Hide System Preferences

jared_f
Valued Contributor

Hi All,

Does anybody have a script that will hide a certain system preferences pane. We know we can restrict them using a .mobileconfig, but that does not work in some of our environments. I have currently been hiding them manually using "View" in the menubar of System preferences.

Thank you for any help!
Jared

13 REPLIES 13

cindySingh
New Contributor III

Hi, What exactly you want to hide? There are various ways. I have controlled many of them. But you need to know if you hide certain items, you also need to write a command 'Enable' what you want. If you do some research around this, you can do better than what Iv done.
In my script you will see some items in Hidden and Enabled, you need to refine it. I just copied my WIP file here.
After running you can try to reboot to see immediate effect.

REMEMBER - Items that you wont mention under 'Hidden' or 'Enabled' will be disabled, and greyed out. Users can't click on them.
#!/bin/sh
defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array 
"com.apple.preference.startupdisk" 
"com.apple.prefs.backup" 
"com.symantec.quickmenusa.prefpane" 
"SymAutoProtect" 
"com.apple.preferences.appstore" 
"com.apple.preferences.softwareupdate" 
"com.apple.preferences.parentalcontrols" 
"com.apple.preference.internet" 
"com.apple.preferences.internetaccounts" 
"com.apple.preferences.icloud" 
"com.apple.preferences.sharing" 
"com.apple.preference.security" 
"com.oracle.java.JavaControlPanel" 
"Citrix.FMDSysPrefPane" 
"net.telestream.wmv.prefpane" 
"com.adobe.flashplayerpreferences" 
"com.apple.preferences.extensions"  500

# Now define the enabled ones.
defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array 
"com.apple.preferences.users" 
"com.apple.preference.general" 
"com.apple.preferences.Bluetooth" 
"com.apple.preference.datetime" 
"com.apple.preference.desktopscreeneffect" 
"com.apple.preference.digihub.discs" 
"com.apple.preference.displays" 
"com.apple.preference.dock" 
"com.apple.preference.energysaver" 
"com.apple.preference.expose" 
"com.apple.preference.ink" 
"com.apple.preferences.internetaccounts" 
"com.apple.preference.keyboard" 
"com.apple.Localization" 
"com.apple.preference.mouse" 
"com.apple.preference.network" 
"com.apple.preference.notifications" 
"com.apple.preferences.parentalcontrols" 
"com.apple.preference.printfax" 
"com.apple.preferences.configurationprofiles" 
"com.apple.preferences.sharing" 
"com.apple.preferences.softwareupdate" 
"com.apple.preference.sound" 
"com.apple.preference.speech" 
"com.apple.preference.startupdisk" 
"com.apple.prefs.backup" 
"com.apple.preference.trackpad" 
"com.apple.preference.universalaccess" 
"com.apple.preference.spotlight" 
"net.telestream.wmv.prefpane" 
"com.adobe.flashplayerpreferences" 
"com.Logitech.Control Center.Preference Pane" 
"com.wacom.settingsPrefPane" 
"com.wacom.PenTabletSettingsPrefPane" 
"com.oracle.java.JavaControlPanel" 
"Citrix.FMDSysPrefPane" 
"com.deploystudio.prefpanel" 
"com.apple.preferences.appstore" 
"com.deploystudio.prefpanel" 
"Extensions.prefPane"  500

jared_f
Valued Contributor

@cindySingh Thank you, I will take a look into this! We want to just hide Profiles because it makes it easier for me when working on client machines to just search it via system preferences. Then, I don't have to remove them from the system preferences group and them re-add them.

cindySingh
New Contributor III

Oh wow, I sent the entire list but I did not mention Profile :D
Bundle identifier for config profile is below, try on a test Mac as I have never ever used it.

com.apple.preferences.configurationprofiles

mlavine
Contributor

If you want to make a configuration profile to hide the Profiles pane in System Preferences you need to create the following plist file:

com.apple.systempreferences.plist

If you only want to hide the Profiles pane then this is all that is needed in the plist.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>HiddenPreferencePanes</key>
    <array>
        <string>com.apple.preferences.configurationprofiles</string>
    </array>
</dict>
</plist>

After you make that plist file I suggest using MCXtoProfile to convert the plist into a Custom Settings profile and then you can distribute it to your users with whatever system you use.

escotland
New Contributor

Hi @cindySingh so I tried the first script to hide the appstore; however when I write the reverse script my system pane is greyed out. Any ides?

Here is the script I wrote (Copy from yours) to reverse the hidden feature:

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array
"com.apple.preferences.appstore"

Also here is a screen shot from my test machine on what happen when I run that script above. dca8e39a431447cf9c079b3fe375ba56

Nix4Life
Valued Contributor

Just a quick glance, but it looks like you are missing the permissions aka the "500" after the array.

L

escotland
New Contributor

Thank you @LSinNY I'm going to give it a shot now and provide feedback after testings are conducted. FYI - I'm new to Casper so still getting a grip of things! :-)

So basically it should look like this right:

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array 500
"com.apple.preferences.appstore"

or

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array
"com.apple.preferences.appstore" 500

dstranathan
Valued Contributor II

This script doesn't really "hide" the panes, it locks/disables/restricts them. They are not hidden at all - users can clearly see the (grey-out) pane.

Is there a way to hide the panes so that they are not visible in the GUI (regardless if they are disabled or not)? I'm referring to the equivalent of mousing to View > Customize > and unchecking panes - but doing this via script or command.

I have a few panes that I don't need to lock users from, but rather keep them "out-of-sight, out-of-mind" (obfuscate).

I lock a couple specific panes via a Jamf restriction profile (Startup Disk, Sharing, Software Update and Parental Controls), but there are a couple other panes I'd prefer to just hide (tuck under the rug).

erowan
New Contributor III

@dstranathan I use this configuration profile to hide and disable the iCloud preference pane:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadType</key>
         <string>com.apple.systempreferences</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
         <key>PayloadIdentifier</key>
         <string>com.apple.systempreferences.12D5D87D-F18F-4807-84A8-1E77FBF0EA4B</string>
         <key>PayloadUUID</key>
         <string>12D5D87D-F18F-4807-84A8-1E77FBF0EA4B</string>
         <key>PayloadDisplayName</key>
         <string>com.apple.systempreferences</string>
         <key>PayloadDescription</key>
         <string></string>
         <key>PayloadOrganization</key>
         <string></string>
         <key>PayloadEnabled</key>
         <true/>
         <key>DisabledPreferencePanes</key>
         <array>
            <string>com.apple.preferences.icloud</string>
         </array>
         <key>HiddenPreferencePanes</key>
         <array>
            <string>com.apple.preferences.icloud</string>
         </array>
      </dict>
   </array>
   <key>PayloadDescription</key>
   <string></string>
   <key>PayloadDisplayName</key>
   <string>com.apple.systempreferences</string>
   <key>PayloadIdentifier</key>
   <string>com.apple.systempreferences</string>
   <key>PayloadOrganization</key>
   <string></string>
   <key>PayloadUUID</key>
   <string>BE218051-ED0B-4555-ADFB-86AA3072BB35</string>
   <key>PayloadRemovalDisallowed</key>
   <true/>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
   <key>PayloadScope</key>
   <string>User</string>
</dict>
</plist>

Morningside
Contributor II

I could use a little help with this script, and or this strategy. I am running the script and trying to enable or disable based on the user logging in. The results are inconsistent at best. Am I doing something wrong here:

#!/bin/bash

 

# Hide or Unhide System Preference Panes

 

# Get variables. $3 is logging in user.

user=$3

echo $user >> /Library/Logs/dnslog.log

 

# Root and Admin should be wide open

 

if 

[[ $user = "root" ]]        ||

[[ $user = "admin" ]]       ||

[[ $user = "Admin" ]]

 

then

# Unhide (sending an empty array unhides all of them):

defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array "" 500

 

# Enable all Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array \

"com.apple.preference.general" \

"com.apple.preference.desktopscreeneffect" \

"com.apple.preference.dock" \

"com.apple.preference.expose" \

"com.apple.Localization" \

"com.apple.preference.security" \

"com.apple.preference.spotlight" \

"com.apple.preference.notifications" \

"com.apple.preference.displays" \

"com.apple.preference.energysaver" \

"com.apple.preference.keyboard" \

"com.apple.preference.mouse" \

"com.apple.preference.trackpad" \

"com.apple.preference.printfax" \

"com.apple.preference.sound" \

“com.apple.preference.startupdisk" \

"com.apple.preferences.icloud" \

"com.apple.preferences.internetaccounts" \

"com.apple.preferences.softwareupdate" \

"com.apple.preference.network" \

"com.apple.preferences.Bluetooth" \

"Extensions.prefPane" \

"com.apple.preferences.sharing" \

"com.apple.preferences.users" \

"com.apple.preferences.parentalcontrols" \

"com.apple.preference.datetime" \

"com.apple.prefs.backup" \

"com.apple.preference.universalaccess" \

"com.apple.preferences.configurationprofiles" \

500

 

else

 

# All other accounts should only see and be able to use, the following:

 

# Unhide these Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array \

"com.apple.preference.expose" \

"com.apple.Localization" \

"com.apple.preference.security" \

"com.apple.preference.spotlight" \

"com.apple.preference.notifications" \

"com.apple.preference.displays" \

"com.apple.preference.energysaver" \

"com.apple.preference.sound" \

“com.apple.preference.startupdisk" \

"com.apple.preferences.icloud" \

"com.apple.preferences.internetaccounts" \

"com.apple.preferences.softwareupdate" \

"com.apple.preference.network" \

"com.apple.preferences.Bluetooth" \

"Extensions.prefPane" \

"com.apple.preferences.sharing" \

"com.apple.preferences.users" \

"com.apple.preferences.parentalcontrols" \

"com.apple.preference.datetime" \

"com.apple.prefs.backup" \

"com.apple.preferences.configurationprofiles" \

500

 

# Enable these Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array \

"com.apple.preference.general" \

"com.apple.preference.desktopscreeneffect" \

"com.apple.preference.dock" \

"com.apple.preference.keyboard" \

"com.apple.preference.mouse" \

"com.apple.preference.trackpad" \

"com.apple.preference.printfax" \

"com.apple.preference.universalaccess" \

500



fi

 

exit 0

I hide the Profiles preference pane. To get to it, you can just type "Profiles" in the System Preferences search field. If admins do this, the script you're writing won't be needed. Setting this up was as easy as creating a plist and then using it in the configuration profile.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>HiddenPreferencePanes</key>
	<array>
		<string>com.apple.preferences.configurationprofiles</string>
	</array>
</dict>
</plist>

That's a great idea, but not a solution to my issue. The older kids know how to do the same search and invariably find ways to mess with stuff. I need the items hidden and disabled both for students but not admins.

Morningside
Contributor II

As it happens though, I did discover whats happening, and there are (were) two snags. First, I had a fancy quotation mark in there screwing things up. I resolved that. Second, the script take a few seconds to run after log in, so the hiding and disabling of the panes is delayed due to this. Opening the Sys preferences app immediately after logging in will effectively bypass the script.  There is no solution to that second problem (other than moving to chromebooks).