Skip to main content

Is there a report in Jamf or EA/Script we can run to see how many/which apps were installed bypassing gatekeeper on advanced users?

In /var/log/DiagnosticsMessages/ you'll see some log files, the process syspolicyd is gatekeeper. You can probably build some EA from that.