How can I determine plist changes while changing System Preferences to automate them next time?

Question

I am trying to automate the process of setting up a new laptop as much as possible. There are certain changes I always end up making manually on a new Mac, such as enabling screen zooming with the Ctrl modifier and setting up keyboard shortcuts to map ⌘⌥← to "Select Previous Tab" in all applications. I’m sure there is a preferences.write equivalent to do this, but gosh darn it, I have no idea how to determine what it is. Can I somehow monitor or "diff" my preferences after making the change manually, perhaps?

Answer 1

Apple stores most relevant preferences in a database now, so your best bet is to ignore plist files on the filesystem and focus on the output of defaults read com.apple.whatever for the things you change. Unfortunately, there isn't a good Rosetta Stone that says if you are in preference X - look for changes in these seven preference domains. Where Apple stores iCloud or security information doesn't map to each visual icon in system preferences so you'll need to issue more than one defaults read to capture the entire state of most preference panes since most panes write to more than one setting domain.

Alternatively, you could just use MDM and configuration profiles and scripts to make all changes so that you just push the changes to all machines from your management tool and skip the whole reverse engineering process entirely.

• https://support.apple.com/profile-manager
• https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html
• https://www.jamf.com
• https://www.jamf.com/jamf-nation/discussions/15362/learn-mcx-and-configuration-profile

In the past MCX was the path to managing enterprise configurations and that's the equivalent of your wanting to look at the .plist files that stored those settings initially at the dawn of OS X - but the current system of configuration profiles, scripted changes and MDM hooks has left MCX and .plist to just the dusty corners that haven't been updated for the new central database to store user and system defaults.

Answer 2

Try plist, a nifty tool I made that works with PlistBuddy.

Here's how:

1. Install plist from https://github.com/8ta4/plist.
2. Run plist. It will watch for changes in .plist files, which store your system preferences.

plist

3. Tweak your System Preferences as you like. You want to enable screen zooming with the Ctrl modifier, you control freak?
4. To set up a new laptop, just run the PlistBuddy commands that plist gave you.

Answer 3

If you know the file which is being changed, you can compare the output before/after in the terminal in order to find the exact setting name. For example:

/usr/libexec/PlistBuddy -c Print ~/Library/Preferences/.GlobalPreferences.plist > /tmp/before.txt

And, diff /tmp/before.txt /tmp/after.txt to see the items being changed. But, be careful, because it's likely that the preference you're changing will be buried in the hierarchical structure.

If you don't already know the file which is being changed, then you can monitor the Library/Preferences folder with ls -lFat to see the most recently changed files listed first, and you can probably determine which file you're interested in from there.

Answer 4

The best way I found is to

1. Run opensnoop (a program included in macOS that shows which files are opened)
2. Change your settings and watch which Preferences folder is accessed
3. Go to this folder and sort by modification time
4. defaults read file.plist on anything suspicious.