HowTo import .mobileconfig files without MDM Server?

[massoo]

Hello All,

We do not have any external MDM tied to our MAC devices. We use CrowdStrike as antivirus which requires "Full Disk Access" and "Web Preferences" Extensions Enabled. These are granted while we install CrowdStrike manually.

We are trying to import the official CrowdStrike profile in our MAC M1 and later laptops with their OS being macOS Ventura 13.x , as detailed in https://supportportal.crowdstrike.com/s/article/ka16T000000wtMWQAY

The command that we are using to import is :
> open /System/Library/PreferencePanes/Profiles.prefPane ~/Desktop/MAC/Official-CS-Falcon-Profile-no-Kext.mobileconfig
- This opens up the Profiles utility, where user can accept the prompts and install the profile.
- This profile is not signed (meaning its unsigned)

However this fails with error:

Profile installation failed
The profile must originate from a user-approved MDM server

I have also tried to install the profile with self-signed certificate, but the error is same

Is there a way to install / import a profile without an MDM Server ?

Please guide me

 

[deliriouscat]

It sounds like you're dealing with a tricky situation there. I found a method that might help. After exporting your .mobileconfig file, you can create a package to deploy this file to a known location on your client systems, for example, /Library/myOrg. It's important to note that simply deploying the file to this location won't install it. Apple provides a command-line tool called 'profiles' which can be used as part of a post-install script included in the package that deploys the .mobileconfig file. You might find this guide useful for more details. Here's an example of what the post-install script could look like:

Code:

#!/bin/bash

/usr/bin/profiles -I -F "/Library/MyOrganization/YourProfile.mobileconfig"

rm "/Library/MyOrganization/YourProfile.mobileconfig"

In this script, you should replace "/Library/MyOrganization/YourProfile.mobileconfig" with the quoted path to the .mobileconfig file deployed by the package.

 

[massoo]

The above method mentioned by @deliriouscat does not work, while running the shell file in the terminal prompt as:

sudo sh ~/Desktop/MAC/csprofile.sh

throws error as:

profile tool no longer supports installs. Use System Settings Profiles to add configuration profile

The ~/Desktop/MAC/csprofile.sh is

#!/bin/bash

/usr/bin/profiles -I -F "/Library/MyOrganization/YourProfile.mobileconfig"

Looks we are stuck for now and cannot import a configuration profile without MDM