Help pushing a System Prefrence not contained in any Casper template.

[Paul_Price1]

First off thanks much to all who participate in this forum. Its a valuable resource and has saved my bacon several times.
I am fairly new to the Mac platform (1 year) and recently passed my CCA. I know enough to be dangerous.

What process and tools do you admins use when you have a need to push a system preference that is not part of one of Casper's Templates or Configuration Profiles. (That is my "teach me how to fish question")

I am trying to package and distribute a setting that is found at [System Preferences, Keyboard, keyboard Shortcuts, uncheck everything under Mission Control]. (This is my "catch the fish for me" question) This is a required setting for the MN Secure Browser testing software we use in our school district here.

Thanks in advance for any help and my apologies if this is covered in another thread that my keywords did not uncover yet.

Paul

[mm2270 · Accepted solution]

Hi Paul,
When you say "need to push a system preference that is not part of one of Casper's Templates or Configuration Profiles." are you talking about a PreferencePane or do you actually mean something like a preference setting? As in an MCX setting?

If you mean a preference setting and not an actual Preference Pane, (which I assume is what you mean) we are currently still using only MCX, not Configuration Profiles here, though I suspect we will need to take the dive into those sooner rather than later.
As for figuring out how to set up a custom setting not part of the JSS template, first thing I do is use Google. Seriously, almost everything you may want to set is already out there or in the very least there are threads where someone is asking the same question and someone has answered it (if its possible to do).

If that fails me, next thing I do is, if I'm sure its stored in a regular plist file, but not sure what file is being modified when the changes occur, I just use the Finder open to the Preferences folder sorted by the Date Modified column, make the change in System Preferences and watch which file jumps to the top of the list. You can also use Composer to do a snapshot using the "Monitor File System Changes" option, change the setting manually in System Preferences or whichever other application you need, then capture it and see what got modified. In either case, If I see plist files being changed, I next examine those in Terminal, XCode or a Text editor, whichever gives me the most readable results.
Sometimes i do the above procedure using a "before" and "after" approach and copy both files to separate folders (so they don't overwrite each other). See what the difference is in the plist files that seems to control that setting to narrow in on it. You can actually use something like 'diff' to compare the two files if they have a ton of settings in them as well.
In most cases they are things you can plug into an MCX setting or a Configuration Profile and push out.

So, to make this a bit more 'real world', I used the above process to capture the settings you're looking to change under Keyboard > Mission Control and I can see that they get stored in a file at ~/Library/Preferences/com.apple.symbolichotkeys.plist. The keyboard shortcuts have a corresponding "enabled" key with a boolean value assigned to them of "true" or "false", or "0" or "1" if viewed with the defaults command.
Its all stored in a big array that includes other keyboard shortcuts, not just the Mission Control ones, so you may have better luck simply opening the file and copying the entire dict array that shows up as:

<dict>
    <key>AppleSymbolicHotKeys</key>
. . . . (all settings here)
</dict>

into a custom MCX or Configuration Profile. The only thing is, this is in the user space (~/Library/Preferences/) and I don't know if the setting can be enforced. Could be one of those "At every login" type of things, so if you were looking to lock it out form the students, I honestly don't know if it can be done, for that setting at least.
You can try doing something like pushing the setting, then changing the permissions on the file to read only for your users, so anything they try to change in that preference won't get written back to the file. But test test test before doing anything like that.

Hope the above helps.

[jacob_salmela · Accepted solution]

Dear Paul:

Here is an overview of what I do:

1. Determine what .plist is associated with the preference
2. Make a copy of the .plist
3. Using Plist Editor, remove all entries except for the preference I am trying to set
4. Save this as a new .plist
5. Convert it it to XML
6. Upload it into a configuration profile under the custom tab

Currently, I have config profiles for:

• setting Terminal preferences
• setting Finder view preferences
• setting the Desktop picture
• disabling Dashboard and Space (required for some software we run)
• making the Dock immutable (dock.plist)
• setting hot corners (dock.plist)
• increasing Mission Control speed animations (dock.plist)

Sometimes, you just need to experiment with different settings. It is kind of a laborious process, but very helpful if they work!

[mm2270 · Accepted solution]

Hi Paul,
When you say "need to push a system preference that is not part of one of Casper's Templates or Configuration Profiles." are you talking about a PreferencePane or do you actually mean something like a preference setting? As in an MCX setting?

If you mean a preference setting and not an actual Preference Pane, (which I assume is what you mean) we are currently still using only MCX, not Configuration Profiles here, though I suspect we will need to take the dive into those sooner rather than later.
As for figuring out how to set up a custom setting not part of the JSS template, first thing I do is use Google. Seriously, almost everything you may want to set is already out there or in the very least there are threads where someone is asking the same question and someone has answered it (if its possible to do).

If that fails me, next thing I do is, if I'm sure its stored in a regular plist file, but not sure what file is being modified when the changes occur, I just use the Finder open to the Preferences folder sorted by the Date Modified column, make the change in System Preferences and watch which file jumps to the top of the list. You can also use Composer to do a snapshot using the "Monitor File System Changes" option, change the setting manually in System Preferences or whichever other application you need, then capture it and see what got modified. In either case, If I see plist files being changed, I next examine those in Terminal, XCode or a Text editor, whichever gives me the most readable results.
Sometimes i do the above procedure using a "before" and "after" approach and copy both files to separate folders (so they don't overwrite each other). See what the difference is in the plist files that seems to control that setting to narrow in on it. You can actually use something like 'diff' to compare the two files if they have a ton of settings in them as well.
In most cases they are things you can plug into an MCX setting or a Configuration Profile and push out.

So, to make this a bit more 'real world', I used the above process to capture the settings you're looking to change under Keyboard > Mission Control and I can see that they get stored in a file at ~/Library/Preferences/com.apple.symbolichotkeys.plist. The keyboard shortcuts have a corresponding "enabled" key with a boolean value assigned to them of "true" or "false", or "0" or "1" if viewed with the defaults command.
Its all stored in a big array that includes other keyboard shortcuts, not just the Mission Control ones, so you may have better luck simply opening the file and copying the entire dict array that shows up as:

<dict>
    <key>AppleSymbolicHotKeys</key>
. . . . (all settings here)
</dict>

into a custom MCX or Configuration Profile. The only thing is, this is in the user space (~/Library/Preferences/) and I don't know if the setting can be enforced. Could be one of those "At every login" type of things, so if you were looking to lock it out form the students, I honestly don't know if it can be done, for that setting at least.
You can try doing something like pushing the setting, then changing the permissions on the file to read only for your users, so anything they try to change in that preference won't get written back to the file. But test test test before doing anything like that.

Hope the above helps.

[Paul_Price1]

Very generous response. Thank you for your time. Yes a custom MCX is what I am after.

I had identified the com.apple.symbolichotkeys.plist as my changing plist file but my lack of skills in manipulating that file into something deploy-able by casper had me doubting myself. Thanks for setting me back on that file. The tip on sorting files by modify date is great and much quicker than the snapshotting I was doing. I'm trying to use Casper to make changes within com.apple.symbolichotkeys.plist using the config below.

I logged into my JSS and created a Managed Preference and configured it as follows.
General Tab
Display name = MN Secure Browser Config
Apply Setting to: User Level Enforced
Domain:~/Library/Preferences/com.apple.symbolichotkeys
Key:79
Value: Radio Button option set to False

Definition tab,
Domain = com.apple.symbolichotkeys
Key Name = 79
Key Type = Bolean

I then duplicated the above for Keys 80, 81, and 82. I have slapped my configurations around some changing bolean to manual to integer etc with no success.

Thanks again for your time.

[jacob_salmela · Accepted solution]

Dear Paul:

Here is an overview of what I do:

1. Determine what .plist is associated with the preference
2. Make a copy of the .plist
3. Using Plist Editor, remove all entries except for the preference I am trying to set
4. Save this as a new .plist
5. Convert it it to XML
6. Upload it into a configuration profile under the custom tab

Currently, I have config profiles for:

• setting Terminal preferences
• setting Finder view preferences
• setting the Desktop picture
• disabling Dashboard and Space (required for some software we run)
• making the Dock immutable (dock.plist)
• setting hot corners (dock.plist)
• increasing Mission Control speed animations (dock.plist)

Sometimes, you just need to experiment with different settings. It is kind of a laborious process, but very helpful if they work!

[Paul_Price1]

Hey Jacob, I see we are neighbors. I work for Eden Prairie Schools. Thanks for taking the time to respond. I'll give your approach a try.

[jacob_salmela]

Hey, look at that!

If you are interested in more detailed steps, let me know.

[Paul_Price1]

Thanks Jacob and Mike for your replies. I downloaded xCode and used that to parse out only the settings I wanted to change. Did an export out of xCode as an xml file and then brought that xml file into the JSS as a "Upload a manifest or a plist file". Works great. Thank you both. I don't think I can give a "Mark as answer" to both of you sadly. Below is how casper brought the plist in, in case others would ever need to turn this setting off. My customer will be very grateful not to have to manually dig in and make these changes. (our help desk will field a few less calls also)

General Tab
Apply Setting to; User Level at every login
Domain: ~/Library/Preferences/com.apple.symbolichotkeys
Keys: AppleSymbolicHotKeys
Value<dict> <key>79</key> <dict> <key>enabled</key> <false /> </dict> <key>80</key> <dict> <key>enabled</key> <false /> </dict> <key>81</key> <dict> <key>enabled</key> <false /> </dict> <key>82</key> <dict> <key>enabled</key> <false /> </dict> </dict>

Definition Tab
Domain: com.apple.symbolichotkeys
Key Name: AppleSymbolicHotKeys
Key Type: Enter Manually (Array or Dictionary)

[Paul_Price1]

Thanks Jacob and Mike for your replies. I downloaded xCode and used that to parse out only the settings I wanted to change. Did an export out of xCode as an xml file and then brought that xml file into the JSS as a "Upload a manifest or a plist file". Works great. Below is how casper brought the plist in, in case others would ever need to turn this setting off. My customer will be very grateful not to have to manually dig in and make these changes. (our help desk will field a few less calls also)

General Tab
Apply Setting to; User Level at every login
Domain: ~/Library/Preferences/com.apple.symbolichotkeys
Keys: AppleSymbolicHotKeys
Value<dict> <key>79</key> <dict> <key>enabled</key> <false /> </dict> <key>80</key> <dict> <key>enabled</key> <false /> </dict> <key>81</key> <dict> <key>enabled</key> <false /> </dict> <key>82</key> <dict> <key>enabled</key> <false /> </dict> </dict>

Definition Tab
Domain: com.apple.symbolichotkeys
Key Name: AppleSymbolicHotKeys
Key Type: Enter Manually (Array or Dictionary)

[jacob_salmela]

Dear Paul:

I am glad to help.

Thanks for marking our posts as the answers. It helps people quickly find the answer!

[mistacabbage · Accepted solution]

Instead of snapshotting I use fseventer
http://www.fernlightning.com/doku.php?id=software:fseventer:start

Press Play. Watch the changed files populate. Make the change you want. Hit pause or stop. Should be easy enough to figure out the plist that was modified.

[quedayone]

Very helpful info. MN For the win!
Eden Prairie graduate myself!
Currently working Downtown Minneapolis.

Thanks!

Wi11

[JayDuff]

For posterity - fseventer is toast.

There is a built-in utility, called fs_usage, that monitors all file system calls in realtime. You can grep that against cprefsd and then change the desired setting to get a pretty good idea of where to look.

Rather than futz with MCX, I used another built-in utility, called PlistBuddy to push the setting via a script.

So, the workflow went something like this:

sudo fs_usage | grep cprefsd

Then open the system preference in question, and modify it. Go back to the Terminal and hit Control-C to stop fs_usage, then scan through the (copious) output for plists that might make sense.

In my case, I was looking for how to turn off the key command to activate VoiceOver (Cmd F5). I saw ~/Library/Preferences/com.apple.symbolichotkeys.plist get hit a few times, and figured that was where to look. I needed to do some Google Fu to figure out that Dict 59 was the command for VoiceOver so I made a script that looks like this:

#!/bin/bash

USER=$(w | grep console | awk '{print $1}')

/usr/libexec/PlistBuddy /Users/$USER/Library/Preferences/com.apple.speech.synthesis.general.prefs.plist -c "set :SpokenUIUseSpeakingHotKeyFlag false"
/usr/libexec/PlistBuddy /Users/$USER/Library/Preferences/com.apple.symbolichotkeys.plist -c "set:AppleSymbolicHotKeys:59:enabled false"

exit 0

The other command disables the Text-to-Speech key.

Hope that helps someone in the future!

--
J.

[lambertir]

Working in Mojave 10.14.3.

I am unable to successfully apply specific settings from a users preferences domain com.apple.symbolichotkeys.plist to the /System/Library/Preferences/User Template/English.lproj/Library/Preferences when a new user signs in. Below are the settings that are what suggests to be overridden by a system wide configuration for those specific values where the enabled=0 changes to enabled=1.

Any help is much appreciated.

79 = { enabled = 0; value = { parameters = ( 65535, 123, 8650752 ); type = standard; }; };

80 = { enabled = 0; value = { parameters = ( 65535, 123, 8781824 ); type = standard; }; }; 81 = { enabled = 0; value = { parameters = ( 65535, 124, 8650752 ); type = standard; }; };
82 = { enabled = 0; value = { parameters = ( 65535, 124, 8781824 ); type = standard; }; };