Skip to main content

Generic Deployment and PPPC Payload for Full Disk Access

Annie Ballew
  • Updated

Team: Huntress Product Support
Product: Huntress Endpoint Protection / Agent
Environment: MacOS with Systems Manager
Summary: Generic Deployment and Privacy Preferences Policy Control (PPPC) payload for Full Disk Access

 

Each MDM solution uses different workflows to install the Huntress agent and grant permissions. This document goes over generic requirements for deploying the Huntress agent; we recommend that you consult your MDM's documentation on its deployment steps and workflows for additional details.   

 

Overview

The installation of Huntress through an MDM or remote management tool consists of 2 items: 

  1. Installation of the Huntress agent via generic deployment script  
  2. Generic PPPC Payload for Full Disk Access  

 

Installation of the Huntress agent via generic deployment script 

Huntress uses a deployment script to deploy the Huntress macOS agent so that your unique Huntress Account Key and assigned Organization Key can be applied to the agent during installation. A generic deployment script is available here.

 

  1. Retrieve your Account Key:  
    1. Hover over the Huntress options menu in the upper-right corner of the dashboard.
      mceclip1.png
    2. Select the "Download Agent" option from the menu.
      mceclip2.png
    3. On the Installer page click the clipboard icon to copy your secret account key to your clipboard; this will come in handy later in the deployment process. mceclip3.png

       

  2. Download or copy the Generic Bash script for macOS Agent installs into the scripting engine/component of your management tool. 

     

  3. Scroll down to lines 44 and 48 of this generic bash script.  Screenshot_2022-11-03_at_10.10.46_PM.png
    1. Update Line 44 with your Account Key (copied from step 1)
    2. Update Line 48 with an assigned Organization Key (which can be either a new value or found in your Huntress portal under Home > Organizations)
    3. Update Line 52 with the name of your RMM or management solution (i.e. Jamf Pro). This value is used for support inquiries.    

       

  4. This completes the first step of the installation process to deploy the Huntress macOS agent via your RMM or management solution.  

 

Generic PPPC Payload for Full Disk Access

Download a pre-configured PPPC payload to upload to your MDM

This step requires an MDM solution. Refer to your MDM solution's documentation on how to deploy a PPPC Payload for Full Disk Access. Click here for more information on Full Disk Access.  

Huntress requires the following parameters when building and deploying a PPPC Payload:  

Payload type: com.apple.TCC.configuration-profile-policy

Identifier type: Bundle ID

Allow or Deny: Allow

 

  Huntress Agent version 0.13.70 and older
Identifier com.huntresslabs.www
Bundle ID identifier "com.huntresslabs.www" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "7W6HQ9J9XA"

 

  Huntress Agent version 0.13.72 and newer
Identifier for agent com.huntress.app
Bundle ID for agent identifier "com.huntress.app" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "7W6HQ9J9XA"
Identifier for system extension com.huntress.sysext
Bundle ID for extension identifier "com.huntress.sysext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "7W6HQ9J9XA"

 

Upon rolling out your PPPC profile, in many cases it will not appear in System Preferences or System Settings (Ventura) of the endpoint under Full Disk Access. 

If deploying without a PPPC profile, to test, do the following: If you have access to the endpoint, one way to check if Full Disk Access has been applied is to grant Terminal Full Disk Access, then from an open Terminal window, issue the following command:
For agent 0.13.70 and older:
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles" and client="com.huntresslabs.www"'
If Full Disk Access is successfully applied, that command should return on agent 0.13.70 and older:
com.huntresslabs.www
For agent 0.13.72 and newer:
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles" and client="com.huntress.app"'
and
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles" and client="com.huntress.sysext"'
If Full Disk Access is successfully applied, that command should return on agent 0.13.72 and newer:
com.huntress.app
and
com.huntress.sysext
If deploying with an MDM that uses a PPPC profile to grant Full Disk Access, the Huntress agent may not show up in the System Settings or in the TCC database. To test if the Huntress app has Full Disk Access with an MDM, issue the following command:
For agent 0.13.70 and older:
sudo plutil -p /Library/Application\ Support/com.apple.TCC/MDMOverrides.plist | grep -zo '"com.huntresslabs.www" => {\s*"kTCCServiceSystemPolicyAllFiles"'
If Full Disk Access is successfully applied, that command should return:
"com.huntresslabs.www" => {
    "kTCCServiceSystemPolicyAllFiles"
For agent 0.13.72 and newer:
sudo plutil -p /Library/Application\ Support/com.apple.TCC/MDMOverrides.plist | grep -zo '"com.huntress.app" => {\s*"kTCCServiceSystemPolicyAllFiles"'

which should return:

com.huntress.app => {
     "kTCCServiceSystemPolicyAllFiles"
and
sudo plutil -p /Library/Application\ Support/com.apple.TCC/MDMOverrides.plist | grep -zo '"com.huntress.sysext" => {\s*"kTCCServiceSystemPolicyAllFiles"'

Which should return:

com.huntress.sysext => {
     "kTCCServiceSystemPolicyAllFiles"

Download PPPC payload

Comments

3 comments

Date Votes
  • Ryan Grimes

    Can you just post the mobileconfig file for us to download?  It would make this a million times easier.

    0
  • Stuart Ashenbrenner

    Hi Ryan Grimes. We went ahead and updated the kb to include a PPPC payload that you can use. Hopefully that helps! Let me know if you have any issues with it.

    0
  • Ryan Grimes

    Funny I was just emailed it as well.  Great support as always!

    0

Please sign in to leave a comment.

Related articles