Immediate Shutdown Mass action MacOS...?

[kbreed27]

My org's NetSec guy wants to do a "Mock Ransomware drill" and wants to have a way to shtudown all of our Mac/Apple Computers/Devices ASAP through Jamf. I know you can initiate a shutdown of Mobile Devices as a mass action command, but it doesn't appear that the same functionality exists for MacOS Computers.  

Does anyone have any ideas on the best way to achieve this? I know a policy could be created to force a shutdown, but is there a way to force all computers to check-in for policies immediately? 

I've experimented with the Lock Device MDM command, it does restart the computer into a locked mode but it appears to still have network functionality. I'm guessing if we're trying to stop the malware from spreading across our network that isn't going to do much? 

[sdagley]

@kbreed27 If you have FileVault enabled (and unless you have multiple users sharing a Mac you probably want FV turned on) when a Mac is in the Locked state there isn't any network connectivity.

[kbreed27]

Ah shoot, we don't utilize FV because we're still binding to AD.

It's Something that I'd like to get away from eventually, but  I Haven't spent a ton of time looking at how to get Mac's talking to our on-prem AD without binding.... 

Do you know if the Lock Screen on Mac (FV-enabled) halts background OS processes as well or is does it simply lock the end-user out of getting into the OS?

[sdagley]

@kbreed27 Are you binding to AD for mobile accounts or for something else?

[kbreed27]

Mobile accounts that login to the computers, yes. 

[sdagley]

That is unfortunate. Used to have to do that in an edu enviroment with multiple users per Mac so much happier now with a corp environment with one user per Mac where we use Kerberos SSO to sync the user's account with our on-prem AD system and have ditched binding.

[kbreed27]

Yep, K-12 EDU environment here.... The majority of our macs are actually given to teachers and are one-to-one devices. We do have a few labs but most of our kids use Chromebooks.

I'm interested in looking into the Kerberos SSO extension for our teacher Macbooks, but my eyes glaze over reading the materials. It's a few steps ahead of my base knowledge at this point. 

[sdagley]

HCS Technology Group created a very extensive guide for the Kerberos SSO extension when it was introduced in macOS Catalina: https://hcsonline.com/support/white-papers/a-guide-for-configuring-the-macos-catalina-kerberos-singl...

It's a bit out of date now (no need to manually create the configuration .plist because Jamf Pro now has a GUI for configuring KSSO) but it's a great overview.

And BTW, while the CrowdStrike capability to isolate network connectivity for a compromised Mac is probably your best approach it is possible to use a Configuration Profile to trigger a Mac to run  policy immediately. For details see the posts by @mm2270 in this thread: https://community.jamf.com/t5/jamf-pro/how-to-run-a-policy-job-immediately-instead-of-a-trigger/m-p/...

[kbreed27]

Ah great! Thank you so much for the information, I will look into these things. 

I see you all of these forums and your posts are always so helpful. @AJPinto as well. 

[AJPinto]

Honestly, its not that hard to setup. Apples documentation is just horrible. The only real prerequisite is you need to know your realm, which is likely the suffix at the end of your FQDNs and your domain. For example, hostname.ucla.edu and the domain is campus would be CAMPUS.UCLA.EDU (likely, not always). The rest of the configuration profile is setup to your preferences.

Note, the Kerberos SSO extension does not provide on demand account creation like domain binding does. However, the Platform SSO extension does which is setup similarly. 

[kbreed27]

Does Platform SSO require a cloud IDP like AAD? 

[AJPinto]

It's in its very early staged of adoption, but yes. Some of those IDPs like Okta are charging extra for the use of Platform SSO.

Similar pricing to JAMF Connect, which is great until you learn you need a license for every user on that tenant and not just a license for every mac user.

[kbreed27]

---

Note, the Kerberos SSO extension does not provide on demand account creation like domain binding does. However, the Platform SSO extension does which is setup similarly. 

---

I'm trying to wrap my head around what you mean here. Are you saying that new accounts on a machine have to walk through setup assistant to create and can't just be handled by logging in at the login screen?

We have a login screen config profile that forces all computers to a login screen with only username/password fields and a script that runs at enrollment binds the machine to our on-prem AD. I'm guessing the SSO extension wouldn't work in this sort of setup? 

Have you tried deploying the SSO extension to machines that already have Roaming Profiles , or is going to Kereberos SSO profile something you have to switch over for new enrollments? 

[AJPinto]

When you bind a Mac to the domain, the log in screen will call the domain controller to validate the user account and logs the user in building their account if necessary. Honestly, from the domain binding experience this is about all that really works. 

If you are logged in using a Mobile Account, the Kerberos SSO Extension will still install but it won't do anything.

https://hcsonline.com/support/white-papers/a-guide-for-configuring-the-macos-catalina-kerberos-singl...

https://www.apple.com/za/business/docs/site/Kerberos_Single_Sign_on_Extension_User_Guide.pdf

The Kerberos SSO Extension has no way to build users accounts on a Mac. It relies on the account to be built some other way like macOS Setup Assistant, or manual account creation (GUI, CLI or tools like JAMF Policy which is CLI under the hood). Once the user logs in to macOS with that account, they log in to the SSO Extension. The SSO Extension then prompts them to sync passwords and will update the local account PW to match the network password and generate Kerberos tickets. However, the Kerberos SSO Extension does not care what the user name is.

Apples Platform SSO does support on demand account creation, which was a massive oversight with Kerberos SSO Extension.

[AJPinto]

You would have to do this with a policy. I don't think Apple has a shutdown MDM Command for macOS like they do for iOS. Setting the policy trigger to recurring check-in would cause the policy to hit as devices check in. Using sudo shutdown -h now would shut down the devices.

I would not use the device lock command for a test as the users need a pin to unlock the device to turn it back on, but that would accomplish your ask. If we are looking at nuclear options also, a device wipe command would also hit in about 5-10 seconds. Providing you don't need forensics off the device, a remote wipe would be a better option for a fire drill.

MacOS should be isolated by a Security Client in the event of a breach, just like Windows. Do you guys have security tools that can network isolate the Macs?

[kbreed27]

Yes, we do use CrowdStrike. 

It seems like Shutting down switches or network containing clients is going to be the better move than trying to shut everything down through MDM, but I am far from an expert and less experienced than our NetSec guy.

He's pushing to have the solution of stopping the slow of Ransomware to be through MDM shutdowns. It seems off to me but I'm still kinda new to this. 

[AJPinto]

@mschlosser has a good point, you dont really want to reboot a compromised device as you may not be able to get back in to it.

CloudStrike Falcon supports network isolation. Basically, if a device is compromised, the security agent isolates the device on the network, whatever network it happens to be on for remote users. Unlike JAMF which works on check-in's, your security agents are usually constantly connected and can act much faster.

[sdagley]

The Device Lock MDM command allows sending a message to be displayed to the user on the lock screen. For users who aren't responsive to email notifications that their Mac requires a restart for something sending a Lock command with a message why their Mac was locked and the PIN code to unlock is not an uncommon use of the command. 

[mschlosser]

AJPinto's method to shutdown the macs would be the most straightforward way in my opinion. That said, I'd be more of an advocate of cutting off the Macs network access whether that be by pulling the cord or at the wifi controller level; I wouldn't turn the device off because sometimes ransomware is written poorly and decryption keys can often be found in memory or tmp folders. Power the device off and those may be lost forever.