studentd

executablemacOS2.3 MBx86_64, arm64

Device management daemon — enforces MDM policies and device controls

Implements Mobile Device Management (MDM) enforcement on macOS by reading and applying configuration profiles from the MDM server. Controls system behaviors including display settings via SkyLight, manages process lifecycle, and accesses device identity through iMessage services. Integrates with keychain for certificate and code signing validation, submits analytics telemetry to Apple, and communicates with nine network endpoints for policy synchronization. Runs with hardened runtime protections and manages restricted application group access through XPC services.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 2.3 MB
UUID: 6653B5BE-0190-342B-9E71-B76DE949A65D
Analyzed: 2026-04-09T10:06:37Z
CDHash: d33c45e279773a8114dfaf53f05ef61ec1f7725e42f0afa5d8e76781f574b749

Capabilities

KeychainRead and write system keychain items

com.apple.private.system-keychain [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.classroom com.apple.studentd com.apple.identities com.apple.certificates

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-write

/Library/Application Support/Apple/

StorageException: access additional file paths

com.apple.security.exception.files.home-relative-path.read-write

/Library/Caches/

StorageAddress book access

/System/Library/Frameworks/Contacts.framework/Versions/A/Contacts

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

IpcRestricted application group access

com.apple.private.security.restricted-application-groups

group.com.apple.studentd

IpcQuery process state from RunningBoard

com.apple.runningboard.process-state [object Object]

IpcShared application group container access

com.apple.security.application-groups

group.com.apple.studentd

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDS

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SystemControl display via SkyLight (window server)

com.apple.private.SkyLight.displaycontrol [object Object]

SystemAccess MDM configuration profiles

com.apple.private.managedclient.configurationprofiles [object Object]

SystemProcess lifecycle management

/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServices

SystemMDM configuration profiles

/System/Library/PrivateFrameworks/ConfigurationProfiles.framework/Versions/A/ConfigurationProfiles

SystemMDM device management

/System/Library/PrivateFrameworks/DeviceManagement.framework/Versions/A/DeviceManagement

Entitlements40

application-identifier com.apple.studentd

com.apple.ClassroomKit.BooksService-accesstrue

com.apple.accounts.appleaccount.fullaccesstrue

com.apple.application-identifier com.apple.studentd

com.apple.avfoundation.allow-system-wide-contexttrue

com.apple.avfoundation.allows-access-to-device-listtrue

com.apple.avfoundation.allows-set-output-devicetrue

com.apple.developer.ClassKit-environment production

com.apple.developer.hardened-processtrue

com.apple.dmd-accesstrue

com.apple.dmd.operation.fetch-safari-bookmarkstrue

com.apple.launchservices.allowedlaunchenvironmentvariables

StudentdProcessIdentifier

com.apple.private.ClassKit.dashboardtrue

com.apple.private.ClassKit.internaltrue

com.apple.private.SkyLight.displaycontroltrue

com.apple.private.accounts.allaccountstrue

com.apple.private.canGetAppLinkInfotrue

com.apple.private.ids.firewalltrue

com.apple.private.ids.idquery-cachetrue

com.apple.private.ids.idsquerytrue

com.apple.private.ids.messaging

com.apple.private.alloy.classroom

com.apple.private.ids.messaging.urgent-priority

com.apple.private.alloy.classroom

com.apple.private.iokit.batterydataprecisetrue

com.apple.private.launchservices.allowedtolaunchwithenvironmentvariablestrue

com.apple.private.managedclient.configurationprofilestrue

com.apple.private.notificationcenter-system

com.apple.studentd

com.apple.private.safari.can-read-bookmarkstrue

com.apple.private.security.restricted-application-groups

group.com.apple.studentd

com.apple.private.system-keychaintrue

com.apple.private.tcc.allow

kTCCServiceAddressBook kTCCServiceScreenCapture kTCCServiceSystemPolicyDownloadsFolder

com.apple.private.usernotifications.bundle-identifiers

com.apple.studentd.notifications

com.apple.runningboard.process-statetrue

com.apple.security.application-groups

group.com.apple.studentd

com.apple.security.exception.files.absolute-path.read-write

/Library/Application Support/Apple/

com.apple.security.exception.files.home-relative-path.read-write

/Library/Caches/

com.apple.security.personal-information.addressbooktrue

com.apple.security.temporary-exception.shared-preference.read-write com.apple.classroom

com.apple.wirelessproxd-locationtrue

keychain-access-groups

com.apple.classroom com.apple.studentd com.apple.identities com.apple.certificates

platform-applicationtrue

Interesting Strings

Bundle IDs(131)

com.apple.application-identifier com.apple.studentd.notifications0) com.apple.wirelessproxd-location !com.apple.private.alloy.classroom0/!com.apple.private.alloy.classroom0V

File Paths(49)

#/Library/Application Support/Apple/0V /Library/Caches/08 /System/Library/Classroom/ClassroomStudentMenuExtra.app /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation /System/Library/Frameworks/AVRouting.framework/Versions/A/AVRouting

telemetry(23)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics @"<STUAnalyticsPrimitives>"@"<STUAnalyticsPrimitives>"16@0:8 Failed to report analytics event %{public}@STUAnalyticsEnrollmentEvent

URLs & Endpoints(6)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://

Network Surface

Networking Frameworks

AVFoundation CoreFoundation Foundation libswiftCoreFoundation.dylib

Endpoints(9)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

HostnameCcom.apple.security.temporary-exception.shared-preference.read-write

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

2

Network

1

Storage

3

Hardware

1

IPC

4

Analytics

1

Security

2

System

5

Behavioral Profile

URL Endpoints

6

Telemetry Strings

23

File Paths

49

Bundle IDs

131

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codef611190bbc6f7fc1d19cc41789697c382b39252802eba6f6ac67f2b1ffd200f3

Importsc72a5a7efa2c8a878feada7de7cf6c1f01dde6dbe67be4eb0b981ade8d7c35cb

Frameworks4688ed53bb76fcd945f9672c6281a6676b3b699dd7c0b70b64520d3e20fedf02

Classes0b024cd33c25673f5af1a833c68bf6835cb4d257360db960a9cddc5da6d5f360

Entitlements47ed9cd2213786cfb96488dc52f188152087755979e6b0326992eb144a007f98

Symbols6735a176a9bc52a159d7cc2454bfd7cd4a25713fb011d71955c7c6607dcc0384

Static Libraries0 / 3871 functions identified

Functions(3871)

0x100001e60-[STUMockWorkspaceOpenConfiguration init]

0x100001ec0-[STUMockWorkspaceOpenConfiguration activates]

0x100001ec8-[STUMockWorkspaceOpenConfiguration setActivates:]

0x100001ed0-[STUMockWorkspaceOpenConfiguration createsNewApplicationInstance]

0x100001ed8-[STUMockWorkspaceOpenConfiguration setCreatesNewApplicationInstance:]

0x100001ee0-[STUMockWorkspaceOpenConfiguration promptsUserIfNeeded]

0x100001ee8-[STUMockWorkspaceOpenConfiguration setPromptsUserIfNeeded:]

0x100001ef0-[STUMockWorkspaceOpenConfiguration environment]

0x100001ef8-[STUMockWorkspaceOpenConfiguration setEnvironment:]

0x100001f00-[STUMockWorkspaceOpenConfiguration .cxx_destruct]

0x100001f0c+[STUCourseIdentifierMetadataTracker sharedTracker]

0x100001f50sub_100001f50

0x100001f94-[STUCourseIdentifierMetadataTracker _init]

0x100002014-[STUCourseIdentifierMetadataTracker classSessionDidConnectWithCourseIdentifier:]

0x1000020cc-[STUCourseIdentifierMetadataTracker classSessionDidDisconnectWithCourseIdentifier:]

0x100002184-[STUCourseIdentifierMetadataTracker setValue:forKey:courseIdentifier:]

0x100002244-[STUCourseIdentifierMetadataTracker removeValueForKey:courseIdentifier:]

0x100002254-[STUCourseIdentifierMetadataTracker valueForKey:courseIdentifier:]

0x1000022dc-[STUCourseIdentifierMetadataTracker numberOfConnectionsForCourseIdentifier:]

0x100002320-[STUCourseIdentifierMetadataTracker .cxx_destruct]

Imports683 symbols from 30 dylibs

ClassroomKit360 CoreFoundation58 Foundation47 libSystem.B.dylib44 libobjc.A.dylib39

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

BTLEServerAgent