Advanced Mac Configuration Topics

Revision as of 09:59, 17 November 2009 by Christopher Hunt (talk | contribs) (Tagged: Moving this page to the Internal wiki.)

NOTE: This page contains information that is only useful to Helpdesk / LIS faculty and staff. Therefore I'm considering moving this information to our Internal wiki. If you feel that this information is important to the general public and/or do NOT think that this move is appropriate, please comment on the discussion page.

--Hunt, Christopher 14:59, 17 November 2009 (UTC)

System, disks, users

Refresh disk arbitration

Note: This may force disks that haven't mounted to mount.

disktool -r

Enable Journaling

diskutil enableJournal /

Matching Mac Model Name with Model Identifier, Mac OS X Build, production date, and Apple Hardware Test version

  1. Get Model IDENTIFIER from System profiler (it will look like Model Identifier: MacBookPro2,2)
  2. Visit http://mactracker.dreamhosters.com/iphone/#_modelWindow and find the model with that identifier
  3. Done

More useful resources:

Programatically Delete Cached User Accounts

From http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html

# Script to remove cached accounts in the local DS node
# This should work in both Tiger and Leopard
# Run this script as root or with sudo

# dscl searching only does exact matches.  So we list the records and pipe them through to grep to find the list of records we want.
# The first column will be the username and we get that using awk.
# We also remove the line endings with tr to make it one long string.

for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser                    # now we delete the record using dscl

More resources: http://www.macosxhints.com/article.php?story=20080127172157404

Enabling Directory Service debug logging

sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Disabling Directory Service debug logging

sudo rm /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Resetting Mac OS X Machine Account Domain Password

See http://www.afp548.com/article.php?story=20061217110502523

Forcefully remove a Mac from the domain

sudo dsconfigad -r -f -u username -p password

Where "username" is the username that was used to add the machine to the domain, and "password" is this username's password.

Resetting Directory Service Settings

This is useful in cases where removing/adding the computer from/to the domain does not work using the standard method (Manually Add a Mac to the Domain). The instructions below forcefully remove (unbind) the mac from the domain:

  1. Login with a local account.
  2. Open the Terminal application
  3. Enter each of the lines below, followed by pressing enter:
sudo rm -rdfv /Library/Preferences/DirectoryService
sudo rm -rdfv /var/db/dslocal/nodes/Default/config
sudo sudo killall -USR1 DirectoryService
  1. Open Macintosh HD => Applications => Utilities => MIDD => Midd1stBootConfig.
  2. Follow the on-screen instructions. When the "Update User Template" application opens, click "Quit".
  3. Reboot and try logging in again with your domain account. If that fails Manually Add a Mac to the Domain.

Reset Mac user or admin password

Can require install disks to reset if you have forgotten the old password. Help here

Give admin (administrator) privileges to a user using the Terminal

Open Terminal, type the line below, hit enter:

sudo dscl . -append /Groups/admin GroupMembership usernamegoeshere

To check who's an admin currently:

dscl . -read /Groups/admin | grep GroupMembership

The above can also be used in ARD commands or in shell scripts.

Upgrade groups to the new UID format

This allows nested group (i.e. a domain group to be a member of a local group).

dseditgroup -o edit -t group -f n groupnamegoes here

Make the admin group a member of the _lpadmin group

  • Easy solution: Connect to smb://middfiles.middlebury.edu/middfiles and open Software => Software Macintosh => Quick-Fixes. Double-click Add Printer - Permissions Problem Fix (lpadmin).app
  • The harder solution (run commands below): This converts the _lpadmin and the admin group to the new format, adds the key NestedGroups to the _lpadmin group and populates it with the GUID of the admin group. Finally, the admin account is made a member of the _lpadmin group.

dseditgroup -o edit -t group -f n admin
dseditgroup -o edit -t group -f n _lpadmin
dseditgroup -o edit -a admin -t group _lpadmin
dscl localhost -create /Local/Default/Groups/_lpadmin NestedGroups ABCDEFAB-CDEF-ABCD-EFAB-CDEF-00000050
dseditgroup -o edit -a admin -t group _lpadmin

Add an application to the dock using a script

  • Add for current user:
defaults write com.apple.dock persistent-apps -array-add "<dict><key>tile-data</key><dict>\
<key>file-data</key><dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
  • Add for default user template:
defaults write /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.dock \
persistent-apps -array-add "<dict><key>tile-data</key><dict><key>file-data</key>\
<dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
  • Add for all users (current and future):
for folder in /Users/*
defaults write $folder/Library/Preferences/com.apple.dock persistent-apps -array-add \
<string>/Applications/Final Cut Express.app</string><key>_CFURLStringType</key>\
currentuser=`basename $folder`
chown $currentuser $folder/Library/Preferences/com.apple.dock.plist

Run a command for each user

for folder in /Users/* echo "Doing a command for $folder" done

For example, this command sets the default printer to LIB242K:

for folder in /Users/*
echo Default LIB242K > $folder/.cups/lpoptions
chmod 777 $folder/.cups/lpoptions

Distribute a file to each user's home dir

E.g. distribute custom print settings to each user

for folder in /Users/*
ditto -V $folder/Library/Preferences/com.apple.print.custompresets.plist \
ditto -V /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.print.custompresets.plist \
chmod 777 $folder/Library/Preferences/com.apple.print.custompresets.plist

ARD techniques

Known ARD Issues

See Known ARD Issues.

Desirable ARD commands

  • Set disk permissions. Ignore permissions.
  • Add ACLS for folders
  • Run login permission script
  • unbind/rename/rebind/rescan/apply proper admin privs.
  • login items fix

Installing (Pushing) Adobe CS via ARD

Note: This assumes you've created a disk image with the applications (from /Applications), and a disk image with the settings (in /Library/Application Support, as well as /Library/Preferences).

hdiutil attach /adobepro.dmg
ditto -V /Volumes/adobepro /Applications
hdiutil detach /Volumes/adobepro
rm -rdfv /adobepro.dmg

hdiutil attach /settings.dmg
ditto -V /Volumes/settings /Library
hdiutil detach /Volumes/settings
rm -rdfv /settings.dmg

Installing LabStats via ARD

  • Requirements: If the client computers are running Mac OS X Leopard, you need LabStats version 4.4.x (at least).
  1. On your ARD computer, visit the labstats admin page and download the Mac installer.
  2. Unzip it the package, and you will get two files (one ending in tar.gz, one ending in conf)
  3. Unpack the tar file (double-clicking should suffice) until you see the install package (ends with pkg).
  4. Open ARD, select the client computers (the ones that need labstats), then click "Copy"
  5. Drag the pkg file and the conf file to the upper portion of the copy window (you can also use the + button), under "Place Item In" specify the full destination to "/tmp" (without the quotes), then click Copy.
  6. When the copy process finishes, select the same computers again and click the Unix command button. In the window that appears, paste these lines in the upper portion:
    installer -package /tmp/labstats_mac_client_installer.pkg -target / 
    rm -rdfv /tmp/labstats* 
  7. Under "Run the command as" enter the user "root" and click "Send"

Mute or set volume via ARD

osascript -e "set volume 0"

Change the zero to another number to set the volume to a higher value. Zero is mute. This seems to be system wide. It also mutes the startup chime. Good for classrooms. If headphones are plugged in, they have a separate volume setting.

Make Macs Speak via ARD

say "I hate Macs"

Set the Open Firmware password via ARD

Note: You need our Open Firmware package for this! It should be on our Mac server.

sudo ofpassword set blahblah123

Enable SSH via ARD

This seems to work:

systemsetup -setremotelogin on

Some other ideas:

echo yes | /System/Library/CoreServices/RemoteManagment/ARDAgent.app/Contents/Support/systemsetup -setremotelogin on
/sbin/service ssh start
echo "AdminsPassHere" | sudo service ssh start

This seems to work until reboot:


Enable ARD remotely

e.g. via SSH

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users admin -privs -all

If nothing's been enabled, the full line should look like: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu

Mount AFP volume via applescript via ARD

osascript -e 'mount volume "afp://user:password@computername/Macintosh HD"'

Check if a process is running via ARD

E.g. Check if AFP server is running

ps -axww | grep -i "AppleFileServer"

Start AFP sharing remotely

  1. Change /etc/hostconfig so that AFPSERVER=-YES=
  2. Send unix script
    sudo AppleFileServer

Get folder size via ARD

du -d 1 -h /Users/Shared/editingclass

Set power management on Macs via ARD

Can be done using the pmset command. Remember to always execute this command as user "root" in ARD. Examples:

  • Instructor stations that need to remain awake for the duration the class:
    pmset -a sleep 0 disksleep 10 displaysleep 75
    The sleep parameter tells the computer never to sleep, disksleep makes the hard disk spin down in 10 minutes, displaysleep makes the monitor remain awake for 75 minutes.
  • Regular workstations that need to remain awake for management purposes can turn off the screen (e.g. after 35 mins) and spin down the hard disk to save power:
    pmset -a sleep 0 disksleep 10 displaysleep 35
  • Alternatively, the machines can be turned off / set to sleep whenever and you designate a "remote management" time period (say, every day after 3:00am). The Mac OS X power management allows you to set the computer to wake up or power on at a specific day and time. This way if a machine was turned off or set to sleep, it can become available for updates, etc. Here's an example:
    pmset repeat wakeorpoweron MTWRF 03:00:00
    This wakes the machine (if it's asleep) or powers it on (if it's turned off), every weekday at 3am.

Get Link Speed

ioreg -l | grep "IOLinkSpeed"

Divide by 1000000 to get "human readable".

Application tips

Pushing LabStats via ARD

Labstats can be pushed via ARD. There are two methods, both start with the same process:

  1. On a machine with ARD, grab the Mac labstats installer from http://labserver:8080/admin
  2. Unpack it, you'll get two files - a pkg package and a "conf" file.

Method 1: Copy the labstats.conf file INSIDE the installer (ctrl+click on the installer, open Contents => Resources => drag the conf file in here). Open the file named "postflight", delete everything in it and replace it with:


ditto "$1/Contents/Resources/labstats.conf" /private/etc/labstats.conf
chown root:wheel /private/etc/labstats.conf
SystemStarter start LabstatsClient

Method 2: Push the default config file AFTER pushing labstats: Use the ARD "copy" button to copy the conf file to a custom destination: /etc

Reset Spotlight

sudo mdutil -i off /
sudo mdutil -E /
sudo mdutil -i on /

Update Symantec AntiVirus

LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

LiveUpdate tends to be in the root library support folder: /Library/Application\ Support/Norton\ Solutions\ Support/LiveUpdate/LiveUpdate.app/Contents/MacOS/LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

Check when an application was last opened

mdls -name kMDItemLastUsedDate /Application/Application.app

Check an entire folder:

mdls -name kMDItemLastUsedDate /Application/*

Filter applications from an entire folder:

mdls /Applications/Adobe\ Photoshop\ CS/* | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemLastUsedDate)|(app)'

Batch checking

mdls "/Applications/Macromedia Dreamweaver MX 2004/Dreamweaver MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Flash MX 2004/Flash MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Fireworks MX 2004/Fireworks MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/Adobe Photoshop CS/Adobe Photoshop CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe InDesign CS/InDesign CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe Illustrator CS/Illustrator CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/GarageBand.app" | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

X11 and the PATH variable in Leopard and Snowleopard

There seems to be no way to directly set the X11 PATH variable. However, if you correctly set your PATH variable in the Terminal (check the command path_helper), you can then launch xterm (X11) from Terminal.app and it will inherit the PATH variable.

A massive X11 FAQ is available here: http://forums.macosxhints.com/showthread.php?t=80171

Network & Printers

Get MAC Address

/sbin/ifconfig en0 | grep ether | cut -d' ' -f 2

Set computer name

sudo scutil --set LocalHostName NEWCOMPUTERNAME
sudo scutil --set ComputerName NEWCOMPUTERNAME

Printers: Install, delete, set as default

List installed printers

lpstat -p


lpadmin -p printer_name -E -v lpd://server/printer -P path-to-ppd.gz
  • An example with a compressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.gz

  • Or an uncompressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.ppd

Must be followed by

cupsenable printer_name


lpadmin -x printer_name


lpadmin -x AdobePDF7

Set as default

lpadmin -d printer_name

Install but disable sharing and add description

lpadmin -p printer_name -E -v lpd://server/printer -D "Room AB123" -P ppdpath -o printer-is-shared=false

Enabling Duplexing

On HP printers this should suffice:

lpadmin -p prntr -E -v lpd://srv/prnt -D "rmnr" -P "ppdpath" -o "HPOption_Duplexer=True" -o Duplex=DuplexNoTumble

On other models you can try listing the available printer options, then pass the appropriate option to lpadmin using the "-o" parameter. To list all available printer options, install the printer on any one workstation and then run:

lpoptions -p printer_name -l

For an HP laserjet the above command gives two options related to duplexing: HPOption_Duplexer and Duplex -- so those are the parameters passed using "-o" in the example above.


Remedying and preventing duplicate DDNS registrations in Mac OS X

1) remove computer from domain 2) Run these commands sudo /usr/sbin/systemkeychain -k /Library/Keychains/System.keychain -C -f sudo rm -rf /var/db/krb5kdc sudo /usr/libexec/configureLocalKDC (ensure uniqueness of local kerberos db) 3) Follow these instructions: http://support.apple.com/kb/HT3169

4) Follow these instructions: http://support.apple.com/kb/HT3169

5) Rename computer as desired under System Preferences => Sharing, then run these commands: sudo hostname NEWCOMPUTERNAME sudo scutil --set ComputerName NEWCOMPUTERNAME sudo scutil --set LocalHostName NEWCOMPUTERNAME sudo scutil --set HostName NEWCOMPUTERNAME (ensure all possible host names are the same) 6) Open Directory Utility, AD plugin, rename computer as desired there, then bind to domain (adding to correct OU)

May need to re-enter username/password in Xsan admin app. May need to remove computer from Xsan database and re-add.

Connect to an AFP server from the command line

sudo mkdir /Volumes/myserver
sudo mount_afp afp://username:password@servername/sharename /Volumes/myserver

Reimage a mac from an image using the command line asr

sudo asr restore --source /Volumes/Source/Image.dmg --target /Volumes/Destination --erase --noverify

Note: This ERASES the destination drive. It also skips verification (which Disk Utility forces you to do, thus adding 10-15 minutes to the imaging process). Verification is GOOD, but sometimes, when you're sure that the image is healthy and your destination drive is healthy, it can be a waste of time.

Manipulating and modifying ACL permissions from the command line terminal

Read ACL

ls -le /path/to/dir

Write ACL

chmod -R +a "group:admin allow read write delete" /path/to/dir

Delete ACL

chmod -R -a# 0 /path/to/dir

Run an ASR server

GUI: Protonpack

sudo asr -source /Volumes/Images/image.dmg -server /path/to/config.plist

Restore a client from an ASR server

GUI: NetRestore

sudo asr -source asr://serverip -targer /Volumes/Volume -erase -noverify

Set expanded windows for save and print

defaults write -g PMPrintingExpandedStateForPrint -bool TRUE

defaults write /Library/Preferences/.GlobalPreferences NSNavPanelExpandedStateForSaveMode -string 1

Make the help window and the add printer (addprinter.app) window act normal

This makes the help window and addprinter.app window accessible to the Dock and command-tab.

sudo defaults write "${i%.plist}" LSUIElement 0
sudo chmod 644 "$i"

i=/System/Library/CoreServices/Help\ Viewer.app/Contents/Info.plist
sudo defaults write "${i%.plist}" LSUIElement 0
sudo chmod 644 "$i"

Slipstreaming Office 2008 for Mac

See: Slipstreaming Office 2008 for Mac

Apple System Image Utility Tips

  • When creating a workflow, "Define Image Source" needs to be on top and "Create Image" on the bottom of the workflow. The rest of the actions may have any order (or so it appears).

Archiving user accounts from a previous semester

cd /Users/
mkdir zz_PreviousSememsters
for cfolder in /Users/*
echo $cfolder
echo "$cfolder" | grep -x zz_PreviousSememsters
if [[ $? > 0 ]]
echo "absent"
mkdir "$cfolder"
mv -f "$cfolder" "/Users/zz_PreviousSememsters/"
echo "present"
return 0


Deleting ALL cached domain user accounts

You can also delete all accounts from the entire semester:

# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser
rm -rdfv /Users/$cuser

# Deleting the Shared files
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*

Deleting ALL cached domain accounts except those on a custom list

#Set the warning flag to off (case sensitive) if you want to start the deletion of accounts.

#Set this flag to true if you want /Users/Shared to be deleted, as well.

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
ls -a /Users/
#Accounts listed here will not be deleted. Local accounts are not deleted by default.
# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
echo $MIDD_DONTDELETE | grep -i "$cuser"
if [ $? == 1 ]
echo "Deleting $cuser"
dscl . -delete /Users/$cuser
rm -rdf /Users/$cuser
echo "$cuser in exclusions list, not deleting"

if [[ "$MIDD_DELETESHARED" == "true" ]]
# Deleting the Shared files
echo Deleting "/Users/Shared"
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*
echo "MIDD_DELETESHARED is set to false so I'm not deleting any files in /Users/Shared"

Erasing a volume entirely and setting permissions

#Set the warning flag to off (case sensitive) if you want to start the deletion.

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
echo Permissions status before erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"

echo Erasing Save Here volumes
diskutil eraseVolume "HFS+" "Save Here" "/Volumes/Save Here"
diskutil eraseVolume "HFS+" "Save Here" /Volumes/SaveHere

echo Ensuring proper permissions status after erasing
vsdbutil -d /Volumes/SaveHere
vsdbutil -d "/Volumes/Save Here"

echo Reporting permissions status after erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"
  • Alternatively, you can replace the "diskutil eraseVolume..." lines with something like rm -rdf "/Volumes/path/to/specific folder to clear"
Powered by MediaWiki