t-lark

#!/usr/bin/python

"""
this code will run through all installed apps, which are locally installed
and generate a CSV file on your desktop listing all 32bit apps
"""

import subprocess
import plistlib
import csv

t-lark

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>Allows CrowdStrike Falcon Sensor disk access</string>
            <key>PayloadDisplayName</key>

t-lark

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>NotificationSettings</key>
			<array>
				<dict>

t-lark

#!/opt/bin/snowflake/python

"""
quick example code to grab what iCloud account is in use
"""

# import modules
from SystemConfiguration import SCDynamicStoreCopyConsoleUser
from CoreFoundation import CFPreferencesCopyAppValue
from Foundation import NSHomeDirectoryForUser

t-lark

#!/usr/bin/python

"""
this is a script to detect what VMs are on a sytsem and escrow what OS they are
You can run this daily or in another workflow
It will use Spotlight to find files with the .pvm extension to locate where the files are on the file system
then parse the PvInfo file for Parallels VMs
"""

# import modules

t-lark

>>> from SystemConfiguration import SCDynamicStoreCopyConsoleUser
>>> from CoreFoundation import CFPreferencesCopyAppValue
>>> from Foundation import NSHomeDirectoryForUser
>>> 
>>> user, uid, gid = SCDynamicStoreCopyConsoleUser(None, None, None)
>>> home = NSHomeDirectoryForUser(user)
>>> userfile = home + '/Library/Preferences/.GlobalPreferences.plist'
>>> keys = ['AppleInterfaceStyle', 'AppleInterfaceStyleSwitchesAutomatically']
# just loop and see what we get
>>> for k in keys:

t-lark

#!/opt/snowflake/bin/python3

"""
In Jamf Pro version 10.49 and higher, Jamf has removed the ability to mass edit management account settings
from a saved search results page via mass actions. This means that you either have to un-manage old devices by manually 
un-managing them one by one in their device record, or write some sort of API script. You can also technically delete 
the device record if that is an acceptable use case at your Org.

This script will take the JSS ID from a smart group, grab the ID of each device and store it in a Python list. Then it will 
iterate through that list and send Classic API commands to remove the management account thus freeing up the license.