Sounds a klaxon whenever a computer on the network boots to single-user mode.

single-user-mode-ids-geeklet

#!/bin/bash
# Pings the IP address that any computer gets when booted to Single-User Mode
# Works best to set it to ping every 2 seconds (set refresh rate in Geektool)
ping -c 1 10.x.x.x &> /dev/null

# If that address is pingable,
if [ $? = 0 ];then
# Sound the "red alert" klaxon for speakers connected to this computer
afplay /Users/Shared/klaxon.mp3

# Play the alert sound effect on the admin's computer as well
ssh <user>@<ip_address> "afplay /Users/Shared/alert09.mp3"

# Set a variable to store the MAC address of that machine, captured from the ARP cache
macAddr=$(arp -an | awk '/10.x.x.x/ {print $4}')
echo $macAddr
# Send a message to the admin computer via terminal-notifier
# Execute the command when the notification is clicked by the admin
# In this case, it copies the MAC address to their clipboard
# From there, it can be looked up in the JSS to find out which computer it is
ssh [email protected] "/usr/local/bin/terminal-notifier \
-title "\"INTRUDER ALERT\"" \
-subtitle "\"Single-user Mode accessed on\"" \
-message "\"$macAddr Click to copy to clipboard\"" \
-execute "\"echo $macAddr \| pbcopy \"""

# Send a text message to the admin with the MAC address of the offending device
curl http://textbelt.com/text -d number=<ten_digit_phone_number_here> -d "message=Single=user Mode Detected: $macAddr"
fi