Show Wi-Fi Status in Menu Bar

What the Wi-Fi Menu Bar enforcer does

This Automox Worklet™ enforces visibility of the Wi-Fi status icon in the macOS Menu Bar for every local user account on the endpoint. The Worklet iterates the /Users directory (skipping Shared and .localized), reads the WiFi key from each account's com.apple.controlcenter.plist, and writes the integer value 18 when the key is missing or set to anything else. Accounts already at 18 are left untouched, so the policy is idempotent and safe on a mixed fleet.

The Worklet runs each read and write as the target user via sudo -u, which is required because com.apple.controlcenter.plist is a per-user preference stored under /Users/<name>/Library/Preferences/ByHost/. When the active console user is the one being remediated, the Worklet calls killall ControlCenter so the new value is reflected in the Menu Bar within seconds. Other accounts pick up the change the next time their session starts, with no logout prompt for end users.

Because evaluation runs first and only flags accounts whose WiFi key is not 18, the Worklet integrates cleanly with a recurring Automox policy. Profile resets, MDM payload removals, and user toggling under Control Center are all caught on the next evaluation cycle. Exit code 1 from evaluation.sh routes the endpoint to remediation; exit code 0 reports compliance and skips remediation entirely.

Why hold the Wi-Fi Menu Bar baseline

The Wi-Fi menulet is a small piece of the macOS user experience, but it is the indicator end users glance at before joining a hotel, conference, or coffee shop network. Menu Bar item visibility is not driven by a specific CIS or NIST control; this Worklet supports operational visibility of network status so users can confirm the SSID, signal strength, and active VPN before transmitting credentials or session tokens. When the icon is hidden, the user has to dig through Control Center or System Settings to see what network the laptop is on, and most do not bother.

The com.apple.controlcenter preference domain drops the WiFi.visible key for predictable reasons. A user clearing Control Center preferences from System Settings wipes the value, an MDM profile rollback during a Jamf or Kandji deployment removes the key, and a fresh image lands without the baseline applied at all. The Worklet reads the controlcenter domain in the signed-in user's defaults on every cycle, calls defaults -currentHost write to set WiFi to 18 when the value is missing or different, and runs killall ControlCenter so the menu bar paints the icon on the next cycle.

How Wi-Fi Menu Bar enforcement works

1. Evaluation phase: The Worklet lists /Users and filters out Shared and .localized entries. For each remaining account, it runs sudo -u <user> defaults -currentHost read com.apple.controlcenter.plist WiFi and compares the result to 18. The first account that returns a non-18 value (including a missing key, which surfaces as an error from defaults) causes evaluation.sh to exit 1, marking the endpoint non-compliant and routing it to remediation.

2. Remediation phase: The remediation script repeats the per-user loop and, for any account whose WiFi key is not 18, runs sudo -u <user> defaults write /Users/<user>/Library/Preferences/ByHost/com.apple.controlcenter.plist WiFi -int 18. When the account being remediated matches the current console user from stat -f %Su /dev/console, the script sleeps three seconds and runs killall ControlCenter so the Menu Bar redraws immediately. The script exits 0 once every account is at 18.

Wi-Fi Menu Bar enforcement requirements

• macOS endpoint with Control Center (Big Sur 11 and later) and the Automox agent running with root privileges

• Per-user com.apple.controlcenter.plist accessible under /Users/<name>/Library/Preferences/ByHost/ (default macOS path)

• bash shell and the defaults binary at /usr/bin/defaults (standard on macOS)

• No conflicting configuration profile that pins the WiFi Control Center value to anything other than 18; MDM-pinned values override defaults writes and will cause the Worklet to loop into remediation every evaluation

• FixNow compatibility enabled on the policy if you want to push the change on demand from the Automox console outside the scheduled window

Expected Wi-Fi Menu Bar state after remediation

After a successful run, the Wi-Fi status icon appears in the macOS Menu Bar for every local user account on the endpoint. For the active console user, the icon is visible within a few seconds of the killall ControlCenter call; other accounts see it the next time they log in. Subsequent Automox policy evaluations report the endpoint as compliant and skip remediation, because every account's WiFi key already reads 18 and evaluation.sh exits 0.

Validate by running sudo -u <user> defaults -currentHost read com.apple.controlcenter.plist WiFi for a sample of accounts and confirming the output is 18. For audit evidence, capture the policy run identifier from the Automox console and pair it with a screenshot of the Menu Bar on a remediated endpoint. The setting persists across reboots, software updates, and account logins; it is only undone if a user manually hides the icon in Control Center or if an MDM profile overrides the value, at which point the next evaluation reads the WiFi key, sees the value diverge from 18, and the remediation pass writes the integer back and restarts ControlCenter.