Preference Key Reader

A copy-pasta function to output all vendor preference keys

Background

While implementing feedback from Søren Theilgaard, we needed an easy way to output every key / value pair from any vendor’s preference files, in either the user or system domain.

Function

1. Copy-and-paste the following readPreferenceKeys function into an open Terminal window:

function readPreferenceKeys() {

    scriptVersion="0.0.2"
    export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin/
    loggedInUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' )
    loggedInUserHome=$( dscl . read /Users/"${loggedInUser}" NFSHomeDirectory | awk -F ": " '{print $2}' )
    serialNumber=$( system_profiler SPHardwareDataType | grep Serial |  awk '{print $NF}' )
    timestamp="$( date '+%Y-%m-%d-%H%M%S' )"
    macOSproductVersion="$( sw_vers -productVersion )"
    macOSbuildVersion="$( sw_vers -buildVersion )"
    preferenceKeyLogDirectory="/var/tmp/"
    preferenceKeyLog="${1}-${2}-preferenceKeys-${macOSproductVersion}-${macOSbuildVersion}-${serialNumber}-${timestamp}.log"
    touch "${preferenceKeyLogDirectory}${preferenceKeyLog}"
    echo "Preference Key Reader (${scriptVersion})" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
    echo "Created ${preferenceKeyLog} …" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
    echo "Running …" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
    echo "Searching for \"${1}\" preference keys on macOS ${macOSproductVersion} (${macOSbuildVersion}) in the \"${2}\" domain …" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
    printf "\n\n\n" >> "${preferenceKeyLogDirectory}${preferenceKeyLog}"

    SECONDS="0"

    case "${2}" in
        "system" )
            preferencePath="/Library/Preferences/"
            ;;
        "user" )
            preferencePath="${loggedInUserHome}/Library/Preferences/"
            ;;
        * )
            echo "Unrecognized Option: \"${2}\"" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
            echo "Removing temporary file and exiting" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"
            rm -v "${preferenceKeyLogDirectory}${preferenceKeyLog}"
            return 1
            ;;
    esac

    for plists in "${preferencePath}"*."${1}".*; do

        echo "${plists}" >> "${preferenceKeyLogDirectory}${preferenceKeyLog}"
        defaults read "${plists}" >> "${preferenceKeyLogDirectory}${preferenceKeyLog}" 2>&1
        printf "\n\n\n" >> "${preferenceKeyLogDirectory}${preferenceKeyLog}"

    done

    echo "Elapsed Time: ${SECONDS}" | tee -a "${preferenceKeyLogDirectory}${preferenceKeyLog}"

    mv -v "${preferenceKeyLogDirectory}${preferenceKeyLog}" "${loggedInUserHome}/Desktop/"
    open -R "${loggedInUserHome}/Desktop/${preferenceKeyLog}"

}

2. Call the function:

# readPreferenceKeys "vendor name" "domain [ system | user]"

readPreferenceKeys "apple" "system"

readPreferenceKeys "apple" "user"

3. Review the output (which is saved to your Desktop)

Discoverys

The readPreferenceKeys function helped us discover that the absence of the ConfigDataInstall key in com.apple.SoftwareUpdate.plist indicated that macOS Ventura’s Rapid Security Response was actually enabled.

(My personal favorite is 1,045-line com.apple.EmojiCache.plist in the user domain.)