Weekly News Summary for Admins — 2018-12-07

We got the macOS 10.14.2 update this week, along with iOS 12.1.1 and watchOS 5.1.2. Versioning is really weird this time around. One can assume something major is planned for iOS 12.2.

For macOS 10.14.2 looks like a unified build for all current hardware. It’s been a while.

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

News and Opinion

MacAdmins on Twitter

  • Jason Broccardo: “10.12.6 + SecUpdate 2018–006 = 16G1710 10.13.6 + SecUpdate 2018–003 = 17G3025 10.14.2 = 18C54”
  • Jason Broccardo: “!!!! 10.13.6 + 2018–003 = 17G4015 !!!”
  • William Smith: “2019 calendar for Microsoft Office 2019 for Mac for 2019 monthly releases is posted. (Subject to change.) https://macadmins.software/calendar/”

Bugs and Security

Support and HowTos

Scripting and Automation

Apple Support

Updates and Releases

To Listen

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!

Weekly News Summary for Admins — 2018-12-01

Just a brief summary this week as I am still travelling through beautiful NZ. Just as a warning: next week’s letter may also be short and late.

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

News and Opinion

Bugs and Security

Support and HowTos

Scripting and Automation

Apple Support

Updates and Releases

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!

Weekly News Summary for Admins — 2018-11-23

Just a quick roundup this week. Because of the US Thanksgiving week it is pretty quiet, and I am travelling. I will try writing up a newsletter over the next two weeks, but no promises.

I have put together a few deals. My own books are also on sale through Monday, Nov 27 (Cyber Monday)

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

Black Friday Deals for Admins

On Scripting OS X

News and Opinion

MacAdmins on Twitter

  • mikeymikey: “Sounds like some Quicktime codec support changes coming again.… ”
  • Tim Hardwick: “I’ve been testing Folder Actions in macOS Mojave 10.14.1, and the results aren’t good. Apple needs to look at how new security approvals are implemented for workflows containing Apple Event scripts, because the reliability of automated actions has taken a dive.”
  • William Smith: “Microsoft Remote Desktop for Mac 10.2.4 beta introduces… SCRIPTING SUPPORT! See today’s announcement in #microsoft-rdc channel on #MacAdmins Slack for details and usage. Run ”Microsoft Remote http://Desktop.app/Content/macOS/Microsoft … Remote Desktop” –script help
  • Greg Neagle: “Ralph Breaks the Internet opens today in the US and some other markets! Be sure to stay through the credits for mid-credits and post-credits scenes!”

Support and HowTos

Scripting and Automation

Apple Support

Updates and Releases

To Listen

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!

Books Sale for Black Friday and Cyber Monday

My three books will be on sale from now, over Black Friday, through Cyber Monday (Nov 26). This is a great chance to pick the books up at a few dollars or euros less:

Prices shown are for the US Apple Books store, but the prices in all regions where the books are published will be reduced.

Happy Thanksgiving to all of you in the US and happy deal hunting to everyone!

On macOS User Groups

User groups are easy, right? A user is either a member or they are not.

Once you start thinking about the deatils and want or need to automate some of the aspects of user and group management on macOS, there is a lot of devil in those details.

User Membership

You can easily list all groups a given user is a member of. The id command will show all the groups the current user is a member of. id -Gn will list just the groups. Add a username to the id command to see the information for a different user. The groups command does the same as id -Gn.

You can also run a command to check if a given user is a member of a group:

$ dseditgroup -o checkmember -m user staff
yes user is a member of staff
$ dseditgroup -o checkmember -m user wheel
no user is NOT a member of wheel

Group Membership

So far, so good.

A user is a member of a group when one of these applies:

  • the user’s PrimaryGroupID attribute matches the PrimaryGroupID of the group
  • the user’s UUID is listed in the group’s GroupMembers attribute and the user’s shortname is listed in the group’s GroupMembership
  • the user is a member of a group nested in the group

Note: you should not attempt to manipulate the GroupMembers or GroupMembership attributes directly. Use the dseditgroup -o edit command to manage group membership instead. dseditgroup syntax is weird, but it is a really useful tool. Study its man page.

Listing Group Members

Sometimes (mainly for security audits) you need to list all the members of a group. With the above information, it is easy enough to build a script that checks the PrimaryGroupID, the GroupMembership attribute and the recursively loops through the NestedGroups.

This is confused by the fact that PrimaryGroupID stores the numeric User ID, GroupMembership uses the shortname and NestedGroups uses UUIDs. Nevertheless, you can sort through it.

I have written exactly such a script here:

In most cases this script will work fine. But, (and you knew there would be a “but”) macOS has a very nasty wrench to throw in our wheels.

Calculated Groups

There are a few groups on macOS, that have neither GroupMembers, GroupMembership, nor NestedGroups, but still have members. This is because the system calculates membership dynamically. This is similar to Smart Playlists in iTunes, Smart Folders in Finder, or Smart Groups in Jamf Pro.

You can list all calculated groups on macOS with:

$ dscl . list /Groups Comment | grep "calc"

The most interesting calculated groups are everyone, localaccounts, and netaccounts.

These groups can be very useful in certain environments. For example in a DEP setup you could add localaccounts or everyone to the _lpadmin and _developer groups, before the user has even created their standard account. That way any user created on that Mac will can manage printers and use the developer tools.

However, since these groups are calculated magically, a script cannot list all the members of any of these groups. (My script above will show a warning, when it encounters one of these groups.)

While it would probably not be wise to nest the everybody group in the admin group, a malicious user could do that and hide from detection with the above script (or similar methods).

Other Solution

Instead of recursively listing all users, we can loop through all user accounts and check their member status with dseditgroup -checkmember. This script is actually much simpler and dseditgroup can deal with calculated groups.

This works well enough when run against all local users.

I strongly recommend against running this for all users in a large directory infrastructure. It’ll be very slow and generate a lot of requests to the directory server. Because of this the script above runs only on the local directory node by default.

Summary

  • on macOS users can be assigned to groups thorugh different means
  • you can check membership with dseditgroup -o checkmember
  • you can edit group membership with dseditgroup -o edit
  • macOS has a few groups which are dynamically calculated and difficult to process in scripts

Weekly News Summary for Admins — 2018-11-16

One of the promises at this year’s WWDC was that some high profile Mac apps would return to the Mac App Store. This week, part of that promise was fulfilled as Panic’s Transmit re-appeared in the Mac App Store.

For admins this news is bittersweet. Transmit chose subscription pricing for the App Store. Unlike App purchases, which can be managed with VPP, subscriptions and other in-App-Purchases still cannot be managed. Thankfully, Panic still offers the standalone app, for a fixed price, which can be managed by traditional means.

Don’t miss the MacAdmins podcast this week. I actually talk briefly about the process of building this very newsletter every week.

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

On Scripting OS X

News and Opinion

MacAdmins on Twitter

  • Steve Yuroff: “Noting the steps needed to get a never-booted 10.14.beta for testing DEP and SecureToken behaviors. This isn’t fun anymore.”
  • Tim Perfitt: “When searching for something in Spotlight, if you press command-return when an item is selected, it opens the enclosing folder.”

Bugs and Security

Support and HowTos

Scripting and Automation

Apple Support

Updates and Releases

To Watch

To Listen

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!

MacAdmins Podcast, Episode 102: Erase All the Things

I had the honor of being on the MacAdmins podcast again!

In this episode, we talk about the EraseInstall app we built at Pro Warehouse, how much fun it can be to build something in Swift and Xcode, the new Macs, my weekly news summary and a bit about Book #4.

Thanks again to Tom, Charles and Marcus and everyone else who makes the MacAdmins Podcast. You are wonderful hosts!

(Though it was very weird to hear you in single speed…)

Listen to the Episode!

Weekly News Summary for Admins — 2018-11-10

Mac minis are real and being delivered to customers!

Apple sent out some updates for their Apps, Pages can now publish to Apple Books and iMovie on a new iPad pro can power a large external screen.

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

On Scripting OS X

News and Opinion

MacAdmins on Twitter

  • James F: “Here’s a script illustrating how to use the #Jamf Pro API I made for my #jnuc2018 interactive lab ”Getting Started with the Jamf Pro API“”
  • Erik Gomez: “To help foster community help, effective today, UMAD and nudge have been moved to my personal GitHub and off the pseudo joke org I made when I developed the tools.”
  • mikeymikey: “Take the hint…”
  • Brian Stucki: “The documents for the new Mac mini were just released. Includes the Essentials, the Quick Start and the Info Guide. Also includes this picture of the Retina display that Apple should definitely make and sell.”

Bugs and Security

Support and HowTos

Scripting and Automation

Apple Support

Updates and Releases

To Watch

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!

Mojave Quick Action to Package Apps

One of the new macOS features in Mojave are “Finder Quick Actions.”

They show as action buttons in the Finder in Column View and the new Gallery View. You can also access Quick Actions in any view from an item’s context menu.

You can configure Quick Actions in the ‘Finder’ section of the ‘Extensions’ Preference Pane. The four sample actions that come with Mojave are ‘Rotate,’ ‘Markup,’ ‘Create PDF,’ and ‘Trim’. While these are certainly useful, they are oriented towards media.

You can, however, build your own Quick Actions with Automator!

Custom Quick Action

When you look at it closely, Quick Actions are re-branded Automator Service Workflows. They are even stored in ~/Library/Services.

Let’s build a useful Quick Action for admins.

Quick Packaging

Recap: You can quickly build an installer package from an application bundle with pkgbuild:

$ pkgbuild --component /Applications/Firefox.app Firefox-63.0.pkg

This even works when the application is not installed on the current system, but then you have to add the --install-location argument:

$ pkgbuild --component /Volumes/Firefox/Firefox.app/ --install-location /Applications Firefox-63.0.pkg

This allows you to build an installer package from a disk image without having to install it.

Note: this method works well with ‘drag to install’ type applications. For many other applications, re-packaging is more elaborate. Learn all the details of packaging in my book: “Packaging for Apple Adminstrators

To make this simple process even simpler, I wrote a small script a while back called quickpkg, which simplifies this even further:

$ quickpkg "~/Downloads/Firefox 63.0.dmg"

(For help with downloading and installing scripts like quickpkg see this post.)

This seems like a good candidate for a Quick Action.

Bring in the Robot

Open the Automator application and create a new Workflow. Choose “Quick Action” as the type of Workflow.

New Workflow Window for a Quick Action in Finder

This will present an empty workflow window with a list of categories and actions on the left and the area where you assemble the workflow on the right. Above the workflow area is a panel where you define the input for our Quick Action. Change the popups to match this image:

Input for our QuickAction
Input for our QuickAction

Then add a ‘Run Shell Script’ action from the list on the left. The easiest way to locate the action is with the search box, or you can find the ‘Run Shell Script’ action in the ‘Utilities’ category. Drag it to the workflow area, labelled ‘Drag actions or file here to build your Workflow.’

Make sure that the shell popup is set to /bin/bash and the ‘Pass input’ popup is set to ‘to stdin’. With these settings, the selected file(s) will be passed as a list of paths, one per line to the stdin stream of the bash code we enter in the text area.

Add the following code:

destination="$HOME/Documents/"

while read -r file; do
    /usr/local/bin/quickpkg --output "$destination" "$file"
done

Your action should look like this:

First, we set a bash variable for the destination folder. You can change this to another path if you want to, but the destination folder has to exist before the workflow runs, otherwise you’ll get an error.

Then we use a while loop with the read command to read the stdin input line by line. Then we run the quickpkg tool once for each line.

You can now save the Workflow (it will be saved in ~/Library/Services/) and then ‘QuickPkg’ (or whatever name you chose) will appear in Finder, for any selected item. Unfortunately, the Automator input controls don’t allow to filter for file types other than the few given ones.

Select a dmg with an application in it, such as the dmg downloaded from the Firefox website and wait a moment. Then check the ~/Documents folder for the result.

(A rotating gear wheel will appear in the menu bar while the action is running. This is all the feedback you can get.)

Revealing the Result

It is annoying that we have to manually open the destination folder to see our result. But the nice thing is that we can let the workflow take care of that. In the action list on the left, search for ‘Reveal Finder Items’ or locate this action in the ‘Files & Folders’ category. You can drag it to the end of your workflow, below the ‘Run Shell Script’ action or just double-click in the list to add to the end of your workflow.

The extended Workflow

Save and run again from the Finder. It should now reveal the pkg file automatically.

You can add more actions to the workflow. For example, you can add actions to

  • open with Pacifist or Suspicious Package
  • tag the pkg file
  • add a comment
  • append the date to the file name
  • copy the pkg to a file share

Improving the Workflow

You may have noticed during testing that in its current form the workflow doesn’t really react well when something goes wrong.

quickpkg can work with .app, .dmg, and .zip files. Unfortunatly, Automator does not let us filter for just those file types in the input setup. The script will report an error when you try to run it against a different file type, but the error is not displayed in Finder.

It is not that difficult to extend our short script to make it a bit more resilient. Change the code in the ‘Run Shell Script’ action to this:

destination="$HOME/Documents/"

while read -r file; do
    result=$(/usr/local/bin/quickpkg --output "$destination" "$file")

    if [[ $? != 0 ]]; then
        osascript -e "display alert \"QuickPkg: An error occured: $result\""
    else
        echo "$result"
    fi
done

With this code we check result code $? of the quickpkg command for an error. If the code is non-zero we display an alert with osascript. If all went well, we echo the result (the path to the new pkg) to stdout, so that Automator can pass that into the following actions.

This is still a fairly crude error handling, but much better than nothing.

Summary

It is quite easy to turn simple shell commands into Automator workflows and Finder Quick Actions. Keep this in mind, when you find yourself performing repetetive tasks in Finder or in Terminal.

Weekly News Summary for Admins — 2018-11-02

New Mac mini! We finally got a new Mac mini!

Oh, and a new MacBook Air and some iPad Pros, too. iOS 12.1 and macOS Mojave 10.14.1, as well. But seriously, did you see the new Mac mini!?

The new Macs have the T2. Now, the majority of new Mac models and quite likely the majority of Macs units sold have Secure Boot and don’t support traditional deployment workflows any more.

The Mac mini and the new MacBook Air also require Mojave 10.14.1 and will likely have a forked build of Mojave.

If you need to learn about the new installation workflows available with High Sierra and Mojave, you can buy my book: “macOS Installation for Apple Administrators

Talking about Secure Boot and T2: among all the other new around the new Macs, iPads, macOS 10.14.1 and iOS 12.1, Apple also released a whitepaper on the T2 Chip. If you don’t read anything else this week, read this. (or at at least Rich’s or David’s summaries)

If you would rather get the weekly newsletter by email, you can subscribe to the Scripting OS X Weekly Newsletter here!! (Same content, delivered to your Inbox once a week.)

Apple October Event

On Scripting OS X

News and Opinion

MacAdmins on Twitter

  • Chapin Bryce:up – cli tool that allows you to manipulate and interact with streams to prototype modification cmds (ie grep, cut, awk). It’s easier to watch the gif then for me to describe in 140 chars” (via Erik Gomez:)
  • mikeymikey: “Heads up macadmins – if you have devices in your fleet where people installed 10.14.0 ”not labeled as beta“ build 18A389 aka ”people thought it was GM but it didn’t say GM“, the 10.14.1 update does not upgrade it.”
  • mikeymikey: “Hey #macadmins This was published in June. But you should probably look at it again. Soon.”
  • Bill Amend:
    “20 years ago I did one of my favorite strips ever. #HappyHalloween… ”

Bugs and Security

Support and HowTos

Scripting and Automation

Apple Support

To Listen

Support

There are no ads on my webpage or this newsletter. If you are enjoying what you are reading here, please spread the word and recommend it to another Mac Admin!

If you want to support me and this website even further, then consider buying one (or all) of my books. It’s like a subscription fee, but you also get a useful book or two extra!