Hide System Preferences

[jared_f]

Hi All,

Does anybody have a script that will hide a certain system preferences pane. We know we can restrict them using a .mobileconfig, but that does not work in some of our environments. I have currently been hiding them manually using "View" in the menubar of System preferences.

Thank you for any help!
Jared

[cindySingh]

Hi, What exactly you want to hide? There are various ways. I have controlled many of them. But you need to know if you hide certain items, you also need to write a command 'Enable' what you want. If you do some research around this, you can do better than what Iv done.
In my script you will see some items in Hidden and Enabled, you need to refine it. I just copied my WIP file here.
After running you can try to reboot to see immediate effect.

REMEMBER - Items that you wont mention under 'Hidden' or 'Enabled' will be disabled, and greyed out. Users can't click on them.

#!/bin/sh
defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array 
"com.apple.preference.startupdisk" 
"com.apple.prefs.backup" 
"com.symantec.quickmenusa.prefpane" 
"SymAutoProtect" 
"com.apple.preferences.appstore" 
"com.apple.preferences.softwareupdate" 
"com.apple.preferences.parentalcontrols" 
"com.apple.preference.internet" 
"com.apple.preferences.internetaccounts" 
"com.apple.preferences.icloud" 
"com.apple.preferences.sharing" 
"com.apple.preference.security" 
"com.oracle.java.JavaControlPanel" 
"Citrix.FMDSysPrefPane" 
"net.telestream.wmv.prefpane" 
"com.adobe.flashplayerpreferences" 
"com.apple.preferences.extensions"  500

# Now define the enabled ones.
defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array 
"com.apple.preferences.users" 
"com.apple.preference.general" 
"com.apple.preferences.Bluetooth" 
"com.apple.preference.datetime" 
"com.apple.preference.desktopscreeneffect" 
"com.apple.preference.digihub.discs" 
"com.apple.preference.displays" 
"com.apple.preference.dock" 
"com.apple.preference.energysaver" 
"com.apple.preference.expose" 
"com.apple.preference.ink" 
"com.apple.preferences.internetaccounts" 
"com.apple.preference.keyboard" 
"com.apple.Localization" 
"com.apple.preference.mouse" 
"com.apple.preference.network" 
"com.apple.preference.notifications" 
"com.apple.preferences.parentalcontrols" 
"com.apple.preference.printfax" 
"com.apple.preferences.configurationprofiles" 
"com.apple.preferences.sharing" 
"com.apple.preferences.softwareupdate" 
"com.apple.preference.sound" 
"com.apple.preference.speech" 
"com.apple.preference.startupdisk" 
"com.apple.prefs.backup" 
"com.apple.preference.trackpad" 
"com.apple.preference.universalaccess" 
"com.apple.preference.spotlight" 
"net.telestream.wmv.prefpane" 
"com.adobe.flashplayerpreferences" 
"com.Logitech.Control Center.Preference Pane" 
"com.wacom.settingsPrefPane" 
"com.wacom.PenTabletSettingsPrefPane" 
"com.oracle.java.JavaControlPanel" 
"Citrix.FMDSysPrefPane" 
"com.deploystudio.prefpanel" 
"com.apple.preferences.appstore" 
"com.deploystudio.prefpanel" 
"Extensions.prefPane"  500

[jared_f]

@cindySingh Thank you, I will take a look into this! We want to just hide Profiles because it makes it easier for me when working on client machines to just search it via system preferences. Then, I don't have to remove them from the system preferences group and them re-add them.

[cindySingh]

Oh wow, I sent the entire list but I did not mention Profile :D
Bundle identifier for config profile is below, try on a test Mac as I have never ever used it.

com.apple.preferences.configurationprofiles

[mlavine]

If you want to make a configuration profile to hide the Profiles pane in System Preferences you need to create the following plist file:

com.apple.systempreferences.plist

If you only want to hide the Profiles pane then this is all that is needed in the plist.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>HiddenPreferencePanes</key>
    <array>
        <string>com.apple.preferences.configurationprofiles</string>
    </array>
</dict>
</plist>

After you make that plist file I suggest using MCXtoProfile to convert the plist into a Custom Settings profile and then you can distribute it to your users with whatever system you use.

[escotland]

Hi @cindySingh so I tried the first script to hide the appstore; however when I write the reverse script my system pane is greyed out. Any ides?

Here is the script I wrote (Copy from yours) to reverse the hidden feature:

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array
"com.apple.preferences.appstore"

Also here is a screen shot from my test machine on what happen when I run that script above.

[Nix4Life]

Just a quick glance, but it looks like you are missing the permissions aka the "500" after the array.

L

[escotland]

Thank you @LSinNY I'm going to give it a shot now and provide feedback after testings are conducted. FYI - I'm new to Casper so still getting a grip of things! :-)

So basically it should look like this right:

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array 500
"com.apple.preferences.appstore"

or

!/bin/sh

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array
"com.apple.preferences.appstore" 500

[dstranathan]

This script doesn't really "hide" the panes, it locks/disables/restricts them. They are not hidden at all - users can clearly see the (grey-out) pane.

Is there a way to hide the panes so that they are not visible in the GUI (regardless if they are disabled or not)? I'm referring to the equivalent of mousing to View > Customize > and unchecking panes - but doing this via script or command.

I have a few panes that I don't need to lock users from, but rather keep them "out-of-sight, out-of-mind" (obfuscate).

I lock a couple specific panes via a Jamf restriction profile (Startup Disk, Sharing, Software Update and Parental Controls), but there are a couple other panes I'd prefer to just hide (tuck under the rug).

[erowan]

@dstranathan I use this configuration profile to hide and disable the iCloud preference pane:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadType</key>
         <string>com.apple.systempreferences</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
         <key>PayloadIdentifier</key>
         <string>com.apple.systempreferences.12D5D87D-F18F-4807-84A8-1E77FBF0EA4B</string>
         <key>PayloadUUID</key>
         <string>12D5D87D-F18F-4807-84A8-1E77FBF0EA4B</string>
         <key>PayloadDisplayName</key>
         <string>com.apple.systempreferences</string>
         <key>PayloadDescription</key>
         <string></string>
         <key>PayloadOrganization</key>
         <string></string>
         <key>PayloadEnabled</key>
         <true/>
         <key>DisabledPreferencePanes</key>
         <array>
            <string>com.apple.preferences.icloud</string>
         </array>
         <key>HiddenPreferencePanes</key>
         <array>
            <string>com.apple.preferences.icloud</string>
         </array>
      </dict>
   </array>
   <key>PayloadDescription</key>
   <string></string>
   <key>PayloadDisplayName</key>
   <string>com.apple.systempreferences</string>
   <key>PayloadIdentifier</key>
   <string>com.apple.systempreferences</string>
   <key>PayloadOrganization</key>
   <string></string>
   <key>PayloadUUID</key>
   <string>BE218051-ED0B-4555-ADFB-86AA3072BB35</string>
   <key>PayloadRemovalDisallowed</key>
   <true/>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
   <key>PayloadScope</key>
   <string>User</string>
</dict>
</plist>

[Morningside]

I could use a little help with this script, and or this strategy. I am running the script and trying to enable or disable based on the user logging in. The results are inconsistent at best. Am I doing something wrong here:

#!/bin/bash

# Hide or Unhide System Preference Panes

# Get variables. $3 is logging in user.

user=$3

echo $user >> /Library/Logs/dnslog.log

# Root and Admin should be wide open

if 

[[ $user = "root" ]]        ||

[[ $user = "admin" ]]       ||

[[ $user = "Admin" ]]

then

# Unhide (sending an empty array unhides all of them):

defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array "" 500

# Enable all Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array \

"com.apple.preference.general" \

"com.apple.preference.desktopscreeneffect" \

"com.apple.preference.dock" \

"com.apple.preference.expose" \

"com.apple.Localization" \

"com.apple.preference.security" \

"com.apple.preference.spotlight" \

"com.apple.preference.notifications" \

"com.apple.preference.displays" \

"com.apple.preference.energysaver" \

"com.apple.preference.keyboard" \

"com.apple.preference.mouse" \

"com.apple.preference.trackpad" \

"com.apple.preference.printfax" \

"com.apple.preference.sound" \

“com.apple.preference.startupdisk" \

"com.apple.preferences.icloud" \

"com.apple.preferences.internetaccounts" \

"com.apple.preferences.softwareupdate" \

"com.apple.preference.network" \

"com.apple.preferences.Bluetooth" \

"Extensions.prefPane" \

"com.apple.preferences.sharing" \

"com.apple.preferences.users" \

"com.apple.preferences.parentalcontrols" \

"com.apple.preference.datetime" \

"com.apple.prefs.backup" \

"com.apple.preference.universalaccess" \

"com.apple.preferences.configurationprofiles" \

500

else

# All other accounts should only see and be able to use, the following:

# Unhide these Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes -array \

"com.apple.preference.expose" \

"com.apple.Localization" \

"com.apple.preference.security" \

"com.apple.preference.spotlight" \

"com.apple.preference.notifications" \

"com.apple.preference.displays" \

"com.apple.preference.energysaver" \

"com.apple.preference.sound" \

“com.apple.preference.startupdisk" \

"com.apple.preferences.icloud" \

"com.apple.preferences.internetaccounts" \

"com.apple.preferences.softwareupdate" \

"com.apple.preference.network" \

"com.apple.preferences.Bluetooth" \

"Extensions.prefPane" \

"com.apple.preferences.sharing" \

"com.apple.preferences.users" \

"com.apple.preferences.parentalcontrols" \

"com.apple.preference.datetime" \

"com.apple.prefs.backup" \

"com.apple.preferences.configurationprofiles" \

500

# Enable these Icons:

defaults write "/Library/Preferences/com.apple.systempreferences" EnabledPreferencePanes -array \

"com.apple.preference.general" \

"com.apple.preference.desktopscreeneffect" \

"com.apple.preference.dock" \

"com.apple.preference.keyboard" \

"com.apple.preference.mouse" \

"com.apple.preference.trackpad" \

"com.apple.preference.printfax" \

"com.apple.preference.universalaccess" \

500

fi

exit 0

[howie_isaacks]

I hide the Profiles preference pane. To get to it, you can just type "Profiles" in the System Preferences search field. If admins do this, the script you're writing won't be needed. Setting this up was as easy as creating a plist and then using it in the configuration profile.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>HiddenPreferencePanes</key>
	<array>
		<string>com.apple.preferences.configurationprofiles</string>
	</array>
</dict>
</plist>

[Morningside]

That's a great idea, but not a solution to my issue. The older kids know how to do the same search and invariably find ways to mess with stuff. I need the items hidden and disabled both for students but not admins.

[Morningside]

As it happens though, I did discover whats happening, and there are (were) two snags. First, I had a fancy quotation mark in there screwing things up. I resolved that. Second, the script take a few seconds to run after log in, so the hiding and disabling of the panes is delayed due to this. Opening the Sys preferences app immediately after logging in will effectively bypass the script.  There is no solution to that second problem (other than moving to chromebooks).