macadmin.fraserhess.com

Discoveries and solutions from my work administering Mac computers.

  • The story of CVE-2025-22460

    Yesterday, Ivanti disclosed CVE-2025-22460, a use of default passwords in their Cloud Services Application. The CSA is a pseudo-reverse proxy for Ivanti’s on-premise Endpoint Manager. The fix requires a fresh install of CSA 5.0.5 or running mitigation steps (login required) after upgrading from 5.0.0-5.0.4. This disclosure began for me last month due to a finding…

  • Building MacBooks with Jamf Setup Manager

    In the last of this series of posts about Jamf Setup Manager, I discuss how we use it to provision MacBooks. This is our primary use case for JSM. Read the first post to learn more about our decision to use it as our preferred tool for provisioning Macs. Design Goals When considering how to replace our…

    , ,

  • Particulars 64

    Particulars, my system information app, has been updated to version 64. The biggest change is that I had to replace the crash reporter due to the retirement of Microsoft’s App Center. After March 31st, crashes in version 63 and earlier cannot be reported. There are two other changes for organizations. A new setting allows organizations…

  • You should be opinionated about Apple’s stock apps

    In a recent post, I covered the differences between Macs from the factory and those that were wiped and macOS was reinstalled. A major difference is that the factory Macs include 5 additional applications: Keynote, Pages, Numbers, iMovie, and GarageBand. I’ve discovered that there’s a very good reason to be opinionated about whether or not…

  • UI and process for preventing a Mac from turning on

    Last week, Apple documented how to prevent a Mac from turning on when the lid is opened or the power is connected. As a person with a set of test Macs that get opened and unplugged/plugged all the time, this is a welcome feature. The nvram command to change this setting has a set of…

    ,