macOS Ventura & Blocking access to Users & Groups pane in System Settings

jamtay
New Contributor II

Hello Jamfnation,

Just wondering if anyone has had any luck with configuring the new settings for blocking access to preference panes in macOS Ventura? The old method is deprecated and produces some strange results if used: https://developer.apple.com/documentation/devicemanagement/systempreferences

One example being that blocking 'users and groups' also blocks 'screen sharing' in General > Sharing

Hopefully Jamf will be releasing a config profile setting soon?

1 ACCEPTED SOLUTION

karthikeyan_mac
Valued Contributor

As per Apple, "The SystemPreferences payload is deprecated, but existing keys and the new DisabledSystemSettings key will continue to disable corresponding panes in System Settings for macOS Ventura. A future version of macOS won't support this payload." You can refer "https://support.apple.com/en-in/HT213327" for more details.

You can try below Custom Payload for "com.apple.systempreferences" with DisabledSystemSettings key. (this works for now)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>DisabledSystemSettings</key>
    <array>
        <string>com.apple.Users-Groups-Settings.extension</string>
    </array>
</dict>
</plist>

 

Thanks.

View solution in original post

11 REPLIES 11

karthikeyan_mac
Valued Contributor

As per Apple, "The SystemPreferences payload is deprecated, but existing keys and the new DisabledSystemSettings key will continue to disable corresponding panes in System Settings for macOS Ventura. A future version of macOS won't support this payload." You can refer "https://support.apple.com/en-in/HT213327" for more details.

You can try below Custom Payload for "com.apple.systempreferences" with DisabledSystemSettings key. (this works for now)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>DisabledSystemSettings</key>
    <array>
        <string>com.apple.Users-Groups-Settings.extension</string>
    </array>
</dict>
</plist>

 

Thanks.

kindly share the same thing to block for profiles and lockdown mode through jamf configuration profile 

jamtay
New Contributor II

Fantastic, thank you

XuHao
New Contributor II

How do you prevent the configuration file from being deleted by the user? Is there a plist file for that?😀

shashank_varma
New Contributor II

(Printers & Scanners) Custom Payload for "com.apple.systempreferences" 

 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>DisabledSystemSettings</key>
    <array>
        <string>com.apple.Print-Scan-Settings.extension</string>
    </array>
</dict>
</plist>

 

 

I've checked the listed custom payloads, but "Privacy and security" and "profile" don't seem to be there.

macOS 13 introduces a new DisabledSystemSettings key for controlling macOS 13 and newer System Settings extensions. However, note that System Settings extensions within the Privacy & Security section cannot be disabled. If DisabledSystemSettings is not provided, the system will attempt to honor the EnabledPreferencePanes and DisabledPreferencePanes by mapping the old preference pane value to one or more new settings extension values whose content was wholly contained in the old preference pane value.

https://github.com/apple/device-management/blob/0340fd30e0bf820ded4797aa658a3ba8b6ab6c6e/mdm/profile... 

itinspectorio
New Contributor II

So we cant lock Privacy & Security? No way to do it? Sorry for stupid question.

No, we cannot disable Privacy & Security.

niacobelli
New Contributor III

I'm sorry for bringing this thread back. How do I go about deploying something like this?