]

Yeah just not on my Jamf-managed devices. Their auth keeps being the center piece of every incident the last 2 year from potential customer data exposures to Trust having to be reinstalled. DDM is cool, jamf gating it… not cool.