(Really) Disabling Time Machine – a Multi-pronged Approach

Great Scott! Time Machine is a fantastic backup solution for people using Macs in a home environment but it can cause issues in enterprise settings. For example, around data loss prevention (DLP), as users can have local data on their Macs end up on a backup destination you don’t manage or control. With this in mind, lots of organisations prefer to use enterprise-grade backup solutions such as Code42, Backblaze or Druva etc.

If you have something like this in place, or your users use a cloud service like Google Drive or OneDrive, you might want to make sure Time Machine doesn’t rear its head again. Thankfully, we have some ways to keep it at bay. Thanks to Mike Dowler for a few extra pointers as I was discussing this with him in #london on the MacAdmins Slack!

Prong 1 – Don’t tell users to back up external drives

Setup Time Machine - NO LONGER IN USE - Please visit  http://support.hardsoft.co.uk

Ignorance is bliss – if you don’t know Time Machine is a thing, then you’ll likely never use it.

Setting the following preference via the command line will stop this behaviour:

% sudo defaults write /Library/Preferences/com.apple.TimeMachine DoNotOfferNewDisksForBackup -bool TRUE

The following MDM Configuration Profile can (and should) be used to enforce this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>DoNotOfferNewDisksForBackup</key>
<true/>
<key>PayloadDisplayName</key>
<string>Time Machine</string>
<key>PayloadIdentifier</key>
<string>com.apple.TimeMachine</string>
<key>PayloadType</key>
<string>com.apple.TimeMachine</string>
<key>PayloadUUID</key>
<string>9FF9D7A8-9611-4922-AE64-6232E363CC63</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Time Machine – Do Not Offer New Disks For Backup</string>
<key>PayloadIdentifier</key>
<string>soundmacguy.D43891EC-0847-4FCE-A973-C9765D57B6C3</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>32FAA95F-56D1-42CF-861F-DE65A3155A49</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

Prong 2 – Stop Time Machine’s automatic backups being enabled

Even if you suppress the prompts for backing up when new drives are connected, it’s still possible to enable Time Machine through System Preferences or by running tmutil enable in the Terminal. Let’s set another preference to stop that:

% sudo defaults write /Library/Preferences/com.apple.TimeMachine AutoBackup -bool FALSE

The following MDM configuration Profile can (and should) be used to enforce this (it will “grey-out” the Back Up Automatically tick-box in System Preferences). Thanks to Mike Dowler for pointing out this one!

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>AutoBackup</key>
<false/>
<key>PayloadDisplayName</key>
<string>Time Machine</string>
<key>PayloadIdentifier</key>
<string>com.apple.TimeMachine</string>
<key>PayloadType</key>
<string>com.apple.TimeMachine</string>
<key>PayloadUUID</key>
<string>89ED37B1-93A2-4789-8114-BD993C908D6F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Time Machine – Disable Automatic Backups</string>
<key>PayloadIdentifier</key>
<string>soundmacguy.44DD0531-4F86-4289-9489-650CA5AE871C</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>64E2F8AE-1D76-47B3-B079-DC25E5B4E985</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

Prong 3 – Hide the menu bar item

Users can initiate backups using the menu bar icon for Time Machine, if they’ve configured backup destinations in the past. This MDM Configuration Profile will hide it:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadContent</key>
<dict>
<key>com.apple.mcxMenuExtras</key>
<dict>
<key>Forced</key>
<array>
<dict>
<key>mcx_preference_settings</key>
<dict>
<key>TimeMachine.menu</key>
<false/>
<key>delaySeconds</key>
<integer>1</integer>
</dict>
</dict>
</array>
</dict>
</dict>
<key>PayloadDisplayName</key>
<string>Custom: (com.apple.mcxMenuExtras)</string>
<key>PayloadEnabled</key>
<true/>
<key>PayloadIdentifier</key>
<string>soundmacguy.6BBFCCE7-9915-464F-992C-1B1AA4F3CDAF</string>
<key>PayloadType</key>
<string>com.apple.ManagedClient.preferences</string>
<key>PayloadUUID</key>
<string>B677F6D7-5EEF-45E8-9B11-A664994CB13F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Time Machine – Disable Menu Item</string>
<key>PayloadIdentifier</key>
<string>soundmacguy.916EB000-B479-40D1-9BAE-CF8DF9C5A746</string>
<key>PayloadOrganization</key>
<string>The Beacon School</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>7B802BB9-C819-4CA2-B732-D192EF72A821</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

Prong 4 – Remove existing backup destinations

Folks may have set up Time Machine before you managed to block it, so they’ll have backup destinations configured for it. We really should remove those. Luckily, the tmutil command has got your back and here’s a script that will remove any and all backup destinations a user might have set.

You can run this with a Jamf policy, Launch Daemon or with a tool like Outset. Thanks to Mike Dowler for the tip on stopping a backup if it’s running when you execute the script.

#!/bin/sh
# Disables Time Machine and removes all destination set for this Mac
/bin/echo "Stopping Time Machine backup if running…"
/usr/bin/tmutil stopbackup
/bin/echo
/bin/echo "Time Machine Destination(s) Found:"
/usr/bin/tmutil destinationinfo
/bin/echo
/bin/echo "Begin removing destinations…"
destinationids=($(/usr/bin/tmutil destinationinfo | awk -F': ' '/^ID/ {print $2}'))
for id in "${destinationids[@]}"
do
/bin/echo "Removing destination ID: ${id}"
/usr/bin/tmutil removedestination "${id}"
done
/bin/echo
/bin/echo "Disabling Time Machine…"
/usr/bin/tmutil disable
/bin/echo "Done."

Prong 5 – Disable the Time Machine System Preferences pane

This is the final nail in the coffin, to stop users adding a new backup destination and running an ad-hoc backup via System Preferences. Most MDM platforms allow you to block specific System Preference panes in the Restrictions payload, including Time Machine.

The following profile will block just the Time Machine System Preferences Pane:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>DisabledPreferencePanes</key>
<array>
<string>com.apple.prefs.backup</string>
</array>
<key>PayloadDisplayName</key>
<string>System Preferences</string>
<key>PayloadIdentifier</key>
<string>com.apple.systempreferences</string>
<key>PayloadType</key>
<string>com.apple.systempreferences</string>
<key>PayloadUUID</key>
<string>5BF26612-E069-4D5C-8FA2-5D2635AFCD86</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Time Machine – Block System Preference Pane</string>
<key>PayloadIdentifier</key>
<string>soundmacguy.ACFD2C76-86A7-4E44-BE4B-078F03EC57B9</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>599F64BA-D206-4D8B-891C-C7D3CBBEBA57</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

If you’ve got any more tips on taming Time Machine, please let me know in the comments.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.