7 ms·

In that case you should know whether a management profile[1] has been installed, but you shouldn't assume you can simply create another admin account. [1] http

• Hamuko 5y ago
  If I don't see a Profiles section in my System Preferences, does this mean that my employer has a very high level of trust in me?
  • mike_d 5y ago
    It means your employer has a very low level of security and you should be genuinely concerned about any personal or financial information you gave them during your hiring.
    • Hamuko 5y ago
      Seems like a vast overstatement.
      • mike_d 5y ago
        Endpoint management is like bare minimum security basics. At this point luck is the only thing stopping a BEC or ransomware attack.
        • siva7 5y ago
          nonsense. there is no one-size-fits-all solution for security.
          • mike_d 5y ago
            That is like arguing "not all cars need seatbelts." You might disagree on how many airbags or crash avoidance widgets a car needs, but the vast majority of the industry agrees that seatbelts are a requirement.
            • R0b0t1 5y ago
              EPS isn't like a seatbelt. Often EPS (like kernel mode AV drivers) is used as an intrusion vector and reduces security.
              • mike_d 5y ago
                Every single FAAMG company runs managed endpoints. I'm not sure why you are arguing that companies having no control over their hardware is somehow a security feature?
• GekkePrutser 5y ago
  I manage hundreds of Macs. Just wanted to add that these management profiles don't say much about what you can and can't do and what your company can do. You have to go through each of them to see what they do (the management one is just the master one, there will be tons more which specify exactly what is restricted and/or enforced). Apple is very good at privacy protection, asking the user for permission even on managed machines, which can be bypassed with certain profiles but it's pretty tough to do. I personally take this as a sign to think long and hard about whether I really should. Co-usage is just a thing these days. A little trust in your employees is also important. Usually these profiles just mandate some basics like password complexity, disk encryption and they set standard settings like WiFi and printers so you don't have to bother figuring all that stuff out. And it will install applications you need and security stuff. And don't forget, a password complexity profile on a Mac will apply to all accounts created on it. Even ones created by the user. Many things work like this, on a machine level. It's more about establishing a security baseline than tying the users' hands.