MacTech 08132019

MacTech Groups Agenda
Tuesday, Aug 13, 2019
2:30 to 4:30 pm
Room B16-B Hillsborough Bld.

Announcements – 5 min

  • OIT only supports macOS 10.13.6 or newer
  • Status page for services see
  • OIT Macintosh Support Web Site for updates.
  • Slack group #macintosh
  • Apple Sales: Paul & Sys Eng: Dave
  • macOS versions that shipped with Intel Hardware:
  • Vintage and Obsolete Apple Products:
  • Apple Education Support Line 800-800-2775 use this number only. Always verify Apple Care Coverage.
  • Antivirus for university owned devices –
  • Unity Macintosh Workflow uses Active Directory configuration with local home directory at /Users/$uid$
  • OIT supports only Apple, Intel (i386) hardware for Mac OS and software. Only unmodified iOS is supported.
  • Please remember to check prices at to verify best price with NC State Marketplace
  • Authorized NC State personnel wanting to get training and tools for Apple Certified Technician should request invitation by opening a help desk ticket at Must login to GSX monthly!!
  • UNC Combined Pricing Initiative (CPI)
  • JAMF Pro Enterprise service, and for details
  • JNUC 2019  Everette attending, Joey J. Presenting.

Training – 5 min

OIT-iOS Mobile Device Security  – TBA

OIT-Managing Apple Devices with Jamf Pro – Sep 24, 2019 –

OIT-Jamf Pro Best Practices for Packagers – Oct 24, 2019 –

OIT-Advanced Apple Device  Management with Jamf Pro – 11/19/2019

CrashPlan for Sub-Org Administrators – Request –

Local Based Commercial Training –

JAMF Pro Training –


Service Updates – 15 min

Configuration Management  – Jamf Pro 10.11.1 is production.
Jamf Pro 10.14.1 is now available for test on
Our production service on will be updated to 10.14.1+hotfix (unless issues are found) on Sep 4, 2019 starting at 1800.
Release notes:’s_New.html  PLEASE TEST!
NOTE: For emailed Enrollment Invitations (and any other email notifications) the From field MUST be

CommunityPatch – No change.  PLEASE TEST in!!

CrashPlan – Move to fully cloud hosted version on Aug 27, 2019.  The web interface look and feel will change.  The client look and feel may have slight changes. Applying 6.8.9 update Thu Aug 15 to fix security issue on current server.

Internet Recovery – Command-Option-R to install latest version for hardware or Command-R to install currently installed version.

Software Packaging – autopkg-conductor is installed and working  with a new version of JSS-Importer! We still see an occasional upload failure but for the most part (97% wish) packages upload as expected.
We are working on new recipes that only upload packages and set package categories (old ones tried to create test policies, groups, etc) to increase the reliability even more.

AntiMalware– MSSCEP is End Of Life by Microsoft and should be removed.   DetectX Swift is now available and should be installed see

Sensitive Data Discovery – NCSU-Campus-Spirion10800.pkg

Apple School Manager – No changes or updates.  Working to test and see if we can enable Federated Login with NCSU Azure.

AppleCare for Enterprise update – AppleCare for Enterprise is on hold pending Apple being able to add to MarketPlace

Endpoint Protection Standard – Phase 1 deadline has past. Phase 2 is Dec 31, 2020.  Please note the updates to the implementation plan to include iOS/iPadOS with no deadline yet.
See Jamf Pro Cheat Sheet at:

Adobe Packages– 5 min

OIT has create individual packages for each of the current Adobe CC 2019 software titles and they are available on Jamf Pro with names of the form:

NCSU-Campus-AdobeCC2019-<ProductName><ProductVersion) like for example
This includes Acrobat.
The installers are all named license.  Any one or all of these can be converted to Shared Device License by making the very last installer be the licensing package for your license.
NOTE: there is no package or license that will allow the applications to run without logging in.  As I understand it, OIT Licensing is still working to get federated login working.

Interest in Patch Management Service – 5 min

With the patch management standard, we have been working to automate as much patching on macOS as possible.  This includes using App Store apps with automatic update, configuring Jamf Patch, and using Autopkg recipes to provide installers.  Recently a few 3rd party patch source servers like have started to be available.  These promise to provide curated, verified Jamf Patch definitions  for a large number of titles (Kinobi already provides 1,000).  These are updated at a known schedule.  While we would still have to provide installers this would automate some of the process and allow us to provide our own definitions if needed.  Costs are not huge (Kinobi is ~$2150 per year).  Would folks be interested in OIT researching 3rd party patch servers ?

Reclaiming our Authentication Domain from Apple or Why is my iTunes asking me to change my Email ? – 15 min

IF we move our Apple School Manager configuration to use Federated Identities from our NCSU Azure instance we will be required to use Email addresses that end in “” for login.  This has the side effect of conflicting with every personal iTunes and iCould account that has been created with an email address (We had similar issue a few years ago when we went to our Google accounts).  Initially this will effect a small number of us that are using ASM but as we move to macOS 10.15.x and potentially use Azure for device login more folks will be affected.  There is no action we can take to change this  or help the end users.  Apple will notify and enforce the needed changes according to this web page:

OIT will announce the date of this change if/when we have finished testing via sys news and other usual channels.  Please be aware of how this might impact your users and point them to Apple’s documentation.  The OIT Help Desk will not be able to “fix” this and will simply point end users to the same documentation.

Measuring Success of EPS – 15 min

Now that the EPS phase one deadline has past, I wanted to have a discussion on how each site is measuring success.  What metric are you using, how often are you measuring, and what reports are you producing.
The phase one requirements:
Enroll endpoints into approved CMS. – How are you making sure endpoints stay enrolled?
Establish an ongoing collection of software inventory. – How frequently are you checking the last inventory date?
Provide anti-malware and antivirus protection. – How do you report last scan, AM/AV software patching, and has your site completely remove Kaspersky?
Require authentication for device access. – Can you report on the status of automatic login?
Provide OS and software patching. – What report do you look at to make sure each application is at current version?
Provide ongoing Sensitive Information Identification and Remediation (SIIR).Discussion. Do you have a report that shows the version of Spirion being run on each device?


Endpoint Protection for iOS/iPadOS devices – 15 min

As noted earlier the implementation plan for endpoint protection has added an undetermined deadline for “mobile devices”.  For Apple devices this would include iOS, iPadOS, tvOS , and watchOS devices.  Not much has been said about how the security controls should be implemented.  For tvOS, so far, the devices does not store university data or sensitive data beyond passwords for accounts.  For watchOS again so far the devices do not store university data but this may change with the next OS and the App Store for Apple Watch! The main focus right now should be on iOS/iPadOS devices.  Best practice already indicates the following for the EPS controls:

Configuration Management – Jamf Pro is available for management of iOS and tvOS devices
Inventory – Enroll in Jamf Pro where daily inventory is collected
Authentication – set a passcode with some “timeout” that requires re-entry, Best practice on tvOS is to require a password to change settings or add apps.
“Full Disk” Encryption – setting a passcode enables encryption and builtin sand boxing provides extra protection
Network Encryption –  our Cisco AnyConnect VPN is available free from the App Store and use of https, etc protocols for connecting to services should be observed on all platforms regardless
AM/AV – NCSU does not currently offer AM/AV software for iOS/iPadOS devices.  Devices should not be jail broken.
Sensitive Data – NCSU does not currently offer Sensitive Data remediation software for iOS/iPadOS devices.
OS and Software Patching – this is provided by Apple and the App Store vendors. Best practice is to turn on automatic update.

Q&A – 15 min

You ask we try to answer


Next meeting:

MacTech – Tue. Sep 10, 2019 in Room B16-B Hillsborough from 2:30-4:30 pm.

MacTech – 2nd Tuesday each month: Jan, Feb, Mar, Apr, May, Jun, Aug, Sep, Oct, Nov, Dec

MacTech dos not meet in July.

Meetings usually held in B16-B Hillsborough Bld.

Please mark your calendar.