Has anyone tested creating the Configuration profile using JSS 9.96 for MacOS Sierra to disable the "External Disk"? I have try installing the profile manually and via MDM with this disable however the USB still shows up. The same profile works on OS X 10.11 for both vanilla and our base build with out issues. I have tried recreating Configuration profile as well via Casper, same effect. Anyone else seen this?
I have tried this on a Sierra vanilla machine as well. Not sure if its a bug or not, Any thoughts?
what about making it read only and/or require authentication. I am looking to upgrade to 9.96 next month, but I already have a feature request to enable FileVault2 on an external disk. It'll be ashamed if I couldn't at least have a different option until the Feature Request is possibly implemented.
We too face this issue and as a workaround we use a rather drastic approach.
We've now setup a policy to unload the actual driver upon Startup and Check-in..
kextunload -b com.apple.iokit.IOUSBMassStorageDriver
kextunload -b com.apple.driver.AppleSDXC
Hope this helps anyone in need to disallow external storage on Sierra..
Good Suggestion, I created a Extension Attribute and a smart group to query those workstations that have it loaded (Below)to go along with your suggestion (Also created two policies), however this is still a kludgy way of doing it. This configuration profile setting needs to be fixed. Another way of doing this is during imaging time (Netboot if you use that) is to unload and move the Kext file out of the Extension folder
#!/bin/sh # Extension Attributes Name: USB Mass Storage # Version: v1 # Compiled: 10/10/2016 # Design For: MacOS 10.12 # Created By: Dan gsusbmassstorage=`sudo kextstat |grep com.apple.iokit.IOUSBMassStorageDriver` if [[ $gsusbmassstorage == "" ]]; then echo "<result>Unloaded</result>" else echo "<result>Loaded</result>" fi
To update, I filed a bug report with Apple (28495915) regarding this issue back in September 2016. Apple just got back to me and said this is resolved in MacOS 10.12.4 Beta patch. Here is their reply.....
"Apple Developer Relations26-Jan-2017 09:51 AM
We believe this issue has been resolved in the latest macOS 10.12.4 beta.
Please test with the latest beta. If you still have issues, please update your bug report with any relevant logs or information that could help us investigate.
I haven't tried the 10.12.4 beta yet, but it seems they fixed it. Jamf has also flag this as a issue - [D-009110] Configuration profiles with the Internal Disks: Allow option disabled do not prevent the use of memory cards.