"Login items added" in Ventura

[PhillyPhoto]

Please tell me we're going to be able to suppress these and a million notifications aren't the future for end users:

[Baravis]

Sweet, thanks @A-bomb!  Did you build that yourself?  Or is it available in the Appleseed Downloads or some other place?

[A-bomb]

I found it somewhere a long time ago. bill@talkingmoose.net built it. The credit is in the code. You can just copy the code above from the first { to the last }

[Baravis]

Oh I see it there.  Well thanks, Bill.  I did copy it, and it's working great, thanks a million. :)

How are you deploying your com.apple.servicemanagement profile?  I'm thinking I can just use Applications & Custom Settings -> Upload

[A-bomb]

I'm actually not using com.apple.servicemanagement at all. Just the one I posted.

[Baravis]

Ah, gotcha!  You’re not concerned that users will just unmanage themselves by turning off the Jamf launch agent?

[A-bomb]

We only have about 25 admins out of over 800 users so the possiblity is very small. I watch the hell out of them and tighten the rope when they get out of line, which doesn't happen often. We can lock a machine as a last resort for compliance which we have only done once in over two years.

[Baravis]

Oh cool.  Every org is just a bit different, hey?  Well, just wanted to check. :D  Thanks a ton for the content.

[jonw]

I just want to point out that a non-admin may still be able to disable certain LaunchAgents critical to management (at least in my testing), just be sure to test toggle all items in your environment if it's a concern to you.  

Also, thanks @A-bomb for your notification suppression config!  I've decided to double down and employ it along with our login & background item management profile.

[A-bomb]

Thanks for the heads up. I admit not testing every one but will today. Glad you are having success with the suppression. I have been considering both as well. 

[A-bomb]

Only Jamf Software (2 items) can be toggled off without admin. Thank God. I am going to work on whitelisting those as detailed on this thread. Thanks again.

[jonw]

No problem!  Yeah, going out on a limb here, you might not want a standard user willy nilly disabling anything Jamf haha! 😉  fwiw, a couple I ran into were from Outset, Munki, and Zoom.

[seido01]

@A-bomb - Do you know whether it's possible to disable these notifications by application path rather that bundle ID?

[A-bomb]

What I posted disables all of the new login and background items added notifications in Ventura. I don’t see the point of having those in our environment. What others have posted here is for specific login or background items. Application path is not recommended and never worked for us. Only using bundle ID did. It can be kind of a pain in the ass to get the bundle ID but once you get it and use it, you can forget about it.. 

[Baravis]

Agreed, Bundle IDs are a nuisance.  This is how I derive mine.  You can either derive it from the app's Info.plist, using the commands below (location may vary, but should be in the *.app contents):

/usr/libexec/PlistBuddy -c 'print CFBundleIdentifier' /Applications/<application>.app/Contents/Info.plist 

or, sometimes in the codesign output, where you can also find the TeamIdentifier:

codesign -dr - /path/to/Application.app

Example:

(Commands in green, BundleIDs in yellow, TeamIdentifiers in red)

[bcrockett]

I am still looking for a solid solution to this issue. 

The popups are consent on macOS13.2 

@A-bomb is your configuration profile working to stop these in your environment? 
I replicated it on my JAMF instance and the issues persist. 

[jbutler47]

@bcrockett  You now have two choices.  Either 1) create a mobile config and upload it to Jamf Pro, or 2) use the new Managed Login Items in Jamf Pro 10.43.1.

I have been using the uploaded mobile config method with no issues to date and will be testing the new payload soon. 

[scottb]

Same.  Report back on the Jamf solution if you test.  I will be soon, but we'll see which one is best for ongoing work...

[bcrockett]

@jbutler47 I got this working using the new Managed Login Items!

I will share a more detailed config soon for now I have a screenshot of my config page. 

[scottb]

Have not looked at it yet, but that looks great!  Thanks for posting it up.  Have to add some new items so good time to check it out.

[scottb]

This has worked since it was posted...still works.

Login Items Management

[bcrockett]

Thank you for sharing that! 

[scottb]

I actually posted waaaaaaay back the profile code i used based off of that page.

It works.  Check it out and see!

[A-bomb]

Yeah, we are still holding strong. Make sure you read all of the thread. There are a few pieces to it.
--
A-bomb

[FutureFacinLuke]

Thank you, this worked as I'd already added the custom Schema from here: https://www.alansiu.net/2021/01/13/managing-macos-notification-center-settings-using-a-jamf-profile/

[allanp81]

I was wondering the same, I don't think it does based on what the docs say.

[Baravis]

My current process order looks like this: 

Profile Creation

1. Create and install a Jamf self-signed certificate: https://docs.jamf.com/technical-articles/Creating_a_Signing_Certificate_Using_Jamf_[…]CA_to_Use_for_...
   1. Note: It's necessary to sign the configuration profile that you create because Jamf 10.41 does not yet have a a Policy item for com.apple.servicemanagement.  Uploading a signed configuration profile pushes out valid configuration items, but Jamf is basically just being used as a dumb push service at this point, because it can't interpret that item properly
2. Download and install iMazing Profile Editor
3. Upload sample configs into iMazing Profile Editor or craft your own using the Service Management - Managed Login Item
4. iMazing Profile Editor config profile creation
   1. adjust the "General" tab with your organizational details (note: these will be static, as you are uploading a signed profile into Jamf; ie: you will not be able to alter config profile details after upload, so each time you make a change to this profile you do it in iMazing, and upload the signed profile to Jamf)
      1. Identifier (you can derive a unique one by creating a new profile in iMazing, use that in this and subsequent versions of this profile)
      2. Profile Signing: select the self-signed cert you created in step 1
   2. Set up "Service Management - Managed login items" configured domain
   3. Rule type and rule value for a given app can be referenced in the AppleSeed for IT documents (downloads, background configuration items), and derived using terminal.  I recommend using LabelPrefix (if available) for com.objects (e.g. com.jamf or com.jamfsoftware) and TeamIdentifier:

codesign -dr - /path/to/Application.app

/usr/libexec/PlistBuddy -c 'print CFBundleIdentifier' /Applications/FortiClient.app/Contents/Info.plist​

5. Upload the configuration into Jamf

I'm scoping my configuration profile to all macOS Ventura machines.  If you scope to current machines it gets installed (if you were wanting to preload), however the profile won't reload its settings when the Ventura install completes and you won't see the benefits of the config.

Instead, consider installing the config between the time a device updates from macOS 11/12 to macOS 13, and when a user logs in.  To accomplish this, I created a policy that runs Inventory at startup on all devices.

[A-bomb]

This is great. Can you post your code here? I can't get this to work.

[Baravis]

You're looking for my launch agent enforcement code, specifically?  I think it's under NDA, but if you're on Slack I can send you a copy?

[A-bomb]

That would be sweet @A-bomb

[A-bomb]

Look at this beauty. Thanks again for your help @Baravis 

[auser]

Do you find that the notifications for these background items suppress also? 

[Baravis]

I do find that, yes.  Supposedly I should be seeing a “your organization is managing login items” pop-up, also, but I’ve yet to see that either.

[A-bomb]

I just did some testing on my MBA M1 running macOS 13 b11. Approving Login/Background Items does not suppress the notifications. Two separate Configuration Profiles are needed to achieve both. I was able to repeat this a few times too. I haven't seen “your organization is managing login items” either.

[Baravis]

I’ll have to recheck my Apple Silicon test unit then, thanks for the heads up!

[auser]

Hmmm. I thought that was how it functioned in the beginning. Maybe a bug in the beta. What are you deploying for the notifications? 

[Baravis]

At present, nothing.  Notifications haven’t been popping up in my tests with the login item enforcement configuration profile in place.  I have to double check my tests, but I’ve been seeing 0 notifications on my Intel device.

[A-bomb]

They weren't popping up but rather sitting in Notification Center. When I applied the allow profile we worked on yesterday they stayed in there but when I applied the notification mute I posted here they immediately disappeared.

[holger_netterby]

Hello @A-bomb , 
How did you manage to get "uninstall" and "install_monitor" disabled. I also have "bash",  "killall" and "Jamf Connect" showing as toggable. All scripts and applications with TeamID´s are disabled on my test-system but still have some unix-binaries showing as toggable. 

[holger_netterby]

I used "sudo sfltool dumpbtm" to find all the Labels and Executable path´s I needed to block

I found then issues of the non-blocked items. I missed some custom LaunchDaemons / Agents Labels

And I was able to shut down Jamf Connect as a standard user until I added a new Label with "com.jamf.connect" in the profile.

The same was done for "uninstall" and "install_monitor" so now my panel is locked for all items I need to lock.

[jkarpenske]

I'm sorry, I'm having a hard time understanding - can you clarify how you got "uninstall" and "install_monitor" locked?  Those are the last two that I've been having trouble with.  I can't seem to find a way to put them into a profile. Did you just use the path to them?  If so, is that considered a label, or something else?   (I'm using iMazing Profile Editor).  Thank you!