Welcome to my blog
Join me on my journey as I share my insights and experiences on all things Apple, Business and Entrepreneurship!
Join me on my journey as I share my insights and experiences on all things Apple, Business and Entrepreneurship!
Turning off Jamf Trust fixed the webinar, which normally would have sent me straight to its routing policies. This time the route was fine: Chromium was treating Jamf's ZTNA broker addresses as a local network, and an Edge and Chrome preference corrected it.
Part one of a Clamshell iBook G3 restoration: a broken screen, a charger detour, a blinking system folder, a full teardown, and the backlight connector mistake that paused the project.
I installed Bromure Agentic Coding, watched it build the Linux VM, authenticated Codex, and followed a real Codex task through the workspace.
Claude Code Auto mode changes how approval decisions are handled. It does not expand the boundary of what the coding agent should be allowed to do.
Amnesia Stealer shows how ClickFix-style social engineering is adapting on macOS, while a public malware sample gives defenders an opportunity to study the behavior behind the campaign.
DLP overrides are not automatically bad. They are a business process that needs visibility. This walkthrough covers a Microsoft Purview DLP policy, a custom sensitive information type, user override behavior, and a PowerShell report that exports override events from Activity Explorer.
The PowerBook 140 project moved from preparing a BlueSCSI card in Basilisk II to installing the repaired internal SCSI cable, powering the BlueSCSI Pico externally from the battery bay, booting System 7.1, and fighting through DaynaPORT Wi-Fi setup.
Microsoft is retiring Microsoft-provided SMS and voice authentication in Entra ID. The migration is not passkeys for everyone; it is removing weak telecom MFA and choosing supported replacement methods such as Microsoft Authenticator, FIDO2 keys, certificate-based authentication, OATH hardware tokens, or customer-managed telecom.
A 22-inch Apple Cinema Display arrived with a broken acrylic easel stand, so I used a 3D printed replacement leg instead of sending the monitor back.
macOS Tahoe 26.6.1 fixes CVE-2026-65400, a high-severity Screen Sharing authentication issue where an attacker on the network may be able to authenticate without valid credentials.
Latest, Applite, and an all-in-one macOS update script each solve a different part of lightweight Mac maintenance: app update visibility, Homebrew-backed app management, and command-line package updates that can be wrapped carefully for small teams or basic MDM.
Natural is a small macOS menu bar utility that makes the natural scrolling toggle easy to reach, but building it from source also shows why open-source desktop utilities need clear prerequisite checks before they become recommended tools.
ClaudeChat-Snow-Leopard is interesting because it brings a modern Claude API workflow back to Mac OS X 10.6.8 with Objective-C, Cocoa, Keychain storage, screenshot uploads, and a native installer built for an older white MacBook.
LibrePods is interesting because it turns AirPods into an interoperability question: what happens when open-source software implements Apple's private AirPods protocol so Android and Linux users can reach features normally reserved for Apple's ecosystem?
Mac Performance Monitor belongs in the Mac admin toolbox because it records local performance history, helps Help Desk review slow-Mac reports after the moment has passed, and keeps process telemetry on the Mac instead of sending it to a cloud service.
Apple says macOS 28 will not support encrypted Mac OS Extended volumes, so older encrypted HFS+ external drives need to be identified, backed up, decrypted, converted, or reformatted before that upgrade.
ClickLock Stealer shows why Mac security teams should watch for Terminal paste lures, fake AppleScript password prompts, command-line Keychain access, LaunchAgent persistence, and Jamf Protect alerts that can route suspected Macs into Jamf Pro response groups.
CrashStealer shows the security gap between Apple's Developer ID notarization path and App Store review, and why Jamf's behavioral detection mattered.
AppleCare One looks more valuable after AppleCare+ price increases for Macs and iPads, especially for people with several Apple devices and older eligible hardware.
Apple's U.S. carrier financing change makes locked versus unlocked iPhones an operational buying decision for small businesses, BYOD users, and Apple fleet planners.
The July 2026 CMMC Phase II pause changes the timing of third-party assessment requirements, but it does not erase DFARS, NIST SP 800-171, SPRS, or the value of a completed Level 2 audit.
How folder naming, control-level artifact names, spreadsheet hyperlinks, and evidence hashing made a CMMC evidence package easier for the auditor to validate.
A step-by-step walkthrough for preparing a BlueSCSI v2 PowerBook card image with Basilisk II: download the pieces, configure the emulator, boot a working classic Mac image, mount the target System 7.1 image, stage tools, and shut down cleanly before moving the image to the card.
Keeping up with ISC2 CPE credits is easier when you treat it like a normal professional habit instead of a renewal emergency. Here is the system I use across CISSP, CCSP, SSCP, and CSSLP, with free and low-friction sources for webinars, books, training, and work-based credits.
Microsoft's MCP tool-poisoning research shows why AI agent security has to treat tool descriptions, schemas, and metadata as part of the control plane instead of harmless documentation.
How Jamf Compliance helped support the Mac portion of a CMMC assessment, and why I added a small read-only CSV summary script for auditor-ready failed-result evidence.
A replacement adapter finally brought my PowerBook 145 back to life, but the storage bay had a stranger problem than I first thought: the drive inside was an IDE drive, not the SCSI storage this machine needs. The surprise was that 6 MB of RAM made a System 7.1 RAM Disk boot possible while I wait on a replacement cable and BlueSCSI.
Homebrew gives Mac admins a useful first-pass inspection workflow before trusting a formula or cask: check the source, checksum, version, tap state, availability, and upstream maintenance story.
Running AI locally on a Mac has become a real part of my workflow, but only once I stopped treating local models like general-purpose answers and started treating them like constrained components inside a system I can still inspect.
Apple’s WWDC26 special presentation on Apple Intelligence and Xcode was less about adding a chat box to developer tools and more about making AI part of the platform boundary. Xcode agents, App Intents, Foundation Models, Core AI, and MLX all point toward the same idea: intelligent features need context, permissions, testing, and clear ownership before they belong in production software.
I picked up a clean PowerBook 145 knowing it might be a gamble. What I found was a machine that looked promising on the outside, demanded the correct 7.5V power approach, revealed a torn hard drive ribbon cable inside, and still refused to chime. That first teardown ended up being less about a successful revival and more about the reality of vintage Apple restoration.
When I started preparing for a CMMC assessment, I expected to spend most of my time focused on policies, procedures, and the System Security Plan. Those things are certainly important, but what surprised me was how much of the assessment ultimately came down to evidence.
Most of those conversations eventually landed in the same place. Siri wasn't ready. Liquid Glass was everywhere. There was no new hardware announcement. Depending on who you asked, WWDC 2026 was either disappointing or forgettable.
ABM Warranty 0.5.1 adds outbound connection workflows for JAMF and OAuth-based APIs, an expanded device detail view, outbound job tracking, and guide updates for connection setup and sync review.
After helping lead our organization through a successful CMMC Level 2 assessment, I share lessons learned from years of preparation, audit readiness, evidence collection, and working through the certification process.
Build beautiful macOS Help Books with live preview, multilingual AI translation, and one-click export to Helpbook, PDF, and HTML.
ABM Warranty 0.5.0 expands the platform with tenant-aware desktop widgets and notifications, giving teams clear, real-time visibility into fleet health, expiring coverage, and devices requiring attention across ABM/ASM environments. This release introduces a powerful CLI for managing notifications and sync workflows, alongside a new job-based architecture with chunking, sync history tracking, and an enterprise sync mode designed to scale with large device fleets. Additional enhancements include API credential rotation for security-conscious organizations, notification muting for known exceptions, forward-compatible database migration paths, and full localization support across 10 languages for global...
Apple has quietly turned Apple Business Manager into something much broader than the device enrollment portal many of us have known for years. The new experience feels cleaner, more organized, and much more intentional. After spending time with the latest Apple Business documentation, my first reaction is that Apple is building a more complete business platform — one that brings identity, services, communications, support, storage, and payments closer together under a single administrative surface.
Recently, after some bad experiences with OpenAI's ChatGPT and CODEX, I decided to look into and learn more about running local AI models. On its face it was intimidating, but I had seen a lot of people in the MacAdmins community posting examples of macOS setups, which really helped lower the bar for me both in terms of approachability and just making me more aware of the local AI community that exists out there today.
I really feel like in this era of AI it's essential to write about and share experiences for others who are leveraging AI, especially now that AI usage seems almost ubiquitous. Specifically, when it comes to AI in development and the rapid growth of AI-driven automations in the IT landscape, I believe there's a need for open discussion and exploration.
The 0.4.x release series for ABM Warranty is focused on operational scale. The earlier 0.3 releases were about trust, correctness, and stabilizing the foundation. Version 0.4.1 builds directly on that work by making the app more practical for consultants, internal IT teams, and managed service providers who need to support multiple environments without losing isolation, control, or visibility. This includes improvements to user interface and workflow, as well as enhanced reporting capabilities to help these users manage their workflows more efficiently.
So there I was, a typically day, a typical weekend. As a ChatGPT customer, I had heard good things about Codex and had not yet tried the platform. To date my experience with agentic coding was simply snippit based support with ChatGPT and Gemeni where I would ask questions, get explanations and support with squashing bugs in a few apps that I work on, for fun, on the side. There were a few core features in one of the apps I built that I wanted to try implementing but the...
Download ABM Warranty
Security and risk are often treated as interchangeable concepts in modern IT environments, but they are not the same discipline. Security focuses on controls, enforcement, and prevention. Risk management, by contrast, is concerned with likelihood, impact, and consequence across operational, financial, and organizational domains. Frameworks such as those published by NIST make this distinction explicit: risk assessment is not a technical exercise, but a business one. Technology informs risk decisions, but it does not define them.
The 0.3.x release series for ABM Warranty is about tightening guarantees. Where earlier releases focused on surfacing data and making long-running operations observable, 0.3.x focuses on ensuring that what you see is complete, consistent, and safe to trust—particularly as the app is used in larger, slower, and more varied environments. This shift in focus aims to provide a more reliable foundation for users who require higher levels of assurance from their warranty management system.
ABM Warranty 0.2.0 is a feature release focused on visibility, safety, and scale. This version does not change what ABM Warranty is meant to be, but it significantly improves how the app behaves under real-world conditions—large device counts, API throttling, long-running imports, and the kinds of failure modes Apple IT admins actually encounter. The improvements in this release are designed to make the app more reliable and efficient, allowing it to handle complex scenarios without breaking or becoming unresponsive.
Shipping software in isolation is comforting. You control the inputs, the environment, and the narrative you tell yourself about how things work. The moment you invite other people in—especially people who don’t share your assumptions—you lose that comfort. You also gain something far more valuable. Running a public beta for ABM Warranty through Apple’s TestFlight program forced me to confront that tradeoff head-on, and it fundamentally changed how quickly and confidently the app matured.
There are a few kinds of mistakes you make as a Mac admin. There are the ones that cost you time, the ones that cost you sleep, and then there are the ones that leave you staring at a perfectly good laptop thinking, “How did I possibly make this *less* manageable by touching it?” These mistakes often stem from a lack of understanding or experience with macOS, but they can also be the result of rushing through tasks or not taking the time to properly plan and test.
If you manage Apple devices at scale, you already know that **Apple Business Manager (ABM)** provides warranty data — but in practice, it’s extremely limited. It doesn’t provide workflow-friendly insights, it doesn’t surface actionable coverage states, and it doesn’t help you wrangle the ever-growing complexity of **AppleCare+ renewals** across hundreds or thousands of devices. This lack of comprehensive information can lead to missed renewal deadlines, unnecessary costs, and a higher risk of device downtime due to expired warranties.
If you’ve ever tried to talk directly to the **Apple Business Manager (ABM) API**, you already know the process can feel like deciphering a secret code. Between private keys, encrypted certificates, ES256 signatures, and OAuth2 flows... there’s a lot going on under the hood. This complexity is what makes direct communication with ABM so challenging, requiring a deep understanding of its intricacies to navigate successfully.
Keeping Safari updated is one of the simplest ways to harden a macOS fleet. Apple ships security fixes for Safari frequently, and those patches often land before a full macOS point release. This means that by keeping Safari up-to-date, you can ensure your users have access to the latest security protections without having to wait for a major operating system update. If Safari is lagging behind, your users are browsing the web with a larger attack surface than necessary.
If you've spent enough time living inside Jamf Pro, you eventually run into the same problem: someone set a configuration somewhere, sometime, and nobody remembers where. It might be something obscure – a certificate payload, a conditional SSO predicate, or that one security preference quietly misbehaving on three machines in accounting. And when you have dozens of configuration profiles, each with multiple payloads, nested keys, and XML-wrapped values, finding that setting can feel like forensic archaeology.
When I first wrote about troubleshooting Standard Routing Policies in Jamf Security Cloud, the goal was simple: help admins keep Microsoft Teams and Microsoft 365 traffic flowing smoothly through Jamf Trust + App-Based VPN. This straightforward objective remains unchanged, as the complexities of network configurations can often lead to frustrating issues that hinder productivity.
When you run a consultancy, you think the job is about your expertise—the thing you’ve been hired to do. But very quickly, you realize the role demands a whole set of skills you never set out to master. They sneak in over time, and before you know it, you’ve become fluent in things you once thought you’d avoid. The funny part is, you don’t even notice you’re learning them until you look back and recognize how much your approach has shifted. These are the skills that never appear on your...
I have a lot of friends in the job market right now, and we’ve been having some interesting conversations about a title that comes up again and again: “Senior.” It’s one of those words that carries weight when you first hear it—implying a certain level of mastery, trust, and authority—but the more you look at how it's used in practice, the more slippery it becomes. We've been debating what exactly "senior" means in different contexts, from years of experience to specific skills or responsibilities.
When I recently passed the Apple Certified Support Professional (ACSP) exam again, I paused to reflect — not just on this milestone, but on the long path I’ve walked through Apple’s certification landscape. My first certification dates back to macOS 10.5, and over the years, I’ve earned credentials across nearly every version since. In that time, the exams — and Apple itself — have transformed significantly.
Keeping your organization's VPN always connected is crucial—especially with Zero Trust Network Access (ZTNA) frameworks like **Jamf Trust**. One of the challenges with **Jamf Trust** is that it does *not* automatically open or reconnect on startup or login by default. However, with a combination of Jamf Pro policies, a custom script, and an extension attribute, you can ensure your users stay securely connected at all times, even when their devices are restarted or logged out. This setup helps maintain continuous access to network resources while adhering to the security standards...
As a fairly new administrator of JAMF Security Cloud, it was the ease of which its administration that admittedly drew me in. Quite an elegant solution for securing the various apps on business workstations with premade app-based VPN routing rules built right in, I was hooked. The concept is simple: turn on the policies, create your enrollment, and deploy – and you're done. This straightforward approach has made it easy to integrate into our existing workflow, allowing us to focus on more critical tasks.
I started thinking about what it means to be a great IT technician. As one of my now roles, IT technician was thrust upon me, among other things, by choice. Primarily because I enjoy it, and so it got me thinking, why do I love it so much? Over the years I have worn the hat of support specialist, web developer, IT manager, IT director, and CEO. I am now the information systems security officer but not matter how hard I try, the pull, and draw of troubleshooting issues pulls...
I’ve written about how I’d build an MSP from scratch in 2024. I followed that up with what I’d do differently in 2025 after a few more battle scars. Now, as I reflect on the way this space keeps evolving, I think it’s time to talk about scale—and more specifically, how not to lose your mind while scaling. It's an area where many MSPs struggle, and I'm no exception.
Managing Secure Tokens on macOS has long been a challenge for administrators using JAMF and Automox. In my previous post, Managing the macOS Secure Token with JAMF Pro, I discussed a script-based approach to grant Secure Tokens to additional users. However, this method required administrators to manually pass usernames and passwords into the JAMF configuration—an approach that, while effective, was not ideal from a security or usability perspective. This manual process introduced unnecessary risks and added complexity to the overall management of Secure Tokens.
As 2025 begins, it’s a fitting time to reflect on the transformative journey I’ve undertaken over the past few years. It’s been a whirlwind, filled with growth, learning, and exciting challenges.
Cybersecurity is no longer a luxury or an afterthought—it's an absolute necessity. But how can you tell if the company you work for, as a security professional, truly values cybersecurity? Let's explore some clear indicators that demonstrate a company's commitment to implementing robust security practices in-house. A genuine commitment will be reflected in the organization's policies and procedures, which should be regularly reviewed and updated to address emerging threats.
In the IT field, certifications often appear to be the golden ticket and in many cases the fast track to success. They signal expertise, validate skills, and provide a sense of accomplishment. However, the heavy reliance on certifications in the industry brings a host of challenges, and many professionals, like myself, find themselves questioning the value, timing, and necessity of these credentials. This has led to a culture where some individuals prioritize certification over hands-on experience, while others feel pressured to constantly update their credentials to remain relevant.
As more professionals leave the security of full-time employment to pursue consulting, the idea of starting your own business becomes both inspiring and daunting. While the freedom to shape your career and work on your own terms is alluring, it’s critical to understand that building a successful consulting business involves significant planning, preparation, and risk. This transition requires careful consideration of financial stability, market demand, and personal goals, as well as a willingness to adapt to changing circumstances and unexpected setbacks.
In 2014, I embarked on a journey that would shape the next eight years of my life. With a vision in mind and a determination to succeed, I founded Grove Technologies, a Managed Service Provider (MSP) based in Maryland, focused on delivering exceptional IT solutions to businesses of all sizes. The company grew steadily, overcoming challenges and celebrating milestones, until 2022, when I decided it was time to pass the baton and sold the business. It was an incredible experience, filled with invaluable lessons, but as I reflect on those...
Its been a while since I have used Automox, but the premise of the tool is that it automatically patches your macOS, Linux and Windows workstations. for macOS it does this using a service account created with username _automoxserviceaccount and this account needs a secure token. The issue here is that when the package is deployed the secure token is not transferred to that account which means that it most cases it can't apply macOS updates.
From 2014 until 2022 I built and ran a series of successful IT consultancies, from a one person solopreneurship (Jon Brown Consulting), to a startup (Mac Gurus) that grew rapidly but faced significant challenges, to its more mature and accomplished predecessor (Grove Technologies) where I eventually sold the business and exited the industry.
In the fast-paced realm of consultancy, where competition is fierce and innovation is key, finding the delicate balance between competition, collaboration, and cooperation is essential. Today, we embark on a journey to explore the transformative potential of collaboration in the consultancy world.
In the dynamic landscape of leadership, the role of a mentor holds paramount importance. The ability to guide, inspire, and empower team members is fundamental to fostering a thriving work environment. However, what happens when a manager is tasked with both managerial responsibilities and the role of a mentor? This delicate balancing act is riddled with challenges and complexities. In this blog post, we'll explore the perils and pitfalls of being both a manager and a mentor and discuss effective strategies to navigate this intricate terrain.
Partnerships can change the trajectory of a business, but only when they are built around real value rather than vague optimism. In practice, the best collaborations do not happen because two companies simply like the idea of working together. They happen because each side brings something the other lacks, and because that relationship creates a better outcome for clients, operations, or long-term growth. This requires a clear understanding of what each partner can offer, as well as a willingness to adapt and compromise in order to achieve mutually beneficial results....
Today, I want to open up about a challenge that has been a constant companion on my entrepreneurial journey—the struggle to separate my personal feelings, passion, and drive from my day-to-day business operations. Early in my career, wearing my heart on my sleeve was an asset. It helped me connect with clients, foster deep relationships, and gain trust.
