Disable iCloud Sync

jallen241
Contributor

Hi,

It there a way to not allow users to sync their device with their personal iCloud? Ie not allowing icloud drive.

Thanks
Jared

31 REPLIES 31

DBrowning
Valued Contributor II

@j_allenbrand Uncheck this box in the restrictions payload (functionality tab) for a config profile. 0cc18583db764132875cda1e232a6803

jhuls
Contributor III

More importantly for me...is there a way to detect if someone is already using iCloud Drive?

DBrowning
Valued Contributor II

@jhuls

Use this EA

#!/bin/bash

# Purpose: to grab iCloud Drive Desktop and Document Sync status.
# If Drive has been setup previously then values should be: "Enabled" or "Not Enabled"
# If Drive has NOT been set up previously then values will be: "iCloud Account Enabled, Drive Not Enabled" or "iCloud Account Disabled"

#Variable to determine major OS version
OSver="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"

#Determine OS is 10.12 or greater as Doc Sync is only available on 10.12+
if [ "$OSver" -ge "12" ]; then
    #Path to PlistBuddy
    plistBud="/usr/libexec/PlistBuddy"

    #Determine logged in user
    loggedInUser=$(python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "
");')

    #Variable to determine status of iCloud Drive Desktop & Documents setting
    iCloudDesktop=$(defaults read /Users/$loggedInUser/Library/Preferences/com.apple.finder.plist FXICloudDriveDesktop)

    #Determine whether user is logged into iCloud
    if [[ -e "/Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist" ]]; then
        iCloudStatus=$("$plistBud" -c "print :Accounts:0:LoggedIn" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )

        #Determine whether user has iCloud Drive enabled. Value should be either "False" or "True"
        if [[ "$iCloudStatus" = "true" ]]; then
            DriveStatus=$("$plistBud" -c "print :Accounts:0:Services:2:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )
            if [[ "$DriveStatus" = "true" ]]; then
                if [[ "$iCloudDesktop" = "1" ]]; then
                    DocSyncStatus="Enabled"
                else
                    DocSyncStatus="Not Enabled"
                fi
            fi
            if [[ "$DriveStatus" = "false" ]] || [[ -z "$DriveStatus" ]]; then
                DocSyncStatus="iCloud Account Enabled, Drive Not Enabled"
            fi
        fi
        if [[ "$iCloudStatus" = "false" ]] || [[ -z "$iCloudStatus" ]]; then
            DocSyncStatus="iCloud Account Disabled"
        fi
    else
        DocSyncStatus="iCloud Account Disabled"
    fi
else
    DocSyncStatus="OS Not Supported"
fi


/bin/echo "<result>$DocSyncStatus</result>"

jhuls
Contributor III

@ddcdennisb Thanks. This will work for most of my systems but it appears to only pull from the logged in user. Ideally it would be nice to pull from all users on the computer and report that as we have some multiuser systems.

jallen241
Contributor

@ddcdennisb where do you get the results from?

DBrowning
Valued Contributor II

@j_allenbrand , that script is an Extension Attribute. So it would be listed under which ever category you put it in.

Rye
New Contributor

@DBrowning, Do you know if this script will be updated to be compatible with Big Sur? Currently, when this script runs, it returns "OS Not Supported" next to the extension attribute. Or is there something that needs to be modified in the code for this change?

DBrowning
Valued Contributor II

@Rye easy change to the script to include Big Sur. Below is the updated EA that I use.

#!/bin/bash

# Purpose: to grab iCloud Drive Desktop and Document Sync status.
# If Drive has been setup previously then values should be: "Enabled" or "Not Enabled"
# If Drive has NOT been set up previously then values will be: "iCloud Account Enabled, Drive Not Enabled" or "iCloud Account Disabled"

#Variable to determine major OS version
OSverMinor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"
OSverMajor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 1)"
#Determine OS is 10.12 or greater as Doc Sync is only available on 10.12+
if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -eq "11" ]; then
    #Path to PlistBuddy
    plistBud="/usr/libexec/PlistBuddy"
    #Determine logged in user
    loggedInUser=$(python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "
");')
    #Variable to determine status of iCloud Drive Desktop & Documents setting
    iCloudDesktop=$(defaults read /Users/$loggedInUser/Library/Preferences/com.apple.finder.plist FXICloudDriveDesktop)
    #Determine whether user is logged into iCloud
    if [[ -e "/Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist" ]]; then
        iCloudStatus=$("$plistBud" -c "print :Accounts:0:LoggedIn" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )
        #Determine whether user has iCloud Drive enabled. Value should be either "False" or "True"
        if [[ "$iCloudStatus" = "true" ]]; then
            DriveStatus=$("$plistBud" -c "print :Accounts:0:Services:2:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )
            if [[ "$DriveStatus" = "true" ]]; then
                if [[ "$iCloudDesktop" = "1" ]]; then
                    DocSyncStatus="Enabled"
                else
                    DocSyncStatus="Not Enabled"
                fi
            fi
            if [[ "$DriveStatus" = "false" ]] || [[ -z "$DriveStatus" ]]; then
                DocSyncStatus="iCloud Account Enabled, Drive Not Enabled"
            fi
        fi
        if [[ "$iCloudStatus" = "false" ]] || [[ -z "$iCloudStatus" ]]; then
            DocSyncStatus="iCloud Account Disabled"
        fi
    else
        DocSyncStatus="iCloud Account Disabled"
    fi
else
    DocSyncStatus="OS Not Supported"
fi
/bin/echo "<result>$DocSyncStatus</result>"

Works like a charm as always.

dvasquez
Valued Contributor

I tested with this script as an extension attribute and it does indeed work for 12.5.1. 

Hello,
I added a line to help with macOS Ventura 13 which is now:

OSverMajor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 1)"

= 13

but the results are not accurate as I have iCloud and iCloud sync active. Maybe you can help me sort this out.

result is: 

Screenshot 2022-09-07 at 4.25.29 PM.png

We do not have Big Sur in our environment so the 2 work perfectly for Monterey:

OSverMinor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"

 

if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -eq "11" ]; then

 Thank you for your help!

Sorry replied to the wrong line :D 

Hi,

I used the above and i am getting

Detect iCloud Sync Settings: OS Not Supported
This is on 12.6.3 and 13.2.1
Both of these machines are M1 and M2. Am i missing something?

DBrowning
Valued Contributor II

@jmanprasert try changing the if statement to 

if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -ge "11" ]; then

I replied to the wrong line. Sorry about that:

Your script above has that line in it, 11th line.

This is the 7-11 line. Even tried taking out the -f 1)" line and didnt make a difference
#Variable to determine major OS version
OSverMinor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"
OSverMajor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 1)"
#Determine OS is 10.12 or greater as Doc Sync is only available on 10.12+
if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -eq "11" ]; then

DBrowning
Valued Contributor II

here is the most updated version that I use today that works fine.  

#!/bin/bash

# Purpose: to grab iCloud Drive Desktop and Document Sync status.
# If Drive has been setup previously then values should be: "Enabled" or "Not Enabled"
# If Drive has NOT been set up previously then values will be: "iCloud Account Enabled, Drive Not Enabled" or "iCloud Account Disabled"

#Variable to determine major OS version
OSverMinor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"
OSverMajor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 1)"

#Determine OS is 10.12 or greater as Doc Sync is only available on 10.12+
if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -ge "11" ]; then
    #Path to PlistBuddy
    plistBud="/usr/libexec/PlistBuddy"

    #Determine logged in user
    loggedInUser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

    #Variable to determine status of iCloud Drive Desktop & Documents setting
    iCloudDesktop=$(defaults read /Users/$loggedInUser/Library/Preferences/com.apple.finder.plist FXICloudDriveDesktop)

    #Determine whether user is logged into iCloud
    if [[ -e "/Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist" ]]; then
        iCloudStatus=$("$plistBud" -c "print :Accounts:0:LoggedIn" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )

        #Determine whether user has iCloud Drive enabled. Value should be either "False" or "True"
        if [[ "$iCloudStatus" = "true" ]]; then
            DriveStatus=$("$plistBud" -c "print :Accounts:0:Services:2:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist 2> /dev/null )
            if [[ "$DriveStatus" = "true" ]]; then
                if [[ "$iCloudDesktop" = "1" ]]; then
                    DocSyncStatus="Enabled"
                else
                    DocSyncStatus="Not Enabled"
                fi
            fi
            if [[ "$DriveStatus" = "false" ]] || [[ -z "$DriveStatus" ]]; then
                DocSyncStatus="iCloud Account Enabled, Drive Not Enabled"
            fi
        fi
        if [[ "$iCloudStatus" = "false" ]] || [[ -z "$iCloudStatus" ]]; then
            DocSyncStatus="iCloud Account Disabled"
        fi
    else
        DocSyncStatus="iCloud Account Disabled"
    fi
else
    DocSyncStatus="OS Not Supported"
fi


/bin/echo "<result>$DocSyncStatus</result>"

This one works. thank you so much!!

dvasquez
Valued Contributor

Sonoma compatibility?

I am seeing OS Not Supported on our clients now.

Thank you.

DBrowning
Valued Contributor II

This changes the check on Major version from equal to 11 and changes it to greater than or equal to 11.

Question regarding the results from this. We noticed that on a computer with iCloud logged in it shows "iCloud Account Disabled" but it's not and is active with the Drive enabled but not syncing. Could this be a bug or fluke on this endpoint macOS Ventura 13.2.1 M1 Pro.

DBrowning
Valued Contributor II

Guess I'll need to go back and validate.  Looks like Apple has changed some of the keys in the plist.  I'll take a look at it tomorrow and report back.

Thanks in advance as I was thinking lost my mind. We have another one that's pretty old we use that seems to be accurate enough that I've posted it below, but we've used the one you wrote for a long time.

#!/bin/sh

iCloudDrivePath="/Library/Mobile Documents/com~apple~CloudDocs"

grabConsoleUserAndHome()
{
currentUser=$(stat -f %Su "/dev/console")
homeFolder=$(dscl . read "/Users/$currentUser" NFSHomeDirectory | cut -d: -f 2 | sed 's/^ *//'| tr -d '\n')
  case "$homeFolder" in
     *\ * )
           homeFolder=$(printf %q "$homeFolder")
          ;;
       *)
           ;;
esac
}

grabConsoleUserAndHome

if [[ "$currentUser" == "root" ]]
    then
        exit
fi

# Checks if the drive path and file exists
if [[ -e "$homeFolder""$iCloudDrivePath" ]]
    then
        # Checks status of iCloud Drive Desktop and Documents setting
        iCloudDesktop=$(defaults read /Users/$currentUser/Library/Preferences/com.apple.finder.plist FXICloudDriveDesktop)
        if [[ "$iCloudDesktop" = 1 ]];
            then
                echo "<result>"Drive Enabled - Desktop/Docs Enabled"</result>"

        else
            echo "<result>"Drive Enabled - Desktop/Docs Disabled"</result>"

        fi;

    else
        echo "<result>"Drive Disabled"</result>"
fi

exit 0

DBrowning
Valued Contributor II

From testing this one seems to work now.

#!/bin/bash

# Purpose: to grab iCloud Drive Desktop and Document Sync status.
# If Drive has been setup previously then values should be: "Enabled" or "Not Enabled"
# If Drive has NOT been set up previously then values will be: "iCloud Account Enabled, Drive Not Enabled" or "iCloud Account Disabled"

#Variable to determine major OS version
OSverMinor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2)"
OSverMajor="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 1)"

#Determine OS is 10.12 or greater as Doc Sync is only available on 10.12+
if [ "$OSverMinor" -ge "12" ] || [ "$OSverMajor" -ge "11" ]; then
    #Path to PlistBuddy
    plistBud="/usr/libexec/PlistBuddy"

    #Determine logged in user
    loggedInUser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
	
    #Variable to determine status of iCloud Drive setting
    iCloudDriveStatus=$(defaults read /Users/"$loggedInUser"/Library/Preferences/com.apple.finder.plist FXICloudDriveEnabled)
	
	#Variable to determine if a user is logged into iCloud
    "$plistBud" -c "print :Accounts:0:AccountID" /Users/"$loggedInUser"/Library/Preferences/MobileMeAccounts.plist > /dev/null 2>&1
	iCloudSignInAccount=$(echo $?)
	
	#If an AccountID is not found 
	if [[ "$iCloudSignInAccount" = "1" ]]; then
		DocSyncStatus="Disabled"
	else
		#If an Account ID is found
		iCloudSignInStatus="1"
		#Variable to determine if Drive is enabled
		driveStatus=$("$plistBud" -c "print :Accounts:0:Services:2:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist)
		
		#If account is signed in
		if [[ "$iCloudSignInStatus" = "1" ]]; then
		
			if [[ "$driveStatus" = "true" ]]; then
       			DocSyncStatus="Enabled"
			fi
		
			if [[ "$driveStatus" = "false" ]]; then
       			DocSyncStatus="iCloud Account Signed In, Drive Not Enabled"
			fi
		fi
	fi
	
else
    DocSyncStatus="OS Not Supported"
fi

/bin/echo "<result>$DocSyncStatus</result>"

dvasquez
Valued Contributor

Very nice and thank you for the work here. I put this in-place and it is working as expected.

Again, thank you!

dvasquez
Valued Contributor

It does seem to work fine.

Thank you again.

 

Rye
New Contributor

@DBrowning Thanks!

jallen241
Contributor

Hi did you put this script under extension attributes or somewhere else? 

dvasquez
Valued Contributor

It is under extension attributes

jallen241
Contributor

Screenshot 2022-09-07 at 2.48.03 PM.pngScreenshot 2022-09-07 at 2.48.57 PM.png

 

hmm I can't seem to get it to show up

dvasquez
Valued Contributor

Screenshot 2022-09-07 at 6.12.33 PM.png

I used the second script posted and set it under Extension Attributes... 

dvasquez
Valued Contributor

I assume you ran a recon on at least one laptop... to pick up the extension attribute?

dvasquez
Valued Contributor

You have it listed under Hardware.

I am sure you know that by now.

Thank you!