helper_check

https://github.com/edamametechnologies/edamame_helper/releases/download

/Library/Application\ Support/Edamame/Edamame-Helper/uninstall.sh

/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode | grep -E "disabled|is off"

/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode off

profiles -P | grep profileIdentifier | grep -v digital_health_restrictions | grep -v dateandtime

profiles remove -all -forced

https://support.apple.com/en-us/guide/deployment/depc0aadd3fe/web

pgrep jamf

jamf removeFramework

https://www.jamf.com/en

systemsetup getwakeonnetworkaccess | grep -v Off

systemsetup -setwakeonnetworkaccess off

systemsetup -setwakeonnetworkaccess on

defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>&1 | grep -v 1

defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallAppUpdates -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true

defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallAppUpdates -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool false

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep disabled

/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off

defaults read /Library/Preferences/com.apple.loginwindow | grep autoLoginUser

defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser

x-apple.systempreferences:com.apple.preferences.users

systemsetup -getremotelogin | grep On

echo yes | systemsetup -setremotelogin off

systemsetup -setremotelogin on

pgrep ARDAgent

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate

launchctl list | grep smbd

launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist

launchctl load -w /System/Library/LaunchDaemons/com.apple.smbd.plist && defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist EnabledServices -array disk

launchctl print-disabled system | grep com.apple.AEServer | grep -E 'enabled|false'

systemsetup -setremoteappleevents off

systemsetup -setremoteappleevents on

fdesetup hasinstitutionalrecoverykey | grep true

https://derflounder.wordpress.com/2019/07/03/managing-macos-mojaves-filevault-2-with-fdesetup/

https://derflounder.wordpress.com/2019/07/03/managing-macos-mojaves-filevault-2-with-fdesetup/

system_profiler SPHardwareDataType | grep -q 'Virtual' || fdesetup isactive | grep false

x-apple.systempreferences:com.apple.preference.security?FileVault

x-apple.systempreferences:com.apple.preference.security?FileVault

spctl --status | grep disabled

spctl --global-enable

spctl --global-disable

defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates 2>/dev/null | grep -q 1 || echo macosupdate_disabled

defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true; defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true; softwareupdate --schedule on

defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool false; defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool false; softwareupdate --schedule off

sysadminctl -screenLock status 2>&1 | grep off

x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension

x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension

if ! ( pgrep BDLDaemon >/dev/null || pgrep RTProtectionDaemon >/dev/null || sentinelctl version 2>/dev/null | grep -q "SentinelOne" || ( xprotect status 2>/dev/null | grep -q "launch scans: enabled" && xprotect status 2>/dev/null | grep -q "background scans: enabled" ) ); then echo "epp_disabled"; fi;

https://www.malwarebytes.com/

https://www.apple.com/fr/macos/security/

([ -d "/Applications/1Password.app" ] || [ -d "/Applications/LastPass.app" ] || [ -d "/Applications/KeePassXC.app" ] || [ -d "/Applications/1Password7.app" ] || [ -d "$HOME/Applications/Chrome Apps.localized/Google Password Manager.app" ] || [ -d "/Applications/Bitwarden.app" ]) >/dev/null 2>&1 || echo "No password manager installed"

https://en.wikipedia.org/wiki/Password_manager

csrutil status | grep disabled

https://support.apple.com/en-us/HT204899

https://support.apple.com/en-us/HT204899

sysadminctl -guestAccount status 2>&1 | grep enabled

sysadminctl -guestAccount off

sysadminctl -guestAccount on

dscl . -read /Users/root Password | grep '\*\*'

https://support.apple.com/HT204012

https://support.apple.com/HT204012

security authorizationdb read system.preferences 2> /dev/null | grep -A1 shared | grep true

security authorizationdb read system.preferences > /tmp/system.preferences.plist; /usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist; security authorizationdb write system.preferences < /tmp/system.preferences.plist

security authorizationdb read system.preferences > /tmp/system.preferences.plist; /usr/libexec/PlistBuddy -c "Set :shared true" /tmp/system.preferences.plist; security authorizationdb write system.preferences < /tmp/system.preferences.plist

pwned -i 365

digitalidentity_manager

https://haveibeenpwned.com/

lanscan

network_manager

network_manager

egresscan

session_manager

session_manager

defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist | grep macOS

x-apple.systempreferences:com.apple.preferences.softwareupdate

https://www.macworld.com/article/673171/how-to-install-older-versions-of-macos-or-os-x.html

defaults read /Applications/Google\ Chrome.app/Contents/Info.plist CFBundleShortVersionString &>/dev/null && { local_version=$(defaults read /Applications/Google\ Chrome.app/Contents/Info.plist CFBundleShortVersionString); latest_version=$(curl -s "https://formulae.brew.sh/api/cask/google-chrome.json" | sed -n 's/.*\"version\": \"\([^\"]*\)\".*/\1/p'); if [ "$(printf '%s
%s
' "$local_version" "$latest_version" | sort -V | tail -n1)" = "$latest_version" ] && [ "$local_version" != "$latest_version" ]; then echo "Chrome is not up to date (Installed: $local_version, Latest: $latest_version)"; fi; }

https://support.google.com/chrome/answer/95414

https://support.google.com/chrome/a/answer/6350036

business_rules

Refer to the business rules documentation for more details.

Refer to the business rules documentation for more details.

grep -q "BEGIN RESTRICT_ZSH_NONADMINS" /etc/zshrc || echo CLI not restricted

grep -q "BEGIN RESTRICT_ZSH_NONADMINS" /etc/zshrc || cat <<'EOF' >> /etc/zshrc
# BEGIN RESTRICT_ZSH_NONADMINS
## Prevent non-admin users from using interactive zsh shells
if [[ -t 1 ]]; then
  if ! id -Gn | grep -qw admin; then
    echo ""
    echo "Command-line access is restricted by your administrator."
    osascript -e "display alert \"Access Restricted\" message \"Command-line tools are blocked for standard users.\" buttons {\"OK\"}" 2>/dev/null || true
    exit 1
  fi
fi
# END RESTRICT_ZSH_NONADMINS
EOF

python3 - <<'PY'
skip = False
lines = []
with open("/etc/zshrc") as src:
    for line in src:
        if "BEGIN RESTRICT_ZSH_NONADMINS" in line:
            skip = True
            continue
        if "END RESTRICT_ZSH_NONADMINS" in line:
            skip = False
            continue
        if not skip:
            lines.append(line)
with open("/etc/zshrc", "w") as dst:
    dst.writelines(lines)
print("[OK] zsh block removed")
PY