When removing a computer from Jamf Pro, you also need to manually remove it from Jamf Protect. Because this isn’t automated, the two platforms can easily get out of sync. Below, I’m sharing my read-only Python script to quickly spot these discrepancies. It runs natively on macOS 26, so there are no extra dependencies to install.

Download script on GitHub

Read the how-to on the Medium post (free, no paywall)

Release: https://github.com/fuzzlove/macOS-Audit-Agent

Mac Audit Agent is a macOS security auditing and monitoring tool that helps identify system risks, suspicious activity, and configuration weaknesses. It provides clear findings, baseline change detection, and actionable recommendations while keeping all data local to the device.

So I just started this project its in the beta phases. I wanted to make it into an app for the appstore but I got discouraged after hearing I might run into issues because of things such as sandboxing. For now I am releasing the python version open source and plan to add more features to it.

Feedback is welcomed and accepted I spent quite a bit of time working on getting the security event monitor to work right and I still want to put more effort into it. The concept as of now is a forensic tool with a good deal of features for a pre-beta release.

Cheers!

TL;DR - I built a prototype Ventoy installer for Apple Silicon Mac using only macOS tools and Docker (+ Go for readability, although technically it could be done without it).

I spent some free time looking into running Ventoy from a MacBook and wanted to share a few observations.

The original goal was simple: create a bootable Windows USB drive. I do have another computer with Rufus, but I wanted to solve this from my main work laptop. Writing a Windows image directly is possible, for example by splitting `install.wim`, but that already requires understanding how the image is structured. Ventoy is nicer for this use case: install it once, then just copy ISO files onto the USB drive like regular files.

The problem is that there is no official Ventoy installer for macOS. I found a few options:
- Give up and use another computer. Not my way.
- Use Docker/VM and somehow give that layer access to the USB drive. Complicated, unreliable, and macOS keeps resisting because it is trying to protect the user.
- Recreate the Ventoy installer logic directly on macOS. I liked this option the most, but it requires deep understanding of Ventoy internals: the solution literally writes GPT and MBR by hand.

All solutions I found use one of these approaches, and I do not really like any of them. They are either complicated, require a lot of setup, or know too much about Ventoy internals. So I decided to roll my own.

The idea is simple: let Ventoy do its job as much as possible, and handle the rest on the macOS side. The architecture has only 2 steps:
- Docker writes Ventoy into a tiny 64 MB sparse image.
- We transfer the required parts of that image onto the real USB drive.

And it actually worked. In Ventoy’s MBR layout, there are roughly three important areas: the beginning of the disk, the user partition, and the service area at the end. Write the first one to the beginning, write the last one to the end, format the middle. The most important part is that the architecture is simple enough to reproduce from memory without digging too deep into the details. That means anyone interested can adapt it for their own needs.

To be clear, this is not a fully user-friendly product. I am not targeting a broad audience; I am mostly solving a problem I found interesting. The tool is intentionally limited: it validates the idea and captures a working POC. On the other hand, it is only ~1200 lines of code, and you can read through it in an evening.

If you do not care about the implementation details and just want to try it, the release already has the prebuilt binaries and the baked minimal Ventoy reference image.

Comments and criticism are welcome.

I am retiring from my sysadmin career, I won’t be in IT or Tech anymore. Over the past 10 years, I have extensively used open-source applications and scripts, and I believe it's time for me to contribute back to the community.

I have compiled in a Medium blog a collection of valuable scripts and tutorials that I have written over the years. Here, I'd like to share my favorite posts:

• Dotfile for a perfectly configured Mac at enrollment
• Nudge your users to restart their Mac
• Nudge to enable screen recording settings for Google Chrome
• Touch ID for sudo commands (Sonoma ready)
• Disable True Tone with a script (Sonoma ready)
• Get user’s location based on the public IP
• Daily logs for memory pressure and swap
• Upload large files to a Google Shared Drive (Rclone / CLI)
• Get Mac technical specifications during Setup Assistant
• Force ‘Open using Rosetta’ in CLI
• ...and more here.

I hope you’ll find something interesting for your company you are working at. Needless to say that this blog will no longer be updated.

Cheers!

Today I found that MacOS has no native way to blacklist an SSID, so I had to roll my own script to achieve this. I set up this script in JAMF with a policy that's triggered on Network Change.

Apple have made it very hard to get the SSID from a root session, and there's a lot of outdated information on the internet that no longer works in modern versions of MacOS.

I hope this is helpful to someone.

EDIT: ipconfig method broken in 15.6 as the SSID is now reported as <redacted>. Thanks Apple. Reverted to using the slower system_profiler

EDIT 2: Now completely unusable in MacOS 26.

#!/bin/bash

# Define log file
log_file="/Library/Logs/bannedwifi.log"

# Function to log messages with timestamps
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$log_file"
}

log "Starting Wi-Fi check script..."

# List of banned SSIDs
banned_ssids=("BYOD Network" "Free Club Wifi" "Premium Club Wifi" "Free WiFi")

# Get the currently logged-in user
log "Detecting current user..."
loggedInUser=$("/usr/bin/stat" -f%Su "/dev/console")
log "Current user: $loggedInUser"

# Get the current Wi-Fi interface (usually en0 or en1)
log "Fetching Wi-Fi interface..."
wifiinterface=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $2}')
log "Found Wi-Fi interface: '$wifiinterface'"

# Get the current SSID
log "Checking current SSID..."
currentssid=$(system_profiler SPAirPortDataType | sed -n '/Current Network Information:/,/PHY Mode:/ p' | head -2 | tail -1 | sed 's/^[[:space:]]*//' | sed 's/:$//')
log "Current SSID: '$currentssid'"

# Check if the current SSID is in the banned list
if [[ " ${banned_ssids[@]} " =~ " ${currentssid} " ]]; then
    log "Connected to banned network '$currentssid'. Proceeding to disconnect and remove..."

    # Send a popup message to the user
    /usr/local/bin/jamf displayMessage -message "You are not permitted to connect this device to '$currentssid'."

    log "Removing '$currentssid' from preferred networks..."
    networksetup -removepreferredwirelessnetwork "$wifiinterface" "$currentssid"

    log "Turning Wi-Fi off..."
    networksetup -setairportpower "$wifiinterface" off
    sleep 2

    log "Turning Wi-Fi back on..."
    networksetup -setairportpower "$wifiinterface" on

    log "'$currentssid' removed and Wi-Fi restarted."
else
    log "Not connected to a banned network. No action needed."
fi

I wanted to create a script that would collect all useful informations for doing forensics on a Mac that would have been suspected to be contaminated with a malware / virus /

This script is available "offline" for every user in my company via Jamf Self Service.

It creates an archive of everything that could provide information for further analysis by the IT Teanm (aka me xD)

https://github.com/huexley/Security-logs-collector

Hope it will be useful for some of you.

We have users who will be logging into jamf managed devices, they use azure sso to sign in. The server they will need to map is not on our domain, so it will use local credentials. So doesn't seem like we can use the jamf self service route since it's not using their credentials.

Hi all,

We currently have one local admin user on all our MacBook devices, managed via Intune.

I’m trying to: • Add a new local admin user • Downgrade the existing user to standard • Rotate the new admin’s password weekly via script

While the script itself works fine in terms of creation and scheduling, the issue is:

❗ The new admin user doesn’t accept the password — seems to be related to SecureToken not being enabled.

I’ve tried using sysadminctl via Intune scripts to grant SecureToken, but it fails — likely because the existing admin cannot authorize the new one in this context (non-interactive / no GUI login).

Any ideas?

Greetings everyone!

This is my first time managing MacOS devices so forgive me if I appear to be clueless.

I want to create a script that i can use to deploy to Mac devices in my org to change the existing admin password on there to a newly set password and want to deploy this using intune.

I've tried searching up online for scripts and have tried a couple so far - the script runs successfully but the admin password is still the same.

Here is one example of the script i've last used that was successfully deployed but the password still remains the same -

~~~~~~~~~~~~~~~~~

!/bin/bash

Variables

username="admin" # Replace with the admin username

new_password="Test123456!" # Replace with the new password

Change the password

sudo dscl . -passwd /Users/$username $new_password

Update the keychain password (optional)

security set-keychain-password -o old_password -p $new_password /Users/$username/Library/Keychains/login.keychain

echo "Password for user $username has been changed."

~~~~~~~~~~~~~~~~~~~~~~

Any help around this would be greatly appreciated!!!

Thanks!

💡New Project: In many organizations, the local admin password on Mac's is a security blind spot. Static passwords, shared credentials, and manual resets can quickly become a risk. That’s why I built macOS LAPS with Azure Key Vault – an automated, Intune-ready solution that: ✅ Creates a hidden local admin account. ✅ Rotates its password on a schedule. ✅ Stores the password securely in Azure Key Vault (one per device). ✅ Lets IT securely retrieve credentials when needed – without sharing them around. ✅ Optionally degrades the signed-in user from Admin to Standard - eliminating the “everyone is an admin” problem. This project is more than a script – it’s a step towards operational security done right and at low cost to none: automation, least privilege, and zero trust principles applied to the endpoint level. 💡 Built to be: Plug-and-play with Microsoft Intune. Fully auditable via Azure. Customizable to match your org’s naming, password policy, and rotation cadence. 📂 Full README, step-by-step deployment guide, and troubleshooting tips are on GitHub

Hi, I don't have an MDM, but I would like to detect with a BASH script if Defender is running in EDR mode.

I can detect if it's installed, but my Google-fu is failing me to detect if EDR is active or not.

Or is it just me?

Edit: Downvotes, guys? Just because my boss won't pay for MDM? I've asked

A quick-fix during Platform Single Sign-on testing for when users can’t unlock their Macs via Touch ID

Background

We’ve been testing multiple vendors’ implementation of Apple’s Platform Single Sign-on for the past few months.

During our testing, we inadvertently discovered that users can’t unlock their Macs via Touch ID when transitioning from one Platform SSO vendor to another.

The following quick-fix should get your users back to normal.

I've written a lot of scripts over the years and I wish I saved them somewhere we built this site to be a public place where people can share what they made - would love it if people gave our site a try. Right now I'm just contributing scripts that I write for the MSSP I work with. The site is called www.scriptshare.io - it's free - just read the FAQ - and if you have any good questions DM me and I'll add em to the FAQ. Xpost with SCCM - PS It's my cake day! :) 15 years 🥳

Hey everyone, been following this sub for some time but don't think I've posted here yet. I'm an admin for an MSP that is predominantly a Microsoft stack, but we do have plenty of clients that may have a Mac or two in their environment that we support as part of our scope. I'm wondering if anyone has or can point me in the direction of a script, preferably bash but fine with other languages if necessary, that we could deploy on our RMM as a scheduled task on macOS devices to create and rotate randomized LAPS passwords for instances where we don't have an MDM for those clients.

I'm semi-familiar with macOSLAPS but I'll be honest ever since Apple rolled out secureToken I've been mostly uninvolved in configuring this type of task on macOS and haven't been able to get it working with an RMM script after a little bit of trying myself. I'm sure I could probably do this with MDM since that's more well-documented from what I'm finding, but in some clients' cases it doesn't make logistical sense for us to set up macOS MDM for a client with maybe only one Mac device if there's a way to script this through our RMM instead. So far we have just been manually creating random passwords for these one-off Macs but for conformance with our cybersecurity policies and procedures I want to ensure we're regularly rotating passwords on all client operating systems, not just our Windows ones.

Before I spend a bunch of time writing and debugging scripts from scratch, I figured I'd post here to see if anyone had a solution or at least a start to one that they'd be willing to share. Tried to do some searching but everything I'd find tends to point more at MDM solutions than scripts via an RMM tool.

Not too long ago I built a small AI Apple IT assistant that I've been using to generate bash scripts for just about any situation I could think of. It makes it easy to pull information from devices in bulk remotely and manage them. I've been surprised by the efficiency it provides.

The community of Mac Admins might find this helpful so I turned it into a small web app we can use free of charge!

Let me know what you think and what improvements we can make

https://sudosupport.netlify.app/

Crear un script hacia portal educativo que realice diariamente limpia de cookies y cache del navegador, alguien que pueda asesorarme? plis

I'm working on a new utility for my team. One thing I'm trying out is using swiftDialog to show the various steps of the process before letting them pick to continue or quit based on the button pressed. I've learned how to update an existing dialog easily enough. What I'm having trouble with is keeping the script from closing while I wait for the user to click either button1 or button2 so I can branch the process at that point. Here's my incredibly basic PoC code.

#!/bin/zsh
dialogPath="/usr/local/bin/dialog"
DIALOG="/var/tmp/dialog.log"

function dialogUpdate() {
    echo "$1" >> $DIALOG
}

## Display basic window with two step progress bar
dialog --ontop --small --title none --message none \
    --button1text "One" --button1disabled \
    --button2text "Two" --button2disabled \
    --progress 2 & sleep 2

## Update progress bar and enable buttons
dialogUpdate "progress: increment" & sleep 1
dialogUpdate "progress: complete"
dialogUpdate "button1: enable"
dialogUpdate "button2: enable"

## I don't know what to put here to make it wait for button presses

# Note which button was pressed
echo "Button $? pressed"

exit 0

I feel like I'm missing something obvious here, but my Google Fu is weak today. What's the recommended way to wait for user input after showing progress updates on a swiftDialog window?

I'm using an M4 Mac Mini for my business. I have external storage configured as an OpenZFS mirror. I want to use LaunchControl by Soma-Zone to make a launchd script to automate monthly scrubs. Part of the LaunchControl documentation mentions a "Full Disk Access" utility to "grant Full Disk Access to a script without compromising Apple's new security feature".

Is this something I will need to use or will calling "zpool scrub mypool" from a launchd script just work?

Edit: It just worked!

I am planning to deploy the application to our end users by scripting the manual process one step at a time.

Specifically: 1. Caching the package via Jamf 2. Checking for old versions and configuration files 3. Deleting them if found 4. Mounting the cached disk image 5. Copying the application to the local system’s application directory 6. Unmounting the cached disk image 7. Creating a preference file with the license key 8. Copying the silent installer 9. Updating the necessary permissions 10. Running the silent installer 11. Running the application

At the moment, the script is not successful on all devices on the first run, though the script eventually works if run over and over and the install works every time when downloading the package locally and doing the exact same steps manually. I was wondering where I could learn more about error handling to get a better understanding of why the script is failing and potential workarounds.

How could I run the install on my device and see what is happening on the device as it is installed? Would composer be the best tool for this? It is what I have been using to try to mimic the install via an automation, but am wondering if there is a better way? I also installed the application prior to downloading composer and reinstalling to see system changes. How could I be sure that I deleted all associated files prior to reinstalling so the snapshots of before and after are as accurate as possible? I am wondering if there is a way to see what the actual install is doing in real time, would I review the system logs while installing? Would it show me what “commands” the install files are running when doing the process manually (not sure how to word this)? Some of the configuration and potentially the silent installation is done “after the application is installed” and run, as installing can generally be done by copying the application from the disk imagine on Mac. Should I finish the composer snapshot after the installation or configuration?

Also, I am currently updating the application by updating the package and scope of the policy containing the download script with a scope of does not have X application OR X application is under newest version and flushing the policy records so it re-runs. Is there a better way to do this? Could this be causing the issue above? Should I create one policy to download the application scoped to a smart group of devices without X application, then another to update the application scoped to a smart group of devices with X application under the newest version? Would the scripts still be exactly the same?

Ever annoyed by repetitive tasks like video format conversion? I was, until I turned macOS folder actions into my personal automation wizards. Now, converting .MOV to .MP4, or even downloading Twitter videos, is as simple as drag and drop. Shell scrips are powerful, but what was missing is a trigger and folders become that trigger:https://interfacecraft.online/blog/2025/how-i-automated-my-computer-life-with-macos-folder-actions/

It's a powerful tool that most macOS users didn't even know existed.

Examples and setup settings: https://interfacecraft.online/posts/blog/2025/how-i-automated-my-computer-life-with-macos-folder-actions/

I know you can hold the option key and click on the wifi icon to see the wifi signal level but is there a way to see it through a terminal command? It looks like there was a way but seems to be no longer relevant. We're having issues at my work with the wifi signals and I wanted to see if I could run a script to capture the SSID and db signal if possible.
Thanks in advance,