Auditing when, how, and by whom file permissions change?

Question

Auditing when, how, and by whom file permissions change?

I am having a lot of trouble with my Mac in that it freezes and shuts down unexpectedly, loses permissions in/on the ~/Library/ folder, and sporadically (it comes and goes) will not open applications like Safari, Preview, and Messages (among others). I have reinstalled the OS many times, yet these issues persist even when I do not migrate any data or reinstall any applications.

One symptom that keeps coming back, no matter how many times I try to repair disk permissions or reset ACLs, is that folders in my drive will gain the red circle with the white bar indicating that I no longer have rights to them. I would like to know if there is a way to log changes to file/folder permissions on the entire drive.

I am including the troubleshooting steps I have already taken (in no particular order, and some more than once), and would like to note that since Apple has already approved a replacement MBP, I have a limited amount of time to continue my search for a root cause.

Verify/Repair Disk Permissions
Verify/Repair Disk
Reset ACLs
Send log files to Apple Engineers
Send ACCD info to Apple Engineers
Reinstall OS X from Recovery Partition
Reinstall OS X from Internet Recovery
*** Many reinstallations with/without bringing back my data, though always through a file copy and never with Time Machine migration
/sbin/fsck -fy
/sbin/fsck_hfs -l /dev/disk1
sysdiagnose (still pouring over data)

Thanks, in advance, to anyone that can help!

MacBook Pro with Retina display, OS X Yosemite (10.10.5), Early 2013

Posted on Sep 1, 2015 3:02 PM

Reply

Answer 1

baltwo

Level 9

62,386 points

Sep 1, 2015 3:56 PM in response to mybrotheriseric

You need to repair/reset the user's permissions and ACLs, using the resetpassword utility.

Turn on the Mac while holding down cmd + R. You can let go once you see a spinning gear icon. That should bring up the ”Mac OS X Utilities” screen.
On the top menu, click Utilities, then select Terminal.
Type resetpassword and press Enter.
Click on your main hard drive.
In the dropdown box under “Select the user account” make sure to select your username.
Underneath where it says “Reset Home Directory Permissions and ACLs”, click the Reset button.
Press cmd + Q to quit the Reset Password application.
Press cmd + Q again to quit the Terminal.
Press cmd + Q one more time and click Restart.
Click Mac OS X Utilities in the top left of the screen and click the Restart button.

27" i7 iMac (Mid 2011) refurb, OS X Yo (10.10.5), Mavs, ML & SL, G4 450 MP w/10.5 & 9.2.2

Reply

Answer 2

Sep 1, 2015 3:57 PM in response to baltwo

Thank you, but I have already done that (see third bullet point). Do you know how to audit permission changes?

Reply

Answer 3

BobHarris

Level 9

57,041 points

Sep 1, 2015 4:16 PM in response to mybrotheriseric

I have 2 hardware related ideas

a) your RAM is failing and when data is written to disk, it is corrupted in RAM and then corrupting the file system.

b) your storage device is failing.

c) it could be a motherboard component failure.

If you have installed 3rd party RAM, that is a very likely candidate.

If you have replaced your original storage with a 3rd party storage device, that is a good candidate.

Storage devices sometimes fail. 2 years old is a little young, but I've had disks fail in less time, and I have had more than 1 laptop disk fail in about 3 years time. So it is not impossible that your storage device is failing.

If you have an external disk you can clone your disk to and boot from, you can see if the situation continues (yes, it will run slower from an external booted disk, but it is an experiment). If it is still failing, you will have eliminated the storage as the culprit.

If 3rd party RAM, put back the original.

You might also consider scheduling an Apple Genius bar appointment, and taking the Mac in for a "Free" evaluation. If they suggest repairs, they will give you a price before doing anything.

Reply

Answer 4

Sep 1, 2015 4:22 PM in response to BobHarris

Great points! I don't have any third party RAM (or anything, for that matter), and I never thought about booting from an external disk. If i can find a large enough disk around the house I will definitely try that.

I forgot to mention that I have taken it to the Apple Genius Bar and have performed the Apple Hardware Test on my own (twice). Neither the SSD nor the RAM indicated any fault. I also forgot to mention that my computer was sent out for depot repair where the battery, logic board, trackpad, and keyboard were all replaced. I'm looking for a way to edit my original post to include those troubleshooting steps.

Reply

Answer 5

Linc Davis

Level 10

209,739 points

Sep 1, 2015 4:30 PM in response to mybrotheriseric

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Another indication that the test is safe can be found in this thread, and this one, for example, where the comment in which I suggested it was recommended by one of the Apple Community Specialists, as explained here.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy a particular line of text to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") The title of the page is "Diagnostic Test." Below the title is a text box headed by three small icons. The one on the right represents a clipboard. Click that icon to select the text, then copy it to the Clipboard on your computer by pressing the key combination command-C.

If the text doesn't highlight when you click the icon, select it by triple-clicking anywhere inside the box. Don't select the whole page, just the text in the box.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

[Process started]

Part 1 of 8 done at … sec
…
Part 8 of 8 done at … sec

The test results are on the Clipboard.

Please close this window.

[Process completed]

The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work (including the referenced "Diagnostic Test"), I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 6

BobHarris

Level 9

57,041 points

Sep 1, 2015 4:47 PM in response to mybrotheriseric

I'm looking for a way to edit my original post to include those troubleshooting steps.

You get 15 minutes to edit a post, and then it is locked. If you wish to post additional information, just add a new reply.

But first. Read and follow the instructions Linc Davis has posted.

Reply

Answer 7

baltwo

Level 9

62,386 points

Sep 1, 2015 4:54 PM in response to mybrotheriseric

mybrotheriseric wrote:

Thank you, but I have already done that (see third bullet point). Do you know how to audit permission changes?

Sorry, but I missed that, expecting to see resetting user permissions. My error.

Reply

Answer 8

Sep 1, 2015 5:14 PM in response to Linc Davis

1 Start time: 20:05:03 09/01/15

2

3 Revision: 1342

4

5 Model Identifier: MacBookPro10,2

6 System Version: OS X 10.10.5 (14F27)

7 Kernel Version: Darwin 14.5.0

8 Time since boot: 3:20

9

10 UID: 502

11

12 Activity

13

14 CPU: user 17%, system 3%

15 en0: in 11, out 44 (KiB/s)

16

17 CPU usage (%)

18

19 com.apple.WebKit (UID 502): 54.7

20 com.apple.WebKit (UID 502): 36.1

21 com.apple.WebKit (UID 502): 32.6

22 WindowServer (UID 0): 21.4

23

24 File opens (per sec)

25

26 SystemUIServer (UID 502) => /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist (status 0): 6

27

28 Energy (lifetime)

29

30 com.apple.WebKit.WebContent (UID 502): 54.34

31 com.apple.WebKit.Plugin.64 (UID 502): 7.65

32 WindowServer (UID 88): 6.64

33

34 Energy (sampled)

35

36 com.apple.WebKit.Plugin.64 (UID 502): 17.19

37 com.apple.WebKit.WebContent (UID 502): 8.62

38 WindowServer (UID 88): 6.83

39 com.apple.WebKit.Networking (UID 502): 6.32

40

41 Diagnostic reports

42

43 2015-08-31 CalendarAgent crash x21

44 2015-08-31 Install Adobe Flash Player hang x2

45 2015-08-31 LaterAgent crash x21

46 2015-08-31 Setup Assistant crash

47 2015-08-31 login crash x2

48 2015-09-01 Finder crash

49

50 HID errors: 22

51

52 Kernel log

53

54 Sep 1 16:41:33 IO80211AWDLPeerManager::getVHtCapabilityIE Unable to get vht capabilities ret 2d

55 Sep 1 16:43:21 considerRebuildOfPrelinkedKernel com.apple.kext.triggers triggered rebuild

56 Sep 1 16:45:18 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

57 Sep 1 16:45:19 Previous shutdown cause: 3

58 Sep 1 16:45:20 IO80211AWDLPeerManager::getVHtCapabilityIE Unable to get vht capabilities ret 2d

59 Sep 1 16:45:46 pci pause: SDXC

60 Sep 1 16:48:57 considerRebuildOfPrelinkedKernel com.apple.kext.OSvKernDSPLib triggered rebuild

61 Sep 1 17:21:32 Limiting closed port RST response from 258 to 250 packets per second

62 Sep 1 17:36:33 Limiting closed port RST response from 280 to 250 packets per second

63 Sep 1 17:41:10 Limiting closed port RST response from 326 to 250 packets per second

64 Sep 1 18:36:59 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

65 Sep 1 18:37:43 pci pause: SDXC

66 Sep 1 18:54:27 Limiting closed port RST response from 463 to 250 packets per second

67 Sep 1 18:58:36 Limiting closed port RST response from 484 to 250 packets per second

68 Sep 1 19:11:18 Limiting closed port RST response from 288 to 250 packets per second

69 Sep 1 19:23:32 Limiting closed port RST response from 489 to 250 packets per second

70 Sep 1 19:29:16 Limiting closed port RST response from 300 to 250 packets per second

71 Sep 1 19:29:47 Limiting closed port RST response from 296 to 250 packets per second

72 Sep 1 19:30:26 Limiting closed port RST response from 394 to 250 packets per second

73 Sep 1 19:30:55 Limiting closed port RST response from 324 to 250 packets per second

74 Sep 1 19:31:08 Limiting closed port RST response from 510 to 250 packets per second

75 Sep 1 19:34:55 Limiting closed port RST response from 487 to 250 packets per second

76 Sep 1 19:35:56 Limiting closed port RST response from 251 to 250 packets per second

77 Sep 1 19:36:58 Limiting closed port RST response from 459 to 250 packets per second

78 Sep 1 19:40:56 Limiting closed port RST response from 290 to 250 packets per second

79

80 System log

81

82 Sep 1 16:47:24 SubmitDiagInfo: Couldn't load config file from on-disk location. Falling back to default location. Reason: Won't serialize in _readDictionaryFromJSONData due to nil object

83 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

84 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

85 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

86 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

87 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

88 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

89 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

90 Sep 1 16:47:34 WindowServer: WSGetSurfaceInWindow : Invalid surface 771049478 for window 46

91 Sep 1 16:49:33 com.apple.CloudPhotosConfiguration: Request UUID: New and old state identical for service com.apple.photo.icloud.cloudphoto: 0, ignoring request

92 Sep 1 16:52:24 loginwindow: ERROR | -[LWBuiltInScreenLockAuthLion closeAuthAndReset:] | Attempted to remove an observer when not observing

93 Sep 1 16:58:08 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

94 Sep 1 17:09:22 airportd: WARNING: sysdiagnose (473) is not entitled for com.apple.wifi.temporary_log, temporarily allowing request with background priority —— all entitlement requirements will be strictly enforced in a future release

95 Sep 1 18:22:39 airportd: _handleLinkEvent: WiFi is not powered. Resetting state variables.

96 Sep 1 18:40:33 Console: Metadata.framework [Error]: void _MDItemMarkAsUsedForPath(CFStringRef): was called with a NULL path

97 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

98 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

99 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

100 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

101 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

102 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

103 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

104 Sep 1 18:41:32 WindowServer: WSGetSurfaceInWindow : Invalid surface 546275351 for window 39

105 Sep 1 19:02:25 spindump: Error loading dyld shared cache uuid UUID: 0x8

106 Sep 1 20:05:32 airportd: _handleLinkEvent: Got an error trying to query WiFi for power. Resetting state variables.

107

108 launchd log

109

110 Sep 1 16:41:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.203: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

111 Sep 1 16:41:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.203: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

112 Sep 1 16:41:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.203: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ com.apple.geod.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

113 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

114 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

115 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

116 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

117 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

118 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

119 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

120 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

121 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

122 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

123 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc, error = 1: Operation not permitted

124 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc, error = 1: Operation not permitted

125 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc, error = 1: Operation not permitted

126 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc, error = 1: Operation not permitted

127 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc, error = 1: Operation not permitted

128 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc, error = 1: Operation not permitted

129 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc, error = 1: Operation not permitted

130 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

131 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

132 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

133 Sep 1 16:45:22 com.apple.xpc.launchd.domain.pid.SecurityAgent.190: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ com.apple.geod.xpc error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

134 Sep 1 16:45:51 com.apple.xpc.launchd.user.502.100005.Aqua: Could not read path: path = /Users/USER/Library/LaunchAgents, error = 2: No such file or directory

135

136 Console log

137

138 Aug 31 17:33:15 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-173315_help mes-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

139 Aug 31 17:33:15 ReportCrash: Failed to save crash report for CalendarAgent[570] (version 8.0 (316.1)) to file:///Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-1733 15_helpmes-MacBook-Pro.crash.

140 Aug 31 17:33:15 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173315_helpmes-Ma cBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

141 Aug 31 17:33:15 ReportCrash: Failed to save crash report for soagent[572] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173315_hel pmes-MacBook-Pro.crash.

142 Aug 31 17:33:15 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173315_helpmes -MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

143 Aug 31 17:33:15 ReportCrash: Failed to save crash report for LaterAgent[573] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173315_ helpmes-MacBook-Pro.crash.

144 Aug 31 17:33:19 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-173319_helpm es-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

145 Aug 31 17:33:19 ReportCrash: Failed to save crash report for cloudphotosd[575] (version 1.0.1 (215.65.0)) to file:///Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-17331 9_helpmes-MacBook-Pro.crash.

146 Aug 31 17:33:25 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-173325_help mes-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

147 Aug 31 17:33:25 ReportCrash: Failed to save crash report for CalendarAgent[579] (version 8.0 (316.1)) to file:///Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-1733 25_helpmes-MacBook-Pro.crash.

148 Aug 31 17:33:26 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173326_helpmes-Ma cBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

149 Aug 31 17:33:26 ReportCrash: Failed to save crash report for soagent[580] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173326_hel pmes-MacBook-Pro.crash.

150 Aug 31 17:33:26 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173326_helpmes -MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

151 Aug 31 17:33:26 ReportCrash: Failed to save crash report for LaterAgent[581] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173326_ helpmes-MacBook-Pro.crash.

152 Aug 31 17:33:32 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-173332_helpm es-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

153 Aug 31 17:33:32 ReportCrash: Failed to save crash report for cloudphotosd[583] (version 1.0.1 (215.65.0)) to file:///Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-17333 2_helpmes-MacBook-Pro.crash.

154 Aug 31 17:33:36 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-173336_help mes-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

155 Aug 31 17:33:36 ReportCrash: Failed to save crash report for CalendarAgent[590] (version 8.0 (316.1)) to file:///Users/USER/Library/Logs/DiagnosticReports/CalendarAgent_2015-08-31-1733 36_helpmes-MacBook-Pro.crash.

156 Aug 31 17:33:36 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173336_helpmes-Ma cBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

157 Aug 31 17:33:36 ReportCrash: Failed to save crash report for soagent[591] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/soagent_2015-08-31-173336_hel pmes-MacBook-Pro.crash.

158 Aug 31 17:33:36 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173336_helpmes -MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

159 Aug 31 17:33:36 ReportCrash: Failed to save crash report for LaterAgent[592] (version ???) to file:///Users/USER/Library/Logs/DiagnosticReports/LaterAgent_2015-08-31-173336_ helpmes-MacBook-Pro.crash.

160 Aug 31 17:33:39 ReportCrash: File creation failed /Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-173339_helpm es-MacBook-Pro.crash - uid: 502 gid: 20, euid: 502 egid: 20 - error 13: Permission denied

161 Aug 31 17:33:39 ReportCrash: Failed to save crash report for cloudphotosd[597] (version 1.0.1 (215.65.0)) to file:///Users/USER/Library/Logs/DiagnosticReports/cloudphotosd_2015-08-31-17333 9_helpmes-MacBook-Pro.crash.

162 Sep 1 16:45:52 fontd: Failed to open read-only database, regenerating DB

163

164 System services loaded

165

166 com.adobe.fpsaud

167 com.apple.spindump

168 - status: 75

169 com.apple.watchdogd

170

171 Login services loaded

172

173 com.apple.Finder

174 - status: -11

175

176 User login items

177

178 iTunesHelper

179 - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

180

181 iCloud errors

182

183 cloudd 17

184 CallHistorySyncHelper 10

185 cloudphotosd 9

186 Finder 9

187 comapple.CloudPhotosConfiguration 3

188 comapple.InputMethodKit.UserDictionary 1

189

190 Continuity errors

191

192 sharingd 11

193 lsuseractivityd 9

194

195 Restricted files: 157831

196

197 Applications

198

199 /Users/USER/Desktop/LockMyMac.app

200 - com.apple.ScriptEditor.id.LockMyMac

201 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Diagnostics Troubleshooting Wizard — Windows 10 x64.app:— Windows 10 x64:

202 - N/A

203 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Event Viewer Snapin Launcher — Windows 10 x64.app:— Windows 10 x64:

204 - N/A

205 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Extensible Wizards Host Process — Windows 10 x64.app:— Windows 10 x64:

206 - N/A

207 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/IME search module — Windows 10 x64.app:— Windows 10 x64:

208 - N/A

209 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Internet Explorer — Windows 10 x64.app:— Windows 10 x64:

210 - N/A

211 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/LicenseManagerShellExt — Windows 10 x64.app:— Windows 10 x64:

212 - N/A

213 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft (R) HTML Application host — Windows 10 x64.app:— Windows 10 x64:

214 - N/A

215 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft IME Open Extended Dictionary Module — Windows 10 x64.app:— Windows 10 x64:

216 - N/A

217 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft Management Console — Windows 10 x64.app:— Windows 10 x64:

218 - N/A

219 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft ® Windows Based Script Host — Windows 10 x64.app:® Windows Based Script Host — Windows 10 x64:

220 - N/A

221 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft® HTML Help Executable — Windows 10 x64.app:® HTML Help Executable — Windows 10 x64:

222 - N/A

223 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Microsoft® Windows Backup — Windows 10 x64.app:® Windows Backup — Windows 10 x64:

224 - N/A

225 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Notepad — Windows 10 x64.app:— Windows 10 x64:

226 - N/A

227 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Paint — Windows 10 x64.app:— Windows 10 x64:

228 - N/A

229 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/PrintBrm Application — Windows 10 x64.app:— Windows 10 x64:

230 - N/A

231 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Provisioning package runtime processing tool — Windows 10 x64.app:— Windows 10 x64:

232 - N/A

233 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Registry Editor — Windows 10 x64.app:— Windows 10 x64:

234 - N/A

235 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Remote Access Phonebook — Windows 10 x64.app:— Windows 10 x64:

236 - N/A

237 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Remote Desktop Connection — Windows 10 x64.app:— Windows 10 x64:

238 - N/A

239 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Support exe for Internet Printing — Windows 10 x64.app:— Windows 10 x64:

240 - N/A

241 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/System Information — Windows 10 x64.app:— Windows 10 x64:

242 - N/A

243 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Contacts — Windows 10 x64.app:— Windows 10 x64:

244 - N/A

245 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Control Panel — Windows 10 x64.app:— Windows 10 x64:

246 - N/A

247 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Explorer — Windows 10 x64.app:— Windows 10 x64:

248 - N/A

249 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Journal — Windows 10 x64.app:— Windows 10 x64:

250 - N/A

251 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Media Player — Windows 10 x64.app:— Windows 10 x64:

252 - N/A

253 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows PowerShell — Windows 10 x64.app:— Windows 10 x64:

254 - N/A

255 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Presentation Foundation Host — Windows 10 x64.app:— Windows 10 x64:

256 - N/A

257 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Remote Assistance — Windows 10 x64.app:— Windows 10 x64:

258 - N/A

259 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Update Standalone Installer — Windows 10 x64.app:— Windows 10 x64:

260 - N/A

261 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Winhlp32 Stub — Windows 10 x64.app:— Windows 10 x64:

262 - N/A

263 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows Wordpad Application — Windows 10 x64.app:— Windows 10 x64:

264 - N/A

265 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows host process (Rundll32) 2 — Windows 10 x64.app:— Windows 10 x64:

266 - N/A

267 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows host process (Rundll32) — Windows 10 x64.app:— Windows 10 x64:

268 - N/A

269 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/Windows® installer — Windows 10 x64.app:® installer — Windows 10 x64:

270 - N/A

271 /Users/USER/Documents/Virtual Machines.localized/Windows 10 x64.vmwarevm/Applications/XPS Viewer — Windows 10 x64.app:— Windows 10 x64:

272 - N/A

273 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Address Book — WindowsXPProSP1a.app:— WindowsXPProSP1a:

274 - N/A

275 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/AppFix & AppHelp Installer — WindowsXPProSP1a.app:— WindowsXPProSP1a:

276 - N/A

277 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/HyperTerminal Applet — WindowsXPProSP1a.app:— WindowsXPProSP1a:

278 - N/A

279 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Internet Explorer — WindowsXPProSP1a.app:— WindowsXPProSP1a:

280 - N/A

281 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Media Player — WindowsXPProSP1a.app:— WindowsXPProSP1a:

282 - N/A

283 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft (R) HTML Application host — WindowsXPProSP1a.app:— WindowsXPProSP1a:

284 - N/A

285 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft (r) Windows Based Script Host — WindowsXPProSP1a.app:— WindowsXPProSP1a:

286 - N/A

287 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft Accessibility Wizard — WindowsXPProSP1a.app:— WindowsXPProSP1a:

288 - N/A

289 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft Help and Support Center — WindowsXPProSP1a.app:— WindowsXPProSP1a:

290 - N/A

291 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft Management Console — WindowsXPProSP1a.app:— WindowsXPProSP1a:

292 - N/A

293 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Microsoft® HTML Help Executable — WindowsXPProSP1a.app:® HTML Help Executable — WindowsXPProSP1a:

294 - N/A

295 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/NetMeeting Whiteboard application — WindowsXPProSP1a.app:— WindowsXPProSP1a:

296 - N/A

297 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Notepad 2 — WindowsXPProSP1a.app:— WindowsXPProSP1a:

298 - N/A

299 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Notepad — WindowsXPProSP1a.app:— WindowsXPProSP1a:

300 - N/A

301 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Outlook Express — WindowsXPProSP1a.app:— WindowsXPProSP1a:

302 - N/A

303 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Paint — WindowsXPProSP1a.app:— WindowsXPProSP1a:

304 - N/A

305 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Performance Monitor Command Line Shell — WindowsXPProSP1a.app:— WindowsXPProSP1a:

306 - N/A

307 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Registry Editor — WindowsXPProSP1a.app:— WindowsXPProSP1a:

308 - N/A

309 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Remote Access Phonebook — WindowsXPProSP1a.app:— WindowsXPProSP1a:

310 - N/A

311 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Remote Desktop Connection — WindowsXPProSP1a.app:— WindowsXPProSP1a:

312 - N/A

313 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Run a DLL as an App — WindowsXPProSP1a.app:— WindowsXPProSP1a:

314 - N/A

315 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Support exe for Internet Printing — WindowsXPProSP1a.app:— WindowsXPProSP1a:

316 - N/A

317 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Backup Utility — WindowsXPProSP1a.app:— WindowsXPProSP1a:

318 - N/A

319 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Explorer — WindowsXPProSP1a.app:— WindowsXPProSP1a:

320 - N/A

321 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Font Viewer — WindowsXPProSP1a.app:— WindowsXPProSP1a:

322 - N/A

323 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Media Player — WindowsXPProSP1a.app:— WindowsXPProSP1a:

324 - N/A

325 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows NT ClipBook Viewer — WindowsXPProSP1a.app:— WindowsXPProSP1a:

326 - N/A

327 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Progman Group Converter — WindowsXPProSP1a.app:— WindowsXPProSP1a:

328 - N/A

329 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows Winhlp32 Stub — WindowsXPProSP1a.app:— WindowsXPProSP1a:

330 - N/A

331 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/Windows® installer — WindowsXPProSP1a.app:® installer — WindowsXPProSP1a:

332 - N/A

333 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/WordPad MFC Application — WindowsXPProSP1a.app:— WindowsXPProSP1a:

334 - N/A

335 /Users/USER/Documents/Virtual Machines.localized/WindowsXPProSP1a.vmwarevm/Applications/mplayer2 — WindowsXPProSP1a.app:— WindowsXPProSP1a:

336 - N/A

337 /Users/USER/Downloads/AprenticeAlf/tools_v6.0.8/DeDRM_Macintosh_Application/DeD RM.app

338 - com.apple.ScriptEditor.id.UUID

339 /Users/USER/Downloads/TorBrowser/TorBrowserBundle_en-US.app

340 - org.torproject.TorBrowserBundle

341

342 PrefPane

343

344 /Library/PreferencePanes/Flash Player.prefPane

345 - com.adobe.flashplayerpreferences

346

347 Bundles

348

349 /Library/Internet Plug-Ins/Flash Player.plugin

350 - com.macromedia.Flash Player.plugin

351

352 Installations

353

354 Adobe Flash Player: 9/1/15, 5:14 PM

355

356 Elapsed time (sec): 312

Reply

Answer 9

Sep 1, 2015 5:27 PM in response to Linc Davis

I should point out that the output of the script you suggested includes a number of errors pointing to VMWare. This application was identified by Apple as being the culprit early on, however, issues persisted after reimaging without reinstalling that application. It's very interesting that they appear, because I never reinstalled the application, and manually copied my Desktop, Documents, Downloads, Music, Movies, and Pictures folders from my home directory backup; I specifically excluded my ~/Libraries/ folder, which is where I would imagine those entries originated. I'm not sure what to make of this.

EDIT: Nevermind; I just re-read the output and noticed the lines are from my Documents folder.

Reply

Answer 10

Linc Davis

Level 10

209,739 points

Sep 1, 2015 5:54 PM in response to mybrotheriseric

A

Some of your user files (not system files) have incorrect permissions or are locked. I don't know why. This procedure will unlock those files and reset their ownership, permissions, and access controls to the default. If you've intentionally set special values for those attributes, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it, but you do need to follow the instructions below.

This is not the same as the permission-reset step that you've already taken, and it may be more effective.

Back up all data before proceeding.

Enter the following command in the Terminal window in the same way as before (triple-click, copy, and paste):

sudo find ~ $TMPDIR.. -exec chflags -h nouchg,nouappnd,noschg,nosappnd {} + -exec chown -h $UID {} + -exec chmod +rw {} + -exec chmod -h -N {} + -type d -exec chmod -h +x {} + 2>&-

You'll be prompted for your login password, which won't be displayed when you type it. Type carefully and then press return. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.

The command may take several minutes to run, depending on how many files you have. Wait for a new line ending in a dollar sign ($) to appear, then quit Terminal.

B

"VMWare" is not installed, but some of its support files are still in the Documents folder and may be wasting a significant amount of storage space.

Reply

Answer 11

Sep 2, 2015 2:48 PM in response to mybrotheriseric

While I certainly do appreciate all the replies received so far, none have attempted to answer my original question: How do I log changes to file/folder permissions for my entire drive?

Further research has led me to the auditd tool, which looks promising. I think if I can see when permissions change, which process initiates the change, and under which user account that process is running, I will be closer to determining exactly where my issue lies. Can anyone confirm whether or not this is a good path to follow? If so, can anyone also direct me to some good resources to assist in learning how to configure this utility? I'm a pretty technical guy, and I do work in the IT field (though my experience with this level of troubleshooting on a Mac is lacking quite substantially. I'm trying to say that I don't mind learning how to do this myself, and I'm not at all afraid of using Terminal. However, I won't dismiss anyone that wants to spell it all out for me now, since I only have about 1 week to work on this particular issue (exchanging device with Apple for new one).

Reply

Answer 12

cdhw

Level 4

3,594 points

Sep 2, 2015 5:03 PM in response to mybrotheriseric

There is a shortage of public information about how to use these features for recent systems. This manual may give you enough to get started:

Mac OS X Security Configuration Guide

C.

Reply

Answer 13

Sep 2, 2015 5:02 PM in response to cdhw

What a great resource! Thank you! I will absolutely check that out.

Reply