3 ms·

If you’re a corporate admin you can whitelist kernel extensions via MDM, maybe that would help? https://support.apple.com/guide/mdm/kernel-extension-policy-pay

• beermonster 5y ago
  Many years ago, when it wasn’t possible to set a strong iPhone password, I worked out I could construct an Exchange ActiveSync profile enabling a strong password policy instead of a four digit number. I didn’t have a corporate Exchange server so I pushed it to the device using the fantastic and open source z-push. A strange length to have to go to mind. I also used this method to force full device encryption and wiping device after 10 failed attempts. All of these are now possible to configure in settings now and device encryption is on by default.
• GekkePrutser 5y ago
  I know! And I do (it prevents popping up a user with a gazillion prompts to accept when they enrol) But this is just kernel extension stuff. We know users use some software (not with kernel or system extensions) that's not allowed in our environment. Zoom for example (people are allowed to use it in the browser only for contact with external parties but many people install the full thing anyway). Our security department has banned the full client because of the backdoor it introduced. Right now we mark it as malware in our antivirus, but it would be great to be able to prevent it altogether.