Skip to main content
Solved

Search Web History on Clients

  • November 24, 2014
  • 2 replies
  • 27 views
G
Forum|alt.badge.img+18
  • GabePPS
  • Esteemed Contributor
  • 831 replies

So we recently had someone printout some documents that seemed slightly questionable and I am looking for a way to see what computer may have been on a specific website by searching web history. Anyone know of a way to search web history for Safari/Firefox/Chrome? I have it narrowed down to a small group of computers but would rather know if they went to this specific website for sure. I could go through the content filter/firewall but thought this would be easier.

Gabe Shackney
Princeton Public Schools

Best answer by mm2270

I'm not sure if I would bother with this unless I was directed to by management.
For one, its not the easiest thing to pull all the browser history, at least not for all the browsers listed. For another, its trivially easy for someone to delete their browsing history, which means it won't show up in any results.

Anyway, you'd have to figure out how to actually report on it. You could do something like run a Casper Remote run command against the target Macs to get some immediate results back I guess.

If you really want to do this, here's a simple line that should print the sites from your own Safari browser history and only show any with "apple.com" in them. You'd have to make this work for other accounts.

defaults read ~/Library/Safari/History.plist | grep '""' | awk -F'"' '{print $4}' | grep "apple.com"

There are likely much better ways of doing this, like looking at this through your schools content filter.

GabePrinceton Public Schools

    2 replies

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • 7886 replies
    • Answer
    • November 24, 2014

    I'm not sure if I would bother with this unless I was directed to by management.
    For one, its not the easiest thing to pull all the browser history, at least not for all the browsers listed. For another, its trivially easy for someone to delete their browsing history, which means it won't show up in any results.

    Anyway, you'd have to figure out how to actually report on it. You could do something like run a Casper Remote run command against the target Macs to get some immediate results back I guess.

    If you really want to do this, here's a simple line that should print the sites from your own Safari browser history and only show any with "apple.com" in them. You'd have to make this work for other accounts.

    defaults read ~/Library/Safari/History.plist | grep '""' | awk -F'"' '{print $4}' | grep "apple.com"

    There are likely much better ways of doing this, like looking at this through your schools content filter.

    G
    Forum|alt.badge.img+18
    • GabePPS
    • Author
    • Esteemed Contributor
    • 831 replies
    • November 24, 2014

    Thanks for that...management is already pulling the trigger on this so I can scope to my small group and perhaps make this an extension attribute or something.

    Gabe Shackney
    Princeton Public Schools

    GabePrinceton Public Schools


    Terms & ConditionsCookie settingsAccessibility statement