mikeymikey: “Sounds like some Quicktime codec support changes coming again.… ”
Tim Hardwick: “I’ve been testing Folder Actions in macOS Mojave 10.14.1, and the results aren’t good. Apple needs to look at how new security approvals are implemented for workflows containing Apple Event scripts, because the reliability of automated actions has taken a dive.”
William Smith: “Microsoft Remote Desktop for Mac 10.2.4 beta introduces… SCRIPTING SUPPORT! See today’s announcement in #microsoft-rdc channel on #MacAdmins Slack for details and usage. Run ”Microsoft Remote http://Desktop.app/Content/macOS/Microsoft … Remote Desktop” –script help
Greg Neagle: “Ralph Breaks the Internet opens today in the US and some other markets! Be sure to stay through the credits for mid-credits and post-credits scenes!”
User groups are easy, right? A user is either a member or they are not.
Once you start thinking about the deatils and want or need to automate some of the aspects of user and group management on macOS, there is a lot of devil in those details.
You can easily list all groups a given user is a member of. The id command will show all the groups the current user is a member of. id -Gn will list just the groups. Add a username to the id command to see the information for a different user. The groups command does the same as id -Gn.
You can also run a command to check if a given user is a member of a group:
$ dseditgroup -o checkmember -m user staff
yes user is a member of staff
$ dseditgroup -o checkmember -m user wheel
no user is NOT a member of wheel
So far, so good.
A user is a member of a group when one of these applies:
the user’s PrimaryGroupID attribute matches the PrimaryGroupID of the group
the user’s UUID is listed in the group’s GroupMembers attribute and the user’s shortname is listed in the group’s GroupMembership
the user is a member of a group nested in the group
Note: you should not attempt to manipulate the GroupMembers or GroupMembership attributes directly. Use the dseditgroup -o edit command to manage group membership instead. dseditgroup syntax is weird, but it is a really useful tool. Study its man page.
Listing Group Members
Sometimes (mainly for security audits) you need to list all the members of a group. With the above information, it is easy enough to build a script that checks the PrimaryGroupID, the GroupMembership attribute and the recursively loops through the NestedGroups.
This is confused by the fact that PrimaryGroupID stores the numeric User ID, GroupMembership uses the shortname and NestedGroups uses UUIDs. Nevertheless, you can sort through it.
I have written exactly such a script here:
In most cases this script will work fine. But, (and you knew there would be a “but”) macOS has a very nasty wrench to throw in our wheels.
There are a few groups on macOS, that have neither GroupMembers, GroupMembership, nor NestedGroups, but still have members. This is because the system calculates membership dynamically. This is similar to Smart Playlists in iTunes, Smart Folders in Finder, or Smart Groups in Jamf Pro.
You can list all calculated groups on macOS with:
$ dscl . list /Groups Comment | grep "calc"
The most interesting calculated groups are everyone, localaccounts, and netaccounts.
These groups can be very useful in certain environments. For example in a DEP setup you could add localaccounts or everyone to the _lpadmin and _developer groups, before the user has even created their standard account. That way any user created on that Mac will can manage printers and use the developer tools.
However, since these groups are calculated magically, a script cannot list all the members of any of these groups. (My script above will show a warning, when it encounters one of these groups.)
While it would probably not be wise to nest the everybody group in the admin group, a malicious user could do that and hide from detection with the above script (or similar methods).
Instead of recursively listing all users, we can loop through all user accounts and check their member status with dseditgroup -checkmember. This script is actually much simpler and dseditgroup can deal with calculated groups.
This works well enough when run against all local users.
I strongly recommend against running this for all users in a large directory infrastructure. It’ll be very slow and generate a lot of requests to the directory server. Because of this the script above runs only on the local directory node by default.
on macOS users can be assigned to groups thorugh different means
you can check membership with dseditgroup -o checkmember
you can edit group membership with dseditgroup -o edit
macOS has a few groups which are dynamically calculated and difficult to process in scripts
One of the promises at this year’s WWDC was that some high profile Mac apps would return to the Mac App Store. This week, part of that promise was fulfilled as Panic’s Transmit re-appeared in the Mac App Store.
For admins this news is bittersweet. Transmit chose subscription pricing for the App Store. Unlike App purchases, which can be managed with VPP, subscriptions and other in-App-Purchases still cannot be managed. Thankfully, Panic still offers the standalone app, for a fixed price, which can be managed by traditional means.
Don’t miss the MacAdmins podcast this week. I actually talk briefly about the process of building this very newsletter every week.
Brian Stucki: “The documents for the new Mac mini were just released. Includes the Essentials, the Quick Start and the Info Guide. Also includes this picture of the Retina display that Apple should definitely make and sell.”
One of the new macOS features in Mojave are “Finder Quick Actions.”
They show as action buttons in the Finder in Column View and the new Gallery View. You can also access Quick Actions in any view from an item’s context menu.
You can configure Quick Actions in the ‘Finder’ section of the ‘Extensions’ Preference Pane. The four sample actions that come with Mojave are ‘Rotate,’ ‘Markup,’ ‘Create PDF,’ and ‘Trim’. While these are certainly useful, they are oriented towards media.
You can, however, build your own Quick Actions with Automator!
When you look at it closely, Quick Actions are re-branded Automator Service Workflows. They are even stored in ~/Library/Services.
Let’s build a useful Quick Action for admins.
Recap: You can quickly build an installer package from an application bundle with pkgbuild:
This allows you to build an installer package from a disk image without having to install it.
Note: this method works well with ‘drag to install’ type applications. For many other applications, re-packaging is more elaborate. Learn all the details of packaging in my book: “Packaging for Apple Adminstrators”
To make this simple process even simpler, I wrote a small script a while back called quickpkg, which simplifies this even further:
$ quickpkg "~/Downloads/Firefox 63.0.dmg"
(For help with downloading and installing scripts like quickpkg see this post.)
This seems like a good candidate for a Quick Action.
Bring in the Robot
Open the Automator application and create a new Workflow. Choose “Quick Action” as the type of Workflow.
This will present an empty workflow window with a list of categories and actions on the left and the area where you assemble the workflow on the right. Above the workflow area is a panel where you define the input for our Quick Action. Change the popups to match this image:
Then add a ‘Run Shell Script’ action from the list on the left. The easiest way to locate the action is with the search box, or you can find the ‘Run Shell Script’ action in the ‘Utilities’ category. Drag it to the workflow area, labelled ‘Drag actions or file here to build your Workflow.’
Make sure that the shell popup is set to /bin/bash and the ‘Pass input’ popup is set to ‘to stdin’. With these settings, the selected file(s) will be passed as a list of paths, one per line to the stdin stream of the bash code we enter in the text area.
Add the following code:
while read -r file; do
/usr/local/bin/quickpkg --output "$destination" "$file"
Your action should look like this:
First, we set a bash variable for the destination folder. You can change this to another path if you want to, but the destination folder has to exist before the workflow runs, otherwise you’ll get an error.
Then we use a while loop with the read command to read the stdin input line by line. Then we run the quickpkg tool once for each line.
You can now save the Workflow (it will be saved in ~/Library/Services/) and then ‘QuickPkg’ (or whatever name you chose) will appear in Finder, for any selected item. Unfortunately, the Automator input controls don’t allow to filter for file types other than the few given ones.
Select a dmg with an application in it, such as the dmg downloaded from the Firefox website and wait a moment. Then check the ~/Documents folder for the result.
(A rotating gear wheel will appear in the menu bar while the action is running. This is all the feedback you can get.)
Revealing the Result
It is annoying that we have to manually open the destination folder to see our result. But the nice thing is that we can let the workflow take care of that. In the action list on the left, search for ‘Reveal Finder Items’ or locate this action in the ‘Files & Folders’ category. You can drag it to the end of your workflow, below the ‘Run Shell Script’ action or just double-click in the list to add to the end of your workflow.
Save and run again from the Finder. It should now reveal the pkg file automatically.
You can add more actions to the workflow. For example, you can add actions to
You may have noticed during testing that in its current form the workflow doesn’t really react well when something goes wrong.
quickpkg can work with .app, .dmg, and .zip files. Unfortunatly, Automator does not let us filter for just those file types in the input setup. The script will report an error when you try to run it against a different file type, but the error is not displayed in Finder.
It is not that difficult to extend our short script to make it a bit more resilient. Change the code in the ‘Run Shell Script’ action to this:
while read -r file; do
result=$(/usr/local/bin/quickpkg --output "$destination" "$file")
if [[ $? != 0 ]]; then
osascript -e "display alert \"QuickPkg: An error occured: $result\""
With this code we check result code $? of the quickpkg command for an error. If the code is non-zero we display an alert with osascript. If all went well, we echo the result (the path to the new pkg) to stdout, so that Automator can pass that into the following actions.
This is still a fairly crude error handling, but much better than nothing.
It is quite easy to turn simple shell commands into Automator workflows and Finder Quick Actions. Keep this in mind, when you find yourself performing repetetive tasks in Finder or in Terminal.
Talking about Secure Boot and T2: among all the other new around the new Macs, iPads, macOS 10.14.1 and iOS 12.1, Apple also released a whitepaper on the T2 Chip. If you don’t read anything else this week, read this. (or at at least Rich’s or David’s summaries)
Chapin Bryce: “up – cli tool that allows you to manipulate and interact with streams to prototype modification cmds (ie grep, cut, awk). It’s easier to watch the gif then for me to describe in 140 chars” (via Erik Gomez:)
mikeymikey: “Heads up macadmins – if you have devices in your fleet where people installed 10.14.0 ”not labeled as beta“ build 18A389 aka ”people thought it was GM but it didn’t say GM“, the 10.14.1 update does not upgrade it.”
mikeymikey: “Hey #macadmins This was published in June. But you should probably look at it again. Soon.”
“20 years ago I did one of my favorite strips ever. #HappyHalloween… ”