Rahul Mehta

Unified Logging on macOS

2024-06-10T09:06:00.009+05:30

What is Unified Logging?

Unified Logging is Apple’s systemwide logging mechanism introduced with macOS Sierra (10.12). It centralises and standardises logging across the operating system and all applications, providing a comprehensive and consistent way to capture, store, and analyse logs.

Why is Logging Useful to a Sysadmin?

Logging is crucial for system administrators because it provides insights into system and application behavior. It helps in:

Troubleshooting: Diagnosing issues and identifying root causes.

Monitoring: Keeping track of system performance and activities.

Auditing: Ensuring compliance with security policies.

Maintenance: Predicting and preventing potential issues.

Why is Unified Logging Useful for Security?

Unified Logging enhances security by offering:

Comprehensive Visibility: Logs from all parts of the system in one place.

Realtime Monitoring: Immediate detection of suspicious activities.

Detailed Records: Granular logs that can aid in forensic analysis.

Controlled Access: Secure and managed access to log data.

Location on Mac the Logs are Stored

Logs in macOS are stored in various directories, but Unified Logging specifically uses the following paths:

/var/db/diagnostics
/var/log
/Library/Logs

`log` Command

The `log` command is the primary tool for interacting with the Unified Logging system. It allows you to view, filter, and manage logs.

Basic Syntax

log show [options]

log stream [options]

Example: Viewing Logs for a Specific Process

log show predicate 'process == "Finder"' info

Predicates

Predicates allow you to filter log entries based on specific criteria.

Example: Show Logs Within a Given Time Frame

log show predicate 'eventMessage contains "error"' info start "20230601 00:00:00" end "20230601 23:59:59"

Log Levels

default: Standard log messages.

info: Informational messages.

debug: Debugging information.

error: Errors that need attention.

fault: Severe errors that likely lead to a crash.

Specified Log Level

Filter logs by their level (default, info, debug, error, fault).

Example: Filter by Log Level

log show predicate 'messageType == error'

Log Stats

The `log stats` command provides statistical information about log entries.

Example: Viewing Log Statistics

log stats overview

Subsystems and Categories

Logs can be categorised by subsystems and categories, helping to organise log data.

Example: Filtering by Subsystem

log show predicate 'subsystem == "com.apple.network"'

Log Archive

To create a log archive for the further analysis

log collect --output <path_to_logarchive>.logarchive

Syslog

`syslog` is the traditional logging system that Unified Logging supersedes but remains available for compatibility.

Example: Viewing Syslog

syslog k Sender Finder

SystemLogging

SystemLogging is the background process that handles the logging infrastructure. Understanding its functionality can help in managing and troubleshooting logging issues.

Sysdiagnose

`sysdiagnose` is a powerful tool that collects extensive system diagnostics, including logs.

Example: Running Sysdiagnose

sudo sysdiagnose f /path/to/output

Profiles and Logs

Profiles (configuration profiles) can be used to manage logging settings across multiple systems, ensuring consistent logging policies.

Example: Applying a Configuration Profile

sudo profiles I F /path/to/profile.mobileconfig

Unified Logging on macOS offers a powerful and flexible system for managing log data, essential for effective system administration and security. By mastering the `log` command and understanding the structure and storage of logs, sysadmins can greatly enhance their ability to monitor, troubleshoot, and secure macOS systems.

Releasing Devices in Apple Business Manager

2024-01-18T11:07:00.001+05:30

Say goodbye to unwanted devices cluttering your Apple Business Manager! Releasing devices is a crucial part of managing your fleet, allowing you to remove devices sold, lost, or simply beyond repair. This blog dives into the steps for releasing devices and sheds light on which roles have the authority to do so.

Why Release Devices?

Releasing devices offers several benefits:

Clean Up Your Inventory: Keep track of active devices and avoid confusion.
Compliance Check: Ensure you're not managing devices you no longer own, adhering to Apple Business Manager Agreement terms.
Security Clearance: Prevent unauthorized access to your network and data by wiping released devices.

Who Can Release the Devices?

Only two user roles in Apple Business Manager can initiate device release:

Administrator: The all-powerful role, with full control over devices, users, and settings.
Device Enrollment Manager: Responsible for device enrollment and management, also authorized to release them.

Release Steps Simplified:

Sign In: Access Apple Business Manager with your valid Administrator or Device Enrollment Manager credentials.

Device Selection: Choose "Devices" from the sidebar. You can search for specific devices or view the entire list.

Target the Unwanted: Select the device(s) you want to release by clicking the checkbox next to their names.

Release Actions: Click the "Release" button at the top right corner.

Confirmation: A confirmation window will appear. Double-check the selected devices and click "Release".

Note: Releasing a device removes it from Apple Business Manager and you will need to wipe the device.

Bonus Tip: You can configure Apple Business Manager to allow only specific users within the Device Enrollment Manager role to release devices. This adds an extra layer of control and accountability.

By following these steps and understanding the authorised roles, you can say goodbye to unwanted devices and maintain a clean, efficient Apple Business Manager environment. So, go forth and release those digital ghosts with confidence!

Remember: This information is accurate as of January 18, 2024. Apple may update its processes or release new features,so always refer to the official Apple Business Manager documentation for the latest guidance.

Feel free to leave comments below if you have any questions or additional insights on device release in Apple Business Manager!

For more information please contact us at https://brilyant.com/contact/

Enhancing Mac Security: A Comprehensive Guide to the macOS Security Module

2024-01-05T00:02:00.007+05:30

In the dynamic landscape of cybersecurity, ensuring the security of your Mac devices is paramount. As technology advances, so do the threats that seek to exploit vulnerabilities in your system. To fortify your Mac's defences, it's crucial to implement a robust Mac Security Module. In this blog post, we'll delve into the key components of Mac security, covering baseline settings, CIS benchmarks, Apple's best practices, company security policies, and the macOS Security Compliance Project.

What Should We Consider?

When embarking on the journey to enhance Mac security, it's essential to consider a holistic approach. Assessing potential risks, understanding the latest threats, and tailoring security measures to your organization's specific needs are vital. Key considerations include:

1. Threat Landscape Analysis: Stay informed about the latest cybersecurity threats targeting macOS to proactively adapt your security measures.

2. User Education and Awareness: Educate users about security best practices, including avoiding phishing scams, using strong passwords, and recognising suspicious activities.

3. Regular Security Audits: Conduct regular security audits to identify and address vulnerabilities in your Mac environment.

Baseline Security Settings:

Establishing a solid foundation for Mac security begins with configuring baseline settings. This involves:

1. Firewall Configuration: Enable the built-in firewall on macOS to monitor and control incoming and outgoing network traffic.

2. FileVault Encryption: Utilise FileVault to encrypt your Mac's hard drive, safeguarding sensitive data in case of theft or unauthorised access.

3. Gatekeeper Settings: Configure Gatekeeper to allow only trusted applications from the App Store or identified developers, reducing the risk of malware.

4. System Updates: Keep macOS and all installed software up-to-date to patch vulnerabilities and protect against known threats.

CIS Benchmarks:

The Center for Internet Security (CIS) provides a set of benchmarks for securing macOS. These benchmarks offer a comprehensive guide to enhancing security, covering areas such as system configurations, network settings, and user account controls. Adhering to CIS benchmarks ensures a standardised and secure configuration for your Mac devices.

Account Policies:

Configuring strong password policies and limiting unnecessary account privileges.

System Integrity Protection (SIP):

Ensuring SIP is enabled to protect critical system files from unauthorized modifications.

Network Configuration:

Applying secure network configurations, such as disabling unnecessary services and using secure protocols.

Apple Best Practices:

Apple, the creator of macOS, provides its own set of security best practices. Key recommendations include:

1. System Integrity Protection (SIP): Do not disable SIP, as it protects critical system files and processes from being tampered with.

2. XProtect and MRT: Keep XProtect and MRT (Malware Removal Tool) updated to defend against known malware threats.

3. Gatekeeper and Notarisation: Leverage Gatekeeper and App Notarisation to verify the integrity of applications before installation.

Company Security Policies:

Tailoring security policies to your organisation's needs is essential. Develop comprehensive security policies that address:

1. Device Usage Policies: Define guidelines for the use of company-issued Mac devices, including acceptable use and security protocols.

2. Access Controls: Implement strict access controls, ensuring that only authorized personnel can access sensitive data and systems.

3. Incident Response Plan: Develop an incident response plan to swiftly and effectively address security incidents, minimising potential damage.

macOS Security Compliance Project:

Participating in the macOS Security Compliance Project ensures alignment with industry standards and best practices. This collaborative effort aims to create a framework for assessing and enhancing macOS security. By actively engaging in this project, organisations can contribute to the development of effective security measures for the broader Mac community.

Security Auditing:

Regularly auditing security configurations to ensure compliance with established standards.

Continuous Monitoring:

Implementing continuous monitoring mechanisms to detect and respond to security incidents in real-time.

Documentation and Reporting:

Maintaining comprehensive documentation of security configurations and generating reports to assess and demonstrate compliance.

Conclusion:

Securing your Mac devices is a multifaceted endeavour that requires a combination of baseline settings, adherence to industry benchmarks, and collaboration with both Apple's best practices and wider security initiatives like the macOS Security Compliance Project. By considering the holistic approach outlined in this guide, organizations can fortify their Mac security and stay ahead of evolving cybersecurity threats.

Reference Links:

1. CIS Apple macOS Benchmarks

2. Apple Security Overview

3. macOS Security Compliance Project

4. Apple Security Research

5. Apple Endpoint security

6. Apple Device Management Git hub Repo

7. Apple Developer Device management

8. Apple Platform Deployment

9. Jamf Compliance Baseline

Feel free to leave comments below if you have any questions

For more information please contact us at https://brilyant.com/contact/

Exploring Apple's Lockdown Mode: A Closer Look at Enhanced Security

2024-01-02T21:38:00.010+05:30

In the ever-evolving landscape of digital security, Apple has consistently been at the forefront of innovation. One notable feature that underscores the company's commitment to user privacy and protection is the Lockdown Mode. Introduced in recent iOS and macOS updates, this security feature offers an additional layer of defence against unauthorised access and potential threats. In this blog post, we will delve into the details of Apple's Lockdown Mode, understanding its functionality, its implications for users, and its role in safeguarding personal information.

Understanding Lockdown Mode:

Lockdown Mode is a security feature integrated into Apple's devices, such as macOS, iPhones and iPads. It provides users with a means to enhance the security of their devices in situations where there is a potential threat or unauthorized access. When activated, Lockdown Mode restricts various functionalities of the device, limiting access to sensitive information and protecting the user's privacy.

Activation and Usage:

Activating Lockdown Mode is a straightforward process. Users can enable it manually or configure it to activate automatically in specific scenarios. To enable Lockdown Mode navigate to settings / system settings (on mac )> privacy > lockdown mode. Once activated, the device's interface changes, signalling that the device is in a more secure state.

Automatic activation of Lockdown Mode can be configured in the device settings. For example, users may choose to enable it when their device is connected to a computer or when the device recognizes an untrusted accessory attempting to establish a connection.

Key Features and Limitations:

1. Biometric and Passcode Protection:

Lockdown Mode reinforces the device's existing security measures, ensuring that biometric authentication methods like Face ID or Touch ID, as well as passcodes, remain required for access. This adds an extra layer of protection beyond the standard lock screen.

2. USB Access Restriction:

One notable aspect of Lockdown Mode is its impact on USB connectivity. When activated, the device restricts USB access, preventing data transfers and other interactions with connected devices. This is particularly crucial in preventing unauthorized access by third-party tools that may attempt to exploit vulnerabilities.

3. App Notifications:

Users in Lockdown Mode receive notifications, providing them with information about the status of their devices. This ensures transparency and allows users to stay informed about any potential security incidents or unauthorized access attempts.

4. Emergency Calls and Medical ID:

Lockdown Mode does not compromise essential features such as making emergency calls or accessing the Medical ID information. Users can still reach out for help or provide critical medical information even when their device is more secure.

Conclusion:

As our lives become increasingly intertwined with digital technology, the importance of robust security measures cannot be overstated. Apple's Lockdown Mode exemplifies the company's dedication to user privacy and data protection. Whether activated manually or configured to engage automatically in specific situations, Lockdown Mode serves as a powerful tool to thwart unauthorized access and potential threats, offering users peace of mind in an interconnected world. As technology continues to advance, it is reassuring to see companies like Apple actively investing in features that prioritize user security and privacy.

For more information please contact us at https://brilyant.com/contact/

Zero Touch Setup with DEPNotify

2023-12-26T17:12:00.006+05:30

DEPNotify is an application that will guide end-users through the process of enrolling a computer with Automated Device Enrollment.

An organization can choose to install critical applications after enrollment with MDM, but without a tool such as DEPNotify, end users may not be aware of the process. This application can also ask the end users for information that can be input and then used by administrators for future management.

Two Major components we need to configure for DEPNotify:

the application
the starter script

Note: While deploying the Application package and any other resources related to it should designed with an Apple Developer certificate (if deployed via Jamf, a Jamf Pro Built-in CA certificate can be used).

Download DEPNotify: https://gitlab.com/Mactroll/DEPNotify

DEPNotify supports a wide range of configurations. These include:

Customisable text
Images
User input fields which can be used for extension attributes
EULAs
The ability to open webpages or play a YouTube video
Full-screen or windowed display
Progress bars

DEPNotify is completely controlled via echoing text to its control file. By default, this is:

“ /var/tmp/depnotify.log “ but can be changed with the -path flag

To Learn about Application flags: https://gitlab.com/Mactroll/DEPNotify#application-flags

Commands:

You can customise the DEPNotify window with Commands for user Interaction, notification and completion information.

Main Window Setup: https://gitlab.com/Mactroll/DEPNotify#main-window-configuration

Interaction: https://gitlab.com/Mactroll/DEPNotify#interaction

Notification: https://gitlab.com/Mactroll/DEPNotify#interaction

Completion: https://gitlab.com/Mactroll/DEPNotify#completion

If you would like to add advanced workflow, we can write a plist “ menu.nomad.DEPNotify.plist “With this file you can configure various things like the EULA window, registration window, status text alignment and help bubbles.

Ref: https://gitlab.com/Mactroll/DEPNotify#depnotify-plist

DEPNotify starter Script:

The DEPNotify Starter Script is very lengthy but is heavily commented on to help you understand the available settings and how to configure them.

DEPNotify-Starter Github repo contains both starter script and reset script for DEPNotify:

https://github.com/jamf/DEPNotify-Starter

you can also use the application DEPNotify Set-up Helper to configure the script for you.

https://github.com/BIG-RAT/DEPNotify-Set-up-Helper

EULAs and images for DEPNotify should not be included in the DEPNotify package but instead can be placed in a package of their own.

Any package installed during Automated Device Enrollment must be signed with a certificate that can be trusted by the Mac

Deployment Plan with Jamf:

Assuming the Apple Business Manager is well-integrated

Prestage Enrollment:

You can go computers: Prestage Enrollments create a setting of prestage.

General > apply setting as per your requirement

Configuration Profile add your DEPNotify Configuration

Enrollment Packages add DEPNotify and any EULA or images package (Note both packages should be signed).

when creating a Prestage enrollment, it is best to use the minimum critical settings

Smart Computer Group:

Create a Smart computer Group with Criteria Enrollment Method: Prestage enrollment operator (is) and value Zero Touch

Configuration Profiles:

If any configuration Profile is you would like to deploy during the Zerotouch scope it with the smart Computer Group you created.

Policies:

Create a policy for the DEPNotify starter script and any packages you need to deploy during the DEPprocess set the as “Ongoing” and with a custom trigger with unique to each policy and scope to this smart Group you created before.

Testing on a Local Enrolled Mac:

Before deploying to production you can test the DEPNotify setting function on you enrolled Mac computer.

To Test open terminal and run the command :

sudo jamf policy -event enrollmentComplete

If all has been configured correctly, you should see the DEPNotify application open and a simulation of your workflow. With the testing flag set to "true", your policies and registration information will not execute.

For more information please contact us at https://brilyant.com/contact/

Revolutionising IT Support: A Deep Dive into Jamf Remote Assist

2023-12-14T00:17:00.006+05:30

In the fast-paced world of technology, efficient IT support is crucial for businesses to thrive. Jamf, a leading provider of Apple device management solutions, has introduced a game-changing tool – Jamf Remote Assist. This innovative solution is designed to enhance customer support, streamline troubleshooting, and provide a seamless experience for both IT professionals and end-users.

Benefits

Jamf Remote Assist offers benefits for both IT teams and end-users, making it a valuable asset in the realm of IT support.

1. Efficient Issue Resolution:

- Enables IT professionals to troubleshoot issues remotely, reducing downtime and increasing productivity.

- Facilitates faster problem-solving, ensuring a seamless user experience.

2. User Empowerment:

- Allows end-users to request support and receive assistance promptly, enhancing overall satisfaction.

- Promotes user independence by providing step-by-step guidance for common issues.

3. Enhanced Productivity:

- Minimizes the need for in-person support, saving time for both IT teams and end-users.

- Improves workflow efficiency by addressing issues without disrupting the user's work environment.

4. Time Savings:
By eliminating the need for physical presence during troubleshooting, IT professionals can resolve issues swiftly, resulting in significant time savings for both support teams and end-users.
5. Reduced Costs:
Lower travel expenses, decreased downtime, and efficient issue resolution contribute to cost savings for organizations utilizing Jamf Remote Assist, making it a cost-effective solution.

What Problem Does it Solve?

Jamf Remote Assist addresses several common challenges faced by IT support teams:

1. Limited Accessibility:

- Overcomes geographical barriers by allowing IT professionals to provide support from anywhere in the world.

2. Resolution:

- Speeds up the troubleshooting process, reducing the time it takes to resolve technical issues.

3. Resource Optimization:

- Optimizes IT resources by minimizing the need for on-site visits and maximizing remote support capabilities.

Setup

Configure the Cloud Service Connection: Settings → Global → Cloud services connection

Enable Automatic Distribution of the PPPC Settings for Jamf Remote Assist in Jamf Pro by Nagavating to settings → Computer management →Security ( On Premises : The first time enabling the Jamf Remote Assist PPPC profile, the administrator must select the data storage location. Options are United States, Asia-Pacific and Europe. Make sure to choose this region carefully. Jamf cannot migrate data between regions at this time.)

Initiate a Jamf Remote Assist session from Jamf Pro: Search Inventory → Select your Mac → Management → Management Commands → Remote Assist

Jamf Remote Assist Network Communication Ports:

Jamf Remote Assist utilizes port 5555 over TCP and port 443 for WebSocket Secure (WSS) network communication.

Jamf Remote Assist Components:

Three primary elements make up Jamf Remote Assist:
The viewer - A web application that is started in a new tab within the admin computer’s browser whenever a session is requested. This is the tool Jamf Pro admins interact with when viewing and interacting with a remote assist session.
The Jamf Remote Assist app - A native application deployed to all computers by Jamf Pro that is responsible for delivering screen and file data to The Viewer. This element is also the part that manages notifications, prompts, and user experience elements displayed on remote computers when sessions are initiated, in progress, or when ended.

Four processes make up the Jamf Remote Assist feature that run on managed computers:

Two processes run as the root user:
jamfRemoteAssistConnector
jamfRemoteAssist

Two processes run as the logged-in user:
jamfRemoteAssistConnectorUI
jamfRemoteAssist

Conclusion

Jamf Remote Assist emerges as a transformative solution in the realm of IT support, offering a comprehensive set of features to streamline issue resolution and enhance the overall user experience.

Reference link:

Jamf Blog: Jamf Remote Assist: Enhancing remote Desktop Sessions in Jamf Pro

Documentation: Jamf Guide

For more information please contact us at https://brilyant.com/contact/

Configuring Account-Driven Enrollment and Enrolling a Personal Device in Jamf Pro

2023-12-08T00:11:00.021+05:30

In today's mobile-driven world, organisations need efficient and secure ways to manage employee devices. Apple's Account-Driven Enrollment (ADE) offers a streamlined solution, allowing users to enroll their personal devices in mobile device management (MDM) using their existing Managed Apple IDs. This article explores the benefits of ADE and guides you through the steps of configuring it with Azure Active Directory (AD) and Jamf Pro.

Benefits of Account-Driven Enrollment:

Simplified User Experience: Users can enroll their devices using familiar credentials, eliminating the need for dedicated enrollment profiles.
Reduced IT Overhead: Organisations no longer need to create and manage individual enrollment profiles for each user.
Enhanced Security: Federated authentication provides an additional layer of security, leveraging existing user credentials.
Improved BYOD Support: ADE facilitates BYOD programs by allowing users to enroll their personal devices for work purposes.

Prerequisites:

Apple Business Manager
Microsoft Azure AD subscription
Jamf Pro MDM solution
Access to the organization’s web host

1. Verifying Domain and Federating Microsoft Azure with Apple Business Manager

Prerequisites:

Apple Business Manager/School Manager account
Microsoft Azure Active Directory (Azure AD) account with appropriate permissions

Steps:

Sign in to Apple Business Manager.
Navigate to Settings > Accounts > Domains.
Click Add Domain.
Enter your domain name and click Next.
Follow the on-screen instructions to verify your domain ownership. This typically involves adding a TXT record to your DNS.
Once verified, click Next.
Select the "Federate" option.
Click "Sign in to Microsoft Azure Portal."
Enter your Azure AD credentials and sign in.
Review and accept the application agreement.
Click "Done."
In Azure AD, ensure the Apple Business Manager application is configured with the appropriate permissions.
Back in Apple Business Manager, test the federation by signing in with an Azure AD user.

Resources:

Apple documentation: https://support.apple.com/guide/apple-business-manager/intro-to-federated-authentication-axmb19317543/web
Microsoft documentation: https://learn.microsoft.com/en-us/entra/identity/saas-apps/apple-business-manager-provision-tutorial

2. Configuring Account-Driven Enrollment in Jamf Pro

Prerequisites:

Jamf Pro 10.33 or later
Managed Apple IDs associated with users
Web server for hosting the enrollment information JSON file

Setting on Webserver Hosting

Setting up Account-Driven User Enrollment involves creating and hosting enrollment information in a JSON file on a web server. This allows devices to initiate a service discovery process to retrieve the information and direct the user to the enrollment portal on their device.

Defining Jamf Pro Enrollment Information for Account-Driven Device Enrollment

A device must authenticate with the Jamf Pro server to initiate the service discovery process and direct a user to the enrollment portal.

After a user signs in with a full Managed Apple ID, the following process occurs:

The device extracts the domain information (information following the @ symbol) from the Managed Apple ID.

The device sends an HTTP request to the web server hosting the enrollment information and authenticates it with the Jamf Pro server.
The device uses that information to redirect the user to the Jamf Pro enrollment portal.

For more information about the service discovery process, see the Discover Authentication Servers documentation from the Apple Developer website.

The contents of the JSON file should look similar to the following:

{

"Servers": [

{

"Version":"mdm-adde",

"BaseURL":"https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/deviceenroll"

}

]

}

Save with the specific file name of com.apple.remotemanagement.

Upload this file to your domain host in this specific location:

https://YOUR-WEB-SERVER-FQDN-HERE/.well-known/com.apple.remotemanagement

NOTE: The steps to upload your JSON file will differ based on the entity that hosts your domain

services.

To verify the contents of the JSON file are hosted correctly, execute the following command:

curl -I https://mycompany.com/.well-known/com.apple.remotemanagement

The command should print something similar to the following:

HTTP/1.1 200 OK

Server: nginx/1.18.0 (Ubuntu)

Date: Day, 00 Month Year 00:00:00 GMT

Content-Type: application/json

Content-Length: 150

Last-Modified: Day, 00 Month Year 00:00:00 GMT

Connection: keep-alive

ETag: "xxxxxx-xxxxxx"

Accept-Ranges: bytes

Configuring an Azure AD Cloud Identity Provider Connection in Jamf Pro

Log in to Jamf Pro.
In the top-right corner of the page, click Settings .
Click System Settings.
Click Cloud Identity Providers.
Click New.
Choose Azure and click Next. You are redirected to the administrator consent page in Microsoft.
Enter your Microsoft Azure credentials and follow the onscreen instructions to grant the permissions requested by the Jamf Pro Azure AD Connector application.
After the request completes, in Jamf Pro configure the settings on the Server Configuration tab. Consider the following:
- The display name for the configuration must be unique.
- The Tenant ID value is pre-populated with information from Microsoft.
- When single sign-on (SSO) with Azure is configured in Jamf Pro, select Transitive groups for SSO to enforce transitive membership lookups in the user and group directory. This ensures that all Azure groups that a group is a member of are included in a directory lookup. There is no need to run recursive queries to list groups for which a user is a member of. You can configure a specific user mapping in the User Mapping from the SAML Assertion field. This allows you to adjust username mapping during transitive membership requests and match the user identifier from the SAML single sign-on settings in the Azure configuration.
- Select Transitive membership lookups to enforce membership lookups for directory workflows that include all groups that a user or group is a member of. This is recursive and checks more than only the direct membership.
- It is recommended to set the Connection Timeout value to 5.
Use the Mappings tab to specify user attribute mappings and group attribute mappings. See the "Default Attribute Mappings for Azure AD as a Cloud Identity Provider" section below for default mappings reference and use it while troubleshooting the connection.
Important: To ensure the configuration works as expected, consider the following:
- The values for the User Id mapping must support the $filter parameter in Azure AD.
- The value for the Group Id mapping defaults to "id" and cannot be changed.
Click Save

Configuring Account-driven User Enrolment settings

In Jamf Pro
Settings
Click Global
Click User-Initiated Enrolment
Click Edit
Click iOS
Under Account-Driven User Enrolment, Select the checkbox for personally owned devices
Click Access
Click Edit
Select the checkbox for Allow the group to enrol personally owned devices via Account-Driven user Enrolment
Click Save.

Setting Up Content Distribution to Personally Owned Devices

Personally owned devices do not report a serial number to Jamf Pro; therefore, you must assign App Store apps directly to users (user-based assignment) before distributing them to devices enrolled using Account-Driven User Enrollment or Profile-Driven User Enrollment.

You can distribute content to devices individually or use a mobile device smart group to distribute apps and books to all devices enrolled via Account-Driven User Enrollment or Profile-Driven User Enrollment.

Distributing apps and books to personally owned devices enrolled via User Enrollment involves the following steps in Jamf Pro:

Automatically registering users who have Managed Apple IDs with volume purchasing

In Jamf Pro, click Users in the sidebar.
Click Smart User Groups in the sidebar.
Click New.
In the General pane, enter a Display Name, such as Managed Apple IDs.
In the Criteria pane, add the following device criteria that includes all Managed Apple IDs in the smart group:
Criteria : Managed Apple ID Operator : like Value: yourdomain.com
Click Save
In Jamf Pro, Click users in the Sidebar
Click invitations
In the General pane, enter a Display Name, such as Invitation for Managed Apple IDs.
Choose "Automatically register only users with Managed Apple IDs and skip invitation" from the Distribution Method pop-up menu.
In the Scope pane, add your smart group that contains Managed Apple IDs as a target for the invitation.
Click Save

Creating a volume assignment

In Jamf Pro, click Users in the sidebar.
Click Volume Assignments in the sidebar.
Click New.
Use the General payload to configure basic settings for the volume assignment, including the location.
Use the Apps and eBooks payloads to select the checkbox for each app and book you want to assign.
Click the Scope tab and configure the scope of the assignment.
Click Save

Creating a smart group for personally owned devices.

In Jamf Pro, click Devices in the sidebar.
Click Smart Device Groups in the sidebar.
Click New.
In the General pane, enter a Display Name, such as Personally Owned Devices.
In the Criteria pane, add the the criteria: Device Ownership Type Operator : is and Value: Personal (user Enrolment)
add the the criteria: Device Ownership Type Operator : is and Value: Personal (Account Driven user Enrolment)
Click Save

Enrolling an iOS or iPadOS Devices

On your iPad, tap settings
Tap General
Tap VPN & Device Management
Tap sign in to work or school Account
Enter your Managed Apple ID
Tap Continue
This will pop up Azure login screen, sign in with Azure ID and Password and verify
Tap sign in to iCloud
Follow on-screen Instruction
Tap Allow Remote Management
Enter your device passcode
The iCloud settings for your managed Apple ID will appear

System administrators can manage only an organisation’s accounts, settings and information provisioned with MDM, never a user’s personal account. In fact, the same features that keep data secure in organisation-owned Managed Apps also protect a user’s personal content from entering the corporate data stream.

MDM can	MDM can’t
Configure accounts	See personal information, usage data or logs
Access inventory of Managed Apps	Access inventory of personal apps
Remove managed data only	Remove any personal data
Install and configure apps	Take over management of a personal app
Require a passcode	Require a complex passcode or password
Enforce certain restrictions	Access device location
Configure Per App VPN	Access unique device identifiers
	Remotely wipe the entire device
	Manage Activation Lock
	Access roaming status
	Turn on Lost Mode

Resources:

Jamf Pro documentation: https://learn.jamf.com/bundle/technical-paper-byod-current/page/Introduction_BYOD.html
Discover Authentication Servers
https://developer.apple.com/videos/play/wwdc2021/10136/

For more information please contact us at https://brilyant.com/contact/

Safeguarding Enterprise Data on Mobile Devices on the Go: The Crucial Role of MDM and Jamf Mobile Threat Defense

2023-12-06T11:31:00.009+05:30

In today's digital age, the workforce is increasingly mobile, with employees relying on smartphones and tablets to carry out their daily tasks on their own devices. As enterprises embrace this shift towards mobile productivity, the need to secure sensitive company data on these devices becomes paramount. we'll explore how enterprise data resides on mobile devices and delve into the significance of Mobile Device Management (MDM) and Mobile Threat Defense (MTD) solutions, specifically focusing on Jamf Protect for Mobile security.

Enterprise Data on Mobile Devices:

Mobile devices have become an integral part of the modern workplace, enabling employees to work remotely, collaborate seamlessly, and access critical information on the go. However, this convenience comes with inherent risks, as enterprise data often resides on these devices, making them potential targets for cyber threats and unauthorized access. Whether it's proprietary business information, customer data, or intellectual property, safeguarding this sensitive data is crucial for maintaining trust, compliance, and the overall security posture of an organisation.

What is MDM and Its Key Role in Data Protection:

Mobile Device Management (MDM) is a comprehensive solution designed to manage, monitor, and secure mobile devices within an enterprise. MDM systems empower IT administrators with the tools to enforce policies, configure settings, and ensure compliance across a fleet of mobile devices. Key features of MDM include remote device wiping, app management, and the ability to track device locations, providing a centralized approach to device security.

MDM plays a vital role in data protection by:

1. Policy Enforcement: MDM allows organisations to establish and enforce security policies, ensuring that devices accessing company data adhere to predefined standards.

2. Data Encryption: MDM solutions often include encryption features, protecting data stored on devices from unauthorised access.

3. Remote Management: In case of loss or theft, administrators can remotely wipe sensitive data from the device, preventing it from falling into the wrong hands.

Introduction to Mobile Threat Defense (MTD) and Jamf Protect for Mobile security:

Mobile Threat Defense (MTD) is a specialized solution focused on identifying and mitigating mobile-specific security threats. With the increasing sophistication of mobile malware and phishing attacks, having a dedicated MTD solution becomes crucial for a comprehensive security strategy.

Jamf Protect for Mobile security is a leading MTD solution designed specifically for Mobile devices, providing advanced threat detection and real-time response capabilities. It offers:

1. Threat Detection: Jamf Mobile Threat Defense employs advanced algorithms to detect and respond to mobile-specific threats, such as malicious apps and network vulnerabilities.

2. Zero-Day Threat Prevention: The solution proactively identifies and blocks threats, even those that exploit vulnerabilities not yet known to the security community.

3. Integration with MDM: Jamf Mobile Threat Defense seamlessly integrates with MDM solutions, creating a holistic approach to mobile device security.

Below is a feature table of Jamf Protect for Mobile security, Mobile Device Management (MDM), and Mobile Application Management (MAM):

Feature	Jamf Protect for Mobile security	Mobile Device Management (MDM)	Mobile Application Management (MAM)
Security	Provides advanced threat detection and remediation for iOS and Android	Focuses on device-level security, enforcing policies, encryption, and compliance.	Concentrates on securing and managing individual applications, ensuring data protection.
Threat Detection	Identifies and mitigates mobile threats, malware, and vulnerabilities in real-time.	Monitors and manages device security, but may not offer advanced threat detection.	Primarily concerned with securing and managing the applications rather than threat detection.
Device Policies	Limited to threat defence policies, ensuring a secure environment.	Enforces a wide range of device-level policies such as passcodes, encryption, and restrictions.	Focuses on application-level policies, controlling how applications interact with data and other apps.
App Deployment	Primarily focused on threat defence; may not handle app deployment.	Centralized deployment and management of apps on devices.	Manages the distribution, updating, and removal of applications on individual devices.
Device Configuration	Limited device configuration options, mainly related to security settings.	Offers comprehensive device configuration settings for a wide range of parameters.	Primarily concerned with configuring how individual applications operate on devices.
User Authentication	May integrate with existing authentication systems for enhanced security.	Enforces user authentication and access controls to the device.	Focuses on securing access to and within individual applications, often using single sign-on (SSO).
Containerization	May utilise containerisation for isolating and securing apps and data.	Generally focuses on device-level containerization for work and personal data separation.	Leverages containerization to isolate and protect individual applications and their data.
Data Protection	Emphasises threat defence for data protection against malicious activities.	Enforces encryption and policies to protect data on the device.	Concentrates on securing data within individual applications, often through app-specific policies.
Device Inventory	Limited device inventory features; primarily focused on threat-related information.	Provides detailed device inventory, tracking hardware and software details.	Offers basic information on devices, but emphasizes more on app-related details.
Platform Support	Typically focused on iOS, Android, Windows and Mac devices.	Supports a wide range of mobile operating systems, including iOS, Android, and others.	Works across various platforms, ensuring compatibility with different operating systems.

Comparing the Cybersecurity Capabilities of MDM, MAM and Jamf Mobile Threat Defense

Cybersecurity Capability	Jamf Protect for Mobile security	MDM (Mobile Device Management)	MAM (Mobile Application Management)
Device Security	Comprehensive protection against known and unknown threats, including malware, phishing, and network attacks.	Device-level control and policy enforcement, ensuring devices comply with security standards.	Focuses on application-level security, limiting access to sensitive data and functionality.
Data Encryption	Strong encryption protocols for data at rest and in transit, safeguarding sensitive information.	Device-centric encryption to protect data stored on devices, reducing the risk of data breaches.	Emphasizes encryption and secure transmission of data within mobile applications, protecting sensitive data.
Access Control	Granular control over device access, user authentication, and authorization, reducing the risk of unauthorized access.	Centralized control over device access, user roles, and permissions to manage access points effectively.	Application-specific access controls to restrict user access based on roles and responsibilities.
App Security	Monitors and secures applications against malicious activities, ensuring only approved and secure apps are allowed.	Controls app installation and updates, preventing the use of unauthorized or outdated applications.	Focuses on securing individual applications, often using containerization to isolate app data and functionality.
Network Security	Proactive threat detection and prevention for network-based attacks, safeguarding device communications.	Manages network configurations and connections to prevent unauthorized access, reducing the risk of network-related threats.	Prioritizes securing data transmitted between mobile apps and corporate servers, minimizing the risk of data interception.
Threat Intelligence	Integration with threat intelligence feeds for real-time updates on emerging threats, enhancing proactive defence mechanisms.	Limited threat intelligence integration, relying on periodic updates and manual security assessments.	Utilizes threat intelligence to assess risks associated with specific mobile applications, focusing on app-level threats.
Compliance Management	Comprehensive compliance tracking and reporting to ensure devices adhere to regulatory and organizational security requirements.	Enforces compliance policies to meet regulatory standards, with centralized reporting for audit purposes.	Focuses on application compliance, ensuring that mobile apps adhere to security policies and regulatory standards.
Security Policy Enforcement	Enforces security policies at the device and application levels, ensuring consistent adherence to security standards.	Centralized enforcement of security policies to maintain a standardized security posture across all devices.	Implements policies specific to application behaviour, enhancing control over app-level security configurations.

Security Gaps:

Limited Visibility: MDM and MAM solutions often lack comprehensive visibility into app activity, making it difficult to detect malicious behaviour or data breaches.
Limited Control: MDM and MAM solutions may not have sufficient control over personal devices, making it difficult to enforce security policies and prevent data leakage.
Limited Protection: MDM and MAM solutions often offer limited protection against sophisticated threats, such as zero-day attacks and advanced malware.

Why Choose MDM and Jamf Mobile Threat Defense:

1. Comprehensive Protection: The combination of MDM and Jamf Protect for Mobile security provides end-to-end security, addressing both device management and threat detection on Mobile devices.

2. User Productivity: By ensuring the security of mobile devices, organisations can foster a productive and collaborative work environment without compromising on data safety.

3. Regulatory Compliance: MDM and Jamf Protect for Mobile security help organisations meet regulatory requirements for data protection and privacy, reducing the risk of legal consequences.

Mitigation Strategies:

Implement Mobile Device Management (MDM): MDM solutions provide basic security features, such as device lock/wipe, app blacklisting and password policies.
Use Mobile Application Management (MAM): MAM solutions offer more granular control over app behaviour and data access.
Utilize Mobile Threat Defense (MTD): MTD solutions provide advanced threat detection and protection capabilities.
Implement strong password policies and multi-factor authentication.
Educate users on mobile security awareness and best practices.
Utilize encryption at rest and in transit.
Implement data loss prevention policies.
Enforce BYOD policies and provide secure alternatives for accessing corporate resources.

Note: The specific capabilities and gaps may vary based on the versions and configurations of the mentioned solutions. It is recommended to refer to the latest documentation and consult with vendors for the most accurate and up-to-date information.

For more information please contact us at https://brilyant.com/contact/

Are you Ready to Deploy MacOS Big Sur?

2020-11-03T22:52:00.008+05:30

Are you Ready to Deploy MacOS Big Sur?

Check List:

Delay software update Policy in your MDM for Testing MacOS BigSur.

Enrol to AppleSeed for IT Program and Beta Test and Complete all Test.

Evaluation of MacOS Big Sur Brand new UI, features and Capabilities.

IT infrastructure like VPN, printer Drivers, Application and Management Policy Test Completed.

Training and Announced of Launch for Internal Team.

macOS Big Sur Compatible devices:

(https://www.apple.com/macos/big-sur-preview/)

1. iMac 2014+
2. iMac Pro 2017
3. Mac Pro 2013+
4. MacMini 2014+
5. MacBook 2015+
6. MacBook Air 2013+
7. MacBook Pro 2013+

Plan for upgrade:

Prepare Package:

Download Install macOS Big Sur app from the Mac App Store.

Build a pkg using Package building tools. Like the Composer, VMware Airwatch Admin Assistant app.

Upload the pkg to MDM.

Create a Policy to deploy in End-user Device.

Jamf MDM users:

Upload the Package to Jamf Pro console using Jamf Admin.

Option A

Cache Install

Log in to Jamf Pro.
Click Computers at the top of the page.
Click Policies.
Click New
In the General payload, enter a display name for the policy. For example, “Cache Install macOS Big Sur.pkg”.
Select Recurring Check-in as the trigger.
Choose “Once per Computer” from the Execution Frequency pop-up menu.
Select the Packages payload and click Configure.
Click Add for the PKG file.
Choose “Cache” from the Action pop-up menu.
Specify a distribution point for computers to download the package from.
Select the Maintenance payload and click Configure.
Ensure that the Update Inventory checkbox is selected.
Click the Scope tab and configure the scope of the policy.
Save

Create a Smart Computer Group with the Cached PKG File

Click Computers at the top of the page.
Click Smart Computer Groups.
Click New.
On the Computer Group pane, enter a display name for the smart computer group. For example, “Install MacOS Big Sur.pkg Cached”.
Click the Criteria tab.
Click Add.
Click Choose for “Cached Packages”.
Note: Only your 30 most frequently used criteria are listed. To display additional criteria, click Show Advanced Criteria.
Choose “has” from the Operator pop-up menu.
Click Browse.
Click Choose for the PKG file.
Note: The PKG file is not available as a value until it has been cached on at least one computer.
Click Save.

Create a Policy for Upgrading macOS

Option 1 self service:

Click Computers at the top of the page.
Click Policies.
Click New.
In the General payload, enter a display name for the policy. For example, “Upgrade macOS”.
Choose “Once per Computer” from the Execution Frequency pop-up menu.
Select the Packages payload and click Configure.
Click Add for the Install macOS Big sur.pkg file.
Choose “Install Cached” from the Action pop-up menu.
Select the Files and Processes payload and click Configure.
In the Execute Command field, enter the file path to the installer with the --startosinstall command. For example, "/file/path/Install macOS Big Sur.app/Contents/Resources/startosinstall". (To suppress end-user messages during installation, add the --agreetolicense flag to the command).
Click the Scope tab.
Click Add.
Click the Computer Groups tab.
Click Add for the smart computer group with the cached PKG file you just created.
Click the Self Service tab.
Select Make the policy available in Self Service.
Configure how the policy is displayed in Self Service using the settings on the pane.
Click Save.

Option 2 Creating Policy for upgrading macOS Automatically:

Click Computers at the top of the page.
Click Policies.
Click New.
In the General payload, enter a display name for the policy. For example, “Upgrade macOS”.
Choose “Once per Computer” from the Execution Frequency pop-up menu.
Select the Packages payload and click Configure.
Click Add for the Install macOS Big Sur.pkg file.
Choose “Install Cached” from the Action pop-up menu.
Select the Files and Processes payload and click Configure.
In the Execute Command field, enter the file path to the installer with the --startosinstall command. For example, "/file/path/Install macOS Big Sur.app/Contents/Resources/startosinstall" (Optional) To suppress user messages while installing macOS, add the --agreetolicense flag to the command.

Click the Scope tab.
Click Add .
Click the Computer Groups tab.
Click Add for the smart computer group with the cached PKG file you just created.
Click the User Interaction tab and enter messages to display to users or allow users to defer the policy.
Click Save.

Option B

Direct Install:

Purchase Mac OS Installer from Apple Business Manager from Apps and Book.

Click Computers at the top of the page.
Click Mac App Store Apps.
Click New.
Do one of the following:

To add the app by browsing the App Store, enter the name of the app, choose an App Store country, and then click Next. Then click Add for the app you want to add.

Use the General pane to configure settings for the app, including the distribution method. For apps distributed using managed distribution, you can also enable automatic app updates.
Click the Scope tab and configure the scope of the app.
Click the Self Service tab and configure the way the app is displayed in Self Service.
You can customize the text displayed in the description for the app in Self Service by using Markdown in the Description field.
Click the Managed Distribution tab, and then click the Device Assignments tab.
Select the Assign Volume Content checkbox.
Choose the location that has purchased the app to distribute to computers.
Click Save
Click Computers at the top of the page.
Click Policies.
Click New.
In the General payload, enter a display name for the policy. For example, “Upgrade macOS”.
Choose “Once per Computer” from the Execution Frequency pop-up menu.
Select the Files and Processes payload and click Configure.
In the Execute Command field, enter the file path to the installer with the --startosinstall command. For example, "/file/path/Install macOS Big Sur.app/Contents/Resources/startosinstall" (Optional) To suppress user messages while installing macOS, add the --agreetolicense flag to the command.

Click the Scope tab.
Click Add.
Click the Computer Groups.
Click Save.

VMware | workspace One MDM:

Option A

In the Workspace ONE UEM Console, click Apps & Books.
Expand Applications and click Native.
Select Purchase
Click Sync Assets
Enable Device Assignment for. MacOS upgrade
Click Ok click Save and Assign
Assign to Pre-Big Sur Device
Set Assignment Type
Click Save and Publish.
Click Add Application on the Internal tab.
Upload macOS Application to Workspace ONE.
Upload Metadata File
Add Image to App
Assign the Application On-Demand
Save and Publish

Option B

Click Add Application on the Internal tab.
Upload macOS Application to Workspace ONE.
Upload Metadata File
Add Image to App
Assign the Application On-Demand
Save and Publish

Configure Post Install Script in Workspace one.

In the Workspace ONE UEM Console, click Devices.
Expand Profiles & Resources and click Profiles.
Click Add.
Click Add Profile
Select Profile Platform and Context - Select Apple macOS> Select Device Profile.
Configure General macOS Device Profile Settings
Configure Custom Attributes Payload (paste the Install script)
Set the Execution Interval to Schedule.
Set Report Every to 8 Hours.
Click Save and Publish, then click Publish.

Note: please validate the script, this plan is for reference only. I am not responsible if any data loss

Creating Redemption code Via Apple Business Manager

2020-07-10T09:37:00.002+05:30

Log in to your Apple Business Manager.
> Custom Apps.
Select the app for which you want to the redemption codes.
Select Redemption Codes from the License Type drop-down menu
Provide the Quantity and click Get (Note: You will receive an email confirming the purchase at the admin email address).
Download the redemption codes, save and share with your Team.

setup Shared iPad for Business

2020-04-13T21:05:00.000+05:30

Shared iPad can also be used in business, Multiple users can use the iPad and the USer experiences can be like a personal device, even though the device is shared.

To set up the Shared iPad it requires an MDM solution, Apple Business Manager and Managed Apple ID created using Microsoft Azure.

Shared iPad Support on:
iPad Pro
iPad 5th Gen
iPad Air 2
iPad mini 4th Gen

iPadOS 13.4

Following setup had to be done in MDM:

When Setting up the AutoEnrollment configuration select Shared iPad.

Sign into shared iPad:

1. Once the Device is configured Enter the Manage Apple ID Username and Password
2.Create a Shared iPad Password
3. Next time when you use the iPad, use Manage Apple ID user name and shared iPad Password.

Shared iPad Temporary Session

In iPadOS 13.4 or later, any user can initiate a temporary session without the need for a username or password by tapping Guest at the login screen. All their data — including browsing history — is deleted when the user signs out.

Using Temporary Sessions with Shared iPad also prevents users from modifying account settings or signing into Apple services. For example, users can’t create new mail accounts in Settings or sign in to the App Store.

Note: Shared iPad Temporary session can be disable using MDM.

Script Jamf

2019-01-16T14:59:00.000+05:30

Assest Tag:

Cat: None

#!/bin/bash
assetTag=$(osascript -e 'text returned of (display dialog "Please type in your asset tag" default answer "JS#####" buttons {"OK"} default button 1)')
sudo jamf recon -assetTag $assetTag

Policy > files and Process : Clean OS install:
"/Applications/Install macOS Mojave.app/Contents/Resources/startosinstall" --eraseinstall --newvolumename "Macintosh HD" --agreetolicense

upload sys log:

cat: system tools

#!/bin/bash
serial=$(system_profiler SPHardwareDataType | awk '/Serial Number/{print $4}')
jamfID=$(curl -sku username:password -H "Accept: application/xml" https://brilyant.jamfcloud.com/JSSResource/computers/serialnumber/$serial | xpath "/computer/general/id/text()")
curl -sku api:apple123 https://brilyant.jamfcloud.com/JSSResource/fileuploads/computers/id/$jamfID -F name=@/private/var/log/system.log -X POST

wallpaper

cat: Dock
#!/bin/bash
# $3 is the logged in user - default for most policies.
sudo -u $3 /usr/bin/osascript <<ENDofOSAscript
tell Application "Finder"
set the desktop picture to {"Library:Desktop Pictures:<apppp>.jpg"} as alias
end tell
ENDofOSAscript
exit 0

Versions:

#!/bin/sh
FILE_PATH="$1"
FILE_NAME="${FILE_PATH##*/}"
PKG_PATH="${FILE_PATH%/*}"
TMP_PATH=`/usr/bin/mktemp -d /tmp/PKGINFO.XXXX`
DEBUG=false

if [ ! -f "$FILE_PATH" ] || [ "$FILE_NAME##*." == "pkg" ]; then
echo "ERROR: Unable to find valid package file."
echo "USAGE: ${0##*/} /path/to/package"
exit $LINENO
fi

if $DEBUG; then
echo "FILE: $FILE_NAME"
echo "FOLDER: $PKG_PATH"
echo "TEMP: $TMP_PATH"
fi

PKG_TITLE=`/usr/sbin/installer -verbose -pkginfo -pkg "$FILE_PATH" | /usr/bin/grep -m 1 Title | /usr/bin/awk -F " : " '{print $2}'`

if ! PKG_INFO=(`/usr/bin/xar -t -f "$FILE_PATH" | /usr/bin/grep PackageInfo`); then
echo "ERROR: Unable to find package file information."
exit $LINENO
fi

pushd "$TMP_PATH" > /dev/null

for PKG_FILE in ${PKG_INFO}; do
if ! /usr/bin/xar -x -f "$FILE_PATH" "$PKG_FILE"; then
echo "ERROR: Unable to extract package file information."
exit $LINENO
else
TMP_INFO+=("$TMP_PATH/$PKG_FILE")
if $DEBUG; then echo "INFO: ${TMP_INFO[@]}"; fi
fi
done

for FILE_INFO in $TMP_INFO; do
PKG_VERSION+=(`/usr/bin/xpath "$FILE_INFO" "string(/pkg-info[1]/@version)" 2> /dev/null`)
echo "TITLE: $PKG_TITLE"
echo "VERSION: ${PKG_VERSION[@]}"
done

popd > /dev/null

/bin/rm -rf "$TMP_PATH"

Lastboot:

#!/bin/bash

bootTime=$(sysctl kern.boottime | awk '{print $5}' | tr -d ,)
#echo "$bootTime"

bootTimeFormatted=$(date -jf %s $bootTime +%F\ %T)

echo "<result>$bootTimeFormatted</result>"

Application launch

#!/bin/bash

open -a (Name of application).app

uptime:

#!/bin/bash

##defers policy
returnCode=$("/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" -windowType hud -description "Click Restart to Resrat your Mac or Choose a better time." -button1 "Restart" -button2 "Cancel" -showDelayOptions "0, 300, 3600")
selectedTime=${returnCode%?}
echo $selectedTime
buttonClicked=${returnCode: -1}

if [[ $returnCode == 3001 ]]; then
sleep 300s;
elif [[ $returnCode == 36001 ]]; then
sleep 3600s;

fi
#### push restart policy
reboot

Changing the name to SL No:

#!/usr/bin/env bash

# Get the Serial Number of the Machine
sn=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}')

# Set the ComputerName, HostName and LocalHostName
scutil --set ComputerName $sn
scutil --set HostName $sn
scutil --set LocalHostName $sn

Message:

osascript -e 'tell app "Finder" to display dialog "you have sucessfully rebooted"'

Last boot
#!/bin/bash

assetTag=$(osascript -e 'text returned of (display dialog "Please type in your asset tag" default answer "JS#####" buttons {"OK"} default button 1)')
sudo jamf recon -assetTag $assetTag

Battery Serial Number
#!/bin/sh

echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep "BatterySerialNumber" | awk '{print $3}' | sed s/\"//g)</result>"

uptime days

#!/bin/bash
# Commands required by this script
declare -x awk="/usr/bin/awk"
declare -x sysctl="/usr/sbin/sysctl"
declare -x perl="/usr/bin/perl"

declare -xi DAY=86400
declare -xi EPOCH="$($perl -e "print time")"
declare -xi UPTIME="$($sysctl kern.boottime |
$awk -F'[= ,]' '/sec/{print $6;exit}')"

declare -xi DIFF="$(($EPOCH - $UPTIME))"

if [ $DIFF -le $DAY ] ; then
echo "<result>1</result>"
else
echo "<result>$(($DIFF / $DAY))</result>"
fi

Active power management

#!/bin/sh
echo "<result>`/usr/bin/pmset -g 2>&1 | grep \* | awk '{$NF=""; print $0}'`</result>"

Email ID

#!/bin/bash

pathData="/usr/local/dashboard/data/EmailAddresses.dat"

function DashboardStructure {
# Ensure the appropriate directories are in place.
mkdir -p /usr/local/dashboard/{bin,data,logs}
CheckAppleMail
CheckOutlook
}

function CheckAppleMail {
if [ `ps aux | grep -c "Mail.ap[p]"` -gt "0" ]; then
accountsMail=$(/usr/bin/osascript <<-EOF
tell application "Mail"
user name of every account
end tell
EOF)
for account in $accountsMail; do
if [ `echo $account | grep -c "@"` -gt "0" ]; then
echo $account | tr -d "," >> "$pathData"
fi
done
fi
}

function CheckOutlook {
if [ `ps aux | grep -c "Microsoft Outlook.ap[p]"` -gt "0" ]; then
accountsOutlook=`/usr/bin/osascript <<-EOT
tell application "Microsoft Outlook"
user name of every exchange account
end tell
EOT`
for account in $accountsOutlook; do
if [ `echo $account | grep -c "@"` -gt "0" ]; then
echo $account | tr -d "," >> "$pathData"
fi
done
accountsOutlookIMAP=$(/usr/bin/osascript <<-EOF
tell application "Microsoft Outlook"
user name of every imap account
end tell
EOF)
for account in $accountsOutlookIMAP; do
if [ `echo $account | grep -c "@"` -gt "0" ]; then
echo $account | tr -d "," >> "$pathData"
fi
done
fi
}

function ReportResult {
if [ -e "$pathData" ]; then
cat "$pathData" | sort -u > "$pathData.tmp"
mv "$pathData.tmp" "$pathData"
echo "<result>`cat $pathData`</result>"
else
echo "<result>N/A</result>"
fi
}

Useful link for Jamf Pro starters

2019-01-10T23:35:00.000+05:30

Youtube knowledge base :
https://www.youtube.com/playlist?list=PLlxHm_Px-Ie3dNKXGmRIuxFgmiy2KZDH5

Guide:
http://docs.jamf.com/10.9.0/jamf-pro/administrator-guide/Preface.html

Network Ports Used by Jamf Pro :
https://www.jamf.com/jamf-nation/articles/34/network-ports-used-by-jamf-pro

integrate Jamf Pro with Active Directory Certificate Services (AD CS) : http://docs.jamf.com/technical-papers/jamf-pro/integrating-ad-cs/10.6.0/Introduction.html

Finding a Process Name Using Terminal:
https://www.jamf.com/jamf-nation/articles/98/finding-the-name-of-processes-when-configuring-restricted-software

Starting and Stopping Tomcat :
https://www.jamf.com/jamf-nation/articles/117/starting-and-stopping-tomcat

Enabling Debug Mode:
https://www.jamf.com/jamf-nation/articles/454/enabling-debug-mode

Classic API
https://developer.jamf.com/#/advancedmobiledevicesearches/findAdvancedMobileDeviceSearches

Obtaining an Installer Certificate from Apple:
https://www.jamf.com/jamf-nation/articles/301/obtaining-an-installer-certificate-from-apple

Integration of Jamf with Intune:
http://docs.jamf.com/technical-papers/jamf-pro/microsoft-intune/10.9.0/Introduction.html

Jamf Pro includes three components:
1. Java: a runtime environment required by Apache Tomcat and the Jamf Pro web application
2. Apache Tomcat: a web server
3. MySQL: an open source relational database management system

The physical location of the Jamf Pro server depends on each organization’s needs. There are two options:
1. Hosted by Jamf in a cloud environment
2. Hosted by an organization in their server environment using macOS, Ubuntu, Red Hat Enterprise Linux (RHEL), or Windows Server

Navigating Jamf Pro:
- Dashboard, Sidebar, Objects, and Buttons
- Computers, Devices, and Users
- Settings button
- Keyboard shortcuts
- Buildings and Departments can be created to organize the devices managed by Jamf Pro.

Jamf Pro Navigational Aid

Computers

Devices
Users
Settings

Jamf Pro Server Environment

	Server OS	Tomcat Version	Database Configuration	Java
Recommended	Windows Server 2016	Tomcat 8.5	MySQL 5.7 – InnoDB	Oracle Java 1.8
	Ubuntu Server 18.04 LTS		MySQL 5.7 on Amazon RDS – InnoDB	OpenJDK 1.8
	macOS 10.14*
	Red Hat Enterprise Linux 7.x
Minimum Required	Windows Server 2012 R2	Tomcat 7	MySQL 5.6 – InnoDB
	Ubuntu Server 16.04 LTS
	macOS 10.13*
	Red Hat Enterprise Linux 6.x

* macOS is not recommended for clustered environments.

Web Browsers
The following table lists the browser requirements for enrollment and access to web applications:

	macOS	iOS	Windows	Linux
Recommended	Safari	Safari	Microsoft Internet Explorer 11
Minimum Required	Google Chrome		Google Chrome	Google Chrome
	Mozilla Firefox		Mozilla Firefox
			Microsoft Edge

Computer and Mobile Device Management
The following table lists operating system requirements for managed computers and mobile devices:

	macOS*	iOS	tvOS
Recommended	macOS 10.14.x	iOS 12.x	tvOS 12.x
		iOS 11.x	tvOS 11.x
Minimum Required	macOS 10.13.x	iOS 10.x
Minimum Required	macOS 10.11.x	iOS 9.x

* Also indicates macOS versions required to run Composer on Mac computers.

Jamf Pro Server Requirements

The server used to host Jamf Pro should meet the minimum requirements for operating system, Tomcat version, database configuration, and Java installation. For detailed information on these requirements, see "Jamf Pro Server Environment" on the Jamf Pro System Requirements page.

The Jamf Pro installers have additional requirements for each platform:

Mac

A 64-bit capable Intel processor
2 GB of RAM
400 MB of disk space available
Ports 8443 and 9006 available

Linux

A 64-bit capable Intel processor
2 GB of RAM
400 MB of disk space available
The "wget" utility installed
Ports 8443 and 8080 available

Windows

A 64-bit capable Intel processor
2 GB of RAM
400 MB of disk space available
Ports 8443 and 8080 available
Note: The Jamf Pro Installer for Windows automatically creates a firewall exception for port 8443. If you are using a third-party firewall, or if you are using a port other than 8443, you will need to manually add a firewall exception.

Jamf Now

2018-12-03T16:01:00.000+05:30

Today just tried Jamf Now:
Create your Jamf Now Account : https://www.jamf.com/products/jamf-now/?r=05efa215693a43be887ba2a161aa1bc7

Jamf Now is Basic For SMB and to get start for becoming a Pro on Jamf.

what all was possible when i tried:

Setting:
Binding : Apple school Manager and Apple Business Manager
Binding : VPP
Auto enrolments and open enrolments
Add Team Mates

Configuration Policies :

iOS Device:

Apps Push
Web clips
Security : Password
Email configurations
Wifi configurations
Restrictions: Apps, Security & Privacy, Network & cellular, iCloud, siri, Email wallpaper
Single App mode
OS update

Mac Device:

Apps Push
Security : Password and Enable file Vault 2
Restrictions: Apps to a certain limit, iCloud
wallpaper
OS update

I suggest this for testing on for iOS Device and SME.

Scan a Document on a Mac using iPhone and iPad

2018-10-15T10:25:00.000+05:30

With New Continuity feature on macOS Mojave and iOS 12 many app on Mac works with continuity camera including Pages Numbers and Keynote. you can now Take a Photo or Scan a Document using iPhone camera or Scan a document.

How to add a Photo or Scan a document:

Open your document
Right click on a Space with in the document Insert From iPhone or from Menu Insert > Insert from iPhone.
Hover to Import from iPhone or iPad
Click what you want to do i.e Take a Photo or Scan a Document
You can see the camera of iPhone or iPad is active
Click Save once done
Photo or Scan a Document will appear in your Document page.

Create Bootable installer for Mac OS 10.14 Mojave

2018-10-04T11:28:00.003+05:30

First copy the "Install macOS Mojave" file from Application folder to a External Hard drive which we are not going to use for creating Bootable Installer.

Second Step We will now need to start with a Erase Pen drive or external hard drive in order to make it a bootable drive.

Plug the Pen drive or External hard drive to your Mac.

Open Disk Utility from Utility folder in Application Folder in your finder.

Erase the Pen drive or External hard Drive name it as Mojave

Third Step Create Bootable installer for Mac OS 10.14 Mojave

Open Terminal and Enter

sudo /Applications/Install\ macOS\ Mojave.app/Contents/Resources/createinstallmedia --volume /Volumes/Untitled -- /Applications/Install\ macOS\ Mojave.app

Press return Key and Enter Admin Password.

Type Y and the process Start of Erasing of Disk and then coping of files to the Pen Drive or External Drive, wait to get the process to complete.

How to set up and use Screen Time on iOS 12

2018-09-19T11:29:00.003+05:30

iOS 12 is designed to make your iPhone and iPad experience even faster, more responsive, and more delightful.

Screen Time

New tools empower you to understand and make choices about how much time you spend using apps and websites.

After updating to iOS 12, the Settings app will have a new section titled Screen

How to Activate Screen Time

Open Settings > Scroll to Screen Time which in next to Do Not Disturb > Once you Tap the screen will ask you for First Time is this iPhone/iPad for yourself or your child? > the it will ask for Downtime.

For kids

Use your family’s Apple IDs to set up Screen Time for your kids to keep an eye on how much time they spend on apps and websites. They can request more time for you to approve.

Activity reports

Get reports weekly or check Today View anytime to see app usage, notifications, and device pickups.Time.breaks down usage for the current day, as well as the past 7 days. Screen Time will also break down how often you pick up your phone, which apps you used the most after picking up your phone, and how many notifications you receive on a per-app basis.

Downtime

Set a specific time, like bedtime, when apps and notifications are blocked. You can choose which apps are on and off limits.

Always allowed

Create exceptions for apps you’d like your kids to have access to even during Downtime, such as Messages or education apps.

App limits

Set the amount of time you and your kids can spend each day on specific apps and websites.

Content & Privacy Restrictions

You can block inappropriate content like iTune & App store purchase, Privacy and also block change of passcode changes, mobile data changes.

You can also set Screen Time passcode :

Open Screen Time > Scroll down below Content & Privacy Restrictions > Use Screen Time passcode > Toggle the switch to green and set passcode.

you can also enable combined screen time which are signed with the same icloud id. also setup screen time for Family.

To turn off screen Time

Open Screen Time > Scroll down below >Turn off Screen > enter passcode (if setup).

https://www.apple.com/ios/ios-12/features/

Prepare for Mac OS 10.14 aka Mojave

2018-09-18T00:02:00.000+05:30

Apple will release macOS 10.14, aka Mojave, on Monday, Sept. 24 as per APPLE EVENT ANNOUNCEMENT.

Let’s Prepare for Mac OS 10.14 aka Mojave
Before we install or upgrade we require to backup first.
We can backup as follow:
Timemachine backup (https://support.apple.com/en-in/HT201250)
manually copying the data to external HDD
if you are using iCloud upload the documents to iCloud.

It is determined that 20GB of storage space should be more than enough to install macOS Mojave if you are out of space you can optimise (https://support.apple.com/en-us/HT206996)

If you are in enterprise you have the option to stop updating Mojave using MDM upto 90 days.

If your enterprise has more Mac and which needs to be upgraded to Mojave I recommend to set up content cache service ( https://support.apple.com/guide/mac-help/manage-content-caching-mchl3b6c3720/mac )

Check compatibility

You can install macOS Mojave on any of these Mac models:

MacBook models introduced in early 2015 or later
MacBook Air models introduced in mid 2012 or later
MacBook Pro models introduced in mid 2012 or later
Mac mini models introduced in late 2012 or later
iMac models introduced in late 2012 or later
iMac Pro (all models)
Mac Pro models introduced in late 2013, plus mid 2010 or mid 2012 models with recommended Metal-capable graphics processor, including MSI Gaming Radeon RX 560 and Sapphire Radeon PULSE RX 580

macOS Mojave can be download from App Store on Mac computers running the latest version of OS X El Capitan or later.
To download from App Store Apple ID and password will be required.

Upgrade to Mojave:
1) Download Mojave from App Store
2) once downloaded installer will launch if not update is saved in Application folder which can be accessed from launch pad.
3) follow on screen instructions and it will be followed by restart.

Clean Install
1) Download Mojave from App Store
2) once downloaded installer will launch close the application or update is saved in Application folder which can be accessed from launch pad.
3) Using terminal command or third party tool create a USB install media.
4) Go to system Preference- startup disk- choose the installer you have created and restart.
5) Go to Disk utility and erase the storage and close the window and come back to main screen.
6) select reinstall a copy of Mac OS, agree terms and conditions
7) follow on screen instructions
8) Set a New Mac.

Get ready for iOS 12 update

2018-09-17T22:48:00.002+05:30

As we all are aware that on Apple’s iPhone event, it was informed that iOS 12 will be released to the public this coming Monday, September 17 2018. So let’s make sure we all ready for the software update follow along for how to get ready for iOS 12.

First to delete all unwanted contents from your iPhone or iPad, particularly with content like photos, videos, and messages that can take up a good amount of storage. It’s amazing how quickly data can pile up over a year’s time. To take full experience of iOS 12, take some time before updating to delete unneeded content and get things organized how you’d like them.

Make some fresh backups for data safety, It does not matter if you’d like to set up your iPhone or iPad as a new device for iOS 12 or bring over all your existing data from iOS 11.

Below are two steps:

1) iCloud backup: https://support.apple.com/en-us/HT207428
2) MAC/PC backup using iTunes: https://support.apple.com/en-in/HT203977

During the update process you’ll need your iPhone/iPad passcode as well as Apple ID password.

How to create a bootable installer for macOS High Sierra

2018-05-26T13:19:00.003+05:30

Below steps should be performed as Mac Mac Admin user.

1) First Step before upgrade or Erase install Please back up all your data.
2) Check for you Mac that is compatible with the Mac OS : https://support.apple.com/en-in/HT201686
3) Download macOS from the App Store
4) When the macOS installer opens, quit it without continuing installation.
5) connect the USB flash drive or other volume that will be used as the bootable installer. Make sure that it has at least 12GB or more available storage.
6) Open Terminal, which is in the Utilities folder of your Applications folder or spotlight Terminal search to open.
7) open Disk utility and Erase the Disk in HFS format volume name should be MyVolume.
8) Type or Paste the following commands in Terminal.

sudo /Applications/Install\ macOS\ High\Sierra.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume --applicationpath /Applications/Install\ macOS\ High\Sierra.app

9) Enter the Mac Admin password

10) Terminal will confirm for Eraising the volume Type Y and confirm with password if asked.

and the process will start.

How to Add iCloud Drive to Dock

2018-05-26T12:17:00.001+05:30

The iCloud Drive brings all your files together of iOS on Mac. You can easily browse, search and organise all your files in one place — not just the files on the device you’re using, but also from iCloud Storage.

We access the iCloud Drive on the sidebar of an Finder window. Its easy to launch this service from Dock, iCloud drive, Airdrop, Network, All my files and computer can be enabled to launch from Dock.

Follow below steps:

1) Finder menu bar Go > Go To folder

2) Here we need to connect to the finder app package folder and we have to go inside the contents/ Applications folder. so we will give the path

/System/Library/CoreServices/Finder.app/Contents/Applications/

3) Using your mouse, drag the iCloud Drive or other app to the desired location in your Dock.

and you are done, you have added iCloud Drive to your Dock for quick access.

Clean Install macOS Sierra

2016-09-21T12:20:00.002+05:30

First Step we recommend that you back up your Mac.

Make sure that your Mac can run macOS Sierra

These Mac models are compatible with macOS Sierra:
MacBook (Late 2009 or newer)
MacBook Pro (Mid 2010 or newer)
MacBook Air (Late 2010 or newer)
Mac mini (Mid 2010 or newer)
iMac (Late 2009 or newer)
Mac Pro (Mid 2010 or newer)

Preparation:

Download the MacOS Sierra from the App Store using you Apple ID and Password.

You should Have 16GB Pendrive that you can erase.

make sure your USB drive is name "Installer", if not To do this Open Finder, right click on the USB drive name on the left and then choose Rename.

Download Install Disk creator

Creating Install Disk:

Once the download is ready, Close the File screen appearing in front of you.

Open the app. If prompted allow the app to run.

Choose your USB device that we named Installer.

Select the OS X Installer and then Choose the MacOS Sierra Installer

Click Create Installer

if prompted enter your computer Admin password.

Once it ready Shutdown the computer.

Perform a Install:

As now we are prepared we can actually perform clean install.

Turn on the Computer by holding "Option or alt" key on your keyboard.

Select Install macOS Sierra USB drive to the right of the screen.

Select the language.

As we are performing clean install we will format the hard drive, choose disk utility and click continue.

Click on your car drive, name it "Macintosh HD" Format type: Mac OS Extended (Journaled).

and click Erase.

Once its Erase is done your Hard drive is empty.

Now we see the Installer screen and follow the onscreen instructions.

Ready to configure:

once the installation is done.

if you want to use you time machine back up, or data from your other Mac/PC on a this Mac you can use Migration Assistant,or start with a clean user name and password.

Download iMove,GarageBand, Pages, Numbers and Keynote from Appstore.

upgrade your Mac to macOS Sierra

2016-09-21T11:53:00.001+05:30

Now upgrade your Mac to macOS Sierra from the Mac App Store -Free

Link: https://itunes.apple.com/us/app/macos-sierra/id1127487414?mt=12&ls=1

Mac models are compatible with macOS Sierra:
MacBook (Late 2009 or newer)MacBook Pro (Mid 2010 or newer)MacBook Air (Late 2010 or newer)Mac mini (Mid 2010 or newer)iMac (Late 2009 or newer)Mac Pro (Mid 2010 or newer)

General Requirements

OS X 10.7.5 or later
2GB of memory
8.8GB of available storage

For details about your Mac model, click the Apple icon at the top left of your screen, choose About This Mac, then choose More Info. 

If your Mac is running OS X Lion 10.7.5 or later, you can upgrade directly to macOS Sierra.
If you’re running Snow Leopard (10.6.8) and your Mac supports macOS Sierra, you will need to upgrade to El Capitan first.

Before you upgrade, we recommend that you back up your Mac. You should also have your Apple ID and password handy. 

How to upgrade

Visit the macOS Sierra page on the Mac App Store. Click the download button.Enter you Apple ID and Password.File Size of 4.77GB will get download in your Application folder.Double click the file and follow the onscreen instructions to begin your upgrade.

Mac keyboard shortcuts

2016-06-22T16:06:00.000+05:30

Mac keyboard shortcuts

By pressing a combination of keys, you can do things that normally need a mouse, trackpad, or other input device.

To use a keyboard shortcut, hold down one or more modifier keys while pressing the last key of the shortcut. For example, to use the shortcut Command-C (copy), hold down Command, press C, then release both keys. Mac menus and keyboards often use symbols for certain keys, including the modifier keys:

Command ⌘
Shift ⇧

Option ⌥
Control ⌃

Caps Lock ⇪
Fn

If you're using a keyboard made for Windows PCs, use the Alt key instead of Option, and the Windows logo key instead of Command. Some Mac keyboards and shortcuts use special keys in the top row, which include icons for volume, display brightness, and other functions. Press the icon key to perform that function, or combine it with the Fn key to use it as an F1, F2, F3, or other standard function key.

To learn more shortcuts, check the menus of the app you're using. Every app can have its own shortcuts, and shortcuts that work in one app may not work in another.

Cut, copy, paste, and other common shortcuts

Shortcut	Description
Command-X	Cut: Remove the selected item and copy it to the Clipboard.
Command-C	Copy the selected item to the Clipboard. This also works for files in the Finder.
Command-V	Paste the contents of the Clipboard into the current document or app. This also works for files in the Finder.
Command-Z	Undo the previous command. You can then press Command-Shift-Z to Redo, reversing the undo command. In some apps, you can undo and redo multiple commands.
Command-A	Select All items.
Command-F	Find: Open a Find window, or find items in a document.
Command-G	Find Again: Find the next occurrence of the item previously found. To find the previous occurrence, press Command-Shift-G.
Command-H	Hide the windows of the front app. To view the front app but hide all other apps, press Command-Option-H.
Command-M	Minimize the front window to the Dock. To minimize all windows of the front app, press Command-Option-M.
Command-N	New: Open an new document or window.
Command-O	Open the selected item, or open a dialog to select a file to open.
Command-P	Print the current document.
Command-S	Save the current document.
Command-W	Close the front window. To close all windows of the app, press Command-Option-W.
Command-Q	Quit the app.
Option-Command-Esc	Force Quit: Choose an app to force quit. Or press Command-Shift-Option-Esc and hold for 3 seconds to force just the front app to quit.
Command–Space bar	Spotlight: Show or hide the Spotlight search field. To perform a Spotlight search from a Finder window, press Command–Option–Space bar. If you use multiple input sources to type in different languages, these shortcuts change input sources instead of showing Spotlight.
Space bar	Quick Look: Use Quick Look to preview the selected item.
Command-Tab	Switch apps: Switch to the next most recently used app among your open apps.
Shift-Command-Tilde (~)	Switch windows: Switch to the next most recently used window of the front app.
Shift-Command-3	Screenshot: Take a screenshot of the entire screen. Learn more screenshot shortcuts.
Command-Comma (,)	Preferences: Open preferences for the front app.

Sleep, log out, and shut down shortcuts

Shortcut	Description
Power button	Tap to turn on your Mac or wake your Mac from sleep.
	Hold for 1.5 seconds while your Mac is awake to display a dialog asking if you want to restart, sleep, or shut down. If you don't want to wait 1.5 seconds, press Control–Power button or Control–Media Eject .
	Hold for 5 seconds to force your Mac to turn off.
Control–Command–Power button	Force your Mac to restart.
Control–Shift–(Power button or Media Eject )	Put your displays to sleep.
Control–Command–Media Eject	Quit all apps, then restart your Mac. If any open documents have unsaved changes, you'll be asked whether you want to save them.
Control–Option–Command–(Power button or Media Eject )	Quit all apps, then shut down your Mac. If any open documents have unsaved changes, you'll be asked whether you want to save them.
Shift-Command-Q	Log out of your OS X user account. You'll be asked to confirm.
Option-Shift-Command-Q	Log out of your OS X user account immediately, without being asked to confirm.

Document shortcuts

Shortcut	Description
Command-B	Boldface the selected text, or turn boldfacing on or off.
Command-I	Italicize the selected text, or turn italics on or off.
Command-U	Underline the selected text, or turn underlining on or off.
Command-T	Show or hide the Fonts window.
Command-D	Select the Desktop folder from within an Open dialog or Save dialog.
Control-Command-D	Show or hide the definition of the selected word.
Shift-Command-Colon (:)	Display the Spelling and Grammar window.
Command-Semicolon (;)	Find misspelled words in the document.
Option-Delete	Delete the word to the left of the insertion point.
Control-H	Delete the character to the left of the insertion point. Or use Delete.
Control-D	Delete the character to the right of the insertion point. Or use Fn-Delete.
Fn-Delete	Forward delete on keyboards that don't have a Forward Delete key. Or use Control-D.
Control-K	Delete the text between the insertion point and the end of the line or paragraph.
Command-Delete	Select Delete or Don't Save in a dialog that contains a Delete or Don't Save button.
Fn–Up Arrow	Page Up: Scroll up one page.
Fn–Down Arrow	Page Down: Scroll down one page.
Fn–Left Arrow	Home: Scroll to the beginning of a document.
Fn–Right Arrow	End: Scroll to the end of a document.
Command–Up Arrow	Move the insertion point to the beginning of the document.
Command–Down Arrow	Move the insertion point to the end of the document.
Command–Left Arrow	Move the insertion point to the beginning of the current line.
Command–Right Arrow	Move the insertion point to the end of the current line.
Option–Left Arrow	Move the insertion point to the beginning of the previous word.
Option–Right Arrow	Move the insertion point to the end of the next word.
Shift–Command–Up Arrow	Select the text between the insertion point and the beginning of the document.
Shift–Command–Down Arrow	Select the text between the insertion point and the end of the document.
Shift–Command–Left Arrow	Select the text between the insertion point and the beginning of the current line.
Shift–Command–Right Arrow	Select the text between the insertion point and the end of the current line.
Shift–Up Arrow	Extend text selection to the nearest character at the same horizontal location on the line above.
Shift–Down Arrow	Extend text selection to the nearest character at the same horizontal location on the line below.
Shift–Left Arrow	Extend text selection one character to the left.
Shift–Right Arrow	Extend text selection one character to the right.
Option–Shift–Up Arrow	Extend text selection to the beginning of the current paragraph, then to the beginning of the following paragraph if pressed again.
Option–Shift–Down Arrow	Extend text selection to the end of the current paragraph, then to the end of the following paragraph if pressed again.
Option–Shift–Left Arrow	Extend text selection to the beginning of the current word, then to the beginning of the following word if pressed again.
Option–Shift–Right Arrow	Extend text selection to the end of the current word, then to the end of the following word if pressed again.
Control-A	Move to the beginning of the line or paragraph.
Control-E	Move to the end of a line or paragraph.
Control-F	Move one character forward.
Control-B	Move one character backward.
Control-L	Center the cursor or selection in the visible area.
Control-P	Move up one line.
Control-N	Move down one line.
Control-O	Insert a new line after the insertion point.
Control-T	Swap the character behind the insertion point with the character in front of the insertion point.
Command–Left Curly Bracket ({)	Left align.
Command–Right Curly Bracket (})	Right align.
Shift–Command–Vertical bar (\|)	Center align.
Option-Command-F	Go to the search field.
Option-Command-T	Show or hide a toolbar in the app.
Option-Command-C	Copy Style: Copy the formatting settings of the selected item to the Clipboard.
Option-Command-V	Paste Style: Apply the copied style to the selected item.
Option-Shift-Command-V	Paste and Match Style: Apply the style of the surrounding content to the item pasted within that content.
Option-Command-I	Show or hide the inspector window.
Shift-Command-P	Page setup: Display a window for selecting document settings.
Shift-Command-S	Display the Save As dialog, or duplicate the current document.
Shift–Command– Minus sign (-)	Decrease the size of the selected item.
Shift–Command– Plus sign (+)	Increase the size of the selected item. Command–Equal sign (=) performs the same function.
Shift–Command– Question mark (?)	Open the Help menu.

Finder shortcuts

Shortcut	Description
Command-D	Duplicate the selected files.
Command-E	Eject the selected disk or volume.
Command-F	Start a Spotlight search in the Finder window.
Command-I	Show the Get Info window for a selected file.
Shift-Command-C	Open the Computer window.
Shift-Command-D	Open the desktop folder.
Shift-Command-F	Open the All My Files window.
Shift-Command-G	Open a Go to Folder window.
Shift-Command-H	Open the Home folder of the current OS X user account.
Shift-Command-I	Open iCloud Drive.
Shift-Command-K	Open the Network window.
Option-Command-L	Open the Downloads folder.
Shift-Command-O	Open the Documents folder.
Shift-Command-R	Open the AirDrop window.
Shift-Command-T	Add selected Finder item to the Dock (OS X Mountain Lion or earlier)
Control-Shift-Command-T	Add selected Finder item to the Dock (OS X Mavericks or later)
Shift-Command-U	Open the Utilities folder.
Option-Command-D	Show or hide the Dock. This often works even when you're not in the Finder.
Control-Command-T	Add the selected item to the sidebar (OS X Mavericks or later).
Option-Command-P	Hide or show the path bar in Finder windows.
Option-Command-S	Hide or show the Sidebar in Finder windows.
Command–Slash (/)	Hide or show the status bar in Finder windows.
Command-J	Show View Options.
Command-K	Open the Connect to Server window.
Command-L	Make an alias of the selected item.
Command-N	Open a new Finder window.
Shift-Command-N	Create a new folder.
Option-Command-N	Create a new Smart Folder.
Command-R	Show the original file for the selected alias.
Command-T	Show or hide the tab bar when a single tab is open in the current Finder window.
Shift-Command-T	Show or hide a Finder tab.
Option-Command-T	Show or hide the toolbar when a single tab is open in the current Finder window.
Option-Command-V	Move: Move the files in the Clipboard from their original location to the current location.
Option-Command-Y	View a Quick Look slideshow of the selected files.
Command-Y	Use Quick Look to preview the selected files.
Command-1	View the items in the Finder window as icons.
Command-2	View the items in a Finder window as a list.
Command-3	View the items in a Finder window in columns.
Command-4	View the items in a Finder window with Cover Flow.
Command–Left Bracket ([)	Go to the previous folder.
Command–Right Bracket (])	Go to the next folder.
Command–Up Arrow	Open the folder that contains the current folder.
Command–Control–Up Arrow	Open the folder that contains the current folder in a new window.
Command–Down Arrow	Open the selected item.
Command–Mission Control	Show the desktop. This works even when you're not in the Finder.
Command–Brightness Up	Turn Target Display Mode on or off.
Command–Brightness Down	Turn display mirroring on or off when your Mac is connected to more than one display.
Right Arrow	Open the selected folder. This works only when in list view.
Left Arrow	Close the selected folder. This works only when in list view.
Option–double-click	Open a folder in a separate window and close the current window.
Command–double-click	Open a folder in a separate tab or window.
Command-Delete	Move the selected item to the Trash.
Shift-Command-Delete	Empty the Trash.
Option-Shift-Command-Delete	Empty the Trash without confirmation dialog.
Command-Y	Use Quick Look to preview the files.
Option–Brightness Up	Open Displays preferences. This works with either Brightness key.
Option–Mission Control	Open Mission Control preferences.
Option–Volume Up	Open Sound preferences. This works with any of the volume keys.
Command key while dragging	Move the dragged item to another volume or location. The pointer changes while you drag the item.
Option key while dragging	Copy the dragged item. The pointer changes while you drag the item.
Option-Command while dragging	Make an alias of the dragged item. The pointer changes while you drag the item.
Option-click a disclosure triangle	Open all folders within the selected folder. This works only when in list view.
Command-click a window title	See the folders that contain the current folder.

How to create password-protected Notes in iOS 9.3

2016-03-23T15:22:00.001+05:30

The first step is simply to create or select a regular Note, unsecured note in the app, since notes can only be secured after the fact.

Type some matter on a new note.

Once this is done, tap the Share icon in the upper-right corner of the screen.This is where the "Lock Note" option is hidden, alongside other choices like Copy and Print.

Selecting it brings up a panel asking you to create a password and retype it to verify. For the best security, avoid reusing an existing password, and make the new one either a phrase or a complex assortment of characters. Optionally you can enter a hint in case you forget, and/or use Touch ID to make logins faster.

At this point, a note's contents will still be visible to anyone able to unlock your device. Protection only takes effect once you tap the padlock icon, again in the upper-right corner.

Finally, the note is secure. To see inside, you'll have to tap "View Note" or the padlock icon, and either enter your password or use Touch ID.