Installomator VS macos_security

If you have access to a Mac, Installomator is a good encapsulation of shell scripting.

I used to use something like the above script but switched to using Installomator for all apps we use that it supports. It can do the initial install as a push or from Self Service, and then you can set it up to patch software as well. https://github.com/Installomator/Installomator

If you want to make things easy for your users and yourself, take a look at Installomator. It'll unlock a lot of nice workflows for your users, since you could put a specific title's install action available in Self Service and thats always gonna be easier than trying to track down the vendor's URL and finding the right download. It also means you don't have to repackage anything.

Munki is not an MDM and I recently learned there's this project called Installomator that might help.

Looks like you’re trying to update/work with version 4 but the installomator version is still on version 3. I’d suggest using build a label for musescore4

Installomator https://github.com/Installomator/Installomator

For starters there's an entire NIST project for macOS Security Compliance - https://github.com/usnistgov/macos_security this will make your life a million times easier to meet a lot of the technical controls required for compliance. Nothing like this really exists for Windows or Linux(closest is Compliance As Code https://github.com/ComplianceAsCode/content)

https://github.com/usnistgov/macos_security - for macOS this would help.

I’d highly recommend checking out the usnistgov/macos_security on GitHub. You can generate a benchmark and then feed the output into extension attributes to trigger policies on.

Study about cybersecurity, or how to harden a macOS fleet against published security frameworks.

Weigh the pros and cons about having your end-users be standard users or admins on their Macs. If they are already admins (probably), consider the political blowback if you take away their admin rights and flexibility and autonomy they've become used to. Conversely, consider the security posture of your organization. If it has to adhere to some well-known guides (like 800-171 o 800-53r5), then you may not be able to allow end-users to be admins. Take a look at the macOS Security Compliance Project.

NIST Compliance Benchmarks: github.com/usnistgov/macos_security

Like OP, I'm trying to disable both bonjour and netbios. I'm using this script: https://github.com/usnistgov/macos_security/blob/main/includes/enablePF-mscp.sh