Mac Health Check

A significant update to the practical and user-friendly approach to surfacing Mac health information directly to end-users via Jamf Pro Self Service

Overview

Mac Health Check provides a practical and user-friendly approach to surfacing Mac compliance information directly to end-users via Jamf Pro Self Service.

Built using the open-source utility swiftDialog, the solution acts as a “heads-up display” that presents real-time system health and policy compliance status in a clear and interactive format.

Deployment of Mac Health Check involves configuring organizational defaults, embedding the script in Jamf Pro, creating a policy to run it on demand and testing to ensure proper output and behavior.

Administrators can customize the user interface using swiftDialog’s visual capabilities, making the experience both informative and approachable.

The tool logs results for review, while not altering device configuration, and a new "Silent" Operation Mode makes Mac Health Check ideal for IT visibility without end-user intrusion.

Four Corners & Silver State September 2025 Meetup (25-Sep-2025)

Use Cases

Mac Health Check is particularly valuable in IT support workflows, serving as an initial triage point for Tier 1 support by confirming network access, credentials, and Jamf Pro connectivity, while also acting as a verification tool for Tier 2 teams both during and after remediation efforts.

Step Zero for Tier 1

• User has a working Internet connection
• User knows their directory credentials
• Mac can execute policies
• Validates Network Access Controls

Step Ninety-nine for Tier 2

• Initial assessment for support sessions
• Easily confirms remediation efforts
• Provides peace-of-mind for end-users

Silent Mode

• Silently performs all health checks and logs results
• No dialog is presented to the end-user
• Ideal for background compliance reporting
• Complements existing MDM compliance frameworks

Features

The following health checks and information reporting are included and the script operates in “test” mode by default. (Change operationMode to production when ready to deploy in production.)

Health Checks

1. macOS Version
2. Available Updates (including deferred and DDM-enforced updates)
3. System Integrity Protection
4. Signed System Volume (SSV)
5. Firewall
6. FileVault Encryption
7. Gatekeeper / XProtect
8. Touch ID 🆕
9. VPN Client
10. Last Reboot
11. Free Disk Space
12. User's Directory Size and Item Count
    • Desktop
    • Downloads
    • Trash
13. MDM Profile
14. MDM Certificate Expiration
15. Apple Push Notification service
16. Jamf Pro Check-in
17. Jamf Pro Inventory
18. Extended Network Checks
    • Apple Push Notification Hosts
    • Apple Device Management
    • Apple Software and Carrier Updates
    • Apple Certificate Validation
    • Apple Identity and Content Services
    • Jamf Hosts
19. Electron Corner Mask 🆕 🔗
20. Organizationally required Applications (i.e., Microsoft Teams)
21. BeyondTrust Privilege Management*
22. Cisco Umbrella*
23. CrowdStrike Falcon*
24. Palo Alto GlobalProtect*
25. Network Quality Test
26. Update Computer Inventory

*Requires external check

Information Reporting

IT Support

• Telephone
• Email
• Website
• Knowledge Base Article

User Information

• Full Name
• User Name
• User ID
• Secure Token
• Location Services
• Microsoft OneDrive Sync Date
• Platform Single Sign-on Extension

Computer Information

• macOS version (build)
• System Memory
• System Storage
• Dialog version
• Script version
• Computer Name
• Serial Number
• Wi-Fi SSID
• Wi-FI IP Address
• VPN IP Address

Jamf Pro Information**

• Jamf Pro Computer ID
• Site

**Payload Variables for Configuration Profiles

Policy Log Reporting

MHC (2.6.0): 2025-11-06 03:43:13 - [NOTICE] WARNING: 'localadmin' IS A MEMBER OF 'admin';
User: macOS Server Administrator (localadmin) [503] staff everyone localaccounts _appserverusr 
admin _appserveradm com.apple.sharepoint.group.4 com.apple.sharepoint.group.3
com.apple.sharepoint.group.1 _appstore _lpadmin _lpoperator _developer _analyticsusers
com.apple.access_ftp com.apple.access_screensharing com.apple.access_ssh com.apple.access_remote_ae
com.apple.sharepoint.group.2; Bootstrap Token supported on server: YES;
Bootstrap Token escrowed to server: YES; sudo Check: /etc/sudoers: parsed OK;
sudoers: root  ALL = (ALL) ALL %admin  ALL = (ALL) ALL ; Platform SSOe: localadmin NOT logged in;
Location Services: Enabled; SSH: On; Microsoft OneDrive Sync Date: Not Configured;
Time Machine Backup Date: Not configured; localadmin's Desktop Size: 160M for 116 item(s);
localadmin's Trash Size: 1.8M for 3 item(s); Battery Cycle Count: 0; Wi-Fi: Liahona;
Ethernet IP address: 17.113.201.250; VPN IP: 17.113.201.250; 
Network Time Server: time.apple.com; Jamf Pro Computer ID: 007; Site: Servers

1. Warning when logged-in user is a member of admin
2. Deferred Software Updates
3. Logged-In User Group Membership
4. Bootstrap Token
5. sudoers
6. Kerberos SSOe
7. Location Services
8. SSH
9. Time Machine
10. Battery Cycle Count
11. Network Time Server
12. Jamf Pro Computer ID

Support

Community-supplied, best-effort support is available on the Mac Admins Slack (free, registration required) #mac-health-check Channel, or you can open an issue.

Deployment

Deployment of Mac Health Check involves configuring organizational defaults, embedding the script in Jamf Pro, creating a policy to run it on demand and testing to ensure proper output and behavior.

Continue reading …