4 ms·

Regarding Find My Mac and the various locks that can cause. Does anyone have advice on a business case for this? I'm planning on switching our staff over to Mac

by selykg 4y ago

Regarding Find My Mac and the various locks that can cause. Does anyone have advice on a business case for this? I'm planning on switching our staff over to MacBooks this year and would love to understand the pros and cons of users using their own Apple ID versus a company provided one. We work remotely, so that could possibly complicate things. The last thing I need is a former staff member setting up Find My Mac and locking it to their Apple ID then leaving the company.

Xylakant 4y ago
This is one of the reasons we've switched over to an MDM solution. If you set it up correctly, the MDM can unlock the Mac, regardless of the apple ID used.
pc86 4y ago
We use macs at my job, there is MDM software available. It's clearly tagged with a sticker on the back, which I assume goes back to some entry in the MDM software, and even though I use a personal Apple ID (I created a new one for this purpose but same end effect) I have no doubt they could press a button to brick the machine until it makes its way back to them if they really had to.
- selykg 4y ago
  Awesome, that is probably the direction I need to head then. I have another company doing the general infrastructure, but I get to be the one deciding the rules. Trying to find the right balance between giving people a little freedom but not so much they hang me, or the company.
morpheuskafka 4y ago
I believe your MDM solution should be able to set up a corporate bypass for this as well as allow you to remotely locate the device: https://docs.jamf.com/jamf- https://docs.jamf.com/jamf- now/documentation/Using_Activation_Lock_Bypass.html Another approach is to just let employees keep or buy out their laptop when they leave as a benefit. The cost of a MacBook isn't that huge relative to a tech salary.
- eli 4y ago
  Data privacy and security policies can’t let ex-employees just walk off with devices containing company data. A neat feature Apple could maybe add is the ability for the user to have their device wiped in a way that generates a suitable certificate of destruction.
  - dfadsadsf 4y ago
    MDM allows you to remotely wipe laptop and you get confirmation that laptop was wiped. If you are a business with more than 2 people and provide laptops to employees, not enabling MDM is just negligence. Lots of inexpensive MDM services for all sizes of businesses.
- selykg 4y ago
  In this case we're a non-profit funded by grant dollars. So, we're spending a good chunk of cash on hardware relative to what many do primarily because I want quality products for our staff and I'd like it to be reliable and secure. I don't think buying it out will be a possibility, but perhaps. Always a discussion. We would definitely need to find a way to validate wiping the device though. Nothing we have is... that sensitive but I'd like to make sure they aren't walking away with user data. I assumed MDM might do something here but wasn't 100% positive.

by selykg 4y ago

Xylakant 4y ago

This is one of the reasons we've switched over to an MDM solution. If you set it up correctly, the MDM can unlock the Mac, regardless of the apple ID used.

pc86 4y ago

We use macs at my job, there is MDM software available. It's clearly tagged with a sticker on the back, which I assume goes back to some entry in the MDM software, and even though I use a personal Apple ID (I created a new one for this purpose but same end effect) I have no doubt they could press a button to brick the machine until it makes its way back to them if they really had to.

selykg 4y ago
Awesome, that is probably the direction I need to head then. I have another company doing the general infrastructure, but I get to be the one deciding the rules. Trying to find the right balance between giving people a little freedom but not so much they hang me, or the company.

morpheuskafka 4y ago

I believe your MDM solution should be able to set up a corporate bypass for this as well as allow you to remotely locate the device: https://docs.jamf.com/jamf- https://docs.jamf.com/jamf- now/documentation/Using_Activation_Lock_Bypass.html Another approach is to just let employees keep or buy out their laptop when they leave as a benefit. The cost of a MacBook isn't that huge relative to a tech salary.

eli 4y ago
Data privacy and security policies can’t let ex-employees just walk off with devices containing company data. A neat feature Apple could maybe add is the ability for the user to have their device wiped in a way that generates a suitable certificate of destruction.
- dfadsadsf 4y ago
  MDM allows you to remotely wipe laptop and you get confirmation that laptop was wiped. If you are a business with more than 2 people and provide laptops to employees, not enabling MDM is just negligence. Lots of inexpensive MDM services for all sizes of businesses.
selykg 4y ago
In this case we're a non-profit funded by grant dollars. So, we're spending a good chunk of cash on hardware relative to what many do primarily because I want quality products for our staff and I'd like it to be reliable and secure. I don't think buying it out will be a possibility, but perhaps. Always a discussion. We would definitely need to find a way to validate wiping the device though. Nothing we have is... that sensitive but I'd like to make sure they aren't walking away with user data. I assumed MDM might do something here but wasn't 100% positive.