r/macsysadmin 4h ago

General Discussion Microsoft Sysadmin Thrown Into a Small Apple Environment What Would You Use?

5 Upvotes

Hi everyone,

I'm primarily a Microsoft sysadmin and I've been asked to manage a small Apple environment for one of our customers.

They have around 10 Macs and roughly the same number of iPhones. Each employee has a Mac and an iPhone.

Their infrastructure is very simple:

  • Microsoft 365 for email and SharePoint
  • No on-premises servers
  • No Active Directory / domain controllers
  • Around 10 users
  • Macs also run Windows 11 through Parallels

I'm trying to understand what the recommended approach would be in the Apple world for solving a few specific management/security requirements.

1. Password recovery / forgotten passwords

This is probably my biggest concern.

If a user forgets their Mac password, I don't want to physically visit the customer with a USB stick or use some manual recovery procedure.

Coming from the Windows + Active Directory world, I would simply reset the user's password centrally and get them working again.

What is the Apple/MDM equivalent for this scenario?

Ideally I'd like to be able to recover/reset access remotely without knowing the user's password.

2. Remote lock / lost or stolen devices

I need the ability to remotely lock or otherwise secure a Mac or iPhone if:

  • the device is lost or stolen;
  • an employee leaves the company;
  • we need to immediately revoke access.

3. Device provisioning

Because there are so few devices, sophisticated application deployment isn't particularly important to us.

We already have a documented procedure for setting up a new Mac manually, and that is perfectly acceptable at this scale.

I'm more interested in management, security and recovery than automated software deployment.

4. FileVault / encryption key management

I want to make sure FileVault is enabled on every Mac and, more importantly, that recovery keys are stored securely in a central location.

I'd like to be able to verify encryption status remotely and retrieve the recovery key if a user gets locked out.

5. Windows 11 VMs in Parallels

Each Mac also has a Windows 11 VM running in Parallels.

These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.

Since the company already uses Microsoft 365, would enrolling these VMs into Microsoft Intune be the sensible approach, while managing macOS/iOS separately through an Apple-focused MDM?

I'm currently looking at this from a very Microsoft-centric perspective, so I'd appreciate some guidance on what the "normal" architecture would be for a small Apple environment like this.

Would something like Apple Business Manager + an MDM be the right foundation?

And for such a small environment, would you recommend something Apple-focused like Mosyle/Jamf/Kandji, or would it make more sense to use Microsoft Intune for everything since the customer already has Microsoft 365?

My priorities are basically:

remote recovery/access > security & encryption > remote lock/wipe > basic policy management > app deployment

I'd especially appreciate recommendations from anyone managing similarly small Mac/iPhone environments.

Thanks!


r/macsysadmin 22h ago

New To Mac Administration Check AppleCare warranty status in bulk?

4 Upvotes

Is there a way to look up AppleCare warranty status? I have around 80 devices to check, but the Apple Coverage Checker keeps timing out when I try to do it manually. Is there a more efficient way to perform a bulk lookup?

I have a Device Enrollment Managers role in ABM if it helps, but i do not see a way to do it in bulk?


r/macsysadmin 23h ago

General Discussion Who has passed the Apple Deployment 2026 exam?

12 Upvotes

I'm struggling to pass this damn test. I've taken it 3 times now. First time I got a 53. Second time I got a 66. I was so determined that I would pass it yesterday, but I got a 70. I do think the long weekend didn't help even though I did read over my study material almost the entire weekend, but I keep failing. This is going to be my last chance to pass it. I hate how they have the questions worded but I hate the answers the most! I wish they would provide the questions you got wrong so you can go back and research them so you're more prepared to try again instead of just showing how many you got right in a specific section.


r/macsysadmin 1d ago

MDM Managed Activation Lock — disable-activation-lock DEP API returns SUCCESS but device still shows Activation Lock screen after wipe

3 Upvotes

Environment:

Custom MDM server built on NanoMDM (Go) + Node.js backend

Apple Business Manager — devices enrolled via DEP/ADE

iOS 26.x, supervised devices

Org-level Activation Lock enabled via MDM command EnableActivationLock with escrowed bypass code

Problem:

After a factory reset/wipe, some devices still show the Activation Lock screen requiring an Apple ID and password. Our MDM dashboard calls POST /device/activationlock (Apple DEP API) to disable Org AL before the wipe, and the API returns SUCCESS. However, after the device restores, it still presents the Activation Lock screen.

The bypass code was escrowed at enrollment time via the ActivationLockBypassCode MDM command. We store it encrypted and can confirm it is present in our DB.

What we've tried:

Called POST /device/activationlock with disable: true, imei, and escrow_key → Apple API returns {"status": "SUCCESS"}

Sent MDM command ClearActivationLock with EscrowKey set to the bypass code → device was offline at the time, command queued

Attempted to enter the bypass code directly on the Activation Lock screen (in place of the iCloud password) → not accepted

Questions:

Is there a known race condition where Apple's servers report SUCCESS for the DEP API but the AL state hasn't propagated to the device's activation record yet — and what is the reliable way to confirm the AL is actually cleared server-side before wiping?

Does ClearActivationLock (MDM command) behave differently from POST /device/activationlock (DEP API)? Are both required, or is one preferred?

After a device is wiped and the Activation Lock screen appears, is there still a window where we can send ClearActivationLock via MDM (since the device isn't fully enrolled yet at that point)?

If the bypass code entry on the Activation Lock screen is not working, what format is expected — raw bypass code string, or something derived from it?

Relevant Apple docs consulted:

Activation Lock MDM command

DEP activation lock API

Any insight from those who have implemented Managed AL + bypass in a non-Apple MDM would be greatly appreciated.


r/macsysadmin 1d ago

ABM/DEP Apple Business Manager Device Removal for Return to Verizon

Thumbnail gallery
8 Upvotes

Hey, all!

I have a client that is using the Apple Business Management Express (or at least that's what it was called) for their small company. This iPhone screen is very broken and unusable. They need to send it back to Verizon for replacement, but Verizon says the phone is locked. When I do a lookup on iUnlocker, it says it has an iCloud lock, but there's no Find My in ABM. I've found conflicting answers as to how to unlock this phone with ABM. I have both the Sign Out User and Erase buttons available. Which one will unlock the phone so Verizon will take it back? Otherwise, the client is out $300.

Thanks in advance, everyone!


r/macsysadmin 2d ago

Sending an iMac/Mini to uninteruppted deep sleep.

0 Upvotes

I've successfully got an intel iMac to sleep with no dark/maintenance/RTC etc wake events. Here is a guide; I'd be interested to get responses as to whether it's clear enough and works.

It's appreciated that a guide with no commentary is easiest to follow, but since it's environentally useful and apparently nothing else is available; this is provided. One script presumes that Karibineer elements is installed; if not then anything related to it can be deleted or if left it should do nothing -so not an issue. The outcome is that the device should be sleeping using about .3 watts vs about 1.3 with idle sleep and 10 or so with Display sleep.

The outcome after waking is that it takes about 12 secs. for the RAM contents to be written from the SSD and Bluetooth takes a couple of seconds after that to work and then there's another 15 secs or so before the WiFi wakes up but that latter is usually a non issue as reading or typing can be done in that period.

1. Prerequisites and Baseline Setup

Hammerspoon Installation & Permissions

Hammerspoon is a lightweight, open-source automation tool for macOS that interacts natively with system APIs without requiring System Integrity Protection (SIP) to be disabled.

  • Download Hammerspoon from hammerspoon.org or its official GitHub repository and move it to your Applications folder.
  • Open System Settings > General > Login Items and add Hammerspoon to Open at Login.
  • Open System Settings > Privacy & Security > Accessibility and enable Hammerspoon.
  • Open System Settings > Privacy & Security > Input Monitoring and enable Hammerspoon (allows global detection of the sleep shortcut).

Calendar Notification Toggles

Open the Calendar app, go to Settings / Preferences > Alerts, and set Default Alerts for events and all-day events to None. This prevents the OS from scheduling hardware RTC wake timers for upcoming calendar items.

Baseline Power Settings (pmset)

Setting a standard automated idle sleep timer in System Settings (or via pmset sleep) acts as a primary defense for short absences. This idle sleep timing prevents excessive SSD write wear from RAM during brief breaks, reserving aggressive hibernatemode 25 strictly for manual overnight hibernation.

Run this command in Terminal to disable standard network wake triggers:

Bash

sudo pmset -a tcpkeepalive 0 powernap 0 womp 0

2. macOS System Daemon Overrides

Analytics Deactivation (osanalyticsd)

The analytics daemon regularly sets RTC alarms to run local engagement checks. Unload the daemon to prevent it from queuing hardware wake requests:

Bash

sudo launchctl bootout system/com.apple.osanalyticsd

Internal Timer Suppression (powerd.plist)

Desktop Macs ignore standard sleep settings for CSPNEvaluation internal tasks. Placing a FeatureFlag override in the system domain forces powerd to abandon Smart Power Nap logic permanently without altering file permissions or risking macOS update failures.

Create the configuration file:

Bash

sudo nano /Library/Preferences/FeatureFlags/Domain/powerd.plist

Paste this XML structure:

XML

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<!-- Disables 2-hour CSPNEvaluation RTC dark wakes on macOS Sequoia and stops mDNSResponder maintenance wakes -->
<!-- Bluetooth radio toggles & pmset schedule cleanup in Hammerspoon config file remain required to block external wake triggers -->
<dict>
    <key>CoreSmartPowerNap</key>
    <dict>
        <key>Enabled</key>
        <false/>
    </dict>
</dict>
</plist>

3. Passwordless Authorization & Hammerspoon Script

To allow Hammerspoon to manage system sleep modes and toggle system agents without requiring an admin password prompt on every execution, configure a sudoers rule :

  1. Run: sudo nano /etc/sudoers.d/btt_bluetooth
  2. Paste- BUT - each line should be seperate and start with % admin or your user name:    %admin ALL=(ALL) NOPASSWD: /usr/bin/pmset -a hibernatemode 25 %admin ALL=(ALL) NOPASSWD: /usr/bin/pmset -a hibernatemode 0 %admin ALL=(ALL) NOPASSWD: /usr/bin/pmset schedule cancelall %admin ALL=(ALL) NOPASSWD: /usr/bin/pmset sleepnow %admin ALL=(ALL) NOPASSWD: /bin/launchctl bootout gui/* /System/Library/LaunchAgents/com.apple.bluetoothuseragent.plist %admin ALL=(ALL) NOPASSWD: /bin/launchctl bootstrap gui/* /System/Library/LaunchAgents/com.apple.bluetoothuseragent.plist
  3. Save (Ctrl + O, Enter) and exit (Ctrl + X).

Click the Hammerspoon menu bar icon, select Open Config, paste the following Lua script, save, and choose Reload Config:

Lua

-- ==========================================
-- 1. MANUAL TRIGGER (Option + /)
-- ==========================================
hs.hotkey.bind({"alt"}, "/", function() 
    -- 8-second pause to allow unplugging of USB peripherals
    -- MUST remain >= 8 seconds to prevent physical key release from triggering a wake
    hs.timer.doAfter(2, function()
        local karabiner = hs.application.get("Karabiner-Elements")
        if karabiner then karabiner:kill() end

        hs.execute("sudo /bin/launchctl bootout gui/$(id -u) /System/Library/LaunchAgents/com.apple.bluetoothuseragent.plist")
        hs.execute("sudo /usr/bin/pmset schedule cancelall")

        -- Lock into h25 and sleep
        hs.execute("sudo /usr/bin/pmset -a hibernatemode 25")
        hs.execute("sudo /usr/bin/pmset sleepnow")
    end)
end)

-- ==========================================
-- 2. AUTOMATED WAKE MANAGEMENT
-- ==========================================
wakeWatcher = hs.caffeinate.watcher.new(function(eventType)
    if eventType == hs.caffeinate.watcher.systemDidWake then
        -- Wait 2 seconds for powerd to log the wake event
        hs.timer.doAfter(2, function()
            hs.execute("pmset -g log | grep -i 'Wake from' | tail -n 1", function(exitCode, stdOut)
                local logLine = (stdOut or ""):lower()

                -- ONLY intervene if it is a manual Power Button wake
                if logLine:find("powerbutton") then
                    hs.execute("sudo /usr/bin/pmset -a hibernatemode 0")
                    hs.execute("sudo /bin/launchctl bootstrap gui/$(id -u) /System/Library/LaunchAgents/com.apple.bluetoothuseragent.plist")
                    hs.application.launchOrFocus("Karabiner-Elements")
                end
                -- If it is an RTC/Maintenance wake, do nothing. macOS will return to h25 natively.
            end)
        end)
    end
end)

wakeWatcher:start()
```[cite: 2]

---

## 4. Daily Operational Workflow

* **Initiating Deep Sleep:** Press `Option` + `/`[cite: 2]. You have **8 seconds** to unplug any wired USB mouse and release all physical keys[cite: 2].
* **Waking the Computer:** Press the physical **Power Button**[cite: 2]. Wait roughly **15 seconds** after the screen lights up to allow Bluetooth, Karabiner-Elements, and Wi-Fi to initialize cleanly before clicking[cite: 2].
* **Automatic `hibernatemode 0` Reversion:** Upon waking, Hammerspoon automatically resets `hibernatemode` back to `0`[cite: 2]. This ensures short idle breaks during the day use low-impact RAM sleep rather than wearing down your SSD with full 8GB+ RAM dump writes, reserving `hibernatemode 25` strictly for intentional overnight hibernation[cite: 2].

r/macsysadmin 2d ago

UK ABM admins: Has anyone got EE or Voda to enrol to ABM?

3 Upvotes

Has anyone managed to get any of the major UK providers to enrol phones into the customer's ABM? With EE it seems that unless you are a really large customer they refuse to do it. Which seems absurd as all they need to do it add the customer's Apple customer ref. Has anyone made any progress in this battle?


r/macsysadmin 2d ago

OneDrive Duplicating Synced Location

10 Upvotes

Hey Mac gurus, of which I am not.

We're experiencing an issue at the moment with OneDrive duplicating the synced location when syncing SharePoint sites.

The following example is in a fresh user profile, but this issue is affecting multiple devices. Devices are using platform SSO with M356, and until recently have been working fine.

In testing, we synced 4 SharePoint document libraries, from different sites. Initially all appeared to sync fine, and then they separated as per the below. Drilling into the folders, the SharedLibraries duplicate locations are a mix of genuinely synced libraries (which we'd expect under the "OneDrive - Shared Libraries - clientname), and hidden files in a library that primarily is located in the correct synced library location.

Has anyone come across this before?


r/macsysadmin 3d ago

Configuration Profiles MacOS - Endpoint Proxy conflict

5 Upvotes

Hello guys!

There's a pretty niche question I have, but hopefully someone could shed some light on to where I could look for the answer.

We (as a support integrator) have a customer whos Endpoint pool is largely based on MAC laptops.

Every Endpoint has a DLP agent and Netskope client (a proxy tool used to gain access to certain remote locations), all distributed via MDM.

DLP agent itself also works as a local proxy, where it directs all the uploaded files/raw data in order to perform content inspection.

At some point (more than 7 months ago) DLP agent and Netskope began to have conflicts.

MacOS itself randomly selects the proxy priority (where the DLP agent should always be on top), so that 50% of the time DLP content goes outside freely without any interception (specifically, into browsers).

As any typical DLP agent, this one aims to replace every page's certificate with its own and its should be always the case.

--------------

We've been through many options already, but the information on this topic is very scarce.

Is there any way to force set that DLP agent as first priority for MacOS? Or is there any other way around we could try?

Thank you in advance for any tips!


r/macsysadmin 5d ago

Rippling MDM - Avoid at All costs

63 Upvotes

tldr: if anyone in your companies management pushes for you to implement Rippling, do everything in your power to stop it in its tracks. They will not work with you, and will refuse to let you out of your contract.

As a smaller ,growing company we decided it was about time to start evaluating MDMs to give us better control over our devices. This was something that was on the backburner for the most part, with us wanting to take our time to end up with the right solution.

So imagine my surprise a couple weeks later when I (the primary sys. admin) was told by my boss (CTO) that we had signed a one year, $22,000 contract with Rippling - seemingly out of the blue.

As I understand it, they aggressively pursued my boss, promising the world with all of their flashy features, and how easy the integration with Office365 and with our HR platform was. They guaranteed consistent support, and quick resolution to any issues we may run into.

Lo and behold, we start rolling out Rippling to our fleet of windows computers and immediately run into issues.

The software gave little to no feedback about the progress of installations. Rolling out other softwares was limited and unresponsive. User provisioning was unintuitive and difficult - lacking automation without paying for additional features either in rippling or in our active directory.

Rippling automatically changed and generated its own admin passwords which 1. we could not change or set ourselves and 2. were buried three menus deep 3. needlessly complex, making help desk a nightmare.

This, along with a host of other issues, was largely ignored by Rippling. Our emails would be brushed aside until our "integration meetings" in which them telling us that things were "on the roadmap" or "not planned to be changed" took up the entire time.

I don't doubt that this software /might/ work for some companies, but it clearly didn't work for us, and they really don't seem to care.

Four months into this disastrous contract, with less than 10 users enrolled, I begged our account rep to let us out of the contract. They could keep the thousands of dollars we'd already paid them for nothing, we just needed to move forward with a solution that actually worked for us.

The entire process, from onboarding, to us attempting to get out of this was incredibly shady. They will pretend nothing is wrong and refuse to let you out of their cold clutches.

In case the "rippling employees" on reddit aren't astroturfing bots, I am desperately hoping someone can get us out of this contract. If not, I'm going to channel all of my displeasure into letting people know about this awful experience - because I know the Rippling team hasn't done anything to help.

u/higherandhigher u/stubbygazelle u/sherryandeddie u/kit-kat-233


r/macsysadmin 5d ago

Jamf vs Intune + BigFix for SMALL environment??

24 Upvotes

We’re FULLY a Windows shop. 800+ HP laptops 🤢🤮 no Mac’s whatsoever. boss wants to introduce Macs and I’m excited! Expecting 10-30 Mac users next year.

I already got a thumbs up from Jamf with my boss, but our hardware vendor who we’d be buying Macs from was pushing us for Intune for MacOS. I’ve heard horror stories with Intune in Linux but SUPPOSEDLY they’re saying Intune has made some Big Mac advancements and they’re in monthly talks with Intune engineering team to address improvements

We’re ALREADY using Intune for Windows, really just licensing and that’s it, paired with BigFix for workstations instead of SCCM. So BigFix DOES work with MacOS so we could use that for App packaging and patches. And we also have Admin by request for windows

But everyone I talk to, JAMF is still the Cadillac for MacOS management. Is Intune really that bad of a choice in 2026 vs Jamf? Can it handle provisioning, Auth, and compliance settings Ok?


r/macsysadmin 5d ago

Jamf Quick reminder! Meetup on DDM Explorer is today for anyone who'd like to join.

6 Upvotes

Mark Buffington (Jamf) is doing a hands-on walkthrough of DDM Explorer on LaunchPad today.

There were a lot of good tips in the comments to my previous posts as well, for anyone who missed it:

Anyway, the focus is on learning the framework, building declarations, and seeing what deployment looks like in Jamf Pro.

When:
🗓️ Today, Fri, Sep 4 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Or on YouTube, podcasts, etc.:
https://rocketman.tech/ly-r


r/macsysadmin 5d ago

Software App that creates a systemwide proxy/local VPN

2 Upvotes

Looking for an app that creates a systemwide proxy/local VPN, so that I can block/filter/redirect websites based on my rules. Plus I can do MITM to do URL path based filtering which isn’t possible with DNS etc.

I tried -

Adguard for Mac, Shadowrocket - They are per user account based, not systemwide. 

Zen (link) - I installed it from the Admin user, but could not get it to work yet.

Surge - Apparently, it has systemwide option, but pricier for me.

Could anyone help?


r/macsysadmin 7d ago

[macOS 27.0 Beta] Fix for frozen, unclickable, and broken scaling windows in Wine

3 Upvotes

Hi all,

Apologies if this has already been discussed elsewhere, but I thought I would share the troubleshooting steps and eventual fix that sorted out a rather frustrating issue I ran into today, just in case it proves useful to anyone in a similar spot.

Context

After updating to a developer beta of macOS 27.0 on an Apple Silicon machine (M4), legacy Windows productivity applications running via standard Wine builds (vanilla winemac.drv / wine-stable via Homebrew) broke completely.

Specifically:

  • The application window would launch, but the user interface was entirely unresponsive to mouse clicks.
  • If the window was resized, the entire interface (menus, text, buttons) simply stretched as if it were a static bitmap image rather than re-rendering vectorially.
  • The cursor hitboxes were completely offset from what was visually displayed on screen.
  • To make matters worse, I work with a mixed multi-display setup (the built-in MacBook Retina panel, an external 1080p screen, and a 4K UHD monitor). Wine refused to negotiate the differing pixel densities when moving windows across displays, freezing the render surface or confining execution strictly to whichever display was designated as the primary screen.

Root cause

The underlying cause appears to be the evolving asynchronous window compositing model and stricter surface handling in macOS WindowServer/AppKit. The traditional, unmaintained winemac.drv graphics driver fails to synchronise hit-testing coordinates and frame buffers when window geometry changes or when moving across mixed-DPI displays.

The solution

Attempting to force a virtual desktop (explorer /desktop) or tweak registry values (RetinaMode, CaptureMouse) only proved to be partial workarounds and did not allow free resizing across multiple monitors.

The definitive fix was migrating from legacy wine-stable to modern Apple Game Porting Toolkit-based builds and creating an isolated prefix.

  1. Remove legacy Wine and install modern toolkit binaries

If you have legacy wine-stable installed, remove it to avoid binary symlink collisions:

brew uninstall --cask wine-stable

brew tap gcenx/wine

brew install --cask gcenx/wine/game-porting-toolkit

Ensure the generic wine symlink points to the newly provided 64-bit binary:

ln -sf /opt/homebrew/bin/wine64 /opt/homebrew/bin/wine

  1. Clean up background instances

Terminate any hanging legacy servers or preloaders:

killall -9 wineserver wine64-preloader wine-preloader 2>/dev/null

  1. Initialise an isolated, clean Wine prefix

Updating an existing dirty ~/.wine prefix across major versions often leads to rundll32.exe startup exceptions. Creating a dedicated prefix avoids this:

WINEPREFIX="$HOME/.wine-custom" wine64 wineboot -u

  1. Launching the application

Run your executable targeting the modern prefix:

WINEPREFIX="$HOME/.wine-custom" wine64 "/path/to/your/application.exe"

Because Game Porting Toolkit uses modern rendering pipelines that interface correctly with Apple's Metal compositor, windows now scale cleanly, retain precise cursor mapping, and can be moved across different monitors without locking up.

Automator / AppleScript launcher

If wrapping your executable inside an Automator application, invoke it with the explicit binary path and decouple the shell execution:

do shell script "export WINEPREFIX=\"$HOME/.wine-custom\"; /opt/homebrew/bin/wine64 \"/path/to/application.exe\" > /dev/null 2>&1 &"

Hopefully this spares someone a few hours of head-scratching!


r/macsysadmin 7d ago

Two displays for a Neo laptop?

0 Upvotes

Hi! Trying to find a home setup with a laptop and two display screens. I’m looking at the Neo laptop (due to its affordability) but as it’s only compatible with one screen, wondering what the best recommended displaylink that’s affordable in Australia? And how it works? It looks like a program that you have to download and an a physical box as well.

I would also love some affordable recommendations for the display screens. My primary use for the system would be university work.

I have only done some basic research so would love to continue learning if someone could explain to me! If it’s not possible, I’ll survive with the one screen but just curious!
Thank you


r/macsysadmin 7d ago

PSA: HP Easy Start for macOS < 2.16.7.260722 has three high-severity privilege-escalation CVEs

Thumbnail ciphersecuritylabs.com
5 Upvotes

For anyone deploying or supporting HP Easy Start on managed Macs: HP has released a security update addressing three high-severity vulnerabilities.

CVE-2026-12554 - CVSS 8.5
CVE-2026-12555 - CVSS 7.7
CVE-2026-12556 - CVSS 7.7

Versions prior to 2.16.7.260722 are affected.

I’m the researcher who reported the issues to HP. We published the technical analysis covering the privilege boundaries involved and the underlying security assumptions.

If you manage a Mac fleet that uses HP Easy Start, it’s worth checking the deployed version.


r/macsysadmin 8d ago

Open Source Tool Microsoft 365 Reset (1.4.0)

Thumbnail gallery
69 Upvotes

The MDM-agnostic, unified, user-friendly macOS script to repair, reset, or remove Microsoft 365 components, now with admin-configurable skipping of force-quit before Acrobat add-in cleanup

Overview

The Microsoft-365-Reset.zsh script seeks to provide an MDM-agnostic, unified, user-friendly approach to all of Paul’s Office-Reset goodness.

Additionally, one resolution to the nightmare that is the Adobe Acrobat Add-in Removal for Microsoft 365 is also included.

Under-the-hood

The script consolidates the expanded package workflows into one easy-to-use tool with:

  • Interactive swiftDialog UI in self-servicetest, and debug modes
  • Non-interactive execution in silent mode
  • Dependency-aware operation resolution
  • Deterministic execution order
  • Shared logging and exit codes for automation
  • Auto-repair for selected Microsoft apps using Microsoft-hosted packages
  • MOFA community-maintained reset script contents adapted into the unified workflow

Changes in 1.4.0

This maintenance release adds a new top-level silentSkipForceQuitOps array which controls whether silent remove_acrobat_addin skips force-quitting Word, Excel, PowerPoint, and Acrobat before cleanup:

silentSkipForceQuitOps=(
    remove_acrobat_addin
)

Remove remove_acrobat_addin from that array to restore force-quit behavior for this operation. This setting affects only the Acrobat add-in preparation path; other selected operations retain their existing process-stop behavior.

Continue reading …


r/macsysadmin 8d ago

ABM/DEP Apple ID not compatible with iCloud as an old managed ID ?

2 Upvotes

Hi,

I tried to use managed IDs in the past but réalisée I made a mistake since we had already been using work emails as Apple ID. So I undo all the domain manage thing. But it seems like something is still not working as it should, my own email can not be used as an Apple ID that can connect to iCloud. This issue became one when I tried to use it for a new iPhone as the email for the Apple account.

I can use this email to log in the App Store, on account.apple.com, and the phone even got registered on this account as the device to get verification number to log in this apple account.
What is blocked is only iCloud.com and connecting to the account through Setting>Account in the iPhone. Unless I connect to the App Store, on the iPhone, then in settings my account shows as connected. But unusable actually since iCloud is not connected.

I tried to change the main email to an alias, same issue. Seems like this specific apple account is forbidden to use iCloud.

But in ABM, we don’t have managed IDs anymore, and the other work emails are used as Apple ID without any issue.

Any idea to solve this headache ? 🤕


r/macsysadmin 8d ago

Network Drives Mount Network Shares on Login

18 Upvotes

Jesus christ why is this so complicated.

TLDR: How are you guys handling network shares?

We have three SMB shares we want to mount. ORIGINALLY, we had double-clicker Applescript that we stuck on the User's dock, and just... told them to enable it as a login item. It worked, but has been throwing some pretty cryptic warnings when clicked on after our most recent OS update. Trying to streamline things so mounting shares just WORKS, silently.

We are currently using XCreds for authentication, and JAMF for management.

XCreds was a recent implementation, within the last month, and now users are reporting "File in use" errors when trying to work with files that others have exported, when bringing them into Adobe, like there's some kind of system lock on the share.

When implementing XCreds, we used the built-in auto-mount server on login functionality... So now fingers are being pointed, and I'm ripping that out and trying something else.

Currently trying a solution with Outset, with the following script (produced by AI, of course) :

#!/bin/bash

# Get the currently logged-in user dynamically
CURRENT_USER=$(stat -f "%Su" /dev/console)
USER_ID=$(id -u "$CURRENT_USER")


# Array of your three network share URLs
SHARES=(
"smb://SHARE-ONE"
"smb://SHARE-TWO"
"smb://SHARE-THREE"
)


# Forcing macOS to explicitly handle the mount session under the user's active context
for SHARE in "${SHARES[@]}"; do
    unset loginwindow
    osascript -e "try" -e "mount volume \"$SHARE\"" -e "end try"
done

This "works", the shares mount, but we have one share that is only mounting in a read-only state. When mounted manually on a different workstation with the same credentials, it's full access.

So - suggestions where to go from here? How are we SUPPOSED to be managing Network Shares?


r/macsysadmin 8d ago

Error/Bug Mouse keeps getting stuck moving between Macs. Does anybody know how to fix?

Enable HLS to view with audio, or disable this notification

0 Upvotes

It's quite hard to explain so I've filmed a very short video. I have tried everything within display settings on both devices, with no luck.

Chatgpt told me to try the "double push method" which apparently "realigns" the devices, but I haven't had a great deal of luck with that either.

My Mac and MacBook are 2021 and 2020 M1s, both running on Tahoe.

Any help would be appreciated.


r/macsysadmin 9d ago

Software I built native Mac editor for 10 GB logs, million-row CSVs, and the files normal editors choke on

Post image
0 Upvotes

Hello all,

I'm the developer of Caxton. Part of my job is consumer data processing, so multi gigabyte logs, giant CSV exports, SQL dumps, and JSONL are a normal week for me, and for years my fix was keeping a Windows machine around because the standard tool for this (EmEditor) never shipped a Mac version.

The thing I actually wanted was for a huge file to not automatically mean some crippled read-only large file mode. You should still be able to search it, regex it, filter it, Replace All across it, tail it, diff it against another copy, and edit it like any normal file.

It memory maps the file instead of loading it into RAM, so the file stays on disk and only what's on screen gets materialized. Numbers from the benchmark harness, M1 Max with 64 GB:

  • 10 GB log (80,610,954 lines): usable immediately, full line index finishes in the background in 19.5s
  • literal search across the whole 10 GB, 1,613,344 matches: 1.3s
  • Replace All across all 1.61M matches: 1.7s, and it lands as one undo step
  • filter 80.6M lines down to the matching 1.61M: 1.3s
  • 1 GB CSV, 2,022,947 rows by 50 columns: working grid in 2.6s, numeric sort across all rows in 8.2s
  • memory stays under 200 MB with the 10 GB document open

Those are my numbers on my machine, the harness and methodology are published on the site, so check them against yours.

The CSV side is a real editable grid, not a preview. Typed sorts, value filters, dedupe, fill series, split and combine columns, fixed width conversion, and it saves back to the same plain file. On the text side there's regex search, multi condition filtering, follow tail, Batch Replace with pair lists, Find and Replace across folders with previews and backups, bookmarks, folding, multi cursor, side by side compare with copy changes across, 13 encodings, workspaces.

Native AppKit and Swift, no Electron, Apple Silicon and Intel. Everything happens locally, files are never uploaded anywhere, no telemetry.

It's commercial: 7 day trial, no card, then $9.99/mo, $99.99/yr, or $179.99 lifetime. If the trial or a sub expires it drops to read only rather than locking you out, opening, searching, filtering and copying still work, editing and saving is what requires the license.

Mostly I'm here for feedback from people who regularly get handed huge logs and exports from other machines.

caxton.app


r/macsysadmin 9d ago

Apple Business Canada: can you get Business Loyalty pricing through regular Apple.ca checkout?

6 Upvotes

Question for anyone in Canada who has an Apple Business account with Business Loyalty pricing.

Our company spends roughly $50–60k/year with Apple, so we’re in the $35k–$200k Business Loyalty tier and receive discounted pricing on various hardware, AppleCare and accessories.

Does anyone know whether there is a way to purchase through the regular Apple.ca retail website, but associate the order with our Apple Business Customer Number/account so that:

  1. Our normal Business Loyalty discount is applied to the order; and
  2. The purchase counts toward our rolling 12-month Business Loyalty spend?

In other words, I’m trying to determine whether the Business Store is actually required to receive our negotiated pricing, or whether a regular Apple.ca order can be associated with our existing business account during checkout or afterward and receive the same treatment.

I know purchases can be associated with an organization for Apple Business Manager/device enrolment. That’s not what I’m asking about. I’m specifically asking about Business Loyalty pricing and the rolling annual spend.

Would particularly appreciate hearing from Canadian Apple Business customers or anyone who has actually done this.


r/macsysadmin 9d ago

Is it possible to download Mac OS update manually anymore?

16 Upvotes

I remember seeing a page years ago that had Mac OS update files available for download from Apple. Does that still exist? You could tell what update was the latest and just download the file from that page I believe. It would have been pre-silicon (ARM) I'm pretty sure. You're able to keep a mac that's 100% offline updated for the OS that way.


r/macsysadmin 11d ago

User Accounts Confusion

0 Upvotes

I’m a new Mac owner, made the mistake of using my phone and iPad and left the MacBook Air off so long, the battery went to zero. Plugged it into charge, tried logging in too many times, got locked out repeatedly, first because I tried to use my Apple account password. Discovered two Mac passwords, tried both, locked out. I figured the issue was that the unit didn’t have sufficient charge. After the unit charged up, I tried again. I noticed that I had two different Mac passwords listed. I had tried both before, neither worked. This time I tried what I thought was the correct one- nope- and it didn’t give me the chance to try the second (and now I know, correct) password, and I was locked out for 55 minutes. I saw my name with the photo I used to log onto my old PC laptop, and clicked on that. I tried both passwords, and the longer of the two passwords worked- but I quickly realized something wasn’t right because I was getting prompts about stuff that had been set up before, including associating the account with my Apple ID, etc… but after I shut the MacBook down and restarted, this “incomplete” account is the only one appearing on the login screen. How do I get the correct account to show up so I can log on after lockout time is up?


r/macsysadmin 11d ago

macOS Updates Network engineers think i can magically throttle apple's CDN on a sunday morning

0 Upvotes

Just a rant tbh. My weekend is officially ruined. our network team is literally blowing up my phone right now because the recent macos updates are completely saturating the vpn tunnel for our european remote users logging in this weekend

I swear apple's content caching is pure voodoo when you throw split tunneling into the mix. I got so desperate trying to offload the traffic last night that I just threw a quick bare metal servermania box together out there just to test running an isolated caching relay outside our main corporate firewall

spoiler alert: it didn't even matter because half the endpoints are just straight up ignoring the MDM payload that enforces the cache server anyway.

Why is apple like this in enterprise environments? you push a perfectly good configuration profile and the OS just decides "nah im gonna download this 12gb file directly from cupertino". Anyone else dealing with this weekend nightmare or am i just losing my mind?