dan-snelson/mac-health-check/mac-health-check-selector

Mac Health Check Selector

Guide a Mac Admin through choosing which Mac Health Check (MHC) health checks to show and run, then write an edited, MDM-specific, date-stamped copy of Mac-Health-Check.zsh into Artifacts/, plus a sidecar .md that records the selection and validation results.

Target: Mac Health Check 5.0.0 and later. Full per-check data (exact list-item JSON, function arguments, shipped default order per MDM, artifact anchors) lives in references/health-checks.md. The write-and-validate procedure lives in references/artifact-procedure.md. The tested build-and-validate helper is scripts/build-artifact.zsh. Read both reference files before generating output. When they disagree with the admin's copy of Mac-Health-Check.zsh, trust the script.

Ground rules

• Ask the MDM question first, every time. Do not skip, merge, or bury it.
• Ask one step at a time. Wait for the answer before moving on.
• Use numbered lists and check IDs (such as C1, M5) so replies parse without ambiguity (see Reply grammar).
• Be non-destructive. Never edit Mac-Health-Check.zsh in place; write only to Artifacts/. Never commit or deploy anything.
• Use placeholders for anything organization-specific: <YOUR_ORG_NAME>, <YOUR_WEBHOOK_URL>, <YOUR_SPLUNK_HEC_URL>, <YOUR_SPLUNK_HEC_TOKEN>, <YOUR_POLICY_TRIGGER>, <YOUR_ORGANIZATION_NETWORK>. Never invent real URLs, tokens, or branding.
• Keep user-facing subtitles short and action-oriented.
• Accept "defaults", "same as shipped", or "recommend for me" at any step; pick the shipped default and say so.
• Change only which checks run, plus the optional removal of other MDMs' code (Step 4b). Every other setting keeps its Mac-Health-Check.zsh default (operationMode, mdmVendorUuid, external-check triggers, targeted remediation verification, developmentListitemJSON). Admins who want those changed edit the artifact manually.
• Leave only passing artifacts in Artifacts/. A build that fails validation is never written there.

Step 1 — Ask which MDM is in use

Send this question alone and wait:

Which MDM manages these Macs? Reply with a number or type your own.

1. Jamf Pro

2. Fleet

3. JumpCloud

4. Microsoft Intune

5. Mosyle

6. Kandji / Iru

7. Addigy

8. Filewave

9. Other / MDM-agnostic / custom

Map the answer to the script's names:

The helper prints each MDM by its display name (Kandji / Iru, Other / MDM-agnostic for generic); use the same names with the admin and in the sidecar.

MDM-specific notes to carry forward:

• All MDMs — the script picks its branch at runtime from the enrolled serverURL, not from the artifact name. An Intune artifact run on a Jamf Pro-enrolled Mac runs the unedited "Jamf Pro" ) branch, or the generic fallback when other MDMs were pruned (Step 4b).
• Jamf Pro — only MDM with Jamf Pro Check-In, Jamf Pro Inventory, Jamf Hosts, Computer Inventory (jamf recon), and checkExternalJamfPro external checks. Entra ID Registration and Clock Skew ship in the Jamf Pro list. The script exits early if /private/var/log/jamf.log is missing.
• Mosyle — adds Mosyle Check-In and the Mosyle Self-Service app check.
• Fleet / Intune — add an MDM agent app presence check (Fleet Desktop / Microsoft Company Portal).
• Kandji / Iru — detected when serverURL contains kandji; an Iru-branded URL without that string falls to the generic branch. Ask the admin to confirm their server URL. Ships a six-app set (A5a–A5f) and no MDM Profile row.
• Addigy — ships with a blank mdmVendorUuid; MDM Profile will not pass until the admin fills it in manually.
• Other — no MDM Profile or MDM Certificate Expiration, because no vendor profile or certificate name is known. Admins who know them edit mdmVendor, mdmVendorUuid or mdmProfileIdentifier, and the certificate name manually. The generic branch also runs on unenrolled Macs, where M4 Apple Push Notification service warns (APNs active; no MDM response) or fails.

Step 2 — Explain the purpose

After the MDM is known, say in two or three sentences:

Mac Health Check runs modular checks and shows each one as a row in the swiftDialog window. For <MDM>, each row is defined in <array name>, and each row's check runs from a matching runConfiguredHealthCheck line in the "<MDM>" case branch. We'll pick which checks to keep. Then I'll write an edited copy of the script to Artifacts/ with both parts in matching order, validate it, and record everything in a sidecar .md. Your Mac-Health-Check.zsh stays untouched.

Step 3 — Present the checklist

Show the checklist below, tailored to the MDM from Step 1:

• `[off]` marks each available check that is not in that MDM's shipped default (for example H7, M2, A4 on Intune). The off group is the smaller one for every MDM, so the list stays quiet. Say once above the list: "Unmarked checks are on by default; [off] checks are available but off." (See Shipped default order per MDM in the reference.)
• A5 shows the concrete app for the chosen MDM: A5 Fleet Desktop, A5 Microsoft Company Portal, A5 Mosyle Self-Service, or for Kandji A5a Microsoft One Drive, A5b Microsoft Outlook, A5c Company Portal, A5d Zoom, A5e Cortex, A5f Netskope.
• "Not available for <MDM>" is one group at the end that lists, with a short reason:
• Jamf Pro-only items (M5, M6, M13, A6–A10, F1) for every MDM except Jamf Pro;
• other vendors' vendor-only items (M7 Mosyle Check-In unless Mosyle);
• A5 when the MDM ships no agent app (Jamf Pro, JumpCloud, Addigy, Filewave, Other); offer an A4-style custom app instead;
• M1 and M3 for Other.
• Mark external checks with *.

Ask: "Reply defaults to keep the shipped list, or change it: H7 A4 adds, no A3 removes, only C, H1-H6, M4 picks exactly those."

Core OS & Security (C)

• C1 macOS Version
• C2 Available Updates (deferred, staged, and DDM-enforced)
• C3 System Integrity Protection (SIP)
• C4 Signed System Volume (SSV)
• C5 Firewall
• C6 FileVault Encryption
• C7 Gatekeeper / XProtect
• C8 Touch ID
• C9 Password Hint
• C10 AirDrop
• C11 AirPlay Receiver
• C12 Bluetooth Sharing
• C13 VPN Client

Maintenance & Hygiene (H)

• H1 Last Reboot
• H2 Free Disk Space
• H3 Desktop Size and Item Count
• H4 Downloads Size and Item Count
• H5 Trash Size and Item Count
• H6 Memory Pressure (warning-only; 14-day JSON Lines history; warns on recurring pressure across 2 distinct days in 7)
• H7 Clock Skew (ships for Jamf Pro; runs on any MDM)

MDM & Connectivity (M)

• M1 <MDM> MDM Profile
• M2 Entra ID Registration (ships for Jamf Pro; reads the JamfAAD plist, Platform SSO, and the MS-ORGANIZATION-ACCESS certificate; on other MDMs it passes as Not Applicable unless that certificate exists, which reports Partial (warning) — review before using elsewhere)
• M3 <MDM> MDM Certificate Expiration
• M4 Apple Push Notification service (APNs)
• M5 Jamf Pro Check-In [Jamf Pro only]
• M6 Jamf Pro Inventory [Jamf Pro only]
• M7 Mosyle Check-In [Mosyle only]
• M8 Apple Push Notification Hosts
• M9 Apple Device Management
• M10 Apple Software and Carrier Updates
• M11 Apple Certificate Validation
• M12 Apple Identity and Content Services
• M13 Jamf Hosts [Jamf Pro only]
• M14 Wi-Fi Strength
• M15 Network Quality Test (slowest check)

Applications & Tools (A)

• A1 App Auto-Patch
• A2 Homebrew Status
• A3 Electron Corner Mask
• A4 Organizationally required application (Microsoft Teams unless the admin names another app)
• A5 MDM agent app (concrete name per MDM; see above)
• A6 BeyondTrust Privilege Management* [Jamf Pro only]
• A7 Cisco Umbrella* [Jamf Pro only]
• A8 CrowdStrike Falcon* [Jamf Pro only]
• A9 Palo Alto GlobalProtect* [Jamf Pro only]
• A10 Other external-checks/ script* (Microsoft Defender, Microsoft Office 365, Nessus, Sophos, Splunk Universal Forwarder, Zscaler, printer install, and others) [Jamf Pro only]

Follow-up Actions (F)

• F1 Computer Inventory [Jamf Pro only; always last]

* = requires an external-check script deployed as a Jamf Pro policy with a custom trigger. On other MDMs, offer A4-style presence checks (checkInternal) or a new custom checkXxx function instead.

A4 defaults to Microsoft Teams (/Applications/Microsoft Teams.app). Do not ask about it up front; show it in 4a, and ask for the path and display name only when the admin names another app or asks to change it. For A10, ask for the Jamf Pro policy trigger and the app path used for the icon.

Reply grammar

One rule set applies to every selection reply, in Step 3 and in 4a:

1. Tokens are case-insensitive and separated by commas or spaces. Duplicates are ignored.
2. Base: the current selection. In Step 3 that is the MDM's shipped default; in 4a it is the list being confirmed.
3. Operations:

• A bare token adds to the base: H7 A4 → defaults + H7 + A4.
• no <token> removes: no A3 on Intune → 33 − 1 = 32 checks.
• only <tokens> replaces the base with exactly those tokens; later no tokens in the same reply still apply.
• defaults resets the base to the shipped default: defaults, no M15.

1. Tokens:

• An ID (C5, A5c). A5 on Kandji means all six A5a–A5f.
• A range (H1-H6) is inclusive and stays inside one category.
• A category letter (C, H, M, A, F) means every available item in that category for the MDM.

1. An unknown ID → ask. A "Not available" ID → warn with the reason, and include it only if the admin confirms.
2. Order:

• Default items keep the MDM's shipped order.
• Available non-default additions go immediately before the first remaining M14, H6, or M15 (the tail every shipped default ends with), in master-table order (C, H, M, A). If none of those remain, append them.
• F1 always comes last. If F1 is picked without M15, warn and ask: keep M15 directly before F1, or drop F1.

Step 4 — Generate the artifact

Read references/health-checks.md and references/artifact-procedure.md, then work through 4a–4f in order.

4a. Confirm the selection

Resolve the final ordered list with Reply grammar. Show this block and wait for yes:

<MDM display name> · <n> checks

Enabled: C1 C2 C3 … M14 H6 M15 (IDs only, in final order)

Changes vs shipped default: added H7 Clock Skew, A4 Microsoft Teams; removed A3 Electron Corner Mask (or "none — unchanged copy of the source")

A4 → Microsoft Teams (/Applications/Microsoft Teams.app) (only when A4 is enabled)

Artifact: Artifacts/Mac-Health-Check_<slug>_<YYYY-MM-DD-HHMMSS>.zsh plus a sidecar .md (timestamp set when written)

All other settings keep Mac-Health-Check.zsh defaults; edit the artifact manually to change them.

Reply yes to write it, or change it: H7 adds, no A3 removes, only … replaces.