I’ve written about customizing the LoginWindow on a Mac a few times now. It’s hard to believe that I wrote https://krypted.com/mac-security/more-loginwindow-customizations-in-mac-os-x/ over ten years ago or https://krypted.com/mac-security/login-logout-hooks/ over 12 years ago. One thing I hadn’t covered is seeing the name of the computer, IP address, and version of the OS by clicking on the clock in the upper right corner of the screen. This behavior is disabled by default and once enabled shows an item for 60 seconds as you scroll through them, which is a pretty nice troubleshooting option here and there. Use the following command to active the additional information, we’ll write the HostName key into the AdminHostInfo…
-
-
Episode 128 of the MacAdmins Podcast: Apple’s Been Busy, with Jeremy Butcher of Apple
-
Episode 127 of the MacAdmins Podcast: APOLLO and Mac Forensics with Sarah Edwards
-
Episode 126 of the MacAdmins Podcast: WWDC After Action Report
-
Episode 125 of the MacAdmins Podcast with Frederick Abeloos
-
Notes from the Underground: Apple WWDC and You
Apple kicked off the annual WWDC conference yesterday and boy there was a flurry of information. There always is, but for people charged with managing Apple devices and vendors that support Apple devices there were some important releases. Some general themes to think about as you read through this list: Privacy is a thing. This includes securing files in the directories of a user by having the user accept a request to touch them (e.g. My Documents, er, I mean, Documents). This also means apps harvesting user data are doomed. The restrictions continue to flow in from iOS to the Mac. And that’s probably a good thing – as it…
-
Controlling Multiple launchagents and launchdaemons concurrently
Most of my examples for launchctl have been per-user, per-agent, per-daemon. But you can also control multiple launchctl targets concurrently. One example would be that you can unload everything in the user domain by not specifying a path but providing the userid. In the following example, we’ll just use $userid as a variable, but it’s worth noting that that would be, as an example, 501 for the : sudo launchctl bootout gui/$userid There’s another option that can be used to do the opposite from within single user mode, called bootshell. Bootshell is called similarly from single user mode: sudo launchctl bootshell
-
Quick One-Liner For Finding Invalid Login Attempts in macOS 10.14 and Up
grep -i login /var/log/system.log That’s all I got. Have a good day.
-
Microsoft Defender Comes To The Mac
Today Microsoft announced that Defender is coming to the Mac. This is a basic malware scanning and remediation solution but specifically built for reporting back through and configuration through Intune and Jamf. Yet another great tool in the arsenal for combatting little nasties that show up on the network!
-
Pull TeamID and BundleID from KextPolicy in scripts
This type of thing is usually done interactively, but when I’m piping output that doesn’t work. So here’s a quick one-liner in bash for pulling the TeamID and BundleID from kexts out of the KextPolicy sqlite database: sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy "SELECT * from kext_policy;" ".exit"