Managing Legacy Kernel Extensions in macOS Using Jamf Pro

Technical Articles

Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

With macOS 11, additional steps are needed to load and use legacy kernel extensions. This requires user approval in System Preferences > Security & Privacy (macOS 12 or earlier) or System Settings > Privacy & Security, and computers must be restarted to load the kernel extension into a kernel cache. You can use the technologies in Jamf Pro to complete this additional process using MDM.

Note:

On Mac computers with Apple silicon, Rosetta 2 does not translate kernel extensions built for Intel processors. Ensure your app or software supports Apple silicon.

For more information, see the following articles from Apple's support website:
You can use both a configuration profile in the Jamf Pro interface or Jamf Pro API to execute the RestartDevice MDM command to load the legacy kernel extension cache. This process looks similar to the following:
1. Create a computer configuration profile with an Approved Kernel Extensions payload.
The profile allows you to pre-approve the required kernel extensions for the software you are installing on target computers. When the profile is installed on the computers, the kernel extensions specified in the profile are can be loaded on target computers.
2. Restart the computer using one of the following methods:
You can use the MDM Restart with Kernel Cache Rebuild option in Jamf Pro to restart the computer after installing the software.
Note:

Restarting the computer using the MDM Restart with Kernel Cache Rebuild option in Jamf Pro is the recommended restart method.

You can use the Jamf Pro API to execute the RestartDevice MDM command to restart the computer after installing the software. Jamf Pro can include the following keys with the RestartDevice MDM command:
  • RebuildKernelCacheThis key is required to rebuild the kernel cache to include the specified kernel extension in the configuration profile.
  • KextPathsThis key is optional and allows you to define the specific file path of the kernel extensions file that need to be loaded on target computers. Kernel extensions that have attempted to load previously may automatically be added by macOS to the rebuilding of the kernel cache.
  • NotifyUserThis key is optional and prompts macOS to display a persistent Notification Center banner for a user to restart the computer. If the user does not restart the computer, the kernel cache will not be rebuilt and any required kernel extensions will not be approved until the computer is restarted. This key applies to computers with macOS 11.3 or later only.
    Important:

    If this key is not specified, the computer immediately restarts when the command is received and could result in data loss.

    When the RestartDevice MDM command is sent to the computer, the computer restarts and the kernel cache is rebuilt to include the specified kernel extensions