Privacy & Security

Everything under System Settings › Privacy & Security, as Nix options. Each one is named after the control you'd click, and set under programs.nix-plist-manager.options in nix-darwin and home-manager.

5 options 2 verified against System Settings

Advanced…

Log out automatically after inactivity

System Settings › Privacy & Security › Advanced… › Log out automatically after inactivity

nix-darwin · system-wide ✓ Verified on macOS 27 After logging out

Minutes of inactivity before logging out; 0 doesn't log out.

applications.systemSettings.privacyAndSecurity.advanced.logOutAutomaticallyAfterInactivity = 0;

A number from 0 to 960 "unset" puts back macOS's default.

Where it's stored and what runs

/Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay

For 0:

/usr/bin/defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 0 || echo 'nix-plist-manager: failed: /usr/bin/defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 0' >&2

For 960:

/usr/bin/defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 57600 || echo 'nix-plist-manager: failed: /usr/bin/defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 57600' >&2

For unset:

/usr/bin/defaults delete /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay 2>/dev/null || true

Require an administrator password to access system-wide settings

System Settings › Privacy & Security › Advanced… › Require an administrator password to access system-wide settings

nix-darwin · system-wide ✓ Verified on macOS 27

applications.systemSettings.privacyAndSecurity.advanced.requireAnAdministratorPasswordToAccessSystemWideSettings = true;

true or false

Where it's stored and what runs

For false:

rule=$(/usr/bin/mktemp); /usr/bin/security authorizationdb read system.preferences > "$rule" 2>/dev/null; /usr/bin/plutil -replace shared -bool true "$rule"; /usr/bin/security authorizationdb write system.preferences < "$rule" >/dev/null 2>&1; rm -f "$rule"

For true:

rule=$(/usr/bin/mktemp); /usr/bin/security authorizationdb read system.preferences > "$rule" 2>/dev/null; /usr/bin/plutil -replace shared -bool false "$rule"; /usr/bin/security authorizationdb write system.preferences < "$rule" >/dev/null 2>&1; rm -f "$rule"

Analytics & Improvements

System Settings › Privacy & Security › Analytics & Improvements › Share Mac Analytics

nix-darwin · system-wide Not verified

applications.systemSettings.privacyAndSecurity.analyticsAndImprovements.shareMacAnalytics = true;

true or false "unset" puts back macOS's default.

Where it's stored and what runs

/Library/Application Support/CrashReporter/DiagnosticMessagesHistory AutoSubmit

For false:

/usr/bin/defaults write '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' AutoSubmit -bool false || echo 'nix-plist-manager: failed: /usr/bin/defaults write '\''/Library/Application Support/CrashReporter/DiagnosticMessagesHistory'\'' AutoSubmit -bool false' >&2

For true:

/usr/bin/defaults write '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' AutoSubmit -bool true || echo 'nix-plist-manager: failed: /usr/bin/defaults write '\''/Library/Application Support/CrashReporter/DiagnosticMessagesHistory'\'' AutoSubmit -bool true' >&2

For unset:

/usr/bin/defaults delete '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' AutoSubmit 2>/dev/null || true

System Settings › Privacy & Security › Analytics & Improvements › Share with app developers

nix-darwin · system-wide Not verified

applications.systemSettings.privacyAndSecurity.analyticsAndImprovements.shareWithAppDevelopers = true;

true or false "unset" puts back macOS's default.

Where it's stored and what runs

/Library/Application Support/CrashReporter/DiagnosticMessagesHistory ThirdPartyDataSubmit

For false:

/usr/bin/defaults write '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' ThirdPartyDataSubmit -bool false || echo 'nix-plist-manager: failed: /usr/bin/defaults write '\''/Library/Application Support/CrashReporter/DiagnosticMessagesHistory'\'' ThirdPartyDataSubmit -bool false' >&2

For true:

/usr/bin/defaults write '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' ThirdPartyDataSubmit -bool true || echo 'nix-plist-manager: failed: /usr/bin/defaults write '\''/Library/Application Support/CrashReporter/DiagnosticMessagesHistory'\'' ThirdPartyDataSubmit -bool true' >&2

For unset:

/usr/bin/defaults delete '/Library/Application Support/CrashReporter/DiagnosticMessagesHistory' ThirdPartyDataSubmit 2>/dev/null || true

Apple Advertising

Personalized Ads

System Settings › Privacy & Security › Apple Advertising › Personalized Ads

home-manager · per user Not verified

applications.systemSettings.privacyAndSecurity.appleAdvertising.personalizedAds = true;

true or false "unset" puts back macOS's default.

Where it's stored and what runs

com.apple.AdLib allowApplePersonalizedAdvertising

For false:

/usr/bin/defaults write com.apple.AdLib allowApplePersonalizedAdvertising -bool false || echo 'nix-plist-manager: failed: /usr/bin/defaults write com.apple.AdLib allowApplePersonalizedAdvertising -bool false' >&2
/usr/bin/defaults -currentHost delete com.apple.AdLib allowApplePersonalizedAdvertising 2>/dev/null || true

For true:

/usr/bin/defaults write com.apple.AdLib allowApplePersonalizedAdvertising -bool true || echo 'nix-plist-manager: failed: /usr/bin/defaults write com.apple.AdLib allowApplePersonalizedAdvertising -bool true' >&2
/usr/bin/defaults -currentHost delete com.apple.AdLib allowApplePersonalizedAdvertising 2>/dev/null || true

For unset:

/usr/bin/defaults delete com.apple.AdLib allowApplePersonalizedAdvertising 2>/dev/null || true
/usr/bin/defaults -currentHost delete com.apple.AdLib allowApplePersonalizedAdvertising 2>/dev/null || true

Not covered

What this pane shows that can’t be declared, and why:

30 settings

File Vault › FileVault — turning FileVault on or off needs a user’s password and a recovery key
Lockdown Mode — needs a restart and the user’s confirmation
Allow assistive applications to control the computer — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access all user files — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to update or delete other apps — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to record your system audio — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to automate your Mac — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Bluetooth — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Calendar — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access the camera — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Contacts — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Developer Tools › Allow applications to use developer tools — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access user files — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access your Focus — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Home data — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to monitor keyboard input — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access your location — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Media Library — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access the microphone — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access your motion and fitness activity — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow web browsers to use passkeys — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Photos — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access Reminders — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access the contents of your screen and audio through Remote Desktop — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to record your screen — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to access speech recognition — kept in the TCC database, which SIP protects; only an MDM privacy preferences profile can grant it
Allow applications to detect nudity — Sensitive Content Warning is kept by Screen Time’s managed settings, not in a preference file
System services can access your location — kept by locationd in a root-only, SIP-protected store
Security › Allow accessories to connect — not kept in a preference file; changing it needs an administrator in System Settings
Security › Gatekeeper — not kept in a preference file; changing it needs an administrator in System Settings