Tutorial

System Preferences Management on macOS

Manage and control System Preferences access on your Roundfleet devices with comprehensive preference pane management, user restriction controls, and enterprise configuration solutions. This tutorial covers hiding, disabling, and controlling System Preferences for enhanced security and compliance.

Understanding System Preferences Management

System Preferences on macOS provides access to system configuration settings:

• Preference Panes - Individual configuration modules (Network, Security, Users, etc.)
• Bundle Identifiers - Unique identifiers for each preference pane
• Hidden vs Disabled - Different levels of access restriction
• Enterprise Control - Centralized management of user access to system settings

Enterprise Use Cases

System Preferences management benefits enterprise environments:

• Security Hardening - Prevent unauthorized configuration changes
• Compliance - Ensure devices meet regulatory requirements
• User Experience - Simplify interfaces by hiding irrelevant options
• Administrative Control - Centralize configuration management
• Data Protection - Restrict access to sensitive system settings

Basic System Preferences Control

Hide Profiles Pane

#!/bin/bash

# Hide Profiles pane from System Preferences
hide_profiles_pane() {
    echo "=== Hiding Profiles Pane ==="
    
    # Check macOS version (hiding requires macOS 13.0+)
    local macos_version=$(sw_vers -productVersion | cut -d. -f1)
    if [[ $macos_version -lt 13 ]]; then
        echo "Warning: Hiding panes requires macOS 13.0 or later"
        echo "Current version: $(sw_vers -productVersion)"
        echo "Using disable instead of hide..."
        disable_profiles_pane
        return
    fi
    
    # Hide the Profiles pane
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        HiddenPreferencePanes -array "com.apple.preferences.configurationprofiles"
    
    if [[ $? -eq 0 ]]; then
        echo "✓ Profiles pane hidden successfully"
        echo "Users will no longer see the Profiles pane in System Preferences"
    else
        echo "✗ Failed to hide Profiles pane"
        return 1
    fi
}

# Disable Profiles pane (alternative for older macOS)
disable_profiles_pane() {
    echo "=== Disabling Profiles Pane ==="
    
    # Disable the Profiles pane (works on macOS 10.2+)
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "com.apple.preferences.configurationprofiles"
    
    if [[ $? -eq 0 ]]; then
        echo "✓ Profiles pane disabled successfully"
        echo "Profiles pane will appear greyed out in System Preferences"
    else
        echo "✗ Failed to disable Profiles pane"
        return 1
    fi
}

# Usage
hide_profiles_pane

Unhide/Re-enable Profiles Pane

#!/bin/bash

# Restore Profiles pane access
restore_profiles_pane() {
    echo "=== Restoring Profiles Pane Access ==="
    
    # Remove from hidden panes
    local hidden_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null)
    if [[ -n "$hidden_panes" ]]; then
        echo "Removing from hidden panes..."
        defaults delete "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null
    fi
    
    # Remove from disabled panes
    local disabled_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null)
    if [[ -n "$disabled_panes" ]]; then
        echo "Removing from disabled panes..."
        defaults delete "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null
    fi
    
    echo "✓ Profiles pane access restored"
    echo "Users can now access the Profiles pane in System Preferences"
}

# Usage
restore_profiles_pane

Multiple Preference Panes Management

#!/bin/bash

# Manage multiple preference panes simultaneously
manage_multiple_panes() {
    local action="${1:-hide}"  # hide, disable, or restore
    local panes=("${@:2}")    # Array of pane identifiers
    
    if [[ ${#panes[@]} -eq 0 ]]; then
        echo "Usage: manage_multiple_panes [hide|disable|restore] <pane1> [pane2] ..."
        echo "Example: manage_multiple_panes hide profiles bluetooth network"
        return 1
    fi
    
    echo "=== Managing Multiple Preference Panes ==="
    echo "Action: $action"
    echo "Panes: ${panes[*]}"
    echo ""
    
    # Convert friendly names to bundle identifiers
    local bundle_ids=()
    for pane in "${panes[@]}"; do
        local bundle_id=$(get_bundle_identifier "$pane")
        if [[ -n "$bundle_id" ]]; then
            bundle_ids+=("$bundle_id")
            echo "✓ $pane -> $bundle_id"
        else
            echo "✗ Unknown pane: $pane"
        fi
    done
    
    if [[ ${#bundle_ids[@]} -eq 0 ]]; then
        echo "No valid panes specified"
        return 1
    fi
    
    # Apply the action
    case "$action" in
        "hide")
            defaults write "/Library/Preferences/com.apple.systempreferences" \
                HiddenPreferencePanes -array "${bundle_ids[@]}"
            echo "✓ Panes hidden successfully"
            ;;
        "disable")
            defaults write "/Library/Preferences/com.apple.systempreferences" \
                DisabledPreferencePanes -array "${bundle_ids[@]}"
            echo "✓ Panes disabled successfully"
            ;;
        "restore")
            defaults delete "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null
            defaults delete "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null
            echo "✓ All panes restored"
            ;;
        *)
            echo "Invalid action: $action"
            return 1
            ;;
    esac
}

# Convert friendly names to bundle identifiers
get_bundle_identifier() {
    local pane_name="$1"
    
    case "$pane_name" in
        "profiles") echo "com.apple.preferences.configurationprofiles" ;;
        "bluetooth") echo "com.apple.preferences.Bluetooth" ;;
        "network") echo "com.apple.preference.network" ;;
        "security") echo "com.apple.preference.security" ;;
        "users") echo "com.apple.preferences.users" ;;
        "sharing") echo "com.apple.preferences.sharing" ;;
        "timemachine") echo "com.apple.prefs.backup" ;;
        "energy") echo "com.apple.preference.energysaver" ;;
        "displays") echo "com.apple.preference.displays" ;;
        "sound") echo "com.apple.preference.sound" ;;
        "keyboard") echo "com.apple.preference.keyboard" ;;
        "mouse") echo "com.apple.preference.mouse" ;;
        "trackpad") echo "com.apple.preference.trackpad" ;;
        "printers") echo "com.apple.preference.printfax" ;;
        "software_update") echo "com.apple.preferences.softwareupdate" ;;
        "date_time") echo "com.apple.preference.datetime" ;;
        "startup_disk") echo "com.apple.preference.startupdisk" ;;
        "accessibility") echo "com.apple.preference.universalaccess" ;;
        "screen_time") echo "com.apple.preference.screentime" ;;
        "extensions") echo "com.apple.preferences.extensions" ;;
        *) echo "" ;;
    esac
}

# Usage examples
# manage_multiple_panes hide profiles bluetooth network
# manage_multiple_panes disable security users sharing
# manage_multiple_panes restore

Advanced System Preferences Management

Policy-Based Preference Management

#!/bin/bash

# Policy-based system preferences management
apply_preference_policy() {
    local policy_name="${1:-standard_office}"
    local user_role="${2:-standard_user}"
    
    echo "=== Applying Preference Policy ==="
    echo "Policy: $policy_name"
    echo "User Role: $user_role"
    echo ""
    
    # Define policies
    case "$policy_name" in
        "kiosk_mode")
            apply_kiosk_policy "$user_role"
            ;;
        "locked_down")
            apply_locked_down_policy "$user_role"
            ;;
        "standard_office")
            apply_standard_office_policy "$user_role"
            ;;
        "developer_workstation")
            apply_developer_policy "$user_role"
            ;;
        "educational")
            apply_educational_policy "$user_role"
            ;;
        "healthcare")
            apply_healthcare_policy "$user_role"
            ;;
        "financial")
            apply_financial_policy "$user_role"
            ;;
        "public_terminal")
            apply_public_terminal_policy "$user_role"
            ;;
        "executive")
            apply_executive_policy "$user_role"
            ;;
        "contractor")
            apply_contractor_policy "$user_role"
            ;;
        *)
            echo "Unknown policy: $policy_name"
            return 1
            ;;
    esac
}

# Kiosk mode policy (maximum restrictions)
apply_kiosk_policy() {
    echo "Applying kiosk mode policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.prefs.backup"
        "com.apple.preferences.softwareupdate"
        "com.apple.preference.datetime"
        "com.apple.preference.startupdisk"
        "com.apple.preferences.extensions"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        HiddenPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Kiosk policy applied - most preferences hidden"
}

# Locked down policy (high security)
apply_locked_down_policy() {
    echo "Applying locked down policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.prefs.backup"
        "com.apple.preferences.softwareupdate"
        "com.apple.preference.startupdisk"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Locked down policy applied - security-sensitive panes disabled"
}

# Standard office policy (moderate restrictions)
apply_standard_office_policy() {
    echo "Applying standard office policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preferences.sharing"
        "com.apple.preference.startupdisk"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Standard office policy applied - minimal restrictions"
}

# Developer workstation policy (minimal restrictions)
apply_developer_policy() {
    echo "Applying developer workstation policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Developer policy applied - profile management restricted only"
}

# Educational policy (student-appropriate restrictions)
apply_educational_policy() {
    echo "Applying educational policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.preferences.softwareupdate"
        "com.apple.preference.startupdisk"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        HiddenPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Educational policy applied - student-safe configuration"
}

# Healthcare policy (HIPAA compliance focused)
apply_healthcare_policy() {
    echo "Applying healthcare policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.prefs.backup"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Healthcare policy applied - HIPAA compliance focused"
}

# Financial policy (enhanced security)
apply_financial_policy() {
    echo "Applying financial policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.prefs.backup"
        "com.apple.preferences.extensions"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Financial policy applied - enhanced security restrictions"
}

# Public terminal policy (maximum protection)
apply_public_terminal_policy() {
    echo "Applying public terminal policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.prefs.backup"
        "com.apple.preferences.softwareupdate"
        "com.apple.preference.datetime"
        "com.apple.preference.startupdisk"
        "com.apple.preferences.extensions"
        "com.apple.preference.energysaver"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        HiddenPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Public terminal policy applied - maximum protection"
}

# Executive policy (minimal restrictions, full access)
apply_executive_policy() {
    echo "Applying executive policy..."
    # Remove all restrictions for executives
    defaults delete "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null
    defaults delete "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null
    
    echo "✓ Executive policy applied - full access granted"
}

# Contractor policy (temporary access restrictions)
apply_contractor_policy() {
    echo "Applying contractor policy..."
    local restricted_panes=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preferences.sharing"
        "com.apple.prefs.backup"
        "com.apple.preferences.softwareupdate"
        "com.apple.preference.startupdisk"
        "com.apple.preferences.extensions"
    )
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${restricted_panes[@]}"
    
    echo "✓ Contractor policy applied - temporary access restrictions"
}

Enterprise System Preferences Management Tool

#!/bin/bash

# Roundfleet System Preferences Management Tool
# Comprehensive preference pane control and enterprise policy management

# Configuration
SCRIPT_VERSION="1.0.0"
LOG_FILE="/var/log/roundfleet_preferences.log"
REPORT_DIR="/etc/roundfleet/reports/preferences"
CONFIG_DIR="/etc/roundfleet/preferences"
POLICY_DIR="/etc/roundfleet/policies/preferences"
BACKUP_DIR="/etc/roundfleet/backups/preferences"

# Create directories if they don't exist
mkdir -p "$REPORT_DIR" "$CONFIG_DIR" "$POLICY_DIR" "$BACKUP_DIR"

# Comprehensive preference pane mapping
declare -A PREFERENCE_PANES=(
    ["profiles"]="com.apple.preferences.configurationprofiles"
    ["bluetooth"]="com.apple.preferences.Bluetooth"
    ["network"]="com.apple.preference.network"
    ["security"]="com.apple.preference.security"
    ["users"]="com.apple.preferences.users"
    ["sharing"]="com.apple.preferences.sharing"
    ["timemachine"]="com.apple.prefs.backup"
    ["energy"]="com.apple.preference.energysaver"
    ["displays"]="com.apple.preference.displays"
    ["sound"]="com.apple.preference.sound"
    ["keyboard"]="com.apple.preference.keyboard"
    ["mouse"]="com.apple.preference.mouse"
    ["trackpad"]="com.apple.preference.trackpad"
    ["printers"]="com.apple.preference.printfax"
    ["software_update"]="com.apple.preferences.softwareupdate"
    ["date_time"]="com.apple.preference.datetime"
    ["startup_disk"]="com.apple.preference.startupdisk"
    ["accessibility"]="com.apple.preference.universalaccess"
    ["screen_time"]="com.apple.preference.screentime"
    ["extensions"]="com.apple.preferences.extensions"
    ["spotlight"]="com.apple.preference.spotlight"
    ["language_region"]="com.apple.Localization"
    ["desktop_screensaver"]="com.apple.preference.desktopscreeneffect"
    ["dock"]="com.apple.preference.dock"
    ["mission_control"]="com.apple.preference.expose"
    ["notifications"]="com.apple.preference.notifications"
    ["internet_accounts"]="com.apple.preferences.internetaccounts"
    ["wallet_apple_pay"]="com.apple.preferences.wallet"
    ["siri"]="com.apple.preference.speech"
    ["touch_id"]="com.apple.preferences.password"
)

# Enterprise policy templates
declare -A POLICY_TEMPLATES=(
    ["kiosk_mode"]="Maximum restrictions for public kiosks and displays"
    ["locked_down"]="High security restrictions for sensitive environments"
    ["standard_office"]="Moderate restrictions for typical office environments"
    ["developer_workstation"]="Minimal restrictions for development environments"
    ["educational"]="Student-appropriate restrictions for educational institutions"
    ["healthcare"]="HIPAA-compliant restrictions for healthcare environments"
    ["financial"]="Enhanced security for financial services environments"
    ["public_terminal"]="Maximum protection for public access terminals"
    ["executive"]="Minimal to no restrictions for executive users"
    ["contractor"]="Temporary access restrictions for contract workers"
)

# Compliance frameworks
declare -A COMPLIANCE_FRAMEWORKS=(
    ["hipaa"]="Health Insurance Portability and Accountability Act"
    ["sox"]="Sarbanes-Oxley Act compliance"
    ["pci_dss"]="Payment Card Industry Data Security Standard"
    ["ferpa"]="Family Educational Rights and Privacy Act"
    ["gdpr"]="General Data Protection Regulation"
    ["nist"]="National Institute of Standards and Technology"
    ["iso27001"]="International Organization for Standardization 27001"
    ["cis"]="Center for Internet Security controls"
    ["fisma"]="Federal Information Security Management Act"
    ["common_criteria"]="Common Criteria security evaluation standard"
)

# Logging function
log_action() {
    local message="$1"
    local severity="${2:-INFO}"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] [$severity] $message" | tee -a "$LOG_FILE"
}

# Enterprise system preferences management
enterprise_preferences_management() {
    local operation="${1:-status}"
    local policy_name="${2:-standard_office}"
    local target_panes="${3:-}"
    local compliance_framework="${4:-}"
    
    log_action "Starting enterprise preferences management" "INFO"
    log_action "Operation: $operation, Policy: $policy_name" "INFO"
    
    echo "=== Enterprise System Preferences Management ==="
    echo "Operation: $operation"
    echo "Policy: $policy_name"
    echo "Target Panes: ${target_panes:-all_policy_defined}"
    echo "Compliance Framework: ${compliance_framework:-none}"
    echo "Management ID: $(uuidgen)"
    echo ""
    
    # Backup current configuration
    backup_current_configuration
    
    case "$operation" in
        "apply_policy")
            apply_enterprise_policy "$policy_name" "$compliance_framework"
            ;;
        "hide_panes")
            if [[ -n "$target_panes" ]]; then
                hide_specific_panes "$target_panes"
            else
                echo "Error: No target panes specified for hide operation"
                return 1
            fi
            ;;
        "disable_panes")
            if [[ -n "$target_panes" ]]; then
                disable_specific_panes "$target_panes"
            else
                echo "Error: No target panes specified for disable operation"
                return 1
            fi
            ;;
        "restore_all")
            restore_all_preferences
            ;;
        "status")
            show_preferences_status
            ;;
        "audit")
            perform_preferences_audit "$compliance_framework"
            ;;
        "list_policies")
            list_available_policies
            ;;
        "list_panes")
            list_available_panes
            ;;
        *)
            echo "Unknown operation: $operation"
            return 1
            ;;
    esac
    
    # Generate management report
    generate_preferences_report "$operation" "$policy_name" "$target_panes" "$compliance_framework"
    
    log_action "preferences management completed" "INFO"
}

# Backup current configuration
backup_current_configuration() {
    local backup_file="$BACKUP_DIR/preferences_backup_$(date +%Y%m%d_%H%M%S).plist"
    
    echo "--- Creating Configuration Backup ---"
    
    # Copy current system preferences configuration
    if [[ -f "/Library/Preferences/com.apple.systempreferences.plist" ]]; then
        cp "/Library/Preferences/com.apple.systempreferences.plist" "$backup_file"
        echo "✓ Configuration backed up to: $backup_file"
        log_action "Configuration backed up: $backup_file" "INFO"
    else
        echo "⚠️ No existing configuration file found"
        log_action "No existing configuration file to backup" "WARNING"
    fi
}

# Apply enterprise policy with compliance considerations
apply_enterprise_policy() {
    local policy_name="$1"
    local compliance_framework="$2"
    
    echo "--- Applying Enterprise Policy ---"
    echo "Policy: $policy_name"
    echo "Compliance: ${compliance_framework:-none}"
    
    # Apply base policy
    case "$policy_name" in
        "kiosk_mode")
            apply_kiosk_mode_policy
            ;;
        "locked_down")
            apply_locked_down_policy
            ;;
        "standard_office")
            apply_standard_office_policy
            ;;
        "developer_workstation")
            apply_developer_workstation_policy
            ;;
        "educational")
            apply_educational_policy
            ;;
        "healthcare")
            apply_healthcare_policy
            ;;
        "financial")
            apply_financial_policy
            ;;
        "public_terminal")
            apply_public_terminal_policy
            ;;
        "executive")
            apply_executive_policy
            ;;
        "contractor")
            apply_contractor_policy
            ;;
        *)
            echo "Unknown policy: $policy_name"
            return 1
            ;;
    esac
    
    # Apply compliance-specific modifications
    if [[ -n "$compliance_framework" ]]; then
        apply_compliance_modifications "$compliance_framework"
    fi
    
    echo "✓ Enterprise policy applied successfully"
}

# Apply compliance-specific modifications
apply_compliance_modifications() {
    local framework="$1"
    
    echo "--- Applying Compliance Modifications ---"
    echo "Framework: $framework"
    
    case "$framework" in
        "hipaa")
            apply_hipaa_compliance
            ;;
        "sox")
            apply_sox_compliance
            ;;
        "pci_dss")
            apply_pci_dss_compliance
            ;;
        "ferpa")
            apply_ferpa_compliance
            ;;
        "gdpr")
            apply_gdpr_compliance
            ;;
        *)
            echo "Unknown compliance framework: $framework"
            ;;
    esac
}

# HIPAA compliance modifications
apply_hipaa_compliance() {
    echo "Applying HIPAA compliance modifications..."
    
    # Additional restrictions for healthcare data protection
    local hipaa_restricted=(
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.prefs.backup"
        "com.apple.preferences.internetaccounts"
    )
    
    # Get current disabled panes
    local current_disabled=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    
    # Combine with HIPAA requirements
    local combined_disabled=($current_disabled "${hipaa_restricted[@]}")
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${combined_disabled[@]}"
    
    echo "✓ HIPAA compliance modifications applied"
}

# SOX compliance modifications
apply_sox_compliance() {
    echo "Applying SOX compliance modifications..."
    
    # Financial audit and control requirements
    local sox_restricted=(
        "com.apple.preferences.configurationprofiles"
        "com.apple.preference.security"
        "com.apple.preferences.users"
        "com.apple.preference.datetime"
    )
    
    # Similar pattern for SOX
    local current_disabled=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    local combined_disabled=($current_disabled "${sox_restricted[@]}")
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${combined_disabled[@]}"
    
    echo "✓ SOX compliance modifications applied"
}

# PCI DSS compliance modifications
apply_pci_dss_compliance() {
    echo "Applying PCI DSS compliance modifications..."
    
    # Payment card industry requirements
    local pci_restricted=(
        "com.apple.preferences.sharing"
        "com.apple.preference.network"
        "com.apple.preference.security"
        "com.apple.preferences.extensions"
    )
    
    local current_disabled=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    local combined_disabled=($current_disabled "${pci_restricted[@]}")
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${combined_disabled[@]}"
    
    echo "✓ PCI DSS compliance modifications applied"
}

# FERPA compliance modifications
apply_ferpa_compliance() {
    echo "Applying FERPA compliance modifications..."
    
    # Educational privacy requirements
    local ferpa_restricted=(
        "com.apple.preferences.sharing"
        "com.apple.preferences.internetaccounts"
        "com.apple.prefs.backup"
    )
    
    local current_disabled=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    local combined_disabled=($current_disabled "${ferpa_restricted[@]}")
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${combined_disabled[@]}"
    
    echo "✓ FERPA compliance modifications applied"
}

# GDPR compliance modifications
apply_gdpr_compliance() {
    echo "Applying GDPR compliance modifications..."
    
    # European data protection requirements
    local gdpr_restricted=(
        "com.apple.preferences.sharing"
        "com.apple.prefs.backup"
        "com.apple.preferences.internetaccounts"
        "com.apple.preference.notifications"
    )
    
    local current_disabled=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    local combined_disabled=($current_disabled "${gdpr_restricted[@]}")
    
    defaults write "/Library/Preferences/com.apple.systempreferences" \
        DisabledPreferencePanes -array "${combined_disabled[@]}"
    
    echo "✓ GDPR compliance modifications applied"
}

# Show current preferences status
show_preferences_status() {
    echo "--- System Preferences Status ---"
    
    # Check hidden panes
    local hidden_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null)
    if [[ -n "$hidden_panes" ]]; then
        echo "Hidden Panes:"
        echo "$hidden_panes" | tr -d '(),"' | tr '\n' ' ' | xargs -n1 | while read pane; do
            if [[ -n "$pane" ]]; then
                local friendly_name=$(get_friendly_name "$pane")
                echo "  - $friendly_name ($pane)"
            fi
        done
    else
        echo "Hidden Panes: None"
    fi
    
    echo ""
    
    # Check disabled panes
    local disabled_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null)
    if [[ -n "$disabled_panes" ]]; then
        echo "Disabled Panes:"
        echo "$disabled_panes" | tr -d '(),"' | tr '\n' ' ' | xargs -n1 | while read pane; do
            if [[ -n "$pane" ]]; then
                local friendly_name=$(get_friendly_name "$pane")
                echo "  - $friendly_name ($pane)"
            fi
        done
    else
        echo "Disabled Panes: None"
    fi
}

# Get friendly name from bundle identifier
get_friendly_name() {
    local bundle_id="$1"
    
    for friendly_name in "${!PREFERENCE_PANES[@]}"; do
        if [[ "${PREFERENCE_PANES[$friendly_name]}" == "$bundle_id" ]]; then
            echo "$friendly_name"
            return
        fi
    done
    
    echo "unknown"
}

# Generate comprehensive preferences report
generate_preferences_report() {
    local operation="$1"
    local policy_name="$2"
    local target_panes="$3"
    local compliance_framework="$4"
    
    local report_file="$REPORT_DIR/preferences_report_$(date +%Y%m%d_%H%M%S).json"
    
    # Get current configuration
    local hidden_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" HiddenPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    local disabled_panes=$(defaults read "/Library/Preferences/com.apple.systempreferences" DisabledPreferencePanes 2>/dev/null | tr -d '(),"' | tr '\n' ' ')
    
    cat > "$report_file" << EOF
{
    "preferences_report": {
        "report_metadata": {
            "report_id": "$(uuidgen)",
            "generated_date": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
            "hostname": "$(hostname)",
            "script_version": "$SCRIPT_VERSION",
            "macos_version": "$(sw_vers -productVersion)"
        },
        "operation_details": {
            "operation": "$operation",
            "policy_name": "$policy_name",
            "target_panes": "$target_panes",
            "compliance_framework": "$compliance_framework"
        },
        "current_configuration": {
            "hidden_panes": "$hidden_panes",
            "disabled_panes": "$disabled_panes",
            "total_restrictions": $(echo "$hidden_panes $disabled_panes" | wc -w)
        },
        "system_information": {
            "total_preference_panes": ${#PREFERENCE_PANES[@]},
            "available_policies": ${#POLICY_TEMPLATES[@]},
            "compliance_frameworks": ${#COMPLIANCE_FRAMEWORKS[@]}
        }
    }
}
EOF
    
    echo "Preferences report generated: $report_file"
    log_action "Preferences report generated: $report_file" "INFO"
}

# List available policies
list_available_policies() {
    echo "--- Available Enterprise Policies ---"
    for policy in "${!POLICY_TEMPLATES[@]}"; do
        echo "  $policy: ${POLICY_TEMPLATES[$policy]}"
    done
}

# List available preference panes
list_available_panes() {
    echo "--- Available Preference Panes ---"
    for pane in "${!PREFERENCE_PANES[@]}"; do
        echo "  $pane: ${PREFERENCE_PANES[$pane]}"
    done
}

# Main execution function
main() {
    local operation="${1:-help}"
    local policy="${2:-}"
    local panes="${3:-}"
    local compliance="${4:-}"
    
    log_action "=== Roundfleet System Preferences Management Started ===" "INFO"
    log_action "Operation: $operation" "INFO"
    
    case "$operation" in
        "apply")
            if [[ -z "$policy" ]]; then
                echo "Usage: $0 apply <policy_name> [compliance_framework]"
                echo "Available policies: ${!POLICY_TEMPLATES[*]}"
                exit 1
            fi
            enterprise_preferences_management "apply_policy" "$policy" "" "$compliance"
            ;;
        "hide")
            if [[ -z "$panes" ]]; then
                echo "Usage: $0 hide <pane1,pane2,...>"
                echo "Available panes: ${!PREFERENCE_PANES[*]}"
                exit 1
            fi
            enterprise_preferences_management "hide_panes" "" "$panes"
            ;;
        "disable")
            if [[ -z "$panes" ]]; then
                echo "Usage: $0 disable <pane1,pane2,...>"
                echo "Available panes: ${!PREFERENCE_PANES[*]}"
                exit 1
            fi
            enterprise_preferences_management "disable_panes" "" "$panes"
            ;;
        "restore")
            enterprise_preferences_management "restore_all"
            ;;
        "status")
            enterprise_preferences_management "status"
            ;;
        "audit")
            enterprise_preferences_management "audit" "" "" "$policy"
            ;;
        "list-policies")
            enterprise_preferences_management "list_policies"
            ;;
        "list-panes")
            enterprise_preferences_management "list_panes"
            ;;
        "help")
            echo "Usage: $0 [operation] [options...]"
            echo "Operations:"
            echo "  apply <policy> [compliance] - Apply enterprise policy"
            echo "  hide <panes> - Hide specific preference panes"
            echo "  disable <panes> - Disable specific preference panes"
            echo "  restore - Restore all preference panes"
            echo "  status - Show current preferences status"
            echo "  audit [compliance] - Perform compliance audit"
            echo "  list-policies - List available policies"
            echo "  list-panes - List available preference panes"
            echo "  help - Show this help"
            echo ""
            echo "Available Policies: ${!POLICY_TEMPLATES[*]}"
            echo "Compliance Frameworks: ${!COMPLIANCE_FRAMEWORKS[*]}"
            ;;
        *)
            log_action "ERROR: Unknown operation: $operation" "ERROR"
            echo "Use '$0 help' for usage information"
            exit 1
            ;;
    esac
    
    log_action "=== System preferences management completed ===" "INFO"
}

# Execute main function
main "$@"

Important Considerations

macOS Version Compatibility

• Hiding Panes: Requires macOS 13.0 or later (HiddenPreferencePanes)
• Disabling Panes: Works on macOS 10.2 and later (DisabledPreferencePanes)
• Bundle Identifiers: May change between macOS versions
• System Integrity Protection: Some restrictions may not apply with SIP enabled

Enterprise Deployment Notes

• User Impact: Hidden/disabled panes affect all users on the device
• Administrative Access: Changes require administrator privileges
• Policy Testing: Always test policies on non-production devices first
• Backup and Recovery: Maintain configuration backups for policy rollback

Security and Compliance Considerations

• Principle of Least Privilege: Only restrict access to necessary preference panes
• Audit Logging: All preference changes should be logged for compliance
• Compliance Frameworks: Different industries require specific restrictions
• User Training: Inform users about restricted functionality and alternatives

System Information Management on macOS

Collect and analyze comprehensive system information across your Roundfleet devices using advanced system profiling, automated data collection, and enterprise-grade analytics. This tutorial provides powerful tools for implementing organizational device inventory, monitoring, and compliance reporting.

Understanding macOS System Information

macOS provides several tools for system information gathering:

• system_profiler - Comprehensive system information collection
• uname - Basic system and kernel information
• sw_vers - Software version information
• hwpref - Hardware preference data
• ioreg - I/O Registry hardware information
• System Information.app - GUI system information interface

Basic System Information Operations

Complete System Information

#!/bin/bash

# Get complete system information
echo "=== Complete System Information ==="
system_profiler

echo "System information collection completed"

List Available Data Types

#!/bin/bash

# List all available system profiler data types
echo "=== Available Data Types ==="
system_profiler --listDataTypes

echo "Data types listing completed"

Specific System Information

#!/bin/bash

# Get specific system information
DATA_TYPE="${1:-SPHardwareDataType}"

echo "=== $DATA_TYPE Information ==="
system_profiler "$DATA_TYPE"

echo "Specific system information retrieved"

Save System Report to File

#!/bin/bash

# Save system information to file
REPORT_FILE="${1:-/tmp/system_report_$(date +%Y%m%d_%H%M%S).txt}"

echo "=== Saving System Report ==="
system_profiler > "$REPORT_FILE"

echo "System report saved to: $REPORT_FILE"

Enterprise System Information Management System

#!/bin/bash

# Roundfleet Enterprise System Information Management System
# Comprehensive system data collection, analysis, and monitoring

# Configuration
ROUNDFLEET_DIR="/etc/roundfleet"
SYSINFO_DIR="$ROUNDFLEET_DIR/system_information"
REPORTS_DIR="$ROUNDFLEET_DIR/reports"
COMPLIANCE_DIR="$ROUNDFLEET_DIR/compliance"
AUDIT_DIR="$ROUNDFLEET_DIR/audit"
LOG_FILE="/var/log/roundfleet_system_information.log"
POLICIES_DIR="$ROUNDFLEET_DIR/system_policies"
INVENTORY_DIR="$ROUNDFLEET_DIR/inventory"

# Create directory structure
create_directories() {
    local dirs=("$ROUNDFLEET_DIR" "$SYSINFO_DIR" "$REPORTS_DIR" "$COMPLIANCE_DIR" "$AUDIT_DIR" "$POLICIES_DIR" "$INVENTORY_DIR")
    for dir in "${dirs[@]}"; do
        [[ ! -d "$dir" ]] && mkdir -p "$dir"
    done
}

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# System Information Categories for Enterprise Management
declare -A SYSTEM_CATEGORIES=(
    ["hardware_overview"]="SPHardwareDataType,SPMemoryDataType,SPStorageDataType"
    ["software_inventory"]="SPSoftwareDataType,SPApplicationsDataType,SPExtensionsDataType"
    ["network_configuration"]="SPNetworkDataType,SPBluetoothDataType,SPWWANDataType"
    ["security_configuration"]="SPFirewallDataType,SPManagedClientDataType,SPConfigurationProfileDataType"
    ["peripherals"]="SPUSBDataType,SPThunderboltDataType,SPAudioDataType,SPDisplaysDataType"
    ["system_diagnostics"]="SPPowerDataType,SPLogsDataType,SPDiagnosticsDataType"
    ["enterprise_management"]="SPManagedClientDataType,SPConfigurationProfileDataType,SPCertificatesDataType"
)

# Data Collection Policies
declare -A COLLECTION_POLICIES=(
    ["comprehensive"]="all_data_types,full_detail,include_sensitive,export_json"
    ["security_focused"]="security_data,certificates,firewall_config,managed_profiles"
    ["hardware_inventory"]="hardware_overview,storage_details,memory_config,peripherals"
    ["software_audit"]="applications,extensions,system_software,preferences"
    ["network_assessment"]="network_interfaces,bluetooth_devices,wireless_config"
    ["compliance_report"]="security_config,certificates,managed_profiles,audit_data"
)

# System Health Monitoring Thresholds
declare -A HEALTH_THRESHOLDS=(
    ["cpu_temperature_warning"]=80
    ["memory_pressure_warning"]=80
    ["storage_usage_warning"]=85
    ["battery_cycle_warning"]=800
    ["uptime_excessive_hours"]=168  # 1 week
)

# Comprehensive system information collection
collect_system_information() {
    local collection_policy="$1"
    local output_format="${2:-json}"
    local include_sensitive="${3:-false}"
    local collection_id="sysinfo_$(date +%Y%m%d_%H%M%S)"
    local output_file="$SYSINFO_DIR/${collection_id}.${output_format}"
    
    log_action "Starting system information collection: $collection_policy"
    
    # Initialize collection metadata
    local hostname=$(hostname)
    local serial_number=$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')
    local model_identifier=$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk '{print $3}')
    local os_version=$(sw_vers -productVersion)
    local build_version=$(sw_vers -buildVersion)
    local uptime=$(uptime | awk '{print $3,$4}' | sed 's/,//')
    
    # Collect data based on policy
    local collected_data=""
    local data_types=""
    
    case "$collection_policy" in
        "comprehensive")
            data_types=$(system_profiler --listDataTypes | tr '\n' ' ')
            ;;
        "security_focused")
            data_types="SPFirewallDataType SPManagedClientDataType SPConfigurationProfileDataType SPCertificatesDataType"
            ;;
        "hardware_inventory")
            data_types="SPHardwareDataType SPMemoryDataType SPStorageDataType SPUSBDataType SPDisplaysDataType SPAudioDataType"
            ;;
        "software_audit")
            data_types="SPSoftwareDataType SPApplicationsDataType SPExtensionsDataType SPPrefPaneDataType"
            ;;
        "network_assessment")
            data_types="SPNetworkDataType SPBluetoothDataType SPWWANDataType SPAirPortDataType"
            ;;
        "compliance_report")
            data_types="SPManagedClientDataType SPConfigurationProfileDataType SPCertificatesDataType SPFirewallDataType"
            ;;
    esac
    
    # Collect data for each specified type
    for data_type in $data_types; do
        [[ -z "$data_type" ]] && continue
        
        log_action "Collecting data type: $data_type"
        
        if [[ "$output_format" == "json" ]]; then
            local type_data=$(system_profiler -json "$data_type" 2>/dev/null)
            if [[ -n "$type_data" && "$type_data" != "null" ]]; then
                collected_data="$collected_data\"$data_type\":$type_data,"
            fi
        else
            local type_data=$(system_profiler "$data_type" 2>/dev/null)
            if [[ -n "$type_data" ]]; then
                collected_data="$collected_data\n=== $data_type ===\n$type_data\n"
            fi
        fi
    done
    
    # Additional system metrics
    local additional_metrics=""
    if [[ "$include_sensitive" == "true" || "$collection_policy" == "comprehensive" ]]; then
        local cpu_info=$(sysctl -n machdep.cpu.brand_string)
        local memory_total=$(system_profiler SPHardwareDataType | grep "Memory:" | awk '{print $2,$3}')
        local storage_info=$(df -h / | awk 'NR==2 {print $2,$3,$4,$5}')
        local network_interfaces=$(ifconfig | grep "^[a-z]" | awk '{print $1}' | sed 's/:$//' | tr '\n' ' ')
        local running_processes=$(ps aux | wc -l)
        local logged_in_users=$(who | wc -l)
        
        additional_metrics="{\"cpu_info\":\"$cpu_info\",\"memory_total\":\"$memory_total\",\"storage_info\":\"$storage_info\",\"network_interfaces\":\"$network_interfaces\",\"running_processes\":$running_processes,\"logged_in_users\":$logged_in_users}"
    fi
    
    # Create structured output
    if [[ "$output_format" == "json" ]]; then
        # Remove trailing comma from collected data
        collected_data="${collected_data%,}"
        
        cat > "$output_file" << EOF
{
  "collection_metadata": {
    "collection_id": "$collection_id",
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "policy": "$collection_policy",
    "hostname": "$hostname",
    "serial_number": "$serial_number",
    "model_identifier": "$model_identifier",
    "os_version": "$os_version",
    "build_version": "$build_version",
    "uptime": "$uptime"
  },
  "system_data": {$collected_data},
  "additional_metrics": $additional_metrics,
  "collection_summary": {
    "data_types_collected": $(echo "$data_types" | wc -w),
    "include_sensitive": "$include_sensitive",
    "collection_size_bytes": $(wc -c < "$output_file" 2>/dev/null || echo "0")
  }
}
EOF
    else
        cat > "$output_file" << EOF
=== Roundfleet System Information Report ===
Collection ID: $collection_id
Timestamp: $(date)
Policy: $collection_policy
Hostname: $hostname
Serial Number: $serial_number
Model: $model_identifier
OS Version: $os_version ($build_version)
Uptime: $uptime

$collected_data
EOF
    fi
    
    log_action "System information collection completed: $output_file"
    echo "$output_file"
}

# System health analysis
analyze_system_health() {
    local analysis_type="$1"
    local health_report="$REPORTS_DIR/system_health_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Starting system health analysis: $analysis_type"
    
    # Collect basic health metrics
    local cpu_temp=$(sudo powermetrics -n 1 -s cpu_power | grep "CPU die temperature" | awk '{print $4}' 2>/dev/null || echo "0")
    local memory_pressure=$(vm_stat | grep "Pages compressed" | awk '{print $3}' | sed 's/\.//' | head -1)
    local storage_usage=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
    local uptime_seconds=$(sysctl -n kern.boottime | awk '{print $4}' | sed 's/,//')
    local current_time=$(date +%s)
    local uptime_hours=$(( (current_time - uptime_seconds) / 3600 ))
    
    # System load analysis
    local load_average=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | sed 's/,//')
    local cpu_cores=$(sysctl -n hw.ncpu)
    local load_per_core=$(echo "scale=2; $load_average / $cpu_cores" | bc -l 2>/dev/null || echo "0")
    
    # Battery information (if available)
    local battery_cycle_count=0
    local battery_condition="Unknown"
    if system_profiler SPPowerDataType | grep -q "Cycle Count"; then
        battery_cycle_count=$(system_profiler SPPowerDataType | grep "Cycle Count" | awk '{print $3}')
        battery_condition=$(system_profiler SPPowerDataType | grep "Condition" | awk '{print $2}')
    fi
    
    # Determine health status
    local health_status="healthy"
    local health_alerts=""
    
    if [[ $(echo "$cpu_temp > ${HEALTH_THRESHOLDS[cpu_temperature_warning]}" | bc -l 2>/dev/null) -eq 1 ]]; then
        health_status="warning"
        health_alerts="$health_alerts\"High CPU temperature: ${cpu_temp}°C\","
    fi
    
    if [[ $storage_usage -gt ${HEALTH_THRESHOLDS[storage_usage_warning]} ]]; then
        health_status="warning"
        health_alerts="$health_alerts\"High storage usage: ${storage_usage}%\","
    fi
    
    if [[ $battery_cycle_count -gt ${HEALTH_THRESHOLDS[battery_cycle_warning]} ]]; then
        health_status="warning"
        health_alerts="$health_alerts\"High battery cycle count: $battery_cycle_count\","
    fi
    
    if [[ $uptime_hours -gt ${HEALTH_THRESHOLDS[uptime_excessive_hours]} ]]; then
        health_status="attention"
        health_alerts="$health_alerts\"Excessive uptime: ${uptime_hours} hours\","
    fi
    
    # Remove trailing comma
    health_alerts="${health_alerts%,}"
    
    # Create health report
    cat > "$health_report" << EOF
{
  "system_health_analysis": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "analysis_type": "$analysis_type",
    "health_status": "$health_status",
    "device_info": {
      "hostname": "$(hostname)",
      "serial_number": "$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')",
      "model": "$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk '{print $3}')",
      "os_version": "$(sw_vers -productVersion)"
    }
  },
  "health_metrics": {
    "cpu_temperature_celsius": "$cpu_temp",
    "memory_pressure_pages": "$memory_pressure",
    "storage_usage_percent": $storage_usage,
    "uptime_hours": $uptime_hours,
    "load_average": "$load_average",
    "load_per_core": "$load_per_core",
    "cpu_cores": $cpu_cores,
    "battery_cycle_count": $battery_cycle_count,
    "battery_condition": "$battery_condition"
  },
  "health_alerts": [$health_alerts],
  "recommendations": [
    $([ "$health_status" != "healthy" ] && echo "\"Address health alerts for optimal performance\",")
    $([ $uptime_hours -gt 72 ] && echo "\"Consider system restart for optimal performance\",")
    $([ $storage_usage -gt 80 ] && echo "\"Review storage usage and cleanup if necessary\",")
    "\"Regular health monitoring recommended\""
  ]
}
EOF
    
    if [[ "$health_status" != "healthy" ]]; then
        log_action "HEALTH WARNING: System health issues detected - $health_status"
    fi
    
    log_action "System health analysis completed: $health_report"
    echo "$health_report"
}

# Enterprise device inventory management
manage_device_inventory() {
    local inventory_action="$1"
    local device_group="${2:-default}"
    local inventory_file="$INVENTORY_DIR/device_inventory_${device_group}.json"
    
    log_action "Managing device inventory: $inventory_action for group $device_group"
    
    case "$inventory_action" in
        "register")
            # Register device in inventory
            local device_data=$(collect_system_information "hardware_inventory" "json" "false")
            local hostname=$(hostname)
            local serial_number=$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')
            local model=$(system_profiler SPHardwareDataType | grep "Model Name" | awk -F': ' '{print $2}')
            local mac_address=$(ifconfig en0 | grep ether | awk '{print $2}')
            
            # Update inventory database
            if [[ -f "$inventory_file" ]]; then
                # Update existing inventory
                jq --arg hostname "$hostname" --arg serial "$serial_number" --arg model "$model" --arg mac "$mac_address" --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
                   '.devices[$hostname] = {serial_number: $serial, model: $model, mac_address: $mac, last_updated: $timestamp, status: "active"}' \
                   "$inventory_file" > "${inventory_file}.tmp" && mv "${inventory_file}.tmp" "$inventory_file"
            else
                # Create new inventory
                jq -n --arg hostname "$hostname" --arg serial "$serial_number" --arg model "$model" --arg mac "$mac_address" --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
                   '{inventory_metadata: {group: "'$device_group'", created: $timestamp}, devices: {($hostname): {serial_number: $serial, model: $model, mac_address: $mac, last_updated: $timestamp, status: "active"}}}' \
                   > "$inventory_file"
            fi
            
            log_action "Device registered in inventory: $hostname ($serial_number)"
            ;;
            
        "update")
            # Update device information
            local hostname=$(hostname)
            if [[ -f "$inventory_file" ]] && jq -e ".devices[\"$hostname\"]" "$inventory_file" >/dev/null; then
                jq --arg hostname "$hostname" --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
                   '.devices[$hostname].last_updated = $timestamp | .devices[$hostname].status = "active"' \
                   "$inventory_file" > "${inventory_file}.tmp" && mv "${inventory_file}.tmp" "$inventory_file"
                log_action "Device inventory updated: $hostname"
            else
                log_action "Device not found in inventory, registering: $hostname"
                manage_device_inventory "register" "$device_group"
            fi
            ;;
            
        "list")
            # List devices in inventory
            if [[ -f "$inventory_file" ]]; then
                echo "=== Device Inventory for Group: $device_group ==="
                jq -r '.devices | to_entries[] | "\(.key): \(.value.model) (\(.value.serial_number)) - \(.value.status)"' "$inventory_file"
            else
                echo "No inventory found for group: $device_group"
            fi
            ;;
            
        "remove")
            # Remove device from inventory
            local hostname=$(hostname)
            if [[ -f "$inventory_file" ]]; then
                jq --arg hostname "$hostname" 'del(.devices[$hostname])' "$inventory_file" > "${inventory_file}.tmp" && mv "${inventory_file}.tmp" "$inventory_file"
                log_action "Device removed from inventory: $hostname"
            fi
            ;;
    esac
}

# Compliance and security reporting
generate_compliance_report() {
    local compliance_framework="$1"
    local report_file="$COMPLIANCE_DIR/compliance_${compliance_framework}_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Generating compliance report: $compliance_framework"
    
    # Collect security-relevant system information
    local security_data=$(collect_system_information "security_focused" "json" "true")
    
    # Check specific compliance requirements
    local filevault_status=$(fdesetup status | grep -q "On" && echo "enabled" || echo "disabled")
    local firewall_status=$(sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -q "enabled" && echo "enabled" || echo "disabled")
    local gatekeeper_status=$(spctl --status | grep -q "enabled" && echo "enabled" || echo "disabled")
    local sip_status=$(csrutil status | grep -q "enabled" && echo "enabled" || echo "disabled")
    local secure_boot_status=$(nvram 94b73556-2197-4702-82a8-3e1337dafbfb:AppleSecureBootPolicy 2>/dev/null | grep -q "2" && echo "full" || echo "reduced")
    
    # Software update status
    local auto_update_status=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled 2>/dev/null || echo "0")
    local last_update_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate LastSuccessfulDate 2>/dev/null || echo "Unknown")
    
    # Certificate information
    local certificate_count=$(security find-certificate -a | grep "labl" | wc -l)
    local expired_certificates=$(security find-certificate -a -p | openssl x509 -noout -checkend 0 2>/dev/null | grep -c "will expire" || echo "0")
    
    # Create compliance report based on framework
    case "$compliance_framework" in
        "nist")
            cat > "$report_file" << EOF
{
  "compliance_report": {
    "framework": "NIST Cybersecurity Framework",
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "device_info": {
      "hostname": "$(hostname)",
      "serial_number": "$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')",
      "os_version": "$(sw_vers -productVersion)"
    }
  },
  "security_controls": {
    "identify": {
      "asset_management": "implemented",
      "system_inventory": "automated"
    },
    "protect": {
      "access_control": "$([ "$gatekeeper_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
      "data_security": "$([ "$filevault_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
      "protective_technology": "$([ "$firewall_status" == "enabled" ] && echo "implemented" || echo "needs_attention")"
    },
    "detect": {
      "security_monitoring": "basic",
      "malicious_code_protection": "$([ "$gatekeeper_status" == "enabled" ] && echo "implemented" || echo "needs_attention")"
    },
    "respond": {
      "incident_response": "manual",
      "communications": "standard"
    },
    "recover": {
      "recovery_planning": "$([ "$filevault_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
      "backup_procedures": "time_machine"
    }
  },
  "technical_controls": {
    "filevault_encryption": "$filevault_status",
    "firewall_protection": "$firewall_status",
    "gatekeeper_protection": "$gatekeeper_status",
    "system_integrity_protection": "$sip_status",
    "secure_boot": "$secure_boot_status",
    "automatic_updates": "$([ "$auto_update_status" == "1" ] && echo "enabled" || echo "disabled")",
    "certificate_management": {
      "total_certificates": $certificate_count,
      "expired_certificates": $expired_certificates
    }
  }
}
EOF
            ;;
            
        "hipaa")
            cat > "$report_file" << EOF
{
  "compliance_report": {
    "framework": "HIPAA Security Rule",
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "device_info": {
      "hostname": "$(hostname)",
      "serial_number": "$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')",
      "os_version": "$(sw_vers -productVersion)"
    }
  },
  "administrative_safeguards": {
    "access_management": "policy_required",
    "workforce_training": "policy_required",
    "contingency_plan": "policy_required"
  },
  "physical_safeguards": {
    "facility_access": "policy_required",
    "workstation_security": "$([ "$filevault_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
    "device_controls": "$([ "$gatekeeper_status" == "enabled" ] && echo "implemented" || echo "needs_attention")"
  },
  "technical_safeguards": {
    "access_control": "$([ "$gatekeeper_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
    "audit_controls": "basic_logging",
    "integrity": "$([ "$sip_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
    "transmission_security": "$([ "$firewall_status" == "enabled" ] && echo "implemented" || echo "needs_attention")",
    "encryption": "$([ "$filevault_status" == "enabled" ] && echo "implemented" || echo "needs_attention")"
  }
}
EOF
            ;;
    esac
    
    log_action "Compliance report generated: $report_file"
    echo "Compliance report saved to: $report_file"
}

# Automated system monitoring and alerting
monitor_system_continuously() {
    local monitoring_interval="${1:-600}"  # 10 minutes default
    local alert_threshold="${2:-warning}"  # warning level default
    
    log_action "Starting continuous system monitoring (interval: ${monitoring_interval}s, threshold: $alert_threshold)"
    
    while true; do
        # Perform health analysis
        local health_report=$(analyze_system_health "continuous")
        local health_status=$(jq -r '.system_health_analysis.health_status' "$health_report" 2>/dev/null || echo "unknown")
        
        if [[ "$health_status" != "healthy" && "$health_status" != "unknown" ]]; then
            local hostname=$(hostname)
            log_action "SYSTEM ALERT: Health status is $health_status for $hostname"
            
            # Send system notification
            osascript -e "display notification \"System health: $health_status\" with title \"Roundfleet System Monitor\""
            
            # Generate detailed report if critical
            if [[ "$health_status" == "critical" ]]; then
                collect_system_information "comprehensive" "json" "false"
            fi
        fi
        
        # Update device inventory
        manage_device_inventory "update" "monitored"
        
        # Log current status
        log_action "System monitoring check completed - Status: $health_status"
        
        sleep "$monitoring_interval"
    done
}

# Fleet deployment and management
deploy_to_fleet() {
    local deployment_action="$1"
    local fleet_file="$2"
    local deployment_policy="${3:-standard}"
    
    if [[ ! -f "$fleet_file" ]]; then
        log_action "ERROR: Fleet file not found: $fleet_file"
        return 1
    fi
    
    log_action "Deploying system information management to fleet: $deployment_action"
    
    while IFS= read -r host; do
        [[ -z "$host" || "$host" =~ ^#.*$ ]] && continue
        
        echo "Deploying to: $host"
        
        # Deploy system information management to remote host
        ssh "$host" "bash -s" << EOF
#!/bin/bash
# Remote deployment of system information management: $deployment_policy

# Create Roundfleet directories
mkdir -p /etc/roundfleet/{system_information,reports,compliance,audit,system_policies,inventory}

# Collect initial system information
echo "Collecting initial system information on \$(hostname)"

case "$deployment_policy" in
    "comprehensive")
        echo "Deploying comprehensive system monitoring"
        ;;
    "security_focused")
        echo "Deploying security-focused system monitoring"
        ;;
    "compliance_audit")
        echo "Deploying compliance audit configuration"
        ;;
esac

echo "System information management deployed on \$(hostname)"
EOF
        
        if [[ $? -eq 0 ]]; then
            log_action "Successfully deployed to: $host"
        else
            log_action "Failed to deploy to: $host"
        fi
        
    done < "$fleet_file"
    
    log_action "Fleet deployment completed"
}

# Health check and system validation
perform_system_health_check() {
    echo "=== Roundfleet System Information Management Health Check ==="
    
    # Check system_profiler availability
    if command -v system_profiler >/dev/null 2>&1; then
        echo "✓ system_profiler: Available"
    else
        echo "✗ system_profiler: Not available"
    fi
    
    # Check system information accessibility
    local hardware_info=$(system_profiler SPHardwareDataType 2>/dev/null)
    if [[ -n "$hardware_info" ]]; then
        echo "✓ Hardware information: Accessible"
    else
        echo "⚠️  Hardware information: Limited access"
    fi
    
    # Check security status
    local filevault_status=$(fdesetup status)
    if echo "$filevault_status" | grep -q "On"; then
        echo "✓ FileVault: Enabled"
    else
        echo "○ FileVault: Disabled"
    fi
    
    # Check firewall status
    if sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -q "enabled"; then
        echo "✓ Firewall: Enabled"
    else
        echo "○ Firewall: Disabled"
    fi
    
    # Check Gatekeeper status
    if spctl --status | grep -q "enabled"; then
        echo "✓ Gatekeeper: Enabled"
    else
        echo "○ Gatekeeper: Disabled"
    fi
    
    # Check System Integrity Protection
    if csrutil status | grep -q "enabled"; then
        echo "✓ SIP: Enabled"
    else
        echo "⚠️  SIP: Disabled"
    fi
    
    # Check available storage space
    local available_space=$(df -h / | awk 'NR==2 {print $4}')
    echo "✓ Available storage: $available_space"
    
    # Check system uptime
    local uptime_info=$(uptime)
    echo "✓ System uptime: $uptime_info"
}

# Main execution function
main() {
    create_directories
    
    case "${1:-}" in
        "collect")
            collect_system_information "${2:-comprehensive}" "${3:-json}" "${4:-false}"
            ;;
        "analyze_health")
            analyze_system_health "${2:-standard}"
            ;;
        "inventory")
            manage_device_inventory "${2:-list}" "${3:-default}"
            ;;
        "compliance")
            generate_compliance_report "${2:-nist}"
            ;;
        "monitor")
            monitor_system_continuously "${2:-600}" "${3:-warning}"
            ;;
        "deploy_fleet")
            deploy_to_fleet "${2:-install}" "$3" "${4:-standard}"
            ;;
        "health_check")
            perform_system_health_check
            ;;
        "help"|*)
            echo "Roundfleet Enterprise System Information Management System"
            echo ""
            echo "Usage: $0 <command> [options]"
            echo ""
            echo "Commands:"
            echo "  collect [policy] [format] [sensitive]    - Collect system information (comprehensive|security_focused|hardware_inventory|software_audit|network_assessment|compliance_report) [json|text] [true|false]"
            echo "  analyze_health [type]                    - Analyze system health (standard|detailed|continuous)"
            echo "  inventory <action> [group]               - Manage device inventory (register|update|list|remove) [group_name]"
            echo "  compliance [framework]                   - Generate compliance report (nist|hipaa|sox|iso27001)"
            echo "  monitor [interval] [threshold]           - Continuous monitoring (interval in seconds) (healthy|warning|critical)"
            echo "  deploy_fleet <action> <fleet_file> [policy] - Deploy to fleet (install|update|remove) [comprehensive|security_focused|compliance_audit]"
            echo "  health_check                             - Perform system health check"
            echo ""
            echo "Examples:"
            echo "  $0 collect comprehensive json false"
            echo "  $0 analyze_health detailed"
            echo "  $0 inventory register production"
            echo "  $0 compliance nist"
            echo "  $0 monitor 300 warning"
            echo "  $0 health_check"
            ;;
    esac
}

# Execute main function
main "$@"

System Information Data Types

The enterprise system supports comprehensive data type collection:

Category	Data Types	Use Case
Hardware Overview	SPHardwareDataType, SPMemoryDataType, SPStorageDataType	Asset inventory and capacity planning
Software Inventory	SPSoftwareDataType, SPApplicationsDataType, SPExtensionsDataType	License management and security auditing
Network Configuration	SPNetworkDataType, SPBluetoothDataType, SPWWANDataType	Network security and connectivity analysis
Security Configuration	SPFirewallDataType, SPManagedClientDataType, SPConfigurationProfileDataType	Compliance and security posture assessment
Peripherals	SPUSBDataType, SPThunderboltDataType, SPAudioDataType, SPDisplaysDataType	Peripheral management and security validation

Enterprise Collection Policies

Comprehensive Collection

# Collect all available system information
./sysinfo_manager.sh collect comprehensive json false

# Include sensitive information for detailed analysis
./sysinfo_manager.sh collect comprehensive json true

Security-Focused Collection

# Collect security-relevant information only
./sysinfo_manager.sh collect security_focused json false

# Generate security compliance report
./sysinfo_manager.sh compliance nist

Hardware Inventory

# Collect hardware inventory data
./sysinfo_manager.sh collect hardware_inventory json false

# Register device in enterprise inventory
./sysinfo_manager.sh inventory register production

System Health Monitoring

Health Analysis

# Perform standard health analysis
./sysinfo_manager.sh analyze_health standard

# Detailed health analysis with comprehensive metrics
./sysinfo_manager.sh analyze_health detailed

Continuous Monitoring

# Monitor system health every 10 minutes
./sysinfo_manager.sh monitor 600 warning

# Monitor system health every 5 minutes with critical threshold
./sysinfo_manager.sh monitor 300 critical

Enterprise Device Inventory

Inventory Management

# Register device in production inventory
./sysinfo_manager.sh inventory register production

# Update device information
./sysinfo_manager.sh inventory update production

# List all devices in inventory
./sysinfo_manager.sh inventory list production

# Remove device from inventory
./sysinfo_manager.sh inventory remove production

Compliance and Security Reporting

NIST Cybersecurity Framework

# Generate NIST compliance report
./sysinfo_manager.sh compliance nist

HIPAA Security Rule

# Generate HIPAA compliance report
./sysinfo_manager.sh compliance hipaa

Fleet Deployment Examples

Deploy to Development Fleet

Create a fleet file dev_fleet.txt:

dev-mac-01.company.com
dev-mac-02.company.com
dev-mac-03.company.com

# Deploy comprehensive system monitoring
./sysinfo_manager.sh deploy_fleet install dev_fleet.txt comprehensive

Deploy Security Monitoring

# Deploy security-focused monitoring to production fleet
./sysinfo_manager.sh deploy_fleet install prod_fleet.txt security_focused

Advanced Enterprise Features

Automated Data Collection

The system provides automated data collection capabilities:

• Scheduled collection with customizable intervals
• Policy-driven data gathering based on organizational requirements
• Intelligent filtering to reduce data volume while maintaining completeness
• Secure transmission of collected data to central repositories

System Health Analytics

Advanced health monitoring includes:

• Performance metrics analysis and trending
• Resource utilization monitoring and alerting
• Security posture assessment and recommendations
• Predictive maintenance based on system health indicators

Enterprise Integration

Integration capabilities include:

• LDAP/Active Directory integration for user and device management
• SIEM integration for security event correlation
• Asset management system integration
• Compliance framework alignment and reporting

Important Security Considerations

• Data sensitivity requires appropriate handling and encryption
• Access controls must be implemented for sensitive system information
• Audit logging should track all system information access and collection
• Network security must protect data transmission between devices
• Compliance requirements vary by industry and geographic location

Performance and Scalability

The enterprise system is designed for:

• Large-scale deployment across thousands of devices
• Efficient data collection with minimal system impact
• Scalable storage for historical data and trend analysis
• High availability with redundancy and failover capabilities
• Performance optimization for various hardware configurations

This comprehensive system transforms basic system information retrieval into an enterprise-grade device management and monitoring platform with advanced analytics, compliance reporting, and fleet-wide management capabilities.

Storage Management on macOS

Monitor and optimize storage across your Roundfleet devices using advanced disk usage analysis, automated cleanup policies, and comprehensive storage management. This tutorial provides enterprise-grade tools for implementing organizational storage policies and fleet-wide storage optimization.

Understanding macOS Storage Management

macOS provides several command-line tools for storage management:

• du - Directory usage analysis and space consumption
• df - Disk free space and filesystem information
• diskutil - Disk utility for advanced disk operations
• tmutil - Time Machine utility for backup storage
• Storage Management - GUI storage optimization interface

Basic Storage Operations

Check User Storage Usage

#!/bin/bash

# Check disk usage for all users
echo "=== User Storage Usage ==="
sudo du -hxd1 /Users

echo "Storage usage check completed"

Check Filesystem Usage

#!/bin/bash

# Check overall filesystem usage
echo "=== Filesystem Usage ==="
df -h

# Check specific filesystem
# df -h /dev/disk1s1

echo "Filesystem usage check completed"

Check Current Directory Usage

#!/bin/bash

# Check current directory usage
echo "=== Current Directory Usage ==="
du -sh *

echo "Directory usage check completed"

Enterprise Storage Management System

#!/bin/bash

# Roundfleet Enterprise Storage Management System
# Comprehensive storage monitoring, optimization, and policy management

# Configuration
ROUNDFLEET_DIR="/etc/roundfleet"
STORAGE_DIR="$ROUNDFLEET_DIR/storage_management"
REPORTS_DIR="$ROUNDFLEET_DIR/reports"
COMPLIANCE_DIR="$ROUNDFLEET_DIR/compliance"
AUDIT_DIR="$ROUNDFLEET_DIR/audit"
LOG_FILE="/var/log/roundfleet_storage_management.log"
POLICIES_DIR="$ROUNDFLEET_DIR/storage_policies"
CLEANUP_DIR="$ROUNDFLEET_DIR/cleanup_logs"

# Create directory structure
create_directories() {
    local dirs=("$ROUNDFLEET_DIR" "$STORAGE_DIR" "$REPORTS_DIR" "$COMPLIANCE_DIR" "$AUDIT_DIR" "$POLICIES_DIR" "$CLEANUP_DIR")
    for dir in "${dirs[@]}"; do
        [[ ! -d "$dir" ]] && mkdir -p "$dir"
    done
}

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# Storage Categories for Enterprise Management
declare -A STORAGE_CATEGORIES=(
    ["system_critical"]="macOS,system_apps,kernel_extensions,system_logs"
    ["user_data"]="documents,downloads,desktop,pictures,movies"
    ["application_data"]="app_support,caches,preferences,saved_states"
    ["development"]="xcode,simulators,build_artifacts,source_code"
    ["media_content"]="photos,videos,music,podcasts"
    ["temporary_files"]="caches,logs,trash,temp_downloads"
    ["backup_data"]="time_machine,local_snapshots,manual_backups"
)

# Storage Policies for Different Environments
declare -A STORAGE_POLICIES=(
    ["aggressive_cleanup"]="clear_caches,remove_logs_7days,empty_trash,remove_downloads_30days"
    ["conservative_cleanup"]="clear_caches,remove_logs_30days,archive_old_files"
    ["development_optimized"]="preserve_builds,clear_simulator_data,optimize_xcode_cache"
    ["media_optimized"]="compress_videos,optimize_photos,remove_duplicates"
    ["security_focused"]="secure_delete,encrypt_backups,audit_sensitive_files"
    ["compliance_strict"]="retain_all,encrypt_storage,detailed_logging,no_auto_delete"
)

# Disk Space Thresholds for Different Alert Levels
declare -A ALERT_THRESHOLDS=(
    ["critical"]=5     # Less than 5GB free
    ["warning"]=10     # Less than 10GB free
    ["low"]=20         # Less than 20GB free
    ["optimal"]=50     # Less than 50GB free
)

# Comprehensive storage analysis
analyze_storage_comprehensive() {
    local analysis_level="$1"
    local output_file="$STORAGE_DIR/storage_analysis_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Starting comprehensive storage analysis: $analysis_level"
    
    # Get basic filesystem information
    local total_space=$(df -h / | awk 'NR==2 {print $2}')
    local used_space=$(df -h / | awk 'NR==2 {print $3}')
    local available_space=$(df -h / | awk 'NR==2 {print $4}')
    local usage_percentage=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
    
    # Convert to bytes for calculations
    local available_gb=$(df -g / | awk 'NR==2 {print $4}')
    
    # Determine alert level
    local alert_level="optimal"
    if [[ $available_gb -lt ${ALERT_THRESHOLDS["critical"]} ]]; then
        alert_level="critical"
    elif [[ $available_gb -lt ${ALERT_THRESHOLDS["warning"]} ]]; then
        alert_level="warning"
    elif [[ $available_gb -lt ${ALERT_THRESHOLDS["low"]} ]]; then
        alert_level="low"
    fi
    
    # Analyze user directories
    local user_data=""
    while IFS= read -r user_dir; do
        if [[ -d "$user_dir" && ! "$user_dir" =~ (Shared|.localized)$ ]]; then
            local user_name=$(basename "$user_dir")
            local user_size=$(du -sg "$user_dir" 2>/dev/null | awk '{print $1}' || echo "0")
            user_data="$user_data{\"user\":\"$user_name\",\"size_gb\":$user_size},"
        fi
    done <<< "$(find /Users -maxdepth 1 -type d)"
    
    # Remove trailing comma
    user_data="${user_data%,}"
    
    # Analyze large directories
    local large_dirs=""
    if [[ "$analysis_level" == "detailed" || "$analysis_level" == "full" ]]; then
        while IFS= read -r dir_info; do
            local size=$(echo "$dir_info" | awk '{print $1}')
            local path=$(echo "$dir_info" | awk '{$1=""; print substr($0,2)}')
            [[ $size -gt 1 ]] && large_dirs="$large_dirs{\"path\":\"$path\",\"size_gb\":$size},"
        done <<< "$(sudo du -sg /Applications /Library /System /Users 2>/dev/null | sort -nr)"
        large_dirs="${large_dirs%,}"
    fi
    
    # Analyze system caches and temporary files
    local temp_data=""
    local cache_size=$(du -sg ~/Library/Caches 2>/dev/null | awk '{print $1}' || echo "0")
    local log_size=$(du -sg /var/log 2>/dev/null | awk '{print $1}' || echo "0")
    local trash_size=$(du -sg ~/.Trash 2>/dev/null | awk '{print $1}' || echo "0")
    
    temp_data="{\"caches_gb\":$cache_size,\"logs_gb\":$log_size,\"trash_gb\":$trash_size}"
    
    # Create comprehensive report
    cat > "$output_file" << EOF
{
  "storage_analysis": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "analysis_level": "$analysis_level",
    "alert_level": "$alert_level",
    "filesystem_info": {
      "total_space": "$total_space",
      "used_space": "$used_space",
      "available_space": "$available_space",
      "usage_percentage": $usage_percentage,
      "available_gb": $available_gb
    },
    "user_breakdown": [$user_data],
    "large_directories": [$large_dirs],
    "temporary_files": $temp_data
  },
  "recommendations": [
    $([ $alert_level == "critical" ] && echo "\"Immediate cleanup required - critical storage level\",")
    $([ $alert_level == "warning" ] && echo "\"Storage cleanup recommended\",")
    $([ $cache_size -gt 5 ] && echo "\"Clear application caches ($cache_size GB)\",")
    $([ $trash_size -gt 1 ] && echo "\"Empty trash ($trash_size GB)\",")
    $([ $log_size -gt 2 ] && echo "\"Archive old log files ($log_size GB)\",")
    "\"Regular storage monitoring recommended\""
  ]
}
EOF
    
    log_action "Storage analysis completed. Report: $output_file"
    
    # Alert if critical
    if [[ "$alert_level" == "critical" ]]; then
        log_action "CRITICAL ALERT: Storage space critically low ($available_gb GB remaining)"
        # Send alert notification
        osascript -e "display notification \"Critical storage space: $available_gb GB remaining\" with title \"Roundfleet Storage Alert\""
    fi
    
    echo "$output_file"
}

# Advanced storage cleanup with policies
perform_storage_cleanup() {
    local cleanup_policy="$1"
    local dry_run="${2:-false}"
    local cleanup_report="$CLEANUP_DIR/cleanup_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Starting storage cleanup with policy: $cleanup_policy (dry_run: $dry_run)"
    
    local total_freed=0
    local operations=""
    
    case "$cleanup_policy" in
        "aggressive_cleanup")
            # Clear application caches
            if [[ "$dry_run" == "false" ]]; then
                local cache_size_before=$(du -sg ~/Library/Caches 2>/dev/null | awk '{print $1}' || echo "0")
                find ~/Library/Caches -type f -mtime +1 -delete 2>/dev/null
                local cache_size_after=$(du -sg ~/Library/Caches 2>/dev/null | awk '{print $1}' || echo "0")
                local cache_freed=$((cache_size_before - cache_size_after))
                total_freed=$((total_freed + cache_freed))
                operations="$operations{\"operation\":\"clear_caches\",\"freed_gb\":$cache_freed},"
            fi
            
            # Remove old logs (7 days)
            if [[ "$dry_run" == "false" ]]; then
                local log_size_before=$(du -sg ~/Library/Logs 2>/dev/null | awk '{print $1}' || echo "0")
                find ~/Library/Logs -type f -mtime +7 -delete 2>/dev/null
                local log_size_after=$(du -sg ~/Library/Logs 2>/dev/null | awk '{print $1}' || echo "0")
                local log_freed=$((log_size_before - log_size_after))
                total_freed=$((total_freed + log_freed))
                operations="$operations{\"operation\":\"remove_old_logs\",\"freed_gb\":$log_freed},"
            fi
            
            # Empty trash
            if [[ "$dry_run" == "false" ]]; then
                local trash_size=$(du -sg ~/.Trash 2>/dev/null | awk '{print $1}' || echo "0")
                rm -rf ~/.Trash/*
                total_freed=$((total_freed + trash_size))
                operations="$operations{\"operation\":\"empty_trash\",\"freed_gb\":$trash_size},"
            fi
            
            # Remove old downloads (30 days)
            if [[ "$dry_run" == "false" ]]; then
                local downloads_size_before=$(du -sg ~/Downloads 2>/dev/null | awk '{print $1}' || echo "0")
                find ~/Downloads -type f -mtime +30 -delete 2>/dev/null
                local downloads_size_after=$(du -sg ~/Downloads 2>/dev/null | awk '{print $1}' || echo "0")
                local downloads_freed=$((downloads_size_before - downloads_size_after))
                total_freed=$((total_freed + downloads_freed))
                operations="$operations{\"operation\":\"remove_old_downloads\",\"freed_gb\":$downloads_freed},"
            fi
            ;;
            
        "development_optimized")
            # Clear Xcode derived data
            if [[ -d ~/Library/Developer/Xcode/DerivedData && "$dry_run" == "false" ]]; then
                local derived_size=$(du -sg ~/Library/Developer/Xcode/DerivedData 2>/dev/null | awk '{print $1}' || echo "0")
                rm -rf ~/Library/Developer/Xcode/DerivedData/*
                total_freed=$((total_freed + derived_size))
                operations="$operations{\"operation\":\"clear_xcode_derived_data\",\"freed_gb\":$derived_size},"
            fi
            
            # Clear iOS Simulator data
            if [[ -d ~/Library/Developer/CoreSimulator && "$dry_run" == "false" ]]; then
                local sim_size_before=$(du -sg ~/Library/Developer/CoreSimulator 2>/dev/null | awk '{print $1}' || echo "0")
                xcrun simctl delete unavailable
                local sim_size_after=$(du -sg ~/Library/Developer/CoreSimulator 2>/dev/null | awk '{print $1}' || echo "0")
                local sim_freed=$((sim_size_before - sim_size_after))
                total_freed=$((total_freed + sim_freed))
                operations="$operations{\"operation\":\"cleanup_simulator_data\",\"freed_gb\":$sim_freed},"
            fi
            ;;
            
        "media_optimized")
            # Find and report duplicate files
            if [[ "$dry_run" == "false" ]]; then
                log_action "Scanning for duplicate media files..."
                # This is a placeholder for duplicate detection logic
                operations="$operations{\"operation\":\"duplicate_scan\",\"freed_gb\":0},"
            fi
            
            # Optimize photo library (placeholder)
            log_action "Photo library optimization available through Photos app"
            operations="$operations{\"operation\":\"photo_optimization_recommended\",\"freed_gb\":0},"
            ;;
    esac
    
    # Remove trailing comma
    operations="${operations%,}"
    
    # Create cleanup report
    cat > "$cleanup_report" << EOF
{
  "cleanup_report": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "policy": "$cleanup_policy",
    "dry_run": "$dry_run",
    "total_freed_gb": $total_freed,
    "operations": [$operations]
  },
  "storage_after_cleanup": {
    "available_space": "$(df -h / | awk 'NR==2 {print $4}')",
    "usage_percentage": "$(df -h / | awk 'NR==2 {print $5}')"
  }
}
EOF
    
    if [[ "$dry_run" == "false" ]]; then
        log_action "Cleanup completed. Total space freed: ${total_freed}GB"
    else
        log_action "Dry run completed. Would free approximately: ${total_freed}GB"
    fi
    
    echo "$cleanup_report"
}

# Storage monitoring and alerting
monitor_storage_continuously() {
    local monitoring_interval="${1:-300}"  # 5 minutes default
    local alert_threshold="${2:-10}"       # 10GB default
    
    log_action "Starting continuous storage monitoring (interval: ${monitoring_interval}s, threshold: ${alert_threshold}GB)"
    
    while true; do
        local available_gb=$(df -g / | awk 'NR==2 {print $4}')
        local usage_percent=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
        
        if [[ $available_gb -lt $alert_threshold ]]; then
            log_action "STORAGE ALERT: Only ${available_gb}GB remaining (${usage_percent}% used)"
            
            # Send system notification
            osascript -e "display notification \"Low storage: ${available_gb}GB remaining\" with title \"Roundfleet Storage Monitor\""
            
            # Optionally trigger automatic cleanup
            if [[ $available_gb -lt 5 ]]; then
                log_action "Triggering emergency cleanup..."
                perform_storage_cleanup "aggressive_cleanup" "false"
            fi
        fi
        
        # Log current status
        log_action "Storage status: ${available_gb}GB available (${usage_percent}% used)"
        
        sleep "$monitoring_interval"
    done
}

# Enterprise storage reporting
generate_storage_report() {
    local report_type="$1"
    local report_file="$REPORTS_DIR/storage_enterprise_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Generating enterprise storage report: $report_type"
    
    # Collect comprehensive storage data
    local filesystem_data=$(df -h | grep -v "tmpfs\|devfs" | awk 'NR>1 {print "{\"filesystem\":\""$1"\",\"size\":\""$2"\",\"used\":\""$3"\",\"available\":\""$4"\",\"usage_percent\":\""$5"\"}"}' | tr '\n' ',' | sed 's/,$//')
    
    # Analyze user storage patterns
    local user_analysis=""
    local total_users=0
    local total_user_storage=0
    
    while IFS= read -r user_dir; do
        if [[ -d "$user_dir" && ! "$user_dir" =~ (Shared|.localized)$ ]]; then
            local user_name=$(basename "$user_dir")
            local user_size_gb=$(du -sg "$user_dir" 2>/dev/null | awk '{print $1}' || echo "0")
            ((total_users++))
            total_user_storage=$((total_user_storage + user_size_gb))
            user_analysis="$user_analysis{\"user\":\"$user_name\",\"storage_gb\":$user_size_gb},"
        fi
    done <<< "$(find /Users -maxdepth 1 -type d)"
    
    user_analysis="${user_analysis%,}"
    local avg_user_storage=$((total_user_storage / total_users))
    
    # Application storage analysis
    local app_storage=""
    if [[ -d /Applications ]]; then
        while IFS= read -r app_info; do
            local size=$(echo "$app_info" | awk '{print $1}')
            local app_path=$(echo "$app_info" | awk '{$1=""; print substr($0,2)}')
            local app_name=$(basename "$app_path")
            [[ $size -gt 0 ]] && app_storage="$app_storage{\"application\":\"$app_name\",\"size_gb\":$size},"
        done <<< "$(du -sg /Applications/*.app 2>/dev/null | sort -nr | head -20)"
        app_storage="${app_storage%,}"
    fi
    
    # System health indicators
    local health_indicators=""
    local available_gb=$(df -g / | awk 'NR==2 {print $4}')
    local health_status="healthy"
    
    if [[ $available_gb -lt 5 ]]; then
        health_status="critical"
    elif [[ $available_gb -lt 10 ]]; then
        health_status="warning"
    elif [[ $available_gb -lt 20 ]]; then
        health_status="low"
    fi
    
    health_indicators="{\"status\":\"$health_status\",\"available_gb\":$available_gb,\"recommendation\":\"$([ "$health_status" != "healthy" ] && echo "Cleanup required" || echo "Storage optimal")\"}"
    
    # Create comprehensive enterprise report
    cat > "$report_file" << EOF
{
  "enterprise_storage_report": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "report_type": "$report_type",
    "device_info": {
      "hostname": "$(hostname)",
      "mac_address": "$(ifconfig en0 | grep ether | awk '{print $2}')",
      "serial_number": "$(system_profiler SPHardwareDataType | grep 'Serial Number' | awk '{print $4}')"
    }
  },
  "storage_overview": {
    "filesystems": [$filesystem_data],
    "health_status": $health_indicators
  },
  "user_analysis": {
    "total_users": $total_users,
    "total_user_storage_gb": $total_user_storage,
    "average_user_storage_gb": $avg_user_storage,
    "user_breakdown": [$user_analysis]
  },
  "application_analysis": {
    "top_applications": [$app_storage]
  },
  "compliance_info": {
    "data_retention_policy": "enterprise_standard",
    "encryption_status": "$(fdesetup status | grep -q "On" && echo "enabled" || echo "disabled")",
    "backup_status": "$(tmutil status | grep -q "Running" && echo "active" || echo "inactive")"
  },
  "recommendations": [
    $([ "$health_status" == "critical" ] && echo "\"Immediate storage cleanup required\",")
    $([ $total_user_storage -gt 100 ] && echo "\"Consider user storage policies\",")
    $([ $available_gb -lt 20 ] && echo "\"Implement automated cleanup policies\",")
    "\"Regular storage monitoring recommended\""
  ]
}
EOF
    
    log_action "storage report generated: $report_file"
    echo "$report_file"
}

# Storage policy enforcement
enforce_storage_policies() {
    local policy_level="$1"
    
    log_action "Enforcing storage policies: $policy_level"
    
    case "$policy_level" in
        "enterprise_standard")
            # Standard enterprise storage policies
            log_action "Applying enterprise standard storage policies"
            
            # Set up automatic cleanup schedules
            cat > /tmp/roundfleet_storage_cleanup.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.roundfleet.storage.cleanup</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>$(realpath "$0") perform_storage_cleanup conservative_cleanup false</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>2</integer>
        <key>Minute</key>
        <integer>0</integer>
    </dict>
    <key>StandardOutPath</key>
    <string>/var/log/roundfleet_storage_cleanup.log</string>
    <key>StandardErrorPath</key>
    <string>/var/log/roundfleet_storage_cleanup.log</string>
</dict>
</plist>
EOF
            sudo mv /tmp/roundfleet_storage_cleanup.plist /Library/LaunchDaemons/
            sudo launchctl load /Library/LaunchDaemons/com.roundfleet.storage.cleanup.plist
            ;;
            
        "development_team")
            # Policies optimized for development teams
            log_action "Applying development team storage policies"
            perform_storage_cleanup "development_optimized" "false"
            ;;
            
        "media_production")
            # Policies for media production environments
            log_action "Applying media production storage policies"
            perform_storage_cleanup "media_optimized" "false"
            ;;
    esac
    
    log_action "Storage policies enforcement completed: $policy_level"
}

# Storage optimization recommendations
generate_optimization_recommendations() {
    local analysis_file="$1"
    local recommendations_file="$REPORTS_DIR/storage_recommendations_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Generating storage optimization recommendations"
    
    # Analyze current storage state
    local available_gb=$(df -g / | awk 'NR==2 {print $4}')
    local usage_percent=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
    
    # Check for common storage issues
    local cache_size=$(du -sg ~/Library/Caches 2>/dev/null | awk '{print $1}' || echo "0")
    local downloads_size=$(du -sg ~/Downloads 2>/dev/null | awk '{print $1}' || echo "0")
    local trash_size=$(du -sg ~/.Trash 2>/dev/null | awk '{print $1}' || echo "0")
    local log_size=$(sudo du -sg /var/log 2>/dev/null | awk '{print $1}' || echo "0")
    
    # Generate recommendations based on analysis
    local recommendations=""
    local priority="medium"
    
    if [[ $available_gb -lt 10 ]]; then
        priority="high"
        recommendations="$recommendations\"Immediate cleanup required - storage critically low\","
    fi
    
    if [[ $cache_size -gt 5 ]]; then
        recommendations="$recommendations\"Clear application caches (${cache_size}GB potential savings)\","
    fi
    
    if [[ $downloads_size -gt 10 ]]; then
        recommendations="$recommendations\"Review Downloads folder (${downloads_size}GB)\","
    fi
    
    if [[ $trash_size -gt 1 ]]; then
        recommendations="$recommendations\"Empty Trash (${trash_size}GB immediate savings)\","
    fi
    
    if [[ $log_size -gt 5 ]]; then
        recommendations="$recommendations\"Archive old log files (${log_size}GB)\","
    fi
    
    if [[ $usage_percent -gt 80 ]]; then
        recommendations="$recommendations\"Consider external storage or cloud archiving\","
    fi
    
    # Remove trailing comma
    recommendations="${recommendations%,}"
    
    cat > "$recommendations_file" << EOF
{
  "optimization_recommendations": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "priority_level": "$priority",
    "current_status": {
      "available_gb": $available_gb,
      "usage_percent": $usage_percent,
      "storage_health": "$([ $available_gb -gt 20 ] && echo "healthy" || echo "attention_required")"
    },
    "immediate_actions": [$recommendations],
    "long_term_strategies": [
      "Implement automated cleanup policies",
      "Set up storage monitoring alerts",
      "Consider cloud storage integration",
      "Regular storage health assessments"
    ],
    "potential_savings": {
      "caches_gb": $cache_size,
      "downloads_gb": $downloads_size,
      "trash_gb": $trash_size,
      "logs_gb": $log_size,
      "total_potential_gb": $((cache_size + downloads_size + trash_size + log_size))
    }
  }
}
EOF
    
    log_action "Storage optimization recommendations generated: $recommendations_file"
    echo "$recommendations_file"
}

# Fleet storage management
deploy_storage_management_to_fleet() {
    local fleet_file="$1"
    local management_policy="$2"
    
    if [[ ! -f "$fleet_file" ]]; then
        log_action "ERROR: Fleet file not found: $fleet_file"
        return 1
    fi
    
    log_action "Deploying storage management to fleet with policy: $management_policy"
    
    while IFS= read -r host; do
        [[ -z "$host" || "$host" =~ ^#.*$ ]] && continue
        
        echo "Deploying storage management to: $host"
        
        # Deploy storage management script to remote host
        ssh "$host" "bash -s" << EOF
#!/bin/bash
# Remote deployment of storage management: $management_policy

# Create Roundfleet directories
mkdir -p /etc/roundfleet/{storage_management,reports,compliance,audit,storage_policies,cleanup_logs}

# Set up basic storage monitoring
echo "Setting up storage monitoring for policy: $management_policy"

case "$management_policy" in
    "enterprise_standard")
        # Set up enterprise-grade monitoring
        echo "Configuring enterprise storage monitoring"
        ;;
    "development_optimized")
        # Set up development-focused monitoring
        echo "Configuring development storage optimization"
        ;;
    "media_production")
        # Set up media production monitoring
        echo "Configuring media production storage management"
        ;;
esac

echo "Storage management deployment completed on \$(hostname)"
EOF
        
        if [[ $? -eq 0 ]]; then
            log_action "Successfully deployed storage management to: $host"
        else
            log_action "Failed to deploy storage management to: $host"
        fi
        
    done < "$fleet_file"
    
    log_action "Fleet storage management deployment completed"
}

# Health check and system validation
perform_storage_health_check() {
    echo "=== Roundfleet Storage Management Health Check ==="
    
    # Check disk space
    local available_gb=$(df -g / | awk 'NR==2 {print $4}')
    local usage_percent=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
    
    if [[ $available_gb -gt 20 ]]; then
        echo "✓ Disk space: Healthy (${available_gb}GB available)"
    elif [[ $available_gb -gt 10 ]]; then
        echo "⚠️  Disk space: Low (${available_gb}GB available)"
    else
        echo "🔴 Disk space: Critical (${available_gb}GB available)"
    fi
    
    # Check for large cache files
    local cache_size=$(du -sg ~/Library/Caches 2>/dev/null | awk '{print $1}' || echo "0")
    if [[ $cache_size -gt 5 ]]; then
        echo "⚠️  Large caches detected: ${cache_size}GB"
    else
        echo "✓ Cache size: Normal (${cache_size}GB)"
    fi
    
    # Check trash
    local trash_size=$(du -sg ~/.Trash 2>/dev/null | awk '{print $1}' || echo "0")
    if [[ $trash_size -gt 1 ]]; then
        echo "○ Trash contains: ${trash_size}GB (can be emptied)"
    else
        echo "✓ Trash: Empty"
    fi
    
    # Check FileVault encryption
    if fdesetup status | grep -q "On"; then
        echo "✓ FileVault: Enabled"
    else
        echo "○ FileVault: Disabled"
    fi
    
    # Check Time Machine
    if tmutil status | grep -q "Running"; then
        echo "✓ Time Machine: Active"
    else
        echo "○ Time Machine: Inactive"
    fi
    
    # Check APFS snapshots
    local snapshots=$(tmutil listlocalsnapshots / | wc -l)
    if [[ $snapshots -gt 10 ]]; then
        echo "⚠️  Many local snapshots: $snapshots (consider cleanup)"
    else
        echo "✓ Local snapshots: $snapshots"
    fi
}

# Main execution function
main() {
    create_directories
    
    case "${1:-}" in
        "analyze")
            analyze_storage_comprehensive "${2:-standard}"
            ;;
        "cleanup")
            perform_storage_cleanup "${2:-conservative_cleanup}" "${3:-false}"
            ;;
        "monitor")
            monitor_storage_continuously "${2:-300}" "${3:-10}"
            ;;
        "report")
            generate_storage_report "${2:-comprehensive}"
            ;;
        "enforce_policies")
            enforce_storage_policies "${2:-enterprise_standard}"
            ;;
        "recommendations")
            generate_optimization_recommendations "$2"
            ;;
        "deploy_fleet")
            deploy_storage_management_to_fleet "$2" "${3:-enterprise_standard}"
            ;;
        "health_check")
            perform_storage_health_check
            ;;
        "help"|*)
            echo "Roundfleet Enterprise Storage Management System"
            echo ""
            echo "Usage: $0 <command> [options]"
            echo ""
            echo "Commands:"
            echo "  analyze [level]                     - Analyze storage (basic|standard|detailed|full)"
            echo "  cleanup <policy> [dry_run]          - Perform cleanup (aggressive_cleanup|conservative_cleanup|development_optimized|media_optimized) [true|false]"
            echo "  monitor [interval] [threshold]      - Continuous monitoring (interval in seconds, threshold in GB)"
            echo "  report [type]                       - Generate enterprise report (comprehensive|summary|compliance)"
            echo "  enforce_policies [policy]           - Enforce storage policies (enterprise_standard|development_team|media_production)"
            echo "  recommendations [analysis_file]     - Generate optimization recommendations"
            echo "  deploy_fleet <fleet_file> [policy]  - Deploy to fleet"
            echo "  health_check                        - Perform system health check"
            echo ""
            echo "Examples:"
            echo "  $0 analyze detailed"
            echo "  $0 cleanup aggressive_cleanup false"
            echo "  $0 monitor 600 15"
            echo "  $0 report comprehensive"
            echo "  $0 health_check"
            ;;
    esac
}

# Execute main function
main "$@"

Storage Analysis and Monitoring

The enterprise system provides comprehensive storage analysis:

Analysis Level	Scope	Details	Use Case
Basic	Overall disk usage	Quick space check	Daily monitoring
Standard	User and system breakdown	Detailed usage patterns	Weekly reviews
Detailed	Large directories analysis	Comprehensive inventory	Monthly audits
Full	Complete system analysis	Enterprise reporting	Quarterly assessments

Storage Cleanup Policies

Aggressive Cleanup Policy

# Perform aggressive cleanup to reclaim maximum space
./storage_manager.sh cleanup aggressive_cleanup false

# Dry run to see what would be cleaned
./storage_manager.sh cleanup aggressive_cleanup true

Development-Optimized Cleanup

# Clean development-specific cache and build data
./storage_manager.sh cleanup development_optimized false

Media Production Cleanup

# Optimize storage for media production workflows
./storage_manager.sh cleanup media_optimized false

Enterprise Storage Monitoring

Continuous Monitoring

# Monitor storage every 5 minutes with 10GB threshold
./storage_manager.sh monitor 300 10

# Monitor storage every hour with 20GB threshold
./storage_manager.sh monitor 3600 20

Automated Alerts

The system provides intelligent alerting:

• Critical Alert - Less than 5GB remaining
• Warning Alert - Less than 10GB remaining
• Low Storage - Less than 20GB remaining
• Optimal - More than 50GB remaining

Storage Policy Management

Enterprise Standard Policy

# Apply enterprise standard storage policies
./storage_manager.sh enforce_policies enterprise_standard

Development Team Policy

# Apply development-focused storage policies
./storage_manager.sh enforce_policies development_team

Media Production Policy

# Apply media production storage policies
./storage_manager.sh enforce_policies media_production

Fleet Deployment Examples

Deploy to Development Fleet

Create a fleet file dev_fleet.txt:

dev-mac-01.company.com
dev-mac-02.company.com
dev-mac-03.company.com

# Deploy development-optimized storage management
./storage_manager.sh deploy_fleet dev_fleet.txt development_team

Deploy to Production Fleet

# Deploy enterprise standard storage management
./storage_manager.sh deploy_fleet prod_fleet.txt enterprise_standard

Advanced Storage Features

Storage Analytics and Reporting

The system provides comprehensive enterprise reporting:

• Usage patterns across users and applications
• Cost analysis for storage optimization
• Compliance reporting for regulatory requirements
• Trend analysis for capacity planning

Automated Optimization

Advanced optimization features include:

• Duplicate file detection and removal
• Cache management with intelligent cleanup
• Log rotation and archival
• Backup optimization and verification

Security and Compliance

Enterprise security features:

• Encrypted storage verification and monitoring
• Audit trails for all storage operations
• Data retention policy enforcement
• Secure deletion for sensitive data

Important Storage Considerations

• FileVault encryption should be enabled for enterprise security
• Time Machine backups require adequate external storage
• APFS snapshots consume storage and should be monitored
• Application caches can grow large and require regular cleanup
• User education helps maintain optimal storage usage

Compliance and Governance

The enterprise system supports various compliance frameworks:

• GDPR Compliance - Data retention and secure deletion
• HIPAA Requirements - Healthcare data storage security
• SOX Compliance - Financial data storage controls
• ISO 27001 - Information security storage management

Performance Optimization

Storage performance optimization includes:

• SSD health monitoring and optimization
• APFS optimization for modern file systems
• Cache management for improved performance
• Defragmentation recommendations when needed

Testing and Validation

Before enterprise deployment:

1. Test cleanup policies on non-production systems
2. Verify monitoring thresholds are appropriate for your environment
3. Confirm alert mechanisms work correctly
4. Test recovery procedures for critical storage situations
5. Validate compliance reporting meets organizational requirements

This comprehensive system transforms basic disk usage commands into an enterprise-grade storage management platform with advanced monitoring, automated optimization, and fleet-wide management capabilities.