Ventura - Allow accessories to connect (USB Type-C)

Lincolnep
New Contributor III

Apple added a security feature into Ventura 13.0 for Apple silicon called "Allow accessories to connect" you can find it under System Settings > Privacy & Security

You can find the info in the link below under the "Accessory security" heading

https://support.apple.com/en-au/guide/deployment/dep950aed53e/1/web/1.0

 

This has caused issues in our environment as we still use AD login and ethernet is required for deployment on the Mac.

Apple has given us a solution to the problem in a well hidden MDM command that came out with Ventura.

https://github.com/apple/device-management/blob/release/mdm/profiles/com.apple.applicationaccess.yam...

Here is the MDM command I am pushing out to our fleet as a Application & Custom Settings payload if anyone is interested.

Bundle ID: com.apple.applicationaccess

 

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>allowUSBRestrictedMode</key>
        <false />
    </dict>
</plist>

 

This Jamf Pro Feature request is related: https://ideas.jamf.com/ideas/JN-I-26484

7 REPLIES 7

swkwan2000
New Contributor

Do you know how to disable USB restricted mode using shell script?  It is because I need this script for Mac OS deployment.

AJPinto
Valued Contributor II

Its better to use a configuration profile. Just add the profile to your prestage, and scope it to all Ventura devices. Scripts are nice to change settings that cant be managed. If there is an option to manage something, use a configuration profile.

 

Do not target all devices as if a nonVentura device receives the profile it will just ignore it and never look at it again even if it updates to Ventura. You would need to exempt and retarget to reinstall if this happens. If it installs on a nonVentura device from the prestage it should automatically remove if the config profile is scoped correctly.

Thanks for your reply. As we don't use any MDM solution for Mac management, that's why we need to use script for Mac OS deployment. May I know any command line on Mac can disable this function?   

AJPinto
Valued Contributor II

I have been looking around and I don't think its possible to manage at this time from CLI. Maybe submit a feedback request on that.

 

You could use imazing profile editor or apple configurator to make a .mobileconfig. Distribute the .mobileconfig to your users and have them install it. If you are not using a MDM solution, you are not managing Macs so it may be best to just leave it to the users.

tender
New Contributor II

Thanks for posting this, it worked for me. I up voted the feature request.

tend·er (tĕn′dər) noun: One who tends something.

f000ky1
New Contributor

Works great! Thanks a bunch!

fperry
New Contributor II

I voted up on this as well. I was able to leverage your info here to come up with a way to block usb storage again. (allowFilesUSBDriveAccess. true/false.) I posted at the link below.

disable USB or USB Mass Storage Devices - Jamf Nation Community - 250451