Apple Remote Desktop

(imported topic written by SystemAdmin)

We are using the four custom fields for Computer Information within the Apple Remote Desktop. Has anyone had any luck in reporting data from these fields? We’re trying to write an analysis, and are currently drawing a blank.

Thanks in advance.

(imported comment written by SystemAdmin)

Additional information…

The data appears to be located in “/Library/Preferences/com.apple.RemoteDesktop.plist”

This looks to be an XML file. Contents as follows:

<?xml version="1.0" encoding="UTF-8"?>

Text1

Text2

Text3

Text4

INFORMATION

Trying to utilize found information on using BigFix to query XML has been unsuccessful (probably because we’re doing it wrong).

The desired outcome is to return the “string” of any of these “keys”.

(imported comment written by SystemAdmin)

We have been able to pull values from this document… if it’s an XML file on a PC (saved as c:\test.xml).

node values of child nodes of selects “/plist/dict/string” of xml document of file “c:\test.xml”

No such luck using QnA on the Mac.

(The operator “xml document” is not defined.)

Could this be because our file path is incorrect on the Mac side?

(imported comment written by BenKus)

Here is some info straight from our Mac Developer:

The XML inspectors are windows only as they use Windows XML parsing APIs.

But the Mac has special .plist inspectors which are even better for this case. You want to use "dictionary of ", and then:

“array of dictionary”

“string of dictionary”

“integer of dictionary”

“bool of dictionary”

“keys of dictionary”

or

"string 2 of "

"int 3 of "

etc. See the inspector language guide for the full set of inspectors.

This way you can get at arbitrary data in trees of .plist data.

For the question they asked the .plist is quite simple (flat, no hierarchy, and all strings) so a simple query would be:

string “Text2” of dictionary of file “/Library/Preferences/com.apple.RemoteDesktop.plist”

A more complex query might be:

string 3 of array “TB Item Identifiers” of dictionary “NSToolar Configuration SafariToolbarIdentifier” of dictionary of file “/Users/Bob/Library/Preferences/com.apple.Safari.plist”

These inspectors become quite useful when used in conjunction with the iokit registry inspector which will give you a dictionary for any of the nodes of any of the planes of the iokit registry:

keys of node “memory-map” of node “chosen” of dictionary of devicetree plane of iokit registry

or

keys of node “chosen/memory-map” of dictionary of devicetree plane of iokit registry

Point of trivia that may be of use: The “cstring” inspector is used in cases where Apple (or other person who created the file) has chosen to store strings not as the “string” type but as the “data” type. If you grab it as “string” or “data” then you get the NULL included, whereas if you happen to know that data field will always have a null terminated string in it, you can use the “cstring” inspector to get what you want. We added this type because this came up in the iokit registry quite often:

Q: string “manufacturer” of dictionary of devicetree plane of iokit registry

A: Apple Computer, Inc.%00

Q: cstring “manufacturer” of dictionary of devicetree plane of iokit registry

A: Apple Computer, Inc.

(imported comment written by SystemAdmin)

This is very useful information. Thank you.