BigFix and Jamf Privacy Protections and Inventory Collection

Usage and Purpose

UC Berkeley IT uses BigFix and Jamf for managing and securing campus computers, specifically: configuration management, assuring secure configurations, ensuring security by assuring patch compliance, providing source data for security investigations, inventory management, delivery of applications, and system details to enable desktop support. Any uses beyond this list must be reviewed and approved through the campus Privacy Balancing process.

Privacy and Data Access

UC Berkeley respects your privacy and confidentiality. BigFix and Jamf retrieve user account data from your computer, which is often but not always your CalNet ID. These applications do not collect any personal or sensitive information (browser history, emails, saved passwords, calendar events, contacts, etc).

BigFix and Jamf retrieve properties (data) that are essential to managing and securing your campus computer. The data collected is only available to UC Berkeley employees who have agreed to abide by all of the UC acceptable use and data access policies, including the University of California Electronic Communications Policy (ECP). Access to the data is contingent on both manager and Berkeley IT approvals and is restricted to the minimum scope that is necessary for that specific employee or system.

Inventory Data Collected

The following table includes some but not all of the data retrieved by BigFix and Jamf.

Property	Information Retrieved
Hardware and Software
Computer Name	The name of your computer.
BIOS	The vendor, version and/or date of your computer's BIOS.
Computer Model	Your computer's model name as provided by the vendor; also indicates whether your computer is a "laptop," "workstation," or "server."
CPU / Architecture	The type, model, speed, and architecture (Intel/ARM) of the central processor.
Space / RAM	Total and free space on all drives; amount of RAM installed.
Serial Number	Your computer's serial number as provided by the vendor.
Applications	The names and versions of applications currently installed on your computer.
Operating System
Account Security	Checks for local accounts with blank passwords. Only account names are retrieved; passwords are never collected.
Uptime / Boot Time	The date and time the computer was last started and total runtime.
OS Details	Type (32/64bit), version, service pack level, and language.
User / Login Data	Current logged-on username, last login timestamp, and logon history.
System Services	Services and processes currently running; automatic update settings and schedules.
Computer Security
Encryption Status	Whether hard drives are encrypted; FileVault recovery keys (macOS/Jamf only).
Security Agents	Status and Agent ID of EDR Trellix; Windows Defender settings and signature status.
macOS Security	Status of System Integrity Protection, Gatekeeper, XProtect, and Bootstrap Tokens.
Patching Status	Update and patching compliance for both the OS and supported applications.
Network
Network Identity	Active Directory path, DNS name, and Domain/Workgroup membership.
Network Addresses	Client IP addresses and hardware MAC addresses.
File Servers	List of file servers currently mapped to the computer.