On macOS User Groups

User groups are easy, right? A user is either a member or they are not.

Once you start thinking about the deatils and want or need to automate some of the aspects of user and group management on macOS, there is a lot of devil in those details.

User Membership

You can easily list all groups a given user is a member of. The id command will show all the groups the current user is a member of. id -Gn will list just the groups. Add a username to the id command to see the information for a different user. The groups command does the same as id -Gn.

You can also run a command to check if a given user is a member of a group:

$ dseditgroup -o checkmember -m user staff
yes user is a member of staff
$ dseditgroup -o checkmember -m user wheel
no user is NOT a member of wheel

Group Membership

So far, so good.

A user is a member of a group when one of these applies:

  • the user’s PrimaryGroupID attribute matches the PrimaryGroupID of the group
  • the user’s UUID is listed in the group’s GroupMembers attribute and the user’s shortname is listed in the group’s GroupMembership
  • the user is a member of a group nested in the group

Note: you should not attempt to manipulate the GroupMembers or GroupMembership attributes directly. Use the dseditgroup -o edit command to manage group membership instead. dseditgroup syntax is weird, but it is a really useful tool. Study its man page.

Listing Group Members

Sometimes (mainly for security audits) you need to list all the members of a group. With the above information, it is easy enough to build a script that checks the PrimaryGroupID, the GroupMembership attribute and the recursively loops through the NestedGroups.

This is confused by the fact that PrimaryGroupID stores the numeric User ID, GroupMembership uses the shortname and NestedGroups uses UUIDs. Nevertheless, you can sort through it.

I have written exactly such a script here:

In most cases this script will work fine. But, (and you knew there would be a “but”) macOS has a very nasty wrench to throw in our wheels.

Calculated Groups

There are a few groups on macOS, that have neither GroupMembers, GroupMembership, nor NestedGroups, but still have members. This is because the system calculates membership dynamically. This is similar to Smart Playlists in iTunes, Smart Folders in Finder, or Smart Groups in Jamf Pro.

You can list all calculated groups on macOS with:

$ dscl . list /Groups Comment | grep "calc"

The most interesting calculated groups are everyone, localaccounts, and netaccounts.

These groups can be very useful in certain environments. For example in a DEP setup you could add localaccounts or everyone to the _lpadmin and _developer groups, before the user has even created their standard account. That way any user created on that Mac will can manage printers and use the developer tools.

However, since these groups are calculated magically, a script cannot list all the members of any of these groups. (My script above will show a warning, when it encounters one of these groups.)

While it would probably not be wise to nest the everybody group in the admin group, a malicious user could do that and hide from detection with the above script (or similar methods).

Other Solution

Instead of recursively listing all users, we can loop through all user accounts and check their member status with dseditgroup -checkmember. This script is actually much simpler and dseditgroup can deal with calculated groups.

This works well enough when run against all local users.

I strongly recommend against running this for all users in a large directory infrastructure. It’ll be very slow and generate a lot of requests to the directory server. Because of this the script above runs only on the local directory node by default.


  • on macOS users can be assigned to groups thorugh different means
  • you can check membership with dseditgroup -o checkmember
  • you can edit group membership with dseditgroup -o edit
  • macOS has a few groups which are dynamically calculated and difficult to process in scripts

Mojave Quick Action to Package Apps

One of the new macOS features in Mojave are “Finder Quick Actions.”

They show as action buttons in the Finder in Column View and the new Gallery View. You can also access Quick Actions in any view from an item’s context menu.

You can configure Quick Actions in the ‘Finder’ section of the ‘Extensions’ Preference Pane. The four sample actions that come with Mojave are ‘Rotate,’ ‘Markup,’ ‘Create PDF,’ and ‘Trim’. While these are certainly useful, they are oriented towards media.

You can, however, build your own Quick Actions with Automator!

Custom Quick Action

When you look at it closely, Quick Actions are re-branded Automator Service Workflows. They are even stored in ~/Library/Services.

Let’s build a useful Quick Action for admins.

Quick Packaging

Recap: You can quickly build an installer package from an application bundle with pkgbuild:

$ pkgbuild --component /Applications/Firefox.app Firefox-63.0.pkg

This even works when the application is not installed on the current system, but then you have to add the --install-location argument:

$ pkgbuild --component /Volumes/Firefox/Firefox.app/ --install-location /Applications Firefox-63.0.pkg

This allows you to build an installer package from a disk image without having to install it.

Note: this method works well with ‘drag to install’ type applications. For many other applications, re-packaging is more elaborate. Learn all the details of packaging in my book: “Packaging for Apple Adminstrators

To make this simple process even simpler, I wrote a small script a while back called quickpkg, which simplifies this even further:

$ quickpkg "~/Downloads/Firefox 63.0.dmg"

(For help with downloading and installing scripts like quickpkg see this post.)

This seems like a good candidate for a Quick Action.

Bring in the Robot

Open the Automator application and create a new Workflow. Choose “Quick Action” as the type of Workflow.

New Workflow Window for a Quick Action in Finder

This will present an empty workflow window with a list of categories and actions on the left and the area where you assemble the workflow on the right. Above the workflow area is a panel where you define the input for our Quick Action. Change the popups to match this image:

Input for our QuickAction
Input for our QuickAction

Then add a ‘Run Shell Script’ action from the list on the left. The easiest way to locate the action is with the search box, or you can find the ‘Run Shell Script’ action in the ‘Utilities’ category. Drag it to the workflow area, labelled ‘Drag actions or file here to build your Workflow.’

Make sure that the shell popup is set to /bin/bash and the ‘Pass input’ popup is set to ‘to stdin’. With these settings, the selected file(s) will be passed as a list of paths, one per line to the stdin stream of the bash code we enter in the text area.

Add the following code:


while read -r file; do
    /usr/local/bin/quickpkg --output "$destination" "$file"

Your action should look like this:

First, we set a bash variable for the destination folder. You can change this to another path if you want to, but the destination folder has to exist before the workflow runs, otherwise you’ll get an error.

Then we use a while loop with the read command to read the stdin input line by line. Then we run the quickpkg tool once for each line.

You can now save the Workflow (it will be saved in ~/Library/Services/) and then ‘QuickPkg’ (or whatever name you chose) will appear in Finder, for any selected item. Unfortunately, the Automator input controls don’t allow to filter for file types other than the few given ones.

Select a dmg with an application in it, such as the dmg downloaded from the Firefox website and wait a moment. Then check the ~/Documents folder for the result.

(A rotating gear wheel will appear in the menu bar while the action is running. This is all the feedback you can get.)

Revealing the Result

It is annoying that we have to manually open the destination folder to see our result. But the nice thing is that we can let the workflow take care of that. In the action list on the left, search for ‘Reveal Finder Items’ or locate this action in the ‘Files & Folders’ category. You can drag it to the end of your workflow, below the ‘Run Shell Script’ action or just double-click in the list to add to the end of your workflow.

The extended Workflow

Save and run again from the Finder. It should now reveal the pkg file automatically.

You can add more actions to the workflow. For example, you can add actions to

  • open with Pacifist or Suspicious Package
  • tag the pkg file
  • add a comment
  • append the date to the file name
  • copy the pkg to a file share

Improving the Workflow

You may have noticed during testing that in its current form the workflow doesn’t really react well when something goes wrong.

quickpkg can work with .app, .dmg, and .zip files. Unfortunatly, Automator does not let us filter for just those file types in the input setup. The script will report an error when you try to run it against a different file type, but the error is not displayed in Finder.

It is not that difficult to extend our short script to make it a bit more resilient. Change the code in the ‘Run Shell Script’ action to this:


while read -r file; do
    result=$(/usr/local/bin/quickpkg --output "$destination" "$file")

    if [[ $? != 0 ]]; then
        osascript -e "display alert \"QuickPkg: An error occured: $result\""
        echo "$result"

With this code we check result code $? of the quickpkg command for an error. If the code is non-zero we display an alert with osascript. If all went well, we echo the result (the path to the new pkg) to stdout, so that Automator can pass that into the following actions.

This is still a fairly crude error handling, but much better than nothing.


It is quite easy to turn simple shell commands into Automator workflows and Finder Quick Actions. Keep this in mind, when you find yourself performing repetetive tasks in Finder or in Terminal.

Include Assets in External macOS Installer Drives

Apple has included a tool to build a bootable external installer drive with the macOS Installer application for a while now. Apple actually has documentation for this tool.

The tool is called createinstallmedia and can be found in /Applications/Install macOS [[High ]Sierra | Mojave].app/Contents/Resources/.

When run, the tool requires a path to an external volume or partition, which will be erased and replaced with a bootable installer volume.

Note: Secure Boot Macs with the T2 chip cannot boot from external drives in the default configuration. As of this writing this affects the iMac Pro and the 2018 MacBook Pro. But it is expected that any new Macs released from now on (as in maybe at the Apple Event tomorrow?) will also have Secure Boot.
Nevertheless, having an bootable external installer is still every useful for ‘legacy’ (i.e. non-secure boot) Macs. Also, while it not a good general configuration, it can be very useful to enable external boot on machines that you frequently re-install for testing.

While the support article covers the basics, the tool gained a new feature in Mojave which is not documented in the article.

When you run the Mojave createinstallmedia tool without arguments you get the usage documentation:

$ /Applications/Install\ macOS\ Mojave.app/Contents/Resources/createinstallmedia 
Usage: createinstallmedia --volume <path to volume to convert>

--volume, A path to a volume that can be unmounted and erased to create the install media.
--nointeraction, Erase the disk pointed to by volume without prompting for confirmation.
--downloadassets, Download on-demand assets that may be required for installation.

Example: createinstallmedia --volume /Volumes/Untitled

This tool must be run as root.

The new argument in the Mojave is called --downloadassets. The description is a bit sparse, but from what I gather this is download additional assets, like firmware installers and bundle them with the other installer files on the installer drive instead of downloading them on-demand during installation.

This will not remove the requirement for the Mac to be connected to the internet during the installation process but it should speed up the process quite a bit.

If you want to learn more about how to create external installers and how to use the macOS Installer app most effectively in your workflows, you can buy my book ‘macOS Installation for Apple Administrators

Changing a User’s Login Picture

Nick asked a question in the comments recently:

Now only if there was as simple a tool for setting the profile pic!

There is no simple tool, but it is not that hard really.

When an individual user wants to change their login picture, they open the Users & Groups preference pane. But if want to pre-set or change it for multiple Computers or Users, then we need to script.

Where is it stored?

The data for the user picture is stored in the user record in the directory. If the user is stored locally the directory is just a bunch of property list files in /var/db/dslocal/nodes. However, we do not want to, nor should we manipulate them directly. The tool to interface with directory data is dscl (directory service command line, pronounced diskel)

You can get a user’s record data like this:

$ dscl . read /Users/username

This will dump a lot of data, some of it binary. When you look more closely at the data, you can see that the binary data is in an attribute JPEGPhoto. This is promising, but converting an image file into some binary code and writing it into the attribute does not sound fun.

When you look around the user record some more, you can find another attribute labeled Picture which contains a decent file path (it may be empty on your machine). When JPEGPhoto contains data, Picture will be ignored. But when we delete the JPEGPhoto attribute, then the system will use the file path set in the Picture attribute.

Let’s Change It!

Deleting the JPEGPhoto attribute is easy:

$ dscl . delete /Users/username JPEGPhoto

And so is setting the Picture attribute to a new value:

$ dscl . create /Users/username Picture "/Library/User Pictures/Flowers/Sunflower.tif"

With this you can create a script that resets all user pictures by looping through all the available pictures in the /Library/User Pictures folder.

(Since you are affecting other users’ records, this script needs to be run as root.)

Custom Images

Of course, you don’t have to use the pre-installed User Picture images, but can install your own.

To demonstrate how this would work, I conceived of a little fun exercise. I wanted to write a script that sets the user picture to an image from the ‘User Pictures’ folder which starts with the same letter as the username.

The set of images in the default cover 19 of the 26 letters in the latin alphabet. I created images for the seven missing letters (A, I, J, K, Q, U, and X).

To run the script at login, I created a LaunchAgent. And finally a script which will set the Picture to the appropriate path.

Since LaunchAgents run as the user, we need to be a bit more careful when changing the attributes. While a user has privileges to modify and delete the JPEGPhoto and Picture attribute, they cannot create the attributes, so our sledgehammer method to overwrite any existing value from the script above will not work.

The dscl . change verb, which modifies an attribute has a weird syntax which requires you to pass the previous value as well as the new value. To get the previous value, which may contain spaces, I use the same PlistBuddy trick from this post.

Finally, I built an installer package which installs all the parts (the additional images, the LaunchAgent plist and the script) in the right places. You can get the project here. Run the buildAlphabetUserPkg.sh script to build an installer package.

Since the LaunchAgent will trigger at a user’s login, you will have to logout and back in, before you can see any changes. You could add a postinstall script that loads the launchagent for the current user (when a user is logged in), but I will leave that as an exercise for the attentive student.

You can get all the pointers on how to build installer packages with postinstall scripts in my book: “Packaging for Apple Administrators

EraseInstall Application

The consulting team at Pro Warehouse has been working on an application. I mentioned this application in my talk at MacSysAdmin. The application is called ‘EraseInstall’ and provides a user interface which runs the startosinstall --eraseinstall command, which is part of the macOS Installer application.


The startosinstall --eraseinstall command with all its options is fairly accessible for an administrator. There have been some attempts to make the command more accessible to end users.

With Mojave, Apple is enforcing the requirement to have an active internet connection before you start the installation. The startosinstall command will fail if it cannot reach Apple’s servers. Also on Secure Boot Macs, you really want a user to have Find My Mac disabled before a system is wiped.

We chose to build an application with an interface that runs the necessary checks and displays a summary, before the startosinstall --eraseinstall is launched.

This will provide end users, techs and admins easy access to a tool which wipes the system. This will close the lifecycle loop of a Mac, from on-boarding to ‘off-boarding.’

Enter EraseInstall

EraseInstall will show three screens, the first will explain what the application does (wipe everything!) and then you will get a summary of the checks. In this initial version we check whether the system has APFS, if Find My Mac is enabled and if there is an internet connection.

EraseInstall also locates a suitable “Install macOS” application, either “Install macOS High Sierra” for 10.13.4 and higher or “Install macOS Mojave.” It is your responsibility to have the install app on the system before the EraseInstall is run. The app does not have to be installed in /Applications. (EraseInstall uses a spotlight query to locate available installer applications. It may take a few minutes after an installer app has been copied to a system for spotlight to pick it up.)

WARNING: the app as we have posted it is fully functional and will erase and install the system on which it is run. Please only run this on a test machine!

You can watch a video of the installation and workflow here:

How to get it

You can download an installer and the source code for the EraseInstall application here.

The installer will put the EraseInstall.app in /Applications/Utilities/.

You need to install, copy or download the “Install macOS” application (for 10.13.4 or higher) through your management system, VPP or manually.

Managing the Desktop Picture on macOS

Many organisations like to set or pre-set the Desktop Picture of managed Macs. There are a few options for Mac Admins.

One of the commonly used methods may break in macOS Mojave because of the new security and privacy controls for AppleEvents, also known as TCC.

Getting the Image File to the Mac

Unless you want to use one of the default macOS Desktop Picture images, you will first need to get the image file on to the client. The best way of doing that is with an installer package.

Note: installing a single image file to /Library/Desktop Pictures is actually the first exercise/example in my book “Packaging for Apple Administrators.” Get that for a more detailed description.

I will use the same example desktop picture as in the book. You can use your own desktop picture or download BoringBlueDesktop.png from the book’s resources.

Note: Desktop pictures on macOS can be many file formats. PNG and JPEG are most commonly used. The new dynamic desktop pictures of macOS Mojave have the heic file extension.

First create a project folder, with a payload folder inside:

$ mkdir -p BoringDesktop/payload
$ cd BoringDesktop

Then copy the image to the payload folder.

$ cp /path/to/BoringBlueDesktop.png payload

Then you can build a pkg with

$ pkgbuild --root payload --install-location "/Library/Desktop Pictures/" --identifier com.example.BoringDesktop --version 1 BoringDesktop.pkg

The resulting pkg file will install the image file in /Library/Desktop Picture.

Note: the pkgbuild command has many options and arguments. If you get one of them slightly wrong it can lead to unexpected behavior or even break the installation. I recommend using a script to run the pkgbuild command to avoid errors. You can find a sample build script here. Read the book for a more detailed explanation of pkgbuild and the build script. If you prefer, you can use munkipkg, which also simplifies and automates the process of building pkg installers.

This will provide the image in a location that the user might look for. However, for better management you want to set the desktop picture as well.

Lock Down the Desktop Picture

Once the image file is in place. You can set the desktop picture with a configuration profile. Many management systems will have an option in the ‘Restrictions’ payload where you can set the path to the desktop picture.

You can also use this custom profile:

You can learn all the ways to manage and install profiles in my other book ‘Property Lists, Preferences and Profiles for Apple Administrators’

With this configuration profile in place, the desktop picture is locked. The user can still open the Desktop preference pane but the selection will be ignored. You would need to be able to remove the profile to change the desktop picture again.

This is very useful in education and other strictly managed environments.

Suggesting a Desktop Picture

In other, less tightly managed environments, you might prefer to set an initial desktop picture, but allow the user to change it later.

The common means to do this has been to use an AppleScript command:

tell application "Finder" to set desktop picture to POSIX file "/Library/Desktop Pictures/BoringBlueDesktop.png"

If you want to run this from a shell script you would execute it with osascript:

osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/Desktop Pictures/Sierra.jpg"'

Note that this sets a user preference so it should be run as the user. See this post for details.

However, with macOS Mojave, Apple is introducing new Privacy and Security measures which require user approval for processes to send AppleEvents. This will put a severe limit on the use of osascript for admin scripts.

One solution would be to whitelist your management system’s agent which allows it to send Apple Events to the Finder. This requires managing the client with a user-approved MDM.

Another solution is to avoid AppleScript and Apple Events entirely.

Here comes the desktoppr!

To do this, I wrote a simple command line tool which can read and set the desktop picture. Neil Martin had the brilliant idea to call it desktoppr.

You can read the current desktop picture with:

$ desktoppr
/Library/Desktop Pictures/High Sierra.jpg

and set the desktop picture with

$ desktoppr "/Library/Desktop Pictures/BoringBlueDesktop.png"

When you have multiple displays, desktoppr will list all desktop pictures:

$ desktoppr
/Library/Desktop Pictures/HotStepper.jpg
/Library/Desktop Pictures/LyricalGangster.jpg
/Library/Desktop Pictures/MrOfficer.jpg

When you pass a file desktoppr will set it as the desktop picture for all screens:

$ desktoppr /Library/Desktop Pictures/NaahNananah.jpg
$ desktoppr
/Library/Desktop Pictures/NaahNananah.jpg
/Library/Desktop Pictures/NaahNananah.jpg
/Library/Desktop Pictures/NaahNananah.jpg

You can also set a specific desktop picture for a specific screen: (index starts at zero)

$ desktoppr 0 /Library/Desktop Pictures/HotStepper.jpg
$ desktoppr 1 /Library/Desktop Pictures/LyricalGangster.jpg
$ desktoppr 2 /Library/Desktop Pictures/MrOfficer.jpg

Managing with desktoppr

You can get the code for desktoppr on Github and an installer package here. The installer pkg will install desktoppr in /usr/local/bin. When you want to run it from a management script it is safest to include the entire path:

/usr/local/bin/desktoppr "/Library/Desktop Pictures/BoringBlueDesktop.png"

Since the desktoppr tool also sets user preferences, you still need to pay attention that it runs as the user.

For example, you could run desktoppr from a LaunchAgent (deployed in /Library/LaunchAgents so it affects all users:

This LaunchAgent will reset the Desktop Picture at every login.

If you want to set the Desktop Picture just once from a management or postinstall script (probably running as root) you can use the following to be safe:

When you find yourself building LaunchAgents or LaunchDaemons often (i.e. more than once) you should really consider using outset.

If you wanted to build an installer package that drops both the picture file and the LaunchAgent, you can do the following:

$ mkdir -p DesktopAndAgent/payload/
$ cd DesktopAndAgent
$ mkdir -p "payload/Library/Desktop Pictures/"
$ cp /path/to/BoringBlueDesktop.png "payload/Library/Desktop Pictures/"
$ mkdir -p payload/Library/LaunchAgents/
$ cp /path/to/com.scriptingosx.setdesktop.plist payload/Library/LaunchAgents
$ pkgbuild --root payload --install-location / --version 1 --identifier com.scriptingosx.desktopandagent DesktopAndAgent-1.pkg

Parsing dscl Output in Scripts

On macOS dscl is a very useful to access data in the local user directory or another directory the Mac is bound to. For example you can read a user’s UID with:

$ dscl /Search read /Users/armin UniqueID
UniqueID: 501

This output looks easy enough to parse, you can just use cut or awk:

$ dscl /Search read /Users/armin UniqueID | cut -d ' ' -f 2
$ dscl /Search read /Users/armin UniqueID | awk '{print $2;}'

However, dscl is a treacherous. Its output format changes, depending on the contents of an attribute. When an attribute value contains whitespace, the format of the output has two lines:

$ dscl /Search read /Users/armin RealName
 Armin Briegel

With attributes like the UID, it is fairly safe safe to assume that there will be no whitespace in the value. With other attributes, such as RealName or NFSHomeDirectory, you cannot make that prediction with certainty. Real names may or may not have been entered with a space. A user (or management script) may have changed their home directory to something starting with /Volumes/User HD/... and your script may fail.

To remove this output ambiguity, dscl has a -plist option which will print the output as a property list:

 $ dscl -plist . read /Users/armin RealName
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
        <string>Armin Briegel</string>

The resulting property list is a dict containing a key with the native attribute name and an array containing the values, even when there is only one value.

Having a property list is nice, but parsing property lists in a shell script is challenging. I have found two solutions


You can use the xpath tool extract data from the XML output:

$ dscl -plist . read /Users/armin RealName | xpath "//string[1]/text()" 2>/dev/null
Armin Briegel

Note that the xpath output does not include a final new line character, which makes it look a bit strange.

The xpath argument in detail means:

  • //string[1]: the first of any string element
  • /text() the text contents of that stringobject

This syntax makes a lot of assumptions about the property list input. I believe they are safe with the dscl output. (Please test)

If you want to play around with xpath syntax, I recommend using an interactive tool. I used this one from Code Beautify which worked well enough, but frankly I just randomly chose one from the list of search results for ‘xpath tester’. (If you can recommend a great one, let us know in the comments.)


As I said, the xpath solution makes a lot of assumptions about the layout of the property list. A safer way of parsing property lists would be a dedicated tool, such as PlistBuddy. However, PlistBuddy does not read from stdin. At least not voluntarily.

A few weeks ago Erik Berglund shared this trick on Mac Admins Slack which makes PlistBuddy read the output from another command. We can adapt this for our use case:

$ /usr/libexec/PlistBuddy -c "print :dsAttrTypeStandard\:RealName:0" /dev/stdin <<< $(dscl -plist . read /Users/armin RealName)
Armin Briegel

Note that you have to escape the : in the attribute name, since PlistBuddy uses the colon as a path separator.

You can use this in scripts to assign the value to a variable with

realName=$(/usr/libexec/PlistBuddy -c "print :dsAttrTypeStandard\:RealName:0" /dev/stdin <<< $(dscl -plist . read /Users/$username RealName))

This uses nested command substitution with the $(... $(...) ...) syntax which is not possible using backticks.

Either way, you can get a safe value from dscl in shell script, whether it contains whitespace or not.

Prefs Tool

Preferences or defaults on macOS seem easy, but their subtleties can grow complex very quickly.

The main reason for confusion is that preferences can be stored in many places and on many levels. The defaults system composites all of the keys and values from all locations to a process or application.

In my book “Property Lists, Preferences and Profiles for Apple Administrators”, I list 17 possible domains or levels where preferences can be stored and read from. The most common domains are:

Domain Location
User/Application ~/Library/Preferences/identifier.plist
User/Application/Computer ~/Library/Preferences/ByHost/identifier.xyz.plist
Computer/Application /Library/Preferences/identifier.plist
Configuration Profile n/a

To add to this confusion, Apple’s documentation keeps mixing up terms like ‘domain’ and ‘identifier’. I use the term ‘domain’ to designate the level or location a setting is stored in, and ‘identifier’ for the name of the preference (i.e. com.apple.screensaver).

The defaults command, which is the proper tool to interact with preferences files, does not properly work with different levels or domains. When you run

$ defaults read com.apple.screensaver

The output will be from the User/Application domain only, i.e. the data stored in the file ~/Library/Preferences/com.apple.screensaver.plist.

But the ScreenSaver process stores more data in the ByHost domain. You can read this domain or location with defaults as well:

$ defaults -currentHost read com.apple.screensaver

However, you must remember to check and read the ByHost domain as well as the standard domain. To access the computer level domain you have to use

$ defaults read /Library/Preferences/com.apple.screensaver

(The ScreenSaver process does not use this domain, so you will get an error saying that it does not exist. However, you won’t know this domain is empty until you try.)

Defaults cannot tell you when a setting is set or overridden by a configuration profile, or what its value is in that case. You cannot get the full composited view of defaults with the defaults command.

Greg Neagle wrote a short python script a while back which could give you the effective result for an identifier and a specific key. His script will also show where the value is coming from.

I have found Greg’s script to be very useful, but I wanted it to do a bit more. My version, Prefs Tool, can now show you all keys set for a specific application identifier, including those managed by configuration profiles.

$ ./prefs.py com.apple.screensaver
idleTime <int>: 0L (User/ByHost)
CleanExit <string>: u'YES' (User/ByHost)
askForPassword <bool>: True (Managed)
askForPasswordDelay <int>: 0L (Managed)
moduleDict <dict>: {
    moduleName = iLifeSlideshows;
    path = "/System/Library/Frameworks/ScreenSaver.framework/Resources/iLifeSlideshows.saver";
    type = 0;
} (User/ByHost)
showClock <bool>: True (User/ByHost)
tokenRemovalAction <int>: 0L (User/ByHost)
PrefsVersion <int>: 100L (User/ByHost)

The script has a few more tricks up its sleeve. There is also still lots of work to be done. See the Github repository and its ReadMe for details.

MacAdmins Slack – a highly opinionated guide

I love MacAdmins Slack. I am logged in nearly every day. I use it for research, solving problems, camaraderie, and just plain fun. The community there is wonderful.

There are a few things particular to this Slack and some other online forums in general that I noticed, so I thought I’d like to write this guide.

This is, as the title says, highly opionionated and from my personal perspective. I do hope it is useful for everyone.

What is Slack?

Slack is a popular message board application. It’s a cross between between a bulletin board system and a chat room.

Slack has a web interface and clients for most operating systems.

The MacAdmins Slack is a particular instance which specializes on topics relevant to Apple Administrators. You can sign up here.

The Lingo

There are a few terms particular with Slack, that might be confusing at first.

An organization can set up a Slack “Workspace.” You can be a member of and logged into multiple workspaces. You will have a different login and username for each workspace.

Slack help has a general glossary, which is helpful.


Within a workspace, Slack is separated into “channels.” Channels can be public or private. When you sign in for the first time, you are added to some public channels by default. You can click on the “Channels” header in the sidebar to browse and search existing channels.

When you are typing and start a word with the # character Slack will treat this as a link to a channel. When you start typing the channel name Slack will suggest auto-completions. If a channel with the name exists, the word will be linked so that users can click to go to that channel.

Frustratingly, Slack’s autocompletion (for channels and users) uses the return key to confirm a selection and the tab key to jump to the next suggestion in the list. This is not how those keys are usually used on macOS and throws me off every time.

Public channels in MacAdmins Slack are either on a particular technology or software (#highsierra or #munki), regions or countries (#thenetherlands, #uk or #anzmac), events (#psumac or #wwdc) or pretty much everything else.

The language on MacAdmins is usually English, though regional channels are often held in that region’s language. Be aware that English is not every user’s main language. While this can make communication frustrating on both sides, be polite, patient and friendly about it.

To be honest, there are way #toomanychannels. The reason for this is that anyone can create a channel. Before you create a new channel, you should browse and search and maybe ask if there is already a channel for that particular purpose or topic. #general is usually a good place to ask if you can’t find something obvious in the channel browser.

In addition there are private channels, which work basically the same, but cannot be searched and only joined on invitation.

Special Channels

There are a few channels that have special roles or uses:

#general: is the “anything” channel, as long as the topic is somewhat MacAdmin related. Questions asked here may are often answered directly or you will be referred to a different channel.

#backroom: This is for ‘off-topic’ discussions. Any topic goes, as long as you follow the CoC.

#ask-about-this-slack: for technical and organizational questions to the admins about the MacAdmins Slack.

Slack is not Email

The MacAdmins Slack can get very busy. You may have the urge to keep up with every message in every channel you follow. This may be possible when you are in just a few channels. However, I have gotten used to just hitting ‘shift-escape’ (Mark all as read) in the morning and maybe again in the afternoon. I try to keep up with discussions and threads I am part of, and have learnt to be ok with missing most others.


Emojis are an important part of Slack and there are a few ways of using them.

You can just insert an Emoji when typing with the standard macOS or iOS emoji picker. You can also type an emoji name or ‘code’ between colon characters:. So :grin: will turn into the grinning smiley. This is usually more convenient than the system pickers.

When you see an emoji, you can hover the mouse over it to learn its name or code.


You can add an emoji to a post with the reaction button. (the smiley with the + symbol). Then the emoji will be shown attached to the post, multiple reactions by different users will be shown next to each other, and they will be counted up.

When you hover your mouse over a reaction, it will show which users added that particular reaction.

Special Emojis

Some Emojis are unique to Slack or have special meaning

:+1: will show as the ‘thumbs up’ emoji. This is commonly used to show approval or support, though some users prefer :plus1 or :heavy_plus_sign:

:protip: is used to highlight a great tip. There is a bot that gathers all post with this reaction in the #protips channel

:this: will show as an animated chevron. Used to approve or emphasize a post.

:raccoon: is used to politely notify that an ongoing discussion might be better suited for another channel (Why is is a raccoon?)

:dolphin: is sometimes used when you leave a channel to state that you are merely leaving to prune your channel list and not because something has upset you

Custom Emojis

You can create your own emojis. Or add new names for existing ones.

Create custom emoji – Slack Help Center

To Thread or not to Thread

You can reply to a post directly in a channel’s timeline or create a ‘thread’ where the replies are collapsed or sorted with the original post. Use the speech bubble icon to create a thread.

In MacAdmins Slack, most users prefer replies in the timeline, however, when you are replying to a post further up in the timeline, then threads can be quite useful. When replying in a thread, you have the option to show the reply in the channel’s main timeline as well.

Use the ‘@’ Wisely

You can ‘mention’ another user with the @ symbol and their username. With Slack’s default setting the user will get notified of a mention. When you use @scriptingosx in a post, it will notify me, even when I am not in the channel.

This can be very useful to ‘summon’ someone into a channel, because they might be interested or able to contribute to a discussion. I use it when I reply to questions or requests that happened a while ago, so that the person gets notified that there is a reply.

Other than that, you should use mentions with care. Remember that you may be ringing all of someone’s devices with it.

Set up Do not Disturb

To avoid excessive notifications, you can set Slack to ‘Do not Disturb’ mode by clicking on the bell icon next to the Workspace name. You can snooze the Slack for a certain and setup a recurring schedule to mute notifications overnight.

A user who mentions you while have the ‘Do not Disturb’ mode enabled will be informed why you may not be reacting.

You can also see a user’s local time in their profile. This might give you an idea of when they might be online or not. You can get to a user’s profile by clicking on their icon.

Manage your Notifications

Aside from the ‘Do not Disturb’ feature you can further manage the notifications Slack can send to you.

In addition to be notified when you are mentioned (@ed) you can add certain keywords that may be interesting to you. (e.g., I have keywords for my books’ titles)

Formatting Posts

You can use a simplified MarkDown-like syntax to format your posts. Enclosing a word or sentence in underscores _ will turn it italic, asterisks * will turn it bold.

If you have trouble remembering the syntax, you can also see the most common formatting options in small text under the message entry field.

Posting Code

Since MacAdmins Slack is a technical forum, posting commands or pieces of code will be fairly common. When you enclose a sequence of words with single backticks it will be shown in monospace font, which others will usually understand to be a command.

When you use triple backticks, Slack will interpret the text in between as a code block. Other special characters and white space (multiple space, tabs, new lines) will be shown as is. This is useful to share short code blocks or log sections.

To share full scripts or longer log files, you should use Slack Snippets. You can create a snippet with the big ‘+’ button next to the text entry or by just dragging a script or text file into the slack window.

Asking questions

We all use Slack to ask for help when we are stuck. The willingness to help each other out it one of the strengths. However, when you do have to ask for help, there are a few common courtesies you should follow. (These hold true for any request for help, like a support incident.)

Be Descriptive and Specific

Don’t just say “Help, XYZ is broken!” Don’t ask if “anyone knows ABC?”

Explain what you are trying to do, in which context. Show what you already tried to fix the problem. (you did try to solve it yourself first, didn’t you?)

I find, that often the act of formulating the question properly helps me figure out the solution myself, or at least get closer to a solution.

People who want to help you will follow-up with those questions, but will be more likely to help when the request is well formulated and has (most of) the necessary context.



My postinstall script does not work! Can anybody help?


I want to show a dialog from a postinstall script which prompts the user for the computer name. I am using osascript, but it is failing and I don’t understand why?

Even better: add the script (or a part of the script) and errors you are seeing

Keep your question relevant

Sometimes a question might just drown in another ongoing conversation. Sometimes, expecially on the less busy channels, no-one will be around to answer. Be patient before you start cross-posting to other channels.

It’s ok to repeat your question, once the ongoing discussion subsides, but don’t spam. Maybe it’s just that no-one really has an answer.

Keep in mind that everyone on the MacAdmins Slack has a job, which is not answering your questions on Slack. Helping each other out on Slack is something we all do on the side, voluntarily.

Don’t @ or DM people just because they have helped you before, unless you want to follow-up on something very specific.

MacAdmins Slack is busiest during North American office hours. Keep that in mind when posting questions as well. (There are a few admins from elsewhere in the world who will help out when they can.)

What do you want to accomplish?

Even when you ask questions properly and with detail, you may ge the the counterquestion: “What is it you actually want to accomplish?” This has turned into a sort of a meme on the MacAdmins Slack.

When you get this question, someone believes that you may be narrowing down on a dead end and a completely different approach may be more appropriate. They want to get your ‘big picture’ to understand the context.

This is the time to step back, explain your goals and let the MacAdmins community help you gain some new perspective. Don’t double down on what you are trying to do. This question has lead to some of the most interesting discussions.

Join the Slack and Enjoy!

Overall I feel the MacAdmins Slack is a great place to share and receive knowledge for MacAdmins. I you still haven’t signed up, go and do it here!

If you already are a member, I hope you learnt something useful here. If you think I missed something important, then let me know! (My user name on the MacAdmins Slack is @scriptingosx.)

BBEdit at 25 and why I still use it

BBEdit turned 25 last week! Belated Happy Birthday!

I am not shy that BBEdit is my favorite text editor. I don’t remember when exactly I got my first copy, but it must have soon after it came out. I have been using it one form or another since then.

It is usually the first application I install on a new Mac. I don’t bother to add the icon to my dock because it is open all the time. (and it doesn’t hog memory)

Recently, someone asked me why I prefer BBEdit. I was caught a bit off-guard but gave my honest answer: habit.

However, this answer doesn’t really do BBEdit much justice. Now I realize it is a habit formed over two-and-a-half decades. When BBEdit came out I was a student and used it for LaTeX documents, shell scripts and Fortran code on my PowerBook 160.

Back then Mac text files preferred a different line break character (carriage return: \r) than Unix (line feed: \n) and Windows (line feed and carriage return: \r\n). BBEdit was able to read, convert and write all of them.

BBEdit transitioned to PowerPC. It was one of the first applications to have a native Mac OS X version (the Mac/Unix text file compatibility was really valuable then). BBEdit made the Intel transition and is ready for the 64-bit only future of macOS.

All along the way, BBEdit has always stayed true to the Mac environment, however the Mac changed. When you expect native ‘Mac-like’ behavior that’s how BBEdit behaves. It supports AppleScript, but also has powerful command line tools. It will parse a binary property list to XML and it will ask for authorization to read and edit root-owned files.

But, BBEdit also has always been a great way to talk with things outside of the Mac.

When I have to edit files over ssh I will grudgingly use nano or (in desperate situations) vi, but then I remember that BBEdit has direct editing over sftp.

BBEdit has supported three version control systems I have used over the years and (so far) survived two.

I have built web pages in BBEdit, trawled through truly gigantic log files, written code in secveral languages, and documents in LaTeX, Markdown and various other file formats. Some of the files were even just plain text.

If you have read anything I have written on this website, or my books, it very likely started out as a draft in BBEdit.

Right now I am writing a book with the experimental Markua language on LeanPub. In BBEdit, of course.

The advantage of text files is that they can be opened everywhere. Trying out a new text editor has virtually no barrier. Over the years I have used and tried out uncountable different editors and many of them had some features I liked. Right now I have Atom and Sublime Text on my Mac, as well. Those are great tools with some wonderful features. However, they are not native to the Mac and that often adds friction to the workflow.

Now that I have thought about it, habit is only part of the answer. It is not just habit, it is a trust they have built and earned over more than two decades.

When Apple does their next transition, I can expect BBEdit to be right there with me, still not sucking. As long as there is still a need to edit text files on Macintosh/Mac OS/Mac OS X/OS X/macOS or whatever it is going to be called, I am looking forward to the next 25 years of working with BBEdit.