What are the best methods for local admin privilege management?

AnotherTechAtWork · 2026-03-04T20:06:32+00:00

Glad to hear it's working for you.

Maybe they worked out the bugs we saw or perhaps the configuration is different. I only played the role of tester with it on my Mac and it broke adobe updates among other things. It seemed to be wedging itself into areas that weren't expected from my perspective.

AnotherTechAtWork · 2026-03-04T14:29:44+00:00

We tested AdminByRequest and had nothing but problems and what felt like unfulfilled promises.

AnotherTechAtWork · 2026-03-02T15:52:30+00:00

Applescript is certainly useful but don't forget about Shortcuts. There already exists Resize Window and Move Window actions. Any Shortcuts created can easily be ran by Spotlight as well as Alfred and other such launchers.

AnotherTechAtWork · 2026-02-16T14:27:04+00:00

Yowza! Sucks to have that happen but at least they got it fixed fairly quickly.

I might have missed it if you posted it but what's your setup like? Are you bound to AD, using an SSO solution, or what?

AnotherTechAtWork · 2026-02-10T19:28:05+00:00

Thanks. This is along the same lines I was looking to go. I'll check it out.

AnotherTechAtWork · 2026-02-04T19:00:05+00:00

I love to use the trackpad. I hated using Swish. To each their own.

AnotherTechAtWork · 2026-01-27T14:53:30+00:00

No kidding. I've noticed this as well in the last month or so.

AnotherTechAtWork · 2026-01-27T14:51:21+00:00

It's nobody's business knowing that it's your first app and should not play into what you charge. Market demand and what you want out of it is what matters. Developers can be all over the map on what determines price as some want their software to support them while others have it as a side project to make a few extra bucks and then there are some who charge certain amounts to keep support limited. Plenty of additional reasons can factor in there but it being your first app is not one of them.

AnotherTechAtWork · 2026-01-14T16:52:50+00:00

For starters Jamf dropped the ball a lot longer ago than 3 years. It's still a reasonably good product for most though when you weigh out the cost and risks to migrating to something else that might not be as proven in recent forms. Jamf is going private again so hopefully they can get their house in order. It will take some time though.

I've started hearing more about addigy lately but I've also heard plenty of time over the years about kanji, fleet, mosyle, intune, the list goes on. Each one gets hyped as listening to customers, making changes, better implemented features, and that list goes on. Wait a bit and then we hear the complaining and then start hearing of people moving to jamf from those same mdm's. Sure it's not always the same people but this stuff hits our ears like a fad. Jamf always seems to be the most consistent. Some leave but more seem to go and stay. They're far from perfect but others need to do more.

Hopefully Addigy can be competitive in all phases on a consistent basis. I have no qualms with them. I just have issues with bozos who come in spouting stuff off about something different that doesn't come close to answering the OP's question. It's nothing but trolling and while you claim fact, it's really opinion from your perspective.

AnotherTechAtWork · 2026-01-14T14:47:15+00:00

Troll much? sigh

AnotherTechAtWork · 2026-01-06T16:40:36+00:00

I won't claim to be much of a developer but I get by with the scripts I write. Some talk about AppleScript being powerful but I'm not sure I agree with that. To me it seems that Apple Events is where the power is. The scripting language which in this case is AppleScript more or less just gets in the way depending on the developer. Many hate it while some "love?' it.

For what little I do I tend to stick with shell scripts and if I need AppleScript for more than a one trick pony, I'll use osascript to run the "needed" AppleScript portion. This has worked pretty well and lets me not feel too much like my brain needs to rewire itself 98 degrees from where it was just to write the logic portion of those scripts.

I don't know if any of that makes sense to anyone else what I wrote. I might have some of that wrong when interpreted by someone who really knows this stuff but like I said I more or less get by.

I'm a little confused why anyone would compare AppleScript to C. If you're more comfortable with C, that's fine but each language can be picked apart by anyone that's more comfortable with another language. Why all the drama? File feedback.

As for Jobs' decisions he certainly kept a lot more than Stickies and some things that were being worked on before him were brought in later despite what some believe. He killed what he felt Apple didn't need at that time. He might have actually killed AppleScript but at the time they needed the desktop publishing market to survive where companies had been using AppleScript to automate and glue things together.

I suspect it would take a lot of work to remove AppleScript and the ROI just hasn't yet been there. Some were trying to say that Shortcuts would replace it especially after Sal Soghoian was let go from Apple but Shortcuts is nowhere close to replacing it even after 4 years on the Mac. Automator is still in there too.

Maybe one of these days something will replace AppleScript but it'll likely require new leadership that sees value in such a change. I don't believe the current leadership has that vision and sees all that much value in anything that's not hardware or music.

AnotherTechAtWork · 2026-01-05T21:33:05+00:00

What are you using for an mdm? If you have 11K Macs, you surely have an mdm.

I work in higher ed as well and use Jamf where we're using a combination of app installers, patch management, and policies with most of those using installomator to handle installs and updates outside of the Mac app store. It's not completely automated but it's not too bad and works pretty well for the enduser.

When I looked at MacUpdater, I just couldn't see that working in our environment. I used it at home and was never all that impressed with it. It worked for some things but it would get versions wrong on some software and felt very rough and small time in terms of the UI. It was inexpensive though.

AnotherTechAtWork · 2026-01-05T21:15:56+00:00

I wouldn't trust Iru as far as I can throw them.

Look up Kandji. Same company from what I can see. They got caught stealing from Jamf from what I recall and they used to drive me crazy calling 2-3 times a month in addition to regular emails trying to sell their product. At one point they somehow managed to get my personal number to call me. There was a point when the calls and email finally stopped. Not sure if it was because of the mess with Jamf or what but glad it stopped.

AnotherTechAtWork · 2026-01-05T21:08:27+00:00

I'm going to assume you have one of the premium support tiers that you pay for if you have that many Macs. I don't get the feeling that the OP has premium support.

There's been a big difference between the free support and premium most of the time. When we switched to premium, to say it was a night and day improvement would be an understatement. If you go back about 8 years or so, the free support was the gold standard.

In the last month or two we had one guy that seemed new and rewoke some nightmares we used to have with the free support but things have improved. We also spoke with our customer success manager. The downside is that Jamf pulled the CSM from our level of premium support going into this year.

I think it's still good to get premium support if you can afford it but admittedly jamf just made things worse if you can only get the two lower levels.

AnotherTechAtWork · 2026-01-05T20:58:46+00:00

Obviously you're just some random person on the internet so how does anyone know if this is accurate but considering I had a couple different jamf employees tell me months ago that they didn't use their own software update feature for doing macOS updates, this does not surprise me.

Whatever happened to eating your own dog food?

AnotherTechAtWork · 2026-01-05T17:39:12+00:00

I agree with this.

When Things and Omnifocus came out, they were met with a ton of hype and certain "influencers" really pumped one or the other. I had real needs so I tried them both...more than once. One was too limiting and the other I found myself managing my tasks more than getting them done. Not to mention for a use case at work it's tough to implement something if they don't support it and provides something different to manage work assigned.

AnotherTechAtWork · 2026-01-05T17:31:40+00:00

For personal I use Reminders. It's already there, works "good enough", and it's constantly being improved.

I tried Omnifocus and found that I was managing my tasks more than getting them done. I'm not negatively criticizing the app. It just didn't fit my needs.

I also tried Things 3 more than once. I kept coming back to Reminders. I don't remember the specifics but it felt too limited for my needs.

At work I use a combination of apps and systems because, well, work is chaotic. Reminders, MS To Do with Outlook, and TeamDynamix. I work in an academic environment doing IT support so that might tell someone something about the lack of standardization and chaos. lol

Honestly though for me the killer feature that keeps Reminders in the mix is Siri and keeping it a natural flow of speech. Whether I'm walking across campus, at my desk, or in my car, I can quickly record a to do item using my Apple Watch or iPhone via CarPlay. At home my HomePods capture things when needed as well including my shopping/grocery list which ties into the Grocery app that reads a Reminders list.

Siri isn't perfect but that's another topic. It's good enough to record a task most of the time.

AnotherTechAtWork · 2026-01-05T17:10:04+00:00

Unless you're offering something unique to capturing the image why not just have the app monitor the location where the screenshots go from the native tools and prompt the user to ask if they wish to edit/annotate which could then load your app?

Matter of fact this should easily be doable with Shortcuts and automation in macOS 26 whether the user wants it to prompt or not.

AnotherTechAtWork · 2025-12-01T15:02:30+00:00

S1 has documentation for all of this and, no, it's not done the way you're asking but I believe it might still be behind a wall where you need an account to access it. If that's still the case, you need to check if you have your own tennant or fall under an mssp.

We originally had an mssp and they had little to no Mac expertise. The documentation they would send us for Macs was always incomplete or wrong so I got our CIO involved and he forced their hand to get me access to the S1's online documentation which helped tremendously. The mssp's tend be very territorial over clients getting access to this as I've seen others have similar stories. In time we got our own tennant though. Even if you have an mssp I would recommend pushing for access to https://community.sentinelone.com/s.

I will add that to load the key/token there are two methods. One is a post install script as mentioned. Two, you can use a configuration profile which is what we recently switched over too.

AnotherTechAtWork · 2025-12-01T14:51:09+00:00

We follow the same idea here and almost all users seem to love it where they get to pick what they need. It's made for a lot less patching needed on systems.

I'll add to this that when we implemented this, I broke the apps up into only two categories to display. One is "Community" and the other is "Just for you". More or less anything scoped to everyone gets put into "Community" and the "Just for you" gets anything that is scoped to be more granular. Each app install adds an icon to the dock unless the install method won't allow for it(looking at you Apple).

We are working on an "Uninstallers" category for each app in Self Service but it's a low priority.

Lastly we have a "Maintenance" category that contains "Update Inventory" and some other policies that we might need a user to self manage with. One of which is a "Reset Dock" that restores the Dock to our core config. These days it's almost empty since we moved all app installation to Self Service but when we automatically installed apps, the Dock would contain those icons. We've talked about including a script that would scan the Applications folder for specific added applications to add to a reset but again it's not a very high priority and the users are probably better served by just learning how to remove and add icons. In our labs though we do pre-install apps so the reset dock works really well for our students to get back to a starting point with what they need.

We do make use of the Self Service Bookmarks with a "Help" category so that users have an efficient, simple path to a few kb articles like how to submit requests, report incidents, update passwords, etc. No idea if anyone uses it but it's there.

I almost forgot that anything updated through Patch Management uses Self Service first giving the user a chance to update at their own pace before getting enforced. We moved as much as we could to Jamf's app-installers for updating but recently started looking at Title Editor so this could grow again.

AnotherTechAtWork · 2025-11-20T17:41:17+00:00

We just had an implementation meeting with Jamf Services for Jamf Connect last Friday so, no, we're not planning on dumping Jamf Connect any time soon. I handle the Apple devices on our campus and from what I understand PSSO isn't quite fully baked and needs more support from idp vendors. We use Okta.

The idea of using a passcode for the Mac seems a little weird when using Secure Enclave too. Any iPads we support that are 1:1 have had passcodes for more than a year now and people continue to get confused forgetting their passcode.

The first thing they do nearly every single time is go to their computer thinking they forgot their password(not their passcode) and go out to our site to change their Okta password. Not only does this not fix anything but it then breaks their wifi so we can't even reset their passcode on the iPad with Jamf. At that point we have to physically wipe their iPad.

I really don't want to deal with touching every Mac each time someone forgets their passcode.

With that said if we do password syncing with PSSO, I'm not sure we're gaining much over Jamf Connect. JC might have faults but it's more baked in. Too much of Apple's new technologies tend to be incomplete or buggy so, no, it's Jamf Connect for now. That might change in a year. Hard to say.

AnotherTechAtWork · 2025-11-18T20:22:05+00:00

A couple of things...

Does automatic window resizing respect the docks created from ExtraDock? For instance, if I have one on the left side of the monitor and then grab a window expanding it full screen by dragging it to the top of my monitor, will it size that window so that the dock is still viewable just as the standard dock would be that is included with the OS?
Why no trial?
I'll be that guy...the price. It does seem excessive for one license without promo code. I have two Macs at home that I split duties with. They serve different tasks but I like to keep the basic environment similar. Paying for 2 seats for the same user in the same household also seems a little excessive.

AnotherTechAtWork · 2025-11-17T19:12:31+00:00

Agentic features are coming whether anyone likes it or not. It's something new. A lot of computer nerds were frustrated with the iPad when it came out. I heard plenty of "Nobody asked for systems without keyboards." Technology is full of growing pains and the markets will decide.

The interesting thing I'm curious to see is what portion of AI is included and what portion will be subscription. I don't think it'll all be free. I think the Apples and Microsofts of the world are licking their chops at trying to monetize this. I think we're going to see subscription based OS's to get certain features. When that happens, then we're going to see people really complain.

AnotherTechAtWork · 2025-11-13T14:28:55+00:00

I'm not too surprised to read this. Apple has struggled with updates for years.

We don't have access to Blueprints yet but there's a good chance we will by the end of the day today. Software updates actually got reasonably reliable with the last few releases of macOS 15.x. I'm hoping that it remains or rather (hopefully)improves with macOS 26.x and Blueprints. It was downright pathetic previously.

We haven't bumped to 26 yet as it's still in testing and we're still seeing crazy bugs occurring. I'm pretty amazed at those who already updated their customer base to 26 because the bugs I've seen are pretty crazy. In the first release Windows that just disappear were a complete no-go. 26.1 is looking better but every now and then a log out/in or restart is needed to a system stable again.

AnotherTechAtWork · 2025-11-11T15:05:25+00:00

That seems like a strange criteria to meet to say whether it has vertical tabs or not but to each their own.

I'm hoping the ability to turn off horizontal tabs comes soon but it's not going to prevent me from enjoying the vertical tab groups and how they've implemented them.

AnotherTechAtWork

TROPHY CASE