Help CenterNote: For organizations deploying to a large amount of endpoints, ThreatLocker recommends using a staggered deployment approach. Organizations that deploy to a large number of endpoints at once may experience increased bandwidth usage as macOS Core and application definitions are downloaded to each endpoint. QOS can be used to limit bandwidth to macapps.threatlocker.com
Below, you will find the steps for MAC deployment through Microsoft Intune.
Step 1: Import Configuration Profile for ThreatLocker
In the Intune portal, head to Devices > macOS Devices > Configuration and click on Create > New Policy.
Select the 'Templates' profile type and 'Custom' template name in the' Create a Profile' pane.
MDM configuration profiles automatically set rights and preferences for the ThreatLocker Agent. When configurd by MDM, the end user will not be prompted to manually enter admin credentials. These profiles on their own do not install any software; they only set needed rights and preferences to enable smooth remote installation of the ThreatLocker Agent.
Please Note: To allow for smooth remote installation of the ThreatLocker agent on MacOS, have the MDM profiles deployed to all Mac devices before the ThreatLocker agent installation is attempted. Beware, remote installation of ThreatLocker on MacOS using an RMM without using an MDM is not recommended because an RMM alone cannot set these required permissions.
Use the link below to download the current version 3 ThreatLocker MDM profiles.
From the downloaded file above, extract the included .mobileconfig files:
-
ThreatLocker Configuration (Required)
-
ThreatLocker Startup & Lock (Required)
-
ThreatLocker Network Core (Required)
-
ThreatLocker Network ZTNA + ZTCA (Required for ZTNA and ZTCA)
All profiles should be added to your MDM as separate configuration profiles and scoped to your Mac devices.
Step 2: Import Deployment Script for ThreatLocker
Note: If the script does not deploy as intended, ThreatLocker highly recommends recreating the script on a macOS device. Due to the differences in how Windows encodes the script, recreating the script on a macOS device should cause the script to run without the potential issue. Once the script has been recreated make sure to name the Script as Threatlocker_Install.Sh
Download the MDM deployment script from the ThreatLocker portal and save it as “ThreatLockerDeploymentScript-MDM.sh”
To see where to get the latest version of our MDM script, please see the 'RMM Deployment' section of Deploying ThreatLocker | ThreatLocker Help Center (kb.help)
Locate your GroupKey and replace it in the code "xxxxxxxxxxxxxxxxxxxxxxxx".
Save the file as ThreatLocker_Install.sh
From Intune, Navigate to Devices > macOS > Shell Scripts > Select Add
Name the script ThreatLocker Deployment Script and Select Next
Under Upload script, navigate to the ThreatLocker_Install.sh file
Select the following options:
- Run the script as a signed-in user: No
- Hide script notifications on devices: Yes
- Script frequency: Every 1 day (this can be reduced to 15 minutes for testing)
- Max number of times to retries if script fails: 3 times
Add to the Same Group as the Configuration Profile has been added.
Select Next > Add
You can monitor the deployment through the script overview:
