Skip to main content
Solved

Restrict user from changing computer name in Ventura


Mark-Kenny
Forum|alt.badge.img+5

Our config profile for blocking sharing works fine on macOS 12, but 13 you can edit the computer name in General / About just by clicking on name, Restricting the General prefs is not blocking About, but all other General settings.

What have I missed?

Best answer by Mark-Kenny

Sussed it. 

com.apple.loginwindow : Set Mac computer name to computer record name FALSE

And com.apple.systempreferences : 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>DisabledSystemSettings</key>
<array>
<string>com.apple.Sharing-Settings.extension</string>
</array>
</dict>
</plist>

View original
Did this topic help you find an answer to your question?

25 replies

sdagley
Forum|alt.badge.img+25
  • Jamf Heroes
  • 3540 replies
  • March 14, 2023

@Mark-Kenny have you considered enforcing your Mac naming convention via policy? For my org the daily recon policy  includes a script payload that verifies the Mac name matches the org standard and changes it if it doesn't. 


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • March 14, 2023
sdagley wrote:

@Mark-Kenny have you considered enforcing your Mac naming convention via policy? For my org the daily recon policy  includes a script payload that verifies the Mac name matches the org standard and changes it if it doesn't. 


Two environments, one has the policy and is good, the other doesn't. 


RobinJJ
Forum|alt.badge.img+4
  • Contributor
  • 14 replies
  • March 14, 2023

I actually change it on check-in. The only policy that runs every 15min 🙊


dmccluskey
Forum|alt.badge.img+8
  • Valued Contributor
  • 88 replies
  • March 14, 2023

Restrict the Sharing area of system settings

This prevents users from going in and changing it.


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • March 14, 2023
dmccluskey wrote:

Restrict the Sharing area of system settings

This prevents users from going in and changing it.


Doesn't work in Ventura as the name can be changed under General / About :-( 

Already have the CP in place for macOS 12, issue is 13.


dmccluskey
Forum|alt.badge.img+8
  • Valued Contributor
  • 88 replies
  • March 14, 2023

I cant for my macs

its greyed out.

maybe because its standard user vs admin.

 

 


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • Answer
  • March 16, 2023

Sussed it. 

com.apple.loginwindow : Set Mac computer name to computer record name FALSE

And com.apple.systempreferences : 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>DisabledSystemSettings</key>
<array>
<string>com.apple.Sharing-Settings.extension</string>
</array>
</dict>
</plist>


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • April 21, 2023

@Mark-Kenny How to set the first part of your solution?

com.apple.loginwindow : Set Mac computer name to computer record name FALSE


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • April 21, 2023

 

 


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • April 21, 2023

Two payloads in the config profile as show above block changing computer name.


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • June 9, 2023

For us the issue was solved with the config profile starting with ventura 13.3.1 (a) version


Forum|alt.badge.img+1
  • New Contributor
  • 2 replies
  • July 4, 2023
Mark-Kenny wrote:

Sussed it. 

com.apple.loginwindow : Set Mac computer name to computer record name FALSE

And com.apple.systempreferences : 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>DisabledSystemSettings</key>
<array>
<string>com.apple.Sharing-Settings.extension</string>
</array>
</dict>
</plist>


May I know where to put the Plist? Appreciates 


Mark-Kenny
Forum|alt.badge.img+5
  • Author
  • New Contributor
  • 6 replies
  • July 4, 2023
danielli wrote:

May I know where to put the Plist? Appreciates 


Config profiles, custom settings.

com.apple.systempreferences

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisabledSystemSettings</key> <array> <string>com.apple.Sharing-Settings.extension</string> </array> </dict> </plist>

 

com.apple.loginwindow

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>UseComputerNameForComputerRecordName</key> <false/> </dict> </plist>


Forum|alt.badge.img+1
  • New Contributor
  • 2 replies
  • July 4, 2023
Mark-Kenny wrote:

Config profiles, custom settings.

com.apple.systempreferences

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisabledSystemSettings</key> <array> <string>com.apple.Sharing-Settings.extension</string> </array> </dict> </plist>

 

com.apple.loginwindow

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>UseComputerNameForComputerRecordName</key> <false/> </dict> </plist>


Thanks alot


Forum|alt.badge.img+1
  • New Contributor
  • 7 replies
  • August 23, 2023

Does not working for me.
I add both in one profile, I can still change the computername in the settings.
Regarding the apple documentation it is deprecated

https://developer.apple.com/documentation/devicemanagement/systempreferences

??


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • August 23, 2023

We are now on the latest os version and since two weeks we do not need this additional profile anymore.

We had also issues with the restricted apple id pane causing by this workaround.

So we just removed the workaround for the computername (Its configured like before in the configuration profile and it works like before).

We created the restriction Configuration profile new for everything we had before.

We removed the previous cp

we scoped the new cp

Everything works like it should

From my side i saw in tests, that after working with this profiles and workarounds its to restart your macbook after the test. At least to completely quit system preferences.

Hopefully this stays like it is :)


Forum|alt.badge.img+1
  • New Contributor
  • 7 replies
  • August 23, 2023

I did. so I restarted the device. but i still can change. as standard user.


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • August 23, 2023

which version MacOS do you have installed? 

And do you have an Configuration Profile for restricting Computername (not the workaround)


Forum|alt.badge.img+1
  • New Contributor
  • 7 replies
  • August 23, 2023

latest release so 13.5.1

Did it directly in Jamf and copied paste the plist content. Into ONE profile. (that should not be reason, should it?)

 


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • August 23, 2023

i had it like from Kenny described. It was in one cp but two different preference domain. That has worked fine


Forum|alt.badge.img+1
  • New Contributor
  • 7 replies
  • August 23, 2023

Not working.


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • August 23, 2023

But, i just checked once again now, and it seems that without the workaround it doesn't work anymore... haha...

So changing computername on the machine is possible, but only with adminrights. This was not possible before. It was greyed out


Forum|alt.badge.img+1
  • New Contributor
  • 7 replies
  • August 23, 2023
Jacek_ADC wrote:

But, i just checked once again now, and it seems that without the workaround it doesn't work anymore... haha...

So changing computername on the machine is possible, but only with adminrights. This was not possible before. It was greyed out


I am not admin, but I can change. usually my clients are not admin, so that would be fine for me, but anyway even as standard i can change the computer name


Jacek_ADC
Forum|alt.badge.img+7
  • Valued Contributor
  • 93 replies
  • August 23, 2023

It seems, that some difference is here between MacOS 13.4 to 13.5 and now with 13.5.1 the CP from jamf doesnt restrict the computername anymore


Forum|alt.badge.img
  • New Contributor
  • 1 reply
  • September 22, 2023

I know this is an older post but has anyone found a solution for this? I tested again on 13.6 and the ability for a non-admin can change the device name in General > About > Name. This of course has been a cause for concern as most of our settings are being applied to smartgroups based on device name. I use JAMF school and not JAMF pro so my ability to control this with a profile is a bit more limited and I cannot find a profile in iMazing that would restrict the devices being renamed.


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings