Apple Configurator only runs on macOS. If your IT team is mostly on windows, someone ends up keeping a mac around just to revive and restore the others. I got sick of that, so I built restorekit.

The software is a cli and desktop app for macOS, windows and linux. Plug into the target's DFU port, run `sudo restorekit restore`, and it detects the mac, downloads the right firmware and restores it. It works on T2 and Apple Silicon. The desktop app restores several macs at once, keeps a history log and exports serials/ECIDs to CSV. The cli has `--json` on most commands for scripting.

The hardware part is dongle-lite. Putting a mac into DFU automatically takes a USB-PD message that PC ports can't send, so from windows or linux you'd normally be stuck doing the key combo. dongle-lite sits between your computer and the mac and sends it for you. It also gives you the target's serial console, which helps a lot when a restore fails and you want to know why.

Everything is free and open source: https://github.com/fcjr/restorekit

I just put another order in from my manufacturer for the dongle so if you are interested in grabbing one: join the batch 2 list at https://www.restorekit.org/#dongle

I'd love feedback!

A recent refactor of SYM-Lite led to a happy accident for fresh installs of Homebrew with Standard macOS users

Background

During a recent refactor of SYM-Lite (1.6.0), I switched Homebrew’s initial installation from an internal, scripted approach to the official .pkg via Installomator.

While Homebrew was technically installed, its installation was in a state of flux: git was missing, meaning that (at least) the following commands were sideways:

• brew -v
• brew update
• brew upgrade

I started down the [Feature]: Auto-install git via Homebrew when missing so brew isn’t degraded road, but ended up with:

dan@Mac ~ % brew -v
Homebrew 7.0.9-dirty

That -dirty suffix means the tracked files in Homebrew’s own git checkout don’t match HEAD. Homebrew mostly worked (bottles and casks still installed), but a brewed git arrives too late to tidy up a checkout that was laid down without one, and leaving every Standard user with a “dirty” Homebrew wasn’t an option.

To my utter amazement, a four-year-old script by Rich Trouton still worked as expected with macOS 27.2 Beta 3, so I closed Feature Request #26 as “not planned,” and opened [Feature]: Install Command Line Tools when git is missing so Homebrew isn’t degraded.

Secret Sauce

The “secret sauce” of this approach was to first install Apple’s Command Line Tools only when git wasn’t already present on the Mac.

Continue reading …

yep, it’s true. lmk

How do I let 3 people use one Mac mini at the same time, each in their own account, without lag?

Hi everyone! I have a Mac mini (M4 Pro, 24 GB of memory, 512 GB drive) and 3 people who need to use it. One will use a MacBook, one a Windows PC, and one a third device. Each person has their own user account. I want it to work like a cloud server: everyone signs in remotely, works in their own desktop at the same time, and never notices the others. Ideally macOS would share the memory and processor between everyone automatically.

What we've tried so far:

\- Apple's built-in Screen Sharing: it can give each person a separate session, but it's laggy even on wired ethernet. It sends the screen as still pictures instead of video.

\- The fast video-based remote apps: they feel close to native, but they can only show whoever is on the physical screen. A second person either can't connect to their own session or kicks the first person off.

\- Open-source remote desktop servers for Mac: we read their code. Each one allows only one session at a time, or takes over the physical screen.

Has anyone actually gotten 2–3 smooth, separate sessions running on one Apple silicon Mac? What worked for you?

I work in post-production and our edit/VFX machines sit in a server room, extended to the desks with Thinklogical TLX 10G fiber extenders. I'd like to replace a pair of 24" 1920x1200 monitors with a single 34" ultrawide (3440x1440 @ 60Hz), and I'm trying to find out whether the hardware can do it.

Setup:

- TX: CHS 4 Quad Chassis with a TLX-TMM-U00D22 module

- RX: CHS 2 Dual Chassis (firmware V25.07) with a TLX-RMM-U00D22 module

- Source: Apple Mac Studio (macOS)

- Multi-mode fiber, LC

- Current monitors: dual 24in EIZO 1920x1200 @ 60Hz

What I've seen so far:

- A previous ultrawide I tried (34", 3440x1440) came through as a stretched 16:9 image, which looks like macOS only being offered 16:9 modes by the KVM's EDID

- The CHS 4 front panel has a "Load EDID Table" menu that currently says "No Table Load"

- I can't find a datasheet for these exact module part numbers, so I don't know the max pixel clock per head or whether single-head mode gets more bandwidth than dual-head

- I've emailed Thinklogical support and haven't heard back yet

Questions:

1. Has anyone gotten a 3440x1440 or similar 21:9 resolution through TLX modules, and which modules?
2. If the limit is just the EDID the extender presents, did a custom EDID (via the chassis menu, an EDID emulator, or on the Mac side with something like BetterDisplay) fix it? Or did the signal fail further down the path?
3. Any idea what the "D22" in TLX-TMM/RMM-U00D22 means for video format and head count?
4. If it turns out to be a hard bandwidth limit, what did you use instead (a different extender, a second computer at the desk with remote desktop, etc.)?

I haven't changed any settings on the chassis, since the CHS 4 serves other stations. Any experience or pointers appreciated, including "it won't work, don't bother." Thanks!

Basically whenever I want to access the users keychain, it asks me for the users password (Which is synced to the AD password and jamf connect), and when I enter it, it takes it but it doesn't bring up the GUI of the keychain. Same thing when I try to add a fingerprint, it asks for the users password, it takes it, and then it doesn't take me to the GUI prompt.

I think something is broken with the keychain/authentication because now outlook kicks them out too. I had a work around, I was using their old password to access the keychain and that was working, but now it's not working.

Basically whenever a prompt comes up asking the user to enter their current password to change any setting, it accepts it, then it doesn't bring up GUI of the application I'm trying to access like Keychain cause the authentication is broken.

Hello,

One of our customers has recently had an issue deploying the Falcon Mac sensor with Mosyle. They are using the newest CrowdStrike installer (8.10) for their installation package, but most of their devices are set to run version N-2, as CrowdStrike recommends. This has created a situation where Mosyle constantly deploys 8.10, and CrowdStrike knocks it back down to N-2.

Since I'm not very familiar with Mosyle, I'm hoping someone can suggest ways to build the deployment package/profile.

I've seen a couple of suggestions. Do either of these seem like the correct call in your view?

1. Create a Device Group that only targets devices where the Falcon sensor is not currently installed. Tell Mosyle to target the deployment only at this group.

2. Maintain the installer package to the current version we're running, N-2.

Interested to hear your thoughts and suggestions. I'm hoping something similar to the Device Group situation is possible since that seems like a better long term solution, requiring less maintenance/upkeep.

🎸 The next Music City Mac Admins meetup is happening Friday, October 16th, from 5–8 PM at Fat Bottom Brewing in West Nashville.

We’re excited to welcome Maz Kahale, Global Director of Solutions Engineering at Iru, for:

“What Is MCP, and Why Should Mac Admins Care?”

Join us for a great evening of learning, conversation, and connection with the Nashville Mac admin community.

🍻 Food and drinks provided thanks to Simply Deploy IT and Iru.

⚠️ Limited spots are still available, so if you’ve been thinking about joining us, now’s the time to reserve your seat.

🎟️ Register here

We’ll see you in Music City! 🎶

Quick question for Mac admins. When a user's Mac fills up (System Data ballooning, caches, Xcode, Adobe, failed macOS updates because there isn't enough free space), how do you handle it today?

- Do you just watch free space in your MDM, or set alerts?

- When a Mac is full, how do you find out *what* filled it?

- Is "what grew and why" something you'd actually want to see per Mac, or is free space plus a cleanup script good enough?

Context: I'm a solo Mac developer and I've built a consumer app around storage history. I'm trying to work out whether something like this would be useful for admins at all, before building anything. Not selling anything here, just want to hear how you actually do it.

Hi everyone. Pretty much a new Mac sys admin.

Inherited a Mac fleet but using 2 different MDMs.

Ivanti for iPhones
Apple business for Mac’s/ipads/Apple TVs.

I come from an MSP and some jamf experience, and i am the first IT person.

Tried to pitch some MDMs as jamf/Iru but I am getting shut down because they are not publicly traded. Companies

My question: Is Intune good enough now to manage a full Mac fleet?

I am also being tasked to get SOC2 type 2 compliant as well.

Thank you

I'm trying to run 3 external monitors independently on my M1 MBP. I have watched countless videos and articles and used GPT to try and sort out what works and what doesn't. But I seem to be lost in a rabbit hole now.

Does anyone have real world expierence using anything that they can confirm working? If yes can you give me the exact name and model number please? Thank you in advance!

For backup disks that live on a dock: no more "Disk Not Ejected Properly". Here is a small Folder Action on /Volumes that, when the disk appears, runs tmutil startbackup --block if the last backup is older than a set interval, then unmounts the disk.

Nothing to install: one zsh script and Automator. It needs Full Disk Access for FolderActionsDispatcher, logs to ~/Library/Logs, and leaves the disk mounted if anything fails, as a visible signal.

https://github.com/mous-design/backup-action

Hope it's useful to someone.

Cheers!

A security-hardened upgrade to Mac Admins’ new favorite “set-it-and-forget-it” DDM macOS update reminder, featuring corroborated DDM declaration validation and “Update Tonight” awareness

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines, delivering a more prominent end-user reminder dialog.

🆕 5.0.0 Highlights

• Update Tonight awareness: Confirmed same-day Update Tonight scheduling for the target version pauses normal reminders until local midnight. Evidence must be logged by softwareupdated; pre-deadline thresholds, aggressive mode, and Force mode still apply. 
• DDM Emergency Fallback: Jamf Pro Script Parameters 5 and 6 can persist an emergency version/deadline requirement at /Library/Management/<rdnn>/dor-fallback-declaration.plist. Runtime can select it after recognized unresolved DDM states; confirmed DDM always wins.

Continue reading …

Hi everyone. I am sharing this technical report to alert the community about a serious security compromise I just analyzed and cleaned on my local development environment. Someone managed to inject persistent malware and disable administrative controls to prevent remediation.

I have attached terminal screenshots showing the evidence. Here is the breakdown of the compromise:

1. Terminal Sabotage (Sudo Bypass via PAM)

The threat actor modified `/etc/pam.d/sudo_local` by injecting an unauthorized directive pointing to an external module (`/opt/homebrew/opt/pam-u2f/lib/pam/pam_u2f.so`). This deliberately broke the `sudo` command. Every time I attempted to use my password to clean files, the terminal threw a systematic `unable to initialize PAM` error, stripping away my root permissions.

1. Hidden Binary Arsenal (~/.local/bin)

Upon auditing environment profiles, I discovered that on September 18, 2026, a malicious installer tied to the Antigravity suite created a hidden `.local/bin` folder containing keyloggers and persistent tools:

- agy (187 MB): A massive executable binary acting as the background engine.

- hermes / hermes-agent: Spyware binaries focused on data exfiltration.

- Fake Node/npm symlinks: Redirected globally to `~/Library/Application Support/Zed/node/...` to intercept development environments.

1. Evasion via Trash Injections (TCC/SIP Exploitation)

To prevent remediation, the malware nested corrupted directories within `~/.Trash/Caches` using legitimate Apple daemon names like `com.apple.aned` (Apple Neural Engine). macOS was tricked into blocking deletion, throwing `Operation not permitted` errors under the protection of SIP. The malware leveraged this hardware lock to masquerade its network traffic under fake Siri and iTunes background calls, which were caught by LuLu firewall rules.

🚨 Apple Support Inaction and Lack of Response

I want to report the absolute lack of assistance from official Apple support. Despite providing physical evidence and running heavy remote logs under their supervision (`sysdiagnose`), Apple failed to provide any technical solution. Their automated systems failed to flag a 187 MB suspicious binary operating in developer paths. This required a manual, line-by-line forensic investigation.

I have fully reclaimed control by purging `~/.local/bin`, cleaning the corrupted profile configurations, and blocking all suspicious connections via LuLu. I am leaving this open for discussion and log analysis.

Dealing with this for about 2 months now so hoping someone's hit it before.

Managed MacBook Pro, Intune enrolled. AirDrop, AirPlay and Sidecar are all dead. AirDrop sees the device fine over AWDL but just sits on "Waiting" forever and never actually transfers. Weirdly Universal Clipboard still works. Same Apple ID everywhere, AWDL is up, no applicationaccess restrictions blocking anything.

Dug into it myself and found firewallBlockAllIncoming = 1 sitting in /Library/Managed Preferences/com.apple.security.firewall. Took that to IT.

Their current theory is there's an old Device Configuration profile and a newer Endpoint Security Firewall profile both trying to manage the firewall, and they're stepping on each other. They turned off "block all incoming" in the console, synced, waited... still enforced on my machine weeks later.

What made me believe it's actually a profile issue and not something wrong with my specific Mac: a colleague had Intune ripped off his identical model and everything started working again immediately.

Anyone dealt with two firewall profiles conflicting like this?

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

• Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
• Interactive selection UI — Checkbox dialog with per-item icons; selectable items start checked and previously installed items are automatically disabled
• Homebrew support — Casks and formulas run in the logged-in user context (with ~/Applications for non-admin users) and never hang on a sudo prompt
• Inspect Mode — Real-time progress monitoring in a moveable, minimizable window
• Silent mode — CSV-based automation support

Continue reading …

Hello,

Just want to make sure I'm not going crazy. I'm a windows admin, but we are trying to manage a few mac using Intune, and wanted to implement PSSO using secure enclave with Entra ID login for use with a few Macs that are used as shared device.

All in the implementations feel ... clunky to me, but we get it working. Users can connect with their Entra ID login.

However, when changing a password by SSPR, the local user password seems to not update.

Is that the intended behavior ? it doesn't seem so, from ms doc : macOS Platform single sign-on known issues and troubleshooting - Microsoft Entra ID | Microsoft Learn It seems it should synchronize in a few hours. It does not, in my experience.

Anyone has battled with this beast ?

I manage about 30 MacBook Pro’s for a high school class that uses Adobe products. Everything has been working without issue for years and over the summer I reset them and installed macOS 26, as well as pushed out the Adobe package which includes the required apps (I do this every summer).

Everything seemed to work fine during the first month of school, but suddenly all of the Macbooks are getting a message stating CCLibrary is damaged and can’t be opened. Clicking “ignore” will bring the message up again, so it can’t be closed.

All of the Macbooks are managed via Mosyle MDM and I have a privacy profile for all of the Adobe apps that allows the apps to have Full Disk Access, as well as access to the Desktop, Documents, and Downloads folder. I added a profile for the “CCLibrary.app” to give it Full Disk Access as well as the aforementioned folders, but the issue is still persisting.

Does anyone know anything about this? I’m not sure what CCLibrary even is (I don’t know much about Adobe products, I just install them lol).

I’m troubleshooting a Mac printing issue with a Canon imageRUNNER ADVANCE DX C5850.

Certain characters in PDFs, especially an en dash (–), print as a boxed question mark. This happens across multiple PDFs.

Environment:

• macOS 26.2, Apple Silicon
• Adobe Acrobat
• Canon C5850
• Direct IPP connection: ipp://<PRINTER-IP>/ipp/print
• Canon C5840/5850 PPD
• Driver version 10.19.23

Troubleshooting so far:

• Normal Acrobat print through Canon driver → fails
• Acrobat Print as Image → works
• Canon Vector Mode → fails
• Canon Raster Mode → fails
• Temporary Generic PostScript queue → works
• Same document containing an en dash printed from Windows to the same physical printer → works

The Generic PostScript queue isn’t usable as a permanent fix because it loses the Canon-specific paper/tray support. It only advertised Letter/Legal/A4/B5 and would not properly handle 11x17.

The Canon queue otherwise works correctly for 11x17, trays, etc.

Printer-side job logs show the affected jobs completing successfully with no errors.

So at this point it seems isolated to the Canon macOS driver/PPD/filter path, specifically version 10.19.23, rather than the PDF, network, or copier itself.

Has anyone seen this with Canon’s Mac drivers, or found a fix that preserves the full Canon tray/11x17 functionality?

Hey r/macsysadmin,

I recently sat the Apple Deployment & Management exam and built two free practice quiz sites to help me revise. Figured I'd share them here in case anyone else is studying for DEP-2026.

🔗 Quiz 1 (80 questions): https://rakshit-swami.github.io/apple-mdm-quiz

🔗 Quiz 2 (108 questions): https://rakshit-swami.github.io/apple-ddm-quiz

📖 Study notes: https://github.com/rakshit-swami/apple-ddm-quiz/blob/main/STUDY_NOTES.md

Both are based on Apple's own free IT Training course:

https://it-training.apple.com/deployment/tutorials/course/

Features:

- Questions randomised every time

- Multi-select questions supported

- Instant feedback and explanations after each answer

- Full review at the end

- Completely free, open source, no account needed

Completely unofficial — not affiliated with Apple in any way. Questions are written in my own words for revision purposes.

The source is on GitHub if anyone wants to fork it and add their own questions. Good luck to anyone else studying!

Hi everyone,

I bought a 2020 MacBook Air (Intel i3, T2 chip) on Facebook Marketplace about three years ago. I’ve used it for school with my own Apple account throughout that time, without any issues using the computer.

I recently decided to sell it, but when I tried to reset it, it asked for the previous owner’s Apple account password to turn off Find My. Apparently, it was still linked to their account despite me using my own account.

Unfortunately, the previous owner has passed away. I don’t have the original purchase receipt, only the bank transfer from when I bought it.

I contacted Apple Support, and they told me to erase and reinstall macOS. After following those instructions, the Mac is now stuck on the Activation Lock screen, and I can no longer use it.

Is there any way to bypass or remove Activation Lock on this specific model? Has anyone successfully resolved a similar situation with Apple using proof of a secondhand purchase?

How are y’all restricting people from updating to golden gste? In the past I just did a Restrict Software and that blocked it. Apparently from what I’ve read that won’t work with Golden Gate and that one would need to use Blueprints. If so what setting exactly restricts it? I see a 90 day deferral and that’s it.

How do I change this password/find it?

(I gave my old MacBook Air to my brother and he is trying to “start it over” so he can connect his own Apple-id and just also have it “as new”. I just cant remember what this password would be and we are stück)

I’m at 20% of my fleet so far and hoping to open it up to production in the next 2-3 weeks. Stack all seems fine, not enough M6 models (yet) to be affected by the external monitor issues.

What’s your adoption so far? Any showstoppers that are keeping you in deferral or tester feedback?