defaults

access the Mac OS user defaults system
aka Apple's registry

defaults [-currentHost |
          -host hostname] { domains | find word | help }
read [domain [key]]
read-type domain key
write domain { plist | key value }
rename domain old_key new_key
delete [domain [key]]

macOS applications and other programs use the defaults system to record user preferences and other information to be maintained when the application isn't running ( font for new documents, or the position of an Info panel). Much of this information is accessible through an application's Preferences panel,

Applications access the defaults system while they're running. Don't modify the defaults of a running application.

User defaults belong to domains, which typically correspond to individual applications. Each domain has a dictionary of keys and values representing its defaults; for example, "Default Font" = "Helvetica".

Keys are strings,
Values can be complex data structures comprising arrays, dictionaries, strings, and binary data.

Stored as XML Property Lists.

Applications, system services, and other programs have their own domains, they also share a domain named NSGlobalDomain. If a default isn't specified in the application's domain, it may be specified in NSGlobalDomain.

domains outputs the names of all domains in the user's defaults system.
read outputs all of the user's defaults, for every domain, to standard output.
 > defaults read | wc     # it's big!
13402   

> defaults read |grep mozy
    "com.mozy.Config" =         (
    "com.mozy.Restore" =         ( Name = "mozyUinMain.scpt"; Name = "mozy-1_5_2_1-8404.dmg";)
    "com.mozy.Config" =     {
    "com.mozy.Status" =     { 

> defaults read /System/Library/LaunchDaemons/org.apache.httpd 
{
    Disabled = 1;
    EnvironmentVariables =     { "XPC_SERVICES_UNAVAILABLE" = 1; };
    Label = "org.apache.httpd";
    OnDemand = 0;
    ProgramArguments =     ( "/usr/sbin/httpd", "-D", FOREGROUND);
    SHAuthorizationRight = "system.preferences";
} 

read domain
> defaults read  org.mozilla.thunderbird
{
    NSColorPanelMode = 7;
    NSColorPickerPreferredRGBEntryMode = 2;
    NSFullScreenMenuItemEverywhere = 0;
    NSNavLastRootDirectory = "~/Downloads";
    NSNavPanelExpandedSizeForOpenMode = "{1291, 699}";
    NSNavPanelExpandedSizeForSaveMode = "{800, 448}";
    NSNavPanelExpandedStateForSaveMode = 1;
    "NSSplitView Subview Frames NSColorPanelSplitView" =     (
        "0.000000, 0.000000, 228.000000, 315.000000, NO, NO",
        "0.000000, 316.000000, 228.000000, 43.000000, NO, NO"
    );
    "NSToolbar Configuration com.apple.NSColorPanel" =     {
        "TB Is Shown" = 1;
    };
    NSTreatUnknownArgumentsAsOpen = NO;
    "NSWindow Frame NSColorPanel" = "251 251 228 335 0 0 1352 843 ";
    "NSWindow Frame NSNavPanelAutosaveName" = "276 296 800 413 0 0 1352 843 ";
}

> defaults read com.oracle.java.JavaAppletPlugin
2020-01-26 15:26:46.534 defaults[5642:136192] 
Domain com.oracle.java.JavaAppletPlugin does not exist

previously 
{ SULastCheckTime = "2013-10-19 22:52:01 +0000"; } 

domains
read domain key
> sudo defaults read /Library/Preferences/com.apple.loginwindow                 
{
    GuestEnabled = 1;
    OptimizerLastRunForBuild = 35663169;
    OptimizerLastRunForSystem = 168624128;
    lastUser = loggedIn;
    lastUserName = dgerman;
}

>  defaults read com.oracle.java.JavaAppletPlugin SULastCheckTime
2013-10-19 22:52:01 +0000

> defaults read com.mozy.Config
{
 BDSShowHiddenFilesKey = 1;
 "NSWindow Frame BackupSetEditorWindow"="386 197 484 549 0 0 1024 746";
 "NSWindow Frame ConfigurationWindow"="68 97 899 606 0 0 1024 746";
 "NSWindow Frame HistoryWindow"="103 193 829 553 0 0 1024 746";
}
read-type domain key type
>  defaults read /Library/Preferences/com.apple.TimeMachine.plist BackupAlias 
{length = 238, bytes = 0x00000000 00ee0002 00010454 4d323800 ... 38203100 ffff0000 }
> defaults read-type /Library/Preferences/com.apple.TimeMachine.plist BackupAlias
Type is data

>> defaults read-type  com.oracle.java.JavaAppletPlugin SULastCheckTime
Type is date

> defaults read-type com.apple.finder AppleShowAllFiles 
Type is string

> defaults read-type com.apple.TextEdit NSDocumentSuppressTempVersionStoreWarning
Type is boolean

> defaults read-type /Library/Preferences/com.apple.loginwindow OptimizerLastRunForBuild
Type is integer 

write domain key 'value' (Over)Writes value property list. Example:
 defaults write com.companyname.appname "Default Color" '(255, 0, 0)'
                  key is enclosed in quotation marks because it contains a space.

defaults write com.apple.finder AppleShowAllFiles 1 
write domain 'plist' Overwrites the defaults information in domain with that given as plist. plist must be a property list representation of a dictionary, Example:
defaults write com.companyname.appname '{ "Default Color" = (255, 0, 0); "Default Font" = Helvetica; }';
delete domain Removes all information for domain.
delete domain key
find word Searches for word in the domain names, keys, and values of the user's defaults, outputs out matches.
help  

Domains

> defaults domains |sed "s/,/\n/g" | grep thunderbird  
org.mozilla.thunderbird

    == com.apple.  
.GlobalPreferences_m
        { AppleLanguages =     ( "en-US");
            AppleLocale = "en_US";
            "Sig_AppleLanguages" = "UserAccountUpdater(425): 2022-03-23 07:42:31 (EDT)";
            "Sig_AppleLocale" = "UserAccountUpdater(425): 2022-03-23 07:42:31 (EDT)"; }  

Domains from Ventura 13.3.1(a). The order shown here is as defaults displays them
↓
 ContextStoreAgent
 MobileMeAccounts
 ZoomChat
AddressBook
defaults read com.apple.AddressBook  
{   ABBirthDayVisible = 1;
    ABDefaultSourceID = "4EE1666E-55E8-40ED-8D64-45E265A2461C";
    ABMetaDataChangeCount = 10009;
    ABMetadataLastOilChange = "2023-05-29 11:15:18 +0000";
    ABVersion = 1419;
}

AppleMultitouchMouse
AppleMultitouchTrackpad
BezelServices
CalendarAgent
CloudPhotosConfiguration
CommCenter.counts
CoreGraphics
desktopservices
DictionaryServices
DiskUtility
FolderActionsDispatcher
FontRegistry.user
GEO
HIToolbox
Preferences
ProblemReporter
PubSubAgent
QuickLookDaemon
Safari
ServicesMenu.Services
SetupAssistant
SharedWebCredentials
Siri
Siri.SiriTodayExtension
SiriNCService
Spotlight
TelephonyUtilities
Terminal
UserAccountUpdater
accounts
appleseed.FeedbackAssistant
appstore
assistant
assistant.backedup
defaults read com.apple.assistant.backedup
{ "Cloud Sync Enabled" = 1;
  "Cloud Sync Enabled Modification Date" = "2023-03-25 16:24:23 +0000";
  "Cloud Sync User ID" = "_d7d2811372306c2752d8a8c9f0d39462"; }

assistant.support
 defaults read com.apple.assistant.support 
{ "Assistant Enabled" = 0;

 "Offline Dictation Status" =     {
   "ar-SA" = { "Auto Punctuation" = 0; "Continuous Listening" = 0;
     "Emoji Recognition" = 0; "High Quality" = 0; Installed = 0;
     "On Device Search" = 0; };
   "de-DE" … …


calculateframework

Specifying domains

domain If no flag is specified, domain is a domain name of the form tld.companyname.appname. Example:
 defaults read org.mozilla.thunderbird 
{   NSFullScreenMenuItemEverywhere = 0;
…
    NSTreatUnknownArgumentsAsOpen = NO;
    "NSWindow Frame NSNavPanelAutosaveName" = "0 195 1352 582 0 0 1352 843 "; } 
-app application An application name may be provided instead of a domain Hard to determine
> defaults read -app facetime 
{
    AccountSortOrder =     (
        "803BBBCE-08A1-47B0-BB16-2624ECEA772F",
        "FD499BC5-68EB-4DE3-9947-A2449F610D46",
        "F8A4FDA3-ECC6-41D4-9CAB-9A890E5D0973"
    );
    CustomRingtone = "";
    DidMigrateToSixteenByNineAspectRatio = 1;
    PNRltc = "2024-01-29 17:21:56 +0000";
    PhoneNumberUpgradeShown = 1;
    VideoWindowFrame = "{{188, 116}, {976, 610}}";
    hasShownThumperAvailable = 1;
}

> defaulted -app facetime  read -app facetime AccountSortOrder                                    
(
    "803BBBCE-08A1-47B0-BB16-2624ECEA772F",
    "FD499BC5-68EB-4DE3-9947-A2449F610D46",
    "F8A4FDA3-ECC6-41D4-9CAB-9A890E5D0973"
)

filepath Domains may also be specified as a path to an arbitrary plist file, omitting .plist'.
 ls -log ~/Library/Preferences/org.mozilla.*      
-rw-------@ 1 119 Apr  2 11:48 /Volumes/DATA/drman/Library/Preferences/org.mozilla.firefox.plist
-rw-------@ 1 577 Apr  5 18:57 /Volumes/DATA/drman/Library/Preferences/org.mozilla.thunderbird.plist
% defaults read /Volumes/DATA/dgerman/Library/Preferences/org.mozilla.thunderbird
{
    NSFullScreenMenuItemEverywhere = 0;
    NSNavLastRootDirectory = "/Volumes/DATA/dgerman/Documents/financial";
    NSNavPanelExpandedSizeForOpenMode = "{1352, 582}";
    "NSSplitView Subview Frames NSColorPanelSplitView" =     (
        "0.000000, 0.000000, 224.000000, 258.000000, NO, NO",
        "0.000000, 259.000000, 224.000000, 48.000000, NO, NO"
    );
    "NSToolbar Configuration com.apple.NSColorPanel" =     {
        "TB Is Shown" = 1;
    };
    NSTreatUnknownArgumentsAsOpen = NO;
    "NSWindow Frame NSNavPanelAutosaveName" = "0 195 1352 582 0 0 1352 843 ";
}
 defaults read ~/Library/Preferences/org.mozilla.firefox     
{
    NSFullScreenMenuItemEverywhere = 0;
    NSTreatUnknownArgumentsAsOpen = NO;
}


defaults read ~/Library/Preferences/com.apple.imessage 
{
    DidDoInitialDisableHashtagImages = 1;
    PreviewTranscodingQualityOnWiFiWasInitializedToDefaultValue = 1;
    PreviewTranscodingWasInitializedToDefaultValue = 1;
}

Surprizingly (to me) shows different that -app TextEdit

-g
-globalDomain
NSGlobalDomain
sample

Specifying value types for preference keys:
Default to string. For best results, use one of the type flags:
-string
-data raw data bytes in hexadecimal.
defaults read /Library/Preferences/com.apple.TimeMachine.plist BackupAlias -data
{length = 238, bytes = 0x00000000 00ee0002 00010454 4d323800 ... 38203100 ffff0000 }
Notice that entire 238 bytes are NOT shown!
-int[eger]
-float floating point number
-bool[ean] Value must be TRUE, FALSE, YES, or NO.
-date
-array write somedomain preferenceKey -array element1 element2 element3

If the key was not present, it is created, Overwrites the value of the key

-array-add add new elements to the end of an array
-dict add/replace a dictionary . Keys and values are specified in order:

defaults write somedomain preferenceKey -dict key1 value1 key2 value2

If the key was not present, it is created , overwrites the value,

-dict-add add new key/value pairs to a dictionary for a key which has a dictionary as its value. Usage is the same as -dict .
If the key was not present, it is created

Specifying a host for preferences: Operations normally apply to any host the user may log in on, but may be restricted to apply only to a specific host.
-currentHost Restricts preferences operations to the host the user is currently logged in on.
-host hostname Restricts preferences operations to hostname

Defaults can be structured in very complex ways, making it difficult for the user to enter them

Defaults of interest

 > defaults read com.apple.finder AppleShowAllFiles 
0 may error, continue anyway!
> defaults write com.apple.finder AppleShowAllFiles 
TRUE

finder all, safari all, Disk Util,
timeMachine

login:sudo defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "Should you really be logging in here?"
sudo defaults write /System/Library/Launch Daemons/com.apple.backupd-auto StartInterval -int 1800  (?plist?  
com.feedface.ffview udn_dont_resize_img_ win 1 
defaults write -app "App Store" ShowDebugMenu YES

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool TRUE # Don't use .dstore on remove volumes.

com.apple.dashboard mcx-disabled -boolean YES; killall Dock
com.apple.dashboard devmode YES


com.apple.dock persistent-others -array-add '{ "tile-data" = { "list-type" = 1; }; "tile-type" = "recents-tile"; }'; killall Dock
com.apple.dock largesize -int 512; killall Dock
com.apple.dock show-exposemenus -boolean no; killall Dock
com.apple.dock showhidden -bool YES; killall Dock
com.apple.dock no-glass -boolean YES; killall Dock
com.apple.dock mouse-over-hilitestack -boolean YES; killall Dock
com.apple.dock use-new-liststack -boolean YES; killall Dock 

com.apple.finder AppleShowAllFiles YES   # not including .D_DStore  (no longer used as of 3/22/22 Maverick)

https://georgegarside.com/blog/macos/stop-finder-opening-when-connecting-iphone/
AMPDevicesAgent
/System/Library/PrivateFrameworks/AMPDevices.framework/Versions/A/Support/AMPDevicesAgent
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool true    
defaults delete com.apple.AMPDevicesAgent
pkill --signal SIGSTOP AMPDeviceDiscoveryAgent
pkill AMPDeviceDiscoveryAgent

defaults write -g ignore-devices -bool true
defaults delete -g ignore-devices

com.apple.iTunes invertStore Links -bool YES 

com.apple.ScreenSharing controlObserveQuality 1

com.apple.screencapture type file-extension  # jpg gif ??
com.apple.screencapture name "Anything you like"; killall SystemUIServer

com.apple.finder AppleShowAll Files TRUE; killall Finder

com.apple.Safari WebKit DeveloperExtras -bool true

com.apple.iCal IncludeDebugMenu YES 

com.apple.addressbook ABShow DebugMenu -bool YES

com.apple.finder QuitMenuItem -bool YES; killall Finder
com.apple.finder QLEnableXRayFolders -boolean YES 
com.apple.Preview NSQuitAlwaysKeepsWindows -bool false


defaults write com.apple.mail PreferPlainText -bool TRUE
defaults write com.apple.dock no-bouncing -bool TRUE

defaults write -g ApplePressAndHoldEnabled -bool false    #  Cause additional characters to be available when holding down
                                                            #  Example holding the a key presents a pop up  permits selecting à á â ä æ ã å ā 
                                                            BUT prevents key repeating
                                                        #for terminal close all sessions and restart terminal to take affect.
defaults delete -g ApplePressAndHoldEnabled

defaults write com.microsoft.VSCode ApplePressAndHoldEnabled -bool false     # only for this application

defaults write com.google.Keystone.Agent checkInterval 604800   # was 18000
helpwrite


write -g NSNavPanelExpandedState ForSaveMode -bool TRUE \
See also, apple;Dock; Dock preferences

sample

sample full file

dslocal.db Directory:
/private/var/db/dslocal/nodes/Default/users
suffix plist removed for clarity all dated:May 10 17:46

_amavisd           _installassistant _networkd         _trustevaluationagent
_appowner         _installer        _pcastagent       _unknown
_appserver        _jabber           _pcastlibrary     _update_sharing
_ard              _kadmin_admin     _pcastserver      _usbmuxd
_atsserver        _kadmin_changepw  _postfix          _uucp
_avbdeviced       _krb_anonymous    _postgres         _warmd
_calendar         _krb_changepw     _qtss             _webauthserver
_ces              _krb_kadmin       _sandbox          _windowserver
_clamav           _krb_kerberos     _screensaver      _www
_coreaudiod       _krb_krbtgt       _scsd             _xgridagent
_cvmsroot         _krbtgt           _securityagent    _xgridcontroller
_cvs              _lda              _serialnumberd    daemon
_cyrus            _locationd        _softwareupdate   dennisgerman
_devdocs          _lp               _spotlight        dgerman
_devicemgr        _mailman          _sshd             mgerman
_dovecot          _mcxalr           _svn              nobody
_dovenull         _mdnsresponder    _taskgated        root
_dpaudio          _mysql            _teamsserver      rut
_eppc             _netbios          _timezone
_ftp              _netstatistics    _tokend

 28310 Aug  5 14:17 mgerman.plist
637672 Aug  5 14:17 rut.plist
414720 Aug  6 10:54 dgerman.plist
299272 Aug  6 23:28 dennisgerman.plist
  1525 Aug  6 23:38 root.plist

Well there it is folks. For all you "my Apple Mac is better than your PC"
Does Mac OS X have a registry, YES this is it. And it's just as well (or not) documented as Micro$oft's! Apple mail defaults