New DEX certifications launch at Experience '26. Get certified and learn from experts in your field.
Register now
Ctrlk
LearnDocumentationSupportCommunity
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Deploying Collector in Jamf

Deploy Nexthink Collector to macOS devices managed in Jamf Pro. The process involves creating a custom deployment package, configuring full disk access permissions, preventing employees from disabling Collector, and deploying the package.

1

Create a custom package

  1. Extract the following file from the downloaded Collector DMG file into a folder:

    • csi.app

    Add the following file to the same folder:

    • Customer Key.txt

  2. Open the folder in Jamf Composer to create a new package.

  3. Set file permissions as follows:

    File
    Owner
    Group
    Everyone

    csi.app

    Read, execute

    Read, execute

    Read, execute

    Customer Key.txt

    Read

    Read

    —

  4. Add a meaningful name for the package.

  5. Add a postinstall shell script to the package and configure the following:

    • Set BASE_PATH to the folder containing the installation files.

    • Set KEYFILE to the path and filename of the Customer Key.txt file.

  6. Set the installer arguments and the clean-up section.

  7. Build and save the package as a PKG file.

  8. In Jamf Pro, navigate to Settings > Computer management > Packages.

  9. On the General tab, create a new package and assign the PKG installation file to it.

  10. On the Options tab, set Priority to 2 to ensure the package deploys as soon as possible.

  11. Save the package.

2

Create a Collector configuration profile

Nexthink Collector relies on the Apple Endpoint Security framework and follows Apple privacy guidelines. Some Collector components need full disk access to collect complete data and run Remote actions on devices.

When deploying Collector version 26.5 or later, you can postpone granting full disk access. The Collector installs successfully and runs in limited mode. It starts full data collection and can run Remote actions only after you grant full disk access.

Collector versions earlier than 26.5 require full disk access at deployment time and cannot postpone it.

The following components require full disk access:

  • nxtsvc: Collects core device data and binary executions and connections events. Permission for this module is mandatory; required by Apple Endpoint Security and Apple privacy controls.

  • nxtcod: Executes Remote actions on user devices and sends results back to Nexthink. Permission for this module is optional; grant it only if Remote actions need access to special folders or shared network resources.

Pre-authorize full disk access to these components before deploying Collector by pushing a Privacy Preferences Policy Control (PPPC) configuration profile. Select the applicable method from the following tabs and perform the procedure described in it:

Nexthink provides a single configuration profile that grants full disk access to both nxtsvc.app and nxtcod.app.

Nexthink-Collector-Full-Disk-Access.xml
3KB
Open

Perform the following steps for both nxtsvc (mandatory) and nxtcod (optional):

  1. In Jamf, select Computers > Configuration Profiles.

  2. Select Privacy Preferences Policy Control > Configure.

  3. Fill in the Identifier and Code Requirement fields.

Getting the Identifier and Code Requirement values for nxtsvc

Identifier

To obtain the Identifier, run the following command on devices where Collector is installed:

sudo codesign -dv /Library/Application\ Support/Nexthink/nxtsvc.app

This displays a response with the value of the Identifier, such as com.nexthink.nxtsvcapp.

Insert that output to the Identifier field in Jamf.

Code Requirement

To obtain the Code Requirement, run the following command on devices where Collector is installed:

sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtsvc.app

Insert the output in the Code Requirement field in Jamf.

Getting the Identifier and Code Requirement values for nxtcod

Identifier

To obtain the Identifier, run the following command on devices where Collector is installed:

sudo codesign -dv /Library/Application\ Support/Nexthink/nxtcod.app

This displays a response with the value of the Identifier, such as com.nexthink.nxtcod.

Insert that output to the Identifier field in Jamf.

Code Requirement

To obtain the Code Requirement, run the following command on devices where Collector is installed:

sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtcod.app

Insert the output in the Code Requirement field in Jamf.

  1. Select Add.

  2. Under App or service access, set SystemPolicyAllFiles to Allow.

  3. Select Scope to define the scope of the profile.

Approve the Nexthink system extension

Nexthink Collector loads its Apple Endpoint Security component as a system extension. Without prior approval, macOS blocks the extension and prompts the user to approve it manually.

To avoid this prompt, add a System Extensions payload to the same configuration profile, allowing team identifier PDEKAZ43QL.

Do not also list PDEKAZ43QL under explicit bundle identifiers in the same or another profile. Apple rejects configurations that specify the same team identifier in both the team-identifier and bundle-identifier allow lists.

3

Prevent employees from disabling Collector

By default, macOS allows employees to disable background applications, including Collector. To prevent this:

  1. In Jamf, select Computers > Configuration Profiles.

  2. Select Privacy Preferences Policy Control > Configure.

  3. Copy the team identifier from the Code Requirement field; it is the last value in the string.

  4. Select Managed Login Items.

  5. Set the Team Identifier rule to the team identifier obtained in the previous step.

  6. Ensure the Include toggle is enabled.

4

Deploy the package

Refer to the official Jamf documentation to learn how to deploy packages with Jamf Pro.

Last updated

Was this helpful?