Install (JAMF)

The macOS forwarder collects files from Intel and Apple Silicon Macs, but it will not install into a vacuum: macOS has to be told, by configuration profile, to permit the system extension and grant full disk access. Jamf's job here is to guarantee those profiles land before the package does.

That ordering is the whole design of this page. You build three configuration profiles, then a smart computer group whose membership requires all three, then point the install policy at that group. A machine cannot receive the package until it already has the profiles, so the failure mode where the installer runs early and fails cannot happen.

You will need a Stairwell environment ID and a forwarder authentication token before you start.

🚧
Do not start with your crown jewels
The forwarder's first act is a full-disk backscan, which is I/O-heavy for a few hours and then subsides. Treat your first several installs as sacrificial: they upload the most unique files, and every later install is cheaper because Stairwell already knows what the earlier ones sent. See Forwarder Performance Tuning.

1. Create Configuration Policies

1A. Create System Extension Policy

Log into Jamf Pro
Under Computers ➡️ Content Management, Select Configuration Profiles
Select + New
Under Options ➡️ General
- Name: Stairwell Forwarder System Extension Policy
- Level: Computer Level
- Distribution Method: Install Automatically
Under Options ➡️ System Extensions, Select Configure
Check the box for Allow users to approve system extensions
Under Allowed Team IDs and System Extensions
- Display Name: Stairwell System Extension Policy
- System Extension Types: Allowed System Extensions
- Team Identifier: 677UQVFGY8
Under Allowed System Extensions, Select + Add
- Type in: com.stairwell.Inception.ProcessMonitor
- Select Save
Under Options ➡️ Scope ➡️ Selected Deployment Targets, Select + Add
- Select the desired computer, user, group, etc
- Select Add
Select 💾 Save

📘
Optional System Extension Type
Instead of selecting "Allowed System Extensions", you can select "Allow Team Identifiers" and skip the Allows System Extension setup. This is a less restrictive setting.

1B. Create Privacy Policy

Under Content Management, Select Configuration Profiles
Select + New in top right
Under Options ➡️ General
- Name: Stairwell Forwarder Privacy Policy
- Level: Computer Level
- Distribution Method: Install Automatically
Under Options ➡️ Privacy Preferences Policy Control, Select Configure
- Identifier: com.stairwell.Inception.ProcessMonitor
- Identifier Type: Bundle ID
- Code Requirement: anchor apple generic and identifier "com.stairwell.Inception.ProcessMonitor" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "677UQVFGY8")
Under APP OR SERVICE, Select + Add
- Select SystemPolicyAllFiles
- Select Allow
- Select Save
Under Options ➡️ Scope ➡️ Selected Deployment Targets, Select + Add
- Select the desired computer, user, group, etc
- Select Add
Select 💾 Save

1C. Create Application Settings Policy

Under Content Management, Select Configuration Profiles
Select + New in top right
Under Options ➡️ General
- Name: Stairwell Forwarder Settings Policy
- Level: Computer Level
- Distribution Method: Install Automatically

Under Options ➡️ Applications & Custom Settings ➡️ External Applications, Select + Add

Source: Custom Schema
Preference Domain: com.stairwell.Inception.ProcessMonitor
Select + Add schema under Custom Schema

{  
  "description": "Preference settings for Stairwell Forwarder",  
  "title": "Stairwell Forwarder",  
  "properties": {  
    "EnvId": {  
      "title": "Environment ID",  
      "description": "Stairwell Environment ID",  
      "property_order": 5,  
      "type": "string"  
      },  
    "RegistrationToken": {  
      "title": "Registration Token",  
      "description": "Token used to register assets",  
      "property_order": 10,  
      "type": "string"  
    },  
    "Debug": {  
      "title": "Debug Logging",  
      "description": "Enables debug logging. Defaults to false",  
      "property_order": 75,  
      "type": "boolean"  
    }  
  }  
}

Environment ID: Environment ID
Registration Token: File Forwarder Token
Debug Logging: false

Under Options ➡️ Scope ➡️ Selected Deployment Targets, Select + Add
- Select the desired computer, user, group, etc
- Select Add
Select 💾 Save

📘
Fleets where MAC addresses are not stable
By default a Mac identifies itself to Stairwell by computer name plus primary MAC address. If your machines change MAC -- or are imaged from a template that already had the forwarder installed -- add a STAIRWELL_REGISTRATION_KEY string property to the custom schema above and set it per machine to something stable and unique, such as the hardware serial. Read Asset Identifiers first: it is read only at first registration, so it has to be right before the rollout, not after.

2. Create Smart Computer Group

Under Computers ➡️ Groups, Select Smart Computer Groups
Select + New
Under Computer Group
- Display Name: Stairwell Forwarder Profiles
Under Criteria, Select + Add
Select Show Advanced Criteria
Find Profile Name and Select Choose (repeat this 2 more times)
Under Criteria
- Operator: Has
- Value: Stairwell Forwarder System Extension Policy
- AND/OR: and
- Operator: Has
- Value: Stairwell Forwarder Privacy Policy
- AND/OR: and
- Operator: Has
- Value: Stairwell Forwarder Settings Policy
Select 💾 Save

3. Create Application Package

Download the current macOS forwarder package
Under Settings ➡️ Computer Management, Select Packages
Select + New
Under General ➡️ Filename, Select Choose File
Select the downloaded package
Select 💾 Save

📘
Upload failed: undefined error
If you encounter this error, please check the Cloud Services Connection.

4. Create New Policy

Under Computers ➡️ Content Management, Select Policies
Select + New
Under Options ➡️ General
- Display Name: Stairwell Forwarder
- Enabled: ☑️
- Trigger: Recurring Check-in
Under Options ➡️ Packages
- Select Configure
- Find the package created in Step 3, Select Add
- Distribution Point: Each computer's default distribution point
- Action: Install
Under Scope ➡️ Targets ➡️ Selected Deployment Targets
- Select + Add
- Select Computer Groups
- Find the group created in Step 2, Select Add
Select 💾 Save

📘
Additional Notes

If the profile payloads from the steps above are incorrect or not present before the installer runs, the installation will fail and require remediation.

Once the above configuration profiles, smart groups, packages, and policies are created, Jamf Pro will automatically install the package on the machines which have the required profiles.

5. Confirm Installation

Navigate to app.stairwell.com and log in
Select Assets
Select the newly created asset name(s) to confirm files are arriving
Check the count under All Objects

Ingestion takes a few minutes to become visible. An asset that appears and then stays at zero objects is usually the Privacy Preferences profile: without SystemPolicyAllFiles, the forwarder runs, reports in, and sees only what macOS lets any unprivileged process see. That reads as a successful deployment right up until someone asks why coverage is thin. See macOS Troubleshooting.

Do all of this against a pilot machine or two before you widen the scope.

What should I read next?

macOS Forwarder downloads, for the current package and its release notes.
Anti-Tamper on macOS, before you try to remove or replace a forwarder.
Install (Generic MDM), if some of your Macs are managed elsewhere.