diff --git a/AIR_Version.xml b/AIR_Version.xml deleted file mode 100644 index e947f68..0000000 --- a/AIR_Version.xml +++ /dev/null @@ -1,28 +0,0 @@ - - -AIR Version - -string -#!/bin/bash - -# Christoph von Gabler-Sahm (christoph.gabler-sahm@computacenter.com) -# Version 1.0 -# -# Modified by Sam Novak (snovak@uwsp.edu) for AIR - -# checks installed version of AIR Framework - - -# Plugin version -S_VERSION=$( /usr/bin/defaults read /Library/Frameworks/Adobe\ AIR.framework/Versions/Current/Resources/Info CFBundleVersion 2>/dev/null ) - - -if [[ "${S_VERSION}" != "" ]]; then -EA_RESULT="${S_VERSION}" -else -EA_RESULT="Not installed" -fi - -echo "<result>${EA_RESULT}</result>" - - diff --git a/ARD Field 1.xml b/ARD Field 1.xml index f355af9..368a50b 100644 --- a/ARD Field 1.xml +++ b/ARD Field 1.xml @@ -1 +1,24 @@ - ARD Field 1 System Information This attribute returns the ARD Computer Info field #1 from the Computer Information attributes in the Apple Remote Desktop settings of a machine. string #!/bin/sh if [ -f "/Library/Preferences/com.apple.RemoteDesktop.plist" ]; then echo "<result>`/usr/bin/defaults read /Library/Preferences/com.apple.RemoteDesktop Text1`</result>" fi \ No newline at end of file + + + ARD Field 1 + System Information + Returns the Apple Remote Desktop Computer Info field #1. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ARD Field 1 Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads Text1 from the Apple Remote Desktop preferences plist. The plist +# is only present once ARD has been configured; absence is reported as empty. + +plist="/Library/Preferences/com.apple.RemoteDesktop.plist" + +if [[ -f "$plist" ]]; then + value=$(/usr/bin/defaults read "$plist" Text1 2>/dev/null) + echo "<result>$value</result>" +else + echo "<result></result>" +fi + + diff --git a/ARD Field 2.xml b/ARD Field 2.xml index 466ef9c..b73553c 100644 --- a/ARD Field 2.xml +++ b/ARD Field 2.xml @@ -1 +1,24 @@ - ARD Field 2 System Information This attribute returns the ARD Computer Info field #2 from the Computer Information attributes in the Apple Remote Desktop settings of a machine. string #!/bin/sh if [ -f "/Library/Preferences/com.apple.RemoteDesktop.plist" ]; then echo "<result>`/usr/bin/defaults read /Library/Preferences/com.apple.RemoteDesktop Text2`</result>" fi \ No newline at end of file + + + ARD Field 2 + System Information + Returns the Apple Remote Desktop Computer Info field #2. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ARD Field 2 Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads Text2 from the Apple Remote Desktop preferences plist. The plist +# is only present once ARD has been configured; absence is reported as empty. + +plist="/Library/Preferences/com.apple.RemoteDesktop.plist" + +if [[ -f "$plist" ]]; then + value=$(/usr/bin/defaults read "$plist" Text2 2>/dev/null) + echo "<result>$value</result>" +else + echo "<result></result>" +fi + + diff --git a/ARD Field 3.xml b/ARD Field 3.xml index 017158e..ed04f32 100644 --- a/ARD Field 3.xml +++ b/ARD Field 3.xml @@ -1 +1,24 @@ - ARD Field 3 System Information This attribute returns the ARD Computer Info field #3 from the Computer Information attributes in the Apple Remote Desktop settings of a machine. string #!/bin/sh if [ -f "/Library/Preferences/com.apple.RemoteDesktop.plist" ]; then echo "<result>`/usr/bin/defaults read /Library/Preferences/com.apple.RemoteDesktop Text3`</result>" fi \ No newline at end of file + + + ARD Field 3 + System Information + Returns the Apple Remote Desktop Computer Info field #3. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ARD Field 3 Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads Text3 from the Apple Remote Desktop preferences plist. The plist +# is only present once ARD has been configured; absence is reported as empty. + +plist="/Library/Preferences/com.apple.RemoteDesktop.plist" + +if [[ -f "$plist" ]]; then + value=$(/usr/bin/defaults read "$plist" Text3 2>/dev/null) + echo "<result>$value</result>" +else + echo "<result></result>" +fi + + diff --git a/ARD Field 4.xml b/ARD Field 4.xml index 33986ea..f3d21c6 100644 --- a/ARD Field 4.xml +++ b/ARD Field 4.xml @@ -1 +1,24 @@ - ARD Field 4 System Information This attribute returns the ARD Computer Info field #4 from the Computer Information attributes in the Apple Remote Desktop settings of a machine. string #!/bin/sh if [ -f "/Library/Preferences/com.apple.RemoteDesktop.plist" ]; then echo "<result>`/usr/bin/defaults read /Library/Preferences/com.apple.RemoteDesktop Text4`</result>" fi \ No newline at end of file + + + ARD Field 4 + System Information + Returns the Apple Remote Desktop Computer Info field #4. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ARD Field 4 Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads Text4 from the Apple Remote Desktop preferences plist. The plist +# is only present once ARD has been configured; absence is reported as empty. + +plist="/Library/Preferences/com.apple.RemoteDesktop.plist" + +if [[ -f "$plist" ]]; then + value=$(/usr/bin/defaults read "$plist" Text4 2>/dev/null) + echo "<result>$value</result>" +else + echo "<result></result>" +fi + + diff --git a/Active Directory OU.xml b/Active Directory OU.xml index f7a217a..ebcd66c 100644 --- a/Active Directory OU.xml +++ b/Active Directory OU.xml @@ -1,27 +1,33 @@ -Active Directory OU -If the computer is bound to Active Directory it will show the path to where it is located in AD. Helpful for Smart Groups based on objects in a particular OU. -string -#!/bin/sh -ad_computer_name=`dsconfigad -show | grep "Computer Account" | awk '{print $4}'` -ad_computer_ou=`dscl /Search read /Computers/$ad_computer_name | \ -grep -A 1 dsAttrTypeNative:distinguishedName | \ -cut -d, -f2- | sed -n 's/OU\=//gp' | \ -sed -n 's/\(.*\),DC\=/\1./gp' | \ -sed -n 's/DC\=//gp' | \ -awk -F, '{ -N = NF -while ( N > 1 ) -{ -printf "%s/",$N -N-- -} - -printf "%s",$1 -}'` - -echo "<result>$ad_computer_ou</result>" + Active Directory OU + If the computer is bound to Active Directory, returns the OU path as a slash-separated DNS-style string. Empty if not bound. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Active Directory OU Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# dsconfigad and dscl /Search continue to work on Apple Silicon and Intel. +# If the Mac is unbound, dsconfigad returns "Not bound..." and we exit empty +# so the EA doesn't pollute Jamf inventory with junk. + +if ! /usr/sbin/dsconfigad -show 2>/dev/null | /usr/bin/grep -q "Computer Account"; then + echo "<result></result>" + exit 0 +fi + +adComputer=$(/usr/sbin/dsconfigad -show | /usr/bin/awk -F'= ' '/Computer Account/ { gsub(/^[ \t]+|[ \t]+$/, "", $2); print $2; exit }') + +ou=$(/usr/bin/dscl /Search read "/Computers/${adComputer}" dsAttrTypeNative:distinguishedName 2>/dev/null \ + | /usr/bin/awk '/distinguishedName/ {found=1; next} found {print; exit}' \ + | /usr/bin/sed -E 's/^[[:space:]]+//; s/^CN=[^,]+,//; s/OU=//g; s/,DC=/./; s/DC=//g' \ + | /usr/bin/awk -F',' '{ + out="" + for (i=NF; i>1; i--) out = out $i "/" + print out $1 + }') + +echo "<result>${ou}</result>" - diff --git a/Active Power Management Profile.xml b/Active Power Management Profile.xml index 77dfba4..6255822 100644 --- a/Active Power Management Profile.xml +++ b/Active Power Management Profile.xml @@ -1 +1,20 @@ - Active Power Management Profile Power Management This attribute displays the power management profile that is currently active on the machine. This attribute applies to both Mac and Windows. string #!/bin/sh echo "<result>`/usr/bin/pmset -g 2>&1 | grep \* | awk '{$NF=""; print $0}'`</result>" VBScript On Error Resume Next Dim WshShell Dim oExec Dim strPowerProfile Set WshShell = WScript.CreateObject("Wscript.Shell") Set oExec = WshShell.Exec("powercfg -GETACTIVESCHEME") strPowerProfile = oExec.StdOut.ReadAll strPowerProfile = Replace (strPowerProfile, Chr(40), "", 58) strPowerProfile = Replace (strPowerProfile, Chr(41), "") WScript.Echo "<result>" & strPowerProfile & "</result>" \ No newline at end of file + + + Active Power Management Profile + Power Management + Reports the active pmset profile (e.g. "Battery Power", "AC Power", "UPS Power"). pmset marks the active profile with an asterisk. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Active Power Management Profile Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# pmset -g lists profile sections; the currently active one is prefixed +# with "*". We strip that marker and trailing colon for a clean label. + +profile=$(/usr/bin/pmset -g 2>/dev/null \ + | /usr/bin/awk '/^\*/ { sub(/^\*[[:space:]]*/, ""); sub(/:$/, ""); print; exit }') + +echo "<result>${profile:-Unknown}</result>" + + diff --git a/Active_Network_Interface.xml b/Active_Network_Interface.xml index e7435a3..da6ab0c 100644 --- a/Active_Network_Interface.xml +++ b/Active_Network_Interface.xml @@ -1,44 +1,39 @@ -Active Network Interface - -string -#!/bin/bash -ref=$(/usr/bin/sw_vers -productVersion | awk '{print substr($1,4,2)}') -case $ref in -[0-4] ) ntwkset="/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder" - ;; - *) ntwkset="networksetup -listnetworkserviceorder" - ;; -esac - -ifconfigoutput=' -BEGIN { print_it = 0 } -/status: active/ { print_it = 1 } -/^($|[^\t])/ { if(print_it) print buffer; buffer = $0; print_it = 0 } -/^\t/ { buffer = buffer "\n" $0 } -END { if(print_it) print buffer } -' - -ntwkint=($(ifconfig -u | awk "$ifconfigoutput" | awk '/flags/{print substr($1,1,3)}')) -/bin/echo -n $"<result>" -for x in "${ntwkint[@]}" -do - echo `$ntwkset | grep "$x" | sed -e 's/[)(]//g;s/,//g;s/.*Port: //g;s/Device:\ //g'` -done -echo "</result>" -On Error Resume Next -strComputer = "." -Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") -Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48) -intmetric = 999 -For Each objItem in colItems - If objitem.ipenabled = True then - If objItem.IPConnectionMetric < intmetric then - stractiveconnection = objItem.description - intmetric = objItem.IPConnectionMetric - End If - End If -Next -WScript.Echo "<result>" & stractiveconnection & "</result>" + Active Network Interface + Returns the human-readable service name(s) of every currently active network interface (e.g. "Wi-Fi", "USB 10/100/1000 LAN"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Active Network Interface Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Finds every ifconfig device marked "status: active" and maps each BSD +# name (en0, en1, ...) to its Service name via networksetup. Multiple +# active services are joined with ", ". + +active=("${(@f)$(/sbin/ifconfig -u 2>/dev/null \ + | /usr/bin/awk ' + /^[a-z0-9]+:/ { iface = substr($1, 1, length($1) - 1); st = "" } + /status:/ { st = $2; if (st == "active") print iface } + ' | /usr/bin/sort -u)}") + +order=$(/usr/sbin/networksetup -listnetworkserviceorder 2>/dev/null) + +results=() +for dev in "${active[@]}"; do + [[ -z "$dev" ]] && continue + svc=$(echo "$order" | /usr/bin/awk -v d="Device: $dev)" ' + index($0, d) { print prev; exit } + { prev = $0 } + ' | /usr/bin/sed -E 's/^\([0-9]+\)[[:space:]]+//') + [[ -n "$svc" ]] && results+=("$svc") +done + +if (( ${#results[@]} == 0 )); then + echo "<result>None</result>" +else + echo "<result>${(j:, :)results}</result>" +fi + diff --git a/Adobe Update Server.xml b/Adobe Update Server.xml index db454a1..3e09b04 100644 --- a/Adobe Update Server.xml +++ b/Adobe Update Server.xml @@ -1 +1,25 @@ - Adobe Update Server Software Updates This attribute returns the DNS/IP address of the Adobe Update Server that is set on the client machine. string #!/bin/sh updaterConfigFile="/Library/Application Support/Adobe/AAMUpdater/1.0/AdobeUpdater.Overrides" if [ -f "$updaterConfigFile" ]; then result=`/bin/cat "$updaterConfigFile" | grep -m 1 "Domain" | sed -e 's/<[^>]*>//g' | sed 's:http\://::g' | awk '{print $1}'` echo "<result>$result</result>" else echo "<result>No Adobe Update Server Set</result>" fi \ No newline at end of file + + + Adobe Update Server + Software Updates + Returns the DNS/IP of the Adobe Update Server configured via AAMUpdater overrides. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Adobe Update Server Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Adobe still ships overrides at the AAMUpdater path on Creative Cloud. + +cfg="/Library/Application Support/Adobe/AAMUpdater/1.0/AdobeUpdater.Overrides" + +if [[ -f "$cfg" ]]; then + server=$(/usr/bin/grep -m1 "Domain" "$cfg" \ + | /usr/bin/sed -E 's/<[^>]*>//g; s|https?://||g' \ + | /usr/bin/awk '{print $1}') + echo "<result>${server:-Not Set}</result>" +else + echo "<result>No Adobe Update Server Set</result>" +fi + + diff --git a/AdobeReaderDCversion.xml b/AdobeReaderDCversion.xml index 40f6f7a..7abf890 100644 --- a/AdobeReaderDCversion.xml +++ b/AdobeReaderDCversion.xml @@ -4,13 +4,21 @@ Version of Acrobat Reader DC installed string - Returns the version of Acrobat Reader DC installed. - #!/bin/bash + Returns the installed Adobe Acrobat Reader DC version, or N/A if absent. + #!/bin/zsh -ver=`/usr/bin/defaults read /Applications/Adobe\ Acrobat\ Reader\ DC.app/Contents/Info CFBundleShortVersionString` +# Updated by SecurityShrimp 2026 +# Acrobat Reader DC Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) -if [ $ver = "" ]; then - ver="N/A" +plist="/Applications/Adobe Acrobat Reader.app/Contents/Info.plist" +[[ ! -f "$plist" ]] && plist="/Applications/Adobe Acrobat Reader DC.app/Contents/Info.plist" + +if [[ -f "$plist" ]]; then + ver=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${ver:-Unknown}</result>" +else + echo "<result>N/A</result>" fi -echo "<result>$ver</result>" + diff --git a/Adobe_Creative_Cloud_License_Length.xml b/Adobe_Creative_Cloud_License_Length.xml index a2c7ee7..ab47e47 100644 --- a/Adobe_Creative_Cloud_License_Length.xml +++ b/Adobe_Creative_Cloud_License_Length.xml @@ -1,25 +1,26 @@ - -Adobe Creative Cloud License Length -Check for the value of LicensableLEIDsLength to determine the version of the license. -number -#!/bin/bash - -ExtensionVersion="" - -if [ -d /Library/Application\ Support/Adobe/SLCache/ ]; then - cd /Library/Application\ Support/Adobe/SLCache/ - LicenseFileName=$(grep LicensableLEIDsLength ./* -l) - if [ -f $LicenseFileName ]; then - ExtensionVersion=$(awk -F\LicensableLEIDsLength '{print $2}' ./$LicenseFileName | cut -f2 -d'>' | cut -f1 -d'<') - fi -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="0" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - + + + Adobe Creative Cloud License Length + Reads LicensableLEIDsLength from the Adobe SLCache to identify the license shape. + number + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Adobe Creative Cloud License Length Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +slCache="/Library/Application Support/Adobe/SLCache" +length="0" + +if [[ -d "$slCache" ]]; then + licenseFile=$(/usr/bin/grep -l "LicensableLEIDsLength" "$slCache"/* 2>/dev/null | /usr/bin/head -n1) + if [[ -n "$licenseFile" ]]; then + length=$(/usr/bin/awk -F'LicensableLEIDsLength' '{print $2}' "$licenseFile" \ + | /usr/bin/cut -f2 -d'>' \ + | /usr/bin/cut -f1 -d'<') + fi +fi + +echo "<result>${length:-0}</result>" + + diff --git a/Adobe_Remote_Update_Manager_Version.xml b/Adobe_Remote_Update_Manager_Version.xml index 2411c6e..9edfc68 100644 --- a/Adobe_Remote_Update_Manager_Version.xml +++ b/Adobe_Remote_Update_Manager_Version.xml @@ -1,21 +1,24 @@ - -Adobe Remote Update Manager Version -Returns the installed version of the Adobe Remote Update Manager -string -#!/bin/bash - -if [ -f /usr/local/bin/RemoteUpdateManager ]; then - chmod +x /usr/local/bin/RemoteUpdateManager - S_VERSION=$(/usr/local/bin/RemoteUpdateManager -h | grep BuildVersion | cut -d ':' -f2 | cut -d ' ' -f2 2>/dev/null ) - EA_RESULT="${S_VERSION}" -elif [ -a /usr/sbin/RemoteUpdateManager ]; then - S_VERSION="Pre 2015.5 Release" - EA_RESULT="${S_VERSION}" -else - EA_RESULT="Not installed" -fi - -echo "<result>${EA_RESULT}</result>" - - - + + + Adobe Remote Update Manager Version + Returns the installed Adobe Remote Update Manager build version, or "Not installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Adobe Remote Update Manager Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +rum="/usr/local/bin/RemoteUpdateManager" + +if [[ -x "$rum" ]]; then + version=$("$rum" -h 2>/dev/null \ + | /usr/bin/awk -F': *' '/BuildVersion/ { print $2; exit }') + echo "<result>${version:-Unknown}</result>" +elif [[ -f "/usr/sbin/RemoteUpdateManager" ]]; then + echo "<result>Pre 2015.5 Release</result>" +else + echo "<result>Not installed</result>" +fi + + diff --git a/AirPort Power.xml b/AirPort Power.xml deleted file mode 100644 index eef3f9c..0000000 --- a/AirPort Power.xml +++ /dev/null @@ -1 +0,0 @@ - AirPort Power Networking This attribute displays the AirPort power status. This attribute applies to Mac only. string #!/bin/sh # Determine the OS version since the networksetup command differs on OS OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then # Ensure that the networksetup link exists on 10.4 and earlier if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then result=`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -getairportpower | sed 's/AirPort Power: //g'` else result=`The networksetup binary is not present on this machine.` fi elif [ "$OS" == "10.5" ]; then result=`/usr/sbin/networksetup -getairportpower | sed 's/AirPort Power: //g'` else result=`/usr/sbin/networksetup -getairportpower AirPort | sed 's/AirPort Power (AirPort): //g'` fi # Ensure that AirPort was found hasAirPort=`echo "$result" | grep "Error"` # Report the result if [ "$hasAirPort" == "" ]; then echo "<result>$result</result>" else echo "<result>No AirPort Device Found.</result>" fi VBScript \ No newline at end of file diff --git a/Apple Software Update - Automatically Download Updates.xml b/Apple Software Update - Automatically Download Updates.xml index 3be1393..7138332 100644 --- a/Apple Software Update - Automatically Download Updates.xml +++ b/Apple Software Update - Automatically Download Updates.xml @@ -1 +1,25 @@ - Apple Software Update - Automatically Download Updates Security Reporting string This attribute displays the status of the Apple software update option to "Automatically Download Updates". The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the setting is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" currentUser=`last -1 -t console | awk '{print $1}'` appDomain="com.apple.SoftwareUpdate.ByHost" keyName="AutomaticDownload" result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Apple Software Update - Automatically Download Updates + Security Reporting + string + Reports whether macOS Software Update is configured to automatically download updates (true/false). + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Software Update - Automatically Download Updates Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# The legacy "dscl . mcxread" approach reads MCX, which has been deprecated +# since macOS 10.7 and is non-functional under modern configuration profile +# management. Reading the canonical preference directly works whether the +# value is set by user, MDM profile, or default. + +value=$(/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload 2>/dev/null) + +case "$value" in + 1) echo "<result>true</result>" ;; + 0) echo "<result>false</result>" ;; + *) echo "<result>Not Set</result>" ;; +esac + + diff --git a/Apple Software Update Server.xml b/Apple Software Update Server.xml deleted file mode 100644 index 44baf16..0000000 --- a/Apple Software Update Server.xml +++ /dev/null @@ -1,8 +0,0 @@ -Apple Software Update ServerSoftware UpdatesstringThis attribute returns the DNS/IP address of the Apple Software Update Server that is set on the client machine. -#!/bin/sh - -SWU=`defaults read /private/var/root/Library/Preferences/com.apple.SoftwareUpdate CatalogURL` - -echo "<result>$SWU</result>" - - \ No newline at end of file diff --git a/BASH_Version.xml b/BASH_Version.xml index b618197..d8bff1b 100644 --- a/BASH_Version.xml +++ b/BASH_Version.xml @@ -1,19 +1,19 @@ -BASH Version -Find the version of BASH installed. -string -#!/bin/sh -################################################################## -# Extension Attribute checks version of BASH installed -# Cobbled together from other's hard work by Christopher Miller -# for ITSD-ISS of JHU-APL, Dated 2014-10-03 -################################################################## - -BASH_Version=$(/bin/bash --version | awk -F'[ |(]' '/version/{print $4}') - -echo "<result>$BASH_Version</result>" - -exit 0 - + BASH Version + Returns the version of /bin/bash that ships with the system. Note: macOS still bundles bash 3.2 for legacy compatibility; zsh is the default user shell. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# BASH Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# /bin/bash remains shipped at version 3.2.x for license reasons. Newer +# bash builds typically live at /opt/homebrew/bin/bash (Apple Silicon) or +# /usr/local/bin/bash (Intel) when installed via Homebrew. + +version=$(/bin/bash --version 2>/dev/null | /usr/bin/awk '/version/ { print $4; exit }') + +echo "<result>${version:-Unknown}</result>" + diff --git a/BIC.xml b/BIC.xml deleted file mode 100644 index 6b7d724..0000000 --- a/BIC.xml +++ /dev/null @@ -1 +0,0 @@ - BIC Agent version Security Reporting string This attribute displays the current version of the Netbox BIC agent installed by checking the safechat.conf file in /var/netbox/etc/ #!/bin/sh result=`awk '{ print }' /var/netbox/etc/safechat.conf | sed -n '2p' | sed "/version = /s///" ` echo "$result" \ No newline at end of file diff --git a/Battery Charge Percentage.xml b/Battery Charge Percentage.xml index a1c42a3..0a62c94 100644 --- a/Battery Charge Percentage.xml +++ b/Battery Charge Percentage.xml @@ -1 +1,29 @@ - Battery Charge Percentage System Information integer This attribute returns remaining charge percentage of the battery, if installed. This attribute applies to both Mac and Windows. #!/bin/sh maxCapacity=`ioreg -r -c "AppleSmartBattery" | grep -w "MaxCapacity" | awk '{print $3}' | sed s/\"//g` currentCapacity=`ioreg -r -c "AppleSmartBattery" | grep -w "CurrentCapacity" | awk '{print $3}' | sed s/\"//g` result=$( echo "scale=4; ($currentCapacity / $maxCapacity) * 100" | bc | sed 's/\(.*\)../\1/' ) echo "<result>$result</result>" VBScript On Error Resume Next Dim objBatteries Dim strBatteries Set objBatteries = GetObject("winmgmts:").InstancesOf("Win32_Battery") i=0 For each Battery in objBatteries if i <> 0 then strBatteries = "<br>" & strBatteries End If strBatteries = Battery.EstimatedChargeRemaining & strBatteries i=i+1 Next WScript.Echo "<result>" & strBatteries & "</result>" \ No newline at end of file + + + Battery Charge Percentage + Hardware + Integer + Remaining battery charge as an integer percentage, or N/A for desktop Macs. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Charge Percentage Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Returns the remaining battery charge as an integer percentage, or N/A on +# Macs without a battery (desktops). + +read -r maxCapacity currentCapacity <<<"$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' ' + /"MaxCapacity" =/ { m=$2 } + /"CurrentCapacity" =/ { c=$2 } + END { print m, c } + ')" + +if [[ -z "$maxCapacity" || -z "$currentCapacity" || "$maxCapacity" -eq 0 ]]; then + echo "<result>N/A</result>" +else + pct=$(( currentCapacity * 100 / maxCapacity )) + echo "<result>$pct</result>" +fi + + diff --git a/Battery Charging.xml b/Battery Charging.xml index fc932b3..19cf3ea 100644 --- a/Battery Charging.xml +++ b/Battery Charging.xml @@ -1 +1,20 @@ - Battery Charging System Information string This attribute returns whether or not the battery is charging, if installed. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep -w "IsCharging" | awk '{print $3}' | sed s/\"//g)</result>" \ No newline at end of file + + + Battery Charging + Hardware + string + Whether the battery is currently charging (Yes/No), or N/A on desktops. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Charging Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the IsCharging property from the AppleSmartBattery IOKit class. +# Returns "N/A" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"IsCharging" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-N/A}</result>" + + diff --git a/Battery Fully Charged.xml b/Battery Fully Charged.xml index 3dbdd0b..7bc351f 100644 --- a/Battery Fully Charged.xml +++ b/Battery Fully Charged.xml @@ -1 +1,20 @@ - Battery Fully Charged System Information string This attribute returns whether or not the battery is fully charged, if installed. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep -w "FullyCharged" | awk '{print $3}' | sed s/\"//g)</result>" \ No newline at end of file + + + Battery Fully Charged + Hardware + string + Whether the battery is fully charged (Yes/No), or N/A on desktops. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Fully Charged Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the FullyCharged property from the AppleSmartBattery IOKit class. +# Returns "N/A" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"FullyCharged" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-N/A}</result>" + + diff --git a/Battery Health Status.xml b/Battery Health Status.xml index b26a197..9b46d64 100644 --- a/Battery Health Status.xml +++ b/Battery Health Status.xml @@ -1 +1,31 @@ - Battery Health Status System Information string This attribute returns the health of the battery, if installed. In the event of battery failure, the attribute will report back "Failure". This attribute applies to both Mac and Windows. #!/bin/sh result=`ioreg -r -c "AppleSmartBattery" | grep "PermanentFailureStatus" | awk '{print $3}' | sed s/\"//g` if [ "$result" == "1" ]; then result="Failure" elif [ "$result" == "0" ]; then result="OK" fi echo "<result>$result</result>" VBScript On Error Resume Next Dim objBatteries Dim strBatteries Set objBatteries = GetObject("winmgmts:").InstancesOf("Win32_Battery") i=0 For each Battery in objBatteries if i <> 0 then strBatteries = "<br>" & strBatteries End if strBatteries = Battery.Status & strBatteries i = i + 1 Next WScript.Echo "<result>" & strBatteries & "</result>" \ No newline at end of file + + + Battery Permanent Failure Status + Hardware + Reports the battery permanent failure status: OK, Failure, or N/A for desktop Macs. + String + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Permanent Failure Status Extension Attribute +# Tested on macOS 11 through 26 (Tahoe), Intel and Apple Silicon +# Returns "OK", "Failure", or "N/A" for Macs without a battery + +# Anchor on the key name and split on the = sign rather than whitespace +# columns, which vary by indentation depth across Mac models. +rawValue=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"PermanentFailureStatus" =/ { + gsub(/^[ \t]+|[ \t]+$/, "", $2) + print $2 + exit + }') + +case "$rawValue" in + 0) result="OK" ;; + "") result="N/A" ;; + *) result="Failure" ;; +esac + +echo "<result>$result</result>" + + diff --git a/Battery Installed.xml b/Battery Installed.xml index e179a60..dccd0b6 100644 --- a/Battery Installed.xml +++ b/Battery Installed.xml @@ -1 +1,20 @@ - Battery Installed System Information string This attribute returns whether or not a battery is currently installed in a system that supports batteries. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep "BatteryInstalled" | awk '{print $3}' | sed s/\"//g)</result>" \ No newline at end of file + + + Battery Installed + Hardware + string + Whether a battery is currently installed (Yes/No), or N/A on desktops. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Installed Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the BatteryInstalled property from the AppleSmartBattery IOKit class. +# Returns "No" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"BatteryInstalled" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-No}</result>" + + diff --git a/Battery Manufacturer.xml b/Battery Manufacturer.xml index ca365ef..a441ce7 100644 --- a/Battery Manufacturer.xml +++ b/Battery Manufacturer.xml @@ -1 +1,20 @@ - Battery Manufacturer System Information string This attribute returns manufacturer of the battery, if installed. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep -w "Manufacturer" | awk '{print $3}' | sed s/\"//g)</result>" \ No newline at end of file + + + Battery Manufacturer + Hardware + string + Battery manufacturer name, or N/A on desktops. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Manufacturer Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the Manufacturer property from the AppleSmartBattery IOKit class. +# Returns "N/A" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"Manufacturer" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-N/A}</result>" + + diff --git a/Battery Serial Number.xml b/Battery Serial Number.xml index 20e0205..4a4e1f2 100644 --- a/Battery Serial Number.xml +++ b/Battery Serial Number.xml @@ -1 +1,20 @@ - Battery Serial Number System Information string This attribute returns serial number of the battery, if installed. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep "BatterySerialNumber" | awk '{print $3}' | sed s/\"//g)</result>" \ No newline at end of file + + + Battery Serial Number + Hardware + string + Battery serial number, or N/A on desktops. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Serial Number Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the BatterySerialNumber property from the AppleSmartBattery IOKit class. +# Returns "N/A" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"BatterySerialNumber" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-N/A}</result>" + + diff --git a/Battery Time Remaining.xml b/Battery Time Remaining.xml index 78d8025..4568acf 100644 --- a/Battery Time Remaining.xml +++ b/Battery Time Remaining.xml @@ -1 +1,20 @@ - Battery Time Remaining System Information integer This attribute returns number of minutes of battery charge remaining, if a battery is installed. This attribute applies to both Mac and Windows. #!/bin/sh echo "<result>$(ioreg -r -c "AppleSmartBattery" | grep -w "TimeRemaining" | awk '{print $3}' | sed s/\"//g)</result>" VBScript On Error Resume Next Dim objBatteries Dim strBatteries Set objBatteries = GetObject("winmgmts:").InstancesOf("Win32_Battery") i=0 For each Battery in objBatteries if i <> 0 then strBatteries = "<br>" & strBatteries End If strBatteries = Battery.EstimatedRunTime & strBatteries i=i+1 Next WScript.Echo "<result>" & strBatteries & "</result>" \ No newline at end of file + + + Battery Time Remaining + Hardware + integer + Estimated minutes of battery runtime remaining, or N/A on desktops. Apple reports 0 while still calculating after a wake or power-source change. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Battery Time Remaining Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Reads the TimeRemaining property from the AppleSmartBattery IOKit class. +# Returns "N/A" on Macs without a battery (desktops). + +value=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"TimeRemaining" =/ { gsub(/^[ "]+|[ "]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-N/A}</result>" + + diff --git a/Battery_Cycle_Count.xml b/Battery_Cycle_Count.xml index 5abf2a8..f7ee237 100644 --- a/Battery_Cycle_Count.xml +++ b/Battery_Cycle_Count.xml @@ -1,9 +1,23 @@ - -Battery Cycle Count -This attribute returns the number of charge cycles logged on the current battery. -number -#!/bin/bash - -echo "<result>$(system_profiler SPPowerDataType | awk '/Cycle Count/{print $NF}')</result>" + + + Battery Cycle Count + Hardware + Battery charge cycle count, or N/A for desktop Macs. + Integer + #!/bin/zsh + +# updated by SecurityShrimp 2026 +# Battery Cycle Count Extension Attribute +# Tested on macOS 11 through 26 (Tahoe), Intel and Apple Silicon +# Returns the battery cycle count, or "N/A" for desktop Macs + +cycleCount=$(/usr/sbin/ioreg -r -c AppleSmartBattery 2>/dev/null \ + | /usr/bin/awk -F'= ' '/"CycleCount" =/ {print $2; exit}') + +if [[ -z "$cycleCount" ]]; then + echo "<result>N/A</result>" +else + echo "<result>$cycleCount</result>" +fi diff --git a/Bluetooth Discoverable State.xml b/Bluetooth Discoverable State.xml index 5a3e558..38a418d 100644 --- a/Bluetooth Discoverable State.xml +++ b/Bluetooth Discoverable State.xml @@ -1 +1,39 @@ - Bluetooth Discoverable State Security Reporting string This attribute verifies the Bluetooth Discoverable State. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that Bluetooth is not set to "Discoverable" This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" appDomain="com.apple.Bluetooth.ByHost" keyName="DiscoverableState" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Bluetooth Discoverable State + Security Reporting + string + Reports whether Bluetooth Discoverable mode is enabled for the current console user. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Bluetooth Discoverable State Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Legacy script used "dscl . mcxread", which depends on MCX (deprecated +# since 10.7 and inert under modern Configuration Profiles). We instead +# read the value directly from the ByHost domain for the active console +# user. macOS only exposes "Discoverable" while the Bluetooth pane is open, +# so a value of 0 (or absence) reflects the default secure posture. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" ]]; then + echo "<result>No Console User</result>" + exit 0 +fi + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +plist=$(/bin/ls "$home/Library/Preferences/ByHost/" 2>/dev/null | /usr/bin/grep -m1 "com.apple.Bluetooth.") +value="" +if [[ -n "$plist" ]]; then + value=$(/usr/bin/defaults read "$home/Library/Preferences/ByHost/${plist%.plist}" DiscoverableState 2>/dev/null) +fi + +case "$value" in + 1) echo "<result>true</result>" ;; + 0) echo "<result>false</result>" ;; + *) echo "<result>Not Set</result>" ;; +esac + + diff --git a/Bradford_Agent_Version.xml b/Bradford_Agent_Version.xml deleted file mode 100644 index 2c1f47b..0000000 --- a/Bradford_Agent_Version.xml +++ /dev/null @@ -1,34 +0,0 @@ - -Bradford Agent Version -This will display the version of the Bradford Agent -string -#!/bin/sh -################################# -# Original Code By Chris Tangora -# Updated by Christopher Miller -# of ITSD-ISS for JHU-APL -# Dated: 20151001 -################################# - -# Look for the newer app version info -if [[ -e "/Library/Application Support/Bradford Networks/Persistent Agent/CSA.app/Contents/Info.plist" ]]; - then - BPAv=$(/usr/bin/defaults read "/Library/Application Support/Bradford Networks/Persistent Agent/CSA.app/Contents/Info.plist" | grep CFBundleGetInfoString | awk {'print $3'} | sed -e 's/[";]//g') - -# Look for the older app version info -elif [[ -e /Library/Application\ Support/Bradford\ Networks/Persistent\ Agent/CSA.app/Contents/Resources/bncsaui.xrs ]]; - then - BPAv=$( zipgrep Version /Library/Application\ Support/Bradford\ Networks/Persistent\ Agent/CSA.app/Contents/Resources/bncsaui.xrs | sed -e 's|.*\Version\:\ ||' -e 's|\<br.*||' ) - -# If nothing found, 'taint installed -else - BPAv="Not Installed" - -fi - -# Spit out the result -echo "<result>$BPAv</result>" - -exit 0 - - diff --git a/Browser_Application_Default.xml b/Browser_Application_Default.xml index 68ca17d..6472ca1 100644 --- a/Browser_Application_Default.xml +++ b/Browser_Application_Default.xml @@ -1,33 +1,38 @@ -Browser Application Default -This will determine the last user logged in and determine the default handler of content 'http'. -string -#!/bin/sh -##################################################################### -# Find the Default Browser on Mac OS X for the last logged in user -# Cobbled together from other's hard work -# By: Christopher T. Miller, Dated: 2014-11-13, Last Mod: 20141119 -# For ITSD-ISS of JHU-APL -##################################################################### - -# use the 'last' command to find the last real user. -# It will skip over the following users: reboot, shutdown, root, wtmp, adobeinstall, and any user you specify. -LastUser=`/usr/bin/last console | /usr/bin/awk '{print $1}' | /usr/bin/sed -e '/^$/d' -e '/^root$/d' -e '/^wtmp$/d' -e '/^adobeinstall$/d' | /usr/bin/awk 'NR>1{exit};1'` - -# Scour the Last User's LaunchServices plist file for the handler of content type "http" -DefaultBrowser=$(/usr/bin/defaults read /Users/$LastUser/Library/Preferences/com.apple.LaunchServices.plist | grep http -B 2 | awk '{print $3}' | tail -n 2 | head -n 1 | sed -e 's/[";,)]//g') - -# Check the value of variable "DefaultBrowser" for absence of data and insert a negative finding if blank (IE no Default Browser App Setting) -# This helps define which Macs have or haven't yet inventoried with the extension attribute -if [ "$DefaultBrowser" == "" ] - then - DefaultBrowser="No Default Browser Defined" -fi - -# Output the results -echo "<result>$DefaultBrowser</result>" - -exit 0 - + Browser Application Default + Returns the bundle ID registered as the default handler for http URLs for the current console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Default Browser Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# LaunchServices moved its handler list under com.apple.LaunchServices/ +# .secure on modern macOS. We parse LSHandlers and return the bundle ID +# bound to http. Reports the current console user (or last login if none). + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +fi + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +plist="$home/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist" + +if [[ ! -f "$plist" ]]; then + echo "<result>No Default Browser Defined</result>" + exit 0 +fi + +browser=$(/usr/libexec/PlistBuddy -c 'Print :LSHandlers' "$plist" 2>/dev/null \ + | /usr/bin/awk ' + /LSHandlerURLScheme = http$/ { want = 1 } + want && /LSHandlerRoleAll/ { print $3; exit } + ') + +echo "<result>${browser:-No Default Browser Defined}</result>" + diff --git a/Browser_Chrome_HomePage.xml b/Browser_Chrome_HomePage.xml index cfcb53f..3b9df97 100644 --- a/Browser_Chrome_HomePage.xml +++ b/Browser_Chrome_HomePage.xml @@ -1,28 +1,33 @@ -Browser Chrome HomePage -This will determine the HomePage Address set in the Firefox Browser for the last logged in user. -string -#!/bin/sh -##################################################################### -# Find the HomePage for Chrome Browser for the last logged in user -# Cobbled together from other's hard work -# By: Christopher T. Miller, Dated: 2014-11-14 -# For ITSD-ISS of JHU-APL -##################################################################### - -# use the 'last' command to find the last real user. -# It will skip over the following users: reboot, shutdown, root, wtmp, adobeinstall, and any user you specify. -LastUser=`/usr/bin/last console | /usr/bin/awk '{print $1}' | /usr/bin/sed -e '/^$/d' -e '/^root$/d' -e '/^wtmp$/d' -e '/^adobeinstall$/d' | /usr/bin/awk 'NR>1{exit};1'` - - -# Scour the Last User's Chrome Preferences file for the HomePage Address -HomePage=$(cat /Users/$LastUser/Library/Application\ Support/Google/Chrome/Default/Preferences | grep homepage | head -n 1 | awk '{print $2}') - - -# Output the results and clip off extra characters -echo "<result>$HomePage</result>" | sed -e 's/[",;)]//g' - -exit 0 - + Browser Chrome HomePage + Returns the homepage URL set in Google Chrome's Preferences for the current/last console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Chrome Homepage Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +prefs="$home/Library/Application Support/Google/Chrome/Default/Preferences" + +if [[ -f "$prefs" ]]; then + hp=$(/usr/bin/python3 -c ' +import json, sys +try: + d = json.load(open(sys.argv[1])) + print(d.get("homepage", "")) +except Exception: + pass +' "$prefs" 2>/dev/null) + echo "<result>${hp:-Not Set}</result>" +else + echo "<result>Not Installed</result>" +fi + diff --git a/Browser_Firefox_HomePage.xml b/Browser_Firefox_HomePage.xml index 51af57f..091e9b8 100644 --- a/Browser_Firefox_HomePage.xml +++ b/Browser_Firefox_HomePage.xml @@ -1,31 +1,34 @@ -Browser Firefox HomePage -This will determine the HomePage Address set in the Firefox Browser for the last logged in user. -string -#!/bin/sh -##################################################################### -# Find the HomePage for Firefox Browser for the last logged in user -# Cobbled together from other's hard work -# By: Christopher T. Miller, Dated: 2014-11-14 -# For ITSD-ISS of JHU-APL -##################################################################### - -# use the 'last' command to find the last real user. -# It will skip over the following users: reboot, shutdown, root, wtmp, adobeinstall, and any user you specify. -LastUser=`/usr/bin/last console | /usr/bin/awk '{print $1}' | /usr/bin/sed -e '/^$/d' -e '/^root$/d' -e '/^wtmp$/d' -e '/^adobeinstall$/d' | /usr/bin/awk 'NR>1{exit};1'` - - -# Find the default Firefox profile folder of the Last User -ProfileDir=$(ls /Users/$LastUser/Library/Application\ Support/Firefox/Profiles/ | grep .default) - - -# Scour the Last User's Firefox prefs.js file for the HomePage Address -HomePage=$(cat /Users/$LastUser/Library/Application\ Support/Firefox/Profiles/$ProfileDir/prefs.js | grep startup.homepage | head -n 1 | awk '{print $2}') - -# Output the results and clip off extra characters -echo "<result>$HomePage</result>" | sed -e 's/[",;)]//g' - -exit 0 - + Browser Firefox HomePage + Returns the homepage URL set in Firefox's prefs.js for the current/last console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Firefox Homepage Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +profilesDir="$home/Library/Application Support/Firefox/Profiles" + +if [[ ! -d "$profilesDir" ]]; then + echo "<result>Not Installed</result>" + exit 0 +fi + +profile=$(/bin/ls "$profilesDir" 2>/dev/null | /usr/bin/grep -m1 '\.default') +prefs="$profilesDir/$profile/prefs.js" + +if [[ -f "$prefs" ]]; then + hp=$(/usr/bin/awk -F'"' '/browser\.startup\.homepage/ { print $4; exit }' "$prefs") + echo "<result>${hp:-Not Set}</result>" +else + echo "<result>Not Set</result>" +fi + diff --git a/Browser_Safari_HomePage.xml b/Browser_Safari_HomePage.xml index 8527256..0419314 100644 --- a/Browser_Safari_HomePage.xml +++ b/Browser_Safari_HomePage.xml @@ -1,26 +1,25 @@ -Browser Safari HomePage -Find the Last User's HomePage address set in the Safari Browser -string -#!/bin/sh -##################################################################### -# Find the HomePage in Safari for the last logged in user -# Cobbled together from other's hard work -# By: Christopher T. Miller, Dated: 2014-11-14 -# For ITSD-ISS of JHU-APL -##################################################################### - -# use the 'last' command to find the last real user. -# It will skip over the following users: reboot, shutdown, root, wtmp, adobeinstall, and any user you specify. -LastUser=`/usr/bin/last console | /usr/bin/awk '{print $1}' | /usr/bin/sed -e '/^$/d' -e '/^root$/d' -e '/^wtmp$/d' -e '/^adobeinstall$/d' | /usr/bin/awk 'NR>1{exit};1'` - -# Scour the Last User's Sarafi plist file for the HomePage Address -HomePage=$(/usr/bin/defaults read /Users/$LastUser/Library/Preferences/com.apple.Safari.plist | grep HomePage | awk '{print $3}') - -# Output the results and clip off extra characters -echo "<result>$HomePage</result>" | sed -e 's/[",;)]//g' - -exit 0 - + Browser Safari HomePage + Returns the homepage URL set in Safari for the current/last console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Safari Homepage Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Safari is sandboxed; its preferences live in a container path on modern +# macOS. We try the container plist first and fall back to the legacy path. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +hp=$(/usr/bin/defaults read "$home/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari" HomePage 2>/dev/null) +[[ -z "$hp" ]] && hp=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.Safari" HomePage 2>/dev/null) + +echo "<result>${hp:-Not Set}</result>" + diff --git a/CarbonBlack_Response_Version.xml b/CarbonBlack_Response_Version.xml deleted file mode 100644 index 6986261..0000000 --- a/CarbonBlack_Response_Version.xml +++ /dev/null @@ -1,19 +0,0 @@ - -CarbonBlack Response Version - -string -#!/bin/bash -versionBinary="/Applications/CarbonBlack/CbOsxSensorService"; -if [[ -f "$versionBinary" ]]; then - version=$($versionBinary -v | tr -d ' ') - if [[ ! -z "$version" ]]; then - result="$version" - else - result="Invalid Version" - fi -else - result="Not Installed" -fi -echo "<result>${result}</result>"; - - diff --git a/Casper Site.xml b/Casper Site.xml index 7e8192f..d4725e3 100644 --- a/Casper Site.xml +++ b/Casper Site.xml @@ -1,23 +1,44 @@ -Casper Site -This script reports the system's site association as an extended attribute so it can be used as search criteria. -string -#!/bin/sh - -apiURL="https://yourjss:8443/JSSResource/computers/udid/" -apiUser="APIUser" -apiPass="APIPassword" -MacAdd=$( /usr/sbin/networksetup -getmacaddress en0 | /usr/bin/awk '{ print $3 }' | /usr/bin/sed 's/:/./g' ) - -udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') - -siteName=$(/usr/bin/curl -s -u ${apiUser}:${apiPass} "${apiURL}${udid}" | /usr/bin/xpath '/computer/general/site/name[1]/text()' 2>/dev/null) - -if [[ $siteName ]]; then - echo "<result>${siteName}</result>" -else - echo "<result>Not Available</result>" -fi - + Jamf Pro Site + Queries the Jamf Pro API for this computer's Site assignment. Configure the apiURL/apiUser/apiPass placeholders before deployment. Note: Casper was renamed Jamf Pro in 2017. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Jamf Pro Site Extension Attribute (formerly "Casper Site") +# Targets macOS 12 through 26 (Tahoe) +# Authenticates against the Jamf Pro Classic API with token-based auth +# (Basic auth on /classic endpoints was deprecated in Jamf Pro 10.35). +# Replace the placeholders with credentials for an API account that has +# Read on Computers. Embedding creds in EAs is not best practice; prefer +# a Jamf Pro built-in Site reporting field when available. + +apiURL="https://yourjss.example.com:8443" +apiUser="APIUser" +apiPass="APIPassword" + +udid=$(/usr/sbin/ioreg -d2 -c IOPlatformExpertDevice 2>/dev/null \ + | /usr/bin/awk -F'"' '/IOPlatformUUID/ { print $4; exit }') + +token=$(/usr/bin/curl -s -u "${apiUser}:${apiPass}" \ + -X POST "${apiURL}/api/v1/auth/token" 2>/dev/null \ + | /usr/bin/awk -F'"' '/token/ { print $4; exit }') + +if [[ -z "$token" ]]; then + echo "<result>Auth Failed</result>" + exit 0 +fi + +xml=$(/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + "${apiURL}/JSSResource/computers/udid/${udid}" 2>/dev/null) + +siteName=$(echo "$xml" | /usr/bin/xmllint --xpath 'string(//computer/general/site/name)' - 2>/dev/null) + +# Revoke the token so we don't leave a session hanging +/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + -X POST "${apiURL}/api/v1/auth/invalidate-token" >/dev/null 2>&1 + +echo "<result>${siteName:-Not Available}</result>" + diff --git a/Centrify_Version.xml b/Centrify_Version.xml deleted file mode 100644 index a46045f..0000000 --- a/Centrify_Version.xml +++ /dev/null @@ -1,32 +0,0 @@ - - -Centrify Version - -string -#!/bin/sh - -mode=`adinfo --version | grep "CentrifyDC" | awk '{print $3}'` - -if [ "$mode" != "" ]; then - echo "<result>Centrify v.${mode//)} Installed</result>" -else - echo "<result>Centrify Not Installed</result>" -fi - -# modified by Amanda De Feo 08-16-2017 - jose below - -#if [ "$mode" == "5.4.1-455)" ]; then -# echo "<result>Centrify v5.3.3 Installed</result>" -#elif [ "$mode" == "5.4.0-289)" ]; then -# echo "<result>Centrify v5.3.3 Installed</result>" -#elif [ "$mode" == "5.3.3-602)" ]; then -# echo "<result>Centrify v5.3.3 Installed</result>" -#elif [ "$mode" == "5.3.0-213)" ]; then -#echo "<result>Old Centrify Version v5.3.0x Installed</result>" -#elif [ "$mode" == "5.2.4-465)" ]; then -#echo "<result>Old Centrify Version v5.2.4x Installed</result>" -#else -# echo "<result>NA</result>" -#fi - - diff --git a/CheckPoint - Encryption Percentage.xml b/CheckPoint - Encryption Percentage.xml index affb0a7..280d9f0 100644 --- a/CheckPoint - Encryption Percentage.xml +++ b/CheckPoint - Encryption Percentage.xml @@ -1 +1,34 @@ - CheckPoint - Encryption Percentage Disk Encryption This attribute returns the Disk Encryption Percentage for CheckPoint on the boot disk. This attribute template applies to CheckPoint (v 3.2). integer #!/bin/sh #This script has been verified to work on CheckPoint (v 3.2). #Check to see if CheckPoint is installed if [ -f /usr/local/ppc-*/bin/FDEEncStatus ]; then result=$(/usr/local/ppc-*/bin/FDEEncStatus | sed 's/Volume:/\Volume:/g' | grep -w "Volume: /" | grep "Status: Encrypt" | awk '{print $7}') if [ "$result" == "" ]; then result=$(/usr/local/ppc-*/bin/FDEEncStatus | sed 's/Volume:/\Volume:/g' | grep -w "Volume: /" | grep "Status: Decrypt" | awk '{print $7}') if [ "$result" == "" ]; then echo "<result>0</result>" else echo "<result>$result</result>" fi else echo "<result>$result</result>" fi else echo "<result>Not installed</result>" fi \ No newline at end of file + + + CheckPoint - Encryption Percentage + Disk Encryption + Returns CheckPoint Full Disk Encryption progress for the boot volume, 0-100. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# CheckPoint Encryption Percentage Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only (Apple Silicon returns N/A) +# Current CheckPoint FDE Mac installer drops FDEEncStatus under /usr/local +# in a version-specific directory (originally ppc-* "Pointsec Personal +# Computer"; modern builds use checkpoint-*). We glob for either. + +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 +fi + +bin=$(/bin/ls /usr/local/ppc-*/bin/FDEEncStatus(N) /usr/local/checkpoint*/bin/FDEEncStatus(N) 2>/dev/null | /usr/bin/head -n1) +if [[ -z "$bin" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +status=$("$bin" 2>/dev/null | /usr/bin/awk ' + /Volume:[[:space:]]*\/[[:space:]]/ { vol=1; next } + vol && /Status:[[:space:]]*Encrypt/ { for (i=1; i<=NF; i++) if ($i ~ /%/) print $i; vol=0 } +') +status=${status//%/} +echo "<result>${status:-0}</result>" + + diff --git a/CheckPoint - Encryption Status.xml b/CheckPoint - Encryption Status.xml index eba4f21..c354569 100644 --- a/CheckPoint - Encryption Status.xml +++ b/CheckPoint - Encryption Status.xml @@ -1 +1,31 @@ - CheckPoint - Encryption Status Disk Encryption This attribute returns the Disk Encryption Status for CheckPoint on the boot disk. Examples of returned values include: "Encrypting", "Encrypted", "Decrypting", and "Decrypted". This attribute template applies to CheckPoint (v 3.2). string #!/bin/sh #This script has been verified to work on CheckPoint (v 3.2). #Check to see if CheckPoint is installed if [ -f /usr/local/ppc-*/bin/FDEEncStatus ]; then result=$(/usr/local/ppc-*/bin/FDEEncStatus | sed 's/Volume:/\ Volume:/g' | grep -w "Volume: /" | grep "Status: Encrypt" | awk '{print $6}') if [ "$result" == "" ]; then result=$(/usr/local/ppc-*/bin/FDEEncStatus | sed 's/Volume:/\ Volume:/g' | grep -w "Volume: /" | grep "Status: Decrypt" | awk '{print $6}') if [ "$result" == "" ]; then echo "<result>Decrypted</result>" else echo "<result>$result</result>" fi else echo "<result>$result</result>" fi else echo "<result>Not installed</result>" fi \ No newline at end of file + + + CheckPoint - Encryption Status + Disk Encryption + Returns the CheckPoint FDE status for the boot volume ("Encrypted", "Encrypting", "Decrypted", "Decrypting", or "Not installed"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# CheckPoint Encryption Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only (Apple Silicon returns N/A) + +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 +fi + +bin=$(/bin/ls /usr/local/ppc-*/bin/FDEEncStatus(N) /usr/local/checkpoint*/bin/FDEEncStatus(N) 2>/dev/null | /usr/bin/head -n1) +if [[ -z "$bin" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +status=$("$bin" 2>/dev/null | /usr/bin/awk ' + /Volume:[[:space:]]*\/[[:space:]]/ { vol=1; next } + vol && /Status:/ { for (i=1; i<=NF; i++) if ($i ~ /(Encrypt|Decrypt)/) print $i; vol=0 } +') + +echo "<result>${status:-Decrypted}</result>" + + diff --git a/Chrome_Extensions_(1).xml b/Chrome_Extensions_(1).xml index 455c42a..25e08d6 100644 --- a/Chrome_Extensions_(1).xml +++ b/Chrome_Extensions_(1).xml @@ -1,75 +1,67 @@ -Chrome Extensions -Displays Name, Version and ID of installed Google Chrome Extensions for current or last user. - -By default, data is displayed as: - -Name: Extension Name -Version: Extension Version -ID: Extension ID. - -However, if further data analysis is needed, an alternate output is available: - -Name;Version;ID - -The default output looks much prettier in the JSS, but the alternative output may be more useful. - -To use the alternate output, simply comment out line: - -echo -e "Name: $reportedName \nVersion: $version \nID: $extID \n" - -And uncomment line: - -echo -e "$reportedName;$version;$extID" -string -#!/bin/bash - -# Setting IFS Env to only use new lines as field seperator -IFS=$'\n' - -currentUser=`ls -l /dev/console | awk {' print $3 '}` -lastUser=`defaults read /Library/Preferences/com.apple.loginwindow lastUserName` - -if [[ "$currentUser" = "" || "$currentUser" = "root" ]] - then userHome=`/usr/bin/dscl . -read /Users/$lastUser NFSHomeDirectory | awk -F ": " '{print $2}'` - else userHome=`/usr/bin/dscl . -read /Users/$currentUser NFSHomeDirectory | awk -F ": " '{print $2}'` -fi - -createChromeExtList () -{ -for manifest in $(find "$userHome/Library/Application Support/Google/Chrome/Default/Extensions" -name 'manifest.json') - do - name=$(cat $manifest | grep '"name":' | awk -F "\"" '{print $4}') - if [[ `echo $name | grep "__MSG"` ]] - then - msgName="\"`echo $name | awk -F '__MSG_|__' '{print $2}'`\":" - if [ -f $(dirname $manifest)/_locales/en/messages.json ] - then reportedName=$(cat $(dirname $manifest)/_locales/en/messages.json | grep -i -A 3 "$msgName" | grep "message" | head -1 | awk -F ": " '{print $2}' | tr -d "\"") - elif [ -f $(dirname $manifest)/_locales/en_US/messages.json ] - then reportedName=$(cat $(dirname $manifest)/_locales/en_US/messages.json | grep -i -A 3 "$msgName" | grep "message" | head -1 | awk -F ": " '{print $2}' | tr -d "\"") - fi - else - reportedName=$(cat $manifest | grep '"name":' | awk -F "\"" '{print $4}') - fi - version=$(cat $manifest | grep '"version":' | awk -F "\"" '{print $4}') - extID=$(basename $(dirname $(dirname $manifest))) - - # This is the default output style - looks nice in JSS - # Comment out line below if you wish to use alternate output - echo -e "Name: $reportedName \nVersion: $version \nID: $extID \n" - - # This is the alternate output style - looks ugly in JSS, but possibly more useful - # Uncomment line below to use this output instead - #echo -e "$reportedName;$version;$extID" - done - } - -if [ -d "$userHome/Library/Application Support/Google/Chrome/Default/Extensions" ] - then result="`createChromeExtList`" - else result="NA" -fi - -echo "<result>$result</result>" - + Chrome Extensions + Lists installed Google Chrome extensions (Name, Version, ID) for the current or last console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Chrome Extensions Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Walks Chrome's Default/Extensions directory and parses each manifest.json +# with python3 (ships in /usr/bin on macOS) to robustly handle localized +# extension names that resolve via _locales/en/messages.json. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +extDir="$home/Library/Application Support/Google/Chrome/Default/Extensions" + +if [[ ! -d "$extDir" ]]; then + echo "<result>NA</result>" + exit 0 +fi + +result=$(/usr/bin/python3 - "$extDir" <<'PY' +import json, os, sys, re +ext_dir = sys.argv[1] +out = [] +for ext_id in sorted(os.listdir(ext_dir)): + ext_path = os.path.join(ext_dir, ext_id) + if not os.path.isdir(ext_path): + continue + for ver in sorted(os.listdir(ext_path)): + m = os.path.join(ext_path, ver, "manifest.json") + if not os.path.isfile(m): + continue + try: + d = json.load(open(m)) + except Exception: + continue + name = d.get("name", "") + version = d.get("version", "") + mo = re.match(r"__MSG_(.+)__", name or "") + if mo: + key = mo.group(1) + for locale in ("en", "en_US"): + lp = os.path.join(ext_path, ver, "_locales", locale, "messages.json") + if os.path.isfile(lp): + try: + msgs = json.load(open(lp)) + for k, v in msgs.items(): + if k.lower() == key.lower(): + name = v.get("message", name) + break + except Exception: + pass + break + out.append(f"Name: {name}\nVersion: {version}\nID: {ext_id}\n") +print("\n".join(out)) +PY +) + +echo "<result>${result:-NA}</result>" + diff --git a/ClamXav - Virus Definition Date.xml b/ClamXav - Virus Definition Date.xml index 8407500..0ab1e93 100644 --- a/ClamXav - Virus Definition Date.xml +++ b/ClamXav - Virus Definition Date.xml @@ -1 +1,34 @@ - ClamXav - Virus Definition Date AntiVirus This attribute returns the Virus Definitions Date for ClamXav. This attribute template applies to ClamXav (v 2.0.5). date #!/bin/sh #This script has been verified to work on ClamXav (v 2.0.5). #Check to see if ClamXav is installed if [ -f "/usr/local/clamXav/bin/freshclam" ]; then result=`/bin/date -j -f "%b %d %Y" "$(/usr/local/clamXav/bin/freshclam --version | sed s:/:\ :g | awk '{print $5, $6, $8}')" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file + + + ClamXav - Virus Definition Date + AntiVirus + Returns the date of the most recent ClamXav virus definitions update. + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ClamXav Virus Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Modern ClamXav (v3+) ships its engine inside the .app bundle. We check +# the bundle path first, then the legacy /usr/local/clamXav install. + +for fc in \ + "/Applications/ClamXAV.app/Contents/Resources/ScanningEngine/bin/freshclam" \ + "/usr/local/clamXav/bin/freshclam" +do + [[ -x "$fc" ]] && freshclam="$fc" && break +done + +if [[ -z "$freshclam" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +raw=$("$freshclam" --version 2>/dev/null | /usr/bin/awk -F'/' '{print $3}') +if [[ -n "$raw" ]]; then + iso=$(/bin/date -j -f "%a %b %d %H:%M:%S %Y" "$raw" "+%Y-%m-%d 00:00:00" 2>/dev/null) +fi + +echo "<result>${iso:-Unknown}</result>" + + diff --git a/ClamXav - Virus Definition Version.xml b/ClamXav - Virus Definition Version.xml index 6b45a8c..bc58386 100644 --- a/ClamXav - Virus Definition Version.xml +++ b/ClamXav - Virus Definition Version.xml @@ -1 +1,28 @@ - ClamXav - Virus Definition Version AntiVirus This attribute returns the Virus Definitions Version for ClamXav. This attribute template applies to ClamXav (v 2.0.5). integer #!/bin/sh #This script has been verified to work on ClamXav (v 2.0.5). #Check to see if ClamXav is installed if [ -f "/usr/local/clamXav/bin/freshclam" ]; then result=`/usr/local/clamXav/bin/freshclam --version | sed s:/:\ :g | awk '{print $3}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file + + + ClamXav - Virus Definition Version + AntiVirus + Returns the ClamXav signature database version (daily.cvd build number). + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# ClamXav Virus Definition Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +for fc in \ + "/Applications/ClamXAV.app/Contents/Resources/ScanningEngine/bin/freshclam" \ + "/usr/local/clamXav/bin/freshclam" +do + [[ -x "$fc" ]] && freshclam="$fc" && break +done + +if [[ -z "$freshclam" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +ver=$("$freshclam" --version 2>/dev/null | /usr/bin/awk -F'/' '{print $2}') +echo "<result>${ver:-Unknown}</result>" + + diff --git a/Computer Sleep.xml b/Computer Sleep.xml index 7d5efc3..c217fbc 100644 --- a/Computer Sleep.xml +++ b/Computer Sleep.xml @@ -1 +1,21 @@ - Computer Sleep Power Management This attribute displays the number of minutes before the computer sleeps on the active power management profile. integer #!/bin/sh echo "<result>`/usr/bin/pmset -g 2>&1 | grep -w sleep | awk '{print $2}'`</result>" \ No newline at end of file + + + Computer Sleep + Power Management + Minutes of idle time before the computer enters sleep on the active power profile. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Computer Sleep Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# pmset -g custom is the documented way to read the active profile's +# sleep timer. The legacy "pmset -g" approach matched the wrong column +# when "displaysleep" appeared first. + +value=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk '/^[[:space:]]*sleep[[:space:]]/ { print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/Computrace - Last Call Time & Date.xml b/Computrace - Last Call Time & Date.xml deleted file mode 100644 index b5b49da..0000000 --- a/Computrace - Last Call Time & Date.xml +++ /dev/null @@ -1 +0,0 @@ - Computrace - Last Call Time & Date Security string This will report on the last call time and date from client to Absolute, based on the modification time and date to the /Library/Preferences/com.absolute.settings file. #!/bin/sh #This script has been tested to work on OS X 10.5.x-10.7.2. #Check to see if Computrace call in Date and Time. #Date and time reported reflect the Computrace servers, and might be different then your local time zone.. #Sean Gallagher - seanjsgallagher@me.com if [ -f "/Library/Preferences/com.absolute.settings" ]; then result=`/usr/bin/mdls -name kMDItemFSContentChangeDate -raw /Library/Preferences/com.absolute.settings | awk '{print $1, $2}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/Computrace_MD5_checksum.xml b/Computrace_MD5_checksum.xml deleted file mode 100644 index ef1fc51..0000000 --- a/Computrace_MD5_checksum.xml +++ /dev/null @@ -1,10 +0,0 @@ - - -Computrace MD5 checksum -This attribute displays the MD5 checksum of the /usr/sbin/rpc.net. -string -#!/bin/sh -echo "<result>`md5 -q /usr/sbin/rpc.net`</result>" - - - diff --git a/CrashPlan - Alert Status.xml b/CrashPlan - Alert Status.xml deleted file mode 100644 index ad7805a..0000000 --- a/CrashPlan - Alert Status.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Alert Status Backup This attribute displays the CrashPlan alert status of the computer. "OK" if the computer has backed up within defined days, "WARN" if computer has exceeded "warning" threshold, "ALERT" if computer has exceeded "alert" threshold. This attribute applies to both Mac and Windows. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` echo "<result>`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computers?guid="$GUID" | grep -w alertStates | awk '{print $2}' | sed s/,//g | sed 's/..\(.*\)/\1/' | sed 's/\(.*\)../\1/'`</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "alertStates") > 0 Then strResult = Replace (arrResults(i), chr(34) & "alertStates" & chr(34) & ": [" & chr(34), "") strResult = Replace (strResult, chr(34) & "]", "") strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") Exit for End if Next WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Average Upload Rate.xml b/CrashPlan - Average Upload Rate.xml deleted file mode 100644 index 2c7e1e8..0000000 --- a/CrashPlan - Average Upload Rate.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Average Upload Rate Backup This attribute displays the average upload rate based on historical CrashPlan backup jobs. This attribute applies to both Mac and Windows. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w completionRateAverage | awk '{print $2}' | sed s/,//g` kilo=$( echo "scale=2; $value / 1024" | bc ) kiloint=$( echo "$value / 1024" | bc ) mega=$( echo "scale=2; $kilo / 1024" | bc ) megaint=$( echo "$kilo / 1024" | bc ) giga=$( echo "scale=2; $mega / 1024" | bc ) gigaint=$( echo "$mega / 1024" | bc ) if [ $kiloint -lt 1 ] ; then result="$value bps" elif [ $megaint -lt 1 ] ; then result="${kilo} kbps" elif [ $gigaint -lt 1 ] ; then result="${mega} mbps" else result="${giga} gbps" fi echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim inttoDo Dim intTotalSize Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "completionRateAverage") > 0 Then intTotalSize = Replace (arrResults(i), chr(34) & "completionRateAverage" & chr(34) & ": ", "") intTotalSize = CInt(Trim(intTotalSize)) Exit for End if Next kilo = intTotalSize / 1024 mega = kilo / 1024 giga = mega / 1024 If kilo < 1 then strResult = Round(intTotalSize) & " bytes" ElseIf mega < 1 then strResult = Round(kilo) & " KB" ElseIf giga < 1 Then strResult = Round(mega) & " MB" Else strResult = Round(giga) & " GB" End If WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Backup Percent Complete.xml b/CrashPlan - Backup Percent Complete.xml deleted file mode 100644 index 9753df9..0000000 --- a/CrashPlan - Backup Percent Complete.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Backup Percent Complete Backup This attribute displays the backup percent complete based on the total size of selected files and the total size of files that CrashPlan has yet to back up. This attribute applies to both Mac and Windows. integer #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` totalSize=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" 2>&1 | grep -w selectedBytes | awk '{print $2}' | sed s/,//g` todo=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w todoBytes | awk '{print $2}' | sed s/,//g` done=`expr "$totalSize" - "$todo"` result=$( echo "scale=4; ($done / $totalSize) * 100" | bc | sed 's/\(.*\)../\1/' ) echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim inttoDo Dim intTotalSize Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "selectedBytes") > 0 Then intTotalSize = Replace (arrResults(i), chr(34) & "selectedBytes" & chr(34) & ": ", "") intTotalSize = CInt(Trim(intTotalSize)) Exit for End if Next For i = 0 to ubound(arrResults) If inStr(arrResults(i), "todoBytes") > 0 Then inttoDo = Replace (arrResults(i), chr(34) & "todoBytes" & chr(34) & ": ", "") inttoDo = CInt(Trim(inttoDo)) Exit for End if Next intdone = intTotalSize - inttoDo strResult = Round(intdone / intTotalSize * 100) WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Computer GUID.xml b/CrashPlan - Computer GUID.xml deleted file mode 100644 index d6973b2..0000000 --- a/CrashPlan - Computer GUID.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Computer GUID Backup This attribute displays the computer GUID assigned to the machine by CrashPlan. This attribute applies to both Mac and Windows. integer #!/bin/sh if [ -f /Library/Application\ Support/CrashPlan/.identity ];then echo "<result>`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g`</result>" else echo "<result>Not installed</result>" fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim arrResults Dim strResult Dim GUID 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else WScript.Echo "<result>" & GUID & "</result>" End If \ No newline at end of file diff --git a/CrashPlan - Last Backup.xml b/CrashPlan - Last Backup.xml deleted file mode 100644 index 4311cbe..0000000 --- a/CrashPlan - Last Backup.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Last Backup Backup This attribute displays the last time CrashPlan ran a backup. This attribute applies to both Mac and Windows. date #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "Please ensure all variables are set in the extension attribute script." else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w lastActivity | awk '{print $2}' | sed s/,//g | sed 's/.\(.*\)/\1/'` result=`/bin/date -j -f "%Y-%m-%dT%H:%M:%S" "$value" "+%Y-%m-%d %H:%M:%S"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "lastActivity") > 0 Then strResult = Replace (arrResults(i), chr(34) & "lastActivity" & chr(34) & ": " & chr(34), "") strResult = Replace (strResult, chr(34), "") strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") Exit for End if Next strResult = Replace(strResult, "T", " ") strResult = Split(strResult, ".") WScript.Echo "<result>" & strResult(0) & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Last Connected.xml b/CrashPlan - Last Connected.xml deleted file mode 100644 index dad1d04..0000000 --- a/CrashPlan - Last Connected.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Last Connected Backup This attribute displays the last time CrashPlan established a connection with the server. This attribute applies to both Mac and Windows. date #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "Please ensure all variables are set in the extension attribute script." else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w lastConnected | awk '{print $2}' | sed s/,//g | sed 's/.\(.*\)/\1/'` result=`/bin/date -j -f "%Y-%m-%dT%H:%M:%S" "$value" "+%Y-%m-%d %H:%M:%S"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "lastConnected") > 0 Then strResult = Replace (arrResults(i), chr(34) & "lastConnected" & chr(34) & ": " & chr(34), "") strResult = Replace (strResult, chr(34), "") strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") Exit for End if Next strResult = Replace(strResult, "T", " ") strResult = Split(strResult, ".") WScript.Echo "<result>" & strResult(0) & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Number of Files to Backup.xml b/CrashPlan - Number of Files to Backup.xml deleted file mode 100644 index acdcee1..0000000 --- a/CrashPlan - Number of Files to Backup.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Number of Files to Backup Backup This attribute displays the number of files CrashPlan is waiting to back up. This attribute applies to both Mac and Windows. integer #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` echo "<result>`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w todoFiles | awk '{print $2}' | sed s/,//g`</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "todoFiles") > 0 Then strResult = Replace (arrResults(i), "todoFiles", "") strResult = Replace (strResult, ":", "") strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") strResult = Replace (strResult, chr(34), "") Exit for End if Next WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Number of Selected Files.xml b/CrashPlan - Number of Selected Files.xml deleted file mode 100644 index 9b81c1e..0000000 --- a/CrashPlan - Number of Selected Files.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Number of Selected Files Backup This attribute displays the number of files CrashPlan is actively backing up. This attribute applies to both Mac and Windows. integer #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` echo "<result>`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w selectedFiles | awk '{print $2}' | sed s/,//g`</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "selectedFiles") > 0 Then strResult = Replace (arrResults(i), "selectedFiles", "") strResult = Replace (strResult, ":", "") strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") strResult = Replace (strResult, chr(34), "") Exit for End if Next WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Selected Files Size.xml b/CrashPlan - Selected Files Size.xml deleted file mode 100644 index d63c477..0000000 --- a/CrashPlan - Selected Files Size.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Selected Files Size Backup This attribute displays the size of the files that CrashPlan has selected to actively back up. This attribute applies to both Mac and Windows. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w selectedBytes | awk '{print $2}' | sed s/,//g` kilo=$( echo "scale=2; $value / 1024" | bc ) kiloint=$( echo "$value / 1024" | bc ) mega=$( echo "scale=2; $kilo / 1024" | bc ) megaint=$( echo "$kilo / 1024" | bc ) giga=$( echo "scale=2; $mega / 1024" | bc ) gigaint=$( echo "$mega / 1024" | bc ) if [ $kiloint -lt 1 ] ; then result="$value bytes" elif [ $megaint -lt 1 ] ; then result="${kilo} KB" elif [ $gigaint -lt 1 ] ; then result="${mega} MB" else result="${giga} GB" fi echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim inttoDo Dim intTotalSize Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "selectedBytes") > 0 Then intTotalSize = Replace (arrResults(i), chr(34) & "selectedBytes" & chr(34) & ": ", "") intTotalSize = CInt(Trim(intTotalSize)) Exit for End if Next kilo = intTotalSize / 1024 mega = kilo / 1024 giga = mega / 1024 If kilo < 1 then strResult = Round(intTotalSize) & " bytes" ElseIf mega < 1 then strResult = Round(kilo) & " KB" ElseIf giga < 1 Then strResult = Round(mega) & " MB" Else strResult = Round(giga) & " GB" End If WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Size of Files Waiting to Backup.xml b/CrashPlan - Size of Files Waiting to Backup.xml deleted file mode 100644 index 8b6759c..0000000 --- a/CrashPlan - Size of Files Waiting to Backup.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Size of Files Waiting to Backup Backup This attribute displays the total size of the files CrashPlan is waiting to back up. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w todoBytes | awk '{print $2}' | sed s/,//g` kilo=$( echo "scale=2; $value / 1024" | bc ) kiloint=$( echo "$value / 1024" | bc ) mega=$( echo "scale=2; $kilo / 1024" | bc ) megaint=$( echo "$kilo / 1024" | bc ) giga=$( echo "scale=2; $mega / 1024" | bc ) gigaint=$( echo "$mega / 1024" | bc ) if [ $kiloint -lt 1 ] ; then result="$value bytes" elif [ $megaint -lt 1 ] ; then result="${kilo} KB" elif [ $gigaint -lt 1 ] ; then result="${mega} MB" else result="${giga} GB" fi echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim inttoDo Dim intTotalSize Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "todoBytes") > 0 Then intTotalSize = Replace (arrResults(i), chr(34) & "todoBytes" & chr(34) & ": ", "") intTotalSize = CInt(Trim(intTotalSize)) Exit for End if Next kilo = intTotalSize / 1024 mega = kilo / 1024 giga = mega / 1024 If kilo < 1 then strResult = Round(intTotalSize) & " bytes" ElseIf mega < 1 then strResult = Round(kilo) & " KB" ElseIf giga < 1 Then strResult = Round(mega) & " MB" Else strResult = Round(giga) & " GB" End If WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Space Used on Destination.xml b/CrashPlan - Space Used on Destination.xml deleted file mode 100644 index 783c657..0000000 --- a/CrashPlan - Space Used on Destination.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Space Used on Destination Backup This attribute displays the size of the CrashPlan archive, as it appears on the current backup destination. This attribute applies to both Mac and Windows. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computerUsage?sourceGuid="$GUID" | grep -w archiveBytes | awk '{print $2}' | sed s/,//g` kilo=$( echo "scale=2; $value / 1024" | bc ) kiloint=$( echo "$value / 1024" | bc ) mega=$( echo "scale=2; $kilo / 1024" | bc ) megaint=$( echo "$kilo / 1024" | bc ) giga=$( echo "scale=2; $mega / 1024" | bc ) gigaint=$( echo "$mega / 1024" | bc ) if [ $kiloint -lt 1 ] ; then result="$value bytes" elif [ $megaint -lt 1 ] ; then result="${kilo} KB" elif [ $gigaint -lt 1 ] ; then result="${mega} MB" else result="${giga} GB" fi echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim inttoDo Dim intTotalSize Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computerUsage?sourceGuid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "archiveBytes") > 0 Then intTotalSize = Replace (arrResults(i), chr(34) & "archiveBytes" & chr(34) & ": ", "") intTotalSize = CInt(Trim(intTotalSize)) Exit for End if Next kilo = intTotalSize / 1024 mega = kilo / 1024 giga = mega / 1024 If kilo < 1 then strResult = Round(intTotalSize) & " bytes" ElseIf mega < 1 then strResult = Round(kilo) & " KB" ElseIf giga < 1 Then strResult = Round(mega) & " MB" Else strResult = Round(giga) & " GB" End If WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan - Status.xml b/CrashPlan - Status.xml deleted file mode 100644 index 1a631a1..0000000 --- a/CrashPlan - Status.xml +++ /dev/null @@ -1 +0,0 @@ - CrashPlan - Status Backup This attribute displays the status of the computer. Values that are returned are either "Active" or "Deactivated". This attribute applies to both Mac and Windows. string #!/bin/sh CP_ServerAddress="EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort="4285" CP_AdminUsername="EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword="EditFromTemplate_CrashPlan_Service_Account_Password" if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/CrashPlan/.identity ];then GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` echo "<result>`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/rest/computers?guid="$GUID" | grep -w status | awk '{print $2}' | sed s/,//g | sed 's/.\(.*\)/\1/' | sed 's/\(.*\)./\1/'`</result>" else echo "<result>Not installed</result>" fi fi VBScript On Error Resume Next 'Declaration of Objects, Constants, Variables Dim objFSO Dim objTextFile Dim strTextFile Dim objHTTP Dim arrResults Dim strResult Dim GUID Dim CP_ServerAddress Dim CP_ServerPort Dim CP_AdminUsername Dim CP_AdminPassword 'Set Variables CP_ServerAddress = "EditFromTemplate_CrashPlan_Server_Name" CP_ServerPort = "4285" CP_AdminUsername = "EditFromTemplate_CrashPlan_Service_Account_Username" CP_AdminPassword = "EditFromTemplate_CrashPlan_Service_Account_Password" 'Validate Variables Have Been Set If CP_ServerAddress = "" Or CP_ServerPort = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" Else 'Set Objects Set objFSO = CreateObject("Scripting.FileSystemObject") Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") 'Set Constants Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 'Read in CrashPlan GUID Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") strTextFile = objTextFile.ReadAll objTextFile.Close arrResults=Split(strTextFile, Chr(13)) For i = 0 to ubound(arrResults) If inStr(arrResults(i), "guid") > 0 Then strResult = Replace(arrResults(i), "guid=", "") GUID = strResult strResult = "" Exit for End if Next If GUID = "" Then WScript.Echo "<result>Not installed</result>" Else 'Connect to the CrashPlan Pro Server Rest API objHTTP.open "GET", "https://" & CP_ServerAddress & ":" & CP_ServerPort & "/rest/computers?guid=" & GUID & "", False objHTTP.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &H3300 objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 objHTTP.send 'Parse the JSON Output arrResults=Split(objHTTP.ResponseText, ",") For i = 0 to ubound(arrResults) If inStr(arrResults(i), "status") > 0 Then strResult = arrResults(i) strResult = Replace (strResult, chr(10), "") strResult = Replace (strResult, chr(32), "") strResult = Replace (strResult, chr(34), "") strResult = Replace (strResult, "status:", "") Exit for End if Next WScript.Echo "<result>" & strResult & "</result>" End If End If \ No newline at end of file diff --git a/CrashPlan PROe - Alert States.xml b/CrashPlan PROe - Alert States.xml deleted file mode 100644 index 864ba8e..0000000 --- a/CrashPlan PROe - Alert States.xml +++ /dev/null @@ -1,118 +0,0 @@ - - - CrashPlan PROe - Alert States - Backup - This attribute displays the CrashPlan PROe alert states of the computer. "OK" if the computer has backed up within defined days, "WARN" if computer has exceeded "warning" threshold, "ALERT" if computer has exceeded "alert" threshold. This attribute applies to both Mac and Windows. - string - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID" | sed -n 's/.*alertStates": \["\([^"]*\).*/\1/p'` - echo "<result>$DATA</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID, False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "alertStates") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "alertStates:", "") - strResult = Replace(strResult, "[", "", 1, -1) - strResult = Replace(strResult, "]", "", 1, -1) - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - Exit for - End if - Next - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Backup Percent Complete.xml b/CrashPlan PROe - Backup Percent Complete.xml deleted file mode 100644 index 9ffa64a..0000000 --- a/CrashPlan PROe - Backup Percent Complete.xml +++ /dev/null @@ -1,118 +0,0 @@ - - - CrashPlan PROe - Backup Perecnt Complete - Backup - This displays the backup percent complete based on the size of selected files and the size of files that CrashPlan PROe has yet to back up. This attribute applies to both Mac and Windows. - integer - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*percentComplete": \([^,]*\).*/\1/p'` - - echo "<result>$DATA</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - 'WScript.Echo objHTTP.ResponseText - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "percentComplete") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "percentComplete:", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - Exit for - End if - Next - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Computer GUID.xml b/CrashPlan PROe - Computer GUID.xml deleted file mode 100644 index 071fd0a..0000000 --- a/CrashPlan PROe - Computer GUID.xml +++ /dev/null @@ -1,53 +0,0 @@ - - - CrashPlan PROe - Computer GUID - Backup - This attribute displays the computer GUID assigned to the machine by CrashPlan PROe. This attribute applies to both Mac and Windows. - integer - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -if [ -f /Library/Application\ Support/CrashPlan/.identity ];then - echo "<result>`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'`</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim arrResults -Dim strResult -Dim GUID - -'Set Objects -Set objFSO = CreateObject("Scripting.FileSystemObject") - -'Read in CrashPlan GUID -Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") -strTextFile = objTextFile.ReadAll -objTextFile.Close -arrResults=Split(strTextFile, Chr(13)) - -For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - GUID = Trim(strResult) - Exit for - End if -Next - -If GUID = "" Then - WScript.Echo "<result>Not installed</result>" -Else - WScript.Echo "<result>" & GUID & "</result>" -End If - - diff --git a/CrashPlan PROe - Last Connected.xml b/CrashPlan PROe - Last Connected.xml deleted file mode 100644 index 9aa0d9a..0000000 --- a/CrashPlan PROe - Last Connected.xml +++ /dev/null @@ -1,124 +0,0 @@ - - - CrashPlan PROe - Last Connected - Backup - This attribute displays the last time CrashPlan PROe established a connection with the server. This attribute applies to both Mac and Windows. - date - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*lastConnected": "\([^"]*\).*/\1/p'` - - FORMATTED=`date -j -f "%Y-%m-%dT%H:%M:%S" "$DATA" "+%Y-%m-%d %H:%M:%S"` - echo "<result>$FORMATTED</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_RevertImpersonationOverSsl = 11 - Const WinHttpRequestOption_EnableRedirects = 6 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - 'objHTTP.Option(WinHttpRequestOption_EnableRedirects) = False - 'objHTTP.Option(WinHttpRequestOption_RevertImpersonationOverSsl) = False - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "lastConnected") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "lastConnected:", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - strResult = Replace(strResult, "T", " ") - strResult = Split(strResult, ".") - Exit for - End if - Next - - WScript.Echo "<result>" & strResult(0) & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Number of Files to Backup.xml b/CrashPlan PROe - Number of Files to Backup.xml deleted file mode 100644 index 5ad8b58..0000000 --- a/CrashPlan PROe - Number of Files to Backup.xml +++ /dev/null @@ -1,117 +0,0 @@ - - - CrashPlan PROe - Number of Files to Backup - Backup - This attribute displays the number of files CrashPlan PROe is waiting to back up. This attribute applies to both Mac and Windows. - integer - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*todoFiles": \([^,]*\).*/\1/p'` - - echo "<result>$DATA</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "todoFiles") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "todoFiles:", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - Exit for - End if - Next - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Number of Selected Files.xml b/CrashPlan PROe - Number of Selected Files.xml deleted file mode 100644 index ace371d..0000000 --- a/CrashPlan PROe - Number of Selected Files.xml +++ /dev/null @@ -1,117 +0,0 @@ - - - CrashPlan PROe - Number of Selected Files - Backup - This attribute displays the number of files CrashPlan PROe is actively backing up. This attribute applies to both Mac and Windows. - integer - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*selectedFiles": \([^,]*\).*/\1/p'` - - echo "<result>$DATA</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "selectedFiles") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "selectedFiles:", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - Exit for - End if - Next - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Selected Files Size.xml b/CrashPlan PROe - Selected Files Size.xml deleted file mode 100644 index d831c90..0000000 --- a/CrashPlan PROe - Selected Files Size.xml +++ /dev/null @@ -1,149 +0,0 @@ - - - CrashPlan PROe - Selected Files Size - Backup - This attribute displays the size of the files that CrashPlan PROe has selected to actively back up. This attribute applies to both Mac and Windows. - string - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - value=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*selectedBytes": \([^,]*\).*/\1/p'` - - kilo=$(echo "scale=2; $value / 1024" | bc ) - kiloint=$( echo "$value / 1024" | bc ) - - mega=$( echo "scale=2; $kilo / 1024" | bc ) - megaint=$( echo "$kilo / 1024" | bc ) - - giga=$( echo "scale=2; $mega / 1024" | bc ) - gigaint=$( echo "$mega / 1024" | bc ) - - if [ $kiloint -lt 1 ] ; then - result="$value bytes" - elif [ $megaint -lt 1 ] ; then - result="${kilo} KB" - elif [ $gigaint -lt 1 ] ; then - result="${mega} MB" - else - result="${giga} GB" - fi - - echo "<result>$result</result>" -else - echo "<result>Not installed</result>" -fi - - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "selectedBytes") > 0 Then - intTotalSize = Replace (arrResults(i), chr(34) & "selectedBytes" & chr(34) & ": ", "") - intTotalSize = CInt(Trim(intTotalSize)) - Exit for - End if - Next - - kilo = intTotalSize / 1024 - mega = kilo / 1024 - giga = mega / 1024 - - If kilo < 1 then - strResult = Round(intTotalSize, 2) & " bytes" - ElseIf mega < 1 then - strResult = Round(kilo, 2) & " KB" - ElseIf giga < 1 Then - strResult = Round(mega, 2) & " MB" - Else - strResult = Round(giga, 2) & " GB" - End If - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Size of Files Waiting to Backup.xml b/CrashPlan PROe - Size of Files Waiting to Backup.xml deleted file mode 100644 index 0860c55..0000000 --- a/CrashPlan PROe - Size of Files Waiting to Backup.xml +++ /dev/null @@ -1,148 +0,0 @@ - - - CrashPlan PROe - Size of Files Waiting to Backup - Backup - This attribute displays the total size of the files CrashPlan PROe is waiting to back up. This attribute applies to both Mac and Windows. - string - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 - -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - value=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*todoBytes": \([^,]*\).*/\1/p'` - - kilo=$(echo "scale=2; $value / 1024" | bc ) - kiloint=$( echo "$value / 1024" | bc ) - - mega=$( echo "scale=2; $kilo / 1024" | bc ) - megaint=$( echo "$kilo / 1024" | bc ) - - giga=$( echo "scale=2; $mega / 1024" | bc ) - gigaint=$( echo "$mega / 1024" | bc ) - - if [ $kiloint -lt 1 ] ; then - result="$value bytes" - elif [ $megaint -lt 1 ] ; then - result="${kilo} KB" - elif [ $gigaint -lt 1 ] ; then - result="${mega} MB" - else - result="${giga} GB" - fi - - echo "<result>$result</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "todoBytes") > 0 Then - intTotalSize = Replace (arrResults(i), chr(34) & "todoBytes" & chr(34) & ": ", "") - intTotalSize = CInt(Trim(intTotalSize)) - Exit for - End if - Next - - kilo = intTotalSize / 1024 - mega = kilo / 1024 - giga = mega / 1024 - - If kilo < 1 then - strResult = Round(intTotalSize, 2) & " bytes" - ElseIf mega < 1 then - strResult = Round(kilo, 2) & " KB" - ElseIf giga < 1 Then - strResult = Round(mega, 2) & " MB" - Else - strResult = Round(giga, 2) & " GB" - End If - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Space Used On Destination.xml b/CrashPlan PROe - Space Used On Destination.xml deleted file mode 100644 index e7b7a86..0000000 --- a/CrashPlan PROe - Space Used On Destination.xml +++ /dev/null @@ -1,147 +0,0 @@ - - - CrashPlan PROe - Space Used on Destination - Backup - This attribute displays the size of the CrashPlan PROe archive, as it appears on the current backup destination. This attribute applies to both Mac and Windows. - string - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - value=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID&incBackupUsage=1" | sed -n 's/.*archiveBytes": \([^,]*\).*/\1/p'` - - kilo=$(echo "scale=2; $value / 1024" | bc ) - kiloint=$( echo "$value / 1024" | bc ) - - mega=$( echo "scale=2; $kilo / 1024" | bc ) - megaint=$( echo "$kilo / 1024" | bc ) - - giga=$( echo "scale=2; $mega / 1024" | bc ) - gigaint=$( echo "$mega / 1024" | bc ) - - if [ $kiloint -lt 1 ] ; then - result="$value bytes" - elif [ $megaint -lt 1 ] ; then - result="${kilo} KB" - elif [ $gigaint -lt 1 ] ; then - result="${mega} MB" - else - result="${giga} GB" - fi - - echo "<result>$result</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID & "&incBackupUsage=1", False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "archiveBytes") > 0 Then - intTotalSize = Replace (arrResults(i), chr(34) & "archiveBytes" & chr(34) & ": ", "") - intTotalSize = CInt(Trim(intTotalSize)) - Exit for - End if - Next - - kilo = intTotalSize / 1024 - mega = kilo / 1024 - giga = mega / 1024 - - If kilo < 1 then - strResult = Round(intTotalSize, 2) & " bytes" - ElseIf mega < 1 then - strResult = Round(kilo, 2) & " KB" - ElseIf giga < 1 Then - strResult = Round(mega, 2) & " MB" - Else - strResult = Round(giga, 2) & " GB" - End If - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan PROe - Status.xml b/CrashPlan PROe - Status.xml deleted file mode 100644 index 6220b6d..0000000 --- a/CrashPlan PROe - Status.xml +++ /dev/null @@ -1,116 +0,0 @@ - - - CrashPlan PROe - Status - Backup - This attribute displays the status of the computer. Values that are returned are either "Active" or "Deactivated". This attribute applies to both Mac and Windows. - string - -#!/bin/sh -# Modified 1/24/13 -# Third-Part Product page for CrashPlan PROe - https://jamfnation.jamfsoftware.com/viewProduct.html?id=217 -CP_ServerAddress="EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername="EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword="EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then - echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -elif [ -f /Library/Application\ Support/CrashPlan/.identity ];then - SERVER=`echo $CP_ServerAddress | sed 's|/$||'` - GUID=`cat /Library/Application\ Support/CrashPlan/.identity | sed -n 's/guid=//p'` - - DATA=`curl -q -u "$CP_AdminUsername:$CP_AdminPassword" -k "$SERVER/api/Computer?guid=$GUID" | sed -n 's/.*status": "\([^"]*\).*/\1/p'` - - echo "<result>$DATA</result>" -else - echo "<result>Not installed</result>" -fi - - VBScript - -On Error Resume Next - -'Declaration of Objects, Constants, Variables -Dim objFSO -Dim objTextFile -Dim strTextFile -Dim objHTTP -Dim arrResults -Dim strResult -Dim GUID -Dim CP_ServerAddress -Dim CP_AdminUsername -Dim CP_AdminPassword -Dim SERVER - -'Set Variables -CP_ServerAddress = "EditFromTemplate_CrashPlan_PROe_Server_Name_-_including_protocol_and_port" -CP_AdminUsername = "EditFromTemplate_CrashPlan_PROe_Service_Account_Username" -CP_AdminPassword = "EditFromTemplate_CrashPlan_PROe_Service_Account_Password" - -'Validate Variables Have Been Set -If CP_ServerAddress = "" Or CP_AdminUsername = "" Or CP_AdminPassword = "" Then - WScript.Echo "<result>Please ensure all variables are set in the extension attribute script.</result>" -Else - 'Set Objects - Set objFSO = CreateObject("Scripting.FileSystemObject") - Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1") - - 'Set Constants - Const WinHttpRequestOption_SslErrorIgnoreFlags = 4 - Const WinHttpRequestOption_EnableHttpsToHttpRedirects = 12 - - 'Read in CrashPlan GUID - Set objTextFile = objFSO.OpenTextFile("C:\ProgramData\CrashPlan\.identity") - strTextFile = objTextFile.ReadAll - objTextFile.Close - arrResults=Split(strTextFile, Chr(13)) - - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "guid") > 0 Then - strResult = Replace(arrResults(i), "guid=", "") - GUID = strResult - strResult="" - Exit for - End if - Next - - If GUID = "" Then - WScript.Echo "<result>Not installed</result>" - Else - If Right(CP_ServerAddress,1) = "/" Then - SERVER = Left(CP_ServerAddress, Len(CP_ServerAddress) -1) - Else - SERVER = CP_ServerAddress - End if - - 'Connect to the CrashPlan ProE Server Rest API - objHTTP.open "GET", SERVER & "/api/computers?guid=" & GUID, False - - objHTTP.Option(WHttpRequestOption_SslErrorIgnoreFlags) = &H3300 - objHTTP.Option(WinHttpRequestOption_EnableHttpsToHttpRedirects) = True - - objHTTP.SetCredentials CP_AdminUsername, CP_AdminPassword, 0 - - objHTTP.send - - 'Parse the JSON Output - If objHTTP.Status = "200" Then - arrResults=Split(objHTTP.ResponseText, ",") - For i = 0 to ubound(arrResults) - If inStr(arrResults(i), "status") > 0 Then - strResult = Replace(arrResults(i), chr(34), "", 1, -1) - strResult = Replace(strResult, "status:", "") - strResult = Replace(strResult, chr(10), "", 1, -1) - strResult = Trim(strResult) - Exit for - End if - Next - - WScript.Echo "<result>" & strResult & "</result>" - Else - WScript.Echo "<result>ERROR RETRIEVING DATA: " & objHTTP.Status & " - " & objHTTP.StatusText & "</result>" - End If - End If -End If - - diff --git a/CrashPlan_-_Last_Backup.xml b/CrashPlan_-_Last_Backup.xml deleted file mode 100644 index 8435c72..0000000 --- a/CrashPlan_-_Last_Backup.xml +++ /dev/null @@ -1,25 +0,0 @@ - -CrashPlan - Last Backup -This attribute displays the last time CrashPlan ran a backup. This attribute applies to both Mac . -date -#!/bin/sh -CP_ServerAddress='Your Code 42 server' -CP_ServerPort="code 42 port number" -CP_AdminUsername="code42 api user" -CP_AdminPassword="code 42 api password " - -if [ "$CP_ServerAddress" == "" ] || [ "$CP_ServerPort" == "" ] || [ "$CP_AdminUsername" == "" ] || [ "$CP_AdminPassword" == "" ];then -echo "Please ensure all variables are set in the extension attribute script." -else -if [ -f /Library/Application\ Support/CrashPlan/.identity ];then - GUID=`/bin/cat /Library/Application\ Support/CrashPlan/.identity | grep guid | sed s/guid\=//g` - value=`/usr/bin/curl -u "$CP_AdminUsername":"$CP_AdminPassword" -k https://"$CP_ServerAddress":"$CP_ServerPort"/api/DeviceBackupReport/?deviceUid="$GUID" | python -m json.tool | grep lastCompletedBackupDate | awk '{print $2}' | sed s/,//g | sed 's/.\(.*\)/\1/'| sed 's/T/ /' | cut -c -19` - result=`/bin/date -j -f "%Y-%m-%dT%H:%M:%S" "$value" "+%Y-%m-%d %H:%M:%S"` - echo "<result>$value</result>" -else - echo "<result>Not installed</result>" -fi -fi - - - diff --git a/CrashPlan_Version.xml b/CrashPlan_Version.xml deleted file mode 100644 index 8d5f06a..0000000 --- a/CrashPlan_Version.xml +++ /dev/null @@ -1,28 +0,0 @@ - - -CrashPlan Version - -string -#!/bin/sh -# -############################################################################ -# -# Extension Attribute checks to display CrashPlan Version with Release number. -# -# Uses CFBundleShortVersionString because this is the "release version number of the bundle" -# Ref: https://developer.apple.com/library/IOS/#documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html -# -# Created By Geoffrey O'Brien - geoffrey-obrien@idexx.com -# last modified: 110515 -# -############################################################################ -# -if [ -d /Applications/CrashPlan.app ] ; then - Edition=$( sudo defaults read /Applications/CrashPlan.app/Contents/Info CFBundleName ) - Version=$( sudo defaults read /Applications/CrashPlan.app/Contents/Info CFBundleShortVersionString ) - echo "<result>$Edition - $Version</result>" -else - echo "<result>Not Installed</result>" -fi - - diff --git a/CrowdStrikeFalcon.xml b/CrowdStrikeFalcon.xml index 5ac0918..8c5ef9f 100644 --- a/CrowdStrikeFalcon.xml +++ b/CrowdStrikeFalcon.xml @@ -1,58 +1,23 @@ -CrowdStrike Falcon Sensor -Operating System -string -Displays version of CrowdStrike Falcon Sensor if installed. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - CS=$(sysctl cs | grep cs.version | awk -F: '{print $2}') + CrowdStrike Falcon Sensor + Operating System + string + Returns the installed CrowdStrike Falcon sensor version, or "Not Installed". + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# CrowdStrike Falcon Sensor Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The Falcon sensor exposes its build via the cs.version sysctl OID on +# every supported macOS version since 10.13. + +ver=$(/usr/sbin/sysctl -n cs.version 2>/dev/null) + +if [[ -n "$ver" ]]; then + echo "<result>Version $ver</result>" else - CS="none" -fi -if [ "$CS" == "none" ]; then - echo "<result>Not Supported in OS $OS</result>" -elif [ "$CS" != "" ]; then - echo "<result>Version $CS</result>" -else - echo "<result>Not Installed or Running</result>" + echo "<result>Not Installed or Running</result>" fi diff --git a/Current AirPort Network.xml b/Current AirPort Network.xml index ade8b50..b512bdf 100644 --- a/Current AirPort Network.xml +++ b/Current AirPort Network.xml @@ -1 +1,44 @@ - Current AirPort Network Networking This attribute displays the network the AirPort is joined to. This attribute applies to Mac only. string #!/bin/sh # Determine the OS version since the networksetup command differs on OS OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then # Ensure that the networksetup link exists on 10.4 and earlier if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then result=`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -getairportnetwork | sed 's/Current AirPort Network: //g'` else result=`The networksetup binary is not present on this machine.` fi elif [ "$OS" == "10.5" ]; then result=`/usr/sbin/networksetup -getairportnetwork | sed 's/Current AirPort Network: //g'` else result=`/usr/sbin/networksetup -getairportnetwork AirPort | sed 's/Current AirPort Network: //g'` fi # Ensure that AirPort was found hasAirPort=`echo "$result" | grep "Error"` # Report the result if [ "$hasAirPort" == "" ]; then echo "<result>$result</result>" else echo "<result>No AirPort Device Found.</result>" fi VBScript \ No newline at end of file + + + Current Wi-Fi Network + Networking + Returns the currently joined Wi-Fi SSID, or a status string ("Wi-Fi Off", "Not Associated", "No Wi-Fi Device Found"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Current Wi-Fi Network Extension Attribute (formerly "AirPort Network") +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Apple deprecated /usr/sbin/airport in macOS 14 and removed reliable SSID +# reporting via "networksetup -getairportnetwork" for non-admins (macOS 14+ +# returns redacted SSIDs unless the calling process has Location Services +# permission). We try networksetup; if that reports a redacted SSID we +# fall back to ipconfig getsummary which still returns the real SSID when +# called as root (which Jamf EAs do). + +device=$(/usr/sbin/networksetup -listallhardwareports 2>/dev/null \ + | /usr/bin/awk '/Hardware Port: Wi-Fi/ { getline; print $2; exit }') + +if [[ -z "$device" ]]; then + echo "<result>No Wi-Fi Device Found</result>" + exit 0 +fi + +raw=$(/usr/sbin/networksetup -getairportnetwork "$device" 2>/dev/null) + +case "$raw" in + *"power is currently off"*) echo "<result>Wi-Fi Off</result>"; exit 0 ;; + "You are not associated"*) echo "<result>Not Associated</result>"; exit 0 ;; +esac + +ssid=${raw#Current Wi-Fi Network: } + +# macOS 14+ may redact SSID. ipconfig getsummary reports the real value. +if [[ "$ssid" == "Unknown" || "$ssid" == "<redacted>" || -z "$ssid" ]]; then + ssid=$(/usr/sbin/ipconfig getsummary "$device" 2>/dev/null \ + | /usr/bin/awk -F': ' '/ SSID_STR/ { print $2; exit }') +fi + +echo "<result>${ssid:-Not Associated}</result>" + + diff --git a/Current User FaceTime ID.xml b/Current User FaceTime ID.xml index 04d4309..2f4000f 100644 --- a/Current User FaceTime ID.xml +++ b/Current User FaceTime ID.xml @@ -1 +1,32 @@ - Current User FaceTime ID User Information This attribute displays the active FaceTime login ID of the current user. This attribute applies only to Mac. string #!/bin/sh loginID=`/usr/libexec/plistbuddy -c Print ~/Library/Preferences/com.apple.imservice.FaceTime.plist | grep "LoginAs" | cut -d: -f2` if [ "loginID" != "" ]; then echo "<result> $loginID </result>" else echo "<result> No FaceTime login information found.</result>" fi \ No newline at end of file + + + Current User FaceTime ID + User Information + Returns the FaceTime LoginAs identifier for the current console user, or empty if not signed in. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# FaceTime Login ID Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original script ran as root and used ~ — which expanded to /var/root. +# We resolve the actual console user's home first, then read their plist. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + echo "<result>No Console User</result>" + exit 0 +fi + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +plist="$home/Library/Preferences/com.apple.imservice.FaceTime.plist" + +if [[ -f "$plist" ]]; then + id=$(/usr/bin/defaults read "$plist" LoginAs 2>/dev/null) +fi + +echo "<result>${id:-No FaceTime login information found.}</result>" + + diff --git a/Current_Wi-Fi_Network_(Yosemite_Compatible).xml b/Current_Wi-Fi_Network_(Yosemite_Compatible).xml index 765ea6c..f36e95b 100644 --- a/Current_Wi-Fi_Network_(Yosemite_Compatible).xml +++ b/Current_Wi-Fi_Network_(Yosemite_Compatible).xml @@ -1,145 +1,39 @@ -Current Wi-Fi Network (Yosemite Compatible) -Reports the currently selected Wifi interface on an OS X computer. -string -#!/bin/sh - -#################################################################################################### -# -# Copyright (c) 2015, JAMF Software, LLC. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the JAMF Software, LLC nor the -# names of its contributors may be used to endorse or promote products -# derived from this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -#################################################################################################### -# -# SUPPORT FOR THIS PROGRAM -# -# This program is distributed "as is" by JAMF Software. -# -#################################################################################################### -# -# ABOUT THIS EXTENSION ATTRIBUTE -# -# NAME -# CurrentWifiNetworkEA.sh -- Reports currently selected Wifi interface -# -# RESULT TYPE -# String -# -# DESCRIPTION -# This extension attribute script was designed to report the currently selected Wifi interface -# on an OS X computer. -# -# NOTES -# While the actual commands to parse and filter out the current Wifi interface from the results -# of using the networksetup command have not changed from the scripts previously posted on JAMF -# Nation, the versionCompare() function has been introduced to future-proof the comparison of OS X -# versions by doing an arithmetic comparison rather than a string comparison. This function should -# be re-usable in any bash scripts where this kind of comparison needs to be made. -# The determination of the Wi-Fi network has been updated to work correctly with OS X 10.7 and -# above (up to 10.10 at the time of writing). -# -#################################################################################################### -# -# HISTORY -# -# Version: 1.0.1 -# -# - Created by Justin Sako on February 11, 2015 -# - Optimization of OS X version comparison by Justin Sako on February 12, 2015 -# -#################################################################################################### -# -# FUNCTIONS -# -#################################################################################################### - - -function parameterMatchesRegexPattern () -{ - local parameter=$1 - local pattern=$2 - - if [[ "$parameter" =~ $pattern ]]; then - return 0 - else - return 1 - fi -} - -function getCurrentWifiNetwork () -{ - local osMinorVersion=`/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2` - - # Use the appropriate path for the networksetup command on the target OS version - - if (( $osMinorVersion < 5 )); then - local networksetupPath="/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup" - else - local networksetupPath="/usr/sbin/networksetup" - fi - - # Determine the current Wifi network - - if [ ! -f $networksetupPath ]; then - local result="The networksetup binary is not present on this machine." - else - if (( $osMinorVersion < 6 )); then - local result=`$networksetupPath -getairportnetwork | sed 's/Current AirPort Network: //g'` - elif (( $osMinorVersion < 7 )); then - local result=`$networksetupPath -getairportnetwork AirPort | sed 's/Current AirPort Network: //g'` - else - local device=`$networksetupPath -listallhardwareports | grep -A 1 Wi-Fi | awk '/Device/{ print $2 }'` - local result=`$networksetupPath -getairportnetwork $device | sed 's/Current Wi-Fi Network: //g'` - fi - fi - - # Modify result to report shorter answers - - if [[ `echo "$result" | grep "Error"` != "" ]]; then - result="No Wi-Fi Device Found" - elif parameterMatchesRegexPattern "$result" "(.*)Wi-Fi[[:space:]]power[[:space:]]is[[:space:]]currently[[:space:]]off(.*)"; then - result="Wi-Fi Off" - elif parameterMatchesRegexPattern "$result" "^You[[:space:]]are[[:space:]]not[[:space:]]associated(.*)"; then - result="Not Associated" - fi - - echo $result -} - - -#################################################################################################### -# MAIN -#################################################################################################### - -activeInterface=$(getCurrentWifiNetwork) - -echo "<result>$activeInterface</result>" - - - - + Current Wi-Fi Network (Yosemite Compatible) + Returns the currently joined Wi-Fi SSID. Retained for compatibility with deployments still depending on this EA name; prefer the "Current Wi-Fi Network" EA going forward. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Current Wi-Fi Network (Yosemite Compatible) Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Identical behaviour to the modern "Current Wi-Fi Network" EA; this +# duplicate is kept because some Jamf smart groups reference this exact +# displayName. Handles macOS 14+ SSID redaction via ipconfig getsummary. + +device=$(/usr/sbin/networksetup -listallhardwareports 2>/dev/null \ + | /usr/bin/awk '/Hardware Port: Wi-Fi/ { getline; print $2; exit }') + +if [[ -z "$device" ]]; then + echo "<result>No Wi-Fi Device Found</result>" + exit 0 +fi + +raw=$(/usr/sbin/networksetup -getairportnetwork "$device" 2>/dev/null) + +case "$raw" in + *"power is currently off"*) echo "<result>Wi-Fi Off</result>"; exit 0 ;; + "You are not associated"*) echo "<result>Not Associated</result>"; exit 0 ;; +esac + +ssid=${raw#Current Wi-Fi Network: } + +if [[ "$ssid" == "Unknown" || "$ssid" == "<redacted>" || -z "$ssid" ]]; then + ssid=$(/usr/sbin/ipconfig getsummary "$device" 2>/dev/null \ + | /usr/bin/awk -F': ' '/ SSID_STR/ { print $2; exit }') +fi + +echo "<result>${ssid:-Not Associated}</result>" - diff --git a/DNS Servers.xml b/DNS Servers.xml index 884a51b..21eba39 100644 --- a/DNS Servers.xml +++ b/DNS Servers.xml @@ -1 +1,41 @@ - DNS Servers Networking This attribute lists all DNS servers set on the active network connection. This attribute applies to both Mac and Windows. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then NetworkInterface=`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"` echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -getdnsservers "$NetworkInterface" 2>&1`</result>" else echo "<result>The networksetup binary is not present on this machine.</result>" fi else NetworkInterface=`/usr/sbin/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"` echo "<result>`/usr/sbin/networksetup -getdnsservers "$NetworkInterface" 2>&1`</result>" fi VBScript On Error Resume Next strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48) For Each objItem in colItems If objitem.ipenabled = True then If isNull(objItem.DNSServerSearchOrder) Then Else strDNS = Join(objItem.DNSServerSearchOrder, "<br>") End If End If Next WScript.Echo "<result>" & strDNS & "</result>" \ No newline at end of file + + + DNS Servers + Networking + This attribute lists all DNS servers set on the active network connection on macOS + string + #!/bin/zsh + +# written by SecurityShrimp 2026 +# DNS Servers Extension Attribute +# Tested on macOS 12 (Monterey) through 26 (Tahoe) +# Returns the active DNS resolvers as a comma-separated list + +# Pull all unique nameservers from the active scoped resolvers. +# scutil --dns lists multiple resolvers; we filter to scoped ones +# (those bound to the active interface) and dedupe. +dnsServers=$(/usr/sbin/scutil --dns 2>/dev/null \ + | /usr/bin/awk ' + /^resolver #[0-9]+$/ { scoped=0 } + /if_index/ { scoped=1 } + scoped && /nameserver\[[0-9]+\]/ { print $3 } + ' \ + | /usr/bin/sort -u \ + | /usr/bin/paste -sd ',' -) + +if [[ -z "$dnsServers" ]]; then + # Fall back to any resolver if no scoped ones are found + # (uncommon, but possible on Macs with unusual network configs) + dnsServers=$(/usr/sbin/scutil --dns 2>/dev/null \ + | /usr/bin/awk '/nameserver\[[0-9]+\]/ {print $3}' \ + | /usr/bin/sort -u \ + | /usr/bin/paste -sd ',' -) +fi + +if [[ -z "$dnsServers" ]]; then + echo "<result>None</result>" +else + echo "<result>$dnsServers</result>" +fi + + diff --git a/Deep Freeze - Badge Status.xml b/Deep Freeze - Badge Status.xml index e555be1..a21c785 100644 --- a/Deep Freeze - Badge Status.xml +++ b/Deep Freeze - Badge Status.xml @@ -1 +1,34 @@ - Deep Freeze - Badge Status System State Management This attribute returns the Deep Freeze badge setting status of a drive. "Enabled" means that the Deep Freeze badge will be displayed on Frozen Drives. string #!/bin/sh dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/Deep Freeze/CLI" ]; then result=`/Library/Application\ Support/Faronics/Deep\ Freeze/CLI "$dfUsername" "$dfPassword" status | grep "DON'T BADGE FROZEN DRIVES" | grep "FALSE"` if [ "$result" == "" ]; then result="Disabled" else result="Enabled" fi fi echo "<result>$result</result>" \ No newline at end of file + + + Deep Freeze - Badge Status + System State Management + Whether the Deep Freeze badge appears on Frozen drives. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Deep Freeze - Badge Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Requires a Deep Freeze service account; populate the placeholders before +# deployment. Embedding credentials in EAs is not best practice — prefer +# a Jamf script parameter or a credentials-on-disk lookup if available. + +dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" +dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" +cli="/Library/Application Support/Faronics/Deep Freeze/CLI" + +if [[ ! -x "$cli" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +match=$("$cli" "$dfUsername" "$dfPassword" status 2>/dev/null \ + | /usr/bin/grep "DON'T BADGE FROZEN DRIVES" | /usr/bin/grep "FALSE") + +if [[ -z "$match" ]]; then + echo "<result>Disabled</result>" +else + echo "<result>Enabled</result>" +fi + + diff --git a/Deep Freeze - Frozen Menu Bar Icon Status.xml b/Deep Freeze - Frozen Menu Bar Icon Status.xml index 3fd02be..7981174 100644 --- a/Deep Freeze - Frozen Menu Bar Icon Status.xml +++ b/Deep Freeze - Frozen Menu Bar Icon Status.xml @@ -1 +1,34 @@ - Deep Freeze - Frozen Menu Bar Icon Status System State Management This attribute returns the Deep Freeze setting for displaying an icon in the menu bar when frozen. "Enabled" means that the Deep Freeze menu bar item will be displayed on a machine with a frozen drive. string #!/bin/sh dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/Deep Freeze/CLI" ]; then result=`/Library/Application\ Support/Faronics/Deep\ Freeze/CLI "$dfUsername" "$dfPassword" status | grep "HIDE FROZEN ICON IN MENU BAR" | grep "FALSE"` if [ "$result" == "" ]; then result="Disabled" else result="Enabled" fi fi echo "<result>$result</result>" \ No newline at end of file + + + Deep Freeze - Frozen Menu Bar Icon Status + System State Management + Whether the Deep Freeze menu bar icon is shown when a drive is Frozen. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Deep Freeze - Frozen Menu Bar Icon Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Requires a Deep Freeze service account; populate the placeholders before +# deployment. Embedding credentials in EAs is not best practice — prefer +# a Jamf script parameter or a credentials-on-disk lookup if available. + +dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" +dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" +cli="/Library/Application Support/Faronics/Deep Freeze/CLI" + +if [[ ! -x "$cli" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +match=$("$cli" "$dfUsername" "$dfPassword" status 2>/dev/null \ + | /usr/bin/grep "HIDE FROZEN ICON IN MENU BAR" | /usr/bin/grep "FALSE") + +if [[ -z "$match" ]]; then + echo "<result>Disabled</result>" +else + echo "<result>Enabled</result>" +fi + + diff --git a/Deep Freeze - Frozen Status.xml b/Deep Freeze - Frozen Status.xml index ed21a7f..c3f0a71 100644 --- a/Deep Freeze - Frozen Status.xml +++ b/Deep Freeze - Frozen Status.xml @@ -1 +1,42 @@ - Deep Freeze - Frozen Status System State Management This attribute returns the Deep Freeze frozen status of a drive. string #!/bin/sh targetDrive="/" #Use "/" for the root device dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/Deep Freeze/CLI" ]; then diskIdentifier=`df | grep "^$targetDrive" | grep "$targetDrive$" | awk '{print $1}' | sed s:/dev/::g` targetPartition=`diskutil info -plist $diskIdentifier | grep -A 1 VolumeName | grep string | sed s:""::g | sed s:""::g | awk '{sub(/^[ \t]+/, ""); print}'` result=`/Library/Application\ Support/Faronics/Deep\ Freeze/CLI "$dfUsername" "$dfPassword" status | grep "$targetPartition" | grep "TRUE"` if [ "$result" == "" ]; then result="False" else result="True" fi fi echo "<result>$result</result>" \ No newline at end of file + + + Deep Freeze - Frozen Status + System State Management + Returns whether the boot volume is currently Frozen under Deep Freeze. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Deep Freeze Frozen Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Looks up the boot volume name via diskutil and asks the Deep Freeze CLI +# whether that partition is Frozen. Populate the service account creds. + +targetDrive="/" +dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" +dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" +cli="/Library/Application Support/Faronics/Deep Freeze/CLI" + +if [[ ! -x "$cli" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +volName=$(/usr/sbin/diskutil info -plist "$targetDrive" 2>/dev/null \ + | /usr/bin/plutil -extract VolumeName raw - 2>/dev/null) + +if [[ -z "$volName" ]]; then + echo "<result>Unknown</result>" + exit 0 +fi + +match=$("$cli" "$dfUsername" "$dfPassword" status 2>/dev/null \ + | /usr/bin/grep "$volName" | /usr/bin/grep "TRUE") + +if [[ -z "$match" ]]; then + echo "<result>False</result>" +else + echo "<result>True</result>" +fi + + diff --git a/Deep Freeze - Thawed Menu Bar Icon Status.xml b/Deep Freeze - Thawed Menu Bar Icon Status.xml index ecd5fa0..30e1ba2 100644 --- a/Deep Freeze - Thawed Menu Bar Icon Status.xml +++ b/Deep Freeze - Thawed Menu Bar Icon Status.xml @@ -1 +1,34 @@ - Deep Freeze - Thawed Menu Bar Icon Status System State Management This attribute returns the Deep Freeze setting for displaying an icon in the menu bar when thawed. "Enabled" means that the Deep Freeze menu bar item will be displayed on a machine with a thawed drive. string #!/bin/sh dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/Deep Freeze/CLI" ]; then result=`/Library/Application\ Support/Faronics/Deep\ Freeze/CLI "$dfUsername" "$dfPassword" status | grep "HIDE THAWED ICON IN MENU BAR" | grep "FALSE"` if [ "$result" == "" ]; then result="Disabled" else result="Enabled" fi fi echo "<result>$result</result>" \ No newline at end of file + + + Deep Freeze - Thawed Menu Bar Icon Status + System State Management + Whether the Deep Freeze menu bar icon is shown when a drive is Thawed. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Deep Freeze - Thawed Menu Bar Icon Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Requires a Deep Freeze service account; populate the placeholders before +# deployment. Embedding credentials in EAs is not best practice — prefer +# a Jamf script parameter or a credentials-on-disk lookup if available. + +dfUsername="EditFromTemplate_DeepFreeze_Service_Account_Username" +dfPassword="EditFromTemplate_DeepFreeze_Service_Account_Password" +cli="/Library/Application Support/Faronics/Deep Freeze/CLI" + +if [[ ! -x "$cli" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +match=$("$cli" "$dfUsername" "$dfPassword" status 2>/dev/null \ + | /usr/bin/grep "HIDE THAWED ICON IN MENU BAR" | /usr/bin/grep "FALSE") + +if [[ -z "$match" ]]; then + echo "<result>Disabled</result>" +else + echo "<result>Enabled</result>" +fi + + diff --git a/Display Sleep.xml b/Display Sleep.xml index 523f792..562d6cc 100644 --- a/Display Sleep.xml +++ b/Display Sleep.xml @@ -1 +1,18 @@ - Display Sleep Power Management This attribute displays the number of minutes before the display sleeps on the active power management profile. integer #!/bin/sh echo "<result>`/usr/bin/pmset -g 2>&1 | grep displaysleep | awk '{print $2}'`</result>" \ No newline at end of file + + + Display Sleep + Power Management + Minutes of idle time before the display enters sleep on the active power profile. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Display Sleep Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +value=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk '/^[[:space:]]*displaysleep[[:space:]]/ { print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/EFI Password Mode.xml b/EFI Password Mode.xml index 9974533..963cb59 100644 --- a/EFI Password Mode.xml +++ b/EFI Password Mode.xml @@ -1,11 +1,26 @@ -EFI Password ModeSecurity ReportingstringDisplays "none" if no firmware password is set; displays "command" or "full" if a firmware password is set. -#!/bin/sh -result=`nvram -p | grep security-mode | awk '{print $2}'` - -if [ "$result" != "" ]; then - echo "<result>$result</result>" -else - echo "<result>none</result>" + + + EFI Password Mode + Security Reporting + string + Firmware password mode: "none", "command", or "full". Returns "N/A" on Apple Silicon (no firmware password concept). + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# EFI Password Mode Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only +# Apple Silicon doesn't expose a firmware-password mode in the same sense +# (boot security is governed by the Startup Security Utility / 1TR), so we +# return N/A on arm64. On Intel + T2, firmwarepasswd reported the mode +# until macOS 14 removed it; we read nvram directly as the canonical source. + +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 fi - - \ No newline at end of file + +mode=$(/usr/sbin/nvram -p 2>/dev/null | /usr/bin/awk '/security-mode/ { print $2; exit }') + +echo "<result>${mode:-none}</result>" + + diff --git a/EnCase - eDiscovery Process.xml b/EnCase - eDiscovery Process.xml deleted file mode 100644 index fa6859a..0000000 --- a/EnCase - eDiscovery Process.xml +++ /dev/null @@ -1,13 +0,0 @@ - EnCase - eDiscovery Process Security string This attribute will show if the EnCase eDiscovery process is running or not. It works for both the intel, and PPC versions. #!/bin/sh -#This has been tested on 10.5.x, 10.6.x, 10.7.2 OS versions. -#Sean Gallagher - seanjsgallagher@me.com - -#Check to see if eDiscovery process is running -PROCESS=enosx -number=$(/bin/ps aux | /usr/bin/grep $PROCESS | /usr/bin/grep -v grep | /usr/bin/wc -l | /usr/bin/awk '{print $1}') - -if [ $number -gt 0 ]; then - /bin/echo "<result>Running</result>" -else - /bin/echo "<result>Not Running</result>" -fi \ No newline at end of file diff --git a/Encase_Version.xml b/Encase_Version.xml deleted file mode 100644 index 914455b..0000000 --- a/Encase_Version.xml +++ /dev/null @@ -1,15 +0,0 @@ - - -Encase Version -Displays version of enosxintel binary -string -#!/bin/bash - -if [ -e /usr/sbin/enosxintel ] - then encaseVersion=$(/usr/sbin/enosxintel -help 2> /dev/null | grep enosxintel | head -1 | awk '{print $2}') - else encaseVersion=NA -fi - -echo "<result>$encaseVersion</result>" - - diff --git a/Energy Saver - Automatic Restart on Power Failure.xml b/Energy Saver - Automatic Restart on Power Failure.xml index c45fa63..b82eade 100644 --- a/Energy Saver - Automatic Restart on Power Failure.xml +++ b/Energy Saver - Automatic Restart on Power Failure.xml @@ -1 +1,35 @@ - Energy Saver - Automatic Restart on Power Failure Security Reporting string This attribute verifies whether or not the "Automatic Restart" energy saver option is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the "Automatic Restart" option is not enabled. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" result="" tmpResult="`/usr/bin/pmset -g | grep -w autorestart | awk '{print $2}'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Energy Saver - Automatic Restart on Power Failure + Security Reporting + string + Compares the active pmset autorestart setting to a desired value. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Energy Saver - Automatic Restart on Power Failure Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Compares the active pmset value to a desiredValue and reports Pass/Fail. +# Edit desiredValue before deploying (use a numeric minutes value, "0"/"1" +# for boolean settings, or "true"/"false" — booleans are normalized below). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk -v k="autorestart" '$1 == k { print $2; exit }') + +# Normalize 0/1 to false/true so boolean desiredValues compare cleanly +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Energy Saver - Display Sleep Timer.xml b/Energy Saver - Display Sleep Timer.xml index d8f734b..cbdc585 100644 --- a/Energy Saver - Display Sleep Timer.xml +++ b/Energy Saver - Display Sleep Timer.xml @@ -1 +1,35 @@ - Energy Saver - Display Sleep Timer Security Reporting string This attribute verifies the "Display Sleep" timer energy saver setting. The value to be verified will need to be specified when creating this extension attribute. Example: "30" verifies that the "Display Sleep" timer is set to put the display to sleep after 30 minutes. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_30" result="" tmpResult="`/usr/bin/pmset -g | grep -w displaysleep | awk '{print $2}'`" if [ "$tmpResult" == "$desiredValue" ]; then result="true" elif [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi if [ "$result" == "true" ]; then echo "<result>Pass ($tmpResult)</result>" else echo "<result>Fail ($tmpResult)</result>" fi \ No newline at end of file + + + Energy Saver - Display Sleep Timer + Security Reporting + string + Compares the active pmset displaysleep value (minutes) to a desired value. Edit desiredValue before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Energy Saver - Display Sleep Timer Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Compares the active pmset value to a desiredValue and reports Pass/Fail. +# Edit desiredValue before deploying (use a numeric minutes value, "0"/"1" +# for boolean settings, or "true"/"false" — booleans are normalized below). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk -v k="displaysleep" '$1 == k { print $2; exit }') + +# Normalize 0/1 to false/true so boolean desiredValues compare cleanly +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Energy Saver - Hard Disk Sleep.xml b/Energy Saver - Hard Disk Sleep.xml index fe7e6f1..8aa44e1 100644 --- a/Energy Saver - Hard Disk Sleep.xml +++ b/Energy Saver - Hard Disk Sleep.xml @@ -1 +1,35 @@ - Energy Saver - Hard Disk Sleep Security Reporting string This attribute verifies the "Hard Disk Sleep" energy saver setting. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the "Hard Disk Sleep" setting is set to not put the hard disk to sleep. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" result="" tmpResult="`/usr/bin/pmset -g | grep -w disksleep | awk '{print $2}'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Energy Saver - Hard Disk Sleep + Security Reporting + string + Compares the active pmset disksleep value (minutes; 0 disables) to a desired value. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Energy Saver - Hard Disk Sleep Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Compares the active pmset value to a desiredValue and reports Pass/Fail. +# Edit desiredValue before deploying (use a numeric minutes value, "0"/"1" +# for boolean settings, or "true"/"false" — booleans are normalized below). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk -v k="disksleep" '$1 == k { print $2; exit }') + +# Normalize 0/1 to false/true so boolean desiredValues compare cleanly +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Energy Saver - System Sleep Timer.xml b/Energy Saver - System Sleep Timer.xml index a055eff..59be00a 100644 --- a/Energy Saver - System Sleep Timer.xml +++ b/Energy Saver - System Sleep Timer.xml @@ -1 +1,35 @@ - Energy Saver - System Sleep Timer Security Reporting string This attribute verifies the "System Sleep" timer energy saver setting. The value to be verified will need to be specified when creating this extension attribute. Example: "0" verifies that the "System Sleep" timer is set to never put the system to sleep. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_0" result="" tmpResult="`/usr/bin/pmset -g | grep -w sleep | awk '{print $2}'`" if [ "$tmpResult" == "$desiredValue" ]; then result="true" elif [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi if [ "$result" == "true" ]; then echo "<result>Pass ($tmpResult)</result>" else echo "<result>Fail ($tmpResult)</result>" fi \ No newline at end of file + + + Energy Saver - System Sleep Timer + Security Reporting + string + Compares the active pmset sleep value (minutes; 0 disables) to a desired value. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Energy Saver - System Sleep Timer Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Compares the active pmset value to a desiredValue and reports Pass/Fail. +# Edit desiredValue before deploying (use a numeric minutes value, "0"/"1" +# for boolean settings, or "true"/"false" — booleans are normalized below). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk -v k="sleep" '$1 == k { print $2; exit }') + +# Normalize 0/1 to false/true so boolean desiredValues compare cleanly +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Energy Saver - Wake on LAN.xml b/Energy Saver - Wake on LAN.xml index 36814e7..524e6dd 100644 --- a/Energy Saver - Wake on LAN.xml +++ b/Energy Saver - Wake on LAN.xml @@ -1 +1,35 @@ - Energy Saver - Wake on LAN Security Reporting string This attribute verifies the "Wake on LAN" energy saver setting. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the "Wake on LAN" setting is disabled #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" result="" tmpResult="`/usr/bin/pmset -g | grep -w womp | awk '{print $2}'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Energy Saver - Wake on LAN + Security Reporting + string + Compares the active pmset Wake-on-LAN (womp) setting to a desired value. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Energy Saver - Wake on LAN Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Compares the active pmset value to a desiredValue and reports Pass/Fail. +# Edit desiredValue before deploying (use a numeric minutes value, "0"/"1" +# for boolean settings, or "true"/"false" — booleans are normalized below). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/pmset -g custom 2>/dev/null \ + | /usr/bin/awk -v k="womp" '$1 == k { print $2; exit }') + +# Normalize 0/1 to false/true so boolean desiredValues compare cleanly +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Enforce PKI Certificate Chain of Trust.xml b/Enforce PKI Certificate Chain of Trust.xml index 37e1739..09877e6 100644 --- a/Enforce PKI Certificate Chain of Trust.xml +++ b/Enforce PKI Certificate Chain of Trust.xml @@ -1 +1,33 @@ - Enforce PKI Certificate Chain of Trust Security Reporting string This attribute verifies the "Enforce PKI Certificate Chain of Trust" setting. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the "Enforce PKI Certificate Chain of Trust" setting is disabled #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" result="" tmpResult=`defaults read /Library/Preferences/com.apple.security DisableUserTrustSettings` if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Enforce PKI Certificate Chain of Trust + Security Reporting + string + Reports whether DisableUserTrustSettings is configured (which prevents users from overriding certificate trust). Edit desiredValue before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Enforce PKI Certificate Chain of Trust Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The key still lives at /Library/Preferences/com.apple.security and is +# typically set via Configuration Profile (com.apple.security.smartcard +# or com.apple.security payload). + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.security DisableUserTrustSettings 2>/dev/null) + +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/File Sharing.xml b/File Sharing.xml index 84368fc..e409388 100644 --- a/File Sharing.xml +++ b/File Sharing.xml @@ -1 +1,22 @@ - File Sharing System Information This attribute displays whether or not file sharing is enabled. This attribute applies to both Mac and Windows. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then result=`cat /private/etc/hostconfig | grep AFP | sed 's/AFPSERVER=//g'` if [ "$result" == "-Yes-" ]; then echo "<result>On</result>" elif [ "$result" == "-No-" ]; then echo "<result>Off</result>" fi else result=`/bin/launchctl list | grep "AppleFileServer"` if [ "$result" == "" ]; then echo "<result>Off</result>" else echo "<result>On</result>" fi fi VBScript On Error Resume Next Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colSettings = objWMIService.ExecQuery _ ("SELECT * FROM Win32_Service WHERE DisplayName='Server'") For Each objService in colSettings If objService.State = "Running" Then strstatus = "On" Else strstatus = "Off" End If Next WScript.Echo "<result>" & strstatus & "</result>" \ No newline at end of file + + + File Sharing + System Information + Reports whether macOS File Sharing (SMB) is enabled. AFP service was removed in macOS 11 (Big Sur), so we only check smbd. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# File Sharing Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Modern macOS no longer ships AFP at all (removed in 11), so we only +# probe smbd. launchctl print lists running services; the legacy "list" +# subcommand is still supported but print is preferred. + +if /bin/launchctl list 2>/dev/null | /usr/bin/grep -q "com.apple.smbd"; then + echo "<result>On</result>" +else + echo "<result>Off</result>" +fi + + diff --git a/File_Sharing.xml b/File_Sharing.xml index 7d15f39..e409388 100644 --- a/File_Sharing.xml +++ b/File_Sharing.xml @@ -1,15 +1,22 @@ - -File Sharing -This attribute displays whether or not file sharing is enabled. This attribute only to Mac. -string -#!/bin/bash - -smb=$(launchctl list | grep smbd) -afp=$(launchctl list | grep AppleFileServer) - -if [[ $smb == "" && $afp == "" ]]; then - echo "<result>Off</result>" -else - echo "<result>On</result>" -fi + + + File Sharing + System Information + Reports whether macOS File Sharing (SMB) is enabled. AFP service was removed in macOS 11 (Big Sur), so we only check smbd. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# File Sharing Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Modern macOS no longer ships AFP at all (removed in 11), so we only +# probe smbd. launchctl print lists running services; the legacy "list" +# subcommand is still supported but print is preferred. + +if /bin/launchctl list 2>/dev/null | /usr/bin/grep -q "com.apple.smbd"; then + echo "<result>On</result>" +else + echo "<result>Off</result>" +fi + diff --git a/Firefox version.xml b/Firefox version.xml index 6d46b0c..3682ad7 100644 --- a/Firefox version.xml +++ b/Firefox version.xml @@ -1,12 +1,23 @@ -Firefox version -Report version of firefox -string -#!/bin/bash - -FFV=`/Applications/Firefox.app/Contents/MacOS/firefox --version | awk '{ print $3 '}` - -echo "<result>$FFV</result>" - + Firefox version + Returns the installed Firefox version (CFBundleShortVersionString), or "Not Installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Firefox Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads the plist directly rather than launching firefox --version, which +# is slow and may prompt for accessibility access on first launch. + +plist="/Applications/Firefox.app/Contents/Info.plist" + +if [[ -f "$plist" ]]; then + ver=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${ver:-Unknown}</result>" +else + echo "<result>Not Installed</result>" +fi + diff --git a/Firewall.xml b/Firewall.xml index 194e68f..8a13fef 100644 --- a/Firewall.xml +++ b/Firewall.xml @@ -1 +1,24 @@ - Firewall System Information This attribute displays whether or not the system firewall is enabled. This attribute applies to both Mac and Windows. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then result=`/usr/bin/defaults read /Library/Preferences/com.apple.sharing.firewall state` if [ "$result" == "YES" ]; then echo "<result>On</result>" elif [ "$result" == "NO" ]; then echo "<result>Off</result>" fi else result=`/usr/bin/defaults read /Library/Preferences/com.apple.alf globalstate` if [ "$result" == "0" ]; then echo "<result>Off</result>" else echo "<result>On</result>" fi fi VBScript On Error Resume Next Set objFirewall = CreateObject("HNetCfg.FwMgr") Set objPolicy = objFirewall.LocalPolicy.CurrentProfile If objPolicy.FirewallEnabled = True Then strStatus = "On" Else strStatus = "Off" End If WScript.Echo "<result>" & strStatus & "</result>" \ No newline at end of file + + + Firewall + System Information + Reports whether the application firewall is enabled. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Firewall Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Uses socketfilterfw, which is the supported tool on modern macOS. Reading +# com.apple.alf globalstate via defaults is unreliable under MDM-managed +# firewall profiles, since the value may live in a managed plist. + +state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null) + +case "$state" in + *enabled*) echo "<result>On</result>" ;; + *disabled*) echo "<result>Off</result>" ;; + *) echo "<result>Unknown</result>" ;; +esac + + diff --git a/FlashVersion.xml b/FlashVersion.xml deleted file mode 100644 index bb9a3bb..0000000 --- a/FlashVersion.xml +++ /dev/null @@ -1,21 +0,0 @@ - - -FlashVersion -Detect version of Flash -string -#!/bin/sh - -# -# script by emily k @volusion 2014-06-10 -# to detect version of flash installed on OS X -# - -if [ -f "/Library/Internet Plug-Ins/Flash Player.plugin/Contents/version.plist" ] ; then - VERSION=$( defaults read "/Library/Internet Plug-Ins/Flash Player.plugin/Contents/version.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi - -echo "<result>$VERSION</result>" - - diff --git a/Flip4Mac Version.xml b/Flip4Mac Version.xml deleted file mode 100644 index 638bed0..0000000 --- a/Flip4Mac Version.xml +++ /dev/null @@ -1,27 +0,0 @@ - - -Flip4Mac Version - -string -#!/bin/sh -# -############################################################################ -# -# Extension Attribute checks to display Flip4Mac Version with Release number. -# -# Uses CFBundleShortVersionString because this is the "release version number of the bundle" -# Ref: https://developer.apple.com/library/IOS/#documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html -# -# -############################################################################ -# -if [ -d /Applications/Flip\ Player.app ] ; then - RESULT=$( sudo defaults read /Applications/Flip\ Player.app/Contents/Info CFBundleShortVersionString ) - echo "<result>$RESULT</result>" -else - echo "<result>Not Installed</result>" -fi - - - - diff --git a/Forefront - Spyware Definition Version.xml b/Forefront - Spyware Definition Version.xml deleted file mode 100644 index cb79f51..0000000 --- a/Forefront - Spyware Definition Version.xml +++ /dev/null @@ -1 +0,0 @@ - Forefront - Spyware Definition Version AntiVirus This attribute displays the current spyware definition version. string VBScript On Error Resume Next Const HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") strKeyPath = "SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Signature Updates" strValueName = "ASsignatureVersion" oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue Wscript.Echo "<result>" & strValue & "</result>" \ No newline at end of file diff --git a/Forefront - Virus Definition Version.xml b/Forefront - Virus Definition Version.xml deleted file mode 100644 index 1f30626..0000000 --- a/Forefront - Virus Definition Version.xml +++ /dev/null @@ -1 +0,0 @@ - Forefront - Virus Definition Version AntiVirus This attribute displays the current virus definition version. string VBScript On Error Resume Next Const HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") strKeyPath = "SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Signature Updates" strValueName = "AVsignatureVersion" oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue Wscript.Echo "<result>" & strValue & "</result>" \ No newline at end of file diff --git a/Forefront - Virus Engine Version.xml b/Forefront - Virus Engine Version.xml deleted file mode 100644 index 05be36c..0000000 --- a/Forefront - Virus Engine Version.xml +++ /dev/null @@ -1 +0,0 @@ - Forefront - Virus Engine Version AntiVirus This attribute displays the current engine version running in Forefront. string VBScript On Error Resume Next Const HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") strKeyPath = "SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Signature Updates" strValueName = "EngineVersion" oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue Wscript.Echo "<result>" & strValue & "</result>" \ No newline at end of file diff --git a/FortiClient_version.xml b/FortiClient_version.xml index 03592f2..f6ea4d1 100644 --- a/FortiClient_version.xml +++ b/FortiClient_version.xml @@ -1,14 +1,22 @@ - -FortiClient version -Returns the FortiClient version -number -#!/bin/bash - -if [ -e /Library/Application\ Support/Fortinet/FortiClient/conf/fctinfo ] - then forticlientVersion=$(/bin/cat /Library/Application\ Support/Fortinet/FortiClient/conf/fctinfo | /usr/bin/cut -d"=" -f2) - else forticlientVersion=0 -fi - -echo "<result>$forticlientVersion</result>" - - + + + FortiClient version + Returns the installed FortiClient version from the fctinfo config file, or 0 if absent. + number + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# FortiClient Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +info="/Library/Application Support/Fortinet/FortiClient/conf/fctinfo" + +if [[ -f "$info" ]]; then + version=$(/usr/bin/awk -F'=' '/^version=/ { print $2; exit }' "$info") + [[ -z "$version" ]] && version=$(/usr/bin/cut -d'=' -f2 "$info" | /usr/bin/head -n1) + echo "<result>${version:-0}</result>" +else + echo "<result>0</result>" +fi + + diff --git a/GPU.xml b/GPU.xml index 08c4a9b..0834e1d 100644 --- a/GPU.xml +++ b/GPU.xml @@ -1,13 +1,21 @@ - - -GPU -This attribute displays the GPU of the computer. It's particularly useful, if you want to scope computers with nVidia video cards, so you can make new drivers or CUDA available for your users. -string -#!/bin/sh -# Meza Hsu -# 2016.02.09 -# Find out which GPU the computer has. -VideoCard=$(system_profiler SPDisplaysDataType | grep 'Chipset Model:' | cut -f2- -d':') -echo "<result>$VideoCard</result>" - - + + + GPU + Reports the GPU chipset model(s). Useful for scoping smart groups by graphics hardware. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# GPU Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Joins multiple chipsets with ", " (e.g., Intel + AMD on dual-GPU MacBook +# Pros). On Apple Silicon this returns the SoC's integrated GPU name. + +gpu=$(/usr/sbin/system_profiler SPDisplaysDataType 2>/dev/null \ + | /usr/bin/awk -F': ' '/Chipset Model:/ { sub(/^ +/, "", $2); print $2 }' \ + | /usr/bin/paste -sd ',' - \ + | /usr/bin/sed 's/,/, /g') + +echo "<result>${gpu:-Unknown}</result>" + + diff --git a/GatekeeperStatus.xml b/GatekeeperStatus.xml index 82eccc8..bda5c30 100644 --- a/GatekeeperStatus.xml +++ b/GatekeeperStatus.xml @@ -4,24 +4,22 @@ Gatekeeper Status string - This will display the current status of Gatekeeper (visible under System Preferences > Security & Privacy > General). - #!/bin/sh + Reports whether Gatekeeper assessments are enabled (visible under System Settings > Privacy & Security). + #!/bin/zsh -TESTFILE="/usr/sbin/jamf/" +# Updated by SecurityShrimp 2026 +# Gatekeeper Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Returns "On" or "Off". The legacy "Anywhere" option was removed from the +# GUI in macOS 13, so it is not reported as a separate state. spctl --status +# is the only spctl invocation Apple still supports for this check. -CMD="`spctl -v -a $TESTFILE 2>&1`" +status=$(/usr/sbin/spctl --status 2>/dev/null) -case "$CMD" in - *rejected*) - STATUS="Mac App Store" - ;; - *override=security*) - STATUS="Anywhere" - ;; - *) - STATUS="Mac App Store and identified developers" - ;; +case "$status" in + *"assessments enabled"*) echo "<result>On</result>" ;; + *"assessments disabled"*) echo "<result>Off</result>" ;; + *) echo "<result>Unknown</result>" ;; esac - -echo "<result>$STATUS</result>" + diff --git a/Get Adobe Reader Version.xml b/Get Adobe Reader Version.xml index b955e92..29a2ccd 100644 --- a/Get Adobe Reader Version.xml +++ b/Get Adobe Reader Version.xml @@ -1,21 +1,28 @@ -Get Adobe Reader Version -This EA gets the currently installed version of Adobe Reader if installed. If not installed, it reports "Not installed." -string -#!/bin/sh - -# -# by emily k @ volusion 2014-06-10 -# checks for Adobe Reader version -# - -if [ -f "/Applications/Adobe Reader.app/Contents/Info.plist" ] ; then - VERSION=$( defaults read "/Applications/Adobe Reader.app/Contents/Info.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi - -echo "<result>$VERSION</result>" - + Get Adobe Reader Version + Returns the installed Adobe Acrobat Reader version, or "Not installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Adobe Reader Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Adobe renamed the product from "Adobe Reader" to "Adobe Acrobat Reader" +# (dropped the "DC" suffix in 2023). We probe historical bundle paths. + +for plist in \ + "/Applications/Adobe Acrobat Reader.app/Contents/Info.plist" \ + "/Applications/Adobe Acrobat Reader DC.app/Contents/Info.plist" \ + "/Applications/Adobe Reader.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>Not installed.</result>" + diff --git a/Get SOLO Version.xml b/Get SOLO Version.xml index 57f05b8..8d96f36 100644 --- a/Get SOLO Version.xml +++ b/Get SOLO Version.xml @@ -1,21 +1,25 @@ -Get SOLO Version -This EA gets the currently installed version of the Don Johnston SOLO Suite if installed. If not installed, it reports "Not installed." -string -#!/bin/sh - -# -# by rick c @ aim academy 2014-07-14 -# checks for Don Johnston SOLO.app Version -# - -if [ -f "/Applications/DonJohnston/SOLO/Applications/SOLO.app/Contents/Info.plist" ] ; then - VERSION=$( defaults read "/Applications/DonJohnston/SOLO/Applications/SOLO.app/Contents/Info.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi - -echo "<result>$VERSION</result>" - + Get SOLO Version + Returns the installed Don Johnston SOLO Suite version, or "Not installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Don Johnston SOLO Suite Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +for plist in \ + "/Applications/DonJohnston/SOLO/Applications/SOLO.app/Contents/Info.plist" \ + "/Applications/Don Johnston/SOLO/SOLO.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>Not installed.</result>" + diff --git a/GetOffice2011Version.xml b/GetOffice2011Version.xml deleted file mode 100644 index 1e5d266..0000000 --- a/GetOffice2011Version.xml +++ /dev/null @@ -1,17 +0,0 @@ - - - - Get Office 2011 Version - - string - This EA gets the currently installed version of Microsoft Office 2011 using the MicrosoftComponentPlugin rather than one of the installed applications. The plugin is always guaranteed installed whereas the applications themselves are not. - #!/bin/sh - -if [ -f "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info.plist" ] ; then - VERSION=$( defaults read "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info" CFBundleShortVersionString ) -else - VERSION="Not installed" -fi - -echo "<result>$VERSION</result>" - diff --git a/Get_Acrobat_Pro_Version.xml b/Get_Acrobat_Pro_Version.xml index 9ecae73..2642272 100644 --- a/Get_Acrobat_Pro_Version.xml +++ b/Get_Acrobat_Pro_Version.xml @@ -1,22 +1,26 @@ -Get Acrobat Pro Version -This EA gets the currently installed version of Acrobat XI Pro if installed. If not installed, it reports "Not installed." -string -#!/bin/sh - -# -# by emily k @ volusion 2014-06-10 -# Modified by joe zima @ gatech 2014-11-17 -# checks for Adobe Acrobat XI Pro version -# - -if [ -f "/Applications/Adobe Acrobat XI Pro/Adobe Acrobat Pro.app/Contents/Info.plist" ] ; then - VERSION=$( defaults read "/Applications/Adobe Acrobat XI Pro/Adobe Acrobat Pro.app/Contents/Info.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi - -echo "<result>$VERSION</result>" - + Get Acrobat Pro Version + Returns the installed Adobe Acrobat Pro version, or "Not installed". Probes the current Acrobat DC bundle plus the legacy XI Pro path. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Adobe Acrobat Pro Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) + +for plist in \ + "/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Info.plist" \ + "/Applications/Adobe Acrobat XI Pro/Adobe Acrobat Pro.app/Contents/Info.plist" \ + "/Applications/Adobe Acrobat.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>Not installed.</result>" + diff --git a/Google Chrome Version.xml b/Google Chrome Version.xml index 5d7a285..f9a1644 100644 --- a/Google Chrome Version.xml +++ b/Google Chrome Version.xml @@ -1,27 +1,24 @@ - - -Google Chrome Version - -string -#!/bin/sh -# -############################################################################ -# -# Extension Attribute checks to display Google Chrome's Version with Release number. -# -# Uses CFBundleShortVersionString because this is the "release version number of the bundle" -# Ref: https://developer.apple.com/library/IOS/#documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html -# -# -############################################################################ -# -if [ -d /Applications/Google\ Chrome.app ] ; then - RESULT=$( sudo defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString ) - echo "<result>$RESULT</result>" -else - echo "<result>Not Installed</result>" -fi - - - - + + + Google Chrome Version + Returns the installed Google Chrome version (CFBundleShortVersionString), or "Not Installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Google Chrome Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads CFBundleShortVersionString from Chrome's Info.plist. No sudo needed: +# Info.plist is world-readable. Uses defaults with the full plist path so +# this works even when the bundle is preserved-for-users (per-user installs). + +chromePlist="/Applications/Google Chrome.app/Contents/Info.plist" + +if [[ -f "$chromePlist" ]]; then + version=$(/usr/bin/defaults read "$chromePlist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" +else + echo "<result>Not Installed</result>" +fi + + diff --git a/Google_Drive_Last_Check.xml b/Google_Drive_Last_Check.xml index e180805..5222299 100644 --- a/Google_Drive_Last_Check.xml +++ b/Google_Drive_Last_Check.xml @@ -1,22 +1,38 @@ -Google Drive Last Check -Checks for the last successful check between Google Drive Cloud and Local files. -date -#!/bin/sh - -# Checks for the last successful comparison between Google Drive Cloud and Local files. -# Works by checking the log file for the last mention of "retrieved" which occurs on a successful connection to Google to compare local and remote files. -# This attribute will check against the most recent user to log in via the login window. -# -# -# Created by Ben Courtade on 2/26/15. -# - -lastUser=$(defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName) - -fileCheckSuccessful=$(cat /Users/$lastUser/Library/"Application Support"/Google/Drive/user_default/sync_log.log | grep CloudWatcher | cut -d " " -f1,2 | cut -d "," -f1 | tail -1) - -echo "<result>$fileCheckSuccessful</result>" - + Google Drive Last Check + Returns the timestamp of Google Drive for Desktop's last cloud-vs-local check. + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Google Drive Last Check Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Google retired "Drive File Stream" and "Backup & Sync" in favor of +# "Google Drive for Desktop". The original log file +# (~/Library/Application Support/Google/Drive/user_default/sync_log.log) +# is no longer written. The modern client logs to +# ~/Library/Application Support/Google/DriveFS/Logs/drive_fs.txt. +# We grep for the marker phrase and report the most recent timestamp. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +stamp="" +modernLog="$home/Library/Application Support/Google/DriveFS/Logs/drive_fs.txt" +legacyLog="$home/Library/Application Support/Google/Drive/user_default/sync_log.log" + +if [[ -f "$modernLog" ]]; then + stamp=$(/usr/bin/grep "poll" "$modernLog" 2>/dev/null \ + | /usr/bin/tail -1 | /usr/bin/awk '{print $1, $2}' | /usr/bin/cut -d, -f1) +elif [[ -f "$legacyLog" ]]; then + stamp=$(/usr/bin/grep "CloudWatcher" "$legacyLog" 2>/dev/null \ + | /usr/bin/tail -1 | /usr/bin/awk '{print $1, $2}' | /usr/bin/cut -d, -f1) +fi + +echo "<result>${stamp:-Not Available}</result>" + diff --git a/Google_Drive_Last_Sync.xml b/Google_Drive_Last_Sync.xml index 7e357c8..48558c9 100644 --- a/Google_Drive_Last_Sync.xml +++ b/Google_Drive_Last_Sync.xml @@ -1,21 +1,38 @@ -Google Drive Last Sync -Checks for the last successful sync between Google Drive Cloud and Local files. -date -#!/bin/sh - -# Checks for the last successful sync between Google Drive Cloud and Local files. -# Works by checking the log file for the last successful=True which occurs on a successful connection to Google to sync a file/folder change -# This attribute will check against the most recent user to log in via the login window. -# -# Created by Ben Courtade on 2/26/15. -# - -lastUser=$(defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName) - -fileSync=$(cat /Users/$lastUser/Library/"Application Support"/Google/Drive/user_default/sync_log.log | grep successful=True | cut -d " " -f1,2 | cut -d "," -f1 | tail -1) - -echo "<result>$fileSync</result>" - + Google Drive Last Sync + Returns the timestamp of Google Drive for Desktop's last successful sync. + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Google Drive Last Sync Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Google retired "Drive File Stream" and "Backup & Sync" in favor of +# "Google Drive for Desktop". The original log file +# (~/Library/Application Support/Google/Drive/user_default/sync_log.log) +# is no longer written. The modern client logs to +# ~/Library/Application Support/Google/DriveFS/Logs/drive_fs.txt. +# We grep for the marker phrase and report the most recent timestamp. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +stamp="" +modernLog="$home/Library/Application Support/Google/DriveFS/Logs/drive_fs.txt" +legacyLog="$home/Library/Application Support/Google/Drive/user_default/sync_log.log" + +if [[ -f "$modernLog" ]]; then + stamp=$(/usr/bin/grep "commit" "$modernLog" 2>/dev/null \ + | /usr/bin/tail -1 | /usr/bin/awk '{print $1, $2}' | /usr/bin/cut -d, -f1) +elif [[ -f "$legacyLog" ]]; then + stamp=$(/usr/bin/grep "successful=True" "$legacyLog" 2>/dev/null \ + | /usr/bin/tail -1 | /usr/bin/awk '{print $1, $2}' | /usr/bin/cut -d, -f1) +fi + +echo "<result>${stamp:-Not Available}</result>" + diff --git a/HD_Serial_Number.xml b/HD_Serial_Number.xml index 80a715f..8e3129d 100644 --- a/HD_Serial_Number.xml +++ b/HD_Serial_Number.xml @@ -1,11 +1,20 @@ -HD Serial Number -This attribute returns serial number of the Hard Drive -string -#!/bin/sh - -echo "<result>$(ioreg -rd1 -w0 -c AppleAHCIDiskDriver | grep Serial | sed 's/.*= //' | cut -d '"' -f 2)</result>" + HD Serial Number + Returns the serial number of the boot disk's underlying storage device. Handles SATA (AHCI), NVMe, and the Apple Silicon embedded NAND. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Hard Drive Serial Number Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Older script only queried AppleAHCIDiskDriver (SATA), which misses NVMe +# and the Apple Silicon embedded NAND. system_profiler exposes all storage +# devices uniformly and includes the disk serial. + +serial=$(/usr/sbin/system_profiler SPNVMeDataType SPSerialATADataType 2>/dev/null \ + | /usr/bin/awk -F': ' '/Serial Number:/ { gsub(/^[ \t]+/, "", $2); print $2; exit }') + +echo "<result>${serial:-Unknown}</result>" - diff --git a/Host name.xml b/Host name.xml index 380b502..f0c50bb 100644 --- a/Host name.xml +++ b/Host name.xml @@ -1 +1,20 @@ - Host name Networking This attribute returns the host name of the computer. This attribute applies to both Mac and Windows. string #!/bin/sh echo "<result>`hostname 2>&1`</result>" VBScript On Error Resume Next Dim WshNetwork Set WshNetwork = WScript.CreateObject("WScript.Network") WScript.Echo "<result>" & WshNetwork.ComputerName & "</result>" \ No newline at end of file + + + Host name + Networking + Returns the local host name (the Bonjour/.local name) of the computer. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Host Name Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Prefers scutil LocalHostName (the Bonjour name shown in Sharing settings) +# and falls back to /bin/hostname if that is unset. + +hostName=$(/usr/sbin/scutil --get LocalHostName 2>/dev/null) +[[ -z "$hostName" ]] && hostName=$(/bin/hostname -s 2>/dev/null) + +echo "<result>${hostName:-Unknown}</result>" + + diff --git a/IP Geo-Location.xml b/IP Geo-Location.xml index 66e07a0..30a0e9c 100644 --- a/IP Geo-Location.xml +++ b/IP Geo-Location.xml @@ -1 +1,35 @@ - IP Geo-Location System Information This attribute lists an approximate location of the machine based on it's current external IP address. This attribute applies to both Mac and Windows. string #!/bin/sh myIP=`curl -L -s --max-time 10 http://checkip.dyndns.org | egrep -o -m 1 '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}'` myLocationInfo=`curl -L -s --max-time 10 http://freegeoip.appspot.com/xml/$myIP` myCountryCode=`echo $myLocationInfo|egrep -o '<CountryCode>.*</CountryCode>'| sed -e 's/^.*<CountryCode/<CountryCode/' | cut -f2 -d'>'| cut -f1 -d'<'` myCity=`echo $myLocationInfo|egrep -o '<City>.*</City>'| sed -e 's/^.*<City/<City/' | cut -f2 -d'>'| cut -f1 -d'<'` myRegionName=`echo $myLocationInfo|egrep -o '<RegionName>.*</RegionName>'| sed -e 's/^.*<RegionName/<RegionName/' | cut -f2 -d'>'| cut -f1 -d'<'` echo "<result>$myCity, $myRegionName - $myCountryCode</result>" VBScript On Error Resume Next url="http://checkip.dyndns.org" Set objHTTP = CreateObject("MSXML2.XMLHTTP") Set xmldoc = WScript.CreateObject("msxml2.domdocument") Call objHTTP.Open("GET", url, FALSE) objHTTP.Send arrIP = Split(objHTTP.responseText, "IP Address: ") strIP = Replace(arrIP(1), "</body></html>", "") url="http://freegeoip.appspot.com/xml/" & strIP & "" Call objHTTP.Open("GET", url, FALSE) objHTTP.send xmldoc.loadXML(objHTTP.responseText) Set objNodeList = xmlDoc.getElementsByTagName("CountryCode") For i = 0 To (objNodeList.length - 1) strCC = strCC & objNodeList.Item(i).text Next Set objNodeList = xmlDoc.getElementsByTagName("RegionName") For i = 0 To (objNodeList.length - 1) strR = strR & objNodeList.Item(i).text Next Set objNodeList = xmlDoc.getElementsByTagName("City") For i = 0 To (objNodeList.length - 1) strCity = strCity & objNodeList.Item(i).text Next WScript.Echo "<result>" & strCity & "," & strR & "," & strCC & "</result>" \ No newline at end of file + + + IP Geo-Location + System Information + Approximate location of the Mac based on its current external IP, in the form "City, Region - CountryCode". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# IP Geo-Location Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Replaced the dyndns + freegeoip.appspot.com endpoints (both shut down). +# ip-api.com returns rate-limited JSON for free; consider replacing the +# host with a self-hosted GeoIP service if you query at scale. + +json=$(/usr/bin/curl -sL --max-time 10 "http://ip-api.com/json" 2>/dev/null) + +if [[ -z "$json" ]]; then + echo "<result>Lookup Failed</result>" + exit 0 +fi + +result=$(echo "$json" | /usr/bin/python3 -c " +import json, sys +try: + d = json.loads(sys.stdin.read()) + if d.get('status') == 'success': + print(f\"{d.get('city','')}, {d.get('regionName','')} - {d.get('countryCode','')}\") +except Exception: + pass +" 2>/dev/null) + +echo "<result>${result:-Lookup Failed}</result>" + + diff --git a/IdentifyDefaultKeychain.xml b/IdentifyDefaultKeychain.xml index 3046dab..6a4a29f 100644 --- a/IdentifyDefaultKeychain.xml +++ b/IdentifyDefaultKeychain.xml @@ -1,57 +1,27 @@ -Identify Default Keychain Used -Operating System -string -Display the default keychain being used on the Mac. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.12 -OSREGEX="^1[2-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - defaultKeychain=$(security default-keychain) + Identify Default Keychain Used + Operating System + string + Returns the path of the default keychain for the current console user. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Identify Default Keychain Used Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# `security` is in the base system on all supported macOS releases. Runs +# in the context of the current console user so we get their keychain +# rather than root's. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + keychain=$(/usr/bin/security default-keychain 2>/dev/null) else - defaultKeychain="none" -fi -if [ "$defaultKeychain" == "none" ]; then - echo "<result>Older Operating System</result>" -elif [ "$defaultKeychain" != " " ]; then - echo "<result>$defaultKeychain</result>" -else - echo "<result>Not Supported</result>" + keychain=$(/usr/bin/sudo -u "$user" /usr/bin/security default-keychain 2>/dev/null) fi + +echo "<result>${keychain:-Unknown}</result>" diff --git a/IdentifyLoginKeychain.xml b/IdentifyLoginKeychain.xml index 7f48370..2f5b175 100644 --- a/IdentifyLoginKeychain.xml +++ b/IdentifyLoginKeychain.xml @@ -1,57 +1,27 @@ -Identify Login Keychain Used -Operating System -string -Display the login keychain being used on the Mac. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.12 -OSREGEX="^1[2-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - loginKeychain=$(security login-keychain) + Identify Login Keychain Used + Operating System + string + Returns the path of the login keychain for the current console user. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Identify Login Keychain Used Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# `security` is in the base system on all supported macOS releases. Runs +# in the context of the current console user so we get their keychain +# rather than root's. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + keychain=$(/usr/bin/security login-keychain 2>/dev/null) else - loginKeychain="none" -fi -if [ "$loginKeychain" == "none" ]; then - echo "<result>Older Operating System</result>" -elif [ "$loginKeychain" != " " ]; then - echo "<result>$loginKeychain</result>" -else - echo "<result>Not Supported</result>" + keychain=$(/usr/bin/sudo -u "$user" /usr/bin/security login-keychain 2>/dev/null) fi + +echo "<result>${keychain:-Unknown}</result>" diff --git a/JSS Certificate Validation.xml b/JSS Certificate Validation.xml index 6d8bddc..1a0c22f 100644 --- a/JSS Certificate Validation.xml +++ b/JSS Certificate Validation.xml @@ -1 +1,36 @@ - JSS Certificate Validation JAMF Software string This attribute verifies that the client can verify the certificate installed on the JSS. This attribute should be used prior to checking the preference "This JSS has a valid certificate installed" in the "JSS/URL Certificate" section of the Management Framework Settings. #!/bin/sh if [ -f "/Library/Preferences/com.jamfsoftware.jamf.plist" ]; then validurl=`defaults read /Library/Preferences/com.jamfsoftware.jamf jss_url | grep https://` if [[ $validurl = "" ]]; then echo "<result>Failed - URL did not contain HTTPS</result>" else curlresult=`curl $validurl` if [[ $curlresult = "" ]]; then echo "<result>Failed - curl was unable to connect</result>" else echo "<result>Success</result>" fi fi else echo "<result>Failed - No jamf 7.3 conf file found</result>" fi \ No newline at end of file + + + JSS Certificate Validation + JAMF Software + string + Validates that this client can reach the Jamf Pro JSS URL over HTTPS with a trusted certificate. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Jamf Pro Certificate Validation Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# `curl -fSs --max-time` fails if the cert is untrusted, the URL doesn't +# resolve, or the response is non-2xx. Stricter than the original (which +# only required a non-empty body). + +plist="/Library/Preferences/com.jamfsoftware.jamf.plist" + +if [[ ! -f "$plist" ]]; then + echo "<result>Failed - No jamf.plist found</result>" + exit 0 +fi + +url=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf jss_url 2>/dev/null) + +if [[ "$url" != https://* ]]; then + echo "<result>Failed - URL did not contain HTTPS</result>" + exit 0 +fi + +if /usr/bin/curl -fSs --max-time 15 -o /dev/null "$url" 2>/dev/null; then + echo "<result>Success</result>" +else + echo "<result>Failed - curl was unable to connect</result>" +fi + + diff --git a/JavaVersion.xml b/JavaVersion.xml index e959773..cf627e3 100644 --- a/JavaVersion.xml +++ b/JavaVersion.xml @@ -1,21 +1,25 @@ -JavaVersion -Detect version of Java -string -#!/bin/sh - -# -# script by emily k @volusion 2014-06-10 -# to detect version of java installed on OS X -# - -if [ -f "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Enabled.plist" ] ; then - VERSION=$( defaults read "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Enabled.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi - -echo "<result>$VERSION</result>" - + JavaVersion + Returns the installed Java runtime version (queries the JDK via /usr/libexec/java_home). The legacy "JavaAppletPlugin" Internet Plug-In has been non-functional since browsers removed NPAPI support. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# JavaVersion Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The Internet Plug-Ins JavaAppletPlugin path stopped being relevant when +# browsers dropped NPAPI (Chrome 45, Firefox 52, Safari 12 ~2018). Detect +# the system JDK via java_home, which Apple still ships in the base OS. + +if ! /usr/libexec/java_home -F &>/dev/null; then + echo "<result>Not installed.</result>" + exit 0 +fi + +version=$(/usr/libexec/java_home -V 2>&1 | /usr/bin/awk '/^[[:space:]]+[0-9]/ { print $1; exit }') +[[ -z "$version" ]] && version=$(/usr/bin/java -version 2>&1 | /usr/bin/awk -F'"' '/version/ { print $2; exit }') + +echo "<result>${version:-Unknown}</result>" + diff --git a/Java_Plugin_Version.xml b/Java_Plugin_Version.xml deleted file mode 100644 index 99bef77..0000000 --- a/Java_Plugin_Version.xml +++ /dev/null @@ -1,20 +0,0 @@ - - -Java Plugin Version -This will determine the version/release number of Oracle's Java7 and Apple's Java6 plugin. -The plugin is located at ~/Library/Internet Plug-Ins/JavaAppletPlugin.plugin - -Note: A different numbering schema is used for v6 & v7. Searches MUST include an "AND" between two version strings. IE, version-is not-14.6.0 AND version-is not-1.7.15 -string -#!/bin/sh -############################################################################ -# Extension Attribute checks to display Oracle Java plugin Version -# Cobbled together from other's hard work by Christopher Miller -# for ITSD-ISS of JHU-APL, Dated 2012-11-09 -############################################################################ -JavaPluginVersion=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleVersion` -echo "<result>$JavaPluginVersion</result>" - -exit 0 - - diff --git a/Java_Vendor_and_Version.xml b/Java_Vendor_and_Version.xml index 0b21db2..e83affb 100644 --- a/Java_Vendor_and_Version.xml +++ b/Java_Vendor_and_Version.xml @@ -1,43 +1,32 @@ - Java Vendor and Version - - string - This is an updated version of the Java Vendor extension attribute submitted by Richard Trouton. This will check for the vendor that is installed, Apple or Oracle, and then grab the version information for what's installed. Works on OS X 10.8 and 10.9 - #!/bin/sh + Java Vendor and Version + + string + Reports the installed Java runtime vendor and version. Apple stopped shipping Java entirely after 10.7, so on modern macOS this reports the third-party JDK (Oracle, Azul, Temurin, etc.) detected via /usr/libexec/java_home. + #!/bin/zsh -# Java_Vendor_and_Version.sh -# -# Original version for vendor by Richard Trouton on 5/8/13. -# Modified to include version by Craig Ernst on 3/17/14. -# Tested on Mac OS X 10.8 and 10.9 -# -# Keep in mind that on a clean install of 10.8 the command 'java -version' -# will prompt to install Apples old version of Java SE 6 if not installed, -# and that 'java -version' will not give the true Internet Plug-In version. -# Even after installing an Oracle version of Java that version info is not updated. -# -# Also keep in mind that on 10.9 the command 'java -version' behaves similarly. -# Although instead of a prompt to install Apple's version it will direct you -# to Oracle's website. -# -# If reporting no Java or an Apple version you should consider installing -# an Oracle version as Apple no longer updates Java. -# -#!/bin/bash +# Updated by SecurityShrimp 2026 +# Java Vendor and Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -javaVendor=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleIdentifier` +if ! /usr/libexec/java_home -F &>/dev/null; then + echo "<result>No Java Available</result>" + exit 0 +fi + +out=$(/usr/bin/java -version 2>&1) +version=$(echo "$out" | /usr/bin/awk -F'"' '/version/ { print $2; exit }') -if [ "$javaVendor" = "com.oracle.java.JavaAppletPlugin" ]; then - javaVersion=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleVersion` - result="Oracle $javaVersion" -elif [ "$javaVendor" = "com.apple.java.JavaAppletPlugin" ]; then - javaVersion=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleVersion` - result="Apple $javaVersion" -elif [ "$javaVendor" = "" ]; then - result="No Java Plug-In Available" +if echo "$out" | /usr/bin/grep -qi "openjdk"; then + vendor="OpenJDK" +elif echo "$out" | /usr/bin/grep -qi "java(tm)"; then + vendor="Oracle" +else + vendor="Unknown" fi -echo "<result>$result</result>" +echo "<result>${vendor} ${version:-Unknown}</result>" + diff --git a/Last User.xml b/Last User.xml index 60650e0..8d5ce5e 100644 --- a/Last User.xml +++ b/Last User.xml @@ -1 +1,23 @@ - Last User User Information This attribute displays the last user to log in. This attribute applies to both Mac and Windows. string #!/bin/sh lastUser=`/usr/bin/last -1 -t console | awk '{print $1}'` if [ $lastUser == "wtmp" ]; then echo "<result>No logins</result>" else echo "<result>$lastUser</result>" fi VBScript On Error Resume Next Dim objComputers Dim strComputers Set objComputers= GetObject("winmgmts:").Instancesof("Win32_ComputerSystem") For each Computer in objComputers strComputers = Computer.UserName Next WScript.Echo "<result>" & strComputers & "</result>" \ No newline at end of file + + + Last User + User Information + Returns the username of the most recent console login. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Last User Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Prefer the loginwindow-tracked value (survives reboots without console +# logins); fall back to `last` if that pref is missing. + +user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) + +if [[ -z "$user" ]]; then + user=$(/usr/bin/last -1 -t console 2>/dev/null | /usr/bin/awk '$1 != "wtmp" { print $1; exit }') +fi + +echo "<result>${user:-No logins}</result>" + + diff --git a/LiveBackup - Backup Size.xml b/LiveBackup - Backup Size.xml deleted file mode 100644 index 0c1e886..0000000 --- a/LiveBackup - Backup Size.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Backup Size Backup This attribute displays the size of the LiveBackup archive. string #!/bin/sh LB_AdminUsername="EditFromTemplate_LiveBackup_Service_Account_Username" LB_AdminPassword="EditFromTemplate_LiveBackup_Service_Account_Password" LB_ServerPort="80" if [ "$LB_AdminUsername" == "" ] || [ "$LB_AdminPassword" == "" ] || [ "$LB_ServerPort" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` serverHost=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` archiveSize=`/usr/bin/curl -u "$LB_AdminUsername":"$LB_AdminPassword" --ntlm http://"$serverHost":"$LB_ServerPort"/lbreportcenter/Activity.aspx | grep "$clientName" | sed -e 's/<[^>]*>/, /g' | awk '{print $8}' | sed -e 's/,//g'` echo "<result>$archiveSize MB</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file diff --git a/LiveBackup - Client Name.xml b/LiveBackup - Client Name.xml deleted file mode 100644 index 010319a..0000000 --- a/LiveBackup - Client Name.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Client Name Backup This attribute displays the client name assigned to the computer in the LiveBackup server. string #!/bin/sh if [ -f /Library/Application\ Support/Atempo/Livebackup/clientname ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` echo "<result>$clientName</result>" else echo "<result>LiveBackup is not installed on this machine.</result>" fi \ No newline at end of file diff --git a/LiveBackup - Encryption Status.xml b/LiveBackup - Encryption Status.xml deleted file mode 100644 index 4c49d9e..0000000 --- a/LiveBackup - Encryption Status.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Encryption Status Backup This attribute displays the encryption status of the client machine running LiveBackup. string #!/bin/sh LB_AdminUsername="EditFromTemplate_LiveBackup_Service_Account_Username" LB_AdminPassword="EditFromTemplate_LiveBackup_Service_Account_Password" LB_ServerPort="80" if [ "$LB_AdminUsername" == "" ] || [ "$LB_AdminPassword" == "" ] || [ "$LB_ServerPort" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` serverHost=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` encryptionStatus=`/usr/bin/curl -u "$LB_AdminUsername":"$LB_AdminPassword" --ntlm http://"$serverHost":"$LB_ServerPort"/lbreportcenter/Activity.aspx | grep "$clientName" | sed -e 's/<[^>]*>/, /g' | awk '{print $14}' | sed 's/,//g'` echo "<result>$encryptionStatus</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file diff --git a/LiveBackup - File Recoveries.xml b/LiveBackup - File Recoveries.xml deleted file mode 100644 index 50b4944..0000000 --- a/LiveBackup - File Recoveries.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - File Recoveries Backup This attribute displays the number file recoveries that have been performed by LiveBackup. integer #!/bin/sh LB_AdminUsername="EditFromTemplate_LiveBackup_Service_Account_Username" LB_AdminPassword="EditFromTemplate_LiveBackup_Service_Account_Password" LB_ServerPort="80" if [ "$LB_AdminUsername" == "" ] || [ "$LB_AdminPassword" == "" ] || [ "$LB_ServerPort" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` serverHost=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` fileRecoveries=`/usr/bin/curl -u "$LB_AdminUsername":"$LB_AdminPassword" --ntlm http://"$serverHost":"$LB_ServerPort"/lbreportcenter/Operations.aspx | grep "$clientName" | sed -e 's/<[^>]*>/, /g' | awk '{print $8}' | sed 's/,//g'` echo "<result>$fileRecoveries</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file diff --git a/LiveBackup - Last Backup Time.xml b/LiveBackup - Last Backup Time.xml deleted file mode 100644 index fdba6f3..0000000 --- a/LiveBackup - Last Backup Time.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Last Backup Time Backup This attribute displays the last time the client submitted a backup to the server. date #!/bin/sh LB_AdminUsername="EditFromTemplate_LiveBackup_Service_Account_Username" LB_AdminPassword="EditFromTemplate_LiveBackup_Service_Account_Password" LB_ServerPort="80" if [ "$LB_AdminUsername" == "" ] || [ "$LB_AdminPassword" == "" ] || [ "$LB_ServerPort" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` serverHost=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` lastBackup=`/usr/bin/curl -u "$LB_AdminUsername":"$LB_AdminPassword" --ntlm http://"$serverHost":"$LB_ServerPort"/lbreportcenter/Activity.aspx | grep "$clientName" | sed -e 's/<[^>]*>/, /g' | awk '{print $12}'` lastBackupFormatted=`/bin/date -j -f "%m/%d/%Y&nbsp;%H:%M:%S&nbsp;%p," "$lastBackup" "+%Y-%m-%d %H:%M:%S"` echo "<result>$lastBackupFormatted</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file diff --git a/LiveBackup - Rollbacks.xml b/LiveBackup - Rollbacks.xml deleted file mode 100644 index 4b19e73..0000000 --- a/LiveBackup - Rollbacks.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Rollbacks Backup This attribute displays the number of rollbacks that have been performed by LiveBackup. integer #!/bin/sh LB_AdminUsername="EditFromTemplate_LiveBackup_Service_Account_Username" LB_AdminPassword="EditFromTemplate_LiveBackup_Service_Account_Password" LB_ServerPort="80" if [ "$LB_AdminUsername" == "" ] || [ "$LB_AdminPassword" == "" ] || [ "$LB_ServerPort" == "" ];then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then clientName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/clientname` serverHost=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` fileRecoveries=`/usr/bin/curl -u "$LB_AdminUsername":"$LB_AdminPassword" --ntlm http://"$serverHost":"$LB_ServerPort"/lbreportcenter/Operations.aspx | grep "$clientName" | sed -e 's/<[^>]*>/, /g' | awk '{print $10}' | sed 's/,//g'` echo "<result>$fileRecoveries</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file diff --git a/LiveBackup - Server Name.xml b/LiveBackup - Server Name.xml deleted file mode 100644 index d8b462c..0000000 --- a/LiveBackup - Server Name.xml +++ /dev/null @@ -1 +0,0 @@ - LiveBackup - Server Name Backup This attribute displays the LiveBackup server name assigned to the computer. string #!/bin/sh if [ -f /Library/Application\ Support/Atempo/Livebackup/serverhost ];then serverName=`/bin/cat /Library/Application\ Support/Atempo/Livebackup/serverhost` echo "<result>$serverName</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/Location_Services.xml b/Location_Services.xml index c123421..2715f3d 100644 --- a/Location_Services.xml +++ b/Location_Services.xml @@ -1,27 +1,32 @@ -Location Services - -string -#!/bin/bash - -uuid=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}') -domain="/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd.${uuid}" -plist="${domain}.plist" - -if [[ -f "${plist}" ]] -then - status=$(defaults read "${domain}" LocationServicesEnabled) - if [[ "${status}" == "1" ]] - then - result="Enabled" - else - result="Disabled" - fi -else - result="Unavailable" -fi - -echo "<result>${result}</result>" - + Location Services + Reports whether the system-wide Location Services daemon is enabled ("Enabled", "Disabled", or "Unavailable" when locationd's plist is absent). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Location Services Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The plist still lives under /var/db/locationd/. The path is SIP-protected +# but readable by root, which is the context Jamf EAs run in. + +uuid=$(/usr/sbin/ioreg -d2 -c IOPlatformExpertDevice 2>/dev/null \ + | /usr/bin/awk -F'"' '/IOPlatformUUID/ { print $4; exit }') + +plist="/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd.${uuid}.plist" + +if [[ ! -f "$plist" ]]; then + echo "<result>Unavailable</result>" + exit 0 +fi + +status=$(/usr/bin/defaults read "${plist%.plist}" LocationServicesEnabled 2>/dev/null) + +if [[ "$status" == "1" ]]; then + echo "<result>Enabled</result>" +else + echo "<result>Disabled</result>" +fi + diff --git a/Login Window - Disable Console Access.xml b/Login Window - Disable Console Access.xml index 981cabc..e351daf 100644 --- a/Login Window - Disable Console Access.xml +++ b/Login Window - Disable Console Access.xml @@ -1 +1,36 @@ - Login Window - Disable Console Access Security Reporting string This attribute displays the status of the Login Window setting "Disable Console Access". The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that console access is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="DisableConsoleAccess" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file + + + Login Window - Disable Console Access + Security Reporting + string + Reports whether the loginwindow DisableConsoleAccess setting matches the desired value. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Login Window - Disable Console Access Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Legacy script read via "dscl . mcxread", which is non-functional on +# modern macOS (MCX deprecated since 10.7). We read the canonical +# loginwindow key from /Library/Managed Preferences first (where MDM +# Configuration Profiles deposit values), then fall back to the device +# preference at /Library/Preferences. + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Managed\ Preferences/com.apple.loginwindow DisableConsoleAccess 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow DisableConsoleAccess 2>/dev/null) + +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Login Window - Display Login Window Message.xml b/Login Window - Display Login Window Message.xml index 903bb63..fefa3fd 100644 --- a/Login Window - Display Login Window Message.xml +++ b/Login Window - Display Login Window Message.xml @@ -1 +1,26 @@ - Login Window - Display Login Window Message Security Reporting string This attribute displays the status of the Login Window setting "Login Window Text". The value to be verified will need to be specified when creating this extension attribute. Example: "This Computer is Property of Company" verifies the message displayed at the login window. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_This_Computer_is_Property_of_Company" appDomain="com.apple.loginwindow" keyName="LoginwindowText" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Login Window - Display Login Window Message + Security Reporting + string + Reports the loginwindow LoginwindowText (legal banner). Edit desiredValue before deployment to compare against an expected string. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Login Window - Display Login Window Message Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Managed\ Preferences/com.apple.loginwindow LoginwindowText 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow LoginwindowText 2>/dev/null) + +value="${raw:-Domain or Key Not Found}" + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Login Window - Display Username and Password Textboxes.xml b/Login Window - Display Username and Password Textboxes.xml index fa28300..d98f231 100644 --- a/Login Window - Display Username and Password Textboxes.xml +++ b/Login Window - Display Username and Password Textboxes.xml @@ -1 +1,36 @@ - Login Window - Display Username and Password Textboxes Security Reporting string This attribute displays the status of the Login Window setting "Display Username and Password Textboxes". The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that username and password test boxes are displayed at the login window rather than a list of users. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="SHOWFULLNAME" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file + + + Login Window - Display Username and Password Textboxes + Security Reporting + string + Reports whether loginwindow shows name/password text fields (SHOWFULLNAME=true) instead of a user list. Edit desiredValue before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Login Window - Display Username and Password Textboxes Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Legacy script read via "dscl . mcxread", which is non-functional on +# modern macOS (MCX deprecated since 10.7). We read the canonical +# loginwindow key from /Library/Managed Preferences first (where MDM +# Configuration Profiles deposit values), then fall back to the device +# preference at /Library/Preferences. + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Managed\ Preferences/com.apple.loginwindow SHOWFULLNAME 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow SHOWFULLNAME 2>/dev/null) + +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Login Window - Show Password Hint After Failed Logins.xml b/Login Window - Show Password Hint After Failed Logins.xml index 622e4cd..6c1ca85 100644 --- a/Login Window - Show Password Hint After Failed Logins.xml +++ b/Login Window - Show Password Hint After Failed Logins.xml @@ -1 +1,30 @@ - Login Window - Show Password Hint After Failed Logins Security Reporting string This attribute displays the status of the Login Window setting "Show Password Hint After Failed Logins". The value to be verified will need to be specified when creating this extension attribute. Example: "0" verifies that password hints are disabled. "2" verifies that password hints will be displayed after 2 failed login attempts. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Retries_Until_Hint_-_Example:_0" appDomain="com.apple.loginwindow" keyName="RetriesUntilHint" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "$desiredValue" ]; then result="true" elif [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi if [ "$result" == "true" ]; then echo "<result>Pass (Hints Disabled)</result>" else echo "<result>Fail ($tmpResult)</result>" fi \ No newline at end of file + + + Login Window - Show Password Hint After Failed Logins + Security Reporting + string + Reports the loginwindow RetriesUntilHint value. 0 disables hints; any positive value shows hints after that many failed attempts. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Login Window - Show Password Hint After Failed Logins Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +desiredValue="EditFromTemplate_Retries_Until_Hint" + +raw=$(/usr/bin/defaults read /Library/Managed\ Preferences/com.apple.loginwindow RetriesUntilHint 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow RetriesUntilHint 2>/dev/null) + +value="${raw:-Domain or Key Not Found}" + +if [[ "$value" == "$desiredValue" ]]; then + if [[ "$value" == "0" ]]; then + echo "<result>Pass (Hints Disabled)</result>" + else + echo "<result>Pass ($value)</result>" + fi +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Login Window - Shutdown.xml b/Login Window - Shutdown.xml index 82ecbcb..d90f0be 100644 --- a/Login Window - Shutdown.xml +++ b/Login Window - Shutdown.xml @@ -1 +1,36 @@ - Login Window - Shutdown, Restart Buttons Disabled Security Reporting string This attribute displays the status of the Login Window setting "Disable Shutdown and Restart Buttons". The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the shutdown and restart buttons are disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="PowerOffDisabled" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file + + + Login Window - Shutdown, Restart Buttons Disabled + Security Reporting + string + Reports whether loginwindow PowerOffDisabled is set (hides Shutdown/Restart at login). Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Login Window - Shutdown, Restart Buttons Disabled Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Legacy script read via "dscl . mcxread", which is non-functional on +# modern macOS (MCX deprecated since 10.7). We read the canonical +# loginwindow key from /Library/Managed Preferences first (where MDM +# Configuration Profiles deposit values), then fall back to the device +# preference at /Library/Preferences. + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Managed\ Preferences/com.apple.loginwindow PowerOffDisabled 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow PowerOffDisabled 2>/dev/null) + +case "$raw" in + 0) value="false" ;; + 1) value="true" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/MDM_Profile_Verification_State.xml b/MDM_Profile_Verification_State.xml index cdeda8f..029c435 100644 --- a/MDM_Profile_Verification_State.xml +++ b/MDM_Profile_Verification_State.xml @@ -1,45 +1,23 @@ -MDM Profile Verification State -This attribute verifies that the Verification State of the MDM Profile installed on a client from the JSS. Results returned are "Verified", "Not Verified" or "Undecided" If an MDM Profile supplied by the JSS is not installed on the client, or if this script cannot find a Verification State attribute, this attribute will return a result of "Undecided". -string -#!/bin/bash -#################################################################################################### -# -# Copyright (c) 2015, JAMF Software, LLC. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the JAMF Software, LLC nor the -# names of its contributors may be used to endorse or promote products -# derived from this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -#################################################################################################### -# Gather MDM Profile Verification State v1 - gmaki 1/4/16 -# v2 updated awk to print a "Not Verified" result appropriately - bschmidt 1/5/16 -# Note, If an MDM Profile is not installed on the client, or if this script cannot find a verification state attribute within 3 lines after the profile identifier using the system_profiler command, this EA will return an "Undecided" result to the JSS. -profileVerifyStatus=`system_profiler SPConfigurationProfileDataType | grep -A3 "UUID: 00000000-0000-0000-A000-4A414D460003" | grep "Verification State: " | awk -F ': ' '{ print $2 }'` -if [ "$profileVerifyStatus" != "" ]; then -echo "<result>$profileVerifyStatus</result>" -else -echo "<result>Undecided</result>" -fi -exit 0 - + MDM Profile Verification State + Reports the Verification State of the Jamf-issued MDM Profile ("Verified", "Not Verified", "Unverified", or "Undecided"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# MDM Profile Verification State Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Apple still exposes a "Verification State" line in +# system_profiler SPConfigurationProfileDataType for the MDM profile. +# Jamf's MDM profile UUID continues to use the well-known suffix +# 00000000-0000-0000-A000-4A414D460003 ("JAMF" hex). + +state=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null \ + | /usr/bin/awk '/UUID: 00000000-0000-0000-A000-4A414D460003/ { found=1; next } + found && /Verification State:/ { sub(/^[^:]*: */, ""); print; exit } + found && /UUID:/ { exit }') + +echo "<result>${state:-Undecided}</result>" + diff --git a/Mac OS X Server - Registration.xml b/Mac OS X Server - Registration.xml deleted file mode 100644 index 90db773..0000000 --- a/Mac OS X Server - Registration.xml +++ /dev/null @@ -1 +0,0 @@ - Mac OS X Server - Registration Server This attribute returns the server registration info for Mac OS X Server. string #!/bin/sh #Check to see if we are running Mac OS X Server if [ -f "/usr/sbin/serveradmin" ]; then OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" > "10.5" ]]; then result=`/System/Library/ServerSetup/serverserialnumberutil -get | cut -c 42- | sed 's/|/, /g'` echo "<result>$result</result>" else result=`/System/Library/ServerSetup/serversetup -getServerSerialNumber | cut -c 42- | sed 's/|/, /g'` echo "<result>$result</result>" fi fi \ No newline at end of file diff --git a/Mac OS X Server - Serial Number.xml b/Mac OS X Server - Serial Number.xml deleted file mode 100644 index 0c7ce7c..0000000 --- a/Mac OS X Server - Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - Mac OS X Server - Serial Number Server This attribute returns the server serial number for Mac OS X Server. string #!/bin/sh #Check to see if we are running Mac OS X Server if [ -f "/usr/sbin/serveradmin" ]; then OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" > "10.5" ]]; then result=`/System/Library/ServerSetup/serverserialnumberutil -get | cut -c 1-40` echo "<result>$result</result>" else result=`/System/Library/ServerSetup/serversetup -getServerSerialNumber | cut -c 1-40` echo "<result>$result</result>" fi fi \ No newline at end of file diff --git a/Managed_By_-_EA.xml b/Managed_By_-_EA.xml index 9a8bbbb..41ce911 100644 --- a/Managed_By_-_EA.xml +++ b/Managed_By_-_EA.xml @@ -1,29 +1,39 @@ - - -Managed By - EA - -string -#!/bin/bash -################################################################################################################################ -## This Extension Attribute will return the "Managed by" account name that the JSS is using to manage the computer" ## -## You can then create Smart Groups or Advanced Search based on this Attribute. ## -## ## -## You need to fill in your UserName, Password to access your JSS. You also need to fill in the JSS address and port number. ## -################################################################################################################################ - -### Update these variables ### -user="UserName" -pass="Password" -jssaddress="Server Address" -serverPort="8443" -computerName=$(hostname -f) - - - -## Do not modify below this line ### -response=$(curl https://$jssaddress/JSSResource:$serverPort/computers/name/$computerName/subset/General --user "$user:$pass") -ManagedBy=$(echo $response | /usr/bin/awk -F'<management_username>|</management_username>' '{print $2}') - -echo "<result>$ManagedBy</result>" - - + + + Managed By - EA + Returns the Jamf Pro management account name assigned to this computer. Requires Classic API credentials with Read on Computers. Populate the placeholders before deployment. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Jamf Pro Managed By Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Uses token-based auth instead of HTTP Basic (deprecated in Jamf Pro +# 10.35+). Queries by UDID rather than hostname for reliability. + +apiUser="UserName" +apiPass="Password" +jssBase="https://jss.example.com:8443" + +udid=$(/usr/sbin/ioreg -d2 -c IOPlatformExpertDevice 2>/dev/null \ + | /usr/bin/awk -F'"' '/IOPlatformUUID/ { print $4; exit }') + +token=$(/usr/bin/curl -s -u "${apiUser}:${apiPass}" \ + -X POST "${jssBase}/api/v1/auth/token" 2>/dev/null \ + | /usr/bin/awk -F'"' '/token/ { print $4; exit }') + +if [[ -z "$token" ]]; then + echo "<result>Auth Failed</result>" + exit 0 +fi + +managedBy=$(/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + "${jssBase}/JSSResource/computers/udid/${udid}/subset/General" 2>/dev/null \ + | /usr/bin/xmllint --xpath 'string(//computer/general/management_username)' - 2>/dev/null) + +/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + -X POST "${jssBase}/api/v1/auth/invalidate-token" >/dev/null 2>&1 + +echo "<result>${managedBy:-N/A}</result>" + + diff --git a/Management_User.xml b/Management_User.xml index 3bcb1d5..d29ac34 100644 --- a/Management_User.xml +++ b/Management_User.xml @@ -1,47 +1,37 @@ -Management User - -string -#!/bin/sh - -#### Hard-coded variables ########################################################################################### - - -# Username that has API read privileges for Computers -apiUsername="" - -# Password for API user -apiPassword="" - -# JSS base url - Example: "https://yourJSSurl:8443" -jssBase="https://jss_url:8443" - - -#### Functions ###################################################################################################### - -function getComputerUUID() { - - computerUUID="$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep 'Hardware UUID' | /usr/bin/awk -F ' ' {'print $3'})" -} - -function getComputerManagementUserViaUUID() { - - computerManagementUser=`/usr/bin/curl -H "Accept: application/xml" -H "Content-type: application/xml" -skfu "${apiUsername}:${apiPassword}" "${jssBase}/JSSResource/computers/udid/${computerUUID}/subset/general" | xmllint --format - 2>/dev/null | awk -F'>|<' '/management_username/{print $3}'` -} - - -#### Main ########################################################################################################### - -getComputerUUID -getComputerManagementUserViaUUID - -if [ ! -z "$computerManagementUser" ]; then - echo "<result>$computerManagementUser</result>" -else - echo "<result>N/A</result>" -fi - + Management User + Returns the Jamf Pro management account name from the Classic API. Functionally identical to "Managed By - EA"; retained for compatibility with deployments using this displayName. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Management User Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +apiUser="" +apiPass="" +jssBase="https://jss_url:8443" + +udid=$(/usr/sbin/ioreg -d2 -c IOPlatformExpertDevice 2>/dev/null \ + | /usr/bin/awk -F'"' '/IOPlatformUUID/ { print $4; exit }') + +token=$(/usr/bin/curl -s -u "${apiUser}:${apiPass}" \ + -X POST "${jssBase}/api/v1/auth/token" 2>/dev/null \ + | /usr/bin/awk -F'"' '/token/ { print $4; exit }') + +if [[ -z "$token" ]]; then + echo "<result>N/A</result>" + exit 0 +fi + +mgmtUser=$(/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + "${jssBase}/JSSResource/computers/udid/${udid}/subset/general" 2>/dev/null \ + | /usr/bin/xmllint --xpath 'string(//computer/general/management_username)' - 2>/dev/null) + +/usr/bin/curl -s -H "Authorization: Bearer ${token}" \ + -X POST "${jssBase}/api/v1/auth/invalidate-token" >/dev/null 2>&1 + +echo "<result>${mgmtUser:-N/A}</result>" - diff --git a/McAfee - Check EPO Agent Version.xml b/McAfee - Check EPO Agent Version.xml index f550c81..14a1e82 100644 --- a/McAfee - Check EPO Agent Version.xml +++ b/McAfee - Check EPO Agent Version.xml @@ -1 +1,27 @@ - McAfee - Check EPO Agent Version Security Reporting string This attribute will report the version of the McAfee EPO Agent installed on the client computer. #!/bin/sh #Reports the version of the McAfee epO Agent installed on the client computer. #Data Type in JSS for this script should be set to: string Version=`cat /etc/cma.d/EPOAGENT3700MACX/config.xml | egrep ".*" |sed -e "s/\(.*\)<\/Version>/\1/"|tr "|" " "` echo ''$Version'' \ No newline at end of file + + + McAfee - Check EPO Agent Version + Security Reporting + string + Returns the installed Trellix (formerly McAfee) ePO Agent version, or "Not installed". + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Trellix/McAfee ePO Agent Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# McAfee rebranded as Trellix in 2022. The agent ships under /Library/McAfee +# (legacy) or /Library/Trellix (post-rebrand) and the directory name +# encodes the agent generation (EPOAGENT3700MACX, EPOAGENT5700MACX, etc.). + +config=$(/bin/ls /etc/cma.d/EPOAGENT*/config.xml(N) 2>/dev/null | /usr/bin/head -n1) +[[ -z "$config" ]] && config=$(/bin/ls /Library/McAfee/cma/scratch/etc/cma.d/EPOAGENT*/config.xml(N) /Library/Trellix/Agent/etc/cma.d/EPOAGENT*/config.xml(N) 2>/dev/null | /usr/bin/head -n1) + +if [[ -z "$config" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +version=$(/usr/bin/xmllint --xpath 'string(//Version)' "$config" 2>/dev/null) +echo "<result>${version:-Unknown}</result>" + + diff --git a/Microsoft Lync Version.xml b/Microsoft Lync Version.xml deleted file mode 100644 index 2d0c656..0000000 --- a/Microsoft Lync Version.xml +++ /dev/null @@ -1,23 +0,0 @@ - - -Microsoft Lync Version -Determine the Microsoft Lync version -string -#!/bin/sh -# -############################################################################ -# -# Extension Attribute checks to display Microsoft Lync Version with Release number. -# -# Uses CFBundleShortVersionString because this is the "release version number of the bundle" -# Ref: https://developer.apple.com/library/IOS/#documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html -# -############################################################################ -if [ -d /Applications/Microsoft\ Office\ 2011 ] ; then - RESULT=$( sudo defaults read /Applications/Microsoft\ Lync.app/Contents/Info.plist CFBundleShortVersionString ) - echo "<result>$RESULT</result>" -else - echo "<result>Not Installed</result>" -fi - - diff --git a/Microsoft Office 2008 Product ID.xml b/Microsoft Office 2008 Product ID.xml deleted file mode 100644 index d9f5dc2..0000000 --- a/Microsoft Office 2008 Product ID.xml +++ /dev/null @@ -1 +0,0 @@ - Microsoft Office 2008 Product ID Serial Numbers string This attribute returns the product ID present on the machine for Microsoft Office 2008. #!/bin/sh if [ -f "/Applications/Microsoft Office 2008/Office/OfficePID.plist" ]; then result=`/usr/bin/defaults read /Applications/Microsoft\ Office\ 2008/Office/OfficePID 1825` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/Microsoft_AutoUpdate.xml b/Microsoft_AutoUpdate.xml index 2556e0c..ac439b9 100644 --- a/Microsoft_AutoUpdate.xml +++ b/Microsoft_AutoUpdate.xml @@ -1,20 +1,27 @@ - -Microsoft AutoUpdate -Returns the installed version of Microsoft Sharepoint Browser -string -#!/bin/bash - -ExtensionVersion="" -if [ -f /Library/Application\ Support/Microsoft/MAU2.0/Microsoft\ AutoUpdate.app/Contents/Info.plist ]; then - ExtensionVersion=$(defaults read /Library/Application\ Support/Microsoft/MAU2.0/Microsoft\ AutoUpdate.app/Contents/Info.plist CFBundleShortVersionString) -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - + + + Microsoft AutoUpdate + Returns the installed Microsoft AutoUpdate (MAU) version. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Microsoft AutoUpdate Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# MAU has moved bundle paths several times. Modern MAU (4.x) lives in +# /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app. + +for plist in \ + "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/Info.plist" \ + "/Applications/Microsoft AutoUpdate.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>Not Installed</result>" + + diff --git a/Microsoft_Sharepoint_Browser.xml b/Microsoft_Sharepoint_Browser.xml deleted file mode 100644 index 5b5edc3..0000000 --- a/Microsoft_Sharepoint_Browser.xml +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Sharepoint Browser -Returns the installed version of Microsoft Sharepoint Browser -string -#!/bin/bash - -ExtensionVersion="" -if [ -f /Library/Internet\ Plug-Ins/SharePointBrowserPlugin.plugin/Contents/Info.plist ]; then - ExtensionVersion=$(defaults read /Library/Internet\ Plug-Ins/SharePointBrowserPlugin.plugin/Contents/Info.plist CFBundleShortVersionString) -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - diff --git a/Network Time Server.xml b/Network Time Server.xml index af7181e..0465a79 100644 --- a/Network Time Server.xml +++ b/Network Time Server.xml @@ -1 +1,25 @@ - Network Time Server System Information This attribute lists the network time server that is currently set. This attribute applies to both Mac and Windows. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup -getnetworktimeserver | awk '{print $4}'`</result>" else echo "<result>The systemsetup binary is not present on this machine.</result>" fi else echo "<result>`/usr/sbin/systemsetup -getnetworktimeserver | awk '{print $4}'`</result>" fi VBScript On Error Resume Next Const HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv") strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\Servers\" strValueName = "" oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValue,strValue2 Wscript.Echo "<result>" & strValue2 & "</result>" \ No newline at end of file + + + Network Time Server + System Information + Returns the configured network time server. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Network Time Server Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# systemsetup -getnetworktimeserver still works, but it requires Full Disk +# Access on macOS 11+ when run from a non-MDM process. Jamf binary has FDA. +# We also read the raw timeServers preference as a fallback. + +server=$(/usr/sbin/systemsetup -getnetworktimeserver 2>/dev/null | /usr/bin/awk '{print $NF}') + +if [[ -z "$server" || "$server" == "Server:" ]]; then + server=$(/usr/bin/defaults read /private/var/db/timed/Library/Preferences/com.apple.timed timeServers 2>/dev/null \ + | /usr/bin/awk -F'"' 'NR==2 { print $2 }') +fi + +echo "<result>${server:-Unknown}</result>" + + diff --git a/Network_Services_List.xml b/Network_Services_List.xml index 0796c45..00c4f58 100644 --- a/Network_Services_List.xml +++ b/Network_Services_List.xml @@ -1,35 +1,20 @@ -Network Services List -This attribute lists all network services present on a machine. This attribute applies to both Mac and Windows. -string -#!/bin/bash -ref=$(/usr/bin/sw_vers -productVersion | awk '{print substr($1,4,2)}') -case $ref in - [0-4] ) if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ] - then - echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listallnetworkservices 2>&1`</result>" - else - echo "<result>The networksetup binary is not present on this machine.</result>" - fi - ;; - * ) echo "<result>`/usr/sbin/networksetup -listallnetworkservices| grep -i -v asterisk`</result>" - ;; -esac -On Error Resume Next - -Dim objNetworkAdapters -Dim strNetworkAdapters - -Set objNetworkAdapters = GetObject("winmgmts:").Instancesof("Win32_NetworkAdapter") -i=0 -For each NetworkAdapter in objNetworkAdapters - If i <> 0 then - strNetworkAdapters = "<br>" & strNetworkAdapters - End If -strNetworkAdapters = NetworkAdapter.Name & strNetworkAdapters - i = i + 1 -Next - -WScript.Echo "<result>" & strNetworkAdapters & "</result>" + Network Services List + Lists all configured network services on this Mac (Wi-Fi, Ethernet, USB tethers, VPN services, etc.). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Network Services List Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Strips the "* " prefix that networksetup uses to mark disabled services +# along with the explanatory header line. + +services=$(/usr/sbin/networksetup -listallnetworkservices 2>/dev/null \ + | /usr/bin/grep -v "An asterisk" \ + | /usr/bin/sed 's/^\* //') + +echo "<result>${services:-None}</result>" + diff --git a/Norton - Virus Definition Date.xml b/Norton - Virus Definition Date.xml index 8de7180..a17b79f 100644 --- a/Norton - Virus Definition Date.xml +++ b/Norton - Virus Definition Date.xml @@ -1 +1,33 @@ - Norton - Virus Definition Date AntiVirus This attribute returns the Virus Definitions Date for Symantec. This attribute template applies to Norton AntiVirus (v 10), and Norton AntiVirus (v 11). date #!/bin/sh #This script has been verified to work on Norton AntiVirus (v 10, v11). #Check to see if Norton v10 is installed if [ -f "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" ]; then result=`/bin/date -j -f "%b %d, %Y" "$(cat "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" | grep "Symantec Security Response" | awk '{print $5, $6, $7}')" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else #Check to see if Norton v11 is installed if [ -f "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" ]; then result=`/bin/date -j -f "%b %d, %Y" "$(cat "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" | grep "Symantec Security Response" | awk '{print $5, $6, $7}')" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + Norton - Virus Definition Date + AntiVirus + Returns the date of Norton/Symantec's most recent virus definitions, or "Not installed". + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Norton/Symantec Virus Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# NortonLifeLock split from Symantec Enterprise (now Broadcom). The WHATSNEW +# file path differs between consumer Norton 360 and Symantec Endpoint +# Protection for Mac; we probe both. + +for whatsnew in \ + "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" \ + "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" \ + "/Library/Application Support/Norton/Norton 360/Engine/WHATSNEW.TXT" +do + if [[ -f "$whatsnew" ]]; then + raw=$(/usr/bin/grep "Symantec Security Response" "$whatsnew" | /usr/bin/awk '{print $5, $6, $7}') + if [[ -n "$raw" ]]; then + iso=$(/bin/date -j -f "%b %d, %Y" "$raw" "+%Y-%m-%d 00:00:00" 2>/dev/null) + echo "<result>${iso:-Unknown}</result>" + exit 0 + fi + fi +done + +echo "<result>Not installed</result>" + + diff --git a/Number_of_Cached_Packages.xml b/Number_of_Cached_Packages.xml index 7a8bc32..abb541e 100644 --- a/Number_of_Cached_Packages.xml +++ b/Number_of_Cached_Packages.xml @@ -1,19 +1,23 @@ -Number of Cached Packages -Counts the number of files in /Library/Application Support/JAMF/Waiting Room, excluding XML files. -number -#!/bin/bash - -# Count the number of non-xml files in /Library/Application Support/JAMF/Waiting Room -number=`ls -1 /Library/Application\ Support/JAMF/Waiting\ Room/ | grep -v xml | wc -l` - -# Remove leading space from string -number=`echo $number` - -# Echo result to JSS -echo "<result>$number</result>" - -exit 0 - + Number of Cached Packages + Counts non-XML files in /Library/Application Support/JAMF/Waiting Room/. These are packages cached by Jamf for later install. + number + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Number of Cached Packages Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +room="/Library/Application Support/JAMF/Waiting Room" + +if [[ ! -d "$room" ]]; then + echo "<result>0</result>" + exit 0 +fi + +count=$(/bin/ls -1 "$room" 2>/dev/null | /usr/bin/grep -cv 'xml$') + +echo "<result>${count:-0}</result>" + diff --git a/Nvidia_CUDA_Driver.xml b/Nvidia_CUDA_Driver.xml deleted file mode 100644 index 5175859..0000000 --- a/Nvidia_CUDA_Driver.xml +++ /dev/null @@ -1,22 +0,0 @@ - -Nvidia CUDA Driver -Returns the installed version of Nvidia CUDA Driver -string -#!/bin/bash - -ExtensionVersion="" -if [ -f /Library/Frameworks/CUDA.framework/Versions/Current/Resources/Info.plist ] - then - ExtensionVersion=$(defaults read /Library/Frameworks/CUDA.framework/Versions/Current/Resources/Info.plist CFBundleShortVersionString) -fi - -if [ "$ExtensionVersion" == "" ] - then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - diff --git a/Nvidia_CUDA_Toolkit.xml b/Nvidia_CUDA_Toolkit.xml deleted file mode 100644 index 16796f3..0000000 --- a/Nvidia_CUDA_Toolkit.xml +++ /dev/null @@ -1,24 +0,0 @@ - -Nvidia CUDA Toolkit -Returns the installed version of the Nvidia CUDA toolkit. -string -#!/bin/bash - -VERSION="" -# Find the gdb sources -# use a cut to the file names in a '7.0.29.src.tar.gz' format -# sort them in reverse to put the newest one first -# Cut out the version number from the first three characters between '.'s -# and return the first result (ex. 7.0.29)' -VERSION=$(find /Developer/NVIDIA/ -name "cuda-gdb*.src.tar.gz" | cut -d '-' -f4 | sort -r | cut -d '.' -f1,2,3 | head -n 1) - -if [ "$VERSION" == "" ]; then - VERSION="Not Installed" -fi - - -echo "<result>$VERSION</result>" - -exit 0 - - diff --git a/OS - Admin Privileges (Via GUI) Valid For X Minutes Until Re-Authentication.xml b/OS - Admin Privileges (Via GUI) Valid For X Minutes Until Re-Authentication.xml deleted file mode 100644 index aece6e3..0000000 --- a/OS - Admin Privileges (Via GUI) Valid For X Minutes Until Re-Authentication.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Admin Privileges (Via GUI) Valid For X Minutes Until Re-Authentication Security Reporting string This attribute displays the status of the number of minutes that admin privileges are cached for until re-prompting for an admin password in the GUI. The system default value is 5 minutes. The value to be verified will need to be specified when creating this extension attribute. Example: "3" verifies admin privileges are cached for 3 minutes. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_3" if [ -f /usr/libexec/PlistBuddy ]; then result=`/usr/libexec/PlistBuddy -c "print rights:system.privilege.admin:timeout" /private/etc/authorization` if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi else echo "<result>Please ensure that PlistBuddy is installed at /usr/libexec/PlistBuddy.</result>" fi \ No newline at end of file diff --git a/OS - Admin Privileges (Via Sudo) Only Permitted for Valid Login Sessions.xml b/OS - Admin Privileges (Via Sudo) Only Permitted for Valid Login Sessions.xml deleted file mode 100644 index 8dcc0eb..0000000 --- a/OS - Admin Privileges (Via Sudo) Only Permitted for Valid Login Sessions.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Admin Privileges (Via Sudo) Only Permitted for Valid Login Sessions Security Reporting string This extension attribute will check /etc/sudoers to make sure that the defaults specification for TTY Tickets is set. #!/bin/sh desiredResult="Defaults tty_tickets" result=`cat /etc/sudoers | grep "$desiredResult" | tail -1` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Admin Privileges (Via Terminal) Valid For 0 Seconds Until Re-Authentication.xml b/OS - Admin Privileges (Via Terminal) Valid For 0 Seconds Until Re-Authentication.xml deleted file mode 100644 index cf5ce3f..0000000 --- a/OS - Admin Privileges (Via Terminal) Valid For 0 Seconds Until Re-Authentication.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Admin Privileges (Via Terminal) Valid For 0 Seconds Until Re-Authentication Security Reporting string This attribute displays the status of the number of seconds that admin privileges are cached for until re-prompting for an admin password in the Terminal. The system default value is 5 minutes. This extension attribute is hard coded to check that the timeout is set to 0 seconds, so the user will be reprompted every time there is a request for admin privileges in the Terminal. To change this setting, edit the "desiredValue" variable. #!/bin/sh desiredValue="Defaults timestamp_timeout=0" result=`cat /etc/sudoers | grep "$desiredValue" | tail -1` if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Auto Logout Disabled.xml b/OS - Auto Logout Disabled.xml deleted file mode 100644 index 269deca..0000000 --- a/OS - Auto Logout Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Auto Logout Disabled Security Reporting string This attribute verifies that the setting "Auto Logout" is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh appDomain=".GlobalPreferences" keyName="com.apple.autologout.AutoLogOutDelay" desiredValue="0" currentUser=`last -1 -t console | awk '{print $1}'` result="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Bluetooth Disabled.xml b/OS - Bluetooth Disabled.xml deleted file mode 100644 index 4830473..0000000 --- a/OS - Bluetooth Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Bluetooth Disabled Security Reporting string This attribute verifies that Bluetooth is disabled. #!/bin/sh if [ -d "/System/Library/Extensions/IOBluetoothFamily.kext" ]; then echo "<result>Fail (Bluetooth Files are Still Present at /System/Library/Extensions)</result>" else echo "<result>Pass (Bluetooth is disabled)</result>" fi \ No newline at end of file diff --git a/OS - Disable Action When Blank CD Inserted.xml b/OS - Disable Action When Blank CD Inserted.xml deleted file mode 100644 index 86636d9..0000000 --- a/OS - Disable Action When Blank CD Inserted.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Action When Blank CD Inserted Security Reporting string This attribute verifies that no action will take place when a blank CD is inserted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that no action will take place when a blank CD is inserted. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.digihub" keyName="com.apple.digihub.blank.cd.appeared" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep action | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/action=//g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable Action When Blank DVD Inserted.xml b/OS - Disable Action When Blank DVD Inserted.xml deleted file mode 100644 index 14c4a26..0000000 --- a/OS - Disable Action When Blank DVD Inserted.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Action When Blank DVD Inserted Security Reporting string This attribute verifies that no action will take place when a blank DVD is inserted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that no action will take place when a blank DVD is inserted. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.digihub" keyName="com.apple.digihub.blank.dvd.appeared" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep action | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/action=//g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable Action When Music CD Inserted.xml b/OS - Disable Action When Music CD Inserted.xml deleted file mode 100644 index ab8efab..0000000 --- a/OS - Disable Action When Music CD Inserted.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Action When Music CD Inserted Security Reporting string This attribute verifies that no action will take place when a music CD is inserted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that no action will take place when a music CD is inserted. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.digihub" keyName="com.apple.digihub.cd.music.appeared" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep action | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/action=//g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable Action When Picture CD Inserted.xml b/OS - Disable Action When Picture CD Inserted.xml deleted file mode 100644 index 5b54cc7..0000000 --- a/OS - Disable Action When Picture CD Inserted.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Action When Picture CD Inserted Security Reporting string This attribute verifies that no action will take place when a picture CD is inserted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that no action will take place when a picture CD is inserted. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.digihub" keyName="com.apple.digihub.picture.cd.appeared" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep action | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/action=//g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable Action When Video DVD Inserted.xml b/OS - Disable Action When Video DVD Inserted.xml deleted file mode 100644 index 5d9af9b..0000000 --- a/OS - Disable Action When Video DVD Inserted.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Action When Video DVD Inserted Security Reporting string This attribute verifies that no action will take place when a video DVD is inserted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that no action will take place when a video DVD is inserted. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.digihub" keyName="com.apple.digihub.dvd.video.appeared" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep action | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/action=//g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable Automatic Login.xml b/OS - Disable Automatic Login.xml deleted file mode 100644 index 286e8a2..0000000 --- a/OS - Disable Automatic Login.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Automatic Login Security Reporting string This attribute verifies that automatic login is disabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that automatic login is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="com.apple.login.mcx.DisableAutoLoginClient" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Disable CPU Kernel Core Dumps.xml b/OS - Disable CPU Kernel Core Dumps.xml deleted file mode 100644 index 901cb82..0000000 --- a/OS - Disable CPU Kernel Core Dumps.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable CPU Kernel Core Dumps Security Reporting string This attribute verifies that CPU kernel core dumping is disabled. #!/bin/sh desiredResult="kern.coredump=0" result=`cat /private/etc/stsclt.conf | grep "$desiredResult" | tail -1` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else if [ "$result" == "" ]; then echo "<result>Fail (CPU Kernel Core Dumping Enabled)</result>" else echo "<result>Fail ($result)</result>" fi fi \ No newline at end of file diff --git a/OS - Disable Insecure Login in Single User Mode.xml b/OS - Disable Insecure Login in Single User Mode.xml deleted file mode 100644 index ca702af..0000000 --- a/OS - Disable Insecure Login in Single User Mode.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable Insecure Login in Single User Mode Security Reporting string This extension attribute template will ensure that the /etc/ttys config file is set to disable insecure single user signon. #!/bin/sh lookFor="insecure" result=`cat /etc/ttys | grep "$lookFor" | tail -1` if [ "$result" == "$lookFor" ]; then echo "<result>Fail ($result)</result>" else echo "<result>Pass (No secure sign-on prefs found.)</result>" fi \ No newline at end of file diff --git a/OS - Disable SSH Login For Accounts With Blank Passwords.xml b/OS - Disable SSH Login For Accounts With Blank Passwords.xml deleted file mode 100644 index a63c752..0000000 --- a/OS - Disable SSH Login For Accounts With Blank Passwords.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Disable SSH Login For Accounts With Blank Passwords Security Reporting string This extension attribute will read the "PermitEmptyPasswords" setting in the file /etc/sshd_config. #!/bin/sh desiredResult="PermitEmptyPasswords no" result=`cat /private/etc/sshd_config | grep "$desiredResult" | tail -1` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Display Terminal Login Message.xml b/OS - Display Terminal Login Message.xml deleted file mode 100644 index 7d97107..0000000 --- a/OS - Display Terminal Login Message.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Display Terminal Login Message Security Reporting string This attribute displays the status of message of the day that is displayed when the Terminal application is launched. The value to be verified will need to be specified when creating this extension attribute. Example: "This Computer is Property of Company" verifies the message displayed upon Terminal login. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_This_Computer_is_Property_of_Company" actualValue=`cat /private/etc/motd` if [ "$actualValue" == "$desiredValue" ]; then echo "<result>Pass ($actualValue)</result>" else echo "<result>Fail ($actualValue)</result>" fi \ No newline at end of file diff --git a/OS - Empty Trash Securely.xml b/OS - Empty Trash Securely.xml deleted file mode 100644 index b4d22ef..0000000 --- a/OS - Empty Trash Securely.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Empty Trash Securely Security Reporting string This attribute verifies that the trash is set to empty securely. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the "Secure Empty Trash" option is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.finder" keyName="EmptyTrashSecurely" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Enabled System Preference Panes.xml b/OS - Enabled System Preference Panes.xml deleted file mode 100644 index 0642d0b..0000000 --- a/OS - Enabled System Preference Panes.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Enabled System Preference Panes Security Reporting string This attribute verifies the enabled system preference panes. The attribute is hardcoded to look for certain preference panes. To edit the verification criteria, add or remove values from the "desiredResult" variable. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredResult='( "com.apple.preference.datetime", "com.apple.preference.dock", "com.apple.preferences.sharing", "com.apple.preference.spotlight", "com.apple.preference.trackpad", "com.apple.preference.desktopscreeneffect", "com.apple.preference.printfax", "com.apple.preference.universalaccess", "com.apple.preference.speech", "com.apple.preference.network", "com.apple.preference.startupdisk", "com.apple.preferences.users", "com.apple.preference.ink", "com.apple.preference.displays", "com.apple.preference.energysaver", "com.apple.preference.sound", "com.apple.Localization", "com.apple.preference.keyboard", "com.apple.preference.quicktime", "com.apple.preferences.parentalcontrols", "com.apple.preference.expose", "com.apple.preference.general", "com.apple.preference.internet", "com.apple.prefpanel.fibrechannel", "com.apple.preference.mouse" )' lastUser=`last -1 -t console | awk '{print $1}'` result=`mcxquery -user "$lastUser" -format tab | grep EnabledPreferencePane | awk -F "\t" '{print $5}'` if [ "$desiredResult" == "$result" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Encrypt Virtual Memory.xml b/OS - Encrypt Virtual Memory.xml deleted file mode 100644 index bc9072c..0000000 --- a/OS - Encrypt Virtual Memory.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Encrypt Virtual Memory Security Reporting string This attribute verifies that the virtual memory is being encrypted. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the "Encrypt Virtual Memory" option is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.virtualMemory" keyName="UseEncryptedSwap" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Fast User Switching Disabled.xml b/OS - Fast User Switching Disabled.xml deleted file mode 100644 index c710b2d..0000000 --- a/OS - Fast User Switching Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Fast User Switching Disabled Security Reporting string This attribute verifies that fast user switching is disabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the "Fast User Switching" option is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" currentUser=`last -1 -t console | awk '{print $1}'` appDomain=".GlobalPreferences" keyName="MultipleSessionEnabled" result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="false" else if [ "$tmpResult" == "0" ]; then result="true" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - Firewall Timeout.xml b/OS - Firewall Timeout.xml deleted file mode 100644 index 098d08f..0000000 --- a/OS - Firewall Timeout.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Firewall Timeout Security Reporting string This extension attribute will verify that the firewall timeout is set to 3 seconds rather than the 5 minute default. #!/bin/sh desiredResult="3" if [ -f /usr/libexec/PlistBuddy ]; then result=`/usr/libexec/PlistBuddy -c "print rights:com.alf:timeout" /private/etc/authorization` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi else echo "<result>Please ensure that PlistBuddy is installed at /usr/libexec/PlistBuddy.</result>" fi \ No newline at end of file diff --git a/OS - Guest Account Disabled.xml b/OS - Guest Account Disabled.xml deleted file mode 100644 index 821040b..0000000 --- a/OS - Guest Account Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Guest Account Disabled Security Reporting string This attribute verifies that the guest account is disabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the guest account is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.MCX" keyName="DisableGuestAccount" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Internet Sharing Disabled.xml b/OS - Internet Sharing Disabled.xml deleted file mode 100644 index 8e24ce0..0000000 --- a/OS - Internet Sharing Disabled.xml +++ /dev/null @@ -1,10 +0,0 @@ -OS - Internet Sharing DisabledSecurity ReportingstringThis attribute verifies that internet sharing is disabled. -#!/bin/sh - -if [ "`/usr/libexec/PlistBuddy -c "Print :NAT:Enabled" /Library/Preferences/SystemConfiguration/com.apple.nat.plist`" == 1 ]; then - echo "<result>Fail (Internet Sharing Enabled)<result>" -else - echo "<result>Pass (Internet Sharing Disabled)<result>" -fi - - \ No newline at end of file diff --git a/OS - Log Authentication Errors.xml b/OS - Log Authentication Errors.xml deleted file mode 100644 index 7785a16..0000000 --- a/OS - Log Authentication Errors.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Log Authentication Errors Security Reporting string This extension attribute will verify that syslog has been configured to output authentication error messages to the system.log. #!/bin/sh desiredResult="auth.err /var/log/secure.log" result=`cat /private/etc/syslog.conf | grep "$desiredResult" | tail -1` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else if [ "$result" == "" ]; then echo "<result>Fail (Authentication Error Logging Not Enabled)</result>" else echo "<result>Fail ($result)</result>" fi fi \ No newline at end of file diff --git a/OS - Non Admins Can Install Printers.xml b/OS - Non Admins Can Install Printers.xml deleted file mode 100644 index b9a79a5..0000000 --- a/OS - Non Admins Can Install Printers.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Non Admins Can Install Printers Security Reporting string This extension attribute will verify that non-admin users can add printers. #!/bin/sh everyoneGroup=`/usr/bin/dscl . read /Groups/everyone GeneratedUID | sed 's/GeneratedUID: //g'` result=`/usr/bin/dscl . read /Groups/lpadmin | grep $everyoneGroup` if [ "$result" == "" ]; then echo "<result>Fail (Admin authentication required.)</result>" else echo "<result>Pass (Users can add printers)</result>" fi \ No newline at end of file diff --git a/OS - Number Of Recent Applications To Remember.xml b/OS - Number Of Recent Applications To Remember.xml deleted file mode 100644 index 7945be8..0000000 --- a/OS - Number Of Recent Applications To Remember.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Number Of Recent Applications To Remember Security Reporting string This extension attribute will verify the number of recent applications the Finder will remember. The value to be verified will need to be specified when creating this extension attribute. Example: "0" means that no recent applications will be remembered. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_0" appDomain="com.apple.recentitems" keyName="Applications" currentUser=`last -1 -t console | awk '{print $1}'` result="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep MaxAmount | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/MaxAmount=//g'`" if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Number Of Recent Documents To Remember.xml b/OS - Number Of Recent Documents To Remember.xml deleted file mode 100644 index 2221cfd..0000000 --- a/OS - Number Of Recent Documents To Remember.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Number Of Recent Documents To Remember Security Reporting string This extension attribute will verify the number of recent documents the Finder will remember. The value to be verified will need to be specified when creating this extension attribute. Example: "0" means that no recent documents will be remembered. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_0" appDomain="com.apple.recentitems" keyName="Documents" currentUser=`last -1 -t console | awk '{print $1}'` result="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep MaxAmount | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/MaxAmount=//g'`" if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Number Of Recent Servers To Remember.xml b/OS - Number Of Recent Servers To Remember.xml deleted file mode 100644 index 52f5cad..0000000 --- a/OS - Number Of Recent Servers To Remember.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Number Of Recent Servers To Remember Security Reporting string This extension attribute will verify the number of recent servers the Finder will remember. The value to be verified will need to be specified when creating this extension attribute. Example: "0" means that no recent servers will be remembered. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_0" appDomain="com.apple.recentitems" keyName="Servers" currentUser=`last -1 -t console | awk '{print $1}'` result="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep MaxAmount | sed -e 's/;//g'| sed -e 's/ //g'| sed -e 's/MaxAmount=//g'`" if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Only Logged In User Can Unlock Screensaver.xml b/OS - Only Logged In User Can Unlock Screensaver.xml deleted file mode 100644 index 6a23454..0000000 --- a/OS - Only Logged In User Can Unlock Screensaver.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Only Logged In User Can Unlock Screensaver Security Reporting string This extension attribute template will ensure that the screensaver unlock requires the owner of the session to unlock it. Default behavior is for any administrator to be able to unlock the screensaver. #!/bin/sh desiredResult="authenticate-session-owner" if [ -f /usr/libexec/PlistBuddy ]; then result=`/usr/libexec/PlistBuddy -c "print rights:system.login.screensaver:rule" /private/etc/authorization` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi else echo "<result>Please ensure that PlistBuddy is installed at /usr/libexec/PlistBuddy.</result>" fi \ No newline at end of file diff --git a/OS - Root Password Configured For Single User Mode.xml b/OS - Root Password Configured For Single User Mode.xml deleted file mode 100644 index 0bc502d..0000000 --- a/OS - Root Password Configured For Single User Mode.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Root Password Configured For Single User Mode Security Reporting string This extension attribute will verify if a password has been set for the root account for single user mode. The "SingleUserPass" variable should be set according to the password that has been set for single user mode in /private/etc/master.passwd. #!/bin/sh #Please note that the "SingleUserPass" variable should be set according to the password that has been set for single user mode in /private/etc/master.passwd SingleUserPass="EditFromTemplate_Single_User_Mode_Root_Password" if [ "$SingleUserPass" == "" ]; then echo "<result>Please ensure all variables are set in the extension attribute script.</result>" else result=`cat /private/etc/master.passwd | grep "$SingleUserPass"` if [ "$result" != "" ]; then echo "<result>Pass (Root Password Configured For Single User Mode)</result>" else echo "<result>Fail (Password Not Set.)</result>" fi fi \ No newline at end of file diff --git a/OS - SSH Root Login Disabled.xml b/OS - SSH Root Login Disabled.xml deleted file mode 100644 index fdbe71d..0000000 --- a/OS - SSH Root Login Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - SSH Root Login Disabled Security Reporting string This extension attribute template will verify that root login over SSH is disabled. #!/bin/sh desiredResult="PermitRootLogin no" result=`cat /private/etc/sshd_config | grep -w "$desiredResult" | tail -1` if [ "$result" == "$desiredResult" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OS - SSH Session Closes After X Seconds Without Successful Authentication.xml b/OS - SSH Session Closes After X Seconds Without Successful Authentication.xml deleted file mode 100644 index 0825265..0000000 --- a/OS - SSH Session Closes After X Seconds Without Successful Authentication.xml +++ /dev/null @@ -1 +0,0 @@ - OS - SSH Session Closes After X Seconds Without Successful Authentication Security Reporting string This extension attribute will verify the number of seconds to wait before an SSH connection closes without successful authentication. The value to be verified will need to be specified when creating this extension attribute. Example: "30" means that an SSH session will wait 30 seconds for a user to successfully authenticate before requiring a new session. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_30" targetPath="/etc/sshd_config" targetParameter="LoginGraceTime" if [ -f "$targetPath" ]; then result="`cat \"$targetPath\" | grep -w \"^$targetParameter\"| awk {'print $2'}`" if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi else echo "<result>File or Directory (\"$targetPath\") does not exist.</result>" fi \ No newline at end of file diff --git a/OS - Spotlight Disabled.xml b/OS - Spotlight Disabled.xml deleted file mode 100644 index f53fdcf..0000000 --- a/OS - Spotlight Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Spotlight Disabled Security Reporting string This extension attribute template will verify that spotlight indexing is disabled. #!/bin/sh launchAgent="" menuBar="" indexingStatus=`/usr/bin/mdutil -s / | grep "Indexing"` if [ -f "/System/Library/LaunchAgents/com.apple.Spotlight.plist" ]; then launchAgent="true" else launchAgent="false" fi if [ -d "/System/Library/CoreServices/Spotlight.app" ]; then menuBar="true" elif [ -d "/System/Library/CoreServices/Search.bundle" ]; then menuBar="true" else menuBar="false" fi if [ "$launchAgent" == "true" ] || [ "$menubar" == "true" ] || [ "indexingStatus" == "Indexing enabled." ]; then echo "<result>menuBar: $menuBar LaunchAgent: $launchAgent indexing status: $indexingStatus - Fail (Spotlight Enabled)</result>" else echo "<result>Pass (Spotlight Disabled)</result>" fi \ No newline at end of file diff --git a/OS - Use Computer Name For Computer Record Name.xml b/OS - Use Computer Name For Computer Record Name.xml deleted file mode 100644 index 2dc05b6..0000000 --- a/OS - Use Computer Name For Computer Record Name.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Use Computer Name For Computer Record Name Security Reporting string This attribute verifies that the setting "Use Computer Name for Record Name" is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the setting is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="UseComputerNameForComputerRecordName" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Use Network Time Server.xml b/OS - Use Network Time Server.xml deleted file mode 100644 index 8ba6059..0000000 --- a/OS - Use Network Time Server.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Use Network Time Server Security Reporting string This attribute verifies that the setting "Use Network Time Server" is enabled. #!/bin/sh desiredValue="On" result="" tmpResult="`systemsetup -getusingnetworktime | awk '{print $3}'`" if [ "$tmpResult" == "$desiredValue" ]; then result="true" else result="false" fi if [ "$result" == "true" ]; then echo "<result>Pass ($tmpResult) </result>" else echo "<result>Fail ($tmpResult) </result>" fi \ No newline at end of file diff --git a/OS - User Home Directory Permitted On Alternate Device.xml b/OS - User Home Directory Permitted On Alternate Device.xml deleted file mode 100644 index 569720c..0000000 --- a/OS - User Home Directory Permitted On Alternate Device.xml +++ /dev/null @@ -1 +0,0 @@ - OS - User Home Directory Permitted On Alternate Device Security Reporting string This attribute verifies whether or not user home directories are permitted on an alternate device. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that home directories are not permitted on external devices. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.loginwindow" keyName="EnableExternalAccounts" result="" tmpResult="`dscl . mcxread /Computers/localhost \"$appDomain\" \"$keyName\" |grep Value:| awk {'print $2'}`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result) </result>" else echo "<result>Fail ($result) </result>" fi \ No newline at end of file diff --git a/OS - Verify Time Server.xml b/OS - Verify Time Server.xml deleted file mode 100644 index ef85aa2..0000000 --- a/OS - Verify Time Server.xml +++ /dev/null @@ -1 +0,0 @@ - OS - Verify Time Server Security Reporting string This attribute verifies that time server that is set in the OS. The value to be verified will need to be specified when creating this extension attribute. Example: "time.apple.com" verifies that the time server is set to "time.apple.com". #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_time.apple.com" result="" tmpResult="`systemsetup -getnetworktimeserver | awk '{print $4}'`" if [ "$tmpResult" == "$desiredValue" ]; then result="true" else result="false" fi if [ "$result" == "true" ]; then echo "<result>Pass ($tmpResult) </result>" else echo "<result>Fail ($tmpResult) </result>" fi \ No newline at end of file diff --git a/OS - iDisk Access Disabled.xml b/OS - iDisk Access Disabled.xml deleted file mode 100644 index aa8a31f..0000000 --- a/OS - iDisk Access Disabled.xml +++ /dev/null @@ -1 +0,0 @@ - OS - iDisk Access Disabled Security Reporting string This attribute verifies that the iDisk access is disabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that iDisk access is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.finder" keyName="ProhibitGoToiDisk" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/OmniFocus Serial Number.xml b/OmniFocus Serial Number.xml deleted file mode 100644 index ffd0d51..0000000 --- a/OmniFocus Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - OmniFocus Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for OmniFocus. #!/bin/sh if [ -d "/Library/Application Support/Omni Group/Software Licenses/" ]; then result=`cat /Library/Application\ Support/Omni\ Group/Software\ Licenses/OmniFocus*.omnilicense | grep -A 1 Key | grep string | sed 's/<string>//g' | sed 's/<\/string>//g' | awk '{print $1}'` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/OmniGraffle Serial Number.xml b/OmniGraffle Serial Number.xml deleted file mode 100644 index 2213e5e..0000000 --- a/OmniGraffle Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - OmniGraffle Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for OmniGraffle. #!/bin/sh if [ -d "/Library/Application Support/Omni Group/Software Licenses/" ]; then result=`cat /Library/Application\ Support/Omni\ Group/Software\ Licenses/OmniGraffle*.omnilicense | grep -A 1 Key | grep string | sed 's/<string>//g' | sed 's/<\/string>//g' | awk '{print $1}'` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/OmniOutliner Serial Number.xml b/OmniOutliner Serial Number.xml deleted file mode 100644 index ccf3f82..0000000 --- a/OmniOutliner Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - OmniOutliner Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for OmniOutliner. #!/bin/sh if [ -d "/Library/Application Support/Omni Group/Software Licenses/" ]; then result=`cat /Library/Application\ Support/Omni\ Group/Software\ Licenses/OmniOutliner*.omnilicense | grep -A 1 Key | grep string | sed 's/<string>//g' | sed 's/<\/string>//g' | awk '{print $1}'` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/OmniPlan Serial Number.xml b/OmniPlan Serial Number.xml deleted file mode 100644 index c559885..0000000 --- a/OmniPlan Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - OmniPlan Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for OmniPlan. #!/bin/sh if [ -d "/Library/Application Support/Omni Group/Software Licenses/" ]; then result=`cat /Library/Application\ Support/Omni\ Group/Software\ Licenses/OmniOutliPlan*.omnilicense | grep -A 1 Key | grep string | sed 's/<string>//g' | sed 's/<\/string>//g' | awk '{print $1}'` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/OpenSSL-Info.xml b/OpenSSL-Info.xml index 15a8c78..af044b4 100644 --- a/OpenSSL-Info.xml +++ b/OpenSSL-Info.xml @@ -1,18 +1,22 @@ -OpenSSL-Info -This will display information regarding the OpenSSL Info on the Mac systems during inventory. -string -#!/bin/sh -# -############################################################################ -# Extension Attribute checks the OpenSSL Version number -# Cobbled together from other's hard work, by Christopher Miller -# for ITSD-ISS of JHU-APL, Dated: 2014-06-13 -############################################################################ -OpenSSLVersion=$(openssl version | awk '{print $2}') -echo "<result>$OpenSSLVersion</result>" - -exit 0 - + OpenSSL-Info + Reports the full /usr/bin/openssl version string (vendor + version + build date). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# OpenSSL-Info Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# /usr/bin/openssl is LibreSSL on every modern macOS (Apple replaced +# OpenSSL years ago). Reports the LibreSSL version it identifies as, +# which differs from upstream OpenSSL release numbering. + +if /usr/bin/openssl version &>/dev/null; then + info=$(/usr/bin/openssl version 2>/dev/null) + echo "<result>${info}</result>" +else + echo "<result>Unknown</result>" +fi + diff --git a/OpenSSL_Version.xml b/OpenSSL_Version.xml index 93dc641..83d6f94 100644 --- a/OpenSSL_Version.xml +++ b/OpenSSL_Version.xml @@ -1,9 +1,23 @@ -OpenSSL Version -Checks the OpenSSL version. -string -#!/bin/sh - echo "<result>`/usr/bin/openssl version | awk '{print $2}'`</result>" - + OpenSSL Version + Reports the /usr/bin/openssl version number. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# OpenSSL Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# /usr/bin/openssl is LibreSSL on every modern macOS (Apple replaced +# OpenSSL years ago). Reports the LibreSSL version it identifies as, +# which differs from upstream OpenSSL release numbering. + +if /usr/bin/openssl version &>/dev/null; then + info=$(/usr/bin/openssl version 2>/dev/null) + version=$(echo "$info" | /usr/bin/awk '{print $2}') + echo "<result>${version}</result>" +else + echo "<result>Unknown</result>" +fi + diff --git a/Oracle_Java_8_JDK.xml b/Oracle_Java_8_JDK.xml deleted file mode 100644 index 5f8d7d1..0000000 --- a/Oracle_Java_8_JDK.xml +++ /dev/null @@ -1,26 +0,0 @@ - -Oracle Java 8 JDK -Returns the installed version of Oracle Java 8 JDK -string -#!/bin/bash - -ExtensionVersion="" -# Find all the JDKs -# Cut out the directory slashes from the find command -# Sort the results in reverse order -# Get the first result from the sort -# Cut that value to a "1.8.0_45" format -if [ -d /Library/Java/JavaVirtualMachines ]; then - cd /Library/Java/JavaVirtualMachines - ExtensionVersion=$(find ./ -d 1 -name "*.jdk" | grep -v '1.6.0' | cut -d '/' -f3 | sort -r | head -n 1 | cut -d '.' -f1,2,3 | cut -d 'k' -f2 ) -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - diff --git a/Outlook_Storage.xml b/Outlook_Storage.xml index 965ec3e..11b2911 100644 --- a/Outlook_Storage.xml +++ b/Outlook_Storage.xml @@ -1,21 +1,30 @@ - -Outlook Storage -This attribute detects of the user's Outlook is set to show "On My Computer". If "On My Computer" is set to show then it's likely that the user is storing emails to their local hard drive. If "On My Computer" is set to hide then the user is not able to store emails to their local hard drive. - -This attribute can have three possible values: 1) none - Outlook is not configured 2) local - Outlook possibly storing emails to local hard drive 3) cloud - Outlook not storing emails to local hard drive. -string -#!/bin/sh -# by Meza Hsu 2017.11.21 -# Find if user's Outlook is set to use local storage -LoggedInUser=$(/usr/bin/stat -f %Su "/dev/console") -status=$(/usr/bin/defaults read /Users/"$LoggedInUser"/Library/Containers/com.microsoft.Outlook/Data/Library/Preferences/com.microsoft.Outlook HideFoldersOnMyComputerRootInFolderList) -if [ "$status" = 1 ]; then - OutlookStorage="cloud" -elif [ "$status" = 0 ]; then - OutlookStorage="local" -else - OutlookStorage="none" -fi -echo "<result>$OutlookStorage</result>" - - + + + Outlook Storage + Reports whether Outlook for Mac shows "On My Computer" folders, which lets users store mail locally. Values: "cloud" (hidden), "local" (visible), "none" (not configured). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Outlook Storage Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Outlook for Mac is sandboxed; its prefs live in +# Containers/com.microsoft.Outlook/Data/Library/Preferences. Some legacy +# (non-sandboxed) installs still write to ~/Library/Preferences directly. + +user=$(/usr/bin/stat -f %Su /dev/console 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +containerPlist="$home/Library/Containers/com.microsoft.Outlook/Data/Library/Preferences/com.microsoft.Outlook" +legacyPlist="$home/Library/Preferences/com.microsoft.Outlook" + +status=$(/usr/bin/defaults read "$containerPlist" HideFoldersOnMyComputerRootInFolderList 2>/dev/null) +[[ -z "$status" ]] && status=$(/usr/bin/defaults read "$legacyPlist" HideFoldersOnMyComputerRootInFolderList 2>/dev/null) + +case "$status" in + 1) echo "<result>cloud</result>" ;; + 0) echo "<result>local</result>" ;; + *) echo "<result>none</result>" ;; +esac + + diff --git a/PGP - Check Enrolled Users.xml b/PGP - Check Enrolled Users.xml deleted file mode 100644 index e269a44..0000000 --- a/PGP - Check Enrolled Users.xml +++ /dev/null @@ -1 +0,0 @@ - PGP - Check Enrolled Users Disk Encryption string This attribute returns the enrolled User Names to PGP on the local computer. #!/bin/sh #This script has been verified to work on PGP (v 10). #Check to see if PGP is installed if [ -f "/usr/local/bin/pgpwde" ]; then result=`/usr/local/bin/pgpwde --status | grep Encrypt` if [ "$result" == "" ]; then result=`/usr/local/bin/pgpwde --list-users | grep "User" | cut -c 16-` echo "<result>$result</result>" else echo "<result>$result</result>" fi \ No newline at end of file diff --git a/PGP - Check Software Version.xml b/PGP - Check Software Version.xml deleted file mode 100644 index bb22bb9..0000000 --- a/PGP - Check Software Version.xml +++ /dev/null @@ -1 +0,0 @@ - PGP - Check Software Version Disk Encryption string This attribute will report the version of the PGP Whole Disk Encryption is installed on the client computer. #!/bin/sh #This script has been verified to work on PGP (v 10). #Check to see if PGP is installed if [ -f "/usr/local/bin/pgpwde" ]; then result=`/usr/local/bin/pgpwde --status | grep Encrypt` if [ "$result" == "" ]; then result=`/usr/local/bin/pgpwde --version | grep "PGP WDE"` echo "$result" else echo "$result" fi \ No newline at end of file diff --git a/PGP - Encryption Percentage.xml b/PGP - Encryption Percentage.xml deleted file mode 100644 index 931b14e..0000000 --- a/PGP - Encryption Percentage.xml +++ /dev/null @@ -1 +0,0 @@ - PGP - Encryption Percentage Disk Encryption This attribute returns the Disk Encryption Percentage for PGP. This attribute template applies to PGP (v 10). integer #!/bin/sh #This script has been verified to work on PGP (v 10). #Check to see if PGP is installed if [ -f "/usr/local/bin/pgpwde" ]; then todo=`/usr/local/bin/pgpwde --disk-status | grep "Total sectors" | awk '{print $3}'` done=`/usr/local/bin/pgpwde --disk-status | grep "highwatermark" | awk '{print $5}'` result=$( echo "scale=4; ($done / $todo) * 100" | bc | cut -c 1-4 ) if [ "$result" == "" ]; then echo "<result>Disk is not instrumented.</result>" else echo "<result>$result</result>" fi else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/PGP - Encryption Status.xml b/PGP - Encryption Status.xml deleted file mode 100644 index 3893fd5..0000000 --- a/PGP - Encryption Status.xml +++ /dev/null @@ -1 +0,0 @@ - PGP - Encryption Status Disk Encryption This attribute returns the Disk Encryption Status for PGP on the boot disk. Examples of returned values include: "Encryption process is running in the background.", "Encryption process interrupted by user request", "Encryption removal process is running in the background", and "Encryption remove process interrupted by user request". This attribute template applies to PGP (v 10). string #!/bin/sh #This script has been verified to work on PGP (v 10). #Check to see if PGP is installed if [ -f "/usr/local/bin/pgpwde" ]; then result=`/usr/local/bin/pgpwde --disk-status | grep Encrypt` if [ "$result" == "" ]; then result=`/usr/local/bin/pgpwde --disk-status | grep "instrumented"` echo "<result>$result</result>" else echo "<result>$result</result>" fi else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/Parallels Windows VM Inventory.xml b/Parallels Windows VM Inventory.xml index add7663..ac77b07 100644 --- a/Parallels Windows VM Inventory.xml +++ b/Parallels Windows VM Inventory.xml @@ -1,6 +1,31 @@ - Parallels Windows VM Application Inventory Virtualization This attribute displays the inventory of a Windows virtual machine in Parallels Desktop for Mac. string #!/bin/sh currentUser=`ls -l /dev/console | awk {'print $3'}` -sharedApplicationDir=`ls /Users/$currentUser/Applications\ \(Parallels\)/ | grep {` -sharedBaseDir="/Users/$currentUser/Applications (Parallels)" -individualApplicationDir= + + + Parallels Windows VM Application Inventory + Virtualization + Lists Windows applications published via Parallels Desktop for Mac's Coherence/Shared Applications folder. + string + #!/bin/zsh -echo "<result>`ls "$baseDir/$applicationDir" | grep .app`</result>" \ No newline at end of file +# Updated by SecurityShrimp 2026 +# Parallels Windows VM Inventory Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Parallels publishes Windows apps as .app shims into +# ~/Applications (Parallels)/{VM Name}/. The original script had +# undefined variables; we walk every VM's shared apps folder. + +user=$(/usr/bin/stat -f %Su /dev/console 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +baseDir="$home/Applications (Parallels)" + +if [[ ! -d "$baseDir" ]]; then + echo "<result>Not Installed</result>" + exit 0 +fi + +apps=$(/usr/bin/find "$baseDir" -maxdepth 2 -name '*.app' -not -name '*Tools*' 2>/dev/null \ + | /usr/bin/awk -F/ '{print $NF}' | /usr/bin/sort -u | /usr/bin/paste -sd '\n' -) + +echo "<result>${apps:-No VMs Configured}</result>" + + diff --git a/Power Save - CPU Sleep Time.xml b/Power Save - CPU Sleep Time.xml deleted file mode 100644 index 7d4b350..0000000 --- a/Power Save - CPU Sleep Time.xml +++ /dev/null @@ -1 +0,0 @@ - Power Save - CPU Sleep Time Power Management This attribute checks for the CPU Sleep Time configured in Faronics Power Save. Values returned are an integer in a number of minutes. This attribute has been tested with Power Save 2.0. integer #!/bin/sh psUsername="EditFromTemplate_Power_Save_Service_Account_Username" psPassword="EditFromTemplate_Power_Save_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/PowerSave/CLI" ]; then psCPUSleep=`"/Library/Application Support/Faronics/PowerSave/CLI" $psUsername $psPassword status | grep "CPU Sleep" | awk '{print $4}'` fi echo "<result>$psCPUSleep</result>" \ No newline at end of file diff --git a/Power Save - Check For Updates.xml b/Power Save - Check For Updates.xml deleted file mode 100644 index d3e0cb9..0000000 --- a/Power Save - Check For Updates.xml +++ /dev/null @@ -1 +0,0 @@ - Power Save - Check For Updates Power Management This attribute checks for updates of Faronics Power Save. This attribute has been tested with Power Save 2.0. string #!/bin/sh psUsername="EditFromTemplate_Power_Save_Service_Account_Username" psPassword="EditFromTemplate_Power_Save_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/PowerSave/CLI" ]; then psUpdateCheck=`"/Library/Application Support/Faronics/PowerSave/CLI" "$psUsername" "$psPassword" checkForUpdates` fi echo "<result>$psUpdateCheck</result>" \ No newline at end of file diff --git a/Power Save - Display Sleep Time.xml b/Power Save - Display Sleep Time.xml deleted file mode 100644 index 4f398d8..0000000 --- a/Power Save - Display Sleep Time.xml +++ /dev/null @@ -1 +0,0 @@ - Power Save - Display Sleep Time Power Management This attribute checks for the Display Sleep Time configured in Faronics Power Save. Values returned are an integer in a number of minutes. This attribute has been tested with Power Save 2.0. integer #!/bin/sh psUsername="EditFromTemplate_Power_Save_Service_Account_Username" psPassword="EditFromTemplate_Power_Save_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/PowerSave/CLI" ]; then psDisplaySleep=`"/Library/Application Support/Faronics/PowerSave/CLI" $psUsername $psPassword status | grep "Display Sleep" | awk '{print $4}'` fi echo "<result>$psDisplaySleep</result>" \ No newline at end of file diff --git a/Power Save - Status.xml b/Power Save - Status.xml deleted file mode 100644 index b91f62f..0000000 --- a/Power Save - Status.xml +++ /dev/null @@ -1 +0,0 @@ - Power Save - Status Power Management This attribute displays the status of Faronics Power Save. Values returned include "Enabled" and "Disabled". This attribute has been tested with Power Save 2.0. string #!/bin/sh psUsername="EditFromTemplate_Power_Save_Service_Account_Username" psPassword="EditFromTemplate_Power_Save_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/PowerSave/CLI" ]; then psStatus=`"/Library/Application Support/Faronics/PowerSave/CLI" "$psUsername" "$psPassword" status | grep "Application Enabled" | awk '{print $3}'` if [ "$psStatus" == "false" ]; then result="Disabled" else result="Enabled" fi fi echo "<result>$result</result>" \ No newline at end of file diff --git a/Power Save - Version.xml b/Power Save - Version.xml deleted file mode 100644 index e288808..0000000 --- a/Power Save - Version.xml +++ /dev/null @@ -1 +0,0 @@ - Power Save - Version Power Management This attribute displays the version of Faronics Power Save that is installed. This attribute has been tested with Power Save 2.0. integer #!/bin/sh psUsername="EditFromTemplate_Power_Save_Service_Account_Username" psPassword="EditFromTemplate_Power_Save_Service_Account_Password" if [ -f "/Library/Application Support/Faronics/PowerSave/CLI" ]; then psVersion=`"/Library/Application Support/Faronics/PowerSave/CLI" "$psUsername" "$psPassword" version | awk '{print $3}'` fi echo "<result>$psVersion</result>" \ No newline at end of file diff --git a/Power_Source.xml b/Power_Source.xml index 173ac93..db63597 100644 --- a/Power_Source.xml +++ b/Power_Source.xml @@ -1,31 +1,18 @@ -Power Source -Check to see whether the system is running on Battery or AC Power. -string -#!/bin/bash -########################################### -# Check to see where power -# is drawing on system -# 'Battery Power' vs. 'AC Power' -########################################### -# by Christopher Miller -# for ITSD-ISS of JHU-APL -# Dated: 2016-05-24, last Mod: -# Cobbled together from other's hard work -########################################### - -#Use the power management to check -PowerUP=$(pmset -g batt | head -n 1) - -#Find the time this was checked -ShotTime=$(/bin/date) - -#Put it together -result=$(echo "$PowerUP" on "$ShotTime") - -echo "<result>$result</result>" - -exit 0 - + Power Source + Reports whether the system is currently drawing from AC or battery. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Power Source Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# pmset -g ps prints "Now drawing from 'AC Power'" or "'Battery Power'". +# Desktops without batteries always report "AC Power". + +source=$(/usr/bin/pmset -g ps 2>/dev/null | /usr/bin/awk -F"'" '/Now drawing/ { print $2; exit }') + +echo "<result>${source:-Unknown}</result>" + diff --git a/PresSTORE - Backup Size.xml b/PresSTORE - Backup Size.xml index 7d0d081..50dc6de 100644 --- a/PresSTORE - Backup Size.xml +++ b/PresSTORE - Backup Size.xml @@ -1,20 +1,33 @@ -PresSTORE - Backup Size BackupdateThis attribute displays the size of the PresSTORE archive. This attribute is compatible with PresSTORE 4.3 and higher. This attribute applies to Mac only. -#!/bin/sh + + + PresSTORE - Backup Size + Backup + date + Total size of the PresSTORE archive (KB), or "Not installed". + #!/bin/zsh -if [ -f /usr/local/aw/bin/nsdchat ]; then - cd /usr/local/aw - workstation=`bin/nsdchat -c Server names` - size=`bin/nsdchat -c Server $workstation totalkbytes` +# Updated by SecurityShrimp 2026 +# PresSTORE - Backup Size Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Archiware PresSTORE installs its CLI (nsdchat) under /usr/local/aw on +# both Intel and Apple Silicon. Modern PresSTORE is now sold as P5 with +# the same CLI path. - if [ "$size" == "" ]; then - echo "<result>O KB</result>" - else - echo "<result>$size KB</result>" - fi +nsdchat="/usr/local/aw/bin/nsdchat" -else - echo "<result>Not installed</result>" +if [[ ! -x "$nsdchat" ]]; then + echo "<result>Not installed</result>" + exit 0 fi - - \ No newline at end of file +cd /usr/local/aw 2>/dev/null || exit 0 +workstation=$("$nsdchat" -c Server names 2>/dev/null) +size=$("$nsdchat" -c Server "$workstation" totalkbytes 2>/dev/null) + +if [[ -z "$size" ]]; then + echo "<result>0 KB</result>" +else + echo "<result>${size} KB</result>" +fi + + diff --git a/PresSTORE - Last Backup End Time.xml b/PresSTORE - Last Backup End Time.xml index 7fb4bb2..86235a1 100644 --- a/PresSTORE - Last Backup End Time.xml +++ b/PresSTORE - Last Backup End Time.xml @@ -1,24 +1,36 @@ -PresSTORE - Last Backup End TimeBackupdateThis attribute displays the last time the client finished submitting a backup to the server. This attribute is compatible with PresSTORE 4.3 and higher. This attribute applies to Mac only. -#!/bin/sh + + + PresSTORE - Last Backup End Time + Backup + date + End time of the most recent PresSTORE backup, with error count. + #!/bin/zsh -if [ -f /usr/local/aw/bin/nsdchat ]; then - cd /usr/local/aw - workstation=`bin/nsdchat -c Server names` - lastend=`bin/nsdchat -c Server $workstation lastend` - lasterror=`bin/nsdchat -c Server $workstation lasterror` +# Updated by SecurityShrimp 2026 +# PresSTORE Last Backup End Time Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon - if [ "$lastend" != "" ] && [ "$lasterror" == "<empty>" ]; then - lastenddate=`date -j -f %s $lastend +"%Y/%m/%d %H:%M:%S"` - echo "<result>Last backup ended $lastenddate with no errors.</result>" - else - lastenddate=`date -j -f %s $lastend +"%m/%d/%y %H:%M:%S"` - echo "<result>Last backup ended $lastenddate with $lasterror error(s).</result>" - fi +nsdchat="/usr/local/aw/bin/nsdchat" - +if [[ ! -x "$nsdchat" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +cd /usr/local/aw 2>/dev/null || exit 0 +workstation=$("$nsdchat" -c Server names 2>/dev/null) +lastend=$("$nsdchat" -c Server "$workstation" lastend 2>/dev/null) +lasterror=$("$nsdchat" -c Server "$workstation" lasterror 2>/dev/null) -else - echo "<result>Not installed</result>" +if [[ -n "$lastend" ]]; then + isoDate=$(/bin/date -j -f %s "$lastend" "+%Y/%m/%d %H:%M:%S" 2>/dev/null) + if [[ "$lasterror" == "<empty>" || -z "$lasterror" ]]; then + echo "<result>Last backup ended $isoDate with no errors.</result>" + else + echo "<result>Last backup ended $isoDate with $lasterror error(s).</result>" + fi +else + echo "<result>No backups recorded</result>" fi - - \ No newline at end of file + + diff --git a/PresSTORE - Last Backup Start Time.xml b/PresSTORE - Last Backup Start Time.xml index aece564..f8b4f08 100644 --- a/PresSTORE - Last Backup Start Time.xml +++ b/PresSTORE - Last Backup Start Time.xml @@ -1,18 +1,31 @@ -PresSTORE - Last Backup Start TimeBackupdateThis attribute displays the last time the client started to submit a backup to the server. This attribute is compatible with PresSTORE 4.3 and higher. This attribute applies to Mac only. -#!/bin/sh + + + PresSTORE - Last Backup Start Time + Backup + date + Start time of the most recent PresSTORE backup, as ISO 8601. + #!/bin/zsh -if [ -f /usr/local/aw/bin/nsdchat ]; then - cd /usr/local/aw - workstation=`bin/nsdchat -c Server names` - lastbegin=`bin/nsdchat -c Server $workstation lastbegin` +# Updated by SecurityShrimp 2026 +# PresSTORE Last Backup Start Time Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon - if [ "$lastbegin" != "" ]; then - lastbegindate=`date -j -f %s $lastbegin +"%Y/%m/%d %H:%M:%S"` - echo "<result>$lastbegindate</result>" - fi +nsdchat="/usr/local/aw/bin/nsdchat" -else - echo "<result>Not installed</result>" +if [[ ! -x "$nsdchat" ]]; then + echo "<result>Not installed</result>" + exit 0 fi - - \ No newline at end of file + +cd /usr/local/aw 2>/dev/null || exit 0 +workstation=$("$nsdchat" -c Server names 2>/dev/null) +lastbegin=$("$nsdchat" -c Server "$workstation" lastbegin 2>/dev/null) + +if [[ -n "$lastbegin" ]]; then + isoDate=$(/bin/date -j -f %s "$lastbegin" "+%Y/%m/%d %H:%M:%S" 2>/dev/null) + echo "<result>$isoDate</result>" +else + echo "<result>No backups recorded</result>" +fi + + diff --git a/PresSTORE - Next Backup Time.xml b/PresSTORE - Next Backup Time.xml index ef2d081..59fe58b 100644 --- a/PresSTORE - Next Backup Time.xml +++ b/PresSTORE - Next Backup Time.xml @@ -1,18 +1,31 @@ -PresSTORE - Next Backup TimeBackupdateThis attribute displays the next time PresSTORE will run a backup. This attribute is compatible with PresSTORE 4.3 and higher. This attribute applies to Mac only. -#!/bin/sh + + + PresSTORE - Next Backup Time + Backup + date + Time of the next scheduled PresSTORE backup, as ISO 8601. + #!/bin/zsh -if [ -f /usr/local/aw/bin/nsdchat ]; then - cd /usr/local/aw - workstation=`bin/nsdchat -c Server names` - nextbackup=`bin/nsdchat -c Server $workstation nextrun` +# Updated by SecurityShrimp 2026 +# PresSTORE Next Backup Time Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon - if [ "$nextbackup" != "" ]; then - nextbackupdate=`date -j -f %s $nextbackup +"%Y/%m/%d %H:%M:%S"` - echo "<result>$nextbackupdate</result>" - fi +nsdchat="/usr/local/aw/bin/nsdchat" -else - echo "<result>Not installed</result>" +if [[ ! -x "$nsdchat" ]]; then + echo "<result>Not installed</result>" + exit 0 fi - - \ No newline at end of file + +cd /usr/local/aw 2>/dev/null || exit 0 +workstation=$("$nsdchat" -c Server names 2>/dev/null) +nextbackup=$("$nsdchat" -c Server "$workstation" nextrun 2>/dev/null) + +if [[ -n "$nextbackup" ]]; then + isoDate=$(/bin/date -j -f %s "$nextbackup" "+%Y/%m/%d %H:%M:%S" 2>/dev/null) + echo "<result>$isoDate</result>" +else + echo "<result>No scheduled backups</result>" +fi + + diff --git a/PresSTORE - Number of Selected Files.xml b/PresSTORE - Number of Selected Files.xml index 102b37c..387821e 100644 --- a/PresSTORE - Number of Selected Files.xml +++ b/PresSTORE - Number of Selected Files.xml @@ -1,19 +1,30 @@ -PresSTORE - Number of Selected FilesBackupdateThis attribute displays the number of files PresSTORE has selected to back up. This attribute is compatible with PresSTORE 4.3 and higher. This attribute applies to Mac only. -#!/bin/sh + + + PresSTORE - Number of Selected Files + Backup + date + Count of files PresSTORE has selected for backup. + #!/bin/zsh -if [ -f /usr/local/aw/bin/nsdchat ]; then - cd /usr/local/aw - workstation=`bin/nsdchat -c Server names` - files=`bin/nsdchat -c Server $workstation totalfiles` +# Updated by SecurityShrimp 2026 +# PresSTORE Number of Selected Files Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon - if [ "$files" == "" ]; then - echo "<result>O Files</result>" - else - echo "<result>$files Files</result>" - fi +nsdchat="/usr/local/aw/bin/nsdchat" -else - echo "<result>Not installed</result>" +if [[ ! -x "$nsdchat" ]]; then + echo "<result>Not installed</result>" + exit 0 fi - - \ No newline at end of file + +cd /usr/local/aw 2>/dev/null || exit 0 +workstation=$("$nsdchat" -c Server names 2>/dev/null) +files=$("$nsdchat" -c Server "$workstation" totalfiles 2>/dev/null) + +if [[ -z "$files" ]]; then + echo "<result>0 Files</result>" +else + echo "<result>${files} Files</result>" +fi + + diff --git a/Pro Tools - Version.xml b/Pro Tools - Version.xml index b88fe0f..2fa08a5 100644 --- a/Pro Tools - Version.xml +++ b/Pro Tools - Version.xml @@ -1 +1,27 @@ - Pro Tools - Version string Gets the Installed version of Pro Tools. #!/bin/sh PTversion=`defaults read /Applications/Avid/Pro\ Tools/Pro\ Tools.app/Contents/version CFBundleShortVersionString` echo "$PTversion" \ No newline at end of file + + + Pro Tools - Version + string + Installed Avid Pro Tools version (CFBundleShortVersionString), or "Not Installed". + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Pro Tools Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Recent Pro Tools (2023+) is "Pro Tools.app" at the top of /Applications; +# older installers nested it under /Applications/Avid/Pro Tools/. + +for plist in \ + "/Applications/Pro Tools.app/Contents/Info.plist" \ + "/Applications/Avid/Pro Tools/Pro Tools.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>Not Installed</result>" + + diff --git a/Pulse_Secure_Version.xml b/Pulse_Secure_Version.xml index 34a42fe..ee6707f 100644 --- a/Pulse_Secure_Version.xml +++ b/Pulse_Secure_Version.xml @@ -1,29 +1,40 @@ - -Pulse Secure Version -Extension Attribute checks for the release version of Pulse Secure Application installed {formerly known as Junos Pulse} -string -#!/bin/sh -############################################################################ -# Extension Attribute checks SSL-VPN Version number. -############################################################################ -AppFound="false" - -# Look for the older name App -if [ -e "/Applications/Junos Pulse.app" ]; then -SSLVPN_Version=$(cat "/Applications/Junos Pulse.app/Contents/Resources/JunosPulseCoreVersion.ini" | grep DisplayVersion | cut -c 16-); AppFound="true" - -# Look for the newer name App -elif [ -e "/Applications/Pulse Secure.app" ]; then -SSLVPN_Version=$(cat "/Applications/Pulse Secure.app/Contents/Resources/PulseSecureCoreVersion.ini" | grep DisplayVersion | cut -c 16-); AppFound="true" - -# If neither found, then say so -elif [ AppFound == "false" ]; then -SSLVPN_Version="not found" - -fi -# Report result -echo "<result>$SSLVPN_Version</result>" - -exit 0 - + + + Pulse Secure Version + Returns the installed Pulse Secure / Ivanti Secure Access client version, or "not found". Pulse Secure was rebranded Ivanti Secure Access Client in 2022. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Pulse Secure / Ivanti Secure Access Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Pulse Secure became Ivanti Secure Access Client (ISAC); modern installs +# live at /Applications/Ivanti Secure Access.app on macOS. We probe both. + +for app in \ + "/Applications/Ivanti Secure Access.app/Contents/Info.plist" \ + "/Applications/Pulse Secure.app/Contents/Info.plist" \ + "/Applications/Junos Pulse.app/Contents/Info.plist" +do + if [[ -f "$app" ]]; then + version=$(/usr/bin/defaults read "$app" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +# Fallback to the legacy ini files +for ini in \ + "/Applications/Pulse Secure.app/Contents/Resources/PulseSecureCoreVersion.ini" \ + "/Applications/Junos Pulse.app/Contents/Resources/JunosPulseCoreVersion.ini" +do + if [[ -f "$ini" ]]; then + version=$(/usr/bin/awk -F'=' '/DisplayVersion/ { print $2; exit }' "$ini") + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done + +echo "<result>not found</result>" + diff --git a/QAS_VersionEA.xml b/QAS_VersionEA.xml index be62537..fd2e122 100644 --- a/QAS_VersionEA.xml +++ b/QAS_VersionEA.xml @@ -1,25 +1,24 @@ - Quest QAS Version Info - - string - Copy the script below into your EA and choose Data Type: String. It will output the version number only without any addition filler information. - ---- -#!/bin/bash -#Output the Version Number of Quest Authentication Services -#Freddie Cox 2012 - -version=`vastool -v | grep QAS\ Version | awk '{print $4}'` - -echo "<result>$version</result>" ---- - #!/bin/bash -#Output the Version Number of Quest Authentication Services -#Freddie Cox 2012 + Quest QAS Version Info + + string + Returns the installed Quest/One Identity Authentication Services version via vastool, or "Not Installed". QAS was rebranded "Safeguard Authentication Services". + #!/bin/zsh -version=`vastool -v | grep QAS\ Version | awk '{print $4}'` +# Updated by SecurityShrimp 2026 +# Quest QAS Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -echo "<result>$version</result>" +if ! /usr/bin/which vastool &>/dev/null && [[ ! -x /opt/quest/bin/vastool ]]; then + echo "<result>Not Installed</result>" + exit 0 +fi + +vastool="${commands[vastool]:-/opt/quest/bin/vastool}" +version=$("$vastool" -v 2>/dev/null | /usr/bin/awk '/QAS Version|Safeguard Authentication Services/ { print $NF; exit }') + +echo "<result>${version:-Unknown}</result>" + diff --git a/QuickTime Pro Serial Number.xml b/QuickTime Pro Serial Number.xml deleted file mode 100644 index 2fdabcc..0000000 --- a/QuickTime Pro Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - QuickTime Pro Serial Number Serial Numbers string This attribute returns the serial number present on the machine for QuickTime Pro. #!/bin/sh if [ -f "/Library/Preferences/com.apple.QuickTime.plist" ]; then result=`/usr/bin/defaults read /Library/Preferences/com.apple.QuickTime "Pro Key" | grep Registration | awk '{print $4}' | sed 's/\"//g' | sed 's/;//g'` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/R.xml b/R.xml index bbadbce..dbca3f1 100644 --- a/R.xml +++ b/R.xml @@ -1,20 +1,22 @@ - -R -Returns the installed version of R -string -#!/bin/bash - -ExtensionVersion="" -if [ -f /Library/Frameworks/R.framework/Versions/Current/Resources/Info.plist ]; then - ExtensionVersion=$(defaults read /Library/Frameworks/R.framework/Versions/Current/Resources/Info.plist CFBundleVersion) -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - + + + R + Returns the installed R framework version (CFBundleShortVersionString), or "Not Installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# R Statistical Computing Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +plist="/Library/Frameworks/R.framework/Versions/Current/Resources/Info.plist" + +if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + [[ -z "$version" ]] && version=$(/usr/bin/defaults read "$plist" CFBundleVersion 2>/dev/null) + echo "<result>${version:-Unknown}</result>" +else + echo "<result>Not Installed</result>" +fi + + diff --git a/Recovery HD Present.xml b/Recovery HD Present.xml index 8cc29eb..0ab9e1a 100644 --- a/Recovery HD Present.xml +++ b/Recovery HD Present.xml @@ -1,12 +1,24 @@ -Recovery HD PresentSystem InformationstringThis attribute returns an Apple Recovery HD is present on the boot disk. Examples of returned values include: "Present", "Not Present". This attribute template applies to drives with Mac OS X 10.7 and later. -#!/bin/sh + + + Recovery Volume Present + System Information + string + Reports whether a Recovery volume exists on the boot disk. Returns "Present" or "Not Present". + #!/bin/zsh -recoveryHDPresent=`/usr/sbin/diskutil list | grep "Recovery HD" | grep disk0` +# Updated by SecurityShrimp 2026 +# Recovery Volume Present Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# The legacy HFS+ "Recovery HD" partition (10.7-10.12) was replaced by an +# APFS "Recovery" volume in the boot container in macOS 10.13+. This checks +# for both so it remains correct on any modern Mac. -if [ "$recoveryHDPresent" != "" ]; then - echo "<result>Present</result>" +if /usr/sbin/diskutil apfs list 2>/dev/null | /usr/bin/grep -Eq 'Name:[[:space:]]+Recovery'; then + echo "<result>Present</result>" +elif /usr/sbin/diskutil list 2>/dev/null | /usr/bin/grep -q 'Recovery HD'; then + echo "<result>Present</result>" else - echo "<result>Not Present</result>" + echo "<result>Not Present</result>" fi - - \ No newline at end of file + + diff --git a/Remote Apple Events.xml b/Remote Apple Events.xml deleted file mode 100644 index 79df050..0000000 --- a/Remote Apple Events.xml +++ /dev/null @@ -1 +0,0 @@ - Remote Apple Events System Information This attribute displays whether or not remote apple events are enabled. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup -getremoteappleevents | awk '{print $4}'`</result>" else echo "<result>The systemsetup binary is not present on this machine.</result>" fi else echo "<result>`/usr/sbin/systemsetup -getremoteappleevents | awk '{print $4}'`</result>" fi \ No newline at end of file diff --git a/Remote Login.xml b/Remote Login.xml index 27022a2..ddd161b 100644 --- a/Remote Login.xml +++ b/Remote Login.xml @@ -1 +1,19 @@ - Remote Login System Information This attribute displays whether or not remote login is enabled. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup -getremotelogin | awk '{print $3}'`</result>" else echo "<result>The systemsetup binary is not present on this machine.</result>" fi else echo "<result>`/usr/sbin/systemsetup -getremotelogin | awk '{print $3}'`</result>" fi \ No newline at end of file + + + Remote Login + System Information + Reports whether SSH Remote Login is enabled. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Remote Login Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# systemsetup -getremotelogin needs Full Disk Access on macOS 11+ — the +# Jamf binary already has it. Result is "On" or "Off". + +state=$(/usr/sbin/systemsetup -getremotelogin 2>/dev/null | /usr/bin/awk '{print $NF}') + +echo "<result>${state:-Unknown}</result>" + + diff --git a/ReviewSmartCardLogging.xml b/ReviewSmartCardLogging.xml index f4aa684..24c7a5b 100644 --- a/ReviewSmartCardLogging.xml +++ b/ReviewSmartCardLogging.xml @@ -1,57 +1,24 @@ -SmartCard - Logging -Operating System -string -Displays the status of SmartCard logging on the Mac. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.12 -OSREGEX="^1[2-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - SClog=$(sudo defaults read /Library/Preferences/com.apple.security.smartcard Logging) -else - SClog="none" -fi -if [ "$SClog" == "none" ]; then - echo "<result>Older Operating System</result>" -elif [ "$SClog" == "1" ]; then - echo "<result>Enabled</result>" -else - echo "<result>Disabled</result>" -fi + SmartCard - Logging + Operating System + string + Reports whether SmartCard verbose logging is enabled via com.apple.security.smartcard Logging. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard Logging Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The original regex was ^1[2-9]$ which would mismatch macOS 26 (Tahoe); +# the canonical preference still lives at the same path on every modern +# release so we just read it directly. + +value=$(/usr/bin/defaults read /Library/Preferences/com.apple.security.smartcard Logging 2>/dev/null) + +case "$value" in + 1) echo "<result>Enabled</result>" ;; + 0) echo "<result>Disabled</result>" ;; + *) echo "<result>Not Set</result>" ;; +esac diff --git a/SSH_Version.xml b/SSH_Version.xml index dcff93f..eb37545 100644 --- a/SSH_Version.xml +++ b/SSH_Version.xml @@ -1,12 +1,16 @@ -SSH_Version -displays the version of OpenSSH (os x's ssh) on the client machine -string -#!/bin/sh - -ssh_version=$(/usr/bin/ssh -V 2>&1) - -echo "<result>$ssh_version</result>" - + SSH Version + Returns the installed OpenSSH client version (the LibreSSL-linked build that ships with macOS). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SSH Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +version=$(/usr/bin/ssh -V 2>&1) + +echo "<result>${version:-Unknown}</result>" + diff --git a/Safari - Auto Fill Forms From Address Book.xml b/Safari - Auto Fill Forms From Address Book.xml index e6a292f..5230c6e 100644 --- a/Safari - Auto Fill Forms From Address Book.xml +++ b/Safari - Auto Fill Forms From Address Book.xml @@ -1 +1,41 @@ - Safari - Auto Fill Forms From Address Book Security Reporting string This attribute verifies whether or not the "Auto Fill Forms From Address Book" Safari setting is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the setting is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" appDomain="com.apple.Safari" keyName="AutoFillFromAddressBook" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Safari - Auto Fill Forms From Address Book + Security Reporting + string + Reports the Safari AutoFillFromAddressBook setting. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Safari - Auto Fill Forms From Address Book Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Safari is sandboxed; its prefs live under Containers on modern macOS. +# We probe the container plist first, then fall back to the legacy path, +# then the managed-preferences location. dscl mcxread is deprecated and +# does not work under modern Configuration Profile delivery. + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.Safari" AutoFillFromAddressBook 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari" AutoFillFromAddressBook 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.Safari" AutoFillFromAddressBook 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Safari - Auto Fill Miscellaneous Forms.xml b/Safari - Auto Fill Miscellaneous Forms.xml index 0510a18..8516abe 100644 --- a/Safari - Auto Fill Miscellaneous Forms.xml +++ b/Safari - Auto Fill Miscellaneous Forms.xml @@ -1 +1,41 @@ - Safari - Auto Fill Miscellaneous Forms Security Reporting string This attribute verifies whether or not the "Auto Fill Miscellaneous Forms" Safari setting is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the setting is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" appDomain="com.apple.Safari" keyName="AutoFillMiscellaneousForms" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Safari - Auto Fill Miscellaneous Forms + Security Reporting + string + Reports the Safari AutoFillMiscellaneousForms setting. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Safari - Auto Fill Miscellaneous Forms Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Safari is sandboxed; its prefs live under Containers on modern macOS. +# We probe the container plist first, then fall back to the legacy path, +# then the managed-preferences location. dscl mcxread is deprecated and +# does not work under modern Configuration Profile delivery. + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.Safari" AutoFillMiscellaneousForms 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari" AutoFillMiscellaneousForms 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.Safari" AutoFillMiscellaneousForms 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Safari - Automatically Open Files After Download.xml b/Safari - Automatically Open Files After Download.xml index 50e600b..45979a1 100644 --- a/Safari - Automatically Open Files After Download.xml +++ b/Safari - Automatically Open Files After Download.xml @@ -1 +1,41 @@ - Safari - Automatically Open Files After Download Security Reporting string This attribute verifies whether or not the "Auto Open Files After Download" Safari setting is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "false" verifies that the setting is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_false" appDomain="com.apple.Safari" keyName="AutoOpenSafeDownloads" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Safari - Automatically Open Files After Download + Security Reporting + string + Reports the Safari AutoOpenSafeDownloads setting. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Safari - Automatically Open Files After Download Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Safari is sandboxed; its prefs live under Containers on modern macOS. +# We probe the container plist first, then fall back to the legacy path, +# then the managed-preferences location. dscl mcxread is deprecated and +# does not work under modern Configuration Profile delivery. + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.Safari" AutoOpenSafeDownloads 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari" AutoOpenSafeDownloads 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.Safari" AutoOpenSafeDownloads 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Safari - Homepage.xml b/Safari - Homepage.xml index 5b78cb8..b0298d3 100644 --- a/Safari - Homepage.xml +++ b/Safari - Homepage.xml @@ -1 +1,36 @@ - Safari - Homepage Security Reporting string This attribute displays the current Safari homepage. The value to be verified will need to be specified when creating this extension attribute. Example: "http://www.company.com" verifies that the homepage is set to company.com. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_http://www.company.com" appDomain="com.apple.Safari" keyName="HomePage" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "$desiredValue" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$tmpResult" == "$desiredValue" ]; then echo "<result>Pass ($tmpResult)</result>" else echo "<result>Fail ($tmpResult)</result>" fi \ No newline at end of file + + + Safari - Homepage + Security Reporting + string + Reports the configured Safari homepage URL. Edit desiredValue before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Safari - Homepage Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Safari is sandboxed; its prefs live under Containers on modern macOS. +# We probe the container plist first, then fall back to the legacy path, +# then the managed-preferences location. dscl mcxread is deprecated and +# does not work under modern Configuration Profile delivery. + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.Safari" HomePage 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari" HomePage 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.Safari" HomePage 2>/dev/null) + +value="${raw:-Domain or Key Not Found}" + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/SafeGuard - Encryption Percentage.xml b/SafeGuard - Encryption Percentage.xml deleted file mode 100644 index 857ce9e..0000000 --- a/SafeGuard - Encryption Percentage.xml +++ /dev/null @@ -1 +0,0 @@ - SafeGuard - Encryption Percentage Disk Encryption This attribute returns the Disk Encryption Percentage for Sophos SafeGuard on the boot disk. This attribute template applies to Sophos SafeGuard (v 5.49.00). string #!/bin/sh #This script has been verified to work on Sophos SafeGuard (v 05.49.00). #Check to see if SafeGuard is installed if [ -f "/usr/bin/sgadmin" ]; then result=`/usr/bin/sgadmin --status | grep -A 3 "Volume info" | grep "| 0" | awk 'BEGIN { FS = "|" } ; {print $6}' | awk '{print $1}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/SafeGuard - Encryption Status.xml b/SafeGuard - Encryption Status.xml deleted file mode 100644 index d0aca28..0000000 --- a/SafeGuard - Encryption Status.xml +++ /dev/null @@ -1 +0,0 @@ - SafeGuard - Encryption Status Disk Encryption This attribute returns the Disk Encryption Status for Sophos SafeGuard on the boot disk. This extension attribute will return "Encrypted" when the drive is fully encrypted. This attribute template applies to Sophos SafeGuard (v 5.49.00). string #!/bin/sh #This script has been verified to work on Sophos SafeGuard (v 05.49.00). #Check to see if SafeGuard is installed if [ -f "/usr/bin/sgadmin" ]; then result=`/usr/bin/sgadmin --status | grep -A 3 "Volume info" | grep "| 0" | awk 'BEGIN { FS = "|" } ; {print $5}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/Sassafras_K2_Client.xml b/Sassafras_K2_Client.xml index b323f19..3c3e3ed 100644 --- a/Sassafras_K2_Client.xml +++ b/Sassafras_K2_Client.xml @@ -1,20 +1,21 @@ - -Sassafras K2 Client -Returns the installed version of Sassafras K2 Client -string -#!/bin/bash - -ExtensionVersion="" -if [ -f /Library/KeyAccess/KeyAccess.app/Contents/Info.plist ]; then - ExtensionVersion=$(defaults read /Library/KeyAccess/KeyAccess.app/Contents/Info.plist CFBundleShortVersionString) -fi - -if [ "$ExtensionVersion" == "" ]; then - ExtensionVersion="Not Installed" -fi - -echo "<result>$ExtensionVersion</result>" - -exit 0 - - + + + Sassafras K2 Client + Returns the installed Sassafras K2 KeyAccess client version, or "Not Installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Sassafras K2 KeyAccess Client Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +plist="/Library/KeyAccess/KeyAccess.app/Contents/Info.plist" + +if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleShortVersionString 2>/dev/null) + echo "<result>${version:-Unknown}</result>" +else + echo "<result>Not Installed</result>" +fi + + diff --git a/Screensaver - Active After X Seconds.xml b/Screensaver - Active After X Seconds.xml index 8fd61ee..2145572 100644 --- a/Screensaver - Active After X Seconds.xml +++ b/Screensaver - Active After X Seconds.xml @@ -1 +1,31 @@ - Screensaver - Active After X Seconds Security Reporting string This attribute displays the current Screensaver idle time. The value to be verified will need to be specified when creating this extension attribute. Example: "300" verifies that the homepage is set to run after the machine is idle for 5 minutes. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_300" currentUser=`last -1 -t console | awk '{print $1}'` appDomain="com.apple.screensaver.ByHost" keyName="idleTime" result=`/usr/bin/dscl . mcxread /Users/$currentUser "$appDomain" "$keyName" |grep Value:| sed 's/Value\: //g'` if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" elif [ "$result" == "" ]; then echo "<result>Fail (Domain or Key Not Found)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Screensaver - Active After X Seconds + Security Reporting + string + Reports the screensaver idle time (seconds) for the current console user. Edit desiredValue before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Screensaver Idle Time Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.screensaver" idleTime 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/sudo -u "$user" /usr/bin/defaults -currentHost read com.apple.screensaver idleTime 2>/dev/null) + +result="${raw:-Domain or Key Not Found}" + +if [[ "$result" == "$desiredValue" ]]; then + echo "<result>Pass ($result)</result>" +else + echo "<result>Fail ($result)</result>" +fi + + diff --git a/Screensaver - Ask for Password.xml b/Screensaver - Ask for Password.xml index 94f6b30..3d373bb 100644 --- a/Screensaver - Ask for Password.xml +++ b/Screensaver - Ask for Password.xml @@ -1 +1,36 @@ - Screensaver - Ask for Password Security Reporting string This attribute displays the status of the screensaver option to "Ask for Password". The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the setting is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" currentUser=`last -1 -t console | awk '{print $1}'` appDomain="com.apple.screensaver" keyName="askForPassword" result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Screensaver - Ask for Password + Security Reporting + string + Reports the askForPassword setting for the current console user. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Screensaver Ask for Password Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +desiredValue="EditFromTemplate_Desired_Value" + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.screensaver" askForPassword 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.screensaver" askForPassword 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Search Domains.xml b/Search Domains.xml index ce53dac..1b738cc 100644 --- a/Search Domains.xml +++ b/Search Domains.xml @@ -1 +1,26 @@ - Search Domains Networking This attribute lists all search domains set on the active network connection. This attribute applies to both Mac and Windows. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.5" ]]; then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then NetworkInterface=`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"` echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -getsearchdomains "$NetworkInterface" 2>&1`</result>" else echo "<result>The networksetup binary is not present on this machine.</result>" fi else NetworkInterface=`/usr/sbin/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"` echo "<result>`/usr/sbin/networksetup -getsearchdomains "$NetworkInterface" 2>&1`</result>" fi VBScript On Error Resume Next strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48) For Each objItem in colItems If objitem.ipenabled = True then strDNSDomain = objItem.DNSDomain End If Next WScript.Echo "<result>" & strDNSDomain & "</result>" \ No newline at end of file + + + Search Domains + Networking + Returns the DNS search domains configured for the active network service. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Search Domains Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# scutil --dns surfaces the active search domains uniformly across +# interfaces, including VPN and multiple resolvers. + +domains=$(/usr/sbin/scutil --dns 2>/dev/null \ + | /usr/bin/awk ' + /^resolver #[0-9]+$/ { scoped=0 } + /if_index/ { scoped=1 } + scoped && /search domain\[[0-9]+\] :/ { print $4 } + ' \ + | /usr/bin/sort -u \ + | /usr/bin/paste -sd ',' -) + +echo "<result>${domains:-None}</result>" + + diff --git a/SecureDocEncryptionStatus.xml b/SecureDocEncryptionStatus.xml index 7d6382c..cfd0408 100644 --- a/SecureDocEncryptionStatus.xml +++ b/SecureDocEncryptionStatus.xml @@ -1,28 +1,39 @@ - SecureDoc - Encryption Status (v 5.3.31) - - string - This attribute returns the Disk Encryption Status for WinMagic SecureDoc on the boot disk. Examples of returned values include: "Software Encrypted", "Partially Encrypted", "Unprotected", "Hardware Encrypted", "Not Encrypted", and "Not Installed". This attribute template applies to WinMagic SecureDoc (v 5.3.31). - #!/bin/sh -#This script has been verified to work on WinMagic SecureDoc (v 5.3.31). + SecureDoc - Encryption Status + + string + Returns WinMagic SecureDoc encryption status for the boot disk: "Software Encrypted", "Partially Encrypted", "Unprotected", "Hardware Encrypted", "Not Encrypted", or "Not installed". + #!/bin/zsh -#Check to see if SecureDoc is installed -if [ -f "/WinMagic/com.winmagic.registry.plist" ]; then - result=`/usr/bin/defaults read /WinMagic/com.winmagic.registry | grep CasperEncryptionStatus | awk '{print $3}' | sed 's/;//g'` - if [ "$result" == "4097" ]; then - echo "<result>Software Encrypted</result>" - elif [ "$result" == "4112" ]; then - echo "<result>Partially Encrypted</result>" - elif [ "$result" == "4352" ]; then - echo "<result>Unprotected</result>" - elif [ "$result" == "4353" ]; then - echo "<result>Hardware Encrypted</result>" - else - echo "<result>Not Encrypted</result>" - fi -else +# Updated by SecurityShrimp 2026 +# SecureDoc Encryption Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only (Apple Silicon returns N/A) +# WinMagic SecureDoc is Intel-only on macOS; Apple Silicon doesn't support +# third-party FDE bootloaders. The registry plist path is unchanged across +# recent SecureDoc versions. + +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 +fi + +plist="/WinMagic/com.winmagic.registry.plist" + +if [[ ! -f "$plist" ]]; then echo "<result>Not installed</result>" -fi + exit 0 +fi + +status=$(/usr/bin/defaults read "${plist%.plist}" CasperEncryptionStatus 2>/dev/null) + +case "$status" in + 4097) echo "<result>Software Encrypted</result>" ;; + 4112) echo "<result>Partially Encrypted</result>" ;; + 4352) echo "<result>Unprotected</result>" ;; + 4353) echo "<result>Hardware Encrypted</result>" ;; + *) echo "<result>Not Encrypted</result>" ;; +esac + diff --git a/Shell_Shock_Status.xml b/Shell_Shock_Status.xml deleted file mode 100644 index 184d45f..0000000 --- a/Shell_Shock_Status.xml +++ /dev/null @@ -1,22 +0,0 @@ - - -Shell Shock Status -Look for the "Shell Shock" vulnerability. -string -#!/bin/sh -################################################################## -# Extension Attribute checks status of Shell Shock vulnerability. -# Cobbled together from other's hard work by Christopher Miller -# for ITSD-ISS of JHU-APL, Dated 2014-10-03 -################################################################## - -ShellShockStatus=`env x='() { :;}; echo vulnerable' bash -c 'echo' | grep vulnerable` -if [ "$ShellShockStatus" != "vulnerable" ] - then - ShellShockStatus="Patched" -fi - -echo "<result>$ShellShockStatus</result>" -exit 0 - - diff --git a/Shockwave version.xml b/Shockwave version.xml deleted file mode 100644 index 5c1bdfe..0000000 --- a/Shockwave version.xml +++ /dev/null @@ -1,30 +0,0 @@ - - -Shockwave version -Tweaked version of https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/Casper_Extension_Attributes/java_browser_plug-in_version -string -#!/bin/bash - -# Christoph von Gabler-Sahm (christoph.gabler-sahm@computacenter.com) -# Version 1.0 -# -# Modified by Sam Novak (snovak@uwsp.edu) for Shockwave - -# checks installed version of Shockwave Plugin - -PLUGINPATH="/Library/Internet Plug-Ins/DirectorShockwave.plugin" - -# Plugin version -S_VERSION=$( /usr/bin/defaults read "${PLUGINPATH}/Contents/Info" CFBundleShortVersionString 2>/dev/null ) - -if [[ -e "${PLUGINPATH}" ]]; then - if [[ "${S_VERSION}" != "" ]]; then - EA_RESULT="${S_VERSION}" - fi -else - EA_RESULT="Not installed" -fi - -echo "<result>${EA_RESULT}</result>" - - diff --git a/Silverlight Version.xml b/Silverlight Version.xml deleted file mode 100644 index 2ccf8d4..0000000 --- a/Silverlight Version.xml +++ /dev/null @@ -1,25 +0,0 @@ - - -Silverlight Version -Checks if Microsofts Silverlight Plugin is installed, if it’s not it returns the message not installed, if it is installed it returns the version number. -string -#!/bin/sh -#################################################################################################### -# -# More information: http://macmule.com/2011/03/07/ea-get-silverlight-version/ -# -# GitRepo: https://github.com/macmule/getSilverlightPluginVersion/ -# -# License: http://macmule.com/license/ -# -#################################################################################################### - -# Checks to see if the plugin exists -if [ -e /Library/Internet\ Plug-Ins/Silverlight.plugin ]; then - result="$(defaults read /Library/Internet\ Plug-Ins/Silverlight.plugin/Contents/Info SilverlightVersion)" - echo "$result" - else - echo "Not installed" -fi - - diff --git a/SmartCardPairingUI.xml b/SmartCardPairingUI.xml index 05d006a..73de53a 100644 --- a/SmartCardPairingUI.xml +++ b/SmartCardPairingUI.xml @@ -1,61 +1,32 @@ -SmartCard - GUI Enabled -Operating System -string -Displays "Enabled" if the SmartCard Pairing UI is enabled; displays "Disabled" if the SmartCard Pairing UI is disabled. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.12 -OSREGEX="^1[2-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -# Sets the user account -currentUser=$(last -1 -t console | awk '{print $1}') -# Review Pairing UI status -if [[ $OSVERS =~ $OSREGEX ]]; then - SCUImode=$(sudo -u "$currentUser" sc_auth pairing_ui -s status) - SCUImode=${SCUImode:28} -else - SCUImode="na" -fi -if [ "$SCUImode" == "enabled." ]; then - echo "<result>Enabled</result>" -elif [ "$SCUImode" == "disabled." ]; then - echo "<result>Disabled</result>" -else - echo "<result>Not Supported</result>" + SmartCard - GUI Enabled + Operating System + string + Reports whether the SmartCard Pairing UI is enabled. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard Pairing UI Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original used ^1[2-9]$ which fails to match macOS 26. sc_auth has been +# the canonical tool since 10.12 and continues to work; run as the active +# console user since pairing_ui status is user-scoped. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + echo "<result>No Console User</result>" + exit 0 fi + +status=$(/usr/bin/sudo -u "$user" /usr/sbin/sc_auth pairing_ui -s status 2>/dev/null | /usr/bin/awk '{print $NF}') + +case "${status%.}" in + enabled) echo "<result>Enabled</result>" ;; + disabled) echo "<result>Disabled</result>" ;; + *) echo "<result>Not Supported</result>" ;; +esac diff --git a/SmartCardUserKeychain.xml b/SmartCardUserKeychain.xml index b1bcb25..34048af 100644 --- a/SmartCardUserKeychain.xml +++ b/SmartCardUserKeychain.xml @@ -1,59 +1,21 @@ -SmartCard - User's Keychain -Operating System -string -Displays the current paired SmartCard in user's keychain. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - SCuserkeychain=$(system_profiler SPSmartCardsDataType | grep "Available SmartCards (keychain)" | awk -F. '{print $2}') - SCuserkeychain=${SCuserkeychain:4} -else - SCuserkeychain=“none” -fi -if [ "$SCuserkeychain" == “none” ]; then - echo "<result>Not Supported in OS $OS</result>" -elif [ "$SCuserkeychain" != "" ]; then - echo "<result>$SCuserkeychain</result>" -else - echo "<result>Not Available</result>" -fi + SmartCard - User's Keychain + Operating System + string + Returns the SmartCard(s) currently available in the user's keychain via system_profiler SPSmartCardsDataType. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard User Keychain Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +cards=$(/usr/sbin/system_profiler SPSmartCardsDataType 2>/dev/null \ + | /usr/bin/awk ' + /Available SmartCards \(keychain\):/ { found=1; next } + found && /^[[:space:]]*[A-Za-z]/ { gsub(/^[[:space:]]+/, ""); print; exit } + ') + +echo "<result>${cards:-Not Available}</result>" - \ No newline at end of file + diff --git a/SmartCardUsers.xml b/SmartCardUsers.xml index 45d4dc1..1284a4a 100644 --- a/SmartCardUsers.xml +++ b/SmartCardUsers.xml @@ -1,25 +1,22 @@ -SmartCard User -Device Security -string -Displays which local user account has been SmartCard enabled and with what type of SmartCard. Requires macOS 10.12. - -#!/bin/sh -# Regex for OS detection +10.12 -OSREGEX="^1[2-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - scuser=`sc_auth identities | sed -n '3p' | awk '{print $2}'` - scusertype=`sc_auth identities | sed -n '3p' | awk '{print $6}'` -else - echo "<result>No Users have been SmartCard enabled.</result>" -fi -if [ "$scuser" != "" ]; then - echo "<result>$scuser - $scusertype</result>" -else + SmartCard User + Device Security + string + Reports which local users have been SmartCard-paired and the card identifier. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard Paired Users Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# sc_auth identities is the canonical lookup on every supported macOS. + +out=$(/usr/sbin/sc_auth identities 2>/dev/null | /usr/bin/awk '/^[[:space:]]*[0-9A-F]/ { sub(/^[[:space:]]+/, ""); print }') + +if [[ -z "$out" ]]; then echo "<result>No Users have been SmartCard enabled</result>" +else + echo "<result>${out}</result>" fi - \ No newline at end of file + diff --git a/Sophos - Virus Definition Date-8.0.xml b/Sophos - Virus Definition Date-8.0.xml deleted file mode 100644 index 8229b14..0000000 --- a/Sophos - Virus Definition Date-8.0.xml +++ /dev/null @@ -1,18 +0,0 @@ - - -Sophos - Virus Definition Date -This attribute returns the Virus Definitions Date for Sophos. This attribute template applies to Sophos (v 8.0.16). -date -#!/bin/sh -#This script has been verified to work on Sophos (v 8.0.16). - -#Check to see if Sophos is installed -if [ -f "/usr/bin/sweep" ]; then -result=`/bin/date -j -f "%b %d %Y" "$(/usr/bin/sweep -v | grep "Data file date" |tail -1| awk '{print $6, $5, $7}')" "+%Y-%m-%d 00:00:00"`; -echo "<result>$result</result>"; -else -echo "<result>Not installed</result>"; -fi - - - diff --git a/Sophos - Virus Definition Date.xml b/Sophos - Virus Definition Date.xml index 348470f..71cb8c3 100644 --- a/Sophos - Virus Definition Date.xml +++ b/Sophos - Virus Definition Date.xml @@ -1 +1,33 @@ - Sophos - Virus Definition Date AntiVirus This attribute returns the Virus Definitions Date for Sophos. This attribute template applies to Sophos (v 7.1). date #!/bin/sh #This script has been verified to work on Sophos (v 7.1). #Check to see if Sophos is installed if [ -f "/usr/bin/sweep" ]; then result=`/bin/date -j -f "%b %d %Y" "$(/usr/bin/sweep -v | grep "Released" | awk '{print $4, $3, $5}')" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file + + + Sophos - Virus Definition Date + AntiVirus + Returns Sophos Anti-Virus / Sophos Endpoint definition release date, or "Not installed". + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Sophos Virus Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Modern Sophos Endpoint moved binaries from /usr/bin/sweep to inside the +# .app bundle, but the legacy savscan/sweep wrappers are preserved at the +# old paths for backwards compatibility on most installs. + +for sweep in /usr/local/bin/sweep /usr/bin/sweep "/Library/Sophos Anti-Virus/Sophos Anti-Virus.app/Contents/MacOS/sweep"; do + [[ -x "$sweep" ]] && binary="$sweep" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +raw=$("$binary" -v 2>/dev/null | /usr/bin/awk '/Released/ {print $4, $3, $5; exit}') + +if [[ -n "$raw" ]]; then + iso=$(/bin/date -j -f "%b %d %Y" "$raw" "+%Y-%m-%d 00:00:00" 2>/dev/null) +fi + +echo "<result>${iso:-Unknown}</result>" + + diff --git a/Sophos - Virus Definition Version.xml b/Sophos - Virus Definition Version.xml index 77e80a2..ff8ac14 100644 --- a/Sophos - Virus Definition Version.xml +++ b/Sophos - Virus Definition Version.xml @@ -1 +1,25 @@ - Sophos - Virus Definition Version AntiVirus This attribute returns the Virus Definitions Version for Sophos. This attribute template applies to Sophos (v 7.1). integer #!/bin/sh #This script has been verified to work on Sophos (v 7.1). #Check to see if Sophos is installed if [ -f "/usr/bin/sweep" ]; then result=`/usr/bin/sweep -v | grep "Virus data version" | awk '{print $5}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file + + + Sophos - Virus Definition Version + AntiVirus + Returns Sophos virus data version number. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Sophos Virus Definition Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +for sweep in /usr/local/bin/sweep /usr/bin/sweep "/Library/Sophos Anti-Virus/Sophos Anti-Virus.app/Contents/MacOS/sweep"; do + [[ -x "$sweep" ]] && binary="$sweep" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +version=$("$binary" -v 2>/dev/null | /usr/bin/awk '/Virus data version/ {print $5; exit}') +echo "<result>${version:-Unknown}</result>" + + diff --git a/Sophos_AV_Primary_Update_Server.xml b/Sophos_AV_Primary_Update_Server.xml index 3ed4d6e..3268a20 100644 --- a/Sophos_AV_Primary_Update_Server.xml +++ b/Sophos_AV_Primary_Update_Server.xml @@ -1,14 +1,15 @@ -Sophos AV Primary Update Server - -string -#!/bin/bash - -if [ -f /Library/Preferences/com.sophos.sau.plist ] ;then -URL=`defaults read /Library/Preferences/com.sophos.sau.plist | grep PrimaryServerURL | awk '{print $3}' | cut -d ";" -f1` -echo "<result>"${URL}"</result>" -fi -exit 0 - + Sophos AV Primary Update Server + Returns the configured Sophos AutoUpdate (SAU) primary server URL. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Sophos AV Primary Update Server Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +url=$(/usr/bin/defaults read /Library/Preferences/com.sophos.sau PrimaryServerURL 2>/dev/null) +echo "<result>${url:-Not Set}</result>" + diff --git a/Sophos_Anti-Virus_RMS_Configuration.xml b/Sophos_Anti-Virus_RMS_Configuration.xml index 80c939f..a38aedb 100644 --- a/Sophos_Anti-Virus_RMS_Configuration.xml +++ b/Sophos_Anti-Virus_RMS_Configuration.xml @@ -1,24 +1,21 @@ -Sophos Anti-Virus RMS Configuration -This is used to get the ParentAddress router configuration located in /Library/Sophos Anti-Virus/RMS/router.config - -This will tell us which SEC server the machine is ACTUALLY communicating with. -string -#!/bin/bash - - -# Check to see if the file exists -if [ -f /Library/Sophos\ Anti-Virus/RMS/router.config ]; then - -# Read the configuration -config=`cat /Library/Sophos\ Anti-Virus/RMS/router.config | grep ParentAddress | cut -d '=' -f2` - -fi - -# Display the configuration -echo "<result>$config</result>" - -exit 0 - + Sophos Anti-Virus RMS Configuration + Returns the ParentAddress (SEC server) from /Library/Sophos Anti-Virus/RMS/router.config so you can verify the management server the agent is actually talking to. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Sophos RMS Configuration Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +config="/Library/Sophos Anti-Virus/RMS/router.config" + +if [[ -f "$config" ]]; then + parent=$(/usr/bin/awk -F'=' '/ParentAddress/ { print $2; exit }' "$config" | /usr/bin/sed 's/^[[:space:]]*//') + echo "<result>${parent:-Not Set}</result>" +else + echo "<result>Not installed</result>" +fi + diff --git a/Symantec_-_Virus_Definition_Date(1).xml b/Symantec_-_Virus_Definition_Date(1).xml index d3d6a72..622a74d 100644 --- a/Symantec_-_Virus_Definition_Date(1).xml +++ b/Symantec_-_Virus_Definition_Date(1).xml @@ -1,42 +1,37 @@ -Symantec - Virus Definition Date -This attribute returns the Virus Definitions Date for Symantec. This attribute template applies to Norton AntiVirus (v 10), and Norton AntiVirus (v 11) as well as Symantec Endpoint Protection v11 and v12. -date -#!/bin/sh -######################################################################################################## -# Find the date of Virus Definitions for Norton AntiVirus or Symantec EndPoint -# This script has been verified to work on Norton AntiVirus (v10, v11) and Symantec Endpoint (v11, v12). -# Cobbled together from other's hard work -# Modification for SEP v12ru4 by Christopher Miller -# for ITSD-ISS of JHU-APL, Dated 2015-01-19, LastMod: 2015-10-23 -######################################################################################################## - -#Check to see if Norton v10 is installed -if [ -f "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" ]; then - result=`/bin/date -j -f "%b %d, %Y" "$(cat "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" | grep "Symantec Security Response" | awk '{print $5, $6, $7}')" "+%Y-%m-%d 00:00:00"` - SEPinstall="Yes" -fi - -#Check to see if Norton v11 is installed -if [ -f "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" ]; then - result=`/bin/date -j -f "%b %d, %Y" "$(cat "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" | grep "Symantec Security Response" | awk '{print $5, $6, $7}')" "+%Y-%m-%d 00:00:00"` - SEPinstall="Yes" -fi - -#Check to see if SEP v12ru4 or higher is installed -#NOTE: SEP v12ru5 and ru6 high versions re-introduced the 'Engine' Directory -if [ -f "/Library/Application Support/Symantec/AntiVirus/engine.mfst" ]; then - result=`/bin/date -j -f "%Y%m%d" $(cat "/Library/Application Support/Symantec/AntiVirus/engine.mfst" | cut -c 2-12) "+%Y-%m-%d 00:00:00"` - SEPinstall="Yes" -fi - -#Check to see if we found any version of SEP -if [ $SEPinstall != "Yes" ]; then - result="Not Installed" -fi - -echo "<result>$result</result>" -exit 0 - + Symantec - Virus Definition Date + Returns the Symantec/Norton AV virus-definition date in ISO 8601 form, or "Not Installed". Probes Symantec Endpoint Protection (SEP) engine manifest, plus legacy WHATSNEW files for older Norton builds. + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Symantec Virus Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# SEP v12ru4+ writes engine.mfst with a YYYYMMDD-prefixed string. Older +# Norton/SEP builds wrote WHATSNEW.TXT. We check both. + +result="" + +mfst="/Library/Application Support/Symantec/AntiVirus/engine.mfst" +if [[ -f "$mfst" ]]; then + ymd=$(/usr/bin/cut -c2-9 "$mfst") + [[ -n "$ymd" ]] && result=$(/bin/date -j -f "%Y%m%d" "$ymd" "+%Y-%m-%d 00:00:00" 2>/dev/null) +fi + +if [[ -z "$result" ]]; then + for whatsnew in \ + "/Library/Application Support/Symantec/AntiVirus/Engine/WHATSNEW.TXT" \ + "/Library/Application Support/Norton Solutions Support/Norton AntiVirus/Engine/WHATSNEW.TXT" + do + if [[ -f "$whatsnew" ]]; then + raw=$(/usr/bin/grep "Symantec Security Response" "$whatsnew" | /usr/bin/awk '{print $5, $6, $7}') + [[ -n "$raw" ]] && result=$(/bin/date -j -f "%b %d, %Y" "$raw" "+%Y-%m-%d 00:00:00" 2>/dev/null) + [[ -n "$result" ]] && break + fi + done +fi + +echo "<result>${result:-Not Installed}</result>" + diff --git a/Tableau_Fulfillment_ID.xml b/Tableau_Fulfillment_ID.xml index ee11e1f..2536c0a 100644 --- a/Tableau_Fulfillment_ID.xml +++ b/Tableau_Fulfillment_ID.xml @@ -1,17 +1,28 @@ -Tableau Fulfillment ID -Displays Fulfillment ID for Tableau Desktop or "Not_Installed" if Tableau is not installed. -string -#!/bin/sh - -if [ -e /Applications/Tableau.app/Contents/Frameworks/FlexNet/custactutil ] - then - fidResult=`/Applications/Tableau.app/Contents/Frameworks/FlexNet/custactutil -view | grep "Fulfillment ID:" | tail -n 1 | awk -F ": " '{print $2}'` - else - fidResult="Not_Installed" -fi - -echo "<result>$fidResult</result>" - + Tableau Fulfillment ID + Returns the FlexNet Fulfillment ID for installed Tableau Desktop, or "Not_Installed". Tableau still bundles the FlexNet custactutil helper on macOS. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Tableau Fulfillment ID Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Tableau versions the bundle directory (Tableau.app or Tableau Desktop.app); +# we glob both. + +custactutil="" +for app in "/Applications/Tableau.app" "/Applications/Tableau Desktop.app"; do + [[ -x "$app/Contents/Frameworks/FlexNet/custactutil" ]] && custactutil="$app/Contents/Frameworks/FlexNet/custactutil" && break +done + +if [[ -z "$custactutil" ]]; then + echo "<result>Not_Installed</result>" + exit 0 +fi + +fid=$("$custactutil" -view 2>/dev/null | /usr/bin/awk -F': ' '/Fulfillment ID:/ { print $2 }' | /usr/bin/tail -n1) + +echo "<result>${fid:-Unknown}</result>" + diff --git a/Time Machine - Auto Backup.xml b/Time Machine - Auto Backup.xml index 7f8f3c4..cea535c 100644 --- a/Time Machine - Auto Backup.xml +++ b/Time Machine - Auto Backup.xml @@ -1 +1,33 @@ - Time Machine - Auto Backup Security Reporting string This attribute displays the status of the Time Machine "Auto Backup" option. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the setting is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" currentUser=`last -1 -t console | awk '{print $1}'` appDomain="com.apple.TimeMachine" keyName="AutoBackup" result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Time Machine - Auto Backup + Security Reporting + string + Reports whether Time Machine's AutoBackup preference matches desiredValue. Edit desiredValue (true/false) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Auto Backup Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# /Library/Preferences/com.apple.TimeMachine remains readable on modern +# macOS (Apple did not move this into a container). Reading it as root +# (Jamf EA context) avoids TCC issues. + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Time Machine - Backup Destination.xml b/Time Machine - Backup Destination.xml index b1c1e75..30a48d3 100644 --- a/Time Machine - Backup Destination.xml +++ b/Time Machine - Backup Destination.xml @@ -1 +1,32 @@ - Time Machine - Backup Destination Backup This attribute displays the Time Machine backup destination. string #!/bin/sh enabled=`/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup` if [ "$enabled" == "1" ];then validateDestination=`/usr/sbin/diskutil info $(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine "DestinationVolumeUUID") | awk '{print $1, $2}'` if [ "$validateDestination" == "Could not" ];then echo "<result>Destination not mounted</result>" else backupDestination=`/usr/sbin/diskutil info $(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine "DestinationVolumeUUID") | grep "Mount Point" | /usr/bin/cut -c 30-` echo "<result>$backupDestination</result>" fi else echo "<result>Not enabled.</result>" fi \ No newline at end of file + + + Time Machine - Backup Destination + Backup + Returns the mount point of the Time Machine destination volume (if mounted), the destination URL for network backups, or "Not enabled". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Backup Destination Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# tmutil destinationinfo is more reliable than parsing the TimeMachine +# plist directly; modern macOS may have multiple destinations and network +# (smb/afp) destinations that don't have a DestinationVolumeUUID. + +if ! /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null | /usr/bin/grep -q "^1$"; then + echo "<result>Not enabled.</result>" + exit 0 +fi + +mount=$(/usr/bin/tmutil destinationinfo 2>/dev/null | /usr/bin/awk -F': ' '/Mount Point/ { print $2; exit }') +url=$(/usr/bin/tmutil destinationinfo 2>/dev/null | /usr/bin/awk -F': ' '/URL[[:space:]]+:/ { print $2; exit }') + +if [[ -n "$mount" ]]; then + echo "<result>$mount</result>" +elif [[ -n "$url" ]]; then + echo "<result>$url</result>" +else + echo "<result>Destination not mounted</result>" +fi + + diff --git a/Time Machine - Enabled.xml b/Time Machine - Enabled.xml index e46267c..066938e 100644 --- a/Time Machine - Enabled.xml +++ b/Time Machine - Enabled.xml @@ -1 +1,30 @@ - Time Machine - Enabled Security Reporting string This attribute displays whether or not Time Machine is enabled. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that Time Machine is enabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.TimeMachine" keyName="AutoBackup" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file + + + Time Machine - Enabled + Security Reporting + string + Reports whether Time Machine is enabled (AutoBackup=1). + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Enabled Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +desiredValue="EditFromTemplate_Desired_Value" + +raw=$(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null) + +case "$raw" in + 1) value="true" ;; + 0) value="false" ;; + "") value="Domain or Key Not Found" ;; + *) value="$raw" ;; +esac + +if [[ "$value" == "$desiredValue" ]]; then + echo "<result>Pass ($value)</result>" +else + echo "<result>Fail ($value)</result>" +fi + + diff --git a/Time Machine - Last Backup Completed-2.xml b/Time Machine - Last Backup Completed-2.xml index 1015fbb..f76ec6c 100644 --- a/Time Machine - Last Backup Completed-2.xml +++ b/Time Machine - Last Backup Completed-2.xml @@ -1 +1,39 @@ - Time Machine - Last Backup Completed Backup This attribute displays the last time a complete Time Machine backup ran. date #!/bin/sh if [ -f /private/var/db/.TimeMachine.Results.plist ];then lastBackupTime=`/usr/bin/defaults read /private/var/db/.TimeMachine.Results "BACKUP_COMPLETED_DATE" | colrm 20` echo "<result>$lastBackupTime</result>" else echo "<result>Not enabled.</result>" fi \ No newline at end of file + + + Time Machine - Last Backup Completed + Backup + Timestamp of the most recent successful Time Machine backup, or "Not enabled". + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Last Backup Completed Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# tmutil latestbackup was added in 10.9 and is the canonical method. +# It returns the most recent local snapshot path (which embeds an ISO +# timestamp) or an error if no backups exist. + +if ! /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null | /usr/bin/grep -q "^1$"; then + echo "<result>Not enabled.</result>" + exit 0 +fi + +# Try tmutil first +latest=$(/usr/bin/tmutil latestbackup 2>/dev/null) + +if [[ -n "$latest" ]]; then + # Path looks like .../com.apple.TimeMachine.2026-05-26-013344.local + stamp=$(/usr/bin/basename "$latest" | /usr/bin/sed -E 's/.*\.([0-9]{4}-[0-9]{2}-[0-9]{2})-([0-9]{2})([0-9]{2})([0-9]{2}).*/\1 \2:\3:\4/') + echo "<result>${stamp:-$latest}</result>" + exit 0 +fi + +# Fall back to TimeMachine.Results.plist (only present on older macOS) +if [[ -f /private/var/db/.TimeMachine.Results.plist ]]; then + stamp=$(/usr/bin/defaults read /private/var/db/.TimeMachine.Results BACKUP_COMPLETED_DATE 2>/dev/null) + echo "<result>${stamp:-Unknown}</result>" +else + echo "<result>Unknown</result>" +fi + + diff --git a/Time Machine - Last Backup Completed.xml b/Time Machine - Last Backup Completed.xml index 36b264a..f76ec6c 100644 --- a/Time Machine - Last Backup Completed.xml +++ b/Time Machine - Last Backup Completed.xml @@ -1,42 +1,39 @@ -Time Machine - Last Backup Completed -Latest Time Machine backup timestamp. Updated for OS X Mavericks compatibility. -date -#!/bin/sh - -# Gather Time Machine Last Backup Status for JSS -# Written by Chad Nielsen -# Forget Computers, Get Creative! -# Last Modified on October 25th, 2013. - -# Version History -# 1.0 - original attribute by JAMF Software supporting OS X 10.8 and lower. -# 1.1 - added ability to check status in OS X 10.9 Mavericks. - -# Determine the OS Version -OS=$(sw_vers | awk '/ProductVersion/{print substr($2,1,4)}') - -# Check the OS, and then check the values in the appropriate corresponding files. -if [ "$OS" = "10.9" ]; then - # Check to see if autobackup is enabled. - autoBackupEnabled=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/AutoBackup/{print $3}' | tr -d ";") - # A value of 1 signifies that Time Machine is on, a value of 0 is off. - if [ "$autoBackupEnabled" = "1" ]; then - lastBackupTime=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/SnapshotDates/{getline; print substr($0,9)}' | sed 's/^ *//g' | tr -d '"') - else - lastBackupTime="Not enabled." - fi -else - # This is the traditional attribute code provided by JAMF, modified slightly. - if [ -f /private/var/db/.TimeMachine.Results.plist ]; then - lastBackupTime=$(defaults read /private/var/db/.TimeMachine.Results "BACKUP_COMPLETED_DATE") - else - lastBackupTime="Not enabled." - fi -fi - -# Report the Time Machine status to the JSS. -echo "<result>$lastBackupTime</result>" - + Time Machine - Last Backup Completed + Backup + Timestamp of the most recent successful Time Machine backup, or "Not enabled". + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Last Backup Completed Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# tmutil latestbackup was added in 10.9 and is the canonical method. +# It returns the most recent local snapshot path (which embeds an ISO +# timestamp) or an error if no backups exist. + +if ! /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null | /usr/bin/grep -q "^1$"; then + echo "<result>Not enabled.</result>" + exit 0 +fi + +# Try tmutil first +latest=$(/usr/bin/tmutil latestbackup 2>/dev/null) + +if [[ -n "$latest" ]]; then + # Path looks like .../com.apple.TimeMachine.2026-05-26-013344.local + stamp=$(/usr/bin/basename "$latest" | /usr/bin/sed -E 's/.*\.([0-9]{4}-[0-9]{2}-[0-9]{2})-([0-9]{2})([0-9]{2})([0-9]{2}).*/\1 \2:\3:\4/') + echo "<result>${stamp:-$latest}</result>" + exit 0 +fi + +# Fall back to TimeMachine.Results.plist (only present on older macOS) +if [[ -f /private/var/db/.TimeMachine.Results.plist ]]; then + stamp=$(/usr/bin/defaults read /private/var/db/.TimeMachine.Results BACKUP_COMPLETED_DATE 2>/dev/null) + echo "<result>${stamp:-Unknown}</result>" +else + echo "<result>Unknown</result>" +fi + diff --git a/Time Machine - Show Status in Menu Bar.xml b/Time Machine - Show Status in Menu Bar.xml index a82c2f7..c22e4f5 100644 --- a/Time Machine - Show Status in Menu Bar.xml +++ b/Time Machine - Show Status in Menu Bar.xml @@ -1 +1,36 @@ - Time Machine - Show Status in Menu Bar Security Reporting string This attribute displays whether or not the Time Machine status is enabled in the menu bar. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh lastUser=`last -1 -t console | awk '{print $1}'` result=`mcxquery -user $lastUser -format tab | grep dontAutoLoad | awk -F "\t" '{print $5}'` desiredResult='( "/System/Library/CoreServices/Menu Extras/TimeMachine.menu" )' if [ "$desiredResult" == "$result" ]; then echo "<result<Pass ($result)</result<" else echo "<result<Fail ($result)</result<" fi \ No newline at end of file + + + Time Machine - Show Status in Menu Bar + Security Reporting + string + Reports whether the Time Machine menu bar item is enabled in the user's menuExtras list. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Menu Bar Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Apple removed the global Time Machine menu extra in Big Sur and replaced +# it with a Control Center module. We check the new ControlCenter prefs +# (TimeMachine = 6 = "Show in Menu Bar") and fall back to the legacy +# menuExtras array. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +cc=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.controlcenter" "NSStatusItem Visible TimeMachine" 2>/dev/null) + +if [[ "$cc" == "1" ]]; then + echo "<result>Pass (Menu Bar)</result>" + exit 0 +fi + +extras=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.systemuiserver" menuExtras 2>/dev/null | /usr/bin/grep -c TimeMachine) + +if (( extras > 0 )); then + echo "<result>Pass (Menu Bar)</result>" +else + echo "<result>Fail (Not in Menu Bar)</result>" +fi + + diff --git a/Time Machine - Status.xml b/Time Machine - Status.xml index 813718c..fefba09 100644 --- a/Time Machine - Status.xml +++ b/Time Machine - Status.xml @@ -1 +1,21 @@ - Time Machine - Status Backup This attribute displays the Time Machine configuration status. string #!/bin/sh enabled=`/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup` if [ "$enabled" == "1" ];then echo "<result>Enabled</result>" else echo "<result>Disabled</result>" fi \ No newline at end of file + + + Time Machine - Status + Backup + Reports Time Machine configuration status ("Enabled" or "Disabled"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +state=$(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null) + +if [[ "$state" == "1" ]]; then + echo "<result>Enabled</result>" +else + echo "<result>Disabled</result>" +fi + + diff --git a/Time Machine Encryption Status.xml b/Time Machine Encryption Status.xml index acfcb0b..037c82f 100644 --- a/Time Machine Encryption Status.xml +++ b/Time Machine Encryption Status.xml @@ -1,34 +1,36 @@ -Time Machine Encryption Status -Show if TimeMachine disk is encrypted. -string - -#!/bin/bash -#Todd Houle -#Partners Healthcare -#19June2014 -#revised 24June2014 -#To determine if connected time machine disk is encrypted. + Time Machine Encryption Status + Reports whether the Time Machine destination volume is encrypted. + string + #!/bin/zsh -mountPath=`tmutil destinationinfo | grep "Mount Point" | awk -F ": " '{print $2}'` -if [ "$mountPath" == "" ]; then - tmExists=`tmutil destinationinfo |grep "No destinations configured"| awk '{print $2 $3 $4}'` - if [ "$tmExists" == "Nodestinationsconfigured." ]; then - result="Backup Not Enabled" - else - result="Disk not available" - fi -else - disk=`df -h|grep "$mountPath"|awk '{print $1}'` - result=`diskutil cs info $disk |grep "Conversion Status" | awk '{print $3}'` - if [ "$result" == "" ] ; then - result="Not Encrypted" - fi +# Updated by SecurityShrimp 2026 +# Time Machine Encryption Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# CoreStorage (the original "diskutil cs" backend) is dead — macOS uses +# APFS for everything now. We use diskutil info -plist on the destination +# mount point and read the Encryption status directly. + +mount=$(/usr/bin/tmutil destinationinfo 2>/dev/null \ + | /usr/bin/awk -F': ' '/Mount Point/ { print $2; exit }') + +if [[ -z "$mount" ]]; then + if /usr/bin/tmutil destinationinfo 2>/dev/null | /usr/bin/grep -q "No destinations configured"; then + echo "<result>Backup Not Enabled</result>" + else + echo "<result>Disk not available</result>" + fi + exit 0 fi -echo "$result" +encrypted=$(/usr/sbin/diskutil info -plist "$mount" 2>/dev/null \ + | /usr/bin/plutil -extract Encryption raw - 2>/dev/null) +case "$encrypted" in + true|1) echo "<result>Encrypted</result>" ;; + false|0) echo "<result>Not Encrypted</result>" ;; + *) echo "<result>Unknown</result>" ;; +esac - diff --git a/Time_Machine_-_Destination.xml b/Time_Machine_-_Destination.xml index d119120..61b2518 100644 --- a/Time_Machine_-_Destination.xml +++ b/Time_Machine_-_Destination.xml @@ -1,22 +1,27 @@ -Time Machine - Destination using tmutil -NOTE - This EA has only been tested with OS X 10.9 and 10.10 !! - -Uses 'tmutil' binary display Time Machine destination volume name and volume type. -string -#!/bin/sh -enabled=`/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup` - -if [ "$enabled" == "1" ] - then - volumeName=`/usr/bin/tmutil destinationinfo | grep "Name" | awk -F ": " '{print $2}'` - volumeType=`/usr/bin/tmutil destinationinfo | grep "Kind" | awk -F ": " '{print $2}'` - result="$volumeName ($volumeType)" - else - result="NA" -fi - -echo "<result>$result</result>" - + Time Machine - Destination using tmutil + Returns the Time Machine destination volume name and kind (e.g. "MyBackup (Local)" or "TimeCapsule (Network)"). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Destination Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +if ! /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null | /usr/bin/grep -q "^1$"; then + echo "<result>NA</result>" + exit 0 +fi + +info=$(/usr/bin/tmutil destinationinfo 2>/dev/null) +name=$(echo "$info" | /usr/bin/awk -F': ' '/Name[[:space:]]+:/ { print $2; exit }') +kind=$(echo "$info" | /usr/bin/awk -F': ' '/Kind[[:space:]]+:/ { print $2; exit }') + +if [[ -z "$name" ]]; then + echo "<result>NA</result>" +else + echo "<result>$name ($kind)</result>" +fi + diff --git a/Time_Machine_-_Volume_Encrypted.xml b/Time_Machine_-_Volume_Encrypted.xml index 9149e15..8010fa9 100644 --- a/Time_Machine_-_Volume_Encrypted.xml +++ b/Time_Machine_-_Volume_Encrypted.xml @@ -1,88 +1,58 @@ -Time Machine - Destination Encryption Status -This EA determines encryption status of Time Machine destination - -NOTE - This has only been tested on OS X 10.9 and 10.10 !!!!! - -Possible results will be: - -Yes -No -NA -Offline -Offline - Encrypted - <timestamp> -Offline - Not Encrypted - <timestamp> - -It is best to use this alongside other Time Machine EA's - like "Time Machine - Enabled" and/or "Time Machine - Destination" - -string -#!/bin/bash - -# EA to determine encryption status of Time Machine destination -# NOTE - This has only been tested on OS X 10.9 and 10.10 !!!!! -# Please set the value of the variable below to suit your environment - -tmEncryptionPreferenceDomain='/Library/Preferences/com.capitalone.ds.cof.TimeMachineCheck' - -# Summary of Results: -# -# NA = Time Machine is not enabled or the destination is a network directory. -# Yes = Drive is online and encrypted (a preference file is then written to record encryption status with time stamp) -# No = Drive is online and not encrypted (a preference file is then written to record encryption status with time stamp) -# Offline = Drive is not online, but we don’t know encryption status -# Offline = Encrypted - <timestamp> - drive is offline, but we read values from the preference file that was written -# Offline = Not Encrypted - <timestamp> - drive is offline, but we read values from the preference file that was written - - -############################################### -# Please do not change anything below this line -############################################### - -# Setting IFS Env to only use new lines as field seperator -IFS=$'\n' - -enabled=`/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup` - -if [ "$enabled" == "1" ] - then - volumeMountPoint=`/usr/bin/tmutil destinationinfo | grep "Mount Point" | awk -F ": " '{print $2}'` - volumeType=`/usr/bin/tmutil destinationinfo | grep "Kind" | awk -F ": " '{print $2}'` - if [ "$volumeType" == "Local" ] - then - if [ -d "$volumeMountPoint" ] - then - if [[ `/usr/sbin/diskutil info $volumeMountPoint | grep "Encrypted:"` ]] - then - result=`/usr/sbin/diskutil info $volumeMountPoint | grep "Encrypted:" | awk -F "Encrypted:" '{print $2}' | sed -e 's/^[ \t]*//'` - if [ "$result" == "Yes" ] - then - /usr/bin/defaults write $tmEncryptionPreferenceDomain timestamp `date +%Y%m%d%H%M%S` - /usr/bin/defaults write $tmEncryptionPreferenceDomain status "Encrypted" - else - /usr/bin/defaults write $tmEncryptionPreferenceDomain timestamp `date +%Y%m%d%H%M%S` - /usr/bin/defaults write $tmEncryptionPreferenceDomain status "Not Encrypted" - fi - else - result="No" - /usr/bin/defaults write $tmEncryptionPreferenceDomain timestamp `date +%Y%m%d%H%M%S` - /usr/bin/defaults write $tmEncryptionPreferenceDomain status "Not Encrypted" - fi - else - if [ -f $tmEncryptionPreferenceDomain.plist ] - then - timestamp=`/usr/bin/defaults read $tmEncryptionPreferenceDomain timestamp` - encryptionStatus=`/usr/bin/defaults read $tmEncryptionPreferenceDomain status` - result="Offline - $encryptionStatus - $timestamp" - else result="Offline" - fi - fi - else result="NA" - fi - else result="NA" -fi - - -echo "<result>$result</result>" - + Time Machine - Destination Encryption Status + Reports the encryption status of the Time Machine destination. Returns Yes / No / NA / Offline (with cached status if available). + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Time Machine Destination Encryption Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# CoreStorage is gone on modern macOS — every disk is APFS or HFS+. We +# read the destination's APFS encryption status from diskutil's plist +# output. The script caches the last-known state in a preference file so +# we can still report something useful when the drive is offline. + +tmCache="/Library/Preferences/com.capitalone.ds.cof.TimeMachineCheck" + +if ! /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine AutoBackup 2>/dev/null | /usr/bin/grep -q "^1$"; then + echo "<result>NA</result>" + exit 0 +fi + +info=$(/usr/bin/tmutil destinationinfo 2>/dev/null) +mount=$(echo "$info" | /usr/bin/awk -F': ' '/Mount Point/ { print $2; exit }') +kind=$(echo "$info" | /usr/bin/awk -F': ' '/Kind[[:space:]]+:/ { print $2; exit }') + +if [[ "$kind" != "Local" ]]; then + echo "<result>NA</result>" + exit 0 +fi + +if [[ -n "$mount" && -d "$mount" ]]; then + encrypted=$(/usr/sbin/diskutil info -plist "$mount" 2>/dev/null \ + | /usr/bin/plutil -extract Encryption raw - 2>/dev/null) + case "$encrypted" in + true|1) + /usr/bin/defaults write "$tmCache" status "Encrypted" + /usr/bin/defaults write "$tmCache" timestamp "$(/bin/date +%Y%m%d%H%M%S)" + echo "<result>Yes</result>" + ;; + false|0) + /usr/bin/defaults write "$tmCache" status "Not Encrypted" + /usr/bin/defaults write "$tmCache" timestamp "$(/bin/date +%Y%m%d%H%M%S)" + echo "<result>No</result>" + ;; + *) echo "<result>Unknown</result>" ;; + esac +else + if [[ -f "$tmCache.plist" ]]; then + status=$(/usr/bin/defaults read "$tmCache" status 2>/dev/null) + stamp=$(/usr/bin/defaults read "$tmCache" timestamp 2>/dev/null) + echo "<result>Offline - ${status:-Unknown} - ${stamp:-Unknown}</result>" + else + echo "<result>Offline</result>" + fi +fi + diff --git a/Total Login Time of Current User.xml b/Total Login Time of Current User.xml index feef762..925a668 100644 --- a/Total Login Time of Current User.xml +++ b/Total Login Time of Current User.xml @@ -1 +1,26 @@ - Total Time of User Login User Information This attribute displays the current total time logged in of the current user. This attribute applies only to Mac. string #!/bin/sh currentUser=`ls -l /dev/console | awk {' print $3 '}` userLoginTime=`ac -p | grep "$currentUser" | awk {' print $2 '} | cut -d . -f 1` totalTimeInDays=`echo "scale=2 ; $userLoginTime/24" | bc` echo "<result>Login time in hours for $currentUser is $userLoginTime Login time in days for $currentUser is $totalTimeInDays </result>" \ No newline at end of file + + + Total Time of User Login + User Information + Total accumulated login time for the current console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Total Login Time Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# ac is part of the base BSD toolset and is preserved on every modern +# macOS. Note: ac counts hours from wtmp/utmp, which the OS rotates, so +# this represents "since the current wtmp rotation" not lifetime. + +user=$(/usr/bin/stat -f %Su /dev/console 2>/dev/null) +hours=$(/usr/bin/ac -p 2>/dev/null | /usr/bin/awk -v u="$user" '$1 == u { print int($2); exit }') + +if [[ -z "$hours" ]]; then + echo "<result>No login data for $user</result>" +else + days=$(( hours / 24 )) + echo "<result>Login time for $user: ${hours}h (~${days}d)</result>" +fi + + diff --git a/Umbrella_Client_Status.xml b/Umbrella_Client_Status.xml index 6b58a12..3d8f943 100644 --- a/Umbrella_Client_Status.xml +++ b/Umbrella_Client_Status.xml @@ -1,24 +1,36 @@ - -Umbrella Client Status - -string -#!/bin/bash - - -if [ -f "/Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist" ]; then - - -ps auwwx | egrep "dnscrypt|RoamingClientMenubar|dns-updater" | grep -vq egrep; - if [[ 0 == $? ]]; then - echo "<result>Enabled</result>" - else -echo "<result>Disabled</result>" - fi - - - -else -echo "<result>Not Installed</result>" -fi - + + + Umbrella Client Status + Reports the status of the Cisco Umbrella (formerly OpenDNS Roaming Client) agent: "Enabled", "Disabled", or "Not Installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Cisco Umbrella Client Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The Roaming Client was renamed Umbrella Secure Internet Gateway agent. +# Modern installs use either the legacy /Library/LaunchDaemons plist or +# the newer Umbrella Roaming Security daemon under +# /Library/LaunchDaemons/com.cisco.umbrella.roamingclient.plist. + +found=0 +for plist in \ + "/Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist" \ + "/Library/LaunchDaemons/com.cisco.umbrella.roamingclient.plist" \ + "/Library/LaunchDaemons/com.cisco.umbrella.csc.plist" +do + [[ -f "$plist" ]] && found=1 && break +done + +if (( ! found )); then + echo "<result>Not Installed</result>" + exit 0 +fi + +if /bin/ps auxww 2>/dev/null | /usr/bin/grep -E "dnscrypt|RoamingClient|dns-updater|umbrella" | /usr/bin/grep -qv grep; then + echo "<result>Enabled</result>" +else + echo "<result>Disabled</result>" +fi + diff --git a/VMware - Virtual Machine List.xml b/VMware - Virtual Machine List.xml index 9234010..97b92d3 100644 --- a/VMware - Virtual Machine List.xml +++ b/VMware - Virtual Machine List.xml @@ -1 +1,44 @@ - VMware - Virtual Machine List Virtualization This attribute displays a list of VMware virtual machines that are installed on the machine. string #!/bin/sh OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5` if [[ "$OS" < "10.6" ]]; then myVMList=`find /Users -name "*.vmx"` else myVMList=`mdfind -name ".vmx" | grep -Ev "vmx.lck" | grep -Ev "vmxf"` fi IFS=$'\n' myCount=1 echo "<result>" for myFile in $myVMList do myNetwork=`cat "$myFile"| grep "ethernet.*.connectionType"| awk '{print \$3}'| sed 's/\"//g'` myDisplayName=`cat "$myFile"| grep "displayName"| sed 's/displayName = //g'| sed 's/\"//g'` myMemSize=`cat "$myFile"| grep "memsize"| awk '{print \$3}'| sed 's/\"//g'` myUUID=`cat "$myFile"| grep "uuid.bios"| sed 's/uuid.bios = //g'| sed 's/\"//g'` myMAC=`cat "$myFile"| grep "ethernet.*.generatedAddress"| grep -v "Offset"| awk '{print \$3}'| sed 's/\"//g'` echo "=-=-=-=-=-=-=-=-=-=-=-=-=-" echo "VMWare VM #$myCount" echo "File Name: $myFile" echo "Display Name: $myDisplayName" echo "Network Type: $myNetwork" echo "MAC Address: $myMAC" echo "Memory: $myMemSize MB" echo "UUID: $myUUID" let myCount=myCount+1 done echo "</result>" unset IFS \ No newline at end of file + + + VMware - Virtual Machine List + Virtualization + Lists VMware Fusion virtual machines on the system with display name, memory, MAC, and UUID. Note: VMware Fusion is Intel-only on macOS; Apple Silicon Macs run UTM/Parallels for x86 guests instead. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VMware VM List Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Note: Fusion on Apple Silicon (Fusion 13+) only supports ARM guests, but +# the .vmx format and discovery path is identical to Intel. + +vmxFiles=("${(@f)$(/usr/bin/mdfind -name '.vmx' 2>/dev/null | /usr/bin/grep -Ev 'vmx\.lck|vmxf')}") + +if (( ${#vmxFiles[@]} == 0 )); then + echo "<result>No VMs Found</result>" + exit 0 +fi + +count=1 +echo "<result>" +for vmx in "${vmxFiles[@]}"; do + [[ -z "$vmx" ]] && continue + name=$(/usr/bin/awk -F'"' '/^displayName/ { print $2; exit }' "$vmx") + net=$(/usr/bin/awk -F'"' '/ethernet0\.connectionType/ { print $2; exit }' "$vmx") + mem=$(/usr/bin/awk -F'"' '/^memsize/ { print $2; exit }' "$vmx") + uuid=$(/usr/bin/awk -F'"' '/^uuid\.bios/ { print $2; exit }' "$vmx") + mac=$(/usr/bin/awk -F'"' '/ethernet0\.generatedAddress[[:space:]]=/ { print $2; exit }' "$vmx") + + echo "=-=-=-=-=-=-=-=-=-=-=-=-=-" + echo "VMWare VM #$count" + echo "File Name: $vmx" + echo "Display Name: $name" + echo "Network Type: $net" + echo "MAC Address: $mac" + echo "Memory: $mem MB" + echo "UUID: $uuid" + (( count++ )) +done +echo "</result>" + + diff --git a/VMware Fusion Serial Number.xml b/VMware Fusion Serial Number.xml deleted file mode 100644 index 68b80cc..0000000 --- a/VMware Fusion Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - VMware Fusion Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for VMware Fusion. #!/bin/sh result=`cat /Library/Preferences/VMware\ Fusion/license* | grep Serial | awk '{print $3}' | sed 's/"//g'` echo "<result>${result}</result>" \ No newline at end of file diff --git a/Verify Certificate Based Communication.xml b/Verify Certificate Based Communication.xml index 3040f29..2b1c239 100644 --- a/Verify Certificate Based Communication.xml +++ b/Verify Certificate Based Communication.xml @@ -1,11 +1,19 @@ -Verify Certificate Based CommunicationJAMF SoftwarestringThis attribute verifies that the client has certificate based communication enabled for communications with the JSS. Results returned are "Enabled" or "Not Enabled" based on whether the client has certificate based profile supplied by the JSS. -#!/bin/sh -jamfKeychain="/Library/Application Support/JAMF/JAMF.keychain" + + + Verify Certificate Based Communication + JAMF Software + string + Checks whether the Jamf framework has a client certificate keychain at /Library/Application Support/JAMF/JAMF.keychain. + #!/bin/zsh -if [ -f "$jamfKeychain" ]; then +# Updated by SecurityShrimp 2026 +# Jamf Certificate-Based Communication Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +if [[ -f "/Library/Application Support/JAMF/JAMF.keychain" ]]; then echo "<result>Enabled</result>" else echo "<result>Not Enabled</result>" fi - - \ No newline at end of file + + diff --git a/Verify MDM Enrollment.xml b/Verify MDM Enrollment.xml index e446840..ede5d70 100644 --- a/Verify MDM Enrollment.xml +++ b/Verify MDM Enrollment.xml @@ -1,12 +1,23 @@ -Verify MDM EnrollmentJAMF SoftwarestringThis attribute verifies that the client has enrolled to the JSS. Results returned are "Enabled" or "Not Enabled" based on whether the client has an MDM profile supplied by the JSS. -#!/bin/sh -mdmEnrollmentProfileID="00000000-0000-0000-A000-4A414D460003" -enrolled=`/usr/bin/profiles -C | /usr/bin/grep "$mdmEnrollmentProfileID"` + + + Verify MDM Enrollment + JAMF Software + string + Reports "Enrolled" if the Jamf MDM profile (well-known UUID 00000000-0000-0000-A000-4A414D460003) is installed, "Not Enrolled" otherwise. + #!/bin/zsh -if [ "$enrolled" != "" ]; then +# Updated by SecurityShrimp 2026 +# Verify MDM Enrollment Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# The profiles binary is preserved on every modern macOS. -C lists +# device-scope profiles which is where the MDM enrollment lives. + +mdmUuid="00000000-0000-0000-A000-4A414D460003" + +if /usr/bin/profiles -C 2>/dev/null | /usr/bin/grep -q "$mdmUuid"; then echo "<result>Enrolled</result>" else echo "<result>Not Enrolled</result>" fi - - \ No newline at end of file + + diff --git a/VerifyScreensaverSettingsForSC.xml b/VerifyScreensaverSettingsForSC.xml index 4474133..44adab7 100644 --- a/VerifyScreensaverSettingsForSC.xml +++ b/VerifyScreensaverSettingsForSC.xml @@ -1,59 +1,32 @@ -SmartCard - Screensaver Lock -Operating System -string -Reviews if the screensaver will activate immediately upon SmartCard removal. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - curUser=$(ls -l /dev/console | cut -d " " -f 4) - SSset=$(defaults read /Users/$curUser/Library/Preferences/com.apple.screensaver tokenRemovalAction) -else - SSset="none" -fi -if [ "$SSset" == "none" ]; then - echo "<result>Not Suppprted in OS $OS</result>" -elif [ "$SSset" == "1" ]; then - echo "<result>Enabled</result>" -else - echo "<result>Disabled</result>" + SmartCard - Screensaver Lock + Operating System + string + Reports whether tokenRemovalAction is set to "screensaver lock on card removal" for the current console user. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard Screensaver Lock Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original regex ^1[3-9]$ would fail to match macOS 26 (Tahoe); the +# preference still works on all modern macOS so we just read it. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') + +if [[ -z "$user" || "$user" == "root" ]]; then + echo "<result>No Console User</result>" + exit 0 fi + +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') +value=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.screensaver" tokenRemovalAction 2>/dev/null) + +case "$value" in + 1) echo "<result>Enabled</result>" ;; + 0) echo "<result>Disabled</result>" ;; + *) echo "<result>Not Set</result>" ;; +esac diff --git a/VerifySmartCardAuthLogin.xml b/VerifySmartCardAuthLogin.xml index 3aa9851..a287978 100644 --- a/VerifySmartCardAuthLogin.xml +++ b/VerifySmartCardAuthLogin.xml @@ -1,57 +1,27 @@ -SmartCard - Login command -Operating System -string -Displays if the login command has been SmartCard enabled. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - SClogin=$(less /etc/pam.d/login | grep smartcard | awk -F. '{print $1}') -else - SClogin="none" + SmartCard - Login command + Operating System + string + Reports whether /etc/pam.d/login includes a smartcard module. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard - Login command Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original regex ^1[3-9]$ would fail to match macOS 26 (Tahoe). PAM module +# layout is unchanged on every supported macOS. + +pam="/etc/pam.d/login" + +if [[ ! -f "$pam" ]]; then + echo "<result>PAM file missing</result>" + exit 0 fi -if [ "$SClogin" == "none" ]; then - echo "<result>Not Supported in OS $OS</result>" -elif [ "$SClogin" != "" ]; then - echo "<result>Enabled</result>" -else + +if /usr/bin/grep -qi 'smartcard' "$pam"; then + echo "<result>Enabled</result>" +else echo "<result>Disabled</result>" fi diff --git a/VerifySmartCardAuthSU.xml b/VerifySmartCardAuthSU.xml index 48f141a..88f2503 100644 --- a/VerifySmartCardAuthSU.xml +++ b/VerifySmartCardAuthSU.xml @@ -1,57 +1,27 @@ -SmartCard - su command -Operating System -string -Displays if the su command has been SmartCard enabled. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - SCsu=$(less /etc/pam.d/su | grep smartcard | awk -F. '{print $1}') -else - SCsu="none" + SmartCard - su command + Operating System + string + Reports whether /etc/pam.d/su includes a smartcard module. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard - su command Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original regex ^1[3-9]$ would fail to match macOS 26 (Tahoe). PAM module +# layout is unchanged on every supported macOS. + +pam="/etc/pam.d/su" + +if [[ ! -f "$pam" ]]; then + echo "<result>PAM file missing</result>" + exit 0 fi -if [ "$SCsu" == "none" ]; then - echo "<result>Not Supported in OS $OS</result>" -elif [ "$SCsu" != "" ]; then - echo "<result>Enabled</result>" -else + +if /usr/bin/grep -qi 'smartcard' "$pam"; then + echo "<result>Enabled</result>" +else echo "<result>Disabled</result>" fi diff --git a/VerifySmartCardAuthSUDO.xml b/VerifySmartCardAuthSUDO.xml index d26c6b9..79ddfd4 100644 --- a/VerifySmartCardAuthSUDO.xml +++ b/VerifySmartCardAuthSUDO.xml @@ -1,57 +1,27 @@ -SmartCard - sudo command -Operating System -string -Displays if the sudo command has been SmartCard enabled. - -#!/bin/sh -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -# -# Copyright (c) 2018 Jamf. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# * Neither the name of the Jamf nor the names of its contributors may be -# used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY -# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -################ -# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff -# Jamf Nation username: mwoodruff -################ -# Regex for OS detection +10.13 -OSREGEX="^1[3-9]$" -# Gets the OS version -OS=$(/usr/bin/sw_vers -productVersion) -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - SCsudo=$(less /etc/pam.d/sudo | grep smartcard | awk -F. '{print $1}') -else - SCsudo="none" + SmartCard - sudo command + Operating System + string + Reports whether /etc/pam.d/sudo includes a smartcard module. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# SmartCard - sudo command Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original regex ^1[3-9]$ would fail to match macOS 26 (Tahoe). PAM module +# layout is unchanged on every supported macOS. + +pam="/etc/pam.d/sudo" + +if [[ ! -f "$pam" ]]; then + echo "<result>PAM file missing</result>" + exit 0 fi -if [ "$SCsudo" == "none" ]; then - echo "<result>Not Supported in OS $OS</result>" -elif [ "$SCsudo" != "" ]; then - echo "<result>Enabled</result>" -else + +if /usr/bin/grep -qi 'smartcard' "$pam"; then + echo "<result>Enabled</result>" +else echo "<result>Disabled</result>" fi diff --git a/Virex - Virus Definition Version.xml b/Virex - Virus Definition Version.xml deleted file mode 100644 index 2de9d5f..0000000 --- a/Virex - Virus Definition Version.xml +++ /dev/null @@ -1 +0,0 @@ - Virex - Virus Definition Version AntiVirus This attribute returns the Virus Definitions Version for McAfee Virex. This attribute template applies to McAfee Virex (v7.0). integer #!/bin/sh #This script has been verified to work on McAfee Virex (v7.0). #Check to see if McAfee Virex is installed if [ -f "/usr/local/vscanx/uvscan" ]; then result=`/usr/local/vscanx/uvscan --version | grep "Virus data" | awk '{print $4}' | cut -c 2-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file diff --git a/VirusBarrier - Active Scanner Tasks.xml b/VirusBarrier - Active Scanner Tasks.xml index 7e02cd6..b69bcf4 100644 --- a/VirusBarrier - Active Scanner Tasks.xml +++ b/VirusBarrier - Active Scanner Tasks.xml @@ -1 +1,32 @@ - VirusBarrier - Active Scanner Tasks AntiVirus This attribute returns the number of active scanner tasks. This attribute template applies to VirusBarrierX5 or VirusBarrier X6. integer #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep activeScannerTasks | cut -c 21-` echo "<result>$result</result>" else #Check to see if VirusBarrierX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep activeScannerTasks | cut -c 21-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Active Scanner Tasks + AntiVirus + Number of active VirusBarrier scanner tasks. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier - Active Scanner Tasks Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Intego VirusBarrier (now part of "Intego Mac Premium Bundle X9") moved +# its CLI to /Library/Intego/virusbarrier.bundle/Contents/MacOS/ in X6+. +# Older X5 installs used Contents/Resources/. We probe both. + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +value=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/activeScannerTasks/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/VirusBarrier - Corrupted Files.xml b/VirusBarrier - Corrupted Files.xml index 0f20b9d..cff28b4 100644 --- a/VirusBarrier - Corrupted Files.xml +++ b/VirusBarrier - Corrupted Files.xml @@ -1 +1,32 @@ - VirusBarrier - Corrupted Files AntiVirus This attribute returns the number of files that have been found to be corrupted since the last reboot. This attribute template applies to VirusBarrierX5 or VirusBarrier X6. integer #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep corruptedFilesSinceBoot | cut -c 26-` echo "<result>$result</result>" else #Check to see if VirusBarrierX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep corruptedFilesSinceBoot | cut -c 26-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Corrupted Files + AntiVirus + Number of files found corrupted since last reboot. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier - Corrupted Files Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Intego VirusBarrier (now part of "Intego Mac Premium Bundle X9") moved +# its CLI to /Library/Intego/virusbarrier.bundle/Contents/MacOS/ in X6+. +# Older X5 installs used Contents/Resources/. We probe both. + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +value=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/corruptedFilesSinceBoot/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/VirusBarrier - Quarantined Files.xml b/VirusBarrier - Quarantined Files.xml index 24820e0..09086ce 100644 --- a/VirusBarrier - Quarantined Files.xml +++ b/VirusBarrier - Quarantined Files.xml @@ -1 +1,32 @@ - VirusBarrier - Quarantined Files AntiVirus This attribute returns the number of files that have been quarantined since the last reboot. This attribute template applies to VirusBarrierX5 or VirusBarrier X6. integer #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep quarantinedFiles | cut -c 19-` echo "<result>$result</result>" else #Check to see if VirusBarrerX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep quarantinedFiles | cut -c 19-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Quarantined Files + AntiVirus + Number of files quarantined since last reboot. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier - Quarantined Files Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Intego VirusBarrier (now part of "Intego Mac Premium Bundle X9") moved +# its CLI to /Library/Intego/virusbarrier.bundle/Contents/MacOS/ in X6+. +# Older X5 installs used Contents/Resources/. We probe both. + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +value=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/quarantinedFiles/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/VirusBarrier - Repaired Files.xml b/VirusBarrier - Repaired Files.xml index 55e852d..3d4ec58 100644 --- a/VirusBarrier - Repaired Files.xml +++ b/VirusBarrier - Repaired Files.xml @@ -1 +1,32 @@ - VirusBarrier - Repaired Files AntiVirus This attribute returns the number of files that have been found to be repaired since the last reboot. This attribute template applies to VirusBarrierX5 or VirusBarrier X6. integer #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep repairedFilesSinceBoot | cut -c 25-` echo "<result>$result</result>" else #Check to see if VirusBarrierX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep repairedFilesSinceBoot | cut -c 25-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Repaired Files + AntiVirus + Number of files repaired since last reboot. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier - Repaired Files Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Intego VirusBarrier (now part of "Intego Mac Premium Bundle X9") moved +# its CLI to /Library/Intego/virusbarrier.bundle/Contents/MacOS/ in X6+. +# Older X5 installs used Contents/Resources/. We probe both. + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +value=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/repairedFilesSinceBoot/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/VirusBarrier - Scanned Files.xml b/VirusBarrier - Scanned Files.xml index 623e094..3d689d8 100644 --- a/VirusBarrier - Scanned Files.xml +++ b/VirusBarrier - Scanned Files.xml @@ -1 +1,32 @@ - VirusBarrier - Scanned Files AntiVirus This attribute returns the number of files that have been scanned since the last reboot. This attribute template applies to VirusBarrierX5 or VirusBarrier X6. integer #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep scannedFilesSinceBoot | cut -c 24-` echo "<result>$result</result>" else #Check to see if VirusBarrierX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep scannedFilesSinceBoot | cut -c 24-` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Scanned Files + AntiVirus + Number of files scanned since last reboot. + integer + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier - Scanned Files Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Intego VirusBarrier (now part of "Intego Mac Premium Bundle X9") moved +# its CLI to /Library/Intego/virusbarrier.bundle/Contents/MacOS/ in X6+. +# Older X5 installs used Contents/Resources/. We probe both. + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +value=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/scannedFilesSinceBoot/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit }') + +echo "<result>${value:-Unknown}</result>" + + diff --git a/VirusBarrier - Virus Definition Date.xml b/VirusBarrier - Virus Definition Date.xml index c65d9d9..1f5ed9a 100644 --- a/VirusBarrier - Virus Definition Date.xml +++ b/VirusBarrier - Virus Definition Date.xml @@ -1 +1,34 @@ - VirusBarrier - Virus Definition Date AntiVirus This attribute returns the VirusBarrierX5 or VirusBarrierX6 virus definitions of the computer. date #!/bin/sh #This script has been verified to work on VirusBarrier X5 and VirusBarrierX6. #Check to see if VirusBarrierX5 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" ]; then result=`date -j -f "%Y-%m%d" "$(/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep vdefsVersion | cut -c 15- | cut -c 1-4)-$(/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers -i | grep vdefsVersion | cut -c 15- | cut -c 5-8)" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else #Check to see if VirusBarrierX6 is installed if [ -f "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" ]; then result=`date -j -f "%Y-%m%d" "$(/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep vdefsVersion | cut -c 15- | cut -c 1-4)-$(/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers -i | grep vdefsVersion | cut -c 15- | cut -c 5-8)" "+%Y-%m-%d 00:00:00"` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi fi \ No newline at end of file + + + VirusBarrier - Virus Definition Date + AntiVirus + Returns Intego VirusBarrier's definition release date (YYYY-MM-DD). + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# VirusBarrier Virus Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +for cli in \ + "/Library/Intego/virusbarrier.bundle/Contents/MacOS/virusbarriers" \ + "/Library/Intego/virusbarrier.bundle/Contents/Resources/virusbarriers" +do + [[ -x "$cli" ]] && binary="$cli" && break +done + +if [[ -z "$binary" ]]; then + echo "<result>Not installed</result>" + exit 0 +fi + +# vdefsVersion is a YYYYMMDD-prefixed integer. +ymd=$("$binary" -i 2>/dev/null | /usr/bin/awk -F'=' '/vdefsVersion/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print substr($2, 1, 8); exit }') + +if [[ -n "$ymd" ]]; then + iso=$(/bin/date -j -f "%Y%m%d" "$ymd" "+%Y-%m-%d 00:00:00" 2>/dev/null) +fi + +echo "<result>${iso:-Unknown}</result>" + + diff --git a/VirusScan - Virus Definition Date.xml b/VirusScan - Virus Definition Date.xml index 72a7b73..f93b7c1 100644 --- a/VirusScan - Virus Definition Date.xml +++ b/VirusScan - Virus Definition Date.xml @@ -1 +1,28 @@ - VirusScan - Virus Definition Date AntiVirus This attribute returns the Virus Definitions Date for McAfee VirusScan. This attribute template applies to McAfee VirusScan (v8.0). date #!/bin/sh #This script has been verified to work on McAfee VirusScan (v8.0). #Check to see if McAfee VirusScan is installed if [ -f "/Library/Preferences/com.Mcafee.VirusScan.plist" ]; then result=`/usr/bin/defaults read /Library/Preferences/com.Mcafee.VirusScan Update_DAT_Time | awk '{print $1, $2}'` echo "<result>$result</result>" else echo "<result>Not installed</result>" fi \ No newline at end of file + + + VirusScan - Virus Definition Date + AntiVirus + Returns McAfee/Trellix VirusScan (Endpoint Security for Mac) virus-definition date. + date + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# McAfee/Trellix VirusScan Definition Date Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# McAfee rebranded as Trellix. The Mac product is now "Endpoint Security +# for Mac"; the legacy plist key Update_DAT_Time is preserved for +# backwards compatibility on most modern installs. + +for plist in \ + /Library/Preferences/com.Mcafee.VirusScan.plist \ + /Library/Preferences/com.trellix.endpoint.epm.macos.plist +do + if [[ -f "$plist" ]]; then + result=$(/usr/bin/defaults read "${plist%.plist}" Update_DAT_Time 2>/dev/null | /usr/bin/awk '{print $1, $2}') + [[ -n "$result" ]] && { echo "<result>$result</result>"; exit 0; } + fi +done + +echo "<result>Not installed</result>" + + diff --git a/WatchmanMonitoring-ComputerURL.xml b/WatchmanMonitoring-ComputerURL.xml index 3fc98c7..fc753aa 100644 --- a/WatchmanMonitoring-ComputerURL.xml +++ b/WatchmanMonitoring-ComputerURL.xml @@ -1,13 +1,19 @@ -Watchman Monitoring Computer URL -Displays the URL to a monitored computer's record in Watchman Monitoring. -string -#!/bin/sh -if [ -f /Library/MonitoringClient/Utilities/ExportStatus ]; then - echo "<result>`defaults read /Library/MonitoringClient/ClientData/UnifiedStatus.plist ClientURL`</result>" -else - echo "<result>Watchman Monitoring not installed</result>" -fi - + Watchman Monitoring Computer URL + Returns the URL of this Mac's record in Watchman Monitoring, or "Watchman Monitoring not installed". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Watchman Monitoring Computer URL Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +if [[ -f /Library/MonitoringClient/Utilities/ExportStatus ]]; then + url=$(/usr/bin/defaults read /Library/MonitoringClient/ClientData/UnifiedStatus.plist ClientURL 2>/dev/null) + echo "<result>${url:-Unknown}</result>" +else + echo "<result>Watchman Monitoring not installed</result>" +fi + diff --git a/WatchmanMonitoring-Status.xml b/WatchmanMonitoring-Status.xml index f43a5cb..956701f 100644 --- a/WatchmanMonitoring-Status.xml +++ b/WatchmanMonitoring-Status.xml @@ -1,20 +1,25 @@ -Watchman Monitoring Status -This attribute returns "Has issue" when Watchman Monitoring is reporting an error. -string -#!/bin/sh - -if [ -f /Library/MonitoringClient/Utilities/ExportStatus ]; then -if [ defaults read /Library/MonitoringClient/ClientData/UnifiedStatus.plist CurrentWarning ]; then - result="Has issue" -else - result="No problems detected" -fi -echo "<result>$result</result>" -fi - echo "<result>Watchman Monitoring not installed</result>" -fi + Watchman Monitoring Status + Reports "Has issue" when Watchman Monitoring has a CurrentWarning, "No problems detected" otherwise. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Watchman Monitoring Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original script had a broken if-chain that always reported as installed. +# Fixed to actually probe for CurrentWarning's presence. + +if [[ ! -f /Library/MonitoringClient/Utilities/ExportStatus ]]; then + echo "<result>Watchman Monitoring not installed</result>" + exit 0 +fi + +if /usr/bin/defaults read /Library/MonitoringClient/ClientData/UnifiedStatus.plist CurrentWarning &>/dev/null; then + echo "<result>Has issue</result>" +else + echo "<result>No problems detected</result>" +fi - diff --git a/WatchmanPluginList-Long.xml b/WatchmanPluginList-Long.xml index 7e9b06a..49704c8 100644 --- a/WatchmanPluginList-Long.xml +++ b/WatchmanPluginList-Long.xml @@ -1,13 +1,21 @@ -Watchman Monitoring-Full Report -Displays a list of all plugins active on the computer, and their status. -string -#!/bin/sh -if [ -f /Library/MonitoringClient/Utilities/ExportStatus ]; then - echo "<result>`/Library/MonitoringClient/Utilities/ExportStatus -v`</result>" -else - echo "<result>Watchman Monitoring not installed</result>" -fi - + Watchman Monitoring-Full Report + Returns the full Watchman Monitoring plugin status report from ExportStatus -v. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Watchman Monitoring Full Report Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon + +exporter="/Library/MonitoringClient/Utilities/ExportStatus" + +if [[ -x "$exporter" ]]; then + report=$("$exporter" -v 2>/dev/null) + echo "<result>${report}</result>" +else + echo "<result>Watchman Monitoring not installed</result>" +fi + diff --git a/Wireless?.xml b/Wireless?.xml index b24f0e4..960218a 100644 --- a/Wireless?.xml +++ b/Wireless?.xml @@ -1,26 +1,21 @@ -Wireless? -Returns Yes if Mac has a Wi-Fi or Airport Card, No if not -string -#!/bin/sh -#################################################################################################### -# -# More information: http://macmule.com/2011/09/08/need-to-find-out-if-a-mac-has-an-airport-card/ -# -# GitRepo: https://github.com/macmule/EAHasWirelessOrAirport/ -# -# License: http://macmule.com/license/ -# -#################################################################################################### - -# Checks to see if their is a hardware port called AirPort or Wi-Fi -checkWireless=$(networksetup -listallhardwareports | egrep "Hardware Port: (Air|Wi-)" | cut -c 16-) - -if [ -n "${checkWireless}" ]; then - echo "<result>No</result>" -else - echo "<result>Yes</result>" -fi - + Wireless? + Returns "Yes" if the Mac has a Wi-Fi/AirPort hardware port, "No" if not. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Wireless Capability Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original script's logic was inverted (reported No when Wi-Fi was present); +# fixed to match the displayed semantics. + +if /usr/sbin/networksetup -listallhardwareports 2>/dev/null \ + | /usr/bin/grep -qE "Hardware Port: (Air|Wi-)"; then + echo "<result>Yes</result>" +else + echo "<result>No</result>" +fi + diff --git a/XprotectStatus.xml b/XprotectStatus.xml index 53e77a0..2dee951 100644 --- a/XprotectStatus.xml +++ b/XprotectStatus.xml @@ -1,19 +1,26 @@ - Xprotect Status - - string - EA to pull the modification date from Xprotect so that admins can see what version of Xprotect is in use on client machines. - -n.b. As Apple silently pushes Xprotect updates to clients if the service is enabled on the machine, the data this EA collects is a snapshot of Xprotect status at time of inventory and might not be the current status on a client machine. - #!/bin/sh + Xprotect Status + + string + Returns the LastModification timestamp of XProtect's metadata. On macOS 12+ the malware definitions are delivered via XProtectRemediator/XProtect.app updates so the meta file's mtime is a proxy for last definition update. + #!/bin/zsh -#Pulls Sophos version string from Sophos Anti-Virus.app +# Updated by SecurityShrimp 2026 +# XProtect Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Apple moved XProtect contents into XProtect.app on macOS 13+. The +# CoreTypes.bundle plist still exists and continues to track update times +# on every modern macOS, so we read it directly. -XPROTECT=`defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification` +stamp=$(/usr/bin/defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification 2>/dev/null) -echo "<result>$XPROTECT</result>" +# On 13+, also probe the newer XProtect.app version +if [[ -z "$stamp" && -d /Library/Apple/System/Library/CoreServices/XProtect.app ]]; then + stamp=$(/usr/bin/defaults read /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Resources/XProtect.meta LastModification 2>/dev/null) +fi -exit 0 +echo "<result>${stamp:-Unknown}</result>" + diff --git a/Xserve - Chassis Intrusion.xml b/Xserve - Chassis Intrusion.xml deleted file mode 100644 index 41e00e7..0000000 --- a/Xserve - Chassis Intrusion.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Chassis Intrusion Server This attribute returns whether or not a chassis intrusion has been detected. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Chassis Intrusion" | awk '{print $4}'` echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Cooling Fan Fault.xml b/Xserve - Cooling Fan Fault.xml deleted file mode 100644 index 5fe8874..0000000 --- a/Xserve - Cooling Fan Fault.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Cooling/Fan Fault Server This attribute returns whether or not a cooling/fan fault has been detected. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Cooling/Fan Fault" | awk '{print $4}'` if [ "$result" == "true" ]; then result="True" elif [ "$result" == "false" ]; then result="False" fi echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Drive Fault.xml b/Xserve - Drive Fault.xml deleted file mode 100644 index b29f808..0000000 --- a/Xserve - Drive Fault.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Drive Fault Server This attribute returns whether or not a drive fault has been detected. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Drive Fault" | awk '{print $4}'` if [ "$result" == "true" ]; then result="True" elif [ "$result" == "false" ]; then result="False" fi echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Front Panel Light.xml b/Xserve - Front Panel Light.xml deleted file mode 100644 index a3368c1..0000000 --- a/Xserve - Front Panel Light.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Front Panel Light Server This attribute returns whether or not the front panel light is enabled. Returned results include "on" or "off". string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Front Panel Light" | awk '{print $5}'` echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Front Panel Lockout.xml b/Xserve - Front Panel Lockout.xml deleted file mode 100644 index c16bfc2..0000000 --- a/Xserve - Front Panel Lockout.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Front Panel Lockout Server This attribute returns whether or not the front panel lockout function is enabled. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Front-Panel Lockout" | awk '{print $4}'` echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Last Power Event.xml b/Xserve - Last Power Event.xml deleted file mode 100644 index e73b85a..0000000 --- a/Xserve - Last Power Event.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Last Power Event Server This attribute returns the last power event returned from the Xserve. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Last Power Event" | awk '{print $5}'` echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Main Power Fault.xml b/Xserve - Main Power Fault.xml deleted file mode 100644 index 41f58d9..0000000 --- a/Xserve - Main Power Fault.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Main Power Fault Server This attribute returns whether or not an Xserve has experienced a recent Main Power Fault. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Main Power Fault" | awk '{print $5}'` if [ "$result" == "true" ]; then result="True" elif [ "$result" == "false" ]; then result="False" fi echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Power Control Fault.xml b/Xserve - Power Control Fault.xml deleted file mode 100644 index 6208c7a..0000000 --- a/Xserve - Power Control Fault.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Power Control Fault Server This attribute returns whether or not an Xserve has experienced a recent Power Control Fault. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Power Control Fault" | awk '{print $5}'` if [ "$result" == "true" ]; then result="True" elif [ "$result" == "false" ]; then result="False" fi echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Power Overload.xml b/Xserve - Power Overload.xml deleted file mode 100644 index 1f257d7..0000000 --- a/Xserve - Power Overload.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Power Overload Server This attribute returns whether or not an Xserve has experienced a recent Power Overload. string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Power Overload" | awk '{print $4}'` if [ "$result" == "true" ]; then result="True" elif [ "$result" == "false" ]; then result="False" fi echo "<result>$result</result>" fi \ No newline at end of file diff --git a/Xserve - Power Restore Policy.xml b/Xserve - Power Restore Policy.xml deleted file mode 100644 index 14ead56..0000000 --- a/Xserve - Power Restore Policy.xml +++ /dev/null @@ -1 +0,0 @@ - Xserve - Power Restore Policy Server This attribute returns the current Power Restore Policy enabled on the Xserve. Returned values include: "always-off", "always-on", "previous". string #!/bin/sh if [ -f "/usr/bin/ipmitool" ]; then result=`/usr/bin/ipmitool chassis status | grep "Power Restore Policy" | awk '{print $5}'` echo "<result>$result</result>" fi \ No newline at end of file diff --git a/activeinspireversion.xml b/activeinspireversion.xml deleted file mode 100644 index d89fcda..0000000 --- a/activeinspireversion.xml +++ /dev/null @@ -1,19 +0,0 @@ - - - - ActivInspire Version - - string - I don't take the credit for this script, it was swood@integer.com but I just edited so I could get the version of ActivInspire on my clients - - - #!/bin/bash - -# get the current version of activeinspire - -aiverion=`/bin/cat /Applications/Promethean/Activsoftware\ Inspire/Inspire.app/Contents/Info.plist | grep -A 1 -m 1 CFBundleGetInfoString | grep string | sed 's/[/]//' | sed 's/<string>//g'` - -echo "<result>$aiverion</result>" - -exit 0 - diff --git a/bootVolumeFreeSpace.xml b/bootVolumeFreeSpace.xml index e840fc2..359a7b2 100644 --- a/bootVolumeFreeSpace.xml +++ b/bootVolumeFreeSpace.xml @@ -4,10 +4,26 @@ Boot Volume Free Space integer - Returns the free space on the current boot volume in GB, rounded down to the nearest integer. - #!/bin/bash + Free space on the boot volume in GB (1 GB = 1,000,000,000 bytes), rounded down. Reflects APFS container free space so the value matches Finder's "Available". + #!/bin/zsh -free=`diskutil info /|grep "Free Space"|awk '{print $4}'` +# Updated by SecurityShrimp 2026 +# Boot Volume Free Space Extension Attribute +# Targets macOS 12 through 26 (Tahoe) +# Reads APFSContainerFree from diskutil's plist output so the result matches +# what Finder shows as "Available" (free + purgeable). Falls back to the +# per-volume FreeSpace on the rare non-APFS boot disk. -echo "<result>"${free%.*}"</result>" - \ No newline at end of file +infoPlist=$(/usr/sbin/diskutil info -plist / 2>/dev/null) + +freeBytes=$(echo "$infoPlist" | /usr/bin/plutil -extract APFSContainerFree raw - 2>/dev/null) +[[ -z "$freeBytes" || "$freeBytes" == "<null>" ]] \ + && freeBytes=$(echo "$infoPlist" | /usr/bin/plutil -extract FreeSpace raw - 2>/dev/null) + +if [[ -z "$freeBytes" || ! "$freeBytes" =~ ^[0-9]+$ ]]; then + echo "<result>Unknown</result>" +else + echo "<result>$(( freeBytes / 1000000000 ))</result>" +fi + + diff --git a/cachingCacheLimit.xml b/cachingCacheLimit.xml index 5760a8b..ba53b96 100644 --- a/cachingCacheLimit.xml +++ b/cachingCacheLimit.xml @@ -1,19 +1,27 @@ - - + - Caching Service Cache Size Limit - - string - This Extension Attribute will Identify if the Server App is installed to /Applications/Server.app and if so it will report the Caching Size Limit in bytes. - #!/bin/sh + Caching Service Cache Size Limit + + string + Reports the macOS Content Caching cache size limit in bytes. + #!/bin/zsh -if [ /Applications/Server.app ]; then +# Updated by SecurityShrimp 2026 +# Caching Service Cache Size Limit Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# macOS Server (Server.app) was discontinued in 2022; the Content Caching +# service is now built into base macOS and controlled via the Sharing +# preference pane / AssetCacheManagerUtil. The legacy serveradmin command +# no longer exists on modern macOS. -/bin/echo "<result>$(serveradmin settings caching:CacheLimit | awk '{print $3}'| sed s/\"//g)</result>" +limit=$(/usr/bin/defaults read /Library/Preferences/com.apple.AssetCache CacheLimit 2>/dev/null) +if [[ -n "$limit" && "$limit" -gt 0 ]]; then + echo "<result>${limit}</result>" +elif /usr/bin/AssetCacheManagerUtil status 2>/dev/null | /usr/bin/grep -q "Activated: true"; then + echo "<result>Unlimited</result>" else - /bin/echo "<result>Server App Not Installed</result>" - + echo "<result>Content Caching Not Active</result>" fi -exit + diff --git a/cachingDataPath.xml b/cachingDataPath.xml index a489f8f..555eb6d 100644 --- a/cachingDataPath.xml +++ b/cachingDataPath.xml @@ -1,19 +1,26 @@ - - + - Server App Caching Service Data Path - - string - This Extension Attribute will Identify if the Server App is installed to /Applications/Server.app and if so it will report the Data Path the Service is caching to. - #!/bin/sh + Content Caching Service Data Path + + string + Reports the macOS Content Caching data path. + #!/bin/zsh -if [ /Applications/Server.app ]; then +# Updated by SecurityShrimp 2026 +# Content Caching Service Data Path Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# macOS Server (Server.app) was discontinued in 2022; the Content Caching +# service is now built into base macOS and controlled via the Sharing +# preference pane / AssetCacheManagerUtil. The legacy serveradmin command +# no longer exists on modern macOS. -/bin/echo "<result>$(serveradmin settings caching:DataPath | awk '{print $3}'| sed s/\"//g)</result>" +path=$(/usr/bin/defaults read /Library/Preferences/com.apple.AssetCache CacheDataPath 2>/dev/null) -else - /bin/echo "<result>Server App Not Installed</result>" - +if [[ -z "$path" ]]; then + path=$(/usr/bin/AssetCacheManagerUtil settings 2>/dev/null \ + | /usr/bin/awk -F': ' '/CacheDataPath/ { print $2; exit }') fi -exit + +echo "<result>${path:-/Library/Application Support/Apple/AssetCache/Data}</result>" + diff --git a/cachingSavedCacheSize.xml b/cachingSavedCacheSize.xml index 2c0cae5..48cd382 100644 --- a/cachingSavedCacheSize.xml +++ b/cachingSavedCacheSize.xml @@ -1,19 +1,27 @@ - - + - Caching Service Saved Cache Size - - string - This Extension Attribute verifies that Server.app is installed at /Library/Applications and if installed reports how many bytes are being used by the Caching Service Saved Cache directory. - #!/bin/sh + Content Caching Saved Cache Size + + string + Reports the number of bytes currently used by the macOS Content Caching data store. + #!/bin/zsh -if [ /Applications/Server.app ]; then +# Updated by SecurityShrimp 2026 +# Content Caching Saved Cache Size Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# macOS Server (Server.app) was discontinued in 2022; the Content Caching +# service is now built into base macOS and controlled via the Sharing +# preference pane / AssetCacheManagerUtil. The legacy serveradmin command +# no longer exists on modern macOS. -/bin/echo "<result>$(serveradmin settings caching:SavedCacheSize | awk '{print $3}'| sed s/\"//g)</result>" +dataPath=$(/usr/bin/defaults read /Library/Preferences/com.apple.AssetCache CacheDataPath 2>/dev/null) +[[ -z "$dataPath" ]] && dataPath="/Library/Application Support/Apple/AssetCache/Data" +if [[ -d "$dataPath" ]]; then + bytes=$(/usr/bin/du -sk "$dataPath" 2>/dev/null | /usr/bin/awk '{print $1 * 1024}') + echo "<result>${bytes:-0}</result>" else - /bin/echo "<result>Server App Not Installed</result>" - + echo "<result>Content Caching Not Active</result>" fi -exit + diff --git a/cachingServiceStatus.xml b/cachingServiceStatus.xml index 5ef0681..ba0e434 100644 --- a/cachingServiceStatus.xml +++ b/cachingServiceStatus.xml @@ -1,19 +1,23 @@ - - + - Server App Caching Service Status - - string - This Extension Attribute will Identify if the Server App is installed to /Applications/Server.app and if so it will report the status of the Caching Service as either STOPPED or RUNNING. - #!/bin/sh + Content Caching Service Status + + string + Reports macOS Content Caching service status as RUNNING or STOPPED. + #!/bin/zsh -if [ /Applications/Server.app ]; then - -/bin/echo "<result>$(serveradmin status caching | awk '{print $3}'| sed s/\"//g)</result>" +# Updated by SecurityShrimp 2026 +# Content Caching Service Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# macOS Server (Server.app) was discontinued in 2022; the Content Caching +# service is now built into base macOS and controlled via the Sharing +# preference pane / AssetCacheManagerUtil. The legacy serveradmin command +# no longer exists on modern macOS. +if /usr/bin/AssetCacheManagerUtil status 2>/dev/null | /usr/bin/grep -q "Activated: true"; then + echo "<result>RUNNING</result>" else - /bin/echo "<result>Server App Not Installed</result>" - + echo "<result>STOPPED</result>" fi -exit + diff --git a/check_for_remote_management_accounts.xml b/check_for_remote_management_accounts.xml index 58ebbc4..c0c2c7b 100644 --- a/check_for_remote_management_accounts.xml +++ b/check_for_remote_management_accounts.xml @@ -1,43 +1,30 @@ - Check for local accounts which have Remote Management rights - - string - This attribute checks which local user accounts have Remote Management rights to access this Mac. - #!/bin/sh - -# Determines if the Remote Management settings are set -# for "All Users" or for "Only these users:" in System -# Preferences' Sharing preference pane - -ARD_ALL_LOCAL=`/usr/bin/defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers` - -# Lists all local user accounts on the Mac with a UID -# of greater or equal to 500 and less than 1024. This -# should exclude all system accounts and network accounts -# -# List is displayed if the "All Users" setting is -# set in the Remote Management settings. - -ALL_ID500_PLUS_LOCAL_USERS=`/usr/bin/dscl . list /Users UniqueID | awk '$2 >= 500 && $2 < 1024 { print $1; }'` - -# Lists all user accounts on the Mac that have been given -# explicit Remote Management rights. List is displayed if -# the "Only these users:" setting is set in the Remote -# Management settings. - -REMOTE_MANAGEMENT_ENABLED_USERS=`/usr/bin/dscl . list /Users naprivs | awk '{print $1}'` - - -if [ "$ARD_ALL_LOCAL" = "1" ]; then - result=$ALL_ID500_PLUS_LOCAL_USERS -elif [ "$ARD_ALL_LOCAL" = "0" ]; then - result=$REMOTE_MANAGEMENT_ENABLED_USERS + Check for local accounts which have Remote Management rights + + string + Lists local accounts allowed to connect via Apple Remote Desktop. If ARD is configured for "All Users", lists every local UID 500-1023. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Remote Management Accounts Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# kickstart -configure is the canonical ARD admin tool; we still read +# ARD_AllLocalUsers via defaults to determine the mode, then enumerate +# either every local user (UID 500-1023) or those granted naprivs. + +allLocal=$(/usr/bin/defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers 2>/dev/null) + +if [[ "$allLocal" == "1" ]]; then + result=$(/usr/bin/dscl . list /Users UniqueID 2>/dev/null \ + | /usr/bin/awk '$2 >= 500 && $2 < 1024 { print $1 }') +elif [[ "$allLocal" == "0" ]]; then + result=$(/usr/bin/dscl . list /Users naprivs 2>/dev/null | /usr/bin/awk '{print $1}') +else + result="ARD Not Configured" fi -# Displays list of accounts that have -# been given Remote Management rights - -echo "<result>$result</result>" +echo "<result>${result}</result>" + diff --git a/check_kbox_1000_agent_version.xml b/check_kbox_1000_agent_version.xml index f1daec6..fb4e7b8 100644 --- a/check_kbox_1000_agent_version.xml +++ b/check_kbox_1000_agent_version.xml @@ -1,20 +1,24 @@ - Kace KBox 1000 6.x and later - - string - Updated Casper Extension Attribute for Kace KBox 1000. Previous versions of the KBox 1000 EA do not pull information correctly for both 5.x and 6.x; this updated version handles both and returns the correct version of the Kace agent. - #!/bin/sh + Kace KBox 1000 6.x and later + + string + Returns the installed Quest KACE (formerly Dell KACE) KBox 1000 agent version, or "Not installed". + #!/bin/zsh -# Check to see if the KBox agent is installed. -# If the agent is installed, report the agent -# version. +# Updated by SecurityShrimp 2026 +# Quest KACE Agent Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -if [ -f "/Library/Application Support/Dell/KACE/data/version" ]; then - result=`cat "/Library/Application Support/Dell/KACE/data/version" | awk 'NR == 1'` - echo "<result>$result</result>" +versionFile="/Library/Application Support/Dell/KACE/data/version" +[[ ! -f "$versionFile" ]] && versionFile="/Library/Application Support/Quest/KACE/data/version" + +if [[ -f "$versionFile" ]]; then + version=$(/usr/bin/head -n1 "$versionFile") + echo "<result>${version:-Unknown}</result>" else - echo "<result>Not installed</result>" -fi + echo "<result>Not installed</result>" +fi + diff --git a/com.apple.screensaver - Require Password.xml b/com.apple.screensaver - Require Password.xml index 6c44d01..b30a3c3 100644 --- a/com.apple.screensaver - Require Password.xml +++ b/com.apple.screensaver - Require Password.xml @@ -1 +1,30 @@ - com.apple.screensaver - Require Password Managed Preferences string This attribute returns enforcement status of the "Require Password" screensaver setting. Since the com.apple.screensaver domain only applies to the user space, the managed preferences will be queried for the last user to login. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh currentUser=`last -1 -t console | awk '{print $1}'` if [ -f "/usr/bin/mcxquery" ]; then result=`/usr/bin/mcxquery -user "$currentUser" | grep -A 1 -w com.apple.screensaver | tail -1 | awk '{print $5}'` if [ "$result" == "0" ]; then result="False" elif [ "$result" == "1" ]; then result="True" else result="Not set." fi fi echo "<result>$result</result>" \ No newline at end of file + + + com.apple.screensaver - Require Password + Managed Preferences + string + Reports the askForPassword setting from com.apple.screensaver for the current console user (True/False/Not set). + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# com.apple.screensaver Require Password Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# mcxquery is non-functional under modern Configuration Profile delivery +# (MCX deprecated since 10.7). Read the canonical pref directly, preferring +# Managed Preferences when present. + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +raw=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.apple.screensaver" askForPassword 2>/dev/null) +[[ -z "$raw" ]] && raw=$(/usr/bin/defaults read "$home/Library/Preferences/com.apple.screensaver" askForPassword 2>/dev/null) + +case "$raw" in + 1) echo "<result>True</result>" ;; + 0) echo "<result>False</result>" ;; + *) echo "<result>Not set.</result>" ;; +esac + + diff --git a/com.microsoft.autoupdate2 - Update Method.xml b/com.microsoft.autoupdate2 - Update Method.xml index 6611170..b270460 100644 --- a/com.microsoft.autoupdate2 - Update Method.xml +++ b/com.microsoft.autoupdate2 - Update Method.xml @@ -1 +1,26 @@ - com.microsoft.autoupdate2 - Update Method Managed Preferences This attribute returns enforcement status of the "Update Method" screensaver setting. Since the com.microsoft.autoupdate2 domain only applies to the user space, the managed preferences will be queried for the last user to login. This extension attribute requires this preference be set using Managed Preferences (MCX). string #!/bin/sh currentUser=`last -1 -t console | awk '{print $1}'` if [ -f "/usr/bin/mcxquery" ]; then result=`/usr/bin/mcxquery -user "$currentUser" | grep -A 1 -w com.microsoft.autoupdate2 | tail -1 | awk '{print $5}'` if [ "$result" == "" ]; then result="Not set." fi fi echo "<result>$result</result>" \ No newline at end of file + + + com.microsoft.autoupdate2 - Update Method + Managed Preferences + Reports the Microsoft AutoUpdate (MAU) HowToCheck setting from com.microsoft.autoupdate2 for the current console user. + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Microsoft AutoUpdate Update Method Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# mcxquery is non-functional under modern Configuration Profile delivery. +# Read the canonical pref directly. The bundle ID is com.microsoft.autoupdate2 +# even though the binary is now "Microsoft AutoUpdate 4.x". + +user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" 2>/dev/null \ + | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3; exit }') +[[ -z "$user" || "$user" == "root" ]] && user=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) +home=$(/usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null | /usr/bin/awk '{print $2}') + +method=$(/usr/bin/defaults read "/Library/Managed Preferences/$user/com.microsoft.autoupdate2" HowToCheck 2>/dev/null) +[[ -z "$method" ]] && method=$(/usr/bin/defaults read "$home/Library/Preferences/com.microsoft.autoupdate2" HowToCheck 2>/dev/null) + +echo "<result>${method:-Not set.}</result>" + + diff --git a/configurationProfileCheck.xml b/configurationProfileCheck.xml index 5896667..9f96fde 100644 --- a/configurationProfileCheck.xml +++ b/configurationProfileCheck.xml @@ -1,28 +1,27 @@ - - -profileName Present -This extension attribute determines whether a given Configuration Profile is present on the computer. -The name of the profile being searched for must be filled in between the quotes in the "Define Profile" section of the script. It is also recommended to replace "profileName in the display name of this extension attribute. -Values returned are "Yes" if profile is present and "No" if profile is not present. -string -#!/bin/bash - -############################################################################### -# Define Profile # -# Fill in the name of the profile being searched for between the quotes below # -############################################################################### - -profileName="" - -############################################### -# Script Body - Do not modify below this line # -############################################### - -if [ "$(profiles -Pv | grep "$profileName" | cut -d ' ' -f 4-)" == "$profileName" ] -then echo "<result>Yes</result>" -else echo "<result>No</result>" -fi - -exit 0 - - + + + profileName Present + Reports whether a named Configuration Profile is installed. Fill in profileName before deployment. Returns "Yes" or "No". + string + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# Configuration Profile Presence Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Edit profileName below before deploying. Matches against the profile's +# displayName, which is what `profiles -Pv` prints after "attribute: name". + +profileName="" + +if [[ -z "$profileName" ]]; then + echo "<result>profileName not configured</result>" + exit 0 +fi + +if /usr/bin/profiles -Pv 2>/dev/null | /usr/bin/grep -q "attribute: name: ${profileName}$"; then + echo "<result>Yes</result>" +else + echo "<result>No</result>" +fi + + diff --git a/dashboard-email-addresses.xml b/dashboard-email-addresses.xml deleted file mode 100644 index 1dcfc22..0000000 --- a/dashboard-email-addresses.xml +++ /dev/null @@ -1,76 +0,0 @@ -StringDashboard: Email AddressesGather the email accounts that are set up in Apple Mail and Microsoft Outlook for relay to Robot Cloud Dashboard. Required for Zendesk integration.Extension Attributes#!/bin/bash - -# Gather Email Addresses -# Written by Robot Cloud for Dashboard -# http://www.forgetcomputers.com/dashboard/ - -##################################[ VARIABLE DEFINITIONS ]################################# -########################################################################################### - -pathData="/usr/local/dashboard/data/EmailAddresses.dat" - -####################################[ SCRIPT BEGINS ]###################################### -############################[ DO NOT MODIFY BELOW THIS LINE ]############################## - -function DashboardStructure { - # Ensure the appropriate directories are in place. - mkdir -p /usr/local/dashboard/{bin,data,logs} - CheckAppleMail - CheckOutlook -} - -function CheckAppleMail { - if [ `ps aux | grep -c "Mail.ap[p]"` -gt "0" ]; then - accountsMail=$(/usr/bin/osascript <<-EOF - tell application "Mail" - user name of every account - end tell - EOF) - for account in $accountsMail; do - if [ `echo $account | grep -c "@"` -gt "0" ]; then - echo $account | tr -d "," >> "$pathData" - fi - done - fi -} - -function CheckOutlook { - if [ `ps aux | grep -c "Microsoft Outlook.ap[p]"` -gt "0" ]; then - accountsOutlook=`/usr/bin/osascript <<-EOT - tell application "Microsoft Outlook" - user name of every exchange account - end tell - EOT` - for account in $accountsOutlook; do - if [ `echo $account | grep -c "@"` -gt "0" ]; then - echo $account | tr -d "," >> "$pathData" - fi - done - accountsOutlookIMAP=$(/usr/bin/osascript <<-EOF - tell application "Microsoft Outlook" - user name of every imap account - end tell - EOF) - for account in $accountsOutlookIMAP; do - if [ `echo $account | grep -c "@"` -gt "0" ]; then - echo $account | tr -d "," >> "$pathData" - fi - done - fi -} - -function ReportResult { - if [ -e "$pathData" ]; then - cat "$pathData" | sort -u > "$pathData.tmp" - mv "$pathData.tmp" "$pathData" - echo "<result>`cat $pathData`</result>" - else - echo "<result>N/A</result>" - fi -} - -####################################[ FUNCTION CALLS ]##################################### -########################################################################################### - -DashboardStructure -ReportResult \ No newline at end of file diff --git a/detect_bootcamp_partition.xml b/detect_bootcamp_partition.xml index 8cfbf69..6705146 100644 --- a/detect_bootcamp_partition.xml +++ b/detect_bootcamp_partition.xml @@ -1,36 +1,27 @@ - Detect Bootcamp Partition - - string - This attribute uses the diskutil list command to check for disk partitions reporting as "Microsoft Basic Data". These partitions are used by Apple's Bootcamp. - -If Microsoft Basic Data partition is reported by diskutil, script reports "Yes". If no Microsoft Basic Data partition is reported by diskutil, script reports "No". - #!/bin/sh + Detect Bootcamp Partition + + string + Reports "Yes" if a Microsoft Basic Data partition is present, "No" otherwise. Returns "N/A" on Apple Silicon (Boot Camp is Intel-only). + #!/bin/zsh -# -# Using diskutil list to check for -# disk partitions reporting as -# "Microsoft Basic Data" -# +# Updated by SecurityShrimp 2026 +# Detect Boot Camp Partition Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only +# Boot Camp doesn't exist on Apple Silicon. On Intel, a Boot Camp install +# creates a "Microsoft Basic Data" partition that diskutil enumerates. -BOOTCAMP_DETECT=$( /usr/sbin/diskutil list | grep -c "Microsoft Basic Data" ) - -# -# If Microsoft Basic Data partition is -# reported by diskutil, script reports -# "Yes". If no Microsoft Basic Data partition -# is reported by diskutil, script reports "No". -# - -if [[ "${BOOTCAMP_DETECT}" == "1" ]]; then - result=Yes - else - result=No +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 fi -echo "<result>$result</result>" -exit 0 +if /usr/sbin/diskutil list 2>/dev/null | /usr/bin/grep -q "Microsoft Basic Data"; then + echo "<result>Yes</result>" +else + echo "<result>No</result>" +fi diff --git a/detectiLok.xml b/detectiLok.xml index 5404481..2816c53 100644 --- a/detectiLok.xml +++ b/detectiLok.xml @@ -1,16 +1,24 @@ - List iLok Serial - - string - EA to list attached iLok USB device Serial - #!/bin/sh -## Script to detect and enumerate attached iLok Serial + List iLok Serial + + string + Returns the serial number of every attached PACE iLok USB device, comma-separated. + #!/bin/zsh -SERIAL=`system_profiler SPUSBDataType | grep -B 5 -i ': iLok' | grep 'Serial' | cut -f 2 -d ":" | sed -e "s/ //"` -#SERIAL=`system_profiler SPUSBDataType | grep -B 5 -i ': iLok' | grep 'Serial'` +# Updated by SecurityShrimp 2026 +# iLok USB Detection Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -echo '<result>'$SERIAL'</result>' +serials=$(/usr/sbin/system_profiler SPUSBDataType 2>/dev/null \ + | /usr/bin/awk ' + /Product ID:/ { p=0 } + /: iLok|iLok 3:|iLok USB/ { p=1 } + p && /Serial Number:/ { sub(/^[[:space:]]*Serial Number: /, ""); print; p=0 } + ' \ + | /usr/bin/paste -sd ',' -) + +echo "<result>${serials:-No iLok attached}</result>" diff --git a/ds-backup-crashplan-log.xml b/ds-backup-crashplan-log.xml deleted file mode 100644 index bc7c851..0000000 --- a/ds-backup-crashplan-log.xml +++ /dev/null @@ -1,176 +0,0 @@ -StringDS Backup: CrashPlan LogParses local CrashPlan log for backup info.Backup#!/usr/bin/env python - -from codecs import open -from datetime import datetime, timedelta, tzinfo -from xml.dom.minidom import Element -import os -import re -import time - -APP_LOG = '/Library/Logs/CrashPlan/app.log' - -ZERO = timedelta(0) - -RE_DEST_SIZE = re.compile('remoteManifestSize=(?P<total>\d+)') - -XML_TAG_LOOKUP = { - 'backup_sets': ('backup_set', 'id'), - 'destinations': ('destination', 'name') -} - - -def cp_stats(applog): - if not os.path.exists(applog): - return no_applog(applog) - - applog = open(applog, 'U', 'utf-8').read() - if is_old_proe_client(applog): - backup_sets, destinations = cpp(applog) - else: - backup_sets, destinations = non_cpp(applog) - return mkresult(backup_sets, destinations).toxml() - - -def is_old_proe_client(applog): - RE_PRO = re.compile('ProClient.*=\s+(.*)') - try: - if RE_PRO.search(applog).group(1).lower() == 'true': - return True - return False - except AttributeError: - return False - - -def mkresult(backup_sets, destinations): - r = Element('result') - c = r.appendChild(Element('crashplan_log')) - for k, v in XML_TAG_LOOKUP.items(): - c.appendChild(dict_to_xml(locals()[k], k, v[0], v[1])) - return r - - -def dict_to_xml(d, container, node, key_label): - c = Element(container) - - for k, v in d.items(): - n = c.appendChild(Element(node)) - n.setAttribute(key_label, k) - for k, v in v.items(): - if type(v) is not dict: - n.setAttribute(k, v) - else: - n_label, k_label = XML_TAG_LOOKUP[k] - n.appendChild(dict_to_xml(v, k, n_label, k_label)) - return c - - -def _parse_dest_detail(block, regex, destinations): - m = regex.search(block) - dest_name = m.group('name') - cp_props = open( - os.path.join(m.group('cache').strip(), 'cp.properties'), 'U', - 'utf-8').read() - destinations[dest_name] = { - 'total': RE_DEST_SIZE.search(cp_props).group('total')} - - return m, dest_name, cp_props - - -class UTC(tzinfo): - def utcoffset(self, dt): - return ZERO - - def tzname(self, dt): - return "UTC" - - def dst(self, dt): - return ZERO - - -def as_utc(timestr): - RE_DT = re.compile('\d+-\d+-\d+T\d+:\d+:\d+') - dt = datetime.fromtimestamp( - time.mktime( - time.strptime(RE_DT.search(timestr).group(), '%Y-%m-%dT%H:%M:%S')), - UTC() - ) - return dt.isoformat() - - -def cpp(applog): - RE_BACKUP_SIZE = re.compile('totalSize\s+=\s+(?P<size>.*)') - RE_DEST_BLOCK = re.compile('DESTINATIONS\s+(?P<block>\d+.*?)\s+\*{99}', - re.M | re.DOTALL) - RE_DEST_DETAIL = re.compile( - '(?P<id>\d+), (?P<name>.*?),.* (?P<percent>\d+.*?)% complete,.*' - 'cache=(?P<cache>.*)') - RE_LAST_BACKUP = re.compile('lastBackupTimestamp=(.*)') - - backup_set = {'name': 'Default'} - backup_sets = {'1': backup_set} - destinations = {} - - m = RE_BACKUP_SIZE.search(applog) - # There's a possibility that CP is scanning the drive and totalSize is not - # present. - if m: - backup_set['size'] = m.group('size').strip() - - for l in RE_DEST_BLOCK.search(applog).group('block').split('\n'): - m, dest_name, cp_props = _parse_dest_detail( - l, RE_DEST_DETAIL, destinations) - last_backup = RE_LAST_BACKUP.search(cp_props).group(1).\ - replace('\\', '') - d = backup_set.setdefault('destinations', {}) - d[dest_name] = {'percent_complete': m.group('percent'), - 'last_backup': as_utc(last_backup)} - - return backup_sets, destinations - - -def non_cpp(applog): - RE_BACKUP_NAME = re.compile( - '<backupSet id="(?P<id>\d+)">\s+<name>(?P<name>.*?)</name>', re.M - ) - RE_BACKUP_SIZE = re.compile( - 'BACKUP SET (?P<id>\d+).*?totalSize\s+=\s+(?P<size>.*?)\n', - re.M | re.DOTALL - ) - RE_DEST_BLOCK = re.compile( - '-{99}\s+DESTINATIONS\s+(?P<block>\d+.*?)\s+(?=-{99})', re.M | - re.DOTALL - ) - RE_DEST_DETAIL = re.compile( - '(?P<id>\d+), (?P<name>.*?),.*cache=(?P<cache>.*)' - ) - RE_SET_COMPLETE = re.compile('setId=(?P<id>\d+):\s+(?P<percent>.*)%') - - backup_sets = {} - destinations = {} - - for m in RE_BACKUP_NAME.finditer(applog): - backup_sets.setdefault(m.group('id'), {})['name'] = m.group('name') - - for m in RE_BACKUP_SIZE.finditer(applog): - backup_sets[m.group('id')]['size'] = m.group('size').strip() - - for db in RE_DEST_BLOCK.finditer(applog): - m, dest_name, cp_props = _parse_dest_detail( - db.group('block'), RE_DEST_DETAIL, destinations) - for m in RE_SET_COMPLETE.finditer(db.group('block')): - d = backup_sets[m.group('id')].setdefault('destinations', {}) - d[dest_name] = {'percent_complete': m.group('percent')} - re_last_backup = re.compile( - 'lastBackupTimestamp_%s=(.*)' % m.group('id')) - d[dest_name]['last_backup'] = as_utc(re_last_backup.search( - cp_props).group(1).replace('\\', '')) - - return backup_sets, destinations - - -def no_applog(applog): - return '<result>%s does not exist</result>' % applog - - -if __name__ == '__main__': - print(cp_stats(APP_LOG)) \ No newline at end of file diff --git a/ds-backup-tm-last-backup-time.xml b/ds-backup-tm-last-backup-time.xml deleted file mode 100644 index 949922e..0000000 --- a/ds-backup-tm-last-backup-time.xml +++ /dev/null @@ -1,102 +0,0 @@ -StringDS Backup: TM Last Backup TimeLatest Time Machine backup timestamp.Backup#!/usr/bin/env python - -from datetime import timedelta, tzinfo -from shlex import split -from subprocess import Popen, PIPE -import os -import plistlib - -ZERO = timedelta(0) -NOT_ENABLED = u'Not enabled.' -TM_PREFS_PATH = '/Library/Preferences/com.apple.TimeMachine.plist' -TM_RESULTS_PATH = '/private/var/db/.TimeMachine.Results.plist' - - -class UTC(tzinfo): - """UTC""" - def utcoffset(self, dt): - return ZERO - - def tzname(self, dt): - return "UTC" - - def dst(self, dt): - return ZERO - - -def render_timestamp(dt): - if not dt.tzinfo: - dt = dt.replace(tzinfo=UTC()) - return dt.strftime('%Y-%m-%d %H:%M:%S %z') - - -def popen(command): - return Popen(split(command), stdout=PIPE).stdout.read() - - -def parse_plist(plist_path): - cmd = '/usr/bin/plutil -convert xml1 -o - "%s"' % plist_path - xml_plist = popen(cmd) - return plistlib.readPlistFromString(xml_plist) - - -def get_prefs_version(prefs): - return prefs.get('PreferencesVersion', -1) - - -def pre_version2_result(results): - result = NOT_ENABLED - if os.path.isfile(results): - tm_status = parse_plist(results) - if tm_status.get('BACKUP_COMPLETED_DATE'): - result = render_timestamp(tm_status['BACKUP_COMPLETED_DATE']) - return result - - -def get_tm_result(prefs, tm_pref_handler): - result = NOT_ENABLED - if tm_pref_handler(prefs): - result = render_timestamp(max(tm_pref_handler(prefs))) - return result - - -def v2_parser(tm_status): - snapshot_timestamps = [] - for d in tm_status['Destinations']: - completed = d.get('BACKUP_COMPLETED_DATE') - if completed: - snapshot_timestamps.append(completed) - return snapshot_timestamps - - -def v3_parser(tm_status): - snapshot_timestamps = [] - for d in tm_status['Destinations']: - snapshot_timestamps.extend(d.get('SnapshotDates', [])) - return snapshot_timestamps - - -def get_tm_status(prefs, results=TM_RESULTS_PATH): - # If the preferences plist doesn't even exist - if not os.path.isfile(prefs): - return u"<result>%s</result>" % NOT_ENABLED - - prefs = parse_plist(prefs) - version = int(get_prefs_version(prefs)) - - # If AutoBackup doesn't exist or isn't enabled - if not int(prefs.get('AutoBackup', 0)): - return u"<result>%s</result>" % NOT_ENABLED - - if version == 3: - last_backup = get_tm_result(prefs, v3_parser) - elif version == 2: - last_backup = get_tm_result(prefs, v2_parser) - else: - last_backup = pre_version2_result(results) - - return u"<result>%s</result>" % last_backup - - -if __name__ == '__main__': - print get_tm_status(TM_PREFS_PATH) \ No newline at end of file diff --git a/ds-battery-design-capacity.xml b/ds-battery-design-capacity.xml deleted file mode 100644 index 62f385e..0000000 --- a/ds-battery-design-capacity.xml +++ /dev/null @@ -1,3 +0,0 @@ -integerDS Battery: Design CapacityThis attribute returns the Design Capacity value of a notebook battery.Extension Attributes#!/bin/sh -result=$(ioreg -r -c "AppleSmartBattery" | awk '/DesignCap/ {print $3}') -echo "<result>$result</result>" \ No newline at end of file diff --git a/ds-battery-max-capacity.xml b/ds-battery-max-capacity.xml deleted file mode 100644 index 138b0c5..0000000 --- a/ds-battery-max-capacity.xml +++ /dev/null @@ -1,3 +0,0 @@ -integerDS Battery: Max CapacityThis attribute returns the Max Capacity value of a notebook battery.Extension Attributes#!/bin/sh -result=$(ioreg -r -c "AppleSmartBattery" | awk '/MaxCap/ {print $3}') -echo "<result>$result</result>" \ No newline at end of file diff --git a/ds-memory-detail.xml b/ds-memory-detail.xml deleted file mode 100644 index 24c226e..0000000 --- a/ds-memory-detail.xml +++ /dev/null @@ -1,3 +0,0 @@ -StringDS Memory: DetailRAM details including bank info and status.System Information#!/bin/sh -memDetailXML=`/usr/sbin/system_profiler SPMemoryDataType -xml | /usr/bin/xmllint --noblanks - | /usr/bin/xpath /plist/array/dict/array/dict/array 2>/dev/null` -echo "<result><plist>$memDetailXML</plist></result>" \ No newline at end of file diff --git a/ds-workload-load-average.xml b/ds-workload-load-average.xml deleted file mode 100644 index 8974fdf..0000000 --- a/ds-workload-load-average.xml +++ /dev/null @@ -1,2 +0,0 @@ -StringDS Workload: Load AverageLoad average snapshot.System Information#!/bin/sh -echo "<result>$(/usr/bin/uptime | /usr/bin/awk '{print $NF}')</result>" \ No newline at end of file diff --git a/ds-workload-vm-paging.xml b/ds-workload-vm-paging.xml deleted file mode 100644 index 44945a9..0000000 --- a/ds-workload-vm-paging.xml +++ /dev/null @@ -1,6 +0,0 @@ -StringDS Workload: VM PagingPaging information since last reboot.System Information#!/bin/sh -pageIns=`/usr/bin/vm_stat | /usr/bin/grep -i pageins | /usr/bin/awk '{print $NF}' | /usr/bin/sed 's/\.//'` -pageIns="<page_ins>$pageIns</page_ins>" -pageOuts=`/usr/bin/vm_stat | /usr/bin/grep -i pageouts | /usr/bin/awk '{print $NF}' | /usr/bin/sed 's/\.//'` -pageOuts="<page_outs>$pageOuts</page_outs>" -echo "<result><stats>$pageIns$pageOuts</stats></result>" \ No newline at end of file diff --git a/efiBits.xml b/efiBits.xml index 9be47e3..055eecf 100644 --- a/efiBits.xml +++ b/efiBits.xml @@ -1,13 +1,24 @@ - EFI Bits - - string - Returns returns the Mac's EFI bits. - #!/bin/bash + EFI Bits + + string + Returns the Mac's firmware ABI width (EFI32 or EFI64). N/A on Apple Silicon, which boots iBoot rather than EFI. + #!/bin/zsh -# returns the Mac's EFI bits +# Updated by SecurityShrimp 2026 +# EFI Bits Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only -echo "<result>"`ioreg -l -p IODeviceTree | awk '/firmware-abi/ { split($0, line, "\""); printf("%s\n", line[4]); }'`"</result>" +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 +fi + +bits=$(/usr/sbin/ioreg -l -p IODeviceTree 2>/dev/null \ + | /usr/bin/awk -F'"' '/firmware-abi/ { print $4; exit }') + +echo "<result>${bits:-Unknown}</result>" + diff --git a/eficheck.xml b/eficheck.xml index fff43dc..9434608 100644 --- a/eficheck.xml +++ b/eficheck.xml @@ -1,31 +1,29 @@ -EFI Password -Device Security -string -Displays "Set" if a firmware password is set; displays "Not Set" if no firmware password is set. - -#!/bin/sh -################ -# Most authorship of the following script by Jamf Nation user: snovak -# Additional edits by Jamf Nation user: mwoodruff -################ -# Regex for OS detection +10.10 -OSREGEX="^1[0-9]$" -# Gets the OS version -OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}') -if [[ $OSVERS =~ $OSREGEX ]]; then - fwmode=`firmwarepasswd -mode | grep Mode | awk -F. '{print $1}'` - fwmode=${fwmode:6} -else - fwmode=`nvram -p | grep security-mode | awk '{print $2}'` + EFI Password + Device Security + string + Reports "Set" or "Not Set" for the firmware password. Returns "N/A" on Apple Silicon (the concept doesn't apply). + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# EFI Password Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel only +# firmwarepasswd was removed in macOS 14 (Apple Silicon never had it). +# nvram security-mode remains the authoritative source on Intel Macs and +# works whether or not firmwarepasswd is present. + +if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then + echo "<result>N/A</result>" + exit 0 fi -if [ "$fwmode" == "none" ]; then - echo "<result>Not Set</result>" -elif [ "$fwmode" != "" ]; then - echo "<result>Set</result>" -else - echo "<result>Not Set</result>" + +mode=$(/usr/sbin/nvram -p 2>/dev/null | /usr/bin/awk '/security-mode/ { print $2; exit }') + +if [[ -z "$mode" || "$mode" == "none" ]]; then + echo "<result>Not Set</result>" +else + echo "<result>Set</result>" fi diff --git a/filevault_2_encryption_check_extension_attribute.xml b/filevault_2_encryption_check_extension_attribute.xml index 385e3d1..ff192a2 100644 --- a/filevault_2_encryption_check_extension_attribute.xml +++ b/filevault_2_encryption_check_extension_attribute.xml @@ -1,126 +1,39 @@ - FIlevault 2 Encryption Status - - string - This extension attribute checks to see if a Mac is running 10.7 or not. If the Mac in question is running 10.7, the extension attribute reports on whether or not it is encrypted with Apple's FileVault 2 encryption and gives the encryption or decryption status. - - #!/bin/sh - -CORESTORAGESTATUS="/private/tmp/corestorage.txt" -ENCRYPTSTATUS="/private/tmp/encrypt_status.txt" -ENCRYPTDIRECTION="/private/tmp/encrypt_direction.txt" - -# Get number of CoreStorage devices. The egrep pattern used later in the script -# uses this information to only report on the first encrypted drive, which should -# be the boot drive. - -DEVICE_COUNT=`diskutil cs list | grep -E "^CoreStorage logical volume groups" | awk '{print $5}' | sed -e's/(//'` - -EGREP_STRING="" -if [ "$DEVICE_COUNT" != "1" ]; then - EGREP_STRING="^\| *" -fi - -OS=`/usr/bin/sw_vers | grep ProductVersion | cut -c 17-20` -CONTEXT=`diskutil cs list | grep -E "$EGREP_STRING\Encryption Context" | sed -e's/\|//' | awk '{print $3}'` -ENCRYPTION=`diskutil cs list | grep -E "$EGREP_STRING\Encryption Type" | sed -e's/\|//' | awk '{print $3}'` -CONVERTED=`diskutil cs list | grep -E "$EGREP_STRING\Size \(Converted\)" | sed -e's/\|//' | awk '{print $5, $6}'` -SIZE=`diskutil cs list | grep -E "$EGREP_STRING\Size \(Total\)" | sed -e's/\|//' | awk '{print $5, $6}'` - -# Checks to see if the OS on the Mac is 10.7 or not. -# If it is not, the following message is displayed without quotes: -# "FileVault 2 Encryption Not Available For This Version Of Mac OS X" - -if [ "$OS" != "10.7" ]; then - echo '<result>'FileVault 2 Encryption Not Available For This Version Of Mac OS X'</result>' -fi - - - -if [ "$OS" = "10.7" ]; then - diskutil cs list >> $CORESTORAGESTATUS - - # If the Mac is running 10.7, but not does not have - # any CoreStorage volumes, the following message is - # displayed without quotes: - # "FileVault 2 Encryption Not Enabled" - - if grep -iE 'No CoreStorage' $CORESTORAGESTATUS; then - echo '<result>'FileVault 2 Encryption Not Enabled'</result>' - fi - - # If the Mac is running 10.7 and has CoreStorage volumes, - # the script then checks to see if the machine is encrypted, - # encrypting, or decrypting. - # - # If encrypted, the following message is - # displayed without quotes: - # "FileVault 2 Encryption Complete" - # - # If encrypting, the following message is - # displayed without quotes: - # "FileVault 2 Encryption Proceeding." - # How much has been encrypted of of the total - # amount of space is also displayed. If the - # amount of encryption is for some reason not - # known, the following message is - # displayed without quotes: - # "FileVault 2 Encryption Status Unknown. Please check." - # - # If decrypting, the following message is - # displayed without quotes: - # "FileVault 2 Decryption Proceeding" - # How much has been decrypted of of the total - # amount of space is also displayed - # - # If fully decrypted, the following message is - # displayed without quotes: - # "FileVault 2 Decryption Complete" - # - - - if grep -iE 'Logical Volume Family' $CORESTORAGESTATUS; then - if [ "$CONTEXT" = "Present" ]; then - if [ "$ENCRYPTION" = "AES-XTS" ]; then - diskutil cs list | grep -E "$EGREP_STRING\Conversion Status" | sed -e's/\|//' | awk '{print $3}' >> $ENCRYPTSTATUS - if grep -iE 'Complete' $ENCRYPTSTATUS; then - echo '<result>'FileVault 2 Encryption Complete'</result>' - else - if grep -iE 'Converting' $ENCRYPTSTATUS; then - diskutil cs list | grep -E "$EGREP_STRING\Conversion Direction" | sed -e's/\|//' | awk '{print $3}' >> $ENCRYPTDIRECTION - if grep -iE 'forward' $ENCRYPTDIRECTION; then - echo '<result>'FileVault 2 Encryption Proceeding. $CONVERTED of $SIZE Remaining'</result>' - else - echo '<result>'FileVault 2 Encryption Status Unknown. Please check.'</result>' - fi - fi - fi - else - if [ "$ENCRYPTION" = "None" ]; then - diskutil cs list | grep -E "$EGREP_STRING\Conversion Direction" | sed -e's/\|//' | awk '{print $3}' >> $ENCRYPTDIRECTION - if grep -iE 'backward' $ENCRYPTDIRECTION; then - echo '<result>'FileVault 2 Decryption Proceeding. $CONVERTED of $SIZE Remaining'</result>' - elif grep -iE '-none-' $ENCRYPTDIRECTION; then - echo '<result>'FileVault 2 Decryption Completed'</result>' - fi - fi - fi - fi -fi -fi -# Remove the temp files created during the script - -if [ -f /private/tmp/corestorage.txt ]; then - rm /private/tmp/corestorage.txt -fi - -if [ -f /private/tmp/encrypt_status.txt ]; then - rm /private/tmp/encrypt_status.txt -fi - -if [ -f /private/tmp/encrypt_direction.txt ]; then - rm /private/tmp/encrypt_direction.txt -fi + FileVault 2 Encryption Status + + string + Reports the FileVault 2 status of the boot volume. Possible values: "Encrypted", "Not Encrypted", "Encrypting", "Decrypting", or status messages from fdesetup. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# FileVault 2 Encryption Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Original 200-line script relied on CoreStorage (HFS+) which is gone on +# modern macOS. APFS introduced fdesetup, which returns concise, scriptable +# status. We surface fdesetup's authoritative state directly. + +status=$(/usr/bin/fdesetup status 2>/dev/null) + +case "$status" in + *"FileVault is On."*) + if echo "$status" | /usr/bin/grep -q "Encryption in progress"; then + pct=$(echo "$status" | /usr/bin/awk -F'= ' '/Percent completed/ { print $2; exit }') + echo "<result>Encrypting ${pct}</result>" + elif echo "$status" | /usr/bin/grep -q "Decryption in progress"; then + pct=$(echo "$status" | /usr/bin/awk -F'= ' '/Percent completed/ { print $2; exit }') + echo "<result>Decrypting ${pct}</result>" + else + echo "<result>Encrypted</result>" + fi + ;; + *"FileVault is Off."*) + echo "<result>Not Encrypted</result>" + ;; + *) + echo "<result>${status:-Unknown}</result>" + ;; +esac + diff --git a/findfirstpreferredwirelessnetwork.xml b/findfirstpreferredwirelessnetwork.xml index f03feb4..02db563 100644 --- a/findfirstpreferredwirelessnetwork.xml +++ b/findfirstpreferredwirelessnetwork.xml @@ -1,21 +1,30 @@ - Find First Preferred Wireless Network - - string - This will provide the name of the wireless network that is first on the list of preferred wireless networks. - #!/bin/bash -# Extension attribute to find the wireless network that's first on the list -# Lauren Caliolio 8/22/2014 -# Contact me: laurendc@gmail.com, twitter @laurendc or JAMFNation: laurendc + Find First Preferred Wireless Network + + string + Returns the SSID at the top of the preferred wireless networks list. + #!/bin/zsh -# Find device on hardware irregardless of model -WIFI_DEVICE=`/usr/sbin/networksetup -listallhardwareports | /usr/bin/egrep -A2 'Airport|Wi-Fi' | /usr/bin/awk '/Device/ { print $2 }'` +# Updated by SecurityShrimp 2026 +# First Preferred Wireless Network Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Note: macOS 14+ requires Location Services permission to enumerate the +# preferred networks list non-redacted. Jamf binary has the entitlement +# when running as root. -# Get name of preferred wireless network that's first on the list -FIRST=`/usr/sbin/networksetup -listpreferredwirelessnetworks $WIFI_DEVICE | /usr/bin/awk 'NR==2{ print $1}'` +device=$(/usr/sbin/networksetup -listallhardwareports 2>/dev/null \ + | /usr/bin/awk '/Hardware Port: Wi-Fi|Hardware Port: AirPort/ { getline; print $2; exit }') -/bin/echo "<result>"$FIRST"</result>" +if [[ -z "$device" ]]; then + echo "<result>No Wi-Fi Device</result>" + exit 0 +fi + +first=$(/usr/sbin/networksetup -listpreferredwirelessnetworks "$device" 2>/dev/null \ + | /usr/bin/awk 'NR==2 { sub(/^[[:space:]]+/, ""); print }') + +echo "<result>${first:-No Preferred Networks}</result>" diff --git a/get_github_version.xml b/get_github_version.xml index 948ded3..de59aaf 100644 --- a/get_github_version.xml +++ b/get_github_version.xml @@ -1,25 +1,30 @@ - get_github_version - - string - Uses CFBundleVersion to get integer version number, rather than the named version title reported by the JSS in the Application Version. - #!/bin/sh + get_github_version + + string + Returns the CFBundleVersion of the installed GitHub Desktop app. + #!/bin/zsh -# -# checks for github.app on machine -# using version integer rather than name -# intended for scoping updates (with patchoo) -# by github.com/smashism -# last updated 2015-03-20 -# +# Updated by SecurityShrimp 2026 +# GitHub Desktop Version Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# GitHub renamed the bundle from "GitHub.app" (capital H) to +# "GitHub Desktop.app". We probe both for backwards compatibility. -if [ -f "/Applications/Github.app/Contents/Info.plist" ] ; then - VERSION=$( defaults read "/Applications/Github.app/Contents/Info.plist" CFBundleVersion ) -else - VERSION="Not installed." -fi +for plist in \ + "/Applications/GitHub Desktop.app/Contents/Info.plist" \ + "/Applications/Github.app/Contents/Info.plist" \ + "/Applications/GitHub.app/Contents/Info.plist" +do + if [[ -f "$plist" ]]; then + version=$(/usr/bin/defaults read "$plist" CFBundleVersion 2>/dev/null) + echo "<result>${version:-Unknown}</result>" + exit 0 + fi +done -echo "<result>$VERSION</result>" +echo "<result>Not installed.</result>" + diff --git a/iSight Camera Status.xml b/iSight Camera Status.xml index fcb1d12..5c366bf 100644 --- a/iSight Camera Status.xml +++ b/iSight Camera Status.xml @@ -1 +1,30 @@ - iSight Camera Status Security Reporting string This attribute displays the status of the iSight Camera. The value to be verified will need to be specified when creating this extension attribute. Example: "disabled" verifies that the iSight Camera is disabled. #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_disabled" if [ -d "/System/Library/Extensions/Apple_iSight.kext" ] || [ -d "/System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component" ] || [ -d "/System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/VDC.plugin" ]; then status="enabled" else status="disabled" fi if [ "$desiredValue" == "$status" ]; then echo "<result>Pass (iSight Status is: $status)</result>" else echo "<result>Fail (iSight Status is: $status)</result>" fi \ No newline at end of file + + + iSight Camera Status + Security Reporting + string + Reports whether the built-in camera (FaceTime HD / Studio Camera) is present and active. Edit desiredValue (enabled/disabled) before deployment. + #!/bin/zsh + +# Updated by SecurityShrimp 2026 +# iSight Camera Status Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon +# Old script probed kext paths under /System/Library/Extensions which +# have been replaced by sealed-system bundles and DriverKit on modern +# macOS. system_profiler is the supported way to detect the camera. + +desiredValue="EditFromTemplate_Desired_Value" + +if /usr/sbin/system_profiler SPCameraDataType 2>/dev/null | /usr/bin/grep -qi "Model ID"; then + status="enabled" +else + status="disabled" +fi + +if [[ "$status" == "$desiredValue" ]]; then + echo "<result>Pass (iSight Status is: $status)</result>" +else + echo "<result>Fail (iSight Status is: $status)</result>" +fi + + diff --git a/iTunes - Disable Music Sharing.xml b/iTunes - Disable Music Sharing.xml deleted file mode 100644 index ccf4ded..0000000 --- a/iTunes - Disable Music Sharing.xml +++ /dev/null @@ -1 +0,0 @@ - iTunes - Disable Music Sharing Security Reporting string This attribute displays the status of iTunes music sharing. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that iTunes music sharing is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.iTunes" keyName="disableSharedMusic" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/iTunes - Disable Music Store Access.xml b/iTunes - Disable Music Store Access.xml deleted file mode 100644 index fd48992..0000000 --- a/iTunes - Disable Music Store Access.xml +++ /dev/null @@ -1 +0,0 @@ - iTunes - Disable Music Store Access Security Reporting string This attribute displays the status of iTunes music store access. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the iTunes music store is disabled. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.iTunes" keyName="disableMusicStore" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/iTunes - Parental Controls Locked.xml b/iTunes - Parental Controls Locked.xml deleted file mode 100644 index 9294aa7..0000000 --- a/iTunes - Parental Controls Locked.xml +++ /dev/null @@ -1 +0,0 @@ - iTunes - Parental Controls Locked Security Reporting string This attribute displays the status of iTunes parental controls. The value to be verified will need to be specified when creating this extension attribute. Example: "true" verifies that the iTunes parental controls are locked. This extension attribute requires this preference be set using Managed Preferences (MCX). #!/bin/sh desiredValue="EditFromTemplate_Desired_Value_-_Example:_true" appDomain="com.apple.iTunes" keyName="locked" currentUser=`last -1 -t console | awk '{print $1}'` result="" tmpResult="`dscl . mcxread /Users/$currentUser \"$appDomain\" \"$keyName\" |grep Value:| sed 's/Value\: //g'`" echo $tmpResult if [ "$tmpResult" == "1" ]; then result="true" else if [ "$tmpResult" == "0" ]; then result="false" else if [ "$tmpResult" == "" ]; then result="Domain or Key Not Found" else result="$tmpResult" fi fi fi if [ "$result" == "$desiredValue" ]; then echo "<result>Pass ($result)</result>" else echo "<result>Fail ($result)</result>" fi \ No newline at end of file diff --git a/iWork 08 Serial Number.xml b/iWork 08 Serial Number.xml deleted file mode 100644 index 4aa2df6..0000000 --- a/iWork 08 Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - iWork 08 Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for iWork 08. #!/bin/sh if [ -f "/Library/Preferences/com.apple.iWork08.plist" ]; then result=`/usr/bin/defaults read /Library/Preferences/com.apple.iWork08 ProductivitySFLLicense` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/iWork 09 Serial Number.xml b/iWork 09 Serial Number.xml deleted file mode 100644 index 8fbea2f..0000000 --- a/iWork 09 Serial Number.xml +++ /dev/null @@ -1 +0,0 @@ - iWork 09 Serial Number Serial Numbers string This attribute returns the serial numbers present on the machine for iWork 09. #!/bin/sh if [ -f "/Library/Preferences/com.apple.iWork09.plist" ]; then result=`/usr/bin/defaults read /Library/Preferences/com.apple.iWork09 ProductivitySFLLicense` fi echo "<result>$result</result>" \ No newline at end of file diff --git a/java_vendor.xml b/java_vendor.xml index f6addb4..505e469 100644 --- a/java_vendor.xml +++ b/java_vendor.xml @@ -1,24 +1,29 @@ - Java Vendor - - string - This attribute detects if a Mac's Java browser plug-in in /Library/Internet Plug-Ins was supplied by Apple or Oracle. If no Java plug-in is detected, a "No Java Plug-In Available" message is displayed. - #!/bin/bash + Java Vendor + + string + Detects which JDK vendor is installed (Oracle, OpenJDK/Temurin/Zulu, etc.) or "No Java Available". + #!/bin/zsh -javaVendor=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleIdentifier` +# Updated by SecurityShrimp 2026 +# Java Vendor Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -if [ "$javaVendor" = "com.oracle.java.JavaAppletPlugin" ]; then - result=Oracle -elif [ "$javaVendor" = "com.apple.java.JavaAppletPlugin" ]; then - result=Apple -elif [ "$javaVendor" = "" ]; then - result="No Java Plug-In Available" +if ! /usr/libexec/java_home -F &>/dev/null; then + echo "<result>No Java Available</result>" + exit 0 fi -echo "<result>$result</result>" - +out=$(/usr/bin/java -version 2>&1) +if echo "$out" | /usr/bin/grep -qi "openjdk"; then + echo "<result>OpenJDK</result>" +elif echo "$out" | /usr/bin/grep -qi "java(tm)"; then + echo "<result>Oracle</result>" +else + echo "<result>Unknown</result>" +fi diff --git a/sortedConfigurationProfileList.xml b/sortedConfigurationProfileList.xml index db9d6aa..d790339 100644 --- a/sortedConfigurationProfileList.xml +++ b/sortedConfigurationProfileList.xml @@ -1,14 +1,20 @@ - Sorted Configuration Profile List - - string - Produces a sorted list of Configuration Profiles applied to a machine. - #!/bin/sh + Sorted Configuration Profile List + + string + Returns a sorted list of Configuration Profile names installed at the system scope. + #!/bin/zsh -profiles=`profiles -C -v | awk -F: '/attribute: name/{print $NF}' | sort` -echo "<result> $profiles </result>" +# Updated by SecurityShrimp 2026 +# Sorted Configuration Profile List Extension Attribute +# Targets macOS 12 through 26 (Tahoe), Intel and Apple Silicon -exit 0 +profiles=$(/usr/bin/profiles -C -v 2>/dev/null \ + | /usr/bin/awk -F': ' '/attribute: name/ { print $NF }' \ + | /usr/bin/sort) + +echo "<result>${profiles}</result>" + diff --git a/warranty.v2.xml b/warranty.v2.xml deleted file mode 100644 index cfe4de5..0000000 --- a/warranty.v2.xml +++ /dev/null @@ -1,102 +0,0 @@ - - - - Update: Warranty Status and Expiration - - string - This script queries Apple's service database to determine warranty coverage based on a system's serial number. This UPDATED version stores the infomration locally so as not to have to query apple's website repeatedly. - #!/bin/sh - -# this script was written to query apple's service database to determine warranty coverage -# base on a system's serial number. This updated version stores the infomration locally so -# as not to have to query apple's website repeatedly. - -# author: Andrew Thomson -# date: 5/30/2013 - - -if [ -f /Library/Preferences/com.apple.warranty.plist ]; then - # get plist data - WarrantyDate=`/usr/bin/defaults read /Library/Preferences/com.apple.warranty WarrantyDate` - WarrantyStatus=`/usr/bin/defaults read /Library/Preferences/com.apple.warranty WarrantyStatus` - - # convert dates to integers - ExpirationDate=`/bin/date -j -f "%Y-%m-%d" "${WarrantyDate}" +%s` - TodaysDate=`/bin/date +%s` - - # if warranty is listed as active but date is expired, update plist entry - if [ "${WarrantyStatus}" == "Active" ] && [ ${TodaysDate} -gt ${ExpirationDate} ]; then - WarrantyStatus="Inactive" - /usr/bin/defaults write /Library/Preferences/com.apple.warranty WarrantyStatus ${WarrantyStatus} - echo Status updated. - else - echo Status unchanged. - fi - echo "<result>${WarrantyStatus} : ${WarrantyDate}</result>" - exit 0 -fi - - -# set temp file -WarrantyTempFile="/tmp/warranty.$(date +%s).txt" - - -# get serial number -SerialNumber=`ioreg -l | awk '/IOPlatformSerialNumber/ { split($0, line, "\""); printf("%s\n", line[4]); }'` -if [ -z "${SerialNumber}" ]; then - echo "Serial Number not found." - exit 1 -fi - - -# query url -WarrantyURL="https://selfsolve.apple.com/wcResults.do?sn=${SerialNumber}&Continue=Continue&num=0" -WarrantyInfo=$(curl -k -s $WarrantyURL | awk '{gsub(/\",\"/,"\n");print}' | awk '{gsub(/\":\"/,":");print}' | sed s/\"\}\)// > ${WarrantyTempFile}) - - -# check validity of serial number -InvalidSerial=$(grep 'invalidserialnumber\|productdoesnotexist' "${WarrantyTempFile}") -if [[ -n "${InvalidSerial}" ]]; then - echo "Invalid Serial Number." - exit 2 -fi - - -# determine warranty status -WarrantyStatus=$(grep displayHWSupportInfo "${WarrantyTempFile}") -if [[ $WarrantyStatus =~ "Active" ]]; then - WarrantyStatus="Active" -else - WarrantyStatus="Inactive" -fi - - -# check for exirpation date -if [[ `grep displayHWSupportInfo "${WarrantyTempFile}"` ]]; then - WarrantyDate=`grep displayHWSupportInfo "${WarrantyTempFile}" | grep -i "Estimated Expiration Date:"| awk -F'<br/>' '{print $2}'|awk '{print $4,$5,$6}'` -fi - - -# convert format of date -if [[ -n "$WarrantyDate" ]]; then - WarrantyDate=$(/bin/date -jf "%B %d, %Y" "${WarrantyDate}" +"%Y-%m-%d") > /dev/null 2>&1 -else - WarrantyDate="N/A" -fi - - -# write status and date to plist -if [[ -n "$WarrantyStatus" ]] && [[ -n "$WarrantyDate" ]]; then - /usr/bin/defaults write /Library/Preferences/com.apple.warranty WarrantyStatus ${WarrantyStatus} - /usr/bin/defaults write /Library/Preferences/com.apple.warranty WarrantyDate ${WarrantyDate} -fi - - -echo Serial Number: "${SerialNumber}" -echo Warranty Status: ${WarrantyStatus} -echo Warranty Expiration: ${WarrantyDate} - -echo "<result>${WarrantyStatus} : ${WarrantyDate}</result>" - - -