10-28-2022 12:03 AM - edited 10-28-2022 12:33 AM
Apple added a security feature into Ventura 13.0 for Apple silicon called "Allow accessories to connect" you can find it under System Settings > Privacy & Security
You can find the info in the link below under the "Accessory security" heading
This has caused issues in our environment as we still use AD login and ethernet is required for deployment on the Mac.
Apple has given us a solution to the problem in a well hidden MDM command that came out with Ventura.
Here is the MDM command I am pushing out to our fleet as a Application & Custom Settings payload if anyone is interested.
Bundle ID: com.apple.applicationaccess
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>allowUSBRestrictedMode</key> <false /> </dict> </plist>
This Jamf Pro Feature request is related: https://ideas.jamf.com/ideas/JN-I-26484
Posted on 10-28-2022 02:10 AM
Do you know how to disable USB restricted mode using shell script? It is because I need this script for Mac OS deployment.
Posted on 10-28-2022 04:59 AM
Its better to use a configuration profile. Just add the profile to your prestage, and scope it to all Ventura devices. Scripts are nice to change settings that cant be managed. If there is an option to manage something, use a configuration profile.
Do not target all devices as if a nonVentura device receives the profile it will just ignore it and never look at it again even if it updates to Ventura. You would need to exempt and retarget to reinstall if this happens. If it installs on a nonVentura device from the prestage it should automatically remove if the config profile is scoped correctly.
Posted on 10-28-2022 05:46 AM
Posted on 10-28-2022 06:37 AM
I have been looking around and I don't think its possible to manage at this time from CLI. Maybe submit a feedback request on that.
You could use imazing profile editor or apple configurator to make a .mobileconfig. Distribute the .mobileconfig to your users and have them install it. If you are not using a MDM solution, you are not managing Macs so it may be best to just leave it to the users.
Posted on 12-08-2022 08:31 AM
Thanks for posting this, it worked for me. I up voted the feature request.
Posted on 01-23-2023 09:01 AM
Works great! Thanks a bunch!
Posted on 01-24-2023 04:30 PM
I voted up on this as well. I was able to leverage your info here to come up with a way to block usb storage again. (allowFilesUSBDriveAccess. true/false.) I posted at the link below.
disable USB or USB Mass Storage Devices - Jamf Nation Community - 250451