Block local admins from bypassing Gatekeeper on macOSSolved

Local administrator users on macOS can natively override standard Gatekeeper prompts using the “Open Anyway” option in System Settings. A standard Gatekeeper restriction can set the allowed app source, but it does not always prevent a local admin from manually approving a blocked app. To fully prevent this behavior, deploy a custom macOS configuration profile that enforces Gatekeeper lockdown using the DisableOverride key. This disables the Gatekeeper override option so local admins cannot approve blocked third-party apps manually.

Recommended approach:

1. Create a non-encrypted .mobileconfig profile using Apple Configurator, ProfileCreator, or another profile-generation tool.
2. Configure the profile to disable Gatekeeper override by enabling the DisableOverride key in the appropriate Gatekeeper/System Policy Control payload.
3. In Hexnode, go to Policies > macOS > Configurations > Deploy Custom Configuration.
4. Upload the .mobileconfig profile.
5. Assign the policy to the target Mac devices or device groups and save the policy.

Once the profile is applied successfully, the “Open Anyway” option is disabled, preventing local admins from bypassing Gatekeeper for blocked apps.

That explains the behavior I was seeing. I was looking for a built-in Hexnode toggle like “Allow users to override Gatekeeper,” but I couldn’t find one in the macOS restrictions page. Is Hexnode supposed to have a ready-made profile for this?

Hexnode can deploy the required configuration profile, but a pre-configured DisableOverride profile is not provided by default. You would need to create the .mobileconfig file externally and upload it through the Deploy Custom Configuration policy. The key point is that the standard restriction and the custom profile solve different parts of the problem:

• The standard Gatekeeper restriction controls the allowed app installation source.
• The custom profile with DisableOverride prevents local administrators from overriding Gatekeeper from System Settings.

For environments where users must remain local admins, the custom configuration profile is the required method to block the admin override path.