Apple MAC system accounts

Portal User asked a question.

December 18, 2017 at 8:00 AM

Does anyone else have Apple MAC devices within their estate?

We have been tidying up our user list, by enabling the user quarantine management and user exclusion list and have bought our list down from over 20K to under 10K. Now that we have a more manageable list of users we can spot anomalies easier.

I have come across several user prefixed with "_", such as:

_appleevents

_applepay

We currently have 37 of these, and with a MAC estate of 250ish devices this equates to almost 4K users.

There is a way to obtain a full list of users via Terminal on a MAC:

dscl . -list /Users

On our current build there are 88 different users in total.

I can obviously add them to the user exclusion list (if it will take that many), but I was wondering if there is another way, or if this has been requested previously?

Thanks

SamuelBaughan
8 years ago
Hi Greg, In our environment, we use the user exclusion list. Since it accepts wildcards, we get rid of the Apple Mac system accounts by excluding this pattern: %\_% That will match any account in any domain that starts with an underscore. We do not have real user accounts matching this pattern, reason for which this trick works in our case. Regards
Expand Post
- Portal User
  8 years ago
  Hi ‌, As we are on a hosted platform, I asked our "Host" to do exactly that, since all the accounts are prefixed with \_ I believe that the "_" is also counted as a wildcard along with "%" so it caused issues as I have been lead to believe if the users appear as Domain\UserName since the exception is only looking for "\" in your case. I did a bit of work analysing the accounts and sent our hosting partner a list of the accounts which occur more frequently, since the user exclusion list has a 500 character limit I believe. One thing I have found useful is an Extension for Google Chrome called "Kantu Browser Automation". You can record web actions that you repeat. So to remove accounts for user "Win7Default" for example, I have a macro recorded. When required, I can clean out my irrelevant users within 5 minutes... Regards Greg
  Expand Post
  - SamuelBaughan
    8 years ago
    Hi Greg, You're right, I forgot about the fact that the underscore is also a wildcard! I reverted back to my previous exclusion list. Thanks a lot!
    Expand Post
    SamuelBaughan
    8 years ago
    A more thorough approach could be to insert a custom cleaning step in the DUJ that would clean the temporary records before they are transferred to SLM. The query would include a DELETE statement with a filter containing something like: WHERE UserName LIKE '%\!_%' ESCAPE '!' But of course, that would need some collaboration with Snow Support Regards
    Expand Post
    Portal User
    8 years ago
    I think that SQL query would work. Might be worth sharing with SNOW. If we weren't on a hosted platform I'd try it
    Expand Post
    SamuelBaughan
    8 years ago
    Hi Greg, Good news, a Snow user in our team found that the matching pattern might actually be regex-based (or a flavour or regex). To confirm, he has made a test using square brackets around the "_" caracter which is supposed to escape it. This seems to work in SLM: So we made the test and included the " %\[_]% " pattern into the exclusion list. I'll let you know the results Greetings
    Expand Post
    Portal User
    8 years ago
    Morning Samuel, That's great. I look forward to hearing back from you. Fingers crossed this works as it will capture all of the accounts in one hit! I'm glad there are clever people out there to work this out Regards Greg
    Expand Post
    SamuelBaughan
    8 years ago
    Hi Greg, Good news! After 2 weeks I can confirm that filtering using the pattern %\[_]% works! I had none of those Mac system accounts imported into SLM for 2 weeks. The accounts are still there but show no new logon. Thanks to Steve who suggested this solution! See: https://community.snowsoftware.com/message/4682-does-the-slm-search-use-the-same-way-smacc-does Regards
    Expand Post
    Portal User
    8 years ago
    This sounds to be a good thing to add to an overall best practices for Snow and Mac devices. Think this should be something to be pulled from all of this good stuff.
    Expand Post
    Portal User
    8 years ago
    Any ideas on how we would best go about clearing those accounts from SLM once we verified the exclusion policy is working?
    Expand Post

10 of 17

Related Product Forums

→ Flexera One

→ Snow Atlas

→ FlexNet Manager

→ Snow License Manager

→ App Broker

Need help finding an answer?

Ask a Question →