Scripting & Automation

Explains what PowerShell execution policies are, the available levels (Restricted, RemoteSigned, AllSigned, Bypass and others) and the scopes they apply to. It also stresses the policy is a safety net rather than a security boundary, and shows how to check and change it per user, machine or session. Loosening it (for example Unrestricted or Bypass) reduces protection, so prefer the narrowest scope.

A user got Access denied running Invoke-Command against localhost even though WinRM was started. The answer explains Invoke-Command needs PowerShell remoting enabled even for the local machine, and suggests setting WinRM to Automatic, starting it and enabling remoting. The answer writes the cmdlet as EnablePSRemoting; the real name is Enable-PSRemoting. Enabling remoting opens a WinRM listener, so only do it where you need it.

Question-and-answer guide to running PowerShell commands on other computers: how remoting works over WS-Management, Invoke-Command versus a persistent PSSession, throttling, serialized output and profiles not loading in remote sessions. It also covers workgroup and cross-domain caveats such as TrustedHosts, and remoting over SSH.

An accepted answer to how to run a locally-working command on other computers. It says to enable PowerShell remoting on the target first (on by default on servers, not on clients, and a security consideration), allow it through the firewall if not on a domain, then create a session with New-PSSession and run the script block with Invoke-Command.

Reference for the cmdlet that configures a Windows machine to receive remote PowerShell commands: it starts WinRM, creates listeners and firewall exceptions, and enables session configurations. It notes that public-network profiles are blocked on client Windows unless -SkipNetworkProfileCheck is used, and that PowerShell 7 and Windows PowerShell endpoints are configured separately. Remoting opens a listener, so only enable it where needed.

Reference for the FOR loop in CMD batch files, which repeats a command for each item in a list, file, folder set, number range or command output. It notes loop variables need a single letter, that variables only expand at loop start unless delayed expansion is used, and gives a short example creating 26 folders.

Explains how batch files check whether a command succeeded using %ERRORLEVEL% and IF ERRORLEVEL, including the gotcha that IF ERRORLEVEL n means n or greater. It covers why %ERRORLEVEL% does not update inside bracketed blocks, differences between .BAT and .CMD, and EXIT /B for returning codes.

The full command reference for robocopy, with every copy, retry, logging and job option plus a table of exit codes. Useful for backup scripts: it shows /MIR, /MT, /R and /W, /LOG, and how exit code 8 and above signals a real failure while lower values only describe what was copied. /MIR and /PURGE delete destination files missing from the source, so test with /L first.

Reference for the defaults command, which reads, writes and deletes macOS app preferences stored as property lists. It explains domains, why defaults is safer than hand-editing plists because of preference caching, and that Dock or Finder changes usually need killall to take effect.

Command reference for pmset, used to view and change sleep, display and wake settings per power source and to schedule wake or shutdown events. Changes need root privileges. Examples show reading settings with pmset -g and cancelling a schedule with sudo pmset repeat cancel.

Reference for the tmutil command-line tool for Time Machine. It documents verbs such as restore (copies an item out of a snapshot, cp-style, may need root), listbackups and latestbackup (need root and Full Disk Access), plus addexclusion, startbackup and compare.

Short Apple guide on combining AppleScript with Terminal: opening Terminal's scripting dictionary in Script Editor and running an AppleScript file from the command line with osascript.

Shows how to add the Run Shell Script and Run AppleScript actions to an Automator workflow. For shell scripts you pick the shell and type the commands; for AppleScript you can edit and test in the action or write it in Script Editor.

Apple's DTS engineer explains that do shell script throws an AppleScript error whenever the command exits non-zero (so test -d on a missing folder errors), shows try blocks to handle it, multi-line scripts, and quoted form of POSIX path for safe paths. He also suggests avoiding the shell where System Events can do the job.

Apple's guide to running shell commands from AppleScript with do shell script, including building a command by concatenation and why paths with spaces break unless wrapped with quoted form of. This is an archived page, so details may predate current macOS.

Reference for osascript with its -e, -i, -l and -s options and a large set of one-liners: activating or quitting apps, emptying the Trash, setting volume, toggling dark mode, and shutting down or restarting without confirmation.

Documents the shortcuts command-line tool for listing, running, viewing and signing Shortcuts from Terminal or scripts. It covers passing input and output files, choosing the output type, and that shortcuts which prompt will pause a command-line run. The tool exits 0 on success and 1 on error.

Introductory page on writing Bash scripts: scripts need Unix newlines, a first-line shebang and execute permission (chmod +x), followed by how bash parses commands, variables, loops, arithmetic and functions.

Community-maintained list of habits for writing reliable Bash scripts: choose the right shebang, quote variables, prefer [[ ]] over [, use $(...) and arrays, avoid parsing ls, and debug with set -x. It points readers on to the BashFAQ and BashPitfalls pages.

Older but useful explanation of launchd replacing cron on the Mac, the five folders where launch plists live, and the difference that agents can interact with the user session while daemons cannot. Suggests checking for legacy crontabs and mentions the Lingon X editor.

Security-focused look at the LaunchAgents and LaunchDaemons folders: where they are, which are SIP-protected under /System/Library and which are not, and why malware uses them to persist. Useful for knowing which launch folders to audit.

VikingOSX shows a working LaunchAgent for a shell script: plist in ~/Library/LaunchAgents with 644 permissions, Label, RunAtLoad, StartInterval and full paths only. The original poster got theirs working after moving the script out of ~/Documents, and etresoft points to privacy permissions instead, noting shell scripts silently fail without Full Disk Access.

A script that worked by hand failed under Task Scheduler. The accepted answer says not to tick Do not store password when using Run whether user is logged on or not, since the task then cannot reach network resources, and to isolate the problem with a trivial test script and -noexit. Rich Matheisen recommends Start-Transcript for diagnosis and says two-factor authentication won't work in a scheduled task; the poster suspected a smart-card PIN prompt. No confirmed final fix is recorded.

Compares Login Items with LaunchAgents and LaunchDaemons: global ones in /Library load before any user logs in, per-user ones after login, and daemons have no window server access. The author favours launchd for background services and Login Items for apps with a UI.

Explains that launchd, driven by launchctl and property list files in the LaunchAgents and LaunchDaemons folders, is the macOS way to run things automatically, with cron deprecated. Key plist keys: ProgramArguments, RunAtLoad and StartInterval (seconds).

The first video in Shane Young's PowerShell for Beginners series.

Shane Young shows how to automate PowerShell scripts with Windows Task Scheduler.

Mac Geek Gab covers creating launch agents on a Mac.

Part 15 of Learn Linux TV's bash scripting series, on cron jobs.

Corey Schafer explains how to schedule commands with cron jobs and crontab on Linux and Mac.

Shane Young demonstrates creating a scheduled task with PowerShell.