Mac Security

Jamf Extension Attribute To Find ***Directories*** Named .DS_Store

I’ve written about .DS_Store files before (e.g. https://krypted.com/mac-os-x/no-more-ds_store-files/ to remove the files on file shares ). The .DS_Store is a ***file*** that has some custom attributes of the folder it’s in, such as a background image for the folder (e.g. in disk images with installers that get expanded and then show you a little arrow to copy the folder to the hard drive /Applications is a common use), spotlight comments, and then the .DS_Store also contains icon positions. This all goes back to Finder apps interpreting objects in a foreign file system kind of world.

Turns out that that a number of vendors have built exceptions for .DS_Store files because it makes programs run improperly sometimes. Therefore, if you call a folder .DS_Store, it’s a cute and fun place to hide things. Data needs to be set free and shouldn’t be hidden. Therefore, if you need to find any of these that might have been generated to hide things, you can query the file system using find or the less expensive mdfind, where where you’re just looking for a resource type of folder that matches the file name (or kMDItemDisplayName) of .DS_Store, as follows:

mdfind kind:folders AND kMDItemDisplayName:.DS_Store

For the Jamf admins out there, this is wrapped into a Jamf Extension Attribute at: https://github.com/krypted/DS_Store_Folders/blob/master/DS_Store_Folder_EA.sh