On macOS, you can access and read which managed preference settings are currently being applied to a particular Mac. This information is available in the following ways:

1. Viewing the contents of the Managed Client section of System Information.app
2. Using the system_profiler command line tool to view the SPManagedClientDataType data type’s data.

These managed preference settings are reported in the following way:

• The preference domain
• The setting’s key
• The setting key’s value (as text)
• Whether it applies to the computer or to a user
• How often it is enforced.

Here’s an example of how the Managed Client section appears in the System Information app:

Here’s an example of the output from the system_profiler command line tool when displaying the SPManagedClientDataType data:

It is possible to export this information using the system_profiler command line tool and work with the exported information. For more details, please see below the jump.

It is possible to use the system_profiler command line tool to export the SPManagedClientDataType data type’s data in either XML or JSON format. To display the data in XML format, you would use the following command:

The output should look similar to this:

If you want to export this data to a file, you can use a command similar to the one below:

The output should look similar to this:

To display the data in JSON format, you would use the following command:

The output should look similar to this:

If you want to export this data to a file, you can use a command similar to the one below:

The output should look similar to this:

Having this data can be useful to Mac admins who need to figure out what managed settings are being applied to a particular Mac, but who are in a situation where they don’t have access or visibility into what’s providing those management settings. One thing I decided to do with it was to try reconstructing configuration profiles being deployed to a particular Mac. This is because the Managed Client settings should have everything we need to reconstruct most profiles, with two caveats:

1. This is going to be a best-effort reconstruction using the available Managed Client settings data.
2. If the actual profile includes other information which isn’t included in the available Managed Client settings information, the resulting reconstruction will not include that information.

With these two caveats, I’ve developed a script named managed_client_profile_extractor.sh to create configuration profile files using the information available from the Managed Client settings. It’s available via the link below:

https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/managed_client_profile_extractor

For information about how to use this script, please see the README file available via the link above.

Note:

The configuration profile files produced by this script are reconstructions. They are not copies of the original profile(s) deployed to a Mac. There will be differences between the reconstructed profiles and the actual deployed profiles. For example:

• The Managed Client settings data doesn’t include profile identifiers, UUIDs, display names or other payloads, so the script generates new ones.
• The report stores every value as text and doesn’t record its type, so the script has to guess whether a value is a boolean, an integer, a decimal, a date or a string.

The reconstructed profiles are intended for reference use only. Do not use the reconstructed profile files for any other purpose, including for deployment to other Macs.

How it works:

The managed_client_profile_extractor.sh script reads a Managed Client report (SPManagedClientDataType) created by the system_profiler command line tool, either via creating that report file from the Mac it runs on or from a report file created previously on this Mac or another Mac. It then writes the settings in it back out as .mobileconfig configuration profiles, one per preference domain.

As noted earlier, this script will be making some guesses as part of its best effort reconstruction efforts with regards to turning text values into values for other data types  (boolean, integer, etc.) As part of this, the script will create a file named _recovery_report.txt, which contains information about the guesses it made with regards to data types.

Usage:

You can run this script with or without a pre-created report file.

Without report file:

With report file:

Note:

If you run the script with no report file specified, it will create a report of the Managed Client settings of the Mac the script is running on and use that information.

Creating a report for the script to use:

If you want to create the report file and provide it to the script, you would run a command similar to the one below:

For example, if you wanted to create a report file named managed_client_report.json and store it on your Desktop, you would use the command shown below:

If using the script without providing a report file, you should see output similar to this:

If using the script and providing a report file, you should see output similar to this:

The _recovery_report.txt file’s contents should appear similar to this example:

An example profile produced by this script should look similar to this: