John Hutchison kdrwygvh

How to Defang macOS System Protections

If you want to change things on the root drive of a Mac you will need to take some steps to disable the built in security of the system. Most of these steps are the same regardless if you are on Intel or Apple Silicon. If there is a difference it is noted.

Note that all of these things put a Mac into an unsupported and less secure state.

Make sure you either perform these steps in a VM or that you reset the protections after you are done poking around

Protections and Terms

(This list is not exahustive on the details of each. Check the links at the end for more info.)

There are a ton of different ways to split up a string in Zsh. This gist attempts to show them with examples to help you build your own. I write Zsh scripts all the time, and still reference back to this gist, so there you go.

From the Zsh docs on Parameter Expansion Flags (yeah - I know... how would anyone ever find that if they didn't know where to look!?)

j:string: Join the words of arrays together using string as a separator.
s:string: Force field splitting at the separator string.

You can also read more by running man zshexpn. (Again, I know, right!? How would anyone know to look there!?)

macOS 10.15 System Preference Panes

Below are a list of System Preference pane URLs and paths that can be accessed with scripting to assist users with enabling macOS security settings without having to walk them through launching System Preferences, finding panes, and scrolling to settings. Not all panes have an accessible anchor and some are OS specific.

To find the Pane ID of a specific pane, open the System Preferences app and select the desired Preference Pane. With the pane selected, open the ScriptEditor.app and run the following script to copy the current Pane ID to your clipboard and display any available anchors:

tell application "System Preferences"
	set CurrentPane to the id of the current pane
	set the clipboard to CurrentPane

	#!/usr/bin/env zsh

	# https://social.technet.microsoft.com/wiki/contents/articles/7608.srv-records-registered-by-net-logon.aspx
	# https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/verify-srv-dns-records-have-been-created

	declare -a activeDirectoryDomainNameTests=(
	_ldap._tcp."$1".
	_ldap._tcp.dc._msdcs."$1"
	_ldap._tcp.pdc._msdcs."$1".
	_kerberos._tcp. "$1" .

	#!/bin/bash
	#https://gist.github.com/brunerd/d775ab7b362b72d9feb0c4035f922ede

	function printState
	{
	echo commandKeyDown: $commandKeyDown
	echo controlKeyDown: $controlKeyDown
	echo optionKeyDown: $optionKeyDown
	echo shiftKeyDown: $shiftKeyDown
	echo functionKeyDown: $functionKeyDown

	#!/bin/zsh

	:<<ABOUT_THIS_SCRIPT
	-------------------------------------------------------------------------------

	Written by:William Smith
	Professional Services Engineer
	Jamf
	[email protected]
	https://gist.github.com/e9ed319226c6da30dd633725e48a97b0

	Model information: https://support.apple.com/en-us/HT211238
	Published Date: October 25, 2021

	Verification: https://regex101.com/r/7nnq4T/13

	This regex is complete. Apple is no longer creating Big Sur compatible Macs.

	(MacBook(10\|9\|8)\|MacBookAir(10\|[6-9])\|MacBookPro1[1-7]\|Macmini[7-9]\|MacPro[6-7]\|iMacPro1),\d\|iMac(14,4\|1[5-9],\d\|2[01],\d)

	#!/bin/bash

	<<ABOUT_THIS_SCRIPT
	-------------------------------------------------------------------------------

	Written by:William Smith
	Professional Services Engineer
	Jamf
	[email protected]
	https://gist.github.com/2cf20236e665fcd7ec41311d50c89c0e

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<array>
	<dict>
	<key>attributeSetting</key>
	<integer>1</integer>
	<key>choiceAttribute</key>
	<string>selected</string>
	<key>choiceIdentifier</key>

	import datetime
	import logging
	import requests
	import urlparse

	class JamfUAPIAuthToken(object):
	def __init__(self, jamf_url, username, password):
	"""
	:param jamf_url: Jamf Pro URL
	:type jamf_url: str