Help, there’s a Mac on my network (3): looking for Group Policy

Episode 3 of the series Help, there’s a Mac on my network.

What happened

Monday morning, quarter past eight. Marieke was standing at Ruud’s desk before his coffee had a chance to cool down. She had three wishes, neatly numbered on a sticky note. One: her MacBook Air had to lock itself after five minutes, because on Friday it had sat open in the canteen for half an hour. Two: the company logo as wallpaper, “just like on the Windows laptops”. Three: no more USB sticks, ever since Karin brought home a free one from a trade fair that, according to the packaging, held “1000 GB”.

“No problem,” said Ruud. On Windows this was a quiet morning: three settings in a GPO, link it to the right OU, done before lunch.

He carried Marieke’s Mac to his desk, pressed Command and Space, and confidently typed gpedit.msc. Spotlight thought about it for a moment and then offered to search the web. He tried “Group Policy”. Spotlight found a PDF from 2019 in Marieke’s Downloads folder. He tried “policy”. Spotlight opened Pages.

“On Windows this was right there under Computer Configuration,” Ruud muttered to his mug. The mug asked whether he had tried turning it off and on again. He hadn’t, but he was seriously considering it.

Sam wandered past with a packet of biscuits. “Mind if I have a go?” He opened System Settings, clicked General and scrolled down to Device Management. One profile sat there: Management Profile, from Microsoft Intune. “That’s your Group Policy,” said Sam. “It just doesn’t live on the Mac. It lives in Intune, and the Mac gets sent a note.”

Ruud looked at the screen, then at Sam, then at the biscuits. “How many notes can a Mac have?”

“As many as you like,” said Sam. “But try them on one first.”

What’s really going on

A Mac has no Group Policy and no Active Directory GPOs. No gpedit, no domain controller dropping by at boot. Apple built management differently from day one: everything goes through MDM, mobile device management. At Bolderman that’s Intune, which Ruud already uses for the Windows laptops.

There are three flavours worth knowing.

• Configuration profiles. The old, familiar mechanism. A profile is a .mobileconfig file (plain XML) holding one or more payloads: one for password rules, one for Wi-Fi, one for the firewall. The MDM server sends the profile to the Mac and macOS enforces it. Think of it as a GPO that arrives by courier.
• Declarative Device Management (DDM). The newer approach. Instead of the server firing commands and constantly asking whether everything is still fine, the Mac gets a declaration (“this is how I want you”) and applies it itself. Through the status channel the Mac reports back on its own whenever something changes. Software updates now run through DDM too: you say which macOS version must be installed by which date, and the Mac handles the rest, including nagging the user. Apple has deprecated the old MDM update commands, so don’t build anything new on them.
• Scripts through the Intune agent. For anything Apple doesn’t offer as a setting, Intune can deploy shell scripts. They run as root or as the signed in user, once or on a schedule. Custom attributes are small scripts that read something (say, a version number) and report it back to Intune.

In Intune you build most of this in the Settings catalog for macOS. MDM payloads and DDM configurations sit side by side there, and you search by name, much like browsing the folders in the GPO editor. What a Mac needs to get into Microsoft 365 is handled separately with a compliance policy: minimum macOS version, FileVault on, firewall on, password required. If the Mac falls short, Conditional Access can show it the door.

Then the part that made Ruud sigh: supervision. A Mac bought through Apple Business and enrolled in Intune with Automated Device Enrollment is supervised, and that lets the organisation do more. A Mac someone enrolled themselves through Company Portal, like Marieke’s conference Mac, is not supervised. You can manage it, but some things you simply can’t enforce. Blocking USB storage is a good example: that declaration only works on supervised Macs running macOS 15 or later. On a BYOD Mac the user can also just remove the management profile. Apple does that on purpose: on a personal Mac the owner is in charge, not the employer.

How to fix it

Marieke’s three wishes

1. Screen lock. Create a Settings catalog profile for macOS and search for the Passcode and screen saver settings. Set maximum inactivity to 5 minutes and require a password immediately after the screen saver starts. Heads up: changing password rules can mean the user has to pick a new password at the next sign in. Tell Marieke first.
2. Wallpaper. There’s no tidy switch for this one. The usual route: an Intune shell script drops the image locally, for example in /Library/Desktop/, and a profile with the Override Picture Path setting points at it. File first, profile second, or the Mac ends up staring at an empty spot.
3. USB sticks. Use the DDM configuration Disk Management and set External storage to Disallowed (or Read-only, if CDs and DVDs are still allowed). This only works on supervised Macs. For Marieke’s Mac that means adding it to Apple Business first (with Apple Configurator on an iPhone, which involves setting the Mac up again) and then enrolling it again through Automated Device Enrollment. Plan it with her, backup first.

Always one Mac first

Create an Entra ID group called “Mac-test” with one Mac in it, preferably not the managing director’s. Assign every new profile to that group first. On that Mac, check System Settings > General > Device Management to see whether the profile arrived, and run sudo profiles show in Terminal to see exactly what’s inside. Only when it works do you widen the assignment. A wrong profile on sixty devices at once isn’t a learning moment anymore, it’s a day off you won’t be getting.

What not to promise on a BYOD Mac

On a Mac that isn’t supervised you can handle password rules, FileVault, Wi-Fi, certificates, apps and compliance just fine. What you can’t guarantee: blocking USB storage, stopping someone from removing the management profile, and a good chunk of the restrictions Apple reserves for supervised devices. Be honest about that with management, and turn it into a purchasing rule: company Macs come from a reseller who adds them to Apple Business.

Ruud’s lesson

Ruud went looking for an editor and found a postman. Group Policy is a place where you make settings; on the Mac it’s a parcel that Intune delivers and macOS unpacks itself. Once that clicks, the Settings catalog feels suspiciously familiar. And that free USB stick from the trade fair? It now lives in the server cupboard, next to the mop. It can’t do much harm there.

Further reading: Apple Business, Entra ID and Intune for small businesses and The Mac in a Windows network.

This is episode 3 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.