Creating a config profile or script to Show All Filename Extensions

[janzaldua]

Hello. I can get these commands and scripts to work just fine when running them locally on my Mac, but they seem to fail when getting pushed from Jamf.

Scripts.

1: 

#!/bin/sh
defaults write NSGlobalDomain "AppleShowAllExtensions" -int "1" && killall Finder

2:

#!/bin/sh
defaults write NSGlobalDomain "AppleShowAllExtensions" YES && killall Finder

Both work fine, surprisingly. Whether I run the scripts from Terminal, or I run the commands themselves directly from Terminal, it works both ways. But if I run either of the two scripts via a policy through Jamf, it doesn't work. The script runs and I see Finder quit/restart, but the setting for 'Show all filename extensions' does not change.

I was going to try a Configuration Profile instead, but cannot figure that out. I had started something like this:

Preference Domain: com.apple.finder

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>AppleShowAllExtensions</key>
    <integer>1</integer>
</dict>
</plist>

Any help appreciated! I'm on macOS Ventura, 13.4.1 (c)

[sdagley]

@janzaldua When you run the command from Terminal you're running it as the logged in user. When you're running the command from Jamf Pro you're running it as the root user. To run the command as the logged in user when running the script via Jamf Pro see the following article: https://scriptingosx.com/2020/08/running-a-command-as-another-user/

[obi-k]

What I am using @YanW : https://community.jamf.com/t5/jamf-pro/script-show-item-info/m-p/279607#M252619

Worth a look for all users: https://community.jamf.com/t5/jamf-pro/see-all-filename-extensions/m-p/106061

[obi-k]

Wrong first link. But here's the script:

#!/bin/sh

# 6.2 Turn on filename extensions

currentUser=$(ls -l /dev/console | awk '{print $3}')

sudo -u $currentUser /usr/bin/defaults write /Users/$currentUser/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true

sleep 2

killall Finder

sleep 2

exit 0

[janzaldua · Accepted solution]

This helped a lot! I am using a slightly modified version of this and it works fine.

#!/bin/bash

#creates a variable for the current logged in user
currentUser=$(who | awk '/console/{print $1}')

#runs the command as the logged in user
su $currentUser -c "defaults write NSGlobalDomain "AppleShowAllExtensions" -int "1" && killall Finder"

[Bol]

@janzaldua 
For configuration profile you can use the 'Application & Custom Settings' payload.
Just copy the json manifest code from Jamf's github page below and then paste it into;
'External Applications' - 'Custom Schema' - 'Edit'. (not forgetting the preference domain)
You then have a number of settings available which can be toggled on or off. Works like a charm

Alternatively, you can download the json file and upload instead of pasting the code, that way the pref domain is pre filled for you.
https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror/blob/main/manifests/ManagedPre...

[mm2270]

This doesn't work for me. Are you sure it works for you? I've always had to do this with a script applying the value in the plist in the user space. I would love to get it work with a profile, but have never had any luck with that, including with this manifest above.

[Bol]

I briefly looked two days ago but it was on an existing machine, I haven’t checked on a fresh enrolment. I’ll test again tomorrow and see.

[Bol]

I thought the domain was incorrect (tried .GlobalPreferences) but looking at Apple's docs and comments here, it was taken away some time ago (when SIP was introduced maybe 10.11 or 10.12?). Other settings in that domain do work ok still.

https://developer.apple.com/documentation/devicemanagement/globalpreferences

So yes, scripting looks like the way to go for this key!

sudo -u $(ls -l /dev/console | awk '{print $3}') defaults write NSGlobalDomain "AppleShowAllExtensions" -int "1" && killall Finder 

[janzaldua]

This did not work for me. I temporarily unmarked it as a solution until we figure out the kinks. I tried changing the Preference Domain to com.apple.Finder, but still no luck. Let me know if y'all figure this out, because I would prefer a config profile over a script.

[sdagley]

@janzaldua Not everything is settable via a Configuration Profile, and for settings that are set via Configuration Profile that will prevent a user from changing it if they don't like the setting you're deploying. For something like the file extension setting, where it could be considered a matter of taste, using a script will cause less user abrasion.

[mm2270]

Except in cases where you are being asked to force something based on a recommendation, like from CIS. Then it would be nice to be able to force it to enabled. I agree that in the grand scheme of things, showing Finder extensions is a very minor security setting. But management in some places like to apply as much of the recommendations as possible, user personal tastes be damned. Unfortunately, this happens to be one of those settings, even though I would not personally care if we do it or not.

[janzaldua]

Agreed. I know the drawback to Config Profile is user configuration options, but some policies need to be enforced to be within compliance, as mm2270 said.

[obi-k]

Just tested it. Didn't work on other user accounts. Was hopeful. The other options in the json file are worth looking at though.

This reminds me of the CIS recommendation. I couldn't get the profile to work so fell back to using the script above.

Wonder if this is an Apple issue?

[mm2270]

The CIS recommendation is what led me down the path to trying to find some way to manage this via profile, and ran up empty despite my best attempts. I was also hopeful the above custom schema would do it, but it doesn't. I tried applying the profile both at Computer and User levels, restarted Finder and the computer, but no luck. I honestly think this is a bug in the OS that Apple never addressed and doesn't have any interest in addressing probably. If so, I don't know if we'll ever see a profile based solution.

[sdagley]

@mm2270 No question some settings, or some settings for some orgs, really need to be locked. I'm just still peeved that when Apple ditched MCX for Configuration Profiles they completely forgot about Manage Once and everything became Manage Always even if that isn't what one wants/needs.

And on a  different topic anyone else getting a "I'm not a robot" CAPTCHA when replying now?