Apple heads homewards with new hardware, fourth betas for 27.2, some nice scripts and automations, as well as lots of updates.
Sponsor
Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users. Trusted by security teams and IT administrators alike, Alectrona Patch helps you:
Reduce time to patch critical applications
Reduce end-user support tickets with clear, customizable guidance
Deliver silent, automated updates
Keep users both secure and productive
Spend less time patching. Spend more time securing your environment. Start your free trial at alectrona.com/patch.
Updates to macOS 27 Golden Gate are going to be a bit more confusing than last year’s cycle for Tahoe.
Weird numbering changes aside, Apple’s release schedule for the minor updates has been quite consistent and predictable since macOS Sierra 10.12. (The pandemic years had a few outliers.)
An in-depth look at OS update deferrals across iOS, iPadOS, and macOS. Exploring how deferral windows behave to help you navigate nuances and maintain fleet compliance.
Of all the privacy protections in macOS, those for local networking are among the most recent and the least understood. Introduced in macOS Sequoia, they’re related to protection introduced earlier in iOS and iPadOS version 14, but different, and could trip you up when you’re least expecting yet another privacy prompt.
For IT teams, a paid Mac App Store title is not simply another package to deploy. A limited Apps and Books license pool must be assigned only when a Mac needs it
So fast that most installs never get reviewed until after they have consequences.
Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.
Apple has announced that they will update how the Full Disk access privilege works, because “some developers are using Full Disk Access in ways that could put users at risk.” This has Mac Admins somewhat concerned. Be sure to file feedback.
Mac Admins Slack moves to Slack’s Enterprise plan starting Friday 9 October 2026 at 11:30 p.m. EDT. Slack will be fully down for about 18 hours, and direct messages need roughly 10 more hours to catch up.
Mac admins now use AI to write scripts, troubleshoot problems, and author configuration profiles, and most of them deploy that output to production. Few of them can undo a bad change quickly.
I also have a proposal: a member-staffed working group with a written charter and one deliverable. That deliverable is a platform evaluation and exit plan. It is not a migration.
It’s not very often we have the wisdom of hindsight and can go back to document changes made in macOS over six months ago. This brief article adds information on some of the more consequential changes made in macOS Tahoe 26.4
Keychains are specialised database files used by every Mac since the introduction of Mac OS X to store and protect passwords, security certificates and other secrets.
Apple announced upcoming Updates to Full Disk Access in macOS that have potential impact for Mac Admins. While currently the details are light, this is a perfect time to file feedback on this topic, to help influence what these changes ultimately become.
You’ll probably have heard that Apple is urgently reviewing privacy protection in macOS, and intends enforcing stricter use of Full Disk Access in Privacy & Security settings. This article explains what’s going on, and why we all need to be concerned.
Monocle inspects scripts and small repos (local or on GitHub), plus diagnostic and support bundles, and produces four audience-specific summaries (Executive, Security, Manager, Engineer) plus a Monocle Score.
Jamf Migrator is a macOS app that copies a source tenant to a destination tenant — everything, or any selection down to a single object — shows exactly what it would change before writing anything, and picks up where it left off if a run is interrupted.
Joe discusses costly RV maintenance and how machines (including hard drives) can fail when left idle, leading into Mac maintenance routines. They debate slang like “cooked,” then talk Apple’s new iPhone lineup, including Jerry’s iPhone 13 Pro Max purchase and their mixed expectations for the first-gen iPhone Duo
Christophe Frenet, Dashlane's CPO, joins the show to talk about the challenges around managing apps that live outside SSO and how Dashlane Vault Enforcement aims to solve that problem.
The new 27 series of Apple’s operating systems are now out! We’re going to spend a bit time talking through what’s new, what’s exciting, and what we all have to look forward to!
This issue of MacAdmins.news is brought to you by iMazing Business: tools and automations to backup, supervise, enroll, and configure fleets of Apple devices from both Mac and PC.
The iMazing Business software suite includes: ~iMazing Configurator~ - apply blueprints for supervision, MDM enrollment, app management and backups; ~iMazing CLI~ - automate every function available in the UI; ~iMazing Profile Editor~ - author and sign profiles using the largest catalog of settings for Apple platforms and ecosystem apps.
I was at MacSysAdmin conference this week, where I had the honor of presenting earlier this week. Because of this, just a brief intro and many greetings from Gothenburg!
The Mac Admins Slack is migrating from Business+ to Enterprise Grid. The migration will begin on Saturday 10 October 2026 at 03:30 UTC. […] Slack estimates 18 hours of hard downtime for the migration
Go outside and smell some roses or touch grass or whatever you would rather be doing on a week-end!
Jamf, a founding sponsor of the Mac Admins Foundation (MAF), has expanded its support to the Visionary level, the Foundation’s highest sponsorship tier.
Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file.
File-notification systems tell applications when files change, e.g., opened, closed, written, deleted. With only read permission on a file or directory, an attacker can watch these notifications and reconstruct user behavior.
It came bundled with your E3 or E5 agreement. It was a free line item sitting next to the productivity suite your org/company actually signed up for. So you started using it, because that's what "free" does: becomes the default before anyone really evaluates it.
Throughout my future blog posts, I am going to explore some different options for scenarios such as this. I don’t know that there is a fully secure method, but there are better and worse ways of dealing with this issue.
David Aclandjoins the show to introduce Orchard. Orchard continuously enforces macOS updates, application updates, and security settings to keep devices compliant and audit-ready.
In 2011, Apple released the Cards app. The app — which required iOS 5 — let you design custom letterpress cards, with your messages and photos printed upon them — which Apple would ship to your recipient on your behalf. I recently learned the origin story of Cards
This issue of MacAdmins.news is brought to you by iMazing Business: tools and automations to backup, supervise, enroll, and configure fleets of Apple devices from both Mac and PC.
The iMazing Business software suite includes: iMazing Configurator - apply blueprints for supervision, MDM enrollment, app management and backups; iMazing CLI - automate every function available in the UI; iMazing Profile Editor - author and sign profiles using the largest catalog of settings for Apple platforms and ecosystem apps.
In the week after the big release of the 27 platforms, we got a first minor update for watchOS, a second beta for 27.2 and an Xcode 27.1beta, which means there are two different Xcode 27 betas right now.
I remain unhappy with Apple’s passkey backup story. […] I don’t think I had written it all in one place before. The new bad news is that, as of macOS 26.4, these problems now affect regular passwords, not just passkeys.
Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped.
Siri is like someone who crashes your party, lolls on a couch, and won’t leave. On my M4 MacBook Air, where I’m writing this, Apple Intelligence takes up more than 33.85 GB
I decided to see whether Siri would be newly useful for creating playlists in the Music app. What I discovered surprised me: when pushed beyond the basic smart playlist capabilities, Siri was able to generate a working Python script for playlist generation.
Richard Glaser has been a Mac Admin for a long, long time, and we’ve got him on this week to talk about what it’s like managing Macs for a whole university library system, the state of lab computing in 2026, and what’s changed in more than 35 years of managing Macs at work!
Joe and Jerry chat about haircuts, travel plans to Yosemite via Reno and Lake Tahoe amid fires and crowds, and recent wildlife encounters. They discuss upgrading iPhones and frustrations about promised Apple Intelligence features
we speak with Maiberg about Amazon’s VGT3 operation and the likely commonplace practice of AI companies purchasing, scanning, and destroying books in an effort to build “frontier” models.
Apple’s ill-fated Copland operating system is notoriously hard to run on real hardware, and has not previously been available in emulation. Here is the last build, D11E4 from June 1996, in an improved DingusPPC.
As expected, Apple published all the 27 platform upgrades this week. With the end of this particular beta phase, we also got a bunch of interesting posts from fellow Mac admins. We also got a somewhat oddly numbered 27.2 beta.
This issue of MacAdmins.news is brought to you by iMazing Business: tools and automations to backup, supervise, enroll, and configure fleets of Apple devices from both Mac and PC.
The iMazing Business software suite includes: ~iMazing Configurator~ - apply blueprints for supervision, MDM enrollment, app management and backups; ~iMazing CLI~ - automate every function available in the UI; ~iMazing Profile Editor~ - author and sign profiles using the largest catalog of settings for Apple platforms and ecosystem apps.
macOS 27 Golden Gate and all the other 27 platform upgrades were released right on schedule this week. This means that Apple device administrators either got to test whether their deferral settings were working or are watching counters of the 27 deployment ticking upwards.
Since the beta phase never ends, Apple also released the first beta for the 27.2 platform updates and Xcode. The numbering is somewhat confusing, so Apple actually clarified it in their Developer notes. The iPhone Duo will come with iOS 27.1 and developers will get Xcode 27.1 to be able to build and release apps for iPhone Duo. Xcode 27.1 beta “will be available later this month.”
The developer note does not state whether the new Mac mini and Mac Studio which will ship next week will ship with macOS 27.1, or a hardware specific build labeled 27.0 with a different build number. I wouldn’t mind if Apple started distinguishing hardware specific builds with their own version numbers.
Also new in the 27 platforms is volume purchasing for App Store subscriptions. Very untypically for Apple, they manage to call this feature by three different names in as many paragraphs in that note. (“Multiseat purchasing”, “Volume purchasing”, and ‘Group purchases”.) Note that the app developer and your device management service has to implement the support for these and the configuration requires the user account to be managed, which includes most shared device setups and even many current 1:1 deployment workflows. But now is a good time to start talking with your management service provider and the app developers on how to do this and provide (more) feedback to Apple for shared device support.
Looking for Sponsor!
There is one opening left for sponsoring this news summary this year. If you are interested, please reply to get in touch.
As part of testing macOS Golden Gate, it was discovered by myself and others that MDM enrollment does not appear to completely work [on virtual machines]
As part of Apple’s ongoing transition from Intel processor support, Apple announced a transition timeline for macOS’s Rosetta 2 translation environment in 2026. At that time, Apple said that Rosetta 2 would continue in its current form for both macOS 26 and macOS 27. That means that macOS Golden Gate 27 is the last version of macOS which will offer Intel app support in its current form.
Over the years, Apple has introduced a number of screens which appear the first time you log into a Mac. Among those which appear as of macOS Golden Gate 27.0 is the Liquid Glass screen, which allows you to adjust the Liquid Glass settings.
Say goodbye to endless permission pop-ups with macOS 27 Golden Gate. An example of how using the new App Privacy declaration type can cut down the number of prompts seen by your users.
I find the new consolidated privacy prompt a step in the right direction by Apple and like that Philip documented its configuration. However: Screen Sharing/Recording is the privacy setting that most throws users, because it doesn’t show until you need it (presumably, because you want to share your screen over a conferencing solution) and then you have to restart app in question (I know that for some apps, you can ignore this prompt, but most users don’t know that.) This creates super stressful situations. So, guess which privicay setting cannot be consolidated with this setting? (Please file feedback with Apple.)
Also, why is this restricted to managed devices? I believe a consolidated prompt would be great for all users.
The reality is that for more casual users, using computers and the Internet has become so difficult—think impossible-to-close interstitials, CAPTCHAs with an endless series of pictures to analyze, and constantly changing interfaces that bury the features they’re looking for—that they have grown desensitized to instructions that seem ridiculous and burdensome.
I found a path traversal in the code that provisions PCC nodes, darwin-init, that lets an attacker write files as root and compromises privacy and security guarantees in PCC.
With OS 27 Apple is moving app restrictions to the new App Settings declaration, but building those configurations means finding Bundle IDs, CDHashes and other signing information first.
Script signing makes it so you don’t have to re-deploy a new version of the MDM profile every single time you change the contents of a script or deploy a new script. You can have the same MDM profile and just sign or re-sign the script.
With the addition of so many different APIs, and the changes to the authentication method, I decided that rather than maintain an independent method of credential storage for Platform API, JamfUploader should instead take advantage of the utility of jamf-cli to handle it.
Joe and Sam discuss a Wall Street Journal documentary on North Korean operatives using stolen identities, AI tools, and U.S. accomplices to gain remote jobs at American companies, including schemes where U.S.-based helpers host shipped laptops for overseas workers, raising financial and data-leak risks.
Chris Lo was a Mac Admin for a long time before he started a recruiting practice. We’re here to talk with him about the state of the job market, how AI has changed things for better and worse, and how to think about your next move.
Apple’s event came and left us with new phones, new watches, new AirPods, and a release date for the 27 platform upgrades. Also, we learn about Keychain files in Tahoe, migrating password managers, and safe mode.
This issue of MacAdmins.news is brought to you by iMazing Business: tools and automations to backup, supervise, enroll, and configure fleets of Apple devices from both Mac and PC.
The iMazing Business software suite includes: iMazing Configurator - apply blueprints for supervision, MDM enrollment, app management and backups; iMazing CLI - automate every function available in the UI; iMazing Profile Editor - author and sign profiles using the largest catalog of settings for Apple platforms and ecosystem apps.
Apple had their September event earlier this week. Most of the announcements had been leaked (or spoiled) before, but it is always interesting to finally get the details.
iPhone Duo, with a foldable screen, was announced at an eye-watering price. (Exaggerated for us Europeans by Apple holding on to a very generous (for them) Euro-Dollar exchange rate.) iPhone Pro 18 comes with some new camera tech and other improvements. Apple Watch Series 12 and Ultra 4 have an new SoC with new health features. And the new AirPods (no moniker) are bucking the trend and actually got cheaper, or at least same price with more features.
Back when iPhone Air was released last year, I speculated this could be like the releases of PowerMac G4 Cube or the 12” retina MacBook. These products were introduced at high prices, because they were pushing at the boundaries of what was technically possible. Neither lasted very long, but some of the technologies used in them made their way into other product lines. We are certainly seeing some design elements and tech of iPhone Air in iPhone Duo.
But this could also be like the introduction of MacBook Air, which started out expensive, but then dropped in price over time as the components became more common. One the other hand, the iPhone X and Mac Studio were able to establish an entirely new product category at a new price range. The Mac mini did this on the low end of the price spectrum, as might the MacBook Neo.
The jury is still out on iPhone Air (and Apple Vision Pro, for that matter...) and it will be interesting to see which path iPhone Duo takes.
For the price of an iPhone Duo, you can easily get an iPhone Pro and an iPad. You will have the advantage of more powerful devices and larger screens, but then you have to charge, carry, and switch between two devices.
Also, when closed, iPhone Duo is smaller than the other iPhone models, even though it is thicker. (But even folded, it is still thinner than the original iPhone!) I still miss iPhone mini, but am not convinced that I would like to pay three times as much to get that form factor back.
Overall, iPhone Duo is intriguing and I will definitely head to an Apple Store to see and hold one. I wasn’t planning to upgrade my phone this year, anyway (my iPhone 15 Pro is good for another year) but I will start watching the real-world experiences with the foldable and maybe start to put some funds on the side for next year.
We also got the release date for macOS 27 Golden Gate, iOS 27 and all the other 27 upgrades: September 14, which is… checks notes… next Monday! Are you ready?
Sponsorships available!
There is one opening left for sponsoring this year. If you are interested, please reply to get in touch.
Historically, you could copy the login keychain file from one Mac to another and be able to open it on the destination Mac by providing the password to that keychain. As of macOS Tahoe, this does not appear to work for Macs which use Secure Enclave.
can be used to diagnose the cause of almost any problem caused by third-party software, and may make some tasks such as obtaining and installing macOS software updates possible, when they fail in normal user mode.
Because these patterns can’t be standardized, full compatibility isn’t feasible. We have decided not to move forward with this feature. We apologize for the inconvenience.
This is one more sad step away from accessible, personal automation.
Sam and Joe discuss being short-staffed while covering client onboarding and ticket work, and how client relationships shift when a different technician becomes the main contact.
we speak with Sutherland about loyalty points theft— how it happens, what companies are doing to protect customers, and what people can do to stay safe.
So fast that most installs never get reviewed until after they have consequences.
Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.
This week marks the first turnover of an Apple CEO in over 15 years. Tim Cook “retires” to the board of directors, while John Ternus takes over as the new CEO.
Ternus has been at Apple since 2001 and a vice president since 2013. He has worked with Cook and the other leaders at Apple for a long time. No-one expects radical changes. Even so, several other leadership roles have changed this year. The Apple story will certainly remain interesting.
The beta phase for the 27 system updates continued with weekly updates, we are now at the eighth beta. Somewhat of a surprise, Apple also announced a new Mac mini and Mac Studio models, with M6 and M5 Pro, Max, and Ultra chips. This updates are not insignificant, as are the price increases, so it comes as a surprise that Apple would announce them without an event of their own.
The event next week will likely focus on the iPhone and its satellite plarforms. This is now tradition for the September event.
The new Macs will start shipping on September 22 and require macOS 27 Golden Gate. So, if you were wondering when the 27 updates would be released, that would be the last date. From previous release cycles, we can expect a release candidate next week around the event and full release in the week after.
Hope you are prepared!
Looking for Sponsor!
There is one opening left for sponsoring this news summary this year. If you are interested, please reply to get in touch.
Ternus has inherited that Apple. Regardless of how much he gives off the vibe of a cool Californian […] who just cares about the best stuff, he is also selling ad space and making sure more people upgrade to Apple One.
Congrats to Tim Cook on his 15-year anniversary as CEO of Apple! Here are some balloons and a gift card to the Olive Garden. There will be cake in the break room.
Reflecting on my time as a Mac Admins Slack admin, I look back on community stewardship, the challenges of AI and data scraping, and why human conversations remain the heart of the community.
macOS 27: Final release to support Rosetta — Intel-only apps will no longer run on Mac computers with Apple silicon after this update.
Not really news when you have been reading this or other Mac management related news. But, this official notice from Apple might be good to have around when talking with developers who are dragging their feet.
At the same time as the release of Golden Gate, we should get Tahoe 26.7 and Sequoia 15.8, but it looks increasingly likely that the final version of Sonoma has been 14.8.9, released on 6 August.
we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded.
From the arm64 sample we documented the on-disk characteristics of the Mach-O, the LaunchAgent persistence chain, and the collection target map, with observed and inferred paths distinguished.
In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.
finding problems worth solving isn’t separate from the rest of the job. It comes from staying engaged with people’s work long enough to see what no single request can show you.
For many organisations, their current macOS provisioning process doesn't make the user MDM-enabled. Here's an example of how you can activate that for your already enrolled devices.
I manage an environment where all computers are shared, and none of the users have a local account (we are still AD-bound). In this situation, managing macOS updates is very tricky.
swiftpkg works with your existing munkipkg projects, and the command-line tool has the same core feature set that munkipkg has, so you should be able to switch tools easily.
uses the Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ Recovery Lock passwords (if one is set) and generate a report in TSV format.
If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice
Deploying an application is only half the battle. If macOS continues opening files and links with the wrong application, users still experience friction—and your deployment may not achieve the behavior you intended.
how to reset an Apple AirTag by inserting and removing the battery five times until a different sound plays, noting newer AirTags may require pressing down. They share issues seen on iOS 27 and macOS betas
Security updates for iOS, macOS, and visionOS, with more in beta. Also 27 beta 5 and beta 6 releases,.
Sponsor
Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users. Trusted by security teams and IT administrators alike, Alectrona Patch helps you:
Reduce time to patch critical applications
Reduce end-user support tickets with clear, customizable guidance
Deliver silent, automated updates
Keep users both secure and productive
Spend less time patching. Spend more time securing your environment. Start your free trial at alectrona.com/patch
All Summer Long
The fifth and sixth betas for the 27 platforms came out with just a week between them. It has actually been quite common for Apple to switch to weekly beta release some time in August, so this is progressing normally.
There is a notion that now is too late for providing feedback to Apple, since the chance is low for a fix or change to be included in the .0 release in September. While it is true that the likelihood is greatest early in the beta phase, getting something fixed or adjusted now is not impossible, when Apple deems it important enough. Also, there will be later updates, the .1 update usually arrives about six weeks after the .0 in late October or early November and the .2 release in December. These updates will have improvements for your feedback, but only if you tell Apple about your problems.
So, keep testing those betas and creating the feedback. Also, document issues you might find. If Apple doesn't fix and we can’t solve them, we can at least document them and warn users when 27.0 inevitably drops in September.
Before Richard Glaser was a Solutions Architect, he was a math major working the library's computer lab by day, and living a whole other life by night: playing guitar in punk and alternative bands,
Here’s where I’m coming from, where I’ve seen the personal programming world evolve, and where I see AI development taking us with the kinds of apps and systems we use on our Apple devices today.
Agent assisted coding satisfies the need to build very customized workflows for your personal needs. As Adam recounts in this article, there have been several solutions in this regard over the past few decades, some of which were quite successful, but all seem to have fallen by the wayside for some reason or other.
I don’t want to dismiss the desire to build your own custom solutions and workflows, but I feel sad that the “magic wand” here is based on something so riddled with ethical, economical and social concerns. What could we have had, if Apple continued to improve Hypercard or AppleScript over the last two or three decades? What could be, if Apple or another company had invested a fraction of the investment of AI development into personal, simple automation?
Apple has just released a security update to macOS Tahoe, bringing it to version 26.6.2. There don’t appear to any matching security updates to Sequoia or Sonoma, though.
Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and macOS Tahoe,including yetanother image parsing vulnerability that could compromise your device.
Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.
Apple's Threat Notifications signal mercenary spyware targeting; learn verification steps, response actions, and layered mobile security defenses for high-risk users.
Jamf Threat Labs discovers and investigates AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.
For MacAdmins, the Dock has always been a deceptively small thing with a big operational footprint. It is the first place many users look for the tools they need, and it is one of the first places they notice when a Mac does not feel ready for work.
Activation Predicates are a powerful way of controlling which devices in your fleet are applied with which controls, without having to create and maintain endless blueprints and scoping groups.
Historically, Adobe has not always aligned cleanly with Apple’s preferred installation and removal workflows, so MacAdmins have often had to adapt their processes around Adobe’s packaging, licensing, and uninstall behavior.
if a device is added or deleted while you’re fetching pages, rows can shift across the offset boundary, potentially causing a record to be skipped entirely or to show up twice across two different page requests.
a practical conversation on the 2026 macOS beta cycle: what’s actually working, what’s still rough, and what IT teams should be paying attention to as the fall release gets closer.
Summer goes on, but even though many of us seem to get a break, the IT world goes on. Apple released, right on the expected schedule, the 26.6 updates and the security notes show a record number of CVEs. Yet they released the first patch for macOS, a bit more than a week later.
That also means it is a bit more than a month before the release of macOS Golden Gate 27 and the other 27 platforms. There was no beta release this week, which is a bit out of schedule. Probably next week. I am planning a lot more testing on my test devices and if that goes well, it might be time to upgrade my production Mac.
Apple also reported their third quarter results — guess what, they are record setting — and hit the five trillion dollar market cap. They are anticipating “headwinds” in the quarter to come. The various tech supply constraints are also affecting Apple and possibly the roll-out of new devices in the Fall.
The Mac Admins community unexpectedly lost a valued member of the community earlier in July with Dave Shepp. A page has been set up to support the family he left behind.
This is the fourth Summer Camp issue. Next issue is in two weeks, August 21. MacAdmins.news will remain on a two-weekly schedule until September 4.
People buy Apple’s products because they are nice and work well and are not lousy in a lot of ways the cheaper competition is. Apple’s revenue-grubbing approach to the user experience in its products and services threatens to erode the Apple brand, and once lost, it can be hard to recover. No amount of incremental revenue from lousy ads and nagging upsells can counteract long-term brand damage.
Using AI to generate a customer service response that replaces a human worker is not the same as using AI to write a config profile. Using AI to approximate a working illustrator’s style without their consent is not the same as using AI to help debug infrastructure.
We can slowly start to change this by fostering a culture where asking questions is a sign of intelligence, and those just starting out know it's okay to not have all the answers.
We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network.
a macOS campaign using a fake Zoom installer to deploy Overlord RAT. Built with .NET, this cross-platform technique simultaneously targets Windows, joining Go- and Rust-based cross-platform malware.
A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges.
This is post authentication, the target Mac must have Screen Sharing or Remote Management enabled, the option "VNC viewers may control screen with password" must be configured, and the attacker must know that VNC password.
Most everyday problems with LaunchServices should be fixed using the GUI. For those that can’t, two command tools, lsregister and lsappinfo, are available to help.
Okta Device Trust issues a certificate to enrolled devices to prove they’re managed by your MDM. That same certificate can authenticate the device to a Meraki wireless network over 802.1X, giving you certificate-based Wi-Fi with no RADIUS server to stand up and no per-device licensing to buy.
Declarative Device Management and the MDM workflow still define the required macOS version, the deadline, and the enforcement behavior; DDM OS Reminder turns that deadline into a visible, scheduled user reminder.
provides a focused workflow to discover Intel-only executable components before deployment, then generate clear remediation feedback for application developers and support teams.
This guide explains how to enable and configure passkeys in Microsoft Entra ID, then register passkeys using Microsoft Authenticator or iCloud Keychain.
When removing a computer from Jamf Pro, you also need to manually remove it from Jamf Protect. Because this isn’t automated, the two platforms can easily get out of sync
Luke Wescott from Sublime Security joins the show to discuss the recent surge in callback phishing attacks abusing auto notifications, verifications, alerts, receipts, and more.
26.6 RC. 27 public beta, as well as fourth dev beta
Sponsor
Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users.
Trusted by security teams and IT administrators alike, Alectrona Patch helps you:
- Reduce time to patch critical applications - Reduce end-user support tickets with clear, customizable guidance - Deliver silent, automated updates - Keep users both secure and productive
Spend less time patching. Spend more time securing your environment. Start your free trial at alectrona.com/patch.
In the Summertime
26.6 went RC this week, so a release is likely early next week. This is also very probably the last significant update to 26.
Apple also released public betas for the 27 platforms. So, if you have super enthusitastic users, you are likely to encounter devices with those betas, but you surely have been using the five week head start to have tested before them, right?
This is the third Summer Camp issue. Next issue is in two weeks, August 7. MacAdmins.news will remain on a two-weekly schedule until September 4.
macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ Data folders to a hand-picked set of non-sandboxed apps’ Application Support folders too.
a new modular macOS stealer that is likely distributed via ClickFix pages and relies on compromised WordPress domains and Telegram infrastructure, with a strong focus on Europe where more than 50% of identified victims are located. It is also worth noting that the current malware doesn’t even need any elevated privileges or rely on exploits for the successful execution.
CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.
Apple is urging users to treat any suspicious FaceTime call or message as untrusted, especially if it involves payments, refunds, password resets, or requests for personal information.
The Apple Watch, at least with data that’s stored in the Health app, is the only popular fitness wearable that supports end-to-end encryption, and it’s enabled by default for all users (you are required to have two-factor authentication enabled as well, but that is also on by default for most accounts). However, Apple Watch owners should remember that this protection is only for data stored in the Apple Health app.
Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure out a user’s real email address which was supposed to be protected by the feature.
Installomator is very good at downloading, verifying, and installing Mac apps, but one uncomfortable problem remains: what if the app is open while you are trying to update it?
When creating a custom role, you can base it on an existing role and add extra permissions on top. That gave me an idea: check whether starting from an existing role plus a small tweak would get me what I needed, instead of building something from scratch.
This script isn’t intended to tell you what should be deleted. It’s intended to help answer a simpler question: do I understand every API client that currently has access to my Jamf environment?
Anna Brading, editor-in-chief of Malwarebytes Labs and director of content and, perhaps most importantly, mother of three. With a long career in cybersecurity—and an equally long time spent reading, writing, and assigning some of the cybersecurity world’s most pressing headlines—Brading has a unique perspective on what is most dangerous to her children online.
Summer and the heat seem to have much of the Northen Hemisphere in a firm grip. But this doesn’t seem to slow down Apple or the Mac Admin community. Security updates and beta releases for both 26.6 and 27.0, as well as Creator Studio app updates from Apple, and lots of tool and app updates from the Mac Admin community.
Doug Brooks, senior product manager of Apple silicon, discussed how Apple's long-term investments in neural processing, unified memory, power-efficient computing, and hardware-software integration have positioned its devices for the AI era.
With more heatwaves expected across Europe and North America, this summer is already proving a challenge for those who can’t use their Macs in rooms that have effective air conditioning.
I do not try to build the entire deployment in one sitting. That usually leads to troubleshooting three different problems at the same time. Instead, I build the workflow in layers.
Before it reaches production, I want to understand what it’s installing, how Jamf is going to deliver it, what other configuration the application depends on, and how I’ll verify that everything worked after the policy runs.
a step-by-step guide to configuring Okta Platform Single Sign-On (SSO) with simplified setup on macOS using Jamf Pro, including certificate management and device access integration.
Since the release of Jamf Setup Manager, it's not been possible to install App Store Applications through VPP whilst running Setup Manager....until now!
Third Party Patcher (TPP) is a macOS MDM agnostic, MDM managed, daemon-based patching and software distribution system for IT administrators. It automatically discovers installed third-party applications, checks for available updates, downloads installers in the background, and applies them.
early impressions of iOS 27 on an iPhone 15 Pro Max and interest in Siri AI on newer iPhone hardware, plus Apple’s macOS 27 compatibility list ending Intel support while continuing support for 2020 M1 Macs, which they estimate could extend security updates to roughly 2029.
we speak with Dubal—professor of law at the UC Irvine School of Law—about how algorithmic wage discrimination works, what data it consumes to function, and the threat it poses as it creeps from gig work into many more industries.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
Summer has arrived with force with a massive heatwave in western Europe. But you can also tell that summer is here by a general “slowing down” of news. To compensate—and to give me a bit of a break—MacAdmins.news will switch to “Summer Camp” issues every two weeks (or fortnightly).
Next issue will be July 10. MacAdmins.news will resume the normal, weekly schedule on September 4, just in time for the big 27 platform upgrades.
Hope you get some break of the summer, too!
Sidenote: there are a few sponsor slots open for the rest of the year. Let me know if you or your org are interested!
Nice table showing the price comparisons from Stephen Hackett, 512 Pixels.
I understand that the overall component price increases kinda forced Apple into this. If anyone could afford lower profit margins, it would be Apple, but… well…
Still, the MacBook Neo price increase feels like a betrayal, as it was only introduced a few months ago and its price point was kind of its most relevant “feature.” The new price point is still competitive, since everyone else in the industry is also dealing with the shortages. Nevertheless, You would have thought Apple could have avoided this pricing see-saw.
I guess that Apple believed until just recently that they would be able to weather out the shortages and price increases, but now felt pressure to act quickly to maintain their profit margin.
Some time pressure probably stems from Apple’s standard yearly schedule. They may not want price increases to overshadow the new iPhone and iOS 27 releases with Siri AI in September. Price increases now, will make higher prices later this year “expected.”
Now the second developer beta-release of Golden Gate is available, Apple’s release notes are giving further details of features that are being deprecated or removed.
The attack exploits a fundamental flaw in how macOS XPC services establish trust boundaries by chaining CDHash kernel cache exploitation with NIB payload injection to impersonate trusted application components. Consequently, any non-root user can invoke arbitrary privileged XPC methods with zero authentication.
Not really a fundamental flaw, as macOS provides APIs to verify the app for these kinds of injections, but still important that developer actually use the verifications.
a Rust macOS implant that embeds a 3.5 KB prompt-injection payload of 38 fabricated “system” messages, built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis.
With much of Europe wilting in the heat this week, it’s time to remind ourselves of the warning signs that our Macs are getting too hot. As Macs don’t sweat in the heat as we do, it’s also vital to understand what we can do to help cool them down.
The hosts discuss Jerry installing iOS 27 beta on an iPhone 15 Pro Max and watch, reporting strong stability, snappy performance, and minor reported edge-case crashes, while noting Siri AI requires newer hardware due to RAM constraints and that others find the new Siri improved.
When end users are requesting new tools that will lead them to the promised lands, how can we as IT teams ensure that the tools are actually what they say they are, and how can we measure their risk in our environments?
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
I haven’t had much time to process the news from WWDC and neither been able to really experiment with the betas yet. Main reason is that I was at Jamf Nation Live in London earlier this week. We got to show some cool enrollment workflows with Setup Manager, Platform SSO, and Setup Checklist.
Thanks to all who came with questions or comments or just to say “hi!” It was great to see you all!
I will also be at Jamf Nation Live in Berlin next week. Registration is still open. It’d be great to see you there!
The moment it stops feeling like work is the moment you have outsourced not just the synthesis but the judgment. The friction is the difference between actual productivity and abdication.
As part of the release of Jamf Pro 11.29.0, the ability to run software updates using DDM is available for folks using on-premise installations of Jamf Pro.
If your fleet runs any Intel-only Mac apps, find them now.
This is a good article, but there are more ways to determine Intel only apps and binaries, which I posted a while back, but—sadly—that issue has been lost with the provider switch, so I will repeat them here:
Replace the ._name at the end with .path to get the path to the app instead of the name.
However, command line tools, i.e. binaries that are not apps, can also be Intel-only. These are a bit harder to track down, as they could be installed pretty much anywhere. You can use find to look through a specific folder:
Mac admins are often asked to remove software that was originally deployed by a vendor .pkg or .mpkg, and the uncomfortable answer is usually: “It depends what the installer put on disk.”
The use of the Suspicious Package command line tool here is intriguing. I am wondering why they assemble instructions for an LLM to build the final script, rather than just assembling a script from template pieces?
you can run iructl directly on your Mac to interface with your Iru tenant. Pull down current state, create new resources, push changes, review sync status: all from the command line.
I’ve been tinkering with Apple’s container tool on and off since it was first announced a year ago and with the new features in the 1.0 release, I ended up building a GUI frontend for it and it’s called ContainerManager.
David Starr (Workbrew) hosted Selina Ali, Kitzy, Arek Dreyer, and myself to discuss the device management news from WWDC. (YouTube) We had a lot of fun discussing the news and I really enjoyed the perspectives and opinions of my co-panelists. Thanks a lot for having me!
we learned a lot about the 2027 series of releases from Apple. We’ve been testing and exploring since the events of the Keynote, and here’s everything we’ve got so far…
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
WWDC previews Apple next major platform updates
In the Keynote, Apple, somewhat surprisingly, backtracked quite a few unpopular user interface choices. They also promised a year of general improvements, big and small. Then they introduced (again) the new Siri AI.
Overall, the keynote felt a less exuberant than keynotes past, which I consider a good thing. Apple's platforms and services have generally reached a level of maturity and sophistication that announcing new superlatives each year seemed quite unserious. I prefer Apple refining and improving existing features. Even so, there are lot of new things in the announcements that will easily take users and admins the next few months to learn and explore.
Apple also released the "What's new in managing Apple devices" session, the most important sessions for Mac Admins. If you haven't seen it yet, go on, watch it now. The rest will make more sense after you have seen it.
(Sidenote: Cyrus Daboo does a great job and I want to hear more device management news narrated by him.)
The session re-iterates that Declarative Device Management (DDM) is now the standard for Apple device management, a strong signal for device management service developers. If your solution is not yet all on board for DDM, it is high time to start looking for alternatives.
Apple announced that organizations will be able to purchase and deploy volume subscriptions for apps! DDM mechanisms to manage and deploy apps are coming from iOS to macOS. Platform SSO is getting improvements.
Not only do these improvement fix some real pain points, some of which have been around for a long time, but they also show Apple's commitment to device management and that the Enterprise team is receptive to feedback.
This year's beta phase and roll-out should be very interesting. Test early, provide lots of feedback.
This year's announcements at WWDC26 carry more operational weight than most. OS 27 offers a structural shift in how Apple devices are configured, secured and managed.
However, as now happens regularly, building a Golden Gate VM isn’t so easy in Tahoe, and is likely to fail without some magic components that we’re not provided with.
There's been some talk about building macOS 27 virtual machines on a macOS 26 host. The solutions so far include creating a macOS 26.5.1 vm and upgrading it or creating the VM image on a macOS 27 host and then moving it to a 26 host. I guess this will be sorted out in future beta releases.
Apple is trying to give the impression that it did all this extra work to meet the DMA’s requirements, and yet the EC rejected its proposals, so it’s their fault Siri AI isn’t shipping in the EU.
It will obviously take some time for vendors to implement all of the new features, but it’s exciting to see Apple “raise the floor“ of what’s possible across the platform.
Apple has carried through on this and announced publicly that legacy software update management no longer functions in all Apple 27.0 operating systems.
iOS 27 introduces a new device recovery mode. This is a Mac-like recovery feature where the iPhone is able to boot into an alternative UI that doesn’t involve loading the entirety of the main operating system.
The MacAdmins community holds a vast amount of information and resources, however, due to the sheer volume and the fact that there is so much spread around the web, it can become quite intimidating, especially for newbies.
One of the customization options called out in the release notes for Self Service+ 2.23.0 is whether or not the Self Service+ menubar icon is visible in the menubar.
Notifications for Jamf's Self Service+ application were only managed for devices enrolled after Jamf Pro 11.18, or via a custom profile. Jamf Pro 11.28.x version fixes this across your fleet
I thought the animated sequence was pretty delightful, so I captured four of my favourite frames, upscaled them, and posted them here for everyone to enjoy.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
Last Friday before WWDC
Against all expectations, this week had no major Apple announcements, unless you count some nice WWDC wallpapers and the winners of the 2026 Apple Design Awards. The tag lines for the WWDC announcements contain wordplays on "bright" and "glow," which does make one wonder if these are hints on more user interface changes (I don't dare say "improvements") or some thing else entirely?
a cluster of Go binaries with a shared deployment identifier and a C2 domain whose naming overlaps with a malware family researchers have been tracking. The samples call themselves "SStar agent"
the apps you open are only the visible layer. Beneath them is a second, larger world of embedded Intel code: audio plug-ins, printer drivers, video effects, screen savers, browser plug-ins and background helpers that nobody double-clicks and nobody audits.
We really should set aside an hour each month to explore lesser-known features in macOS. In today’s exploration I bring you Get Info’s sibling Inspector, exact duplication, a free slideshow, and an Easter Egg.
Unlike most of the other items in Privacy & Security settings, Location Services aren’t managed using TCC and tccutil, but by their own service locationd.
Jamf Setup Checklist is a great tool for getting your users ready to go from the moment they're logged in, however sometimes organisations need to populate Jamf Pro inventory fields to ensure device configuration is complete. This post covers an example of how to do just that.
The hosts discuss Apple TV shows they were late to, including The Morning Show and For All Mankind, and talk about Hail Mary Project, comparing the film’s “E.T.-esque” choices to Andy Weir’s book.
We all have a brand, whether it’s literally a company that we own or a company we represent, or figuratively as one we put out in the world. And if you’re like me, someone who hasn’t put much thought into what having a brand means, and why you should care about protecting it – this episode is for you.
we speak with Reitman—who is also the president and a co-founder of the Freedom of the Press Foundation—about the real stories of those who have been financially censored, why financial companies cut off customers for legal speech, and how a single company’s decision can create cascading consequences that feel impossible to fight.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
WWDC starts a week from Monday. Apple traditionally releases products and news they could not or did not want to show in the Keynote the week before, so next week might be interesting. Even a lack of such releases would be of note. Will Apple release the much anticipated M5 versions of the Mac mini and Mac Studio, or is even Apple's legendary supply chain challenged by the industry's parts constraints?
I want to approach LLMs from the perspective of the community we share, as people involved in technology.
There is "usefulness" in LLMs as tools, but I remain reluctant to embrace them in their current state while the companies that build and endorse them, demonstrate a continued disregard for the ethical, environmental, societal, educational, and economical consequences. This post does an excellent deep dive into the effects of LLM use on tech communities.
A Mac Admin's recap of NIST's mSCP Mac Admins Day 2026: the 2.0 launch timeline, what changed under the hood, new community tools, and what you need to review before June 23.
ClickFix is a social-engineering technique, […] in which a malicious web page presents a fake verification or support prompt […], silently copies an obfuscated shell command to the victim's clipboard, and instructs the victim to paste it into the Windows Run dialog or macOS Terminal. The victim runs the command themselves; no software vulnerability is exploited.
Vulnerability management is the broader discipline of finding, prioritizing, and remediating risk across your environment. Patch management is the operational practice of deploying software updates. Patching is one remediation option that comes out of vulnerability management. It is not the same thing.
How many external monitors can your Mac actually drive? Pick your exact Apple Silicon Mac — we'll show the maximum external display count, per-port resolution and refresh caps, valid configurations, and the gotchas that burn people.
for auditing purposes, it’s useful to know which API clients are using which API roles as API roles determine the permissions that the API clients have.
But looking back on me as a kid just starting out, I really had no idea what I was doing, so if I were able to build a time machine today there are eight things I would tell a younger version of myself.
This is great advice for learning in general. It is application, even if you are just planning to learn some shell scripting on the side.
Most teams don’t. brew is already installed on developer Macs. The challenge is visibility: what packages are installed, which versions are running, and where vulnerabilities exist.
Workbrew Free gives you a complete real-time inventory of Homebrew across your fleet. Deploy through any MDM and within minutes you can see every package, dependency, and CVE with zero disruption to developers or existing workflows.
Like a young child coming home from kindergarten with their latest crayon scrawls, the internet is currently awash with people sharing their AI-generated work. And just like the young child’s drawings, much of that work should be proudly put up on the walls within the artist’s house—and no further.
What is worth examining is what happens when this wave reaches software operating at a deeper level of a user's system. Free, open-source Mac utilities are appearing on GitHub many positioning themselves as a CleanMyMac alternative or as replacements for other established Mac tools.
MacAD.UK gave me a lot of firsts: my first visit to Brighton, my first professional conference talk, my first experience working so closely with a mentor on a presentation, and a reminder of how open and supportive the Mac Admins community can be. I met wonderful people, had great conversations, and left with the strong feeling that I would love to come back.
Apple today previewed a suite of accessibility updates that use Apple Intelligence to bring new capabilities to features users rely on every day, including VoiceOver, Magnifier, Voice Control, and Accessibility Reader.
Until macOS 26.4, Archive Utility had nearly unrestricted filesystem access. Combined with a drag-and-drop sandbox quirk, this let an attacker bypass App Sandbox data containers, Transparency, Consent, and Control (TCC) protections, and hijack third-party apps
Offering a supported managed migration may help ease some friction with users who have still not moved from Intel-based Macs to Macs with Apple silicon.
if your network is equipped with Mac(s) running the Apple Content Caching Service, this same content is downloaded one time from the Internet, and then shared from the local network storage.
If you point an AI coding agent at a vanilla MDM repo and prompt it to add a profile, you’ll get something back. It might even apply cleanly. It also might quietly overwrite an existing profile because it reused the identifier from the file it copied.
And Archiware have been great to entertain my feature requests and ideas for making P5 do what I wanted. Mostly extending the cli (and API) to help monitor the system with MunkiReport and a variety of shell scripts.
XCreds includes Xpsso, an innovative micro-service to enable Apple’s built-in Platform Single Sign-On (PSSO) to work with Identity Providers (IdP) that have not been extended to support cloud binding of Mac systems.
This episode is not that – it has many guests- who will introduce themselves, a hazy plotline, and was recorded with a stolen microphone, unofficially, guerilla style at the first ever MacAdmins Europe conference. Follow me throughout the day as I [Selina] accost victims- I mean guests- on the spot and ask questions about the conference, their perspectives, and what they’ve enjoyed most.
Adam Angst of TidBITS reflects on Apple’s 50 years through the lens of early tech idealism, arguing that what mattered most wasn’t Apple itself but the community around it, which was weakened by shifts like the end of Macworld keynotes, Apple’s vertical integration, and the decline of user groups and independent resellers.
Geoffrey Cain, author of Steve Jobs in Exile: The Untold Story of NeXT and the Remaking of an American Visionary. We talk about the book, how Steve became a leader at NeXT, and how the foundation that was built during this period led to Apple's enterprise success in 2026.
Clara Mansfeld, a historian working on digital communications at one of the institutions signed onto the open letter—the Foundation of Hamburg Memorials and Learning Centers Commemorating the Victims of Nazi Crimes.
🚨 Your workforce is saving time by connecting AI agents to email, file shares, and business workflows, with or without security's sign-off.
This free guide by Nudge Security breaks down the risks and gives you four practical steps to build visibility, enforce least privilege, and extend the controls you already have.
So this week I built a munki-pkg replacement app PKGBuilder. And next week I’ll have 3-4 other apps built too.
I do not want to curb Mat's enthusiasm and creativity in any way. I have always believed that creating a tool for a specific task is one of the best learning experiences, even (sometimes especially) when you are "re-inventing the wheel." Wielded properly, LLMs are a great tool to support and enhance learning. All the power to Mat X for solving problems, building useful tools, and sharing them.
Sharing your solutions can be another great step forward in learning and building experience. (Not to mention your resumé.) When your shared tool gets attention, you learn a lot about code maintenance and versioning, debugging, documentation, communication, and more. Building, using, and maintaining a tool for yourself is very different than doing so for a wider audience. Those are also important skills for a Mac Admin, not just for shared code.
But it does seem to me that we are replacing an "army of shell scripts" from various git repos with an army of Swift apps. That's not necessarily bad, but it's not really an improvement, either. You have even more tools to sift through when looking for solution. The app might be easier to use than a command line tool, but the code is harder to review and understand.
Mac Admins have to take responsibility for all code and tools they take from a repo, forum, website, or Slack message. Before deploying it to your fleet, you have to review and understand what it does and how it does it. There are no shortcuts. LLMs can be of great use to analyze and review any piece of code, but the built-in predisposition to please you and provide positive and confirming responses can lead to misleading results. The ultimate responsibility remains with you. The "AI" cannot and will not be responsible. You have to understand what you are deploying.
It's great and flattering when someone says "this is a popular tool from a well-known member of the MacAdmins community, so I can trust it." Even "well-known" admins make mistakes or their repo can be hi-jacked. Their tools may be tested for their particular use case, but it is surprisingly likely that your deployment reveals one or more unconsidered edge cases.
Most Mac Admins have more experience with shell scripts, so those are more understandable, readable, and easier to review than Swift code. Tools built with Swift get orders of magnitude less code contributions than shell scripts. Apps with a user interface are by necessity more complex than scripts or tools built for the command line. LLM generated code without refactoring and refinement, tends to be quite elaborate, redundant, and difficult to untangle.
It can be nice to have a drag and drop tool for a common task, but you don't really need to create a full-blown app to get that. You have always been able to simply add drag'n drop to a command line tool with an AppleScript applet, and Finder integration with a Quick Action.
Making certain tasks more accessible is a laudable goal. It lowers the barrier for people new to the job and community to achieve certain tasks. Automation saves time and errors for admins of every skill level. Building installer packages is a tedious and error prone task and we can certainly use more and improved tooling here.
But, understanding the structure of installation packages and how they work and how they can fail is also a crucial skill for people managing and deploying Macs. There are so many jagged and dangerous edge cases here, that automation cannot cover them all.
AutoPkg achieves great flexibility by providing the option to extend functionality with programmable processors. Installomator labels can contain custom logic. You need to learn and understand the simple use cases, so you can move on to tackle the difficult edge cases. You need to build experience, to be able to tell the difference.
I consider some other skills, like reading and editing XML plists (and knowing how to deal with binary plists or recognizing a legacy ASCII plist output and not trying to feed it into something that expects JSON) important, as well. Other knowledge, such as directory service architecture or MCX may seem useless, but is often useful when you dig further into the innards of macOS.
I am also wondering whether my perspective on these skills is skewed and biased by literally decades of experience and maybe, going forward, these new tools just might be able to abstract these things away, in a more user/admin friendly way.
Nevertheless, these "legacy" skills make me more effective when wielding an LLM. I know to formulate more precise prompts and recognize when the output is erroneous. I can tell the assistance of an LLM is more effective than in areas where I have less or no expertise, where I am "flying blind" and have to trust the output. It is generally accepted that LLMs are more effective when wielded by subject matter experts.
But how is the next generation supposed to build that expertise, when everything is automated, abstracted, and filtered through a chat bot? How will we be able to evaluate and pick the good and trustworthy tool, when we don't understand the code ourselves, but evaluate them using the same tools that built everything?
Again, this is no criticism of Mat's tools or creativity, nor the use of LLMs in general. But, as a community, we will have to figure out the generation and transfer of experience in this new era. I cannot pretend I have good answers or, honestly, any answers. I am afraid we are way past the point where we can outright reject LLMs and work generated with LLMs, despite the massive concerns regarding their ecological, ethical, economical, educational, and social impact. But the issues need to be identified, the questions have to be asked.
Ultimately, the Macalope would like to see Apple be a little less stodgy and a little more willing to experiment, even if it means failing from time to time. Is that too much to ask?
The anxiety is real and valid. But I've watched this movie before, and the ending is always the same: the tools change, the work evolves, and the people who adapt become more valuable than ever.
the sea change is coming regardless of whether it’s good, and that understanding what’s happening - clearly, without either catastrophizing or cheerleading - is the only way to navigate it.
One of the features included with macOS Tahoe 26.5.0 is a new option in the Energy preferences in System Settings for automatically starting a Mac when power is connected to it, either following a power failure or when the Mac is plugged in to power.
Starting today, end-to-end encrypted RCS messaging begins rolling out in beta for iPhone users running iOS 26.5 with supported carriers and Android users on the latest version of Google Messages.
This guide covers what the principle of least privilege means for device management, how to enforce it across macOS, Windows, and Linux, and how it maps to the compliance frameworks auditors care about.
This repository is designed to consolidate everything a Jamf Pro admin might need to configure Platform SSO with Microsoft Entra, and to migrate existing Macs.
This week we’re talking about Apple Business and all the changes that Apple’s made of late! We’re deep into the APIs and promises that exist in this critical platform.
Adam Engst (TidBITS) discusses a malware incident in a long-running public “Slack Bits” group where a bad actor impersonated Glenn Fleishman via a duplicate Slack display name, tricking him into downloading an info-stealer, prompting Engst to consider shutting down the 1,400-member community.
Conference season is fully upon us now. MacAD.UK and Mac Admins Europe were in the previous month, ACES, WWDC, MacDevOps and PSU MacAdmins are imminent. Mac Admins India Connect, JNUC, MacSysAdmin and Objective-by-the-Sea are a bit later this year.
🚨 In April, a compromised OAuth token resulted in a breach at Vercel. This is the reality facing security teams: 🥷 An infostealer hits a vendor in your SaaS ecosystem, the attacker works backwards from stolen access, and an old consent becomes the front door. 🚪
If you haven't made OAuth grant reviews a regular part of your on-going security program, you should.
Download Nudge Security’s OAuth & MCP Investigation Checklist to learn the repeatable way to uncover risky OAuth grants and MCP server connections.
If you haven't chosen the conference to go to or to present at yet, registration is still available for those later this year! (MacSysAdmin just opened registration.)
This is our sixth year doing the survey. Over the last few weeks, we took the temperature of about a hundred admins, half of whom report that they manage more than a thousand devices.
With six years of history, some interesting trends are emerging. There are some great gems in the full commentary, even though that is quite a wall of text to read through.
If you're on the fence, don't be. Everyone in this space started where you are, and I promise most of them are a lot nicer than your grumpy old IT boss.
Managed Brew Access closes that gap. It moves brew access management into Workbrew itself, so the Console state and the device state are describing the same thing.
deploying the managed preferences for Keynote, Numbers, and Pages will reduce confusion for users of these apps until such time that Apple figure out a way of organisations purchasing subscriptions for their app services.
If you want to restore just part of a snapshot, you can mount it as a volume in the Finder and copy the folders and files you need from there, as if it was a backup. This article considers how you can address a bigger problem, where your best choice is to return the whole of your Mac’s Data volume to how it was when a snapshot was made.
[I] didn’t consider minimum specifications for a usable VM. Given current interest in running a VM on a MacBook Neo, I thought it would be worth examining these afresh, from macOS Tahoe.
This article explains the differences between certificates and tokens in Apple ecosystems, including how each is used to secure communication, authenticate services, and manage access.
Everything is “AI” now, which means the word no longer tells you anything useful about how the system actually works. In software development, the shift isn’t happening in the models. The shift is in how we use them.
users could schedule the update for whenever made sense for them. 2am on a tuesday. lunchtime. tonight after work. they were in control of the timing. Apple handled the nudging.
The goal is to give you an in depth but approachable understanding of LLMs, how they work, and how they are trained. We will ignore some details, and provide simplified explanations where appropriate.
Jamf Icon Uploader is a utility that streamlines the bulk upload of icons to Jamf Pro, eliminating the tedious process of uploading them one at a time.
host Joe and guests discuss standards, policies, certification, and compliance with Michael Thomsen of Origin 84 in Sydney, continuing an ISO 27001 deep dive.
Velasquez about cybercrime’s impact on small businesses, the new threats being deployed because of AI, and what is necessary to protect business owners and their consumers.
Shadow AI is quietly accessing sensitive data across your SaaS environment. Learn how to close AI blind spots and get ahead of data exposure risks with this new guide.
Whether you're just starting to think about AI governance or looking to close gaps in your current approach, this guide gives you a clear, practical comparison of what works, what doesn't, and why.
The Mac Admins Europe team, led by Mischa van der Bent, with Rob Potvin, Jordy Thery, Anthony Darlow, and myself, put up a full day of amazing speakers, sponsors, and, most of all, the community. The host city Leiden, showed off with the most gorgeous sunshine.
Everyone, sponsors, speakers, and attendees, brought lots of enthusiasm and ideas. Many sessions had to start with a delay, because we had a hard time of herding everyone back in from all the socializing in the break area. It was a real community event.
We'd been talking about doing this for years, and we finally did it. Thank you to all who helped, sponsored, spoke, and attended.
It looks like this won't be the last time. No promises or details yet, but at the team's celebration/debrief breakfast this morning and the most used words were "next year…"
The Mac Admins Foundation is pleased to open applications for the 2026 Community and Conference Grant supporting attendance at the MacAdmins Conference at Penn State University.
An agent can translate a script from Python to Swift in fifteen minutes, a task that might take a human hours. On paper, that is a massive gain. But this speed creates a hidden tax. If you do not spend the time to refactor and document that code, you are just inheriting cognitive debt.
Kitzy wrote a response to Samuel's post. Dan Snelson published his updated AI Guiding Principles, which refers to Samuel's and my post. (Which the AI misinterpreted, twice.) I was asked about my thoughts on LLMs several times at Mac Admins Europe. (Likely provoked by me wearing a "rage against the machine learning" t-shirt.)
This discussion is very timely, valuable, and necessary. The concept and concerns around "cognitive debt" are fairly new. "AI burnout" describes a feeling many of us experience. I also believe the other impacts of this technology, and the behavior, choices, and marketing/hype of the venture capital infused AI industry raise significant ethical, social, economical, and ecological concerns, which are often left aside while focussing on the more immediate effects of how well the models may or may not perform. It is a complex, multi-layered challenge on so many levels.
As part of its engineering preparations for the switch to using Arm processors, Apple decided that the only practical way to support virtualisation on its new Mac hardware was to build it into macOS.
you've already solved the "how do devices get enrolled" problem. But there's a separate question worth asking: how do you know the device that enrolled is actually the device it claims to be?
every generation of Time Capsule actually runs NetBSD, and that it’s trivially easy to add support for Samba 4 and SMB3 authentication to your Time Capsule, thereby extending its life expectancy considerably?
Mac Devops YVR becomes MacDevOps YUL this year as the popular conference makes a move to a new city thanks to the World Cup. We’re here with conference founder Mat X to talk about what to expect, what’s on tap, and who should make the trek to Montreal
Login
