Viewing applied MCX Settings

7 01 2010

Chances are if you have worked with Client Management on OS X (called MCX) you’ve wanted to test out settings and view what is actually being applied to the user / group / computer.  (From the Windows world, there is a MMC snapin, rsop.msc that you may be familiar with)  The tough part is you can’t really view these applied settings as they combine in Workgroup Manager.  The capability is there to view them on the user or the group or the computer or the computer list.  However, nested settings won’t show, and screenshots of settings are tough to work through, especially when you are using nested groups and computer lists.

Viewing the local files in /Library/Managed Preferences will show you the applied plists per user and for the machine.  But again, it is tough to figure out how these all apply and overlap.  This is where the mcxquery command proves to be very useful.  Even better, the tool has a GUI wrapper for when you are not feeling in the mood for CLI butteryness.  The difference, however, lies in the requirements.

To view the settings in a GUI form, you will need to be logged in to the workstation with the account you are interested in checking out.  This works well on one account.  To view the settings, open System Profiler (Apple Menu -> About this Mac -> More Info)  Along the left, under Software, is a heading Managed Client.  Clicking in this will traverse settings and display them with disclosure triangles for each preference key, the settings applicable, and from where the preference originates.  An excellent to see what is being applied and from where.

The CLI method to this tool is simply:

mcxquery -user USER -group GROUP -computer COMPUTER

With this command, you specify the user, group, and computer to view the settings.  The benefit with this method is you don’t need the user password or the specific computer to view applied settings.  The user must be a member of the specified group, and you define the computer with either the UUID, mac address, or record name.  If a computer is not specified, the computer in which the command is executed will be used. Once using this command, you will see in one terminal window all settings via key.

These are great tools use for viewing MCX settings and “seeing” the result of nested groups.

Is there a favorite tool or another approach you utilize to view your managed settings?  I’d love to hear about them!