System Extensions

Overview

Certain antivirus/network security applications require access to the hard disk and memory of devices, in order to function properly. For this purpose, you might need to whitelist certain extensions on these devices. As a part of macOS 10.13, Apple introduced User Approved Kernel Extension Loading (UAKEL) which gave users full control to approve or deny Kernel extensions during software installation. 

However, Mac machines in which you remotely approve these extensions using an MDM solution must hold a User Approved MDM (UAMDM) status. Mobile Device Manager Plus' enrollment methods automatically grant the UAMDM status to managed Mac machines. As a result of this, you can whitelist both Kernel Extensions and System Extensions which include Network, Driver, as well as Security extensions.

Prerequisite(s)

Profile Settings

PROFILE SPECIFICATION

DESCRIPTION

Allow users to approve kernel/system extensions manually Enabling this allows users to manually approve or block the extensions which are not specified in this policy.
Team identifier To approve extensions developed by a vendor, provide their Team identifier.
Allowed Extension Categories Select at least one category of extensions you want to whitelist.
Extension bundle identifier(s) To approve specific extensions developed by a vendor which belongs to particular categories, specify their unique bundle identifier(s). If this is left unspecified, all the extensions with the same Team identifier will be approved.

  • To whitelist the complete set of extensions developed by a vendor, across all categories:
    • Specify the Team identifier of the vendor and ensure all the Allowed Extension Categories are selected before saving the policy.
  • To whitelist a specific set of extensions developed by a vendor, which belongs to one or more categories:
    • Specify the Team identifier of the vendor and ensure you select at least one or more Allowed Extension Categories before saving the policy.
  • To whitelist a particular extension developed by a vendor, which belongs to a specific category: 
    • Specify the Team identifier of the vendor, the particular Extension bundle identifier, and select the extension's category as well. You can also add multiple Extension bundle identifiers if need be.

How to obtain Team identifier and Extension bundle identifier(s)

Copyright © 2020, ZOHO Corp. All Rights Reserved.
ManageEngine