MacOS Agent Change Log

Key

  • + New Feature
  • * Bug Fix
  • - General Change

Version 3.6.0

  • * Important: fixed the agent deleting users' home folders. From version 3.3.0, whenever the agent listed the Mac's users (when the Users tab refreshed, after a user change and, from 3.3.2, shortly after the agent started), it removed any folder in /Users that it did not match to a user. The user list could occasionally come back incomplete, so a real user's home folder could be deleted. The account and installed apps were not affected. Without Full Disk Access, Desktop, Documents and parts of Library usually survived, but settings, keychains, app data and development setups were lost. All Macs should be upgraded to 3.6.0. If a user reports their settings or files have reset, restore their home folder from backup
  • * The agent now only removes the home folder of a user it has just deleted itself, and only if that folder still belongs to the deleted account
  • * Fixed: after an upgrade the agent's program file could be owned by the Mac's first user, who could then replace a program that runs as root. The agent now resets its folder to root ownership every time it starts
  • * Download File from URL: an HTTP error (such as 404) now fails the task instead of saving the error page as the file, "replace existing file" now works, missing folders are created, and the next task waits for the download to finish (up to one hour)
  • * Services tab: a service now shows as Running only when it is actually running
  • * Last software update now shows the last macOS update, not the last app installed
  • * The reported user is now the person signed in at the screen, not a Terminal or SSH session
  • * Execute Shell Command: on a timeout, programs the command started are now stopped as well
  • * Agent upgrades now run as a separate background job, so stopping the old agent can no longer cut the upgrade off half way and leave the Mac without an agent. The upgrade starts 90 seconds after the task so that its result reaches the portal first

Version 3.5.3

  • * Grant Secure Token now works when the technician's password starts with "-", "[", "{", "(" or "<"
  • * Every password the agent passes to macOS, apart from the managed admin's own generated password, is now passed in a way macOS cannot misread
  • - When macOS refuses a change with "Operation is not permitted without secure token unlock", the task result now explains why and what to do

Version 3.5.2

  • * "Require password reset on login" now works on macOS 27, and the task reports whether it worked. Other password policies on the account are no longer wiped when it is set
  • + A password reset at next login can now be required without changing the password
  • * Creating an account whose name contains a space now applies "Require password reset on login" correctly. The task result arrives about 60 seconds later than before
  • * Task results that finished while the agent was checking in could be lost. Fixed
  • - The managed admin account cannot be made to require a password reset

Version 3.5.1

  • * Passwords that begin with "-" or "[" can now be set. macOS read them as a command option and did nothing, which looked like "only simple passwords work". Passwords are now passed to macOS in a way that avoids this for password resets, account creation and the managed admin account
  • - There is no restriction on which characters a password may contain. The only thing refused is a line break
  • * Resetting the password of an account without a secure token (below macOS 26) now checks the new password actually works before reporting success
  • * Command output containing accented or other non-ASCII characters is no longer discarded. Previously a single accented character could make a user appear to have no secure token, or make the Users tab come back empty

Version 3.5.0

  • + Managed admin account: the agent creates a hidden administrator (_btadmin) holding a secure token on each Mac. Apple requires a secure token holder to authorise changes to other token holders, and from macOS 26 this is the only way local user management works at all
  • + The managed admin's password is generated on the Mac itself, never sent from the server, and is rotated every 90 days or on demand
  • + Secure token setup by a technician supplying an existing token holder's credentials, or by prompting the logged-in user for their own password. Neither credential is stored or logged
  • + Managed admin status (secure token, token holders, rotation due) is reported on every check-in
  • + The agent reports whether it has Full Disk Access. Full Disk Access is required to delete an account with a secure token; all other user management works without it
  • + New Execute Shell Command task: runs the command line through /bin/sh, so quoting, pipes, && and redirection work. stdout, stderr and the exit code are reported separately, with a configurable timeout (1-3600 seconds, default 60) and an option to run as the logged-in user. Matches the Linux and Windows agents
  • * Password resets, deletions and account creation now work on current macOS versions, including token-holding accounts, by authenticating as the managed admin
  • * New accounts get a secure token when created, so they can unlock FileVault and approve software updates. If an account ends up without one, the job result says so
  • * Deleting a user now works on macOS 26.1 and later. A deletion that macOS would refuse is stopped before it starts, so the user's home folder is no longer removed while the account is left behind
  • * "Require a new password at next login" now works reliably across macOS versions
  • * Task results were sometimes not matched to their task on the server, so results from collection jobs were lost. Fixed
  • * A password check can no longer report a password as valid when the check itself failed to run
  • - Passwords are never written to the agent log or returned in task results
  • - Minimum supported version is now macOS 11.0 Big Sur
  • - Signed with the Dalegroup Developer ID certificate
  • - Uninstalling the agent leaves the managed admin account in place, so a Mac is never left without a secure token holder

Version 3.3.1

  • * Fixed error with new standard users not getting the specified password.
  • - Cannot change password for locally created users due to Apple's secure token. This now gives a more helpful error message.
  • + Deleting a locally added user works but it may not completely remove the user directory until after a reboot.
  • + Added ability to request a password reset. This requires a reboot to trigger it. Only tested manually, but works with locally created users.

Version 3.3

  • + Added ability to list local users and groups.
  • + Added ability to modify users: password, enabled status, admin status.
  • + Added ability to delete users (not available on dashboard yet).

Version 3.2

  • + For M series laptops, GPU and CPU temp can now be reported

Version 3.1

  • + Build for Apple Silicon (M series chips) as well as Intel.
  • + Added services commands: get_services, restart_service, stop_service, start_service.
  • + Added Network tab support
  • + Added Storage tab support
  • - Increase minimum target to macOS 10.15.
  • - Improved software update check to report system updates only.
  • - Updated the free memory check which was not correct on modern Macs due to change in page size.

----------------------

For Mac OS 10.14.3 and lower you also need to install the Swift 5 Runtime Support for Command Line Tools (We recommend you install this first but you can also install afterwards)

Version 2.0.1

  • + Split out OS info (OS Name & OS Build) to allow for better reporting
  • + Create local admin account task supported
  • * Fixes to agent reliability

Version 2.0.0

  • + First release of native MacOS agent

Added Monday 10th August 2020 Last modified Thursday 15th October 2026