Why not just

/usr/bin/defaults read /Library/Preferences/com.apple.smb.server AllowGuestAccess

When I set the value to false with defaults and read it back I get 0, which is the correct value returned for a false setting. Even though you use human readable words when setting it, reading it back displays a value of 0 or 1 (false or true)

your suggestion works in the command line and returns 0, So I have thisas my EA script and it returns:

Fail (/usr/bin/defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess).

I am missing something easy here! I just know it.

#!/bin/sh
desiredValue="0"

result=""
tmpResult= /usr/bin/defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess
if [ "$tmpResult" == "1" ]; then
result="true"
else
if [ "$tmpResult" == "0" ]; then
result="false"
else
if [ "$tmpResult" == "" ]; then
result="Domain or Key Not Found"
else
result="$tmpResult"
fi
fi
fi
if [ "$result" == "$desiredValue" ]; then
echo "<result>Pass ($result)</result>"
else
echo "<result>Fail ($result)</result>"
fi

@mm2270

I actually had to change the path in the example above

Just some questions. Why the in front of AllowGuestAccess in your script? I don't understand why that would be needed. When using defaults to read that back you shouldn't need to escape that. Or am I the one missing something?

Also, why do you need to check what it finds against a desired value in the EA itself? The Extension Attribute should simply be returning a result, which you can then use to create Smart Groups to take some action, like dropping a machine into scope of your MCX setting. Its not like you'd be looking for the script in the EA to take some action on the machine if it doesn't find the desired value. It really just plugs a value into the db. Taking an action is what a policy would be for.

Does something simpler like this work?

#!/bin/sh



GuestAccess=`/usr/bin/defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess 2> /dev/null`

echo $GuestAccess



if [[ $GuestAccess == 0 ]]; then

    echo "<results>Disabled</result>"

elif [[ $GuestAccess == 1 ]]; then

    echo "<result>Not Disabled</result>"

elif [[ $GuestAccess == "" ]]; then

    echo "<result>Unknown</result>"

fi

Forgive me if I'm overlooking something.

To test the output of the previous command in bash, you can use `echo $?`

for example:

bash-3.2$ dscl . list /Users | grep tlarkin

tlarkin

bash-3.2$ echo $?

0

Returning zero means it exited with no errors

bash-3.2$ dscl . list /Users | grep conanthebarbarian

bash-3.2$ echo $?

1

The last command failed, so it had an exit status of 1. You can use that to see if a command returns a proper exit status or not.

Thanks So much to everyone , I have learned a lot!