Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

is there a query that can discover the status of find my mac (FMM)? i found <https://github.com/Ignition-IT/Watchman-Plugins/blob/master/activation-lock/_activation_lock.plugin> (via [reddit](<https://www.reddit.com/r/macsysadmin/comments/pc9ple/check_find_my_mac_status/>) ). it doesn't seem to work on 15.x or 26.x on apple silicon

Hey <@U08R8MV8MSP>, I'll be honest, I didn't expect it to take me this long and still not have an actual solution for you.

The closest I'm getting so far is checking to see if the activation lock is enabled using the system_profiler table. Which would only be an indicator that Find My could be enabled.

```SELECT json_extract(value, '$[0].activation_lock_status') AS activation_lock_status
FROM system_profiler
WHERE data_type = 'SPHardwareDataType';```

I believe Activation lock status is something that can be gathered via the MDM protocol itself. Some (most?) already gather this as part of their inventory. I know WS1 has it.

yeah i already have a query to find the activation lock status -- that exact query in fact. however, under MDM activation lock can be disabled yet FMM still enabled.

Indeed. I'm not sure if or how they even surface this information, with it hidden behind the iCloud account settings.

I could absolutely be wrong, though.

the setting/key should be stored in nvram if enabled, you may be able to ascertain enabled status by the presence or lack of presence of results here: one key for sure is `fmm-computer-name`
```select * from nvram where lower(name) like '%fmm%';```

Screenshot 2025-12-22 at 4.04.22 PM.png

the value of `LocationServicesEnabled` is `%01` which doesn't feel like an indicator for FMM, just for location as a whole.

maybe need to experiment, does that value change if one or both of those services are disabled? my machine was recently updated so can't readily test myself

in general, if you can find some plist that stores a config value, then it should be queryable even if a dedicated table for it doens't exist.

it worked! and it tracks the system settings.
```$ defaults read /Library/Preferences/com.apple.FindMyMac FMMEnabled
1```

so you can just do
```select * from plist where path = "/Library/Preferences/com.apple.FindMyMac.plist";```

select value ... from ... where key = 'FMMEnabled' to make it more of a yes/no policy type check