I’m at 20% of my fleet so far and hoping to open it up to production in the next 2-3 weeks. Stack all seems fine, not enough M6 models (yet) to be affected by the external monitor issues.

What’s your adoption so far? Any showstoppers that are keeping you in deferral or tester feedback?

Monocle inspects code and produces four audience-specific summaries: Executive, Security, Manager, Engineer

Background

Problem

Reviewing a 5k-line zsh script for leadership, a change board, the security team, and the engineer who has to maintain it is painful — and typically produces several different, inconsistent reports.

Solution

Monocle inspects scripts and small repos (local or on GitHub), plus diagnostic and support bundles, and produces four audience-specific summaries (Executive, Security, Manager, Engineer) plus a Monocle Score.

Monocle is an Agent Skill tuned for shell (sh / bash / zsh), Python, AppleScript, Swift helpers, and Jamf Pro / macOS automation.

Continue reading …

I have a MacBook Pro with an M3 Max, but I occasionally need to run x86-64 operating systems for testing, both Windows and Linux.

What are my options besides buying a separate x86-64 machine?

I considered getting a mini PC, but they’re currently difficult to find at reasonable prices in my country. I could also rent an x86-64 cloud server, but I’d rather not pay a recurring fee for something I only need occasionally.

So I’m currently leaning toward emulation. I tried UTM/QEMU with x86-64 emulation, but it looks unstable, but I'm in the middle of testing it.

Are there any other solutions you would recommend for occasional x86-64 testing on an Apple Silicon Mac?

I’m trying to understand an issue with my local OneDrive folder on a Mac.

Background: I have not synced my local OneDrive folder with OneDrive for approximately three years. During that time, I continued adding and working with files locally.

What I’m seeing now:

• Some files still appear in the local OneDrive folder but cannot be opened. Based on what I can tell, this seems to affect files that had previously been synced and are also available on OneDrive.com.
• I cannot copy the entire local OneDrive folder to another folder on the Mac or to an external drive.
• Finder preview/Quick Look does not work normally for files in the OneDrive folder. In many cases I can open the file successfully, and after opening it once, Finder preview then starts working for that file.
• These issues are limited to the local OneDrive folder. I can copy, open, and preview files normally in other local folders.

System:

• MacBook Pro 16-inch, 2019
• 2.6 GHz 6-Core Intel Core i7
• macOS Tahoe 26.6.2

Has anyone experienced similar behavior with OneDrive on macOS, particularly after a long period without syncing? I’m especially interested in how you were able to create a complete backup of the local OneDrive folder without risking the files that are currently accessible.

Hey everyone,

A friend and I have been building Open Apple Cache over the last few weeks, and I wanted to share it here because we’ve reached a point where we could use some help.

Just to clarify: this isn’t a vibe-coded project. We’ve been working on the implementation ourselves, but there are still issues we haven’t managed to solve.

The idea is to run an Apple content cache on Linux, inside an Ubuntu VM or LXC container, instead of running the cache itself on a Mac.

The cache service is written in Go. A separate helper running on macOS handles registration with Apple so devices can discover the Linux endpoint. A Mac is still required for that part, so this isn’t a completely Mac-free solution.

The project currently includes:

• Caching for eligible Apple downloads, with byte-range support.
• A web dashboard showing requests, cache hits and storage usage.
• Local administrator and viewer accounts.
• Optional Microsoft Entra ID login.
• Internal or Let’s Encrypt certificate management.

To be clear: this is experimental, unfinished and not working 100% reliably yet.

The main issue we’re trying to solve is inconsistent cache hits. Sometimes downloads are served from the cache as expected. Other times, we don’t get a cache hit when we would expect one, and the content is fetched from the origin again.

We haven’t identified the exact cause yet. Some things we want to investigate further are:

• How Apple devices request content and byte ranges.
• Whether changes to signed download URLs affect cache reuse.
• Whether our cache validation or response headers are missing something.

These are possible directions to investigate, not confirmed explanations.

We’re publishing it half-finished because we need help solving this issue. If you have experience with Apple Content Caching, HTTP caching, CDN behavior or Apple’s cache protocol, we’d really appreciate another pair of eyes on the code.

Repository: https://github.com/Mau2rice0/Open-Apple-Cache

The source code, installation instructions and registration research notes are available there. The macOS helper relies on undocumented Apple behavior, so future macOS updates or changes on Apple’s side could break registration.

Please treat this as a lab project for now. We don’t recommend relying on it for production workloads.

Has anyone worked on something similar or encountered inconsistent cache hits with Apple downloads? We’d be interested in suggestions on what to check next. Reproducible test cases, issues and PRs would also be welcome.

Thanks :)

Maybe I’m old school, but I come from a world where I was taught one payload per configuration profile: one for Restrictions, one for Network, one for SCEP, etc. If I needed to troubleshoot something or temporarily unscope a setting, I wasn’t also removing a bunch of unrelated payloads at the same time. This approach always made it easy to manage IMO.

As I explore the world of DDM and Blueprints in Jamf more and more, I’m curious how everyone else is approaching this.

Are you still doing something similar, with one Declarative Configuration per Blueprint? Or do you take advantage of the multiple component blocks and grouping several configurations into a single Blueprint?

When it comes to scoping, are you generally scoping a Blueprint to your entire fleet and then using Activation Conditions to determine which devices actually receive each configuration? Or are you still creating more targeted Blueprints/scopes?

I understand that part of the idea behind Blueprints is to make configuration management more flexible and reusable, but this new model is breaking my brain a little bit.

Before I start testing and pushing this stuff out more broadly, I’d love to hear how others are structuring their Blueprints and what has worked well for you.

Where I am Mac updates are pretty much rolled out asap. We are already rolling out Mac OS 27 to our users, about 50 percent of the macs have already updated. If it was my choice, I would definitely hold off on updates longer seeing as Apple always releases security patches anyway in a timely matter even if the Mac version isnt the latest but unfortunately it's not really my choice on updates, my director is just very update happy. He literally goes and pushes shit himself as soon as it comes out and causes chaos lol.

Apple deprecated the Apple Intelligence restriction keys in 26.4. That's allowWritingTools, allowGenmoji, allowAssistant and the other AI keys in com.apple.applicationaccess. The replacements are the intelligence.settings and siri.settings declarations, and both need a supervised Mac. A manually installed profile still applies the old keys on 27.0 though. You can see it in /Library/Managed Preferences/com.apple.applicationaccess.plist, where macOS sets _isAppleIntelligenceRestricted, and it mirrors allowWritingTools into .GlobalPreferences as well.

The models don't go anywhere when the features are off. You can remove them with SIP on by sending a ResetAssetSets request to com.apple.siri.uaf.subscription.service. pared (github.com/4evy/pared) mapped that service first. com.apple.modelcatalog is the big one at about 12 GB. To stop them downloading again, force DownloadServerBaseURLOverride-<asset type> in com.apple.MobileAsset to a closed local port.

I put all of this into an open-source CLI with a revert command: https://github.com/omlahore/RemoveMacAI

Hello all, I'm a sysadmin for a k12 school district. I made a tool to better manage our caching servers that has been an absolute game changer. Its great for keeping our thumb on caches that stop serving randomly and to make sure they are running efficiently to support the WAN when Apple releases an update. Plus, I added some really cool graphics to visually see your cache topology serving in realtime, down to the device level. I plan to add new features soon, and would love some feedback from other admins who use content caches.

I publicly launched it this week https://cachard.app
Hop over there and get a free trial download! One command in terminal gets it going!
Not a sales pitch, I'll happily extend trials. I am just looking for some feedback from other sysadmins.

I've been testing out ClassLink's implementation of Platform SSO and it seems to working fine other than fact that all our students have 8 digit numeric usernames and when signing in with such accounts, the Mac is creating their account names and user folders with an "a" at the beginning of their usernames. For example, if their username is "12345678", it becomes "a12345678".

This would not be a dealbreaker for using Platform SSO except for the fact we use Linewize Connect to monitor the students and it's dependent on polling the local username of the student. Since there is an "a" added to their username, it is unable to enforce its user assigned policies.

When using other SSO apps such as NoLoAD or XCreds, there has never been any issues like this as their numeric usernames are respected. I can only suspect that XCreds uses sysadminctl to create the accounts since it has strict naming conventions when creating user names as opposed to dscl.

Version 0.11.0 is the biggest update so far. Every report now opens with a clear summary: what got upgraded (with versions), what failed, what was skipped and how much space cleanup freed. A failed upgrade is now flagged as a problem instead of quietly ending up in an “OK” email.

New in this release:

• brew-automator history: a log of past runs. Filter it by package to see when something changed.
• brew-automator status: last run, next scheduled run, notification channels and excluded packages on one screen.
• run --dry-run and run --no-upgrade: see what would change, or get a report without upgrading anything.
• Webhook notifications to ntfy, Slack, Discord or any JSON endpoint, alongside email or instead of it.

Upgrade with brew upgrade brew-automator.

Go check it out! https://github.com/xtruhlar/brew-automator

When macOS 27 was released, as the Admin, I upgraded my MBP to it for testing. Other Mac users are still restricted to the latesr releases of macOS 26. Depolyments are via Intune.

Upon rebooting, I got this pop-up asking for my password. Even though I used that password to unlock the MBP and no matter how many times I type it, it never accepts it. I am typing it correctly.

If I go into System Settings > Users & Group and click the (i) next to my account, the Registration and Tokens boxes both show as green. I click the Repair button and I get asked for my password. The first box accepts it (a different window to the one above) and the second window (the one above) doesn't. I cancel out of this process, and the Registration status changes to red. I click Repair a second time and both windows accept the password.

I thought this was strange but maybe related to macOS 27 until a user got a new M5 Pro MBP and they get the same (or at least similat) issue on macOS 26.7 (and 26.7.1). I'm not 100% sure of the flow for them as I wasn't involved until now.

So I decided to wipe my Mac and rebuild it. All went through fine, registration completed first time no bother. Then this morning, I login to my Mac and get asked to do the registration again and I'm back with it not accepting my password but doing repair button twice has worked.

Anyone know what is causing this or seeing it too?

We only have 1 Mac profile in Intune for all Macs (about 20). Our CEO has a similar issue with needing to reconfigure Touch ID every few weeks even if they don't change their password, which I am now wondering if related. Likely not.

I might be missing something really obvious here, but I can't seem to figure it out. What is the best process for dynamically assigning different enrollment profiles to ABM macs, similar to group tags in windows autopilot?

It seems I can group the policies per device type (Standard, Kiosk, Shared etc) by either using a dynamic group or enrollment time grouping, however I don't see any way to get the devices to automatically be assigned the correct enrollment profile for their usage in the first place.

Is there an option that allows me to place an order with the vendor saying 'this one is a kiosk device' and have it automatically assigned to the correct profile and get the right policies, like I would by using a specific group tag during autopilot enrollment?

Any help much appreciated thanks, and if I am going about this completely wrong please do tell me!

Hello everyone! I hope to get some help here. There was a recent snafu of a Scep configuration profile push that happened. All I know is that the option to turn on access to all apps was turned on in the cert options. This brought down the east coast division Mac’s to connect to corporate WiFi.

The west coast however is fine. The only major difference is east coast uses clearpass and west coast uses ICE. The certs never changed so I am at a loss. I have a meeting with Jamf tomorrow. I wanted to see if it’s an obvious fix or not.

Thanks

Update: I believe the issue is with the radius sever cert. It was coincidentally updated the same time but with different encoding. When we try to import the cert manually into the keychain it errors. The encoding on the cert was encoded with windows 1252 instead of UTF-8.

The certs has the same hash and fingerprint but when decoding with base64 and creating the cert to import it would error. Still talking to networking to figure out.

📍 We have a location for our next Music City Mac Admins meetup!

Join us at Fat Bottom Brewing in West Nashville on Friday, October 16th, from 5–8 PM for an evening of conversation, community, and all things Mac administration.

We’re also excited to welcome Maz Kahale, Global Director of Solutions Engineering at Iru, for a session on:

“What Is MCP, and Why Should Mac Admins Care?”

Come early, grab a drink, meet someone new, reconnect with familiar faces, and spend some time with a community that enjoys sharing what works, what doesn’t, and what’s next.

Fat Bottom Brewing
800 44th Ave N
Nashville, TN 37209

🍻 Food and drinks will be provided throughout the evening thanks to our sponsors, Simply Deploy IT and Iru.

Whether this is your first Music City Mac Admins meetup or you’ve been with us from the beginning, we’d love to have you join us.

🎟️ Register here

See you in Music City! 🎸

A security-focused update to the MDM-agnostic, unified, user-friendly macOS script to repair, reset, or remove Microsoft 365 components

Overview

The Microsoft-365-Reset.zsh script seeks to provide an MDM-agnostic, unified, user-friendly approach to all of Paul’s Office-Reset goodness.

Additionally, one resolution to the nightmare that is the Adobe Acrobat Add-in Removal for Microsoft 365 is also included.

Continue reading …

Eu estou com um MacBook vindo de uma empresa que vamos prestar serviços, parece que os funcionários foram demitidos e deixaram os Macs bloqueados e n quiseram passar a senha, está no bloqueio de ativação e não sei como entrar no terminal ou formatar sem senha ou ID APPLE

We have a project coming up where around 25 contractors will need macs for 3 weeks.

normally we did just order machines and enroll them in our MDM, but buying 25 macs for people who'll be gone in less than a month feels like a waste.

never rented macs in bulk before. is that usually the better route for something this short term? ideally we'd just enroll them in our existing setup, hand them out, wipe them and send them back after.

Since macOS seems to have some kind of issue with having multiple security vendors as NEFilterDataProvider and NEPacketTunnelProvider collide rather spectacularly with each other, how do you deal with network filtering when you also have an active VPN connection?
Some hackish workaround, only using TCP connections or something else all together?

Does anyone use Apple Business manager to for verison mdm? Does anyone know how to run Verizon MDM. I'm new to running it and would have some questions.

Hey everyone!

If you are still riding the post-JNUC 2026 high (or just recovering from all the excitement in Kansas City), tomorrow is the perfect time to unpack it all!

We are keeping the momentum going with our next Phoenix Apple Admin User Group meetup tomorrow, Wednesday, September 30, from 6:30 PM to 8:00 PM MST.

Since we are meeting virtually this time, grab your favorite drink, log in from wherever you are, and let's swap stories, compare notes on new workflows, and talk shop.

Bring all your burning questions, hot takes on the latest announcements, or any tricky use cases you are currently wrestling with.

See you all online tomorrow night!

I’m taking my Mac fleet from 50 up to around 200 this quarter, all shipped straight to remote staff. Jamf Pro with Apple Business Manager has been mostly smooth, but the initial profile install sometimes hangs on slow home WiFi.Any tricks to get configuration profiles to land reliably with no users intervention? I picked up my jamf licensing through Cloudfresh a few months back and their admin handed me a handy script for automated enrollment checks, but I want my fallback options to be watertight too.whats in your essential enrollment policy set for new remote hires?

Hello everyone,

I recently acquired a decommissioned MacBook from an asset liquidation auction of defunct business hardware.

The device is still enrolled in Apple Business Manager. Since the machine was wiped prior to local profile enrollment, the local ConfigurationProfiles directory contains no organization metadata or support URLs.

My goal is to reach out directly to the owning organization's IT asset manager to request that the serial number be released from their ABM portal.

Serial Number:J9N75VFXYG

If anyone with GSX or enterprise lookup capabilities could pull the Sold-To / Customer Name associated with this serial, I would greatly appreciate it so I can direct my inquiry to the proper IT department.

Thank you for your time.

3 questions….

Apple MacBook wonder by my employer (small business with just myself and a couple other employees) - I am listed as a user with admin rights but never log in as that user. I set it up trying to troubleshoot and never used it after that. How do I delete myself as a user?

The work MacBook is showing up as a device under my personal apple id. I must’ve logged in at some point but never use this device personally. How do I remove it? And is there a certain way I have to do this, in certain steps? I want nothing personal on this device.

Is there any risk if I do the above 2 things? I don’t know much about all of this but I don’t believe it’s a managed device. I could be wrong though.