Help CenterPlease Note: For organizations deploying to a large amount of endpoints, ThreatLocker recommends using a staggered deployment approach. Organizations that deploy to a large number of endpoints at once may experience increased bandwidth usage as macOS Core and application definitions are downloaded to each endpoint. QOS can be used to limit bandwidth to macapps.threatlocker.com.
Below, you will find the steps for MAC deployment through Jamf Pro.
Step 1: Set up the ThreatLocker MDM Configuration Profiles
Please Note: To allow for smooth remote installation of the ThreatLocker agent on MacOS, have the MDM profiles deployed to all Mac devices before the ThreatLocker agent installation is attempted. Beware, remote installation of ThreatLocker on MacOS using an RMM without using an MDM is not recommended because an RMM alone cannot set these required permissions.
Use the link below to download the current version 3 ThreatLocker MDM profiles.
From the downloaded file above, extract the included .mobileconfig files:
-
ThreatLocker Configuration (Required)
-
ThreatLocker Startup & Lock (Required)
-
ThreatLocker Network Core (Required)
-
ThreatLocker Network ZTNA + ZTCA (Required for ZTNA and ZTCA)
All profiles should be added to your MDM as separate configuration profiles and scoped to your Mac devices.
Login to JAMF Pro, navigate to the ‘Computers’ page and click on ‘Configuration Profiles’. Click on the ‘Upload’ button and import one of the ThreatLocker .mobileconfig files from the above link.
Once imported, define the scope by navigating to the Scope Tab. Then click Add.
On the ‘Add Deployment Targets’ page, click ‘Computer Groups’, Then click ‘Add’ next to all of the groups you wish to deploy to. Finally click ‘Save’
Step 2: Create the Script
After the Configuration Profile is imported and saved, head to the Settings page and search for “Scripts”
After clicking on Scripts, click on Add and enter a display name for the new script.
Under the Script tab, import our MDM deployment script from the ThreatLocker portal into Jamf Pro.
To see where to get the latest version of our MDM script, please see the 'RMM Deployment' section of Deploying ThreatLocker | ThreatLocker Help Center (kb.help)
Be sure to replace the GroupKey with the group key of the Mac group, which can be located here.
Step 3: Add the Deployment Script to the Policy
After saving the profile, click on Policies and New to create a new policy. Give the policy a name and add your ThreatLocker deployment script to the policy.
Be sure to also define a scope for the policy before saving it.
ThreatLocker should now be deployed to the machines defined within your scope.