How to Create Mac Computer Configuration Items in Configuration Manager

In the Configuration Manager console, click Assets and Compliance.

In the Assets and Compliance workspace, expand Compliance Settings, and then click Configuration Items.

On the Home tab, in the Create group, click Create Configuration Item.

On the General page of the Create Configuration Item Wizard, specify the following information:

• Name: Enter a unique name for the configuration item. You can use a maximum of 256 characters.
  
  
• Description: Provide a description that gives an overview of the configuration item and other relevant information that helps to identify it in the Configuration Manager console. You can use a maximum of 500 characters.
  
  

In the Specify the type of configuration item that you want to create list, select Mac OS X.

On the Settings page of the Create Configuration Item Wizard, click New.

On the General tab of the Create Setting dialog box, provide the following information:

• Name: Enter a unique name for the setting. You can use a maximum of 256 characters.
  
  
• Description: Enter a description for the setting. You can use a maximum of 1000 characters.
  
  
• Setting type: In the list, choose one of the following setting types to use for this setting:
  
  

   

  Setting type	More information
  Mac OS X Preferences	Configure the following for this setting type: Application ID – Specify the application ID of the property list file from which you want to evaluate a key for compliance. For example, if you want to edit settings for the Safari Web browser, you might use com.apple.Safari.plist. Key – Specify the name of the key that you want to evaluate for compliance on Mac computers. Use the following syntax: /<dictionary>/<keyname>.
  Script	Configure the following for this setting type: Discovery Script – Click Add Script, and then enter a shell script to assess settings on the Mac computer for compliance. Use the echo command in the shell script to return values to Configuration Manager for compliance. Configuration Manager uses the results returned in STDOUT to evaluate compliance. Important Do not include the reboot command in the discovery script. Because the discovery script runs each time the client restarts, this will cause the Mac computer to continually restart. Remediation script (optional) – Optionally, click Add Script and then enter a shell script that is used to remediate any noncompliance settings found on Mac client computers. Warning To ensure that you do not introduce formatting characters that the Mac computer cannot interpret, do not use copy and paste but type in the script.

• Data type: In the list, choose the format in which the condition returns the data before it is used to assess the setting.
  
  

  Note
  The Floating point data type supports only 3 digits after the decimal point.

Click OK to save the setting and close the Create Setting dialog box.

On the Compliance Rules page of the Create Configuration Item Wizard, click New.

In the Create Rule dialog box, provide the following information:

• Name: Enter a name for the compliance rule.
  
  
• Description: Enter a description for the compliance rule.
  
  
• Selected setting: Click Browse to open the Select Setting dialog box. Select the setting that you want to define a rule for, or click New Setting. When you are finished, click Select.
  
  

  Note
  You can also click Properties to view information about the currently selected setting.

• Rule type: Select the type of compliance rule that you want to use:
  
  
  • Value Create a rule that compares the value returned by the configuration item against a value that you specify.
    
    
  • Existential Create a rule that evaluates the setting depending on whether it exists on a client.
    
    
• For a rule type of Value, specify the following information:
  
  
  • The setting must comply with the following rule – Select an operator and a value which is assessed for compliance with the selected setting. You can use the following operators:
    
    

     

    Operator	More information
    Equals	No additional information
    Not equal to	No additional information
    Greater than	No additional information
    Less than	No additional information
    Between	No additional information
    Greater than or equal to	No additional information
    Less than or equal to	No additional information
    One of	In the text box, specify one entry on each line.
    None of	In the text box, specify one entry on each line.

  • Remediate noncompliant rules when supported – Select this option if you want Configuration Manager to automatically remediate noncompliant rules.
    
    

    Important
    You can only remediate noncompliant rules when the rule operator is set to Equals.

• Report noncompliance if this setting instance is not found – The configuration item reports noncompliance if this setting is not found on client computers.
  
  
• Noncompliance severity for reports: Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:
  
  
  • None Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.
    
    
  • Information Computers that fail this compliance rule report a failure severity of Information for Configuration Manager reports.
    
    
  • Warning Computers that fail this compliance rule report a failure severity of Warning for Configuration Manager reports.
    
    
  • Critical Computers that fail this compliance rule report a failure severity of Critical for Configuration Manager reports.
    
    
  • Critical with event Computers that fail this compliance rule report a failure severity of Critical for Configuration Manager reports. This severity level is also be logged as a Windows event in the application event log.
    
    
• For a rule type of Existential, specify the following information:
  
  

  Note
  The options shown might vary depending on the setting type you are configuring a rule for.

  • The setting must exist on client devices
    
    
  • The setting must not exist on client devices
    
    
• Noncompliance severity for reports: Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:
  
  
  • None Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.
    
    
  • Information Computers that fail this compliance rule report a failure severity of Information for Configuration Manager reports.
    
    
  • Warning Computers that fail this compliance rule report a failure severity of Warning for Configuration Manager reports.
    
    
  • Critical Computers that fail this compliance rule report a failure severity of Critical for Configuration Manager reports.
    
    
  • Critical with event Computers that fail this compliance rule report a failure severity of Critical for Configuration Manager reports. This severity level is also be logged as a Windows event in the application event log.
    
    

Click OK to close the Create Rule dialog box.