+7Trying to set up a config profile for this new feature set. I have used Jamf's example and Apple's example as starting points, but the radio buttons for the items I have set to be managed are still able to be turned off and do not say they are managed like the Jamf apps are.
Has anyone else had success in getting a config profile to work for this yet?
Best answer by Jason33
Use iMazing Profile Editor and this guide
https://hammen.medium.com/managing-login-items-for-macos-ventura-e78d627f88b6
+13Use iMazing Profile Editor and this guide
https://hammen.medium.com/managing-login-items-for-macos-ventura-e78d627f88b6
+18Service Management - Managed Login Items in iMazing Profile Editor will help to create the profile.
"sudo sfltool dumpbtm" will list all the login items and details to add it in the profile.
Thanks
+10Here's what I got to finally work. Save the below as a .mobileconfig file, and then upload it to Jamf after updating your org name. You'll have to generate new PayloadUUID's with uuidgen in terminal if you use this as a template for other applications.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Service Management - Managed Login Items</string>
<key>PayloadIdentifier</key>
<string>com.apple.servicemanagement.1ED2CC51-41E0-49EB-A8D1-E6B5C3A283CC</string>
<key>PayloadType</key>
<string>com.apple.servicemanagement</string>
<key>PayloadUUID</key>
<string>1ED2CC51-41E0-49EB-A8D1-E6B5C3A283CC</string>
<key>PayloadVersion</key>
<array>
<dict>
<key>Comment</key>
<string>Zoom</string>
<key>RuleType</key>
<string>Label</string>
<key>RuleValue</key>
<string>us.zoom.ZoomDaemon</string>
</dict>
</array>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Zoom - Managed Background and Login Items</string>
<key>PayloadIdentifier</key>
<string>YOURORGHERE.87731DFF-DE49-482B-958F-0623F514D2AF</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>87731DFF-DE49-482B-958F-0623F514D2AF</string>
</dict>
</plist>
+7I had never tried iMazing before, thank you both that suggested it! Holy crap this is going to make things easier
+6Here's what I got to finally work. Save the below as a .mobileconfig file, and then upload it to Jamf after updating your org name. You'll have to generate new PayloadUUID's with uuidgen in terminal if you use this as a template for other applications.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Service Management - Managed Login Items</string>
<key>PayloadIdentifier</key>
<string>com.apple.servicemanagement.1ED2CC51-41E0-49EB-A8D1-E6B5C3A283CC</string>
<key>PayloadType</key>
<string>com.apple.servicemanagement</string>
<key>PayloadUUID</key>
<string>1ED2CC51-41E0-49EB-A8D1-E6B5C3A283CC</string>
<key>PayloadVersion</key>
<array>
<dict>
<key>Comment</key>
<string>Zoom</string>
<key>RuleType</key>
<string>Label</string>
<key>RuleValue</key>
<string>us.zoom.ZoomDaemon</string>
</dict>
</array>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Zoom - Managed Background and Login Items</string>
<key>PayloadIdentifier</key>
<string>YOURORGHERE.87731DFF-DE49-482B-958F-0623F514D2AF</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>87731DFF-DE49-482B-958F-0623F514D2AF</string>
</dict>
</plist>
Thanks! What is the Preference Domain assignment in this zoom example?
+7Thanks! What is the Preference Domain assignment in this zoom example?
For "Managed Login Items" the preference domain is always
com.apple.servicemanagement
+6Can't get this to work. I tried the profile created by naschenbrenner above. I changed the UUID codes and uploaded it to Jamf. It pushes out to the workstation, and the profile installs. However the toggles in LoginItems can be still changed. The computer I am testing with is Ventura 13.0.1. It was upgraded from the Beta... so maybe something is not working right? I also tried to add the team id, and the LabelPrefix:
<dict>
<key>RuleType</key>
<string>TeamIdentifier</string>
<key>RuleValue</key>
<string>BJ4HAAB9B3</string>
</dict>
<dict>
<key>RuleType</key>
<string>LabelPrefix</string>
<key>RuleValue</key>
<string>us.zoom</string>
</dict>I will try to re-install the computer with Ventura 13.0.1 from scratch to see if this fixes the issue...
+9Can't get this to work. I tried the profile created by naschenbrenner above. I changed the UUID codes and uploaded it to Jamf. It pushes out to the workstation, and the profile installs. However the toggles in LoginItems can be still changed. The computer I am testing with is Ventura 13.0.1. It was upgraded from the Beta... so maybe something is not working right? I also tried to add the team id, and the LabelPrefix:
<dict>
<key>RuleType</key>
<string>TeamIdentifier</string>
<key>RuleValue</key>
<string>BJ4HAAB9B3</string>
</dict>
<dict>
<key>RuleType</key>
<string>LabelPrefix</string>
<key>RuleValue</key>
<string>us.zoom</string>
</dict>I will try to re-install the computer with Ventura 13.0.1 from scratch to see if this fixes the issue...
Hello,
Use the accepted solution mentioned above. It works really well and is very easy to create. I was quite impressed with it.
+7Use iMazing Profile Editor and this guide
https://hammen.medium.com/managing-login-items-for-macos-ventura-e78d627f88b6
That article worked very well for me... except the last point, #18. On my test computer where I upgrade from macOS 12 to macOS 13, the "Managed Login Items - Jamf Apps" is pushed immediately, but not my custom defined "Managed Login Items". Mine gets pushed only after the computer checks-in, and I scoped it out as per the article #18 (Smart Group with a Profile Identifier of com.jamf.servicemanagement.backgroundapps).
I do have some users who would go look at what they can disable immediately after the upgrade, so I'm concerned about that. Any suggestions?
+18Here is the Profile info from using Robert Hammen's info. Used iMazing Profile Editor to build it and then upload it. Works great...no more notifications. Just scoped to enrollment for Smart Group "macOS 13."
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>NotificationSettings</key>
<array>
<dict>
<key>BundleIdentifier</key>
<string>com.apple.BTMNotificationAgent</string>
<key>NotificationsEnabled</key>
<false/>
</dict>
</array>
<key>PayloadIdentifier</key>
<string>com.apple.notificationsettings.12c05d0d-6231-4621-9ac6-a781a626951b</string>
<key>PayloadType</key>
<string>com.apple.notificationsettings</string>
<key>PayloadUUID</key>
<string>12c05d0d-6231-4621-9ac6-a781a626951b</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDescription</key>
<string>Disable Background Task Management Notifications</string>
<key>PayloadDisplayName</key>
<string>Disable Background Task Management Notifications</string>
<key>PayloadIdentifier</key>
<string>com.apple.notificationsettings.5ea4543d-f0fe-4f19-9e5f-7fab2051b712</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>5ea4543d-f0fe-4f19-9e5f-7fab2051b712</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
+9@scottb Thanks for sharing your solution Scott. A general question regarding your solution and Robert Hammen. Once we deploy the Disable Notifications to our fleet will it block ALL Notifications from any software or just the titles related to the Managed Logins?
I already have notifications disabled for Qualys, Forescout, FireEye etc. So wondering if I need to make more changes.
Thanks
+18@scottb Thanks for sharing your solution Scott. A general question regarding your solution and Robert Hammen. Once we deploy the Disable Notifications to our fleet will it block ALL Notifications from any software or just the titles related to the Managed Logins?
I already have notifications disabled for Qualys, Forescout, FireEye etc. So wondering if I need to make more changes.
Thanks
@pueo - did you block Notifications or did you lock down those with Agents/Daemons (login)?
The one above will silence 'em all, and you don't (AFAIK) have to alter it. The one I made to lockdown the Login items I need to update as I add new Team Identifiers to the list. The profile above will stop you from being told about new Login Items being added...
Similar, but different items...
+9For the apps I mentioned I used Notification and the specific Bundle ID to block them.
You say the one above will silence them all. Is that ALL notifications for ALL Apps or just New Login Items as mentioned in the last line. It was not clear to me.
+9Login Item management is not built into the latest Jamf Pro version? We should continue to use Robert Hammen's solution?
+13To block the "Managed Login Items Added" notification, use this simple procedure:
+13Another way to block the "Managed Login Items Added" notification is to:
+9I'm trying to grey out elastic-agent in the login items in Ventura but it still doesn't work!
after running this command "sudo sfltool dumpbtm" I got this about Elastic agent :
#15:
UUID: F8A306A3-45BB-4B2B-A1CE-DD5824BB6D7A
Name: elastic-agent
Developer Name: (null)
Type: legacy daemon (0x10010)
Disposition: [enabled, allowed, visible, notified] (11)
Identifier: co.elastic.elastic-agent
URL: file:///Library/LaunchDaemons/co.elastic.elastic-agent.plist
Executable Path: /usr/local/bin/elastic-agent
Generation: 1
Parent Identifier: Unknown Developer
I built a profile like this one below but it still doesn't work ! any tips please?
Another way to block the "Managed Login Items Added" notification is to:
This works great for turning it off for all apps. What if I want to do if for one? Our security wants us to install the Rapid7 agent and I can't figure out how to do this just for that. Can you help?
Thanks!
+7I'm trying to grey out elastic-agent in the login items in Ventura but it still doesn't work!
after running this command "sudo sfltool dumpbtm" I got this about Elastic agent :
#15:
UUID: F8A306A3-45BB-4B2B-A1CE-DD5824BB6D7A
Name: elastic-agent
Developer Name: (null)
Type: legacy daemon (0x10010)
Disposition: [enabled, allowed, visible, notified] (11)
Identifier: co.elastic.elastic-agent
URL: file:///Library/LaunchDaemons/co.elastic.elastic-agent.plist
Executable Path: /usr/local/bin/elastic-agent
Generation: 1
Parent Identifier: Unknown Developer
I built a profile like this one below but it still doesn't work ! any tips please?
Change the "Rule Type" from "BundleIdentifier" to "Label" and use the name of the plist without suffix ("co.elastic.elastic-agent") as the "Rule Value".
+1This works great for turning it off for all apps. What if I want to do if for one? Our security wants us to install the Rapid7 agent and I can't figure out how to do this just for that. Can you help?
Thanks!
You can still allow notifications per app, this just turns off the notification that a background item was added.
+9Actually it worked by choosing LabelPrefix as the rule type and the value is co.elastic
+14Looks like Managed Login Items is a section in Jamf Pro in the built in Configuration Profiles section
+1Looks like Managed Login Items is a section in Jamf Pro in the built in Configuration Profiles section
That's correct if you're using Jamf 10.42+
Prior to 10.42 you won't have that section available and will have to create your own config profile per the discussions in this thread.
+18@bootrec We had the same problem and ended up using a startup policy with a script to update inventory if the macOS is Ventura and scope the profiles to macOS Ventura smart group.
Thanks.
#!/bin/bash
#
# Run recon if the Mac is running macOS Ventura.
#
IFS='.' read osvers_major osvers_minor osvers_dot_version <<< "$(/usr/bin/sw_vers -productVersion)"
if [[ ${osvers_major} -eq 13 ]]; then
echo "macOS Ventura $osvers_major.$osvers_minor.$osvers_dot_version"
jamf recon
else
echo "Device not running macOS Ventura. Inventory update not required at startup"
fi
+13I created the below, but I'm still getting the background notification message.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.