TweetFollow Us on Twitter

MacEnterprise: Scripting Opportunities for System Administrators, Part One

Volume Number: 25
Issue Number: 06
Column Tag: MacEnterprise

MacEnterprise: Scripting Opportunities for System Administrators, Part One

When, where, why, and how you should run administrative scripts

By Greg Neagle,


In previous MacTech columns, I have sometimes offered up a script or two as part of a solution to a particular problem. Even if the script I presented is a perfect fit for your environment, you might still have had trouble making effective use of it in your organization, because you did not know how to make it run at the right time or in the correct context to get the job done.

This month, we'll begin a look at some of the many mechanisms available to run scripts (and other processes). Each mechanism has different uses and is suited for a unique set of tasks. Depending on what you need to accomplish, you should select the appropriate mechanism.


The first question you should ask is "Why do I want to run this script? What task do I want to accomplish?" Some of the common administrative categories that might lend themselves to scripting are:

System configuration - initial setup of the OS, networking, user accounts, etc.

System management - ongoing management of system settings; enforcing system-wide policies

User settings/preferences - configuring applications; setting up useful default preferences, enforcing user-level policies

Administrator tools - tools to make tedious or difficult tasks easier or more consistent

Hacks/fixes/workarounds - scripts to "fix" or work around problems with the OS or applications (or users!)


Once you know why you are running the script, or what you want to accomplish with the script, you can consider when it should run. Some of the possibilities:

On demand - only when invoked by an admin or user

At startup

Repeating (daily/weekly/monthly, or other intervals like hourly, every 15 minutes, etc)

When a user logs in

When a user logs out

Let's look at some logical pairings of "Why?" and "When?":

Utility scripts or administrative tools that are to be run only on demand are the easiest to handle. Simply put them in a directory somewhere and run them manually as needed, or run them remotely using Apple Remote Desktop or SSH.

If your script is doing system configuration tasks like binding a machine to Active Directory or creating local users, it should almost certainly run at startup. System management tasks might run at startup, on a repeating schedule, or both.

Tasks that affect user settings or preferences should probably run at user login, or if it's a cleanup task, perhaps at user logout.

Hacks/fixes/workarounds can vary when it is appropriate to run them: they may need to run on demand; they may need to run at login to make a change to a user's environment; they may need to run at startup to clear out stale cached data.


How can you run your script when you want? Let's look at some of the available mechanisms.

Running a script at startup

There are several ways to run scripts at startup, but the two most commonly used on Mac OS X are StartupItems and launchd items. Both Startup Items and launchd's LaunchDaemons run in the root context.


Startup items have been used on Mac OS X for a long time, and continue to work in OS X 10.5 Leopard. Administrator-provided Startup items should be placed in /Library/StartupItems. Since Apple is phasing out StartupItems, we won't spend a lot of time on these. A Startup Item consists of a directory containing an executable (typically a shell script) and a StartupParameters.plist file. Both the executable/shell script and the StartupParameters.plist have a very specific format. The startup item directory may optionally contain other items - for example, a Resources subdirectory. Apple has some good documentation on creating StartupItems here:

launchd items

launchd was introduced with Mac OS X 10.4 Tiger. It was intended to replace almost every other way of launching processes, though in practice it has not yet accomplished that. Still, launchd is very capable, and Apple continues to enhance it. Launchd items are simpler to setup than StartupItems, as they generally require only a single additional file other than the actual script or executable. Administrator-provided launchd items that run a script at startup should go in /Library/LaunchDaemons.

Launchd has been covered extensively in MacTech as well as many other places, so I won't go into great depth. But let's do a quick example. Let's say we have a configuration script that we want to run at startup. It is located at /Library/Management/, and is marked as executable. It looks like this:

logger -t configuration "Hello from the config script!"

This script simply writes a message to the system log. You can test it manually:

root# /Library/Management/
root# tail /var/log/system.log
Apr 21 12:31:05 arcus configuration[8400]: Hello from the config script!

To get it to run at startup, you'd need a property list at /Library/LaunchDaemons/com.mactech.demo.plist that looks something like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">

This property list should have owner: root, group: wheel, and mode: 0644. Some explanation of the included keys:

Label is a string used by launchd to identify the job. The name of the plist file is usually the same as this label plus ".plist".

ProgramArguments is simply the full path to the executable script.

RunAtLoad is set to true so that launchd will run the job when it loads it, which is normally at startup.

OnDemand is set to true so that launchd won't attempt to restart the script once it exits - in other words, this process/script is not meant to run continuously.

We could test the launchd job by rebooting and then looking at the system log for our message, but rebooting can take a while, and if there's a problem, the fix/retest cycle is tedious. So let's do a quicker test:

root# launchctl load /Library/LaunchDaemons/com.mactech.demo.plist
root# tail /var/log/system.log
Apr 21 12:31:05 arcus configuration[8400]: Hello from the config script!
Apr 21 12:37:13 arcus configuration[9073]: Hello from the config script!

At the end of the system log, you should see the message from the configuration script.

If you have problems, unload the job:

root# launchctl unload /Library/LaunchDaemons/com.mactech.demo.plist

Make your changes to the plist, and try loading the job again. Once the job is working, you should be able to reboot, and see the message in the system log during the startup process.

Apple documentation on creating a launchd item is available here:

Repeating scripts

Some scripts are best run on repeating intervals. For example, you have a script that scans the startup disk for all installed fonts and then uploads that list of fonts to a database somewhere so you can monitor for license compliance. You should run that script periodically: maybe daily, maybe weekly, maybe monthlyit's up to your organization. There are several ways to do this.

One of the easiest ways is to piggy-back off an existing facility for running repeating scripts: the periodic command. By default, periodic is used to run scripts on a daily, weekly or monthly basis. It runs all the scripts it finds in certain directories:

/etc/periodic/daily/ - these are run every day

/etc/periodic/weekly/ - these are run once a week

/etc/periodic/monthly/ - these are run once a month

To get periodic to run your scripts, mark them as executable and put them in the appropriate directory. You can control the order in which the scripts run by naming them appropriately. The convention used is to start the script name with a three-digit number; the scripts are then run in numeric order:

root# ls -1 /etc/periodic/daily

There are some issues to be aware of, however. The first is exactly when these scripts will run. This is controlled by launchd in the following files in /System/Library/LaunchDaemons:

Looking at

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">

The StartCalendarInterval key tells us it will run each day at 3:15 AM local time. That time might not be a good one for your environment. Consider a few scenarios:

Desktop machines: if the desktops in your organization are left on 24/7, then the script will run shortly after 3:15 AM each day. If instead, they are asleep at 3:15 AM, they'll run shortly after they are woken up each day. If they are powered off at 3:15 AM, the scripts won't run at all. Launchd will reschedule jobs that were scheduled to run when the machine was asleep, but will not reschedule jobs that were scheduled to run when the machine was powered off.

Laptop machines: all of the same complications as with desktops, with the additional problem that if they get taken home at night or over the weekend, and run these jobs at 3:15 AM (or when woken up), and your scripts require access to network services or resources available only when the machine is connected to your organization's network, they may fail, or at the very least, fail to do anything useful.

Therefore, you might consider changing the time these jobs run to a time during the day when it's more likely the machine is on, awake, and on your network.

Another possible approach that does not require modifying Apple's provided launchd items is to run a script at startup that checks for overdue periodic jobs and runs them. Such a script is described (and available) here:

Repeating launchd jobs

Looking at the property list for suggests another method for running scripts on a repeating basis: avoiding the periodic middleman and using launchd directly. Using our com.mactech.demo example as before, we can run a script at startup and once a day with a LaunchDaemon plist like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">

We've added a StartCalendarInterval to the previous version of the property list that tells launchd to run the job each day at 12:15, when many of our staff will be at lunch. If we didn't want it to run at startup as well, we could remove the RunAtLoad key, or set it to false.

Good old cron

One last method to mention: the classic UNIX cron is still available in OS X, and can still be used to run repeating jobs. Type man cron at a command prompt for details. You'll probably want to create a crontab at /etc/crontab . A big disadvantage of using cron is that it's hard to manage different versions of the crontab files. For example, if you have a set of machines that need repeating jobs A and B, another set that needs repeating jobs B and C, and yet another set that needs repeating jobs A, B and C, you'll need to manage three different versions of the crontab as well as the scripts that do the actual jobs. If you use periodic or launchd, you don't have to deal with the monolithic crontab file, as the scheduling info for each job lives in a separate file (or in the case of periodic, is not needed).

To be continued...

We covered quite a bit this month. We looked at running scripts at startup and on a repeating schedule. In the future, we'll look at running scripts as part of the login and logout process, both with root privileges, and as the user logging-in. While you might guess that launchd might be useful here, we'll also look at login/logout hooks and login items. We'll also consider the special case of scripts that should run only once, either at startup or login. Finally, we'll look at some methods to simplify implementing additional scripts once you have a few working. See you next time!

Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project ( and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at


Community Search:
MacTech Search:

Software Updates via MacUpdate

Arq 5.5.1 - Online backup to Google Driv...
Arq is super-easy online backup for Mac and Windows computers. Back up to your own cloud account (Amazon Cloud Drive, Google Drive, Dropbox, OneDrive, Google Cloud Storage, any S3-compatible server... Read more
Slack 2.3.0 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.3.0: Note: Now requires OS X 10.8 or later New The app... Read more
Cocktail 10.1 - General maintenance and...
Cocktail is a general purpose utility for macOS that lets you clean, repair and optimize your Mac. It is a powerful digital toolset that helps hundreds of thousands of Mac users around the world get... Read more
Firefox 49.0.2 - Fast, safe Web browser.
Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
Art Text 3.1 - $49.99
Art Text is graphic design software to create stunning illustrations, such as badges, flyers, logos, social headers and icons, text mockups, website graphics and buttons, picture captions, word art,... Read more
AirRadar 3.1.9 - $9.95
With AirRadar, scanning for wireless networks is now easier and more personalized! It allows you to scan for open networks and tag them as favourites or filter them out. View detailed network... Read more
Alarm Clock Pro 10.2.5 - $19.95
Alarm Clock Pro isn't just an ordinary alarm clock. Use it to wake you up in the morning, send and compose e-mails, remind you of appointments, randomize the iTunes selection, control an internet... Read more
MacCleanse 5.1.6 - $29.95
MacCleanse is the product of thousands of hours of intense research and development. It meticulously scans all of the nooks and crannies of a computer for unnecessary junk that can take up huge... Read more
Apple macOS Sierra 10.12.1 - The latest...
With Apple macOS Sierra, Siri makes its debut on Mac, with new features designed just for the desktop. Your Mac works with iCloud and your Apple devices in smart new ways, and intelligent... Read more
Backblaze - Online backup serv...
Backblaze is an online backup service designed from the ground-up for the Mac. With unlimited storage available for $5 per month, as well as a free 15-day trial, peace of mind is within reach with... Read more

Latest Forum Discussions

See All

WitchSpring2 (Games)
WitchSpring2 1.27 Device: iOS Universal Category: Games Price: $3.99, Version: 1.27 (iTunes) Description: This is the story of Luna, the Moonlight Witch as she sets out into the world. This is a sequel to Witch Spring. Witch Spring 2... | Read more »
4 popular apps getting a Halloween makeo...
'Tis the season for all things spooky. So much, so, in fact, that even apps are getting into the spirt of things, dressing up in costume and spreading jack o' lanterns all about the place. These updates bring frightening new character skins, scary... | Read more »
Pokémon GO celebrates Halloween with can...
The folks behind Pokémon GO have some exciting things planned for their Halloween celebration, the first in-game event since it launched back in July. Starting October 26 and ending on November 1, trainers will be running into large numbers of... | Read more »
Best Fiends Forever Guide: How to collec...
The fiendship in Seriously's hit Best Fiends has been upgraded this time around in Best Fiends Forever. It’s a fast-paced clicker with lots of color and style--kind of reminiscent of a ‘90s animal mascot game like Crash Bandicoot. The game... | Read more »
5 apps for the budding mixologist
Creating your own cocktails is something of an art form, requiring a knack for unique tastes and devising interesting combinations. It's easy to get started right in your own kitchen, though, even if you're a complete beginner. Try using one of... | Read more »
5 mobile strategy games to try when you...
Strategy enthusiasts everywhere are celebrating the release of Civilization VI this week, and so far everyone seems pretty satisfied with the first full release in the series since 2010. The series has always been about ultra-addictive gameplay... | Read more »
Popclaire talk to us about why The Virus...
Humanity has succumbed to a virus that’s spread throughout the world. Now the dead have risen with a hunger for human flesh, and all that remain are a few survivors. One of those survivors has just called you for help. That’s the plot in POPCLAIRE’... | Read more »
Oceans & Empires preview build sets...
Hugely ambitious sea battler Oceans & Empires is available to play in preview form now on Google Play - but download it quickly, as it’s setting sail away in just a few days. [Read more] | Read more »
Rusty Lake: Roots (Games)
Rusty Lake: Roots 1.1.4 Device: iOS Universal Category: Games Price: $2.99, Version: 1.1.4 (iTunes) Description: James Vanderboom's life drastically changes when he plants a special seed in the garden of the house he has inherited.... | Read more »
Flippy Bottle Extreme! and 3 other physi...
Flippy Bottle Extreme! takes on the bottle flipping craze with a bunch of increasingly tricky physics platforming puzzles. It's difficult and highly frustrating, but also addictive. When you begin to master the game, the sense of achievement is... | Read more »

Price Scanner via

EyeQue Introduces iOS And Android Based Advan...
Affordable vision technologies developers EyeQue have announced what they claim to be the world’s most advanced intelligent vision solution, pitched as enabling anyone, anywhere to easily and... Read more
Smartwatch Market Tanks, Declining 51.6% in 2...
The worldwide smartwatch market experienced a round of growing pains in the third quarter of 2016 (3Q16), resulting in a year-over-year decline in shipment volumes. According to data from the... Read more
CAZE announces Ultra Thin Glass Screen Protec...
Hong Kong based CAZE has announced its first ultra thin glass screen protector, the Glazz Pro for iPhone 7/7 Plus. Glazz Pro is made from chemically reinforced glass with an anti-fingerprint... Read more
11-inch MacBook Airs on sale for up to $120 o...
Newegg has 11″ MacBook Airs on sale for up to $120 off MSRP. Shipping is free: - 11″ 1.6GHz/128GB MacBook Air: $799.99 $100 off MSRP - 11″ 1.6GHz/256GB MacBook Air: $979 $120 off MSRP Read more
Up to $300 off Macs, $20 off iPads with Apple...
Purchase a new Mac or iPad using Apple’s Education Store and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free, and... Read more
Apple’s Thursday “Hello Again” Event A Largel...
KGI Securities analyst Ming-Chi Kuo, who has a strong record of Apple hardware prediction accuracy, forecasts in a new note to investors released late last week that a long-overdue redo of the... Read more
12-inch Retina MacBooks on sale for $100 off...
Amazon has 2016 12″ Apple Retina MacBooks on sale for $100 off MSRP. Shipping is free: - 12″ 1.1GHz Silver Retina MacBook: $1199.99 $100 off MSRP - 12″ 1.1GHz Gold Retina MacBook: $1199.99 $100 off... Read more
Save up to $600 with Apple refurbished Mac Pr...
Apple has Certified Refurbished Mac Pros available for up to $600 off the cost of new models. An Apple one-year warranty is included with each Mac Pro, and shipping is free. The following... Read more
PixelStyle Inexpensive Photo Editor For Mac W...
PixelStyle is an all-in-one Mac Photo Editor with a huge range of high-end filters including lighting, blurs, distortions, tilt-shift, shadows, glows and so forth. PixelStyle Photo Editor for Mac... Read more
13-inch MacBook Airs on sale for $100-$140 of...
B&H has 13″ MacBook Airs on sale for $100-$140 off MSRP for a limited time. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/128GB MacBook Air (sku MMGF2LL/A): $899 $100 off... Read more

Jobs Board

*Apple* Retail - Multiple Positions- Towson,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Software Engineering Intern: Integration / QA...
Job Summary Apple is currently seeking enthusiastic interns who can work full-time for a minimum of 12-weeks between Fall 2015 and Summer 2016. Our software Read more
Software Engineering Intern: Frameworks at *...
Job Summary Apple is currently seeking enthusiastic interns who can work full-time for a minimum of 12-weeks between Fall 2015 and Summer 2016. Our software Read more
*Apple* Retail - Multiple Positions- Nashua,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions- Napervi...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.