Driving 100% OS Compliance Across 105 Corporate Endpoints
IT Support Intern, Global Corporate IT (EUC)
- JumpCloud
- PowerShell
- JumpCloud REST API
Outcome
Achieved 100% OS version compliance across 105 endpoints across 3 regions
Context
The corporate fleet ran a mix of macOS versions across Singapore, TST, and remote users. Security required all endpoints on a minimum OS version, but there was no central compliance dashboard, compliance was tracked manually by asking people to check their version.
Problem & Constraints
- 105 endpoints across 3 regions
- No central visibility into OS versions
- Users couldn't be forced to update during work hours
- IT had no automated enforcement mechanism
- Some endpoints hadn't been updated in 6+ months
Approach
Used JumpCloud's policy framework to define the minimum OS version requirement. Wrote PowerShell scripts that queried the JumpCloud REST API for every endpoint's reported OS version, compared against the policy baseline, and generated a non-compliance report. Coordinated the rollout with Facilities (office endpoints), EUC, and the TST office.
The approach prioritised visibility first, enforcement second. By giving teams a clear report of where they stood, compliance became self-correcting before policy enforcement was needed.
Implementation
The PowerShell script authenticated against JumpCloud's API, pulled all system records, filtered by OS type and version, and output a CSV of non-compliant devices with assigned user, last check-in time, and OS delta. This ran as a scheduled task. Non-compliant users received automated reminders. Policy enforcement in JumpCloud set the minimum version; systems below threshold were flagged.
Outcome
- 100% OS compliance across all 105 endpoints within 6 weeks
- Compliance dashboard updated daily instead of manually checked quarterly
- Zero security incidents related to outdated OS versions post-rollout
- Rollout coordinated across EUC, TST, and Facilities without disruption
Reflection
The coordination overhead was higher than expected, regional teams had different change windows. In hindsight, staggering the rollout by region with a 1-week buffer would have been smoother. The reporting script worked well but could have been a real-time dashboard instead of a scheduled CSV dump.