Following up on the eMudhra intermediate-CA compromise. Apple's OS fix cleans the system trust and /etc/ssl/cert.pem — but it does NOT touch the CA bundles that individual Python installs vendor. On our fully-updated Mac, Apple's own /usr/bin/pip3 (Command Line Tools) ships certifi 2021.05.30, which still contains both roots the compromised intermediates chain to: "AAA Certificate Services" and "emSign ECC Root CA - G3". Xcode's bundled python and several app-bundled pythons are the same.

So `pip install` and anything using those interpreters can still trust the leaked roots, even though curl/git and your up-to-date venvs are clean.

Check each python you use (reads the file, changes nothing — match the two SPECIFIC roots, not just "emSign", since legit emSign roots are still in play):

BUNDLE=$(python3 -c 'import certifi; print(certifi.where())')

grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' "$BUNDLE"

Any output = that interpreter still trusts them. What we saw on our Mac:

# /usr/bin/python3 (CLT) -> certifi 2021.05.30

# Subject: CN=AAA Certificate Services O=Comodo CA Limited

# Subject: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited

# ...meanwhile /etc/ssl/cert.pem (curl/git): 0 matches — clean

Gotcha that burned us: don't grep just "emSign" or trust the cert count — "AAA Certificate Services" was dropped from certifi before "emSign ... G3", so a bundle can look half-fixed. Match both exact names.

Fix: upgrade certifi (2026.10.19+) in each environment, or point SSL_CERT_FILE / REQUESTS_CA_BUNDLE at an updated bundle. For Apple's bundled pips you can't upgrade in place, use a venv with current certifi for anything that matters.

Anyone else seeing the 2021 certifi in CLT/Xcode pip? Curious how widespread this is.

We're mostly a windows shop but we also use Jamf Pro to support IOS and Mac devices.

How do you stay sane with the constant change?

PPPC profiles that worked for months now need adjustments with updates.

Printer Drivers that have been working just fine now suddenly don't work anymore and we're probably going to just end up having to create a driverless printing setup just for the Macs.

DDM, SSO, etc, etc. It's all so much 😭. Just constantly having to make adjustments to keep things stable.

Just downloaded and installed the 27.2 update and now my Intune-managed mac with platform SSO via Secure Enclave FINALLY lets me see the login disclaimer and restores the previous username and password box which logs in after only entering the password once (like in Tahoe).

Prior to this, the early adopters in our fleet were getting very confused by login screens that froze or kept repeatedly prompting before letting the user in.

Just a nice case of the update actually fixing something for once (and hopefully not causing any other issues)

Hey all, some may remember me a while back posting about ScopeMap. Version 2.0 just dropped: https://github.com/Jamf-Concepts/scope-map

Notable changes:

All calls can be done using Platform API now
Blueprint information overhaul (including per app device status reporting that isn't in the Jamf GUI)

Flagging configuration profiles that have a DDM capable payload to alert you of ones that can/should be considered for moving to a blueprint

General UI and bug fixes

Hope it helps some of you guys out if you weren't aware of it and if you have it already make sure you update your version.

As always, any feedback is always welcome.

We've confirmed that sudo jamf recon is failing on multiple Macs, including both newly enrolled devices and previously healthy devices. jamf checkJSSConnection succeeds, and devices continue receiving policies and configuration profiles normally. However, inventory submission fails immediately after "Retrieving inventory preferences..." with the error "There was an error. Message has no content." This appears to be affecting inventory updates globally rather than being isolated to a specific device, as both our main office and remote users are experiencing the same issue. Has anyone else encountered this issue or identified a root cause or resolution?

I'm a former Windows user who recently bought a 15-inch MacBook Air M5 with 24GB of RAM and 1TB of storage to escape the hell that Windows has become.

I love this computer.

I currently have the latest version of macOS Golden Gate installed.

I installed Java 8 (from Oracle) update 511, and it added a section in the bottom left of System Settings, but when I click on it, it's completely blank, and I can't see any options in the Java Control Panel.

Are you experiencing this?.

It's a bug?

Is there a solution?

Because I've tried everything I can think of, and I can't fix it.

Thank you very much.

Best regards. de

I appreciate knowing where data is stored locally on the Mac. For instance, messages are stored at /Users/Username/Library/Messages. You can back this folder up with Time Machine or whatever backup software you use.

Is there a similar place where the Siri app stores your conversations and attachments? I know they are stored on the system, but cannot for the life of me figure out where.

Thanks for any help!

Any other admins remember the days of having one for their PowerMac G5?

PowerMac G5 external AirPort Wi-Fi antenna (Apple part number A1066 or 603-3420)

Trying to identify what sets the isMdmMigrationCapable flag to true.

Requirements are, macos 26+, ADE enrolled and MDM managed which the device now meets.

Currently flag set to false in ABM due to the fact that macos was 14, but it was since updated to 27 yet flag is still false. Is it a timing delay or else?

API path for isMdmMigrationCapable flag is read only.

Hello! Just FYI, looks like Apple Business/School Manager changed how they distribute free apps.

The UI for Apple School Manager > App Store changed.

• Free apps no longer need to have licenses "purchased" in Apple Manager
• Only apps that need to be paid for will show you the “Enter the number of licenses” quantity option

For our MDM Jamf Pro instance, once an app is “Added” in Apple School Manager, it gets added automatically into Jamf under Devices > Mobile device apps with a license number of ‘2147483647’ (integer limit lol) for the Volume Content.

I spent so much time trying to figure out how to get the licensing for a new app I added and finally noticed these changes. Didn't see this documented anywhere so I just wanted to make a PSA!

EDIT: Reply from Apple support:

There were some enhancements to Apple School Manager yesterday with regards to purchasing Apps.  More information can be found below:

Apple School Manager release notes

https://support.apple.com/guide/apple-school-manager/axm357705f83

Intro to apps and books licenses in Apple School Manager

https://support.apple.com/guide/apple-school-manager/axme19b23f7f

Get apps and books in Apple School Manager

https://support.apple.com/guide/apple-school-manager/axmc21817890

In particular, you can follow the steps listed HERE to purchase books and assign them to your Location of choice.  HERE are the steps for Free Apps.  There is one big change for Free Apps.

Free Apps no longer require you to provide a number of licenses when getting them from Apple School Manager.  In short, once you have obtained a Free App and assign it to a Location, then you will never have to get more licenses.  Perhaps that is causing the confusion and that is why you only see the Manage option when viewing a Free app.

ASM Release Notes (they have 2 pages, 1 they don’t update 🤦🏻‍♂️): https://support.apple.com/guide/apple-school-manager/release-notes-axm357705f83/web

ABM Release Notes: https://support.apple.com/guide/business/release-notes-axm357705f83/web

A MOFA-parity update to the MDM-agnostic, unified, user-friendly macOS script to repair, reset, or remove Microsoft 365 components

Overview

The Microsoft-365-Reset.zsh script seeks to provide an MDM-agnostic, unified, user-friendly approach to all of Paul’s Office-Reset goodness.

Additionally, one resolution to the nightmare that is the Adobe Acrobat Add-in Removal for Microsoft 365 is also included.

Continue reading …

Macs are now about 1 in 9 business computers in the US and climbing, but the pool of IT people who really know how to manage them is still small. Jamf is the name companies look for when managing Macs and iPhones at work.

Hey everyone,
I own a perpetual license for Office 2021 Home & Business for Mac, tied directly to my Microsoft account under "Purchased products". Every time I download the installer from my account dashboard, it delivers a build that behaves entirely like Microsoft 365.
Even after installing it, the apps demand a 365 subscription instead of activating the perpetual 2021 license. Even worse, if it briefly launches, the auto-updater immediately pushes it to the 365 branch.
I've already tried:

• Completely removing Word, Excel, and Outlook from /Applications.
• Downloading the installer fresh from my account page.
• Logging out and logging back in with the account that holds the license.

Reinstalling changes nothing — it just drops right back into the 365 subscription prompt.
Is Microsoft actively breaking standalone 2021 activations on macOS, or is there a specific build/fix needed to lock it to the perpetual license without it reverting to 365?
Any help or workaround would be appreciated.

I work in an all Microsoft shop, but we are now starting to introduce some Macs into the environment. One pain point has been a remote support tool. We've always used BeyondTrust, but with Macs although we can get it to work, it really needs to be babysat due to updates in the app or changes in the OS. Are there any options out there that are low maintenance for use on Mac? Essentially one that is easy to deploy from Intune and where you do not have to frequently update scripts to grant it access to actually work?

Powering Up Before JNUC: A Look Back at This Year’s Level Up
Recap of Level Up, the hands-on Jamf training day held before JNUC. The article covers the two tracks offered, what happened in the classrooms, and feedback from attendees and instructors.

Hello Everyone,

I am trying to find a way to record OOBE on the mac, it's an enterprise mac, and we have made some changes to the OOBE and need to create video guide around it. I have tried OBS but it wasn't detecting the other mac. Either i am missing something there, or that method won't work. Anyways, i would really appreciate if you can help me find out a way to get this done.

Previously we use to power on device and select region and press command control option + T but this process now asking for admin super user password.

Current macOS releases (27.0.1 / 26.7.1 / 15.8.1, all dated 28 Sep) still ship /etc/ssl/cert.pem with the two roots the leaked eMudhra intermediates chain to. Apple's block covers Safari and apps using the system's own security framework, but the built-in curl, git, python3, openssl (and perl/ruby) verify against that file. On a fully updated 26.7.1 with Apple's file, curl and git connect to the advisory's test host and openssl verifies the chain. The advisory now covers this too (Filippo Valsorda's PR #52 on we-have-a-problem.com), and they're flagging it to Apple.

Quick check on any Mac (0 = still trusts the leaked chain, 60 = refuses):

/usr/bin/curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; echo $?

We wrapped the advisory's awk removal in a script that's safe to push fleet-wide:

- no-op if the file is already clean

- timestamped backup, never overwritten

- checks the new file (cert count minus exactly the two removed roots) before replacing

- keeps 644, re-tests against the advisory's host, restores the original on a wrong result

- refuses to touch a damaged file

- runs as root with no prompts; exit 0 safe/fixed, 1 still exposed (rolled back), 2 couldn't tell

Heads-up: Apple's built-in pip3 (and venvs made from /usr/bin/python3) carries its own outdated roots, so it needs the advisory's PIP_CERT sitecustomize fix as well. And if you run official Node.js, update to 26.12.1 / 24.22.1 / 22.23.4 (all out 21 Oct).

Script, source and SHA-256: https://www.deimoscore.com/wardlatch/#mac

The project is open source (Apache-2.0), holds a self-certified OpenSSF Best Practices passing badge (bestpractices.dev project 15757), and releases are signed with Sigstore attestations, so you can verify what you deploy.

Disclosure: I'm one of the people behind it. Feedback welcome, especially from anyone on 27.0.1 or 15.8.1. I've only tested 26.7.1.

Update 24 Oct:

- The Mac fix script hasn't changed (same SHA-256 as on 21 Oct).

- On 27.0.1, one admin saw the script's re-test put the original file back, so nothing was changed. We're working out why in the comments below. If you're on 27, please share what you see.

- New: every Mac step on one page, including pip, which keeps its own copy of the roots: https://www.deimoscore.com/wardlatch/mac/

- Wardlatch, the free checker behind this, is now at 0.1.9. It tests each tool on a Mac separately (curl, python3, Node, certifi in your venvs, cloudflared and more), and it now also checks 9 other live incidents: PHP, GitLab, Plex, LiteLLM, the OVHcloud CLI, WordPress plugins, planted GitHub Actions workflows, keys committed to code, and headers that give away your name. Every "safe" now says what it checked. Versions before 0.1.9 could say safe without really checking, so if you ran it before, please run it again:

npx wardlatch@latest

It runs on your machine, sends no data (only test connections), and changes nothing. Release notes: https://www.deimoscore.com/newsroom/2026-10-24-wardlatch-0-1-9-every-safe-names-what-it-checked/

I’ve been setting up a Windows 11 environment on my M-series MacBook for some specialized work software and light gaming, which brought me straight to this.

When virtualizing ARM-based Windows on Apple Silicon, performance and usability come down to how well the hypervisor handles hardware acceleration and OS-level integration. Open-source virtualization frameworks require manual configuration for graphics drivers, shared folders, and network bridging. On the other hand, Parallels Desktop optimizes hardware pass-through out of the box with Coherence mode, native Apple Silicon graphics acceleration (DirectX 11/12 support), and one-click Windows installation, which cuts down configuration overhead for daily use.

For those running Windows virtual machines on Apple Silicon for work or everyday apps, how do you weigh DIY tinkering against paying for pre-configured integration? Has Parallels Desktop stayed fast and reliable for your daily workflow, or do you prefer tweaking open-source setups?

Ay, as a part of admins that got hit by the Meraki MDM EoS, im currently trying out the new built-in MDM in Apple Business.

So far it works like a charm, deploying configs via mobileconfigs and apps, be it from app store or third party. The only issue i couldn’t get around so far, some enterprise applications from certain vendors require config files to be created under /opt/, which aren’t bundled with the provided pkg installer.

So far i tried:

- small package with payload containing the path and files, didn’t work
- patching the installer provided by the vendor, repack and sign, no luck either

In both cases a self-issued cert was used for signing, which was deployed on the test device via pem deployment directly from the MDM. Cert is trusted, manual install of .pkg via installer works flawless.

Does anyone else have experience in that area? Kinda out of ideas for now :(

How Apple demonstrates its enterprise apathy with each new major release of macOS

Background

When the first beta of macOS 27.0 was released, we opened an AppleCare Enterprise Case and filed Feedback to report some unexpected behavior.

The macOS 27.0 Beta 3 release notes acknowledged the keys “did not work,” and by macOS 27.0 Beta 5, they were marked as “working correctly,” yet the immutability behavior we rely on from macOS 26 is no longer present for Standard Users on supervised devices, which was just confirmed with macOS 27.2 Release Candidate.

Continue reading …

Hi All,

Looking for some advice and similar experiences as googling has unfortunatley come up dry.

I'm seeing issues using migration assistant both as part of setup assistant and post setup. The error i'm seeing is the below
This Mac can't be used to migrate data: Due to an issue with unlocking this system, you can't migrate. Please update this Mac and retry.

Most troubleshooting steps recommend updating to same OS (have done 27.0.1) and same network (have tried both wi-fi and cable) but still seeing the same thing.

I am using Platform SSO with secure enclave activated during setup assistant. The user accounts are also not local admin and instead, migration assistant is opened using the local LAPS account. I'm starting to think its one of these configurations which is causing the issues but just wondering if anyone else has got this working in a similar scenario.

TIA

if your intune ios compliance floor is worked out by arithmetic, the 18 to 26 jump probably broke it
ran into this a couple weeks back. we keep apple devices on n-1 for corporate and n-2 for personal, and the minimum version was getting worked out by subtracting from the current major. fine for years.
then apple moved to year based numbers and ios went 18 straight to 26. so "current minus 1" is now 25, which never shipped, and the floor ends up pointing at a version that doesn't exist. devices that should be non compliant just quietly are not.
there are already a few runbooks that auto-update the policy off the SOFA feed (rozemuller and skiptotheendpoint both have good ones). those are solid. i just didn't want mine writing to intune, so i went the other way: a power automate flow that reads the SOFA feed every morning and emails the service desk the day after a new major ships. a human makes the actual policy change. no graph scopes, no write access, it literally can't touch a compliance policy.
two things that got me if anyone builds the same:
read the version by position in the feed (OSVersions[0], [1], [2]), not by subtracting. after the jump, position is the only thing that stays right.
apple's own gdmf feed wouldn't work from power automate's http action, the cert chain isn't trusted and there is no skip-cert option. SOFA served over a normal cert so it just worked.
wrote it all up with the expressions, jcan drop the link if it's useful.

https://ketankamble.com/blog/apple-os-release-watch-for-intune-compliance/

Transitioned my main work setup to my Macbook but i still have 2 or 3 Windows utilities i cant replace with Mac equivalents. Now im looking into Parallels vs Crossover to bridge the gap. Im not into gaming, this is strictly for documents, desktop specific extensions and legacy client software.

I like that Parallels desktop sets up an officially supported windows 11 instance where peripheral support, print drivers and shared folders work right out of the box without tweaking configs. But im wondering if spinning up a full VM is too much if i only open these tools a few times a day. How are you guys handling windows-only software on macOS? Is having the complete windows environment in Parallels worth the extra drive space for peace of mind?

What is everyone using to lock this down? (block lists, Security Cloud, config profiles, Jamf AI Governance... hoping nobody installs Claude Code, lol)

Have you seen anything still get through?

Claude Code, Copilot, ChatGPT, browser extensions, local models, something weird?

Eric Abel (Jamf) is covering Jamf's AI Governance on the next LaunchPad meetup if you want the walkthrough.

Would love to read your war stories here though.

When:
🗓️ Fri, Nov 6 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

Hi everyone,

I'm managing 100+ student MacBooks through Mosyle MDM and trying to force-update them to macOS Tahoe 26.7.1 (Build 25G241).

I've tried running the following command with sudo:

sudo softwareupdate -i "macOS Tahoe 26.7.1-25G241"

The update downloads successfully, but it doesn't proceed with the installation. The output is:

Downloading: macOS Tahoe 26.7.1
Downloaded: macOS Tahoe 26.7.1

After that, the update doesn't appear to install. I've also tried running the command through Mosyle, but I'm having trouble getting the installation to complete.

My questions are:

• Is there a Terminal command that can force the installation of a specific macOS version and build?
• Since these Macs are managed through Mosyle, is there a reliable way to trigger the installation remotely without requiring students to authenticate manually?

I'd appreciate any advice or recommendations from anyone who has dealt with this in a managed Mac environment.

Thanks!