The Good, the Bad, the ugly of local admin management

JNUC Video Posted on Youtube

Additional Resources:

• Bill Smith Tech Thoughts: https://community.jamf.com/t5/tech-thoughts/how-to-securely-manage-local-admin-passwords-with-jamf-pro-and/ba-p/289969
• Tom Koehler Tech Thoughts: https://community.jamf.com/t5/tech-thoughts/laps-enhancements-and-changes-to-the-uie-management-account/ba-p/297191
• 10.48 deprecation notice: https://learn.jamf.com/bundle/jamf-pro-release-notes-10.48.0/page/Deprecations_and_Removals.html
• https://support.apple.com/guide/deployment/dep24dbdcf9e/

Apps

• Jamf LAPS

"Jamf Pro 10.45 introduced a new "Local Administrator Password Solution" (LAPS) API endpoint. LAPS helps admins avoid the practice of creating a single static admin account password on their managed devices."

The PRK [Option + Shift + Return]

On a Mac with Apple silicon using macOS 12.0. 1 or later, press Option-Shift-Return to reveal the entry field for the PRK, then press Return (or click the arrow). macOS starts up. There is only one PRK per encrypted volume, and during FileVault enablement from MDM, it can optionally be hidden from the user.

Manage FileVault with mobile device management

The Flow