探花大神

Contact Us
Help Center Home > Apple > Grant Full Disk Access Permissions to the 探花大神 Agent for macOS

Grant Full Disk Access Permissions to the 探花大神 Agent for macOS

Starting with macOS Monterey, Apple has made a change that affects 探花大神 and 探花大神 IT Admins. Apple now restricts the /etc/pam.d/ directory on macOS Monterey and newer devices, and requires that any process that wants to edit the files in this directory have user consent, or consent supplied by their admin through an MDM profile.

The files in the /etc/pam.d/ directory control a part of the macOS authentication system called pluggable authentication modules. 探花大神鈥檚 login window mechanism is an example of a pluggable authentication module. The 探花大神 agent edits the authorization and screensaver settings files to use the 探花大神 authentication module, which allows your user passwords to be synced to the machine. 

Preparing for this Change

  • If you are using 探花大神鈥檚 MDM with your macOS Devices - 探花大神 now grants SystemPolicyAllFiles to our agent and supporting processes on the device as part of enrollment in the MDM, and you do not need to make any changes. This allows existing devices that are updated to Monterey to continue to check in.
  • If you are setting up 探花大神 using Device Enrollment or Automated Device Enrollment with another MDM (such as Jamf Pro's Prestage Enrollment method) and Zero-Touch Onboarding - You'll also need to update the enrollment configuration to have access. For instructions, see the procedure below. For more detail on 探花大神's MDM Prestage User Enrollment, see .
  • If you are using 探花大神 with another MDM, such as Jamf Pro, Kandji, Mosyle, or SimpleMDM - You will need to either manually grant the agent permissions, or download the  preconfigured profile for use with your MDM to grant the appropriate permissions to our software. See To grant permissions for a non-探花大神 MDM.
  • If none of your macOS devices are enrolled in MDM -  Starting with macOS Monterey, you will need to give the 探花大神 agent Full Disk Access permission to enable our agent to communicate with the authentication controls on the system. See To grant permissions for a device that is not enrolled in MDM.

Granting Permissions for a Non-探花大神 MDM

To grant permissions for a non-探花大神 MDM:

A custom profile is required for Steps 1-2 and is attached to this article.

  1. Download the profile file from this article. It's located on the right side of this page under In this Article.
  2. Follow the instructions for your MDM to install this custom profile.
  3. Alternatively, if you鈥檇 rather use a Privacy Preferences Policy Control policy directly inside your MDM, you can grant the required privileges for the jumpcloud-agent:
    1. Set the path for the policy to /opt/jc/bin/jumpcloud-agent.
    2. Set the privilege to SystemPolicySysAdminFiles or SystemPolicyAllFiles.
    3. Change the code requirements to:

鈥嬧�媔dentifier "jumpcloud-agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = N985MXSH85

  1. You鈥檒l need to grant the required privileges for the jumpcloud-agent updater:
    1. Set the path for the policy to /opt/jc/bin/jumpcloud-agent-updater.
    2. Set the privilege to SystemPolicySysAdminFiles or SystemPolicyAllFiles.
    3. Change the code requirements to:

identifier "jumpcloud-agent-updater-darwin" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = N985MXSH85