Skip to content

Magic Toolbox v1.0.3

Latest
Latest

Choose a tag to compare

View all tags
@MDMMagic MDMMagic released this 22 Oct 19:58
· 2 commits to main since this release
1.0.3
602aeb3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Magic Toolbox 1.0.3

A redesigned Home screen, three new tools, a PIN lock for sensitive tools, and much safer write operations across Clone, Wipe, Disable and Restore.

Highlights

  • Redesigned Home screen. The 21 tools are grouped into four categories you open with a click: Jamf Pro Tools, Audit & Health Check, Profile Builders and Content & Packages, each showing how many tools it holds. Saved Servers sit just above them, and a new tile opens the MDM Reporting Tool. If a tool is still writing to Jamf Pro in the background, a banner says so and the other tools wait until it finishes.
  • Three new tools
    • Network Check tests whether this Mac can reach the endpoints Jamf, Apple, Microsoft, Google, Okta, CrowdStrike, Zoom and Slack need, plus any hosts you add. Export the results as HTML.
    • Profile Signer signs .mobileconfig profiles and .pkg installers with a certificate from your keychain.
    • Profile Unsigner removes the signature from profiles and packages so you can read and edit them.
  • Tool Lock. Require a PIN before chosen tools (Wipe, for example) can be opened.
  • Undo for every write tool. Clone backs up destination objects before overwriting them, Disable saves an undo backup, Wipe has a dry run, and Restore can now write objects back in place.
  • Honest results. When something can't be read from Jamf Pro, the audit tools say the results are incomplete instead of reporting an all-clear.

New

  • The MDM Reporting Tool tile opens the app, or its web page if it isn't installed. Set it up, or hide the tile, in Preferences → Third-Party Tools.
  • Preferences → Profile Signing Certificate picks the certificate Profile Signer uses.
  • Clone, Wipe, Disable, Restore and Unused deletes write a journal of every change as it happens, so there's a record even if the app is force-quit.

Safer changes to Jamf Pro

Clone

  • Asks for a passphrase and saves an encrypted, verified backup of every destination object before overwriting it. Open it in Restore to put the old objects back.
  • Clone Scope never widens a scope. Missing target groups are left out, and a missing exclusion or limitation fails the object instead.
  • Existing destination objects keep their scope when you choose No Scope.
  • References to categories, scripts, packages and so on are matched by name on the destination, never by the source's IDs.
  • New option: Create static groups without members.

Disable

  • Saves an encrypted undo backup of the original enabled state and scope first. Undo from backup… puts it all back.
  • Warns that removing scope uninstalls profiles and apps from devices.
  • Won't disable the account you're signed in with, or an account whose status can't be read.

Wipe

  • Dry run shows exactly what would be deleted, in order, without deleting anything.
  • Deleting needs the server's host name typed to confirm.
  • Your own session's credentials are skipped unless you choose to delete them last.
  • Items that can't be restored need a separate acknowledgement, or can be excluded in one click.
  • Selecting a group no longer deletes the policies scoped to it. They're listed as related items you can opt in to.

Restore

  • New Update existing objects mode writes backed-up objects over live ones.
  • Opens Clone backups, re-links restored objects to each other's new IDs, and has an Abort button.

All backups need a passphrase of at least 12 characters, are readable only by your user account, and are read back and checked before anything changes.

Improved

Audit tools

  • Unused: new matching rules (PreStages, patch titles, printers, criteria and more), deletion is blocked for incomplete categories, and references are re-checked just before deleting.
  • Account Audit: covers local and LDAP account groups, and flags custom privilege sets with critical privileges.
  • Cert & Token Expiry: adds the active CA certificate's expiry.
  • Smart Group Audit: takes OR and parentheses into account, and has no limit on how many groups it audits.
  • Profile Conflicts: rewritten detection. macOS and iOS profiles are compared separately, Wi-Fi, VPN and certificates are compared per network or certificate, different-group scopes are flagged as a possible overlap, and secrets are redacted.

Profile builders

  • Uploads ask before overwriting a profile with the same name.
  • Generated profiles get stable identifiers, so re-uploading updates the profile on devices instead of adding a second one.
  • PPPC Analyser: User Can Allow for Screen Recording and Input Monitoring, manual code requirements for apps from a .pkg, an Apple Events receiver picker, and warnings before a profile blocks camera, microphone or screen sharing.
  • System Extensions: accepts .dext, writes every type an extension has, and asks you to confirm a Team ID taken from an installer.
  • Login Item Profiles: finds helpers and launch items inside apps, and is Allow-only to match Apple's payload.
  • Web Content Filter: saving follows the same validation as uploading.

Everything else

  • Inspector now verifies package and app signatures, shows the Distribution XML, and has new review findings.
  • Compare evaluates building, department and network segment scope, and can ignore case when comparing servers.
  • Icons shows the policy's name and asks you to confirm before attaching an icon.
  • Downloader no longer overwrites files with the same name.
  • The app asks before you quit or close the window while a tool is writing to Jamf Pro.
  • Saved servers can be reordered, and tools store a link to a saved server rather than a copy of its secret.
  • Throttled requests are retried automatically, and sign-in errors show what Jamf Pro actually returned.
  • Licences are re-checked every 6 hours while the app runs. After the offline grace period the licence key is kept, so it comes back as soon as the app is online again.

Before you upgrade

  • Login Item Profiles rules set to Deny or Ask are dropped, because Apple's payload only supports Allow.
  • The Web Content Filter Identity certificate field has been removed.
  • Saved Jamf credentials are now only readable while the Mac is unlocked.
  • Inspector may contact Apple to check whether a package's signing certificate has been revoked.

Full documentation: Magic Toolbox wiki

Assets 3
Loading