Use a loop to read the users. Set the loop to end when it finds a value set to have updates On.

This will give you a quick audit and then you can enforce a policy to turn it off for all users.

@Taylor.Armstrong

The for-loop would do it for sure,or make profile out of the .plist and install it at user-level to set it to the correct setting. You might also want to look at outset

LSinNY

Awesome... thanks guys. (and one response from a former co-worker no less!

I'll probably ultimately enforce via a profile, but unfortunately, need to be able to show that we're checking for it at the same time - combination of the two should work perfectly.

Depending on how many users are on each system, you could also look at dynamically populating an array during the loop.
Example:

#!/bin/bash



plist_path="/Library/Preferences/com.microsoft.autoupdate2.plist"



all_users=$(ls /Users/ | grep -v Shared)



while read user_account; do

    if [[ $(defaults read "/Users/${user_account}${plist_path}" HowToCheck 2>/dev/null) == "Automatic" ]]; then

        enabled_accounts+=("$user_account")

    fi

done < <(printf '%s

' "$all_users")



if [ "${#enabled_accounts[@]}" -gt 0 ]; then

    echo "<result>$(printf '%s

' "${enabled_accounts[@]}")</result>"

else

    echo "<result>None</result>"

fi

This would print out a full list of any accounts that had the Auto Update setting to Automatic, rather than just stopping once it finds one account and printing something like "Yes" Either way could work for you. Just wanted to present an alternative in case you need to actually show all accounts that had the setting the way you're auditing for.

Thanks mm2270...

For our purposes, I think the 1st approach is sufficient, but I may look at the 2nd anyway. I tend to like overkill :)

We have a baseline that essentially says we're disabling auto-updates, so bottom line is that I just need some sort of "artifact" to prove that it isn't just a one-time setting. As long as I can run a simulated test and show that enabling it will be detected and disabled (via the EA and then a policy scoped to a smart group) I think I'm good.

@Taylor.Armstrong Sure, no worries. Its usually best to do what's actually needed and not go over board, so the first approach is probably the way you should go if it makes it easier to report on.

Good thing is, the script I posted above can be used as a template for checking on other things if you needed to do that for something else later, by looping over all local accounts in /Users/ and checking a preference setting.

^^ Exactly. Definitely saving it as a base to work from on some other stuff - appreciate it!!!

@Taylor.Armstrong I have a Configuration Profile set that sets Updates to Manual and disables the new "Office Insider" Program. The XML is:

Create a Configuration Profile scoped to User Level, set the Custom settings to:
1. Preference Domain = com.microsoft.autoupdate2
2. xml =

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

    <key>DisableInsiderCheckbox</key>

    <true/>

    <key>HowToCheck</key>

        <string>Manual</string>

</dict>

</plist>

Awesome again, thanks! (and you thought you were done supporting this office long ago! ;)

10 years! Kinda miss it, but don't miss the commute! We should try and meet up for a drink sometime. Do you ever go to the MacDMV meetings?