66      iPhone_iPad_Mac_apple

Security & Privacy

I am testing Sierra on some new MacBook Pros that we are about to purchase and deploy to our enterprise network users.  Everything seemed to go fine as usual with setup and initial configuration.  However, when I logged on as the authenticated network user, I cannot change the setting below in Security & Privacy (Grayed out).

I referenced a post from 2013 Screensaver "start time" option grayed out.  It mentions deleting a file from ~/Library/Preferences/ByHost but this is for Mountain Lion, not Sierra.

I do have Profiles installed, but only 3 and they are for wired and wireless 802.1X network configurations and machine certificate (X509).

The kicker is when I logon to the local admin account, I can manipulate this setting without issue...and I was under the impression if a setting is NOT grayed out on the local admin account (after binding with policies enforced), those settings should propagate to other authenticated users.

Any help is appreciated.

this is just another reason why I deploy macs as close to "out of the box" as I can...

Profile Manager - Official Apple Support

This is true; unfortunately, I am the Mac Engineer in a company that officially doesn't support Macs.  So I am at the behest of my knowledge of Macs and our network vs. a lack of IT support.  So I have to make due.

You are preaching to the choir. - Once you mention the word mac in an IT meeting the questions that follow makes Medieval Europe look like a utopian age of enlightenment.

Are they forcing you through an AD environment?

Integrate macOS systems with Windows Active Directory - Apple Support

There may be a GPO in there that would force you to do this through a domain admin account, preferably a newly made one as default as can be. Sometimes those admin rights that have seemingly nothing to do with one set of rules can cluster funk an entire other set of permissions.

If you make the necessary changes to this with the local account does it stick later?

Wait...you support Macs where Macs aren't supported by IT?  I literally though I was the only one!  Funny thing is, the previous "support" person that I replaced introduced Macs to this department (Graphic/Duplication Services) back when they still used paper, easels and and in house back specialist.  She was a Graphic Designer by trade, Mac/IT person by choice.

She drove everyone nuts to the point where mentioning Macs to someone in IT caused seizures and even drove a couple high-ups into retirement (literally)! I came in from 5.5 years managing the Windows Standard OS Image for the company and its helped to settle people down since they actually like working with me (and have offered to help in recent months).

I was forced into using ADmitMac 10.0 since there are so many GPOs governing things related to Kerberos, password and LANMAN policy.  Using the built-in AD tools within macOS didn't provide the complete binding necessary to get the root certificates, etc and wasn't allowing me to use Profile Manager effectively.  ADmitMac was seeing and implementing the handful of GPOs that both Windows and Mac understand...as well as the root and intermediate certs.

I checked with the AD team and they have not implemented any new GPO's since before my testing began.  And the local admin account does not have this grayed out, only my authenticated user account (with local admin rights).  I thought this was a systemwide preference where if I change it as local admin, it will maintain that to all logged on users.  Am I incorrect about this?

Honestly I woud not know, my suspicion is it should remain, however Windows AD puts the @$$ in assume - I would ask them to make a test admin account for you and keep it default and rule it out if it leads nowhere. It will only take a minute to find out.

最後更新：2017-09-13 22:59:45

  上一篇： How to connect a pen tablet to Macbook?

  下一篇： Sierra 10.12.6: Gmail inbox empties, goes to ar...