Apple added a security feature into Ventura 13.0 for Apple silicon called "Allow accessories to connect" you can find it under System Settings > Privacy & Security
You can find the info in the link below under the "Accessory security" heading
This has caused issues in our environment as we still use AD login and ethernet is required for deployment on the Mac.
Apple has given us a solution to the problem in a well hidden MDM command that came out with Ventura.
Here is the MDM command I am pushing out to our fleet as a Application & Custom Settings payload if anyone is interested.
Bundle ID: com.apple.applicationaccess
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>allowUSBRestrictedMode</key> <false /> </dict> </plist>
This Jamf Pro Feature request is related: https://ideas.jamf.com/ideas/JN-I-26484
Its better to use a configuration profile. Just add the profile to your prestage, and scope it to all Ventura devices. Scripts are nice to change settings that cant be managed. If there is an option to manage something, use a configuration profile.
Do not target all devices as if a nonVentura device receives the profile it will just ignore it and never look at it again even if it updates to Ventura. You would need to exempt and retarget to reinstall if this happens. If it installs on a nonVentura device from the prestage it should automatically remove if the config profile is scoped correctly.
I have been looking around and I don't think its possible to manage at this time from CLI. Maybe submit a feedback request on that.
You could use imazing profile editor or apple configurator to make a .mobileconfig. Distribute the .mobileconfig to your users and have them install it. If you are not using a MDM solution, you are not managing Macs so it may be best to just leave it to the users.
I voted up on this as well. I was able to leverage your info here to come up with a way to block usb storage again. (allowFilesUSBDriveAccess. true/false.) I posted at the link below.