macOS Ventura & Blocking access to Users & Groups pane in System Settings

[jamtay]

Hello Jamfnation,

Just wondering if anyone has had any luck with configuring the new settings for blocking access to preference panes in macOS Ventura? The old method is deprecated and produces some strange results if used: https://developer.apple.com/documentation/devicemanagement/systempreferences

One example being that blocking 'users and groups' also blocks 'screen sharing' in General > Sharing

Hopefully Jamf will be releasing a config profile setting soon?

[karthikeyan_mac · Accepted solution]

As per Apple, "The SystemPreferences payload is deprecated, but existing keys and the new DisabledSystemSettings key will continue to disable corresponding panes in System Settings for macOS Ventura. A future version of macOS won't support this payload." You can refer "https://support.apple.com/en-in/HT213327" for more details.

You can try below Custom Payload for "com.apple.systempreferences" with DisabledSystemSettings key. (this works for now)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>DisabledSystemSettings</key>
    <array>
        <string>com.apple.Users-Groups-Settings.extension</string>
    </array>
</dict>
</plist>

Thanks.

[shashank_varma]

kindly share the same thing to block for profiles and lockdown mode through jamf configuration profile 

[jamtay]

Fantastic, thank you

[XuHao]

How do you prevent the configuration file from being deleted by the user? Is there a plist file for that?😀

[shashank_varma]

(Printers & Scanners) Custom Payload for "com.apple.systempreferences" 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>DisabledSystemSettings</key>
    <array>
        <string>com.apple.Print-Scan-Settings.extension</string>
    </array>
</dict>
</plist>

[shashank_varma]

 FYR https://community.jamf.com/t5/jamf-pro/macos-ventura-amp-blocking-system-preferences-system-settings...

[XuHao]

I've checked the listed custom payloads, but "Privacy and security" and "profile" don't seem to be there.

[hüseyinusta]

macOS 13 introduces a new DisabledSystemSettings key for controlling macOS 13 and newer System Settings extensions. However, note that System Settings extensions within the Privacy & Security section cannot be disabled. If DisabledSystemSettings is not provided, the system will attempt to honor the EnabledPreferencePanes and DisabledPreferencePanes by mapping the old preference pane value to one or more new settings extension values whose content was wholly contained in the old preference pane value.

https://github.com/apple/device-management/blob/0340fd30e0bf820ded4797aa658a3ba8b6ab6c6e/mdm/profile... 

[itinspectorio]

So we cant lock Privacy & Security? No way to do it? Sorry for stupid question.

[karthikeyan_mac]

No, we cannot disable Privacy & Security.

[niacobelli]

I'm sorry for bringing this thread back. How do I go about deploying something like this?