{
	"version": "https://jsonfeed.org/version/1",
	"title": "csh's toolbox",
	"icon": "https://avatars.micro.blog/avatars/2024/40/7414.jpg",
	"home_page_url": "https://applefreakz.de/",
	"feed_url": "https://applefreakz.de/feed.json",
	"items": [
			{
				"id": "http://csh.micro.blog/2025/08/09/prevent-a-mac-laptop-from.html",
				"title": "Prevent a Mac laptop from turning on when opening its lid or connecting to power",
				"content_html": "<p>Just found this interesting article in my drafts. Apple released some time ago a support article that explains in detail how you can configure your Mac’s power on behavior.</p>\n<p>I personally do not like the current default behavior and modified it.</p>\n<p>Which team you are in?</p>\n<p><a href=\"https://support.apple.com/en-us/120622\">Prevent a Mac laptop from turning on when opening its lid or connecting to power</a></p>\n",
				
				"date_published": "2025-08-09T23:21:01+02:00",
				"url": "https://applefreakz.de/2025/08/09/prevent-a-mac-laptop-from.html"
			},
			{
				"id": "http://csh.micro.blog/2025/01/29/configure-notification-settings-for-password.html",
				"title": "Configure notification settings for Password Policy Updated notification on macOS 14.x and above",
				"content_html": "<p>With the release of macOS Sonoma 14.x (I think it was 14.1) a new alert notification was introduced which indicated the user that a new/updated payload of a password restriction was received by the Mac.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2025/82099151e8.png\" alt=\"macOS Notification screenshot, title: Password Policy Updated, body: The next time you log in your password may need to be updated to meet your organisation's new password requirements.\">\n<p>After the policy is received the local account password is no longer accepted and the user has to change it in System Settings or, as mentioned in the notification, log out and log in again.</p>\n<p>This is in my opinion a great improvement for the user experience. The challenge in my experience here is, that with the macOS default behavior for notifications is the alert type ' Banner'. Banners appear in the upper-right corner and go away automatically. The user might not see the notification and is confused that the local account password does not work anymore in the current session.</p>\n<p>But luckily with the help of Apple Care Enterprise engineers (<strong>hat tip</strong>) I have now the App Bundle Identifier to create a notification settings profile. In the example below you find a profile for <em>com.apple.ManagedClient.PasscodeUserNotification2</em> which changes the Alert Type to &lsquo;Alerts&rsquo;. Alerts stay on screen until dismissed.</p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-xml\" data-lang=\"xml\"><span style=\"color:#75715e\">&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&gt;</span>\n<span style=\"color:#75715e\">&lt;!DOCTYPE plist PUBLIC &#34;-//Apple//DTD PLIST 1.0//EN&#34; &#34;http://www.apple.com/DTDs/PropertyList-1.0.dtd&#34;&gt;</span>\n<span style=\"color:#f92672\">&lt;plist</span> <span style=\"color:#a6e22e\">version=</span><span style=\"color:#e6db74\">&#34;1.0&#34;</span><span style=\"color:#f92672\">&gt;</span>\n<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadContent<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;array&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>NotificationSettings<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;array&gt;</span>\n\t\t\t\t<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>AlertType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>2<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>BadgesEnabled<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>BundleIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.ManagedClient.PasscodeUserNotification2<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>CriticalAlertEnabled<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>GroupingType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>0<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>NotificationsEnabled<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PreviewType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>ShowInCarPlay<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>ShowInLockScreen<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>ShowInNotificationCenter<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>SoundsEnabled<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t\t\t<span style=\"color:#f92672\">&lt;true/&gt;</span>\n\t\t\t\t<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;/array&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>Notifications<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.notificationsettings.99163D44-2ADB-4669-AAC2-84F41DF4377E<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.notificationsettings<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>99163D44-2ADB-4669-AAC2-84F41DF4377E<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;/array&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDescription<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Notification settings for com.apple.ManagedClient.PasscodeUserNotification2<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Notification Settings <span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>applefreakz.3797D291-714A-466F-A248-B5D3EF325FA2<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Configuration<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>3797D291-714A-466F-A248-B5D3EF325FA2<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n<span style=\"color:#f92672\">&lt;/plist&gt;</span>\n</code></pre></div><p>Hope some of you find this tidbit helpful for your environment.</p>\n",
				
				"date_published": "2025-01-29T12:37:52+02:00",
				"url": "https://applefreakz.de/2025/01/29/configure-notification-settings-for-password.html",
				"tags": ["macOS"]
			},
			{
				"id": "http://csh.micro.blog/2024/12/08/change-siris-volume.html",
				"title": "Change Siri's volume on your HomePod",
				"content_html": "<p>I just stumbled over this support article.</p>\n<p><a href=\"https://support.apple.com/en-us/105092\">Change Siri&rsquo;s volume on your HomePod</a></p>\n<p>Never thought about telling Siri to talk quieter. The output was always to loud for my taste. In the article you find a section for HomePod:</p>\n<blockquote>\n<p>You can ask Siri to speak louder, quieter, or at a specific volume. Say &ldquo;Hey Siri,&rdquo; then say something like:</p>\n<ul>\n<li>&ldquo;Speak louder.&rdquo;</li>\n<li>&ldquo;Always speak quieter.&rdquo;</li>\n<li>&ldquo;Set your volume to sixty percent.&rdquo;</li>\n</ul>\n<p>HomePod automatically adjusts Siri&rsquo;s response volume based on the level of noise in the room, your distance from HomePod, and how loudly you&rsquo;re speaking to Siri. You can turn automatic volume on or off by saying, &ldquo;Hey Siri, turn on automatic Siri volume,&rdquo; or &ldquo;Hey Siri, turn off automatic Siri volume.&rdquo;</p>\n</blockquote>\n",
				
				"date_published": "2024-12-08T01:16:44+02:00",
				"url": "https://applefreakz.de/2024/12/08/change-siris-volume.html"
			},
			{
				"id": "http://csh.micro.blog/2024/10/08/vision-pro-reset.html",
				"title": "Vision Pro 2.0 - Reset after ACE configuration profile stuck downloading",
				"content_html": "<p>I recently learned that playing with ADE enrollments of AVPs on an unsupported (not yet) MDM could lead to a device stuck in &lsquo;waiting for configuration&rsquo; screen. Restarting device will end in the same screen even after you unassigned the device in ABM.</p>\n<p>There was no obvious way to reset the device running visionOS 2.0. I have ask ACE support and there is a way to reset the device if you do the following.</p>\n<ol>\n<li>Press both top buttons. A windows will appear: Apple Vision Pro is not configured.</li>\n<li>Go to Accessibility options -&gt; Eye input -&gt; Switch eye input (you need to reconfigure your eye input settings).</li>\n</ol>\n<p>Once you did this, an Apple logo with a progress bar will appear and AVP will be reset to factory settings before starting the new calibration progress.</p>\n<p>Hopefully that helps if you are playing around like myself.</p>\n",
				
				"date_published": "2024-10-08T14:51:46+02:00",
				"url": "https://applefreakz.de/2024/10/08/vision-pro-reset.html",
				"tags": ["VisionOS"]
			},
			{
				"id": "http://csh.micro.blog/2024/04/16/blocking-ios-thirdparty.html",
				"title": "Blocking iOS third-party marketplaces and web distribution in the EU",
				"content_html": "<p>Apple released with iOS 17.4 and iOS 17.5 with two minor updates for users in the European Union to comply with the EU&rsquo;s Digital Markets Act new features. In these releases users located in the EU have the possiblity to install 3rd party App Stores (aka Marketplaces in 17.4) and to download iOS apps directly from websites (aka Web Distribution in 17.5). If you wanna block users to install these on managed, corporate devices you can find here how.</p>\n<p><strong>What does this mean?</strong></p>\n<p>You can find a very detailed description what was changed in this <a href=\"https://developer.apple.com/support/dma-and-apps-in-the-eu/\">Apple support document</a>.</p>\n<p><strong>New for enterprise admins</strong></p>\n<p>In case you want to block one or both new distribution methods of apps you can do this quiet easy with two new device restrictions that are supported on <em>supervised devices</em>.</p>\n<ol>\n<li>allowMarketplaceAppInstallation - iOS 17.4 includes a new Restriction key to prevent installing third-party app marketplaces on supervised iPhones in the EU.</li>\n<li>allowWebDistributionAppInstallation - iOS 17.5 includes a new Restriction key allowWebDistributionAppInstallation to prevent installing apps through <a href=\"https://developer.apple.com/support/web-distribution-eu/\">Web Distribution</a> on supervised iPhones in the EU.</li>\n</ol>\n<p>These already known restriction keys were updated to apply as well to the new distribution methods above:</p>\n<ul>\n<li>allowAppInstallation</li>\n<li>allowAppRemoval</li>\n<li>allowListedAppBundleIDs</li>\n<li>blockAppBundleIDs</li>\n</ul>\n<p><strong>The unexpected problem</strong></p>\n<p>What I mentioned during testing and deployment of the new settings as custom profiles via Microsoft Intune is that you have to be a little careful. This is because you can deploy this settings to all your devices and the profile reporting looks nice and clean. This <strong><em>is not</em></strong> working as you would expect on your devices. If you assign this configurations to iOS devices <strong><em>before 17.4</em></strong> (allowMarketplaceAppInstallation) or <strong><em>before 17.5</em></strong>  (allowWebDistributionAppInstallation) is installed the report shows a successful deployment but the restriction does not apply (does not show in the management profile locally) and is not re-applied after the OS update is installed.</p>\n<p>To overcome this (IMHO implementation flaw in iOS restrictions that is not taken in account by Intune) you can create to assignment filters that look like this.</p>\n<p><strong>Warning</strong>: You have to maintain them with upcoming iOS releases. I just added a few minor and patch versions in advance that may not be released ever to be prepared.</p>\n<p>Go to Intune admin center -&gt; Tenant administration -&gt; Filters and create two new filters for the Platform &lsquo;iOS/iPadOS&rsquo;. I used in this example rule syntax a combination of the &lsquo;device.enrollmentProfileName&rsquo; to target only supervised devices and a &lsquo;device.osVersion&rsquo; list of &lsquo;17.4 to 17.6.3&rsquo; and &lsquo;17.5 to 17.6.3&rsquo; respectively. Edit: You can after the 2408 Intune release use -ge, -gt, -le and -lt operators in preview. This simplifies the filters. I added the simplified filters below</p>\n<p><strong>Filter name: iOS 17.4+</strong></p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-txt\" data-lang=\"txt\">((device.enrollmentProfileName -eq &#34;YourEnrollmentProfileName&#34;) and\n(device.osVersion -in\n[&#34;17.4&#34;,&#34;17.4.1&#34;,&#34;17.4.2&#34;,&#34;17.4.3&#34;,&#34;17.5&#34;,&#34;17.5.1&#34;,&#34;17.5.2&#34;,&#34;17.5.3&#34;,&#34;17.6&#34;,&#34;17.6.1&#34;,&#34;17.6.2&#34;,&#34;17.6.3&#34;])\n</code></pre></div><p><strong>Filter name: Simplified iOS 17.4+</strong></p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-txt\" data-lang=\"txt\">((device.enrollmentProfileName -eq &#34;YourEnrollmentProfileName&#34;) and\n(device.osVersion -ge &#34;17.4&#34;)\n</code></pre></div><p><strong>Filter name: iOS 17.5+</strong></p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-txt\" data-lang=\"txt\">((device.enrollmentProfileName -eq &#34;YourEnrollmentProfileName&#34;)\nand (device.osVersion -in\n[&#34;17.5&#34;,&#34;17.5.1&#34;,&#34;17.5.2&#34;,&#34;17.5.3&#34;,&#34;17.6&#34;,&#34;17.6.1&#34;,&#34;17.6.2&#34;,&#34;17.6.3&#34;])\n</code></pre></div><p><strong>Filter name: Simplified iOS 17.5+</strong></p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-txt\" data-lang=\"txt\">((device.enrollmentProfileName -eq &#34;YourEnrollmentProfileName&#34;)and (device.osVersion -ge &#34;17.5&#34;)\n</code></pre></div><p>Now you can simply add this filters to the respective custom profiles and you will not see this unintended behavior.</p>\n<p>Edit: <a href=\"https://www.linkedin.com/in/martijnvanloenhout/\">Martijn van Loenhout</a> mentioned that allowMarketplaceAppInstallation is now (Service release 2403) already available as Setting Catalog configuration in Intune. You can use this for sure as well if you prefer this.</p>\n<p><a href=\"https://applefreakz.de/uploads/2024/applefreakz-allowmarketplaceappinstallation-false.mobileconfig\">applefreakz-allowmarketplaceappinstallation-false.mobileconfig</a>:</p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-xml\" data-lang=\"xml\"><span style=\"color:#75715e\">&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&gt;</span>\n<span style=\"color:#75715e\">&lt;!DOCTYPE plist PUBLIC &#34;-//Apple//DTD PLIST 1.0//EN&#34; &#34;http://www.apple.com/DTDs/PropertyList-1.0.dtd&#34;&gt;</span>\n<span style=\"color:#f92672\">&lt;plist</span> <span style=\"color:#a6e22e\">version=</span><span style=\"color:#e6db74\">&#34;1.0&#34;</span><span style=\"color:#f92672\">&gt;</span>\n<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadContent<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;array&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>Restrictions<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.applicationaccess.24BB5BE8-DCB8-4876-9F16-7C6D25CABF78<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.applicationaccess<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>24BB5BE8-DCB8-4876-9F16-7C6D25CABF78<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>allowMarketplaceAppInstallation<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;false/&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;/array&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDescription<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Block third-party app marketplaces<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>applefreakz_allowMarketplaceAppInstallation-FALSE<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>de.applefreakz.987A43C8-F8E8-4636-8C82-9FDAD46AB686<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadOrganization<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>applefreakz<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Configuration<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>CDC18090-077D-48BF-9621-86ECFAA3C327<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n<span style=\"color:#f92672\">&lt;/plist&gt;</span>\n</code></pre></div><p><a href=\"https://applefreakz.de/uploads/2024/applefreakz-allowwebdistributionappinstallation-false.mobileconfig\">applefreakz-allowwebdistributionappinstallation-false.mobileconfig</a></p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-xml\" data-lang=\"xml\"><span style=\"color:#75715e\">&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&gt;</span>\n<span style=\"color:#75715e\">&lt;!DOCTYPE plist PUBLIC &#34;-//Apple//DTD PLIST 1.0//EN&#34; &#34;http://www.apple.com/DTDs/PropertyList-1.0.dtd&#34;&gt;</span>\n<span style=\"color:#f92672\">&lt;plist</span> <span style=\"color:#a6e22e\">version=</span><span style=\"color:#e6db74\">&#34;1.0&#34;</span><span style=\"color:#f92672\">&gt;</span>\n<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadContent<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;array&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;dict&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>Restrictions<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.applicationaccess.BFB998BC-3E8B-4252-816E-A6795D302D34<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>com.apple.applicationaccess<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;string&gt;</span>BFB998BC-3E8B-4252-816E-A6795D302D34<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;key&gt;</span>allowWebDistributionAppInstallation<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t\t\t<span style=\"color:#f92672\">&lt;false/&gt;</span>\n\t\t<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n\t<span style=\"color:#f92672\">&lt;/array&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDescription<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Block app installation through Web Distribution<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadDisplayName<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>applefreakz_allowWebDistributionAppInstallation-FALSE<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadIdentifier<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>de.applefreakz.8AE1F450-602E-4156-B149-CE1E9CD0F469<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadOrganization<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>applefreakz<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadType<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>Configuration<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadUUID<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;string&gt;</span>E5A4DE5C-E468-40A9-B4C4-D2D2D063E3DE<span style=\"color:#f92672\">&lt;/string&gt;</span>\n\t<span style=\"color:#f92672\">&lt;key&gt;</span>PayloadVersion<span style=\"color:#f92672\">&lt;/key&gt;</span>\n\t<span style=\"color:#f92672\">&lt;integer&gt;</span>1<span style=\"color:#f92672\">&lt;/integer&gt;</span>\n<span style=\"color:#f92672\">&lt;/dict&gt;</span>\n<span style=\"color:#f92672\">&lt;/plist&gt;</span>\n</code></pre></div><p>In the management profile you will see two new restrictions like this:</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/ios-restrictions-marketplaceandwebdistribution.png\" width=\"325\" height=\"600\" alt=\"\">\n",
				
				"date_published": "2024-04-16T08:10:00+02:00",
				"url": "https://applefreakz.de/2024/04/16/blocking-ios-thirdparty.html",
				"tags": ["iOS"]
			},
			{
				"id": "http://csh.micro.blog/2024/02/21/issue-with-app.html",
				"title": "Issue with app re-installation on macOS devices managed by Intune",
				"content_html": "<p><strong>Fixed 😎</strong></p>\n<p>This issue was fixed with the release of IntuneMDMAgent version 2404.005. Please check <a href=\"\">here</a> for more information.</p>\n<p><strong>Understanding the problem</strong></p>\n<p>During extensive testing of Intune enrollments with macOS Sonoma beginning of January (<a href=\"https://www.applefreakz.de/troubleshooting-intune-macos-app-installation-issues-during-enrollments/\">find here why</a>), a colleague of mine mentioned an unexpected behaviour of machines installing applications on reboots. This seams interesting to investigate further.</p>\n<p>So I analysed this behaviour in some virtual machines and on the Macs of my colleagues.</p>\n<ol>\n<li>I figured out that the apps (PKG and DMG) in question where installed  before the reboot with the Intune installation intent &lsquo;required&rsquo;.</li>\n<li>This could be just a few hours ago on the speciific machine or can happen weeks after the inintial install.</li>\n<li>Before the reboot I was able to confirm that the applications are installed and should be detected by IntuneMDMAgent.</li>\n<li>Currently I can not reproduce this on every reboot in our setup but it happens a lot.</li>\n</ol>\n<p><strong>State of analysis</strong></p>\n<p>I was able to check if apps are successfully installed  by querying installed apps with the following command and output the result to a file before a reboot.</p>\n<p>Just use the following command via Terminal:</p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-bash\" data-lang=\"bash\">sudo /usr/libexec/mdmclient QueryInstalledApps &gt; installedApps.txt\n</code></pre></div><p>This will give you a verbose output of the detected app on the specific machine.</p>\n<p>On the affected machines I perfomed a shutdown and booted the machine some minutes later. Now, I checked the /Applications folder for required apps and &lsquo;Date modified&rsquo; changed to the current time before analysing the IntuneMDMDaemon.log file for suspicious activities.</p>\n<p>It looks like that the apps are installed, but the detection of already installed apps fails for no obvious reason.</p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-txt\" data-lang=\"txt\">2024-01-19 11:39:54:236 | IntuneMDM-Daemon | E | 5244 | AppDetection | Error in getting requirement for apps. Error: AppDetectionError.errorGettingBundleIDAsString, PolicyID: 3bc5b6c6-33dc-4ce2-80fa-9f8830b5d6c7, AppName: Microsoft OneDrive, BundleID: com.microsoft.OneDrive\n</code></pre></div><p><strong>Ticket at Microsoft</strong>\nI opened a ticket at Microsoft. End of last week Intune Product group confirmed this is reproducable and other customers also reported this behaviour. I will update the post if I get more information what is the root cause and a potential fix.</p>\n<p><strong>Update #1 - 2024-03-25 20:20 CET</strong>\nThere is some good news regarding this issue. I am currently testing an updated version of Sidecar Agent (IntuneMDMAgent) which fixed the detection. The detection is now very stable. Once the update is available I will share how you can verify that the new Agent is on your machines.</p>\n<p><strong>Update #2 - 2024-03-30 10:30 CET</strong>\nMicrosoft now released the Company Portal version (20240301). The Sidecar Agent version included in this release verified by checking the IntuneMDMAgent in &lsquo;/Library/Intune/IntuneMDMAgent.app&rsquo;.</p>\n<p><strong>Update #3 - 2024-04-09 20:45 CEST</strong></p>\n<h4 id=\"issue-fixed\">ISSUE FIXED!</h4>\n<p>Yesterday I received the most current version of  IntuneMDMAgent (2404.005) that fixed this issue in all my tests. I tried reproducing with multiple VMs and Macs the issue in the last two days. I was not able to get these machines with over 100 reboots or shutdowns to show the reported behavior. I closed the ticket now at Microsoft.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/intunemdmagent.png\" width=\"600\" height=\"499\" alt=\"\">\n<p>You can easily check the version of the Sidecar Agent in Terminal with the defaults read command. To get an overview of all Agent versions in a fleet, I will create a &lsquo;Custom Attribute&rsquo; in Intune. I created a little bash script:</p>\n<div class=\"highlight\"><pre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-bash\" data-lang=\"bash\"><span style=\"color:#75715e\">#!/bin/bash\n</span><span style=\"color:#75715e\"></span><span style=\"color:#75715e\">#Check Intune Agent (sidecar agent) version</span>\ndefaults read /Library/Intune/Microsoft<span style=\"color:#ae81ff\">\\ </span>Intune<span style=\"color:#ae81ff\">\\ </span>Agent.app/Contents/Info.plist CFBundleShortVersionString\n</code></pre></div><p>Now you can create a &lsquo;Custom Attribute&rsquo; in the Intune Admin center. Go to &lsquo;Devices -&gt; macOS -&gt; Custom attributes&rsquo; and click on the &lsquo;Add&rsquo; bottom.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/intune-macos-customattributes-add.png\" width=\"600\" height=\"208\" alt=\"\">\n<p>In the first screen &lsquo;Basic&rsquo; choose a name and add a description for your custom attribute and click &lsquo;Next&rsquo;.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/intune-macos-customattributes-basics.png\" width=\"600\" height=\"267\" alt=\"\">\n<p>On the next page &lsquo;Attribute settings&rsquo; choose &lsquo;Data type of attribute&rsquo; = String and upload the script I showed you above. Afterwards, you can finish the creation of the new custom attribute by adding scope tags in step 3, assign the attribute to all your machines or users as you like and lastly add it.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/intune-macos-customattributes-attributesettings.png\" width=\"600\" height=\"462\" alt=\"\">\n<p>Now you will always have a nice overview of all the machine&rsquo;s currently reported IntuneMDMAgent version in case you want to dig deeper.</p>\n",
				
				"date_published": "2024-02-21T13:13:00+02:00",
				"url": "https://applefreakz.de/2024/02/21/issue-with-app.html",
				"tags": ["macOS"]
			},
			{
				"id": "http://csh.micro.blog/2024/02/13/palo-alto-global.html",
				"title": "Palo Alto Global Protect (macOS) unable to connect via Personal Hotspot on T-Mobile Germany",
				"content_html": "<p>My colleagues recently discovered that users can not connect to Palo Alto Global Protect when using their Mac via Personal Hotspot. After some tests, we could nail it down that this only affects users that are using a Personal Hotspot via an iPhone on  mobile carrier T-Mobile Germany. Other SIMs by other carriers in the same iPhone worked just fine.</p>\n<p>We had some challenges before with T-Mobile Germany using IPv6-only as default in their cellular network with other software vendors.</p>\n<p>Today I found in the MacAdmin Slack a thread by others reporting the same <a href=\"https://macadmins.slack.com/archives/C5W0L8KUM/p1707764203845279\">issue</a>. I was reminded by <strong><em>colorenz</em></strong> in this thread that you still can use the old APN internet.telekom as a temporary workaround. <strong><em>Matthew G</em></strong> also provided some insides which point to DS-Lite/IPv4-over-IPv6 as root cause and that a fix is on its <a href=\"https://macadmins.slack.com/archives/C5W0L8KUM/p1707767607711809?thread_ts=1707764203.845279&amp;cid=C5W0L8KUM\">way</a>. Thanks again macadmins Slack community!</p>\n<p>I will try getting a confirmation and ETA from Palo Alto for that.</p>\n<p>If you wanna change APN settings this manually go to Settings - Cellular - Select the SIM you wanna modify - Cellular Data Network and change the second APN under Personal Hotspot to internet.telekom.</p>\n<img src=\"https://cdn.uploads.micro.blog/2797/2024/apn-settings.png\" width=\"306\" height=\"600\" alt=\"Screenshot of iPhone APN settings\">\n",
				
				"date_published": "2024-02-13T23:33:00+02:00",
				"url": "https://applefreakz.de/2024/02/13/palo-alto-global.html",
				"tags": ["macOS"]
			},
			{
				"id": "http://csh.micro.blog/2024/01/29/troubleshooting-intune-macos.html",
				"title": "Troubleshooting Intune macOS app installation issues during enrollments",
				"content_html": "<p><strong>Understanding the problem</strong></p>\n<p>I mentioned that during enrollments of Macs with macOS 14.x the installation for applications is stopping without any obvious reason.</p>\n<p><img src=\"https://media.giphy.com/media/rVSZrFGySmllC/giphy.gif\" alt=\"Confused\" title=\"Confused Gif\"></p>\n<p>I started analysing what could be the problem and found an interesting  workaround for this behavior. The apps in question include a variety of types supported by Intune:</p>\n<ul>\n<li>Volume Purchasing Program (VPP) apps: These are apps purchased in bulk from the App Store.</li>\n<li>DMG Installers: Standalone installations via diskimages for macOS.</li>\n<li>PKG Installers: Installation packages for  distributing software on macOS.</li>\n<li>Shell scripts: Used for specific installations, like the Company Portal.</li>\n</ul>\n<p>Intune, a Microsoft service used for device management, encounters a particular challenge with macOS: it does not prioritize or order app installations, nor does it handle dependencies. This lack of structured installation order can result in my experience to unpredictable and inconsistent app deployment.</p>\n<p><strong>Reproducing the issue</strong></p>\n<p>For example, I identified specific scenarios that halt the installation process:</p>\n<ol>\n<li>Network switching: Changing from an &lsquo;enrollment WiFi&rsquo; to a managed WiFi profile.</li>\n<li>System Extension Installations: Installing a PKG that includes a network system extension, especially when combined with allowing explicit system extension policies.</li>\n<li>VPN Connection: Initiating a VPN connection before the completion of all app installations.</li>\n</ol>\n<p>Each of these scenarios can disrupt the installation process, often seen during the device enrollment phase.</p>\n<p><strong>User experience</strong></p>\n<p>When these interruptions occur, app installations simply stop, leaving users without a clear resolution. This issue can be particularly challenging as it can happen at multiple stages:</p>\n<ol>\n<li>During a WiFi switch.</li>\n<li>While installing any network system extensions (in my tests in total three).</li>\n<li>At the initiation of a VPN connection.</li>\n</ol>\n<p>Unfortunately, even if Microsoft&rsquo;s Company Portal is installed, syncing the device doesn&rsquo;t rectify this issue. A device reboot can temporarily restart the installations, but they may halt again upon encountering the same interruptions.</p>\n<p><img src=\"https://media.giphy.com/media/3o7qDZEh8C6Tctgr8k/giphy-downsized.gif\" alt=\"Wait? What?!?!?\" title=\"Wait? What? Gif\"></p>\n<p><strong>Developing a workaround</strong></p>\n<p>Analyzing the IntuneMDMDaemon.log file revealed key insights. For instance, an error in the log for Microsoft Edge showed an issue with downloading the app binary file. This suggests that the IntuneMDMDaemon struggles to download the necessary packages, leading to halted installations without any retry mechanism.</p>\n<blockquote>\n<p>2024-01-25 07:10:01:920 | IntuneMDM-Daemon | I | 13242 | AppInstallManager+Logging | Error downloading app binary file. PolicyID: 37432470-3dcd-4835-ba9a-df66c4102601, AppName: Microsoft Edge, ExitCode: -2016214735, ErrorDetails: Cannot download app binary file.,ComplianceState: Error, EnforcementState: Error</p>\n</blockquote>\n<p><strong>The Script Solution</strong></p>\n<p>To circumvent this, I developed a shell script that:</p>\n<ul>\n<li>Checks the status of required apps.</li>\n<li>Restarts the IntuneMDMDaemon process if an app is found installed or</li>\n<li>if the initial VPN connection was successful.Currently, the script does not address WiFi changes, but this may be incorporated later if necessary.</li>\n</ul>\n<p><strong>Workaround Challenges</strong></p>\n<p>An interesting observation was that restarting the IntuneMDMDaemon inadvertently triggers the shell script again. To prevent repetitive executions, I incorporated a check to determine if the script had already been initiated but not all apps were installed.</p>\n<p><strong>Vendors involved</strong></p>\n<p>Currently I have an open ticket at the Microsoft Intune support as well as a sibling ticket at Apple Care Enterprise. Currently, the MS ticket is analysed and hopefully the root cause of this can be found. I will update the post with new information from both cases.</p>\n<p><strong>Update #1 - 2024-01-31 08:10 CET</strong></p>\n<p>Intune Product Group confirmed that the implementation of IntuneMDMDaemon/Sidecar in Company Portal for macOS is not handling the installation of systemextensions gracefully. They are now aware and working on a fix in an upcoming Company Portal for macOS release. I emphasised that it would be good to check the two other problems (WiFi change during downloads and connecting to a VPN during downloads) and address them as well in the upcoming update if possible.</p>\n<p><strong>Update #2 - 2024-02-05 07:20 CET</strong></p>\n<p>I published my workaround bash script on my <a href=\"https://github.com/cschildhorn/my-scripts/blob/main/applefreakz_kickstart_IntuneMDMDaemon.sh\">GitHub account</a>. Maybe you wanna check it out and I would be happy to get feedback if something can be done more elegant or if I did any major error in it.</p>\n<p><strong>Update #3 - 2024-04-09 22:10 CEST</strong></p>\n<p>Two days ago the IntuneMDMAgent version 2404.005 was released by Microsoft (more information how to check for the version <a href=\"https://applefreakz.de/2024/10/08/issue-with-app.html\">here</a>) This new version introduced a new mechanism of retrying app binary downloads. Currently, this has three attempts of downloading the binary. This significantly improved the enrollment flow and might work a lot better for some Intune macOS admins. This is a great achievment. Sadly, it does not fully solve my issue with the more than three interuption we face during our enrollents. I will create reproductions of my issue and report this to Microsoft.</p>\n",
				
				"date_published": "2024-01-29T15:27:00+02:00",
				"url": "https://applefreakz.de/2024/01/29/troubleshooting-intune-macos.html",
				"tags": ["macOS","iOS"]
			}
	]
}
