Sfmtool or something lets you dump btm? There’s no table I’m aware of for ‘administratively allowed’ state, but the artifacts referenced in that interface are mostly launchd’s anyway, you’d know if the end user successfully disabled them by the job not being loaded, I’d think

ack, TY! I figured there might not be a table. We'll probably end up just relying on other data points that will give us good enough signal, like you suggest. We have pretty high assurance that these will be always enabled since we manage via Managed Login Item MDM payload, but I figured adding extra logic to our osquery queries is free 😅