Microsoft System Center For Mac
- Microsoft announced in November 2018 that it was discontinuing support for System Center Endpoint protection for Mac on December 31, 2018. As a result, OIT is transitioning to ESET Endpoint Antivirus as the recommended antivirus software for university owned Mac computers. See the ESET Endpoint Antivirus page fto learn how to download and install the antivirus agent.
- Apr 12, 2018 Note: macOS 10.12 (Sierra) and macOS 10.13 (High Sierra) are currently only supported on System Center Configuration Manager (current branch) The following scenarios are supported through the Mac client in Microsoft System Center Configuration Manager: Discovery – Discovers Mac OS X system in Active Directory and through network discovery.
Nov 29, 2019 Note. The Start menu path changed in version 1910. In version 1906 and earlier, the folder name is Microsoft System Center.When you update Configuration Manager to version 1910 or later, make sure to update any internal documentation that you maintain to. System Center Endpoint Protection includes an Endpoint Protection client for Linux and for Mac computers. These clients aren't supplied with Configuration Manager. Download the following products from the Microsoft Volume Licensing Service Center.
Download the Mac client msi file to a Windows system; Run the msi and it will create a dmg file under the default location “C: Program Files Microsoft System Center Configuration Manager for Mac client ” on the Windows system; Copy the dmg file to a network share or a folder on a Mac computer.
Applies to: Configuration Manager (current branch)
Endpoint Protection manages antimalware policies and Windows Firewall security for client computers in your Configuration Manager hierarchy.
Important
You must be licensed to use Endpoint Protection to manage clients in your Configuration Manager hierarchy.
When you use Endpoint Protection with Configuration Manager, you have the following benefits:
- Configure antimalware policies, Windows Firewall settings, and manage Microsoft Defender Advanced Threat Protection to selected groups of computers
- Use Configuration Manager software updates to download the latest antimalware definition files to keep client computers up-to-date
- Send email notifications, use in-console monitoring, and view reports. These actions inform administrative users when malware is detected on client computers.
Beginning with Windows 10 and Windows Server 2016 computers, Windows Defender is already installed. For these operating systems, a management client for Windows Defender is installed when the Configuration Manager client installs. On Windows 8.1 and earlier computers, the Endpoint Protection client is installed with the Configuration Manager client. Windows Defender and the Endpoint Protection client have the following capabilities:
- Malware and spyware detection and remediation
- Rootkit detection and remediation
- Critical vulnerability assessment and automatic definition and engine updates
- Network vulnerability detection through Network Inspection System
- Integration with Cloud Protection Service to report malware to Microsoft. When you join this service, the Endpoint Protection client or Windows Defender downloads the latest definitions from the Malware Protection Center when unidentified malware is detected on a computer.
Note
The Endpoint Protection client can be installed on a server that runs Hyper-V and on guest virtual machines with supported operating systems. To prevent excessive CPU usage, Endpoint Protection actions have a built-in randomized delay so that protection services do not run simultaneously.
In addition, you manage Windows Firewall settings with Endpoint Protection in the Configuration Manager console.
Example scenario: Using System Center Endpoint Protection to protect computers from malware Endpoint Protection and the Windows Firewall.
Managing Malware with Endpoint Protection
Endpoint Protection in Configuration Manager allows you to create antimalware policies that contain settings for Endpoint Protection client configurations. Deploy these antimalware policies to client computers. Then monitor compliance in the Endpoint Protection Status node under Security in the Monitoring workspace. Also use Endpoint Protection reports in the Reporting node.
Additional information:
How to create and deploy antimalware policies for Endpoint Protection - Create, deploy, and monitor antimalware policies with a list of the settings that you can configure
How to monitor Endpoint Protection - Monitoring activity reports, infected client computers, and more.
How to manage antimalware policies and firewall settings for Endpoint Protection - Remediate malware found on client computers
Managing Windows Firewall with Endpoint Protection
Endpoint Protection in Configuration Manager provides basic management of the Windows Firewall on client computers. For each network profile, you can configure the following settings:
Enable or disable the Windows Firewall.
Block incoming connections, including those in the list of allowed programs.
Notify the user when Windows Firewall blocks a new program.
Note
Endpoint Protection supports managing the Windows Firewall only.
For more information, see How to create and deploy Windows Firewall policies for Endpoint Protection.
Microsoft Defender Advanced Threat Protection
Endpoint Protection manages and monitors Microsoft Defender Advanced Threat Protection (ATP), formerly known as Windows Defender ATP. The Microsoft Defender ATP service helps enterprises detect, investigate, and respond to advanced attacks on the corporate network. For more information, see Microsoft Defender Advanced Threat Protection.
Endpoint Protection Workflow
Microsoft System Center Virtual Machine Manager
Use the following diagram to help you understand the workflow to implement Endpoint Protection in your Configuration Manager hierarchy.
Endpoint Protection Client for Mac Computers and Linux Servers
Important
Support for System Center Endpoint Protection (SCEP) for Mac and Linux (all versions) ends on December 31, 2018. Availability of new virus definitions for SCEP for Mac and SCEP for Linux may be discontinued after the end of support. For more information, see End of support blog post.
System Center Endpoint Protection includes an Endpoint Protection client for Linux and for Mac computers. These clients aren't supplied with Configuration Manager. Download the following products from the Microsoft Volume Licensing Service Center:
System Center Endpoint Protection for Mac
System Center Endpoint Protection for Linux
Note
You must be a Microsoft Volume License customer to download the Endpoint Protection installation files for Linux and the Mac.
These products can't be managed from the Configuration Manager console. A System Center Operations Manager management pack is supplied with the installation files, which allows you to manage the client for Linux.
How to get the Endpoint Protection client for Mac computers and Linux servers
Use the following steps to download the image file containing the Endpoint Protection client software and documentation for Mac computers and Linux servers.
- Sign in to the Microsoft Volume Licensing Service Center.
- Select the Downloads and Keys tab at the top of the website.
- Filter on product System Center Endpoint Protection (current branch).
- Click link to Download
- Click Continue. You should see several files, including one named: System Center Endpoint Protection (current branch - version 1606) for Linux OS and Macintosh OS Multilanguage 32/64 bit 1878 MB ISO.
- To download the file, click the arrow icon. The file name is SW_DVD5_Sys_Ctr_Endpnt_Prtctn_1606_MultiLang_-3_EptProt_Lin_Mac_MLF_X21-67050.ISO.
The January 2018 update (X21-67050) includes the following versions:
System Center Endpoint Protection for Mac 4.5.32.0 (support for macOS 10.13 High Sierra)
System Center Endpoint Protection for Linux 4.5.20.0
For more information about how to install and manage the Endpoint Protection clients for Linux and Mac computers, use the documentation that accompanies these products. This product documentation is in the Documentation folder of the .ISO file.
Applies to: Configuration Manager (current branch)
This article describes how to deploy and maintain the Configuration Manager client on Mac computers. To learn about what you have to configure before deploying clients to Mac computers, see Prepare to deploy client software to Macs.
When you install a new client for Mac computers, you might have to also install Configuration Manager updates to reflect the new client information in the Configuration Manager console.
Microsoft System Center Virtual Machine Manager 2016
In these procedures, you have two options for installing client certificates. Read more about client certificates for Macs in Prepare to deploy client software to Macs.
Use Configuration Manager enrollment by using the CMEnroll tool. The enrollment process doesn't support automatic certificate renewal. Re-enroll the Mac computer before the installed certificate expires.
Use a certificate request and installation method that is independent from Configuration Manager.
Important
To deploy the client to devices running macOS Sierra, correctly configure the Subject name of the management point certificate. For example, use the FQDN of the management point server.
Configure client settings
Use the default client settings to configure enrollment for Mac computers. You can't use custom client settings. To request and install the certificate, the Configuration Manager client for Mac requires the default client settings.
In the Configuration Manager console, go to the Administration workspace. Select the Client Settings node, and then select Default Client Settings.
On the Home tab of the ribbon, in the Properties group, choose Properties.
Select the Enrollment section, and then configure the following settings:
Allow users to enroll mobile devices and Mac computers: Yes
Enrollment profile: Choose Set Profile.
In the Mobile Device Enrollment Profile dialog box, choose Create.
In the Create Enrollment Profile dialog box, enter a name for this enrollment profile. Then configure the Management site code. Select the Configuration Manager primary site that contains the management points for these Mac computers.
Note
If you can't select the site, make sure that you configure at least one management point in the site to support mobile devices.
Choose Add.
In the Add Certification Authority for Mobile Devices window, select the certification authority server that issues certificates to Mac computers.
In the Create Enrollment Profile dialog box, select the Mac computer certificate template that you previously created.
Select OK to close the Enrollment Profile dialog box, and then the Default Client Settings dialog box.
Tip
If you want to change the client policy interval, use Client policy polling interval in the Client Policy client setting group.
The next time the devices download client policy, Configuration Manager applies these settings for all users. To initiate policy retrieval for a single client, see Initiate policy retrieval for a Configuration Manager client.
In addition to the enrollment client settings, make sure that you have configured the following client device settings:
Hardware inventory: Enable and configure this feature if you want to collect hardware inventory from Mac and Windows client computers. For more information, see How to extend hardware inventory.
Compliance settings: Enable and configure this feature if you want to evaluate and remediate settings on Mac and Windows client computers. For more information, see Plan for and configure compliance settings.
For more information, see How to configure client settings.
Download the client for macOS
Download the macOS client file package, Microsoft Endpoint Configuration Manager - macOS Client (64-bit). Save ConfigmgrMacClient.msi to a computer that runs Windows. This file isn't on the Configuration Manager installation media.
Run the installer on the Windows computer. Extract the Mac client package, Macclient.dmg, to a folder on the local disk. The default path is
C:Program FilesMicrosoftSystem Center Configuration Manager for Mac client.Copy the Macclient.dmg file to a folder on the Mac computer.
On the Mac computer, run Macclient.dmg to extract the files to a folder on the local disk.
In the folder, make sure that it contains the following files:
Ccmsetup: Installs the Configuration Manager client on your Mac computers using CMClient.pkg
CMDiagnostics: Collects diagnostic information related to the Configuration Manager client on your Mac computers
CMUninstall: Uninstalls the client from your Mac computers
CMAppUtil: Converts Apple application packages into a format that you can deploy as a Configuration Manager application
CMEnroll: Requests and installs the client certificate for a Mac computer so that you can then install the Configuration Manager client
Enroll the Mac client
Enroll individual clients with the Mac computer enrollment wizard.
To automate enrollment for many clients, use the CMEnroll tool.
Enroll the client with the Mac computer enrollment wizard
After you install the client, the Computer Enrollment wizard opens. To manually start the wizard, select Enroll from the Configuration Manager preference page.
On the second page of the wizard, provide the following information:
User name: The user name can be in the following formats:
domainname. For example:contosomnorthuser@domain. For example:mnorth@contoso.comImportant
When you use an email address to populate the User name field, Configuration Manager automatically populates the Server name field. It uses the default name of the enrollment proxy point server and the domain name of the email address. If these names don't match the name of the enrollment proxy point server, fix the Server name during enrollment.
The user name and corresponding password must match an Active Directory user account that has Read and Enroll permissions on the Mac client certificate template.
Server name: The name of the enrollment proxy point server.
Client and certificate automation with CMEnroll
Use this procedure for automation of client installation and requesting and enrollment of client certificates with the CMEnroll tool. To run the tool, you must have an Active Directory user account.
On the Mac computer, navigate to the folder where you extracted the contents of the Macclient.dmg file.
Enter the following command:
sudo ./ccmsetupWait until you see the Completed installation message. Although the installer displays a message that you must restart now, don't restart, and continue to the next step.
From the Tools folder on the Mac computer, type the following command:
sudo ./CMEnroll -s <enrollment_proxy_server_name> -ignorecertchainvalidation -u '<user_name>'After the client installs, the Mac Computer Enrollment wizard opens to help you enroll the Mac computer. For more information, see Enroll the client by using the Mac computer enrollment wizard.
Example: If the enrollment proxy point server is named server02.contoso.com, and you grant contosomnorth permissions for the Mac client certificate template, type the following command:
sudo ./CMEnroll -s server02.contoso.com -ignorecertchainvalidation -u 'contosomnorth'Note
If the user name includes any of the following characters, enrollment fails:
<>'+=,. Use an out-of-band certificate with a user name that doesn't include these characters.For a more seamless user experience, script the installation steps. Then users only have to supply their user name and password.
Type the password for the Active Directory user account. When you enter this command, it prompts for two passwords. The first password is for the super user account to run the command. The second prompt is for the Active Directory user account. The prompts look identical, so make sure that you specify them in the correct sequence.
Wait until you see the Successfully enrolled message.
To limit the enrolled certificate to Configuration Manager, on the Mac computer, open a terminal window and make the following changes:
Enter the command
sudo /Applications/Utilities/Keychain Access.app/Contents/MacOS/Keychain AccessIn the Keychain Access window, in the Keychains section, choose System. Then in the Category section, choose Keys.
Expand the keys to view the client certificates. Find the certificate with a private key that you installed, and open the key.
On the Access Control tab, choose Confirm before allowing access.
Browse to /Library/Application Support/Microsoft/CCM, select CCMClient, and then choose Add.
Choose Save Changes and close the Keychain Access dialog box.
Restart the Mac computer.
To verify that the client installation is successful, open the Configuration Manager item in System Preferences on the Mac computer. Also update and view the All Systems collection in the Configuration Manager console. Confirm that the Mac computer appears in this collection as a managed client.
Tip
To help troubleshoot the Mac client, use the CMDiagnostics tool included with the Mac client package. Use it to collect the following diagnostic information:
- A list of running processes
- The Mac OS X operating system version
- Mac OS X crash reports relating to the Configuration Manager client including CCM*.crash and System Preference.crash.
- The Bill of Materials (BOM) file and property list (.plist) file created by the Configuration Manager client installation.
- The contents of the folder /Library/Application Support/Microsoft/CCM/Logs.
The information collected by CmDiagnostics is added to a zip file that is saved to the desktop of the computer and is named cmdiag-<hostname>-<datetime>.zip
Manage certificates external to Configuration Manager
You can use a certificate request and installation method independent from Configuration Manager. Use the same general process, but include the following additional steps:
When you install the Configuration Manager client, use the MP and SubjectName command-line options. Enter the following command:
sudo ./ccmsetup -MP <management point internet FQDN> -SubjectName <certificate subject name>. The certificate subject name is case-sensitive, so type it exactly as it appears in the certificate details.Example: The management point's internet FQDN is server03.contoso.com. The Mac client certificate has the FQDN of mac12.contoso.com as a common name in the certificate subject. Use the following command:
sudo ./ccmsetup -MP server03.contoso.com -SubjectName mac12.contoso.comIf you have more than one certificate that contains the same subject value, specify the certificate serial number to use for the Configuration Manager client. Use the following command:
sudo defaults write com.microsoft.ccmclient SerialNumber -data '<serial number>'.For example:
sudo defaults write com.microsoft.ccmclient SerialNumber -data '17D4391A00000003DB'
Renew the Mac client certificate
This procedure removes the SMSID. The Configuration Manager client for Mac requires a new ID to use a new or renewed certificate.
Important
After you replace the client SMSID, when you delete the old resource in the Configuration Manager console, you also delete any stored client history. For example, hardware inventory history for that client.
Create and populate a device collection for the Mac computers that must renew the computer certificates.
In the Assets and Compliance workspace, start the Create Configuration Item Wizard.
On the General page of the wizard, specify the following information:
Name: Remove SMSID for Mac
Type: Mac OS X
On the Supported Platforms page, select all Mac OS X versions.
On the Settings page, select New. In the Create Setting window, specify the following information:
Feb 05, 2020 Hello, I was following the 'Notes won't Sync' instructions today about how to sync my notes on OneNote from my Mac to my Ipad Pro. I closed the Notebook in order to open the notebook in the app by clicking 'open in-app' through the OneNote website. Apr 07, 2020 I'm trying to export my OneNote 2016 for Mac notebook. Tried to use onenote.com, I see my notebook here, but when I click on Export option in context menu, only a blank window appears and nothing happens. Tried two different MACs, one Windows laptop, different browsers - window with export settings is empty. Tech support scams are an industry-wide issue where scammers trick you into paying for unnecessary technical support services. You can help protect yourself from scammers by verifying that the contact is a Microsoft Agent or Microsoft Employee and that the phone number is an official Microsoft global customer service number. Can't download onenote to mac site answers.microsoft.com pc. Oct 17, 2018 1. Add both your personal OneDrive account and your Office 365 Work or School account to OneNote for Mac, open the notebooks on your OneDrive for Business and the personal one. Right click on a section and select Copy Section to to copy it to the notebooks stored on your personal OneDrive. Repeat the action until all the contents are copied. Other download options For the best compatibility, we recommend the 32-bit version. If you already have other 64-bit Office products installed, use the 64-bit version of OneNote.
Name: Remove SMSID for Mac
Setting type: Script
Data type: String
In the Create Setting window, for Discovery script, select Add script. This action specifies a script to discover Mac computers configured with an SMSID.
In the Edit Discovery Script window, enter the following shell script:
Choose OK to close the Edit Discovery Script window.
In the Create Setting window, for Remediation script (optional), choose Add script. This action specifies a script to remove the SMSID when it's found on Mac computers.
In the Create Remediation Script window, enter the following shell script:
Choose OK to close the Create Remediation Script window.
On the Compliance Rules page, choose New. Then in the Create Rule window, specify the following information:
Name: Remove SMSID for Mac
Selected setting: Choose Browse and then select the discovery script that you previously specified.
In the following values field: The domain/default pair of (com.microsoft.ccmclient, SMSID) does not exist.
Enable the option to Run the specified remediation script when this setting is noncompliant.
Complete the wizard.
Create a configuration baseline that contains this configuration item. Deploy the baseline to the target collection.
For more information, see How to create configuration baselines.
After you install a new certificate on Mac computers that have the SMSID removed, run the following command to configure the client to use the new certificate: