3 ms·

Wow I'm so happy I'm moving away from Mac administration. I currently manage a big userbase but we still don't have M1s in our environment as our antivirus solu

Wow I'm so happy I'm moving away from Mac administration. I currently manage a big userbase but we still don't have M1s in our environment as our antivirus solution (Cylance) is really slow in supporting it. Apple is introducing more and more mechanisms in the name of security but they keep access and information very close to their heart. All us Mac admins have struggled with SecureToken in combination with AD accounts and it took two major releases for Apple to actually introduce a way for us to manage these properly through MDM. In the mean time most information had to be gathered through blogs such as this one. Another issue is that more and more enterprise management features are becoming dependent on managed (federated) Apple IDs. But Apple requires that the email and identifying account address (UPN) are the same which will never happen in our 200k user environment. So we're stuck with more and more things to work around. This is really something that should have been considered from the start. And this owner key thing sounds worse. Security is good but the end user or corporate admin should have the keys to every lock. Not just the vendor. Now my successor can deal with this stuff. I used to be a big fan of macOS personally too but I moved over to FreeBSD 2 years ago and I'm glad I did. I really want an OS that answers to me.

gjsman-1000 5y ago
You could just set security to Permissive. It’s as secure as any Windows machine and disables this, even though the only time you’d ever run into this would be if you ran 2 Mac installs on the same machine, which surely a corporate deployment isn’t doing.
- GekkePrutser 5y ago
  You'd be surprised. Macs for us are only half a percent of our userbase (yet still many hundreds), and are mainly used by app developers and graphical design roles. Especially the app dev guys tend to have fairly nonstandard usecases. However most of it happens in labs firewalled off the company network. Anyway, I'm glad I'm not the one having to figure out how to work around these things with very limited documentation from Apple, like I have before ;)
  - gjsman-1000 5y ago
    Also of note is that this article only applies to M1 macs, so unless you running a beta of Monterey, you’d have to be dual-booting Big Sur for some reason.

gjsman-1000 5y ago

You could just set security to Permissive. It’s as secure as any Windows machine and disables this, even though the only time you’d ever run into this would be if you ran 2 Mac installs on the same machine, which surely a corporate deployment isn’t doing.

GekkePrutser 5y ago
You'd be surprised. Macs for us are only half a percent of our userbase (yet still many hundreds), and are mainly used by app developers and graphical design roles. Especially the app dev guys tend to have fairly nonstandard usecases. However most of it happens in labs firewalled off the company network. Anyway, I'm glad I'm not the one having to figure out how to work around these things with very limited documentation from Apple, like I have before ;)
- gjsman-1000 5y ago
  Also of note is that this article only applies to M1 macs, so unless you running a beta of Monterey, you’d have to be dual-booting Big Sur for some reason.