From martin-van-diemen at g-star.com  Fri Jan  2 02:50:28 2009
From: martin-van-diemen at g-star.com (Martin van Diemen)
Date: Fri, 2 Jan 2009 11:50:28 +0100
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <ec2e75ff0812310557m6229d761t5be2f8ebd02becae@mail.gmail.com>
Message-ID: <C583B004.5792%martin-van-diemen@g-star.com>

Hi Miles,

Thanks for your reply. I've tried to make use of the $3 variable but the strange thing is that it's empty. We're making use of Active Directory. Could this have something to do with it?

Best wishes for 2009 to you all!

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com



________________________________
From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Wed, 31 Dec 2008 14:57:34 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

username is $3

$1 is the mount point of the target drive
$2 is the computer name

$4 through $11 are configurable.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com>




On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <martin-van-diemen at g-star.com> wrote:
Hi,

I want to delete the com.adobe.mediabrowser.plist (~/Library/Preferences/) for the user that's currently logging in. I tried to do this with a policy:
Search for file by path: ~/Library/Preferences/com.adobe.mediabrowser.plist and Delete if found.

This doesn't work because it can't find the file (cause it's using the casper account?).
Is this possible with a variable e.g. /Users/$1/Library/Preferences/com.adobe.mediabrowser.plist? $1 doesn't work.

If I use a script which variable tells me the login name of the user?

Thanks in advance.

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com>
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



From miles.leacy at themacadmin.com  Fri Jan  2 08:23:36 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 2 Jan 2009 11:23:36 -0500
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <C583B004.5792%martin-van-diemen@g-star.com>
References: <ec2e75ff0812310557m6229d761t5be2f8ebd02becae@mail.gmail.com>
	<C583B004.5792%martin-van-diemen@g-star.com>
Message-ID: <ec2e75ff0901020823o6ab25c06k8d4a5f31be3c85f8@mail.gmail.com>

What is the script triggered by?  I would set it to login or logout to be
sure that there is a username available.  If it runs on another trigger, you
risk the possibility that no one is logged in.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 2, 2009 at 5:50 AM, Martin van Diemen <
martin-van-diemen at g-star.com> wrote:

> Hi Miles,
>
> Thanks for your reply. I've tried to make use of the $3 variable but the
> strange thing is that it's empty. We're making use of Active Directory.
> Could this have something to do with it?
>
> Best wishes for 2009 to you all!
>
> Kind Regards,
>
> Martin van Diemen
>
> t +31(0) 205677744
> __________________
>
> G-Star International B.V.
> www.g-star.com
>
>
>
> ________________________________
> From: Miles Leacy <miles.leacy at themacadmin.com>
> Date: Wed, 31 Dec 2008 14:57:34 +0100
> To: Martin van Diemen <martin-van-diemen at g-star.com>
> Cc: <casper at list.jamfsoftware.com>
> Conversation: [Casper] Delete com.adobe.mediabrowser.plist
> Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist
>
> username is $3
>
> $1 is the mount point of the target drive
> $2 is the computer name
>
> $4 through $11 are configurable.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com><
> http://www.themacadmin.com>
>
>
>
>
> On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <
> martin-van-diemen at g-star.com> wrote:
> Hi,
>
> I want to delete the com.adobe.mediabrowser.plist (~/Library/Preferences/)
> for the user that's currently logging in. I tried to do this with a policy:
> Search for file by path: ~/Library/Preferences/com.adobe.mediabrowser.plist
> and Delete if found.
>
> This doesn't work because it can't find the file (cause it's using the
> casper account?).
> Is this possible with a variable e.g.
> /Users/$1/Library/Preferences/com.adobe.mediabrowser.plist? $1 doesn't work.
>
> If I use a script which variable tells me the login name of the user?
>
> Thanks in advance.
>
> Kind Regards,
>
> Martin van Diemen
>
> t +31(0) 205677744
> __________________
>
> G-Star International B.V.
> www.g-star.com <http://www.g-star.com><http://www.g-star.com>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090102/677bfd46/attachment.htm 

From rharter at uwsp.edu  Fri Jan  2 12:27:43 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Fri, 2 Jan 2009 14:27:43 -0600
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <C583B004.5792%martin-van-diemen@g-star.com>
References: <C583B004.5792%martin-van-diemen@g-star.com>
Message-ID: <73F743E9-1C87-4E61-95C3-9E9311B6A57E@uwsp.edu>

What version of Casper are you using?  There was a bug in 6.0 that  
caused $3 to not be set, Casper 6.01 fixed this.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 2, 2009, at 4:50 AM, Martin van Diemen wrote:

> Hi Miles,
>
> Thanks for your reply. I've tried to make use of the $3 variable but  
> the strange thing is that it's empty. We're making use of Active  
> Directory. Could this have something to do with it?
>
> Best wishes for 2009 to you all!
>
> Kind Regards,
>
> Martin van Diemen
>
> t +31(0) 205677744
> __________________
>
> G-Star International B.V.
> www.g-star.com
>
>
>
> ________________________________
> From: Miles Leacy <miles.leacy at themacadmin.com>
> Date: Wed, 31 Dec 2008 14:57:34 +0100
> To: Martin van Diemen <martin-van-diemen at g-star.com>
> Cc: <casper at list.jamfsoftware.com>
> Conversation: [Casper] Delete com.adobe.mediabrowser.plist
> Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist
>
> username is $3
>
> $1 is the mount point of the target drive
> $2 is the computer name
>
> $4 through $11 are configurable.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com 
> >
>
>
>
>
> On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <martin-van-diemen at g-star.com 
> > wrote:
> Hi,
>
> I want to delete the com.adobe.mediabrowser.plist (~/Library/ 
> Preferences/) for the user that's currently logging in. I tried to  
> do this with a policy:
> Search for file by path: ~/Library/Preferences/ 
> com.adobe.mediabrowser.plist and Delete if found.
>
> This doesn't work because it can't find the file (cause it's using  
> the casper account?).
> Is this possible with a variable e.g. /Users/$1/Library/Preferences/ 
> com.adobe.mediabrowser.plist? $1 doesn't work.
>
> If I use a script which variable tells me the login name of the user?
>
> Thanks in advance.
>
> Kind Regards,
>
> Martin van Diemen
>
> t +31(0) 205677744
> __________________
>
> G-Star International B.V.
> www.g-star.com <http://www.g-star.com><http://www.g-star.com>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090102/252d876f/attachment.html 

From martin-van-diemen at g-star.com  Sun Jan  4 22:34:44 2009
From: martin-van-diemen at g-star.com (Martin van Diemen)
Date: Mon, 5 Jan 2009 07:34:44 +0100
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <ec2e75ff0901020823o6ab25c06k8d4a5f31be3c85f8@mail.gmail.com>
Message-ID: <C5876894.57F4%martin-van-diemen@g-star.com>

Triggered by login. I also tested the script when an user was logged in.

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com



________________________________
From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Fri, 2 Jan 2009 17:23:36 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

What is the script triggered by?  I would set it to login or logout to be sure that there is a username available.  If it runs on another trigger, you risk the possibility that no one is logged in.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com>




On Fri, Jan 2, 2009 at 5:50 AM, Martin van Diemen <martin-van-diemen at g-star.com> wrote:
Hi Miles,

Thanks for your reply. I've tried to make use of the $3 variable but the strange thing is that it's empty. We're making use of Active Directory. Could this have something to do with it?

Best wishes for 2009 to you all!

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com>



________________________________
From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Wed, 31 Dec 2008 14:57:34 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

username is $3

$1 is the mount point of the target drive
$2 is the computer name

$4 through $11 are configurable.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com>  <http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com>




On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <martin-van-diemen at g-star.com> wrote:
Hi,

I want to delete the com.adobe.mediabrowser.plist (~/Library/Preferences/) for the user that's currently logging in. I tried to do this with a policy:
Search for file by path: ~/Library/Preferences/com.adobe.mediabrowser.plist and Delete if found.

This doesn't work because it can't find the file (cause it's using the casper account?).
Is this possible with a variable e.g. /Users/$1/Library/Preferences/com.adobe.mediabrowser.plist? $1 doesn't work.

If I use a script which variable tells me the login name of the user?

Thanks in advance.

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com>  <http://www.g-star.com><http://www.g-star.com><http://www.g-star.com><http://www.g-star.com>
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper





From martin-van-diemen at g-star.com  Sun Jan  4 22:35:48 2009
From: martin-van-diemen at g-star.com (Martin van Diemen)
Date: Mon, 5 Jan 2009 07:35:48 +0100
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <73F743E9-1C87-4E61-95C3-9E9311B6A57E@uwsp.edu>
Message-ID: <C58768D4.57F7%martin-van-diemen@g-star.com>

The version that has been installed is 6.01

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com



________________________________
From: Ryan Harter <rharter at uwsp.edu>
Date: Fri, 2 Jan 2009 21:27:43 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: Miles Leacy <miles.leacy at themacadmin.com>, <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

What version of Casper are you using?  There was a bug in 6.0 that caused $3 to not be set, Casper 6.01 fixed this.


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu><mailto:Ryan.Harter at uwsp.edu>


On Jan 2, 2009, at 4:50 AM, Martin van Diemen wrote:

Hi Miles,

Thanks for your reply. I've tried to make use of the $3 variable but the strange thing is that it's empty. We're making use of Active Directory. Could this have something to do with it?

Best wishes for 2009 to you all!

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com>



________________________________
From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Wed, 31 Dec 2008 14:57:34 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

username is $3

$1 is the mount point of the target drive
$2 is the computer name

$4 through $11 are configurable.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com>




On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <martin-van-diemen at g-star.com> wrote:
Hi,

I want to delete the com.adobe.mediabrowser.plist (~/Library/Preferences/) for the user that's currently logging in. I tried to do this with a policy:
Search for file by path: ~/Library/Preferences/com.adobe.mediabrowser.plist and Delete if found.

This doesn't work because it can't find the file (cause it's using the casper account?).
Is this possible with a variable e.g. /Users/$1/Library/Preferences/com.adobe.mediabrowser.plist? $1 doesn't work.

If I use a script which variable tells me the login name of the user?

Thanks in advance.

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com><http://www.g-star.com><http://www.g-star.com>
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



From tlarki at kckps.org  Mon Jan  5 10:06:23 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Mon, 05 Jan 2009 12:06:23 -0600
Subject: [Casper] Delete com.adobe.mediabrowser.plist
In-Reply-To: <C58768D4.57F7%martin-van-diemen@g-star.com>
References: <73F743E9-1C87-4E61-95C3-9E9311B6A57E@uwsp.edu>
	<C58768D4.57F7%martin-van-diemen@g-star.com>
Message-ID: <4961F7BF.7141.0039.0@kckps.org>

I have a search and destroy policy that searches out files by type or by name and deletes them.  You don't need a script as it is a one liner command.  Keeping it simple is the way to go in my humble opinion.  If you want to get specific you can script it out and make it more robust. 

Here are some examples: 

/usr/bin/find /Users/* -name "full_filename.extension" -print -delete 

That will search the /Users folder and delete all files to test it out just use the -print option first and leave out the delete option.  Then once you confirmed it works add back in the delete.  Working for a public school system I get to search and destroy some creative user created content that gets passed around from time to time. 

If you are looking to delete a certain file type across the board you can add to the find command with regex and since home folder synchronizing is not perfect it syncs things that are not suppose to be there, and then I have to play janitor on the file servers.  An example of that is: 

/usr/sbin/find -x -E /path/to/share -regex '.*\.(m[4po][34agpv]|mpeg|aac|asf|wmv)' -print -delete 

That deletes pretty much any file with those extensions in the file name, MP3, MP4, AAC, mpeg, so on and so forth.  So that should give you something to work with and with the find command set the path to a narrow scope, otherwise it will just search the root of the drive and that can take forever to run 

Hope that helps


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Martin van Diemen <martin-van-diemen at g-star.com> 01/05/09 12:35 AM >>>
The version that has been installed is 6.01

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com



________________________________
From: Ryan Harter <rharter at uwsp.edu>
Date: Fri, 2 Jan 2009 21:27:43 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: Miles Leacy <miles.leacy at themacadmin.com>, <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

What version of Casper are you using?  There was a bug in 6.0 that caused $3 to not be set, Casper 6.01 fixed this.


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu><mailto:Ryan.Harter at uwsp.edu>


On Jan 2, 2009, at 4:50 AM, Martin van Diemen wrote:

Hi Miles,

Thanks for your reply. I've tried to make use of the $3 variable but the strange thing is that it's empty. We're making use of Active Directory. Could this have something to do with it?

Best wishes for 2009 to you all!

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com>



________________________________
From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Wed, 31 Dec 2008 14:57:34 +0100
To: Martin van Diemen <martin-van-diemen at g-star.com>
Cc: <casper at list.jamfsoftware.com>
Conversation: [Casper] Delete com.adobe.mediabrowser.plist
Subject: Re: [Casper] Delete com.adobe.mediabrowser.plist

username is $3

$1 is the mount point of the target drive
$2 is the computer name

$4 through $11 are configurable.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com><http://www.themacadmin.com>




On Wed, Dec 31, 2008 at 4:58 AM, Martin van Diemen <martin-van-diemen at g-star.com> wrote:
Hi,

I want to delete the com.adobe.mediabrowser.plist (~/Library/Preferences/) for the user that's currently logging in. I tried to do this with a policy:
Search for file by path: ~/Library/Preferences/com.adobe.mediabrowser.plist and Delete if found.

This doesn't work because it can't find the file (cause it's using the casper account?).
Is this possible with a variable e.g. /Users/$1/Library/Preferences/com.adobe.mediabrowser.plist? $1 doesn't work.

If I use a script which variable tells me the login name of the user?

Thanks in advance.

Kind Regards,

Martin van Diemen

t +31(0) 205677744
__________________

G-Star International B.V.
www.g-star.com <http://www.g-star.com><http://www.g-star.com><http://www.g-star.com><http://www.g-star.com>
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090105/193101b4/attachment.html 

From david.lundgren at brooks.edu  Mon Jan  5 13:10:16 2009
From: david.lundgren at brooks.edu (David Lundgren)
Date: Mon, 5 Jan 2009 15:10:16 -0600
Subject: [Casper] Upgrading from Tiger to Leopard
Message-ID: <C587D358.1C4F6%david.lundgren@brooks.edu>

I was wondering how you all have done migrations from Tiger to Leopard.

We have an Active Directory setup where the users home directories are local
to the machine (our faculty often have 10GB+ of data, and some have
laptops).

We were contemplating doing separate user and OS partitions at the same time
to make any future OS upgrades less painful, without having to worry about
user data.

Thanks,
 
David Lundgren
IT Systems Administrator

Brooks Institute - "Passion, Vision, Excellence"
27 East Cota Street
Santa Barbara, CA 93101
(888) 304-3456 (toll-free)
(805) 690-7615 (office)
http://www.brooks.edu


From jared.nichols at ll.mit.edu  Mon Jan  5 16:34:41 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Mon, 5 Jan 2009 19:34:41 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <C587D358.1C4F6%david.lundgren@brooks.edu>
Message-ID: <C5881152.17B25%jared.nichols@ll.mit.edu>

One thing to consider is that Leopard is no longer based on netinfo.  Pre-leopard was nice using NetInfo Manager for arranging tasks like the movement of /users to a different drive/partition.  This would all have to be done with dscl now... On the upshot, it's all scriptable...

j


On 1/5/09 16:10 , "David Lundgren" <david.lundgren at brooks.edu> wrote:

I was wondering how you all have done migrations from Tiger to Leopard.

We have an Active Directory setup where the users home directories are local
to the machine (our faculty often have 10GB+ of data, and some have
laptops).

We were contemplating doing separate user and OS partitions at the same time
to make any future OS upgrades less painful, without having to worry about
user data.

Thanks,

David Lundgren
IT Systems Administrator

Brooks Institute - "Passion, Vision, Excellence"
27 East Cota Street
Santa Barbara, CA 93101
(888) 304-3456 (toll-free)
(805) 690-7615 (office)
http://www.brooks.edu

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090105/03a902a9/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan  6 06:01:16 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 6 Jan 2009 09:01:16 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <C587D358.1C4F6%david.lundgren@brooks.edu>
References: <AclvisUd5YPZEMWJ80yB5K49QBeIOg==>
	<C587D358.1C4F6%david.lundgren@brooks.edu>
Message-ID: <ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>

If you don't mind doing some extra work now, you can move people's data to
another partition now, and in the future, you can do as you like with the
system volume going forward without worry about user data.
Note that if you boot an existing Mac (with user data) to a Leopard volume,
you can create new partitions non-destructively and this task can be
scripted.

I would (and do) do it like this:

#!/bin/sh
#
##### HEADER BEGINS #####
# scr_sys_symlinkUsers.sh
#
# Created 20071011 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090106 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
remains intact.
#
# This script is provided "as is".  The author offers no warranty or
guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
twice more.
#
# This script moves /Users to /Volumes/Data.  If your data volume is named
differently,
# be sure to replace each instance of "/Volumes/Data" with the path to your
data volume.
# Run as an "at reboot" script when imaging with Casper.
#
##### HEADER ENDS #####

/bin/mv /Users /Volumes/Data

rm -R /Users

/bin/ln -s /Volumes/Data /Users

diskutil repairPermissions /


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 5, 2009 at 4:10 PM, David Lundgren <david.lundgren at brooks.edu>wrote:

> I was wondering how you all have done migrations from Tiger to Leopard.
>
> We have an Active Directory setup where the users home directories are
> local
> to the machine (our faculty often have 10GB+ of data, and some have
> laptops).
>
> We were contemplating doing separate user and OS partitions at the same
> time
> to make any future OS upgrades less painful, without having to worry about
> user data.
>
> Thanks,
>
> David Lundgren
> IT Systems Administrator
>
> Brooks Institute - "Passion, Vision, Excellence"
> 27 East Cota Street
> Santa Barbara, CA 93101
> (888) 304-3456 (toll-free)
> (805) 690-7615 (office)
> http://www.brooks.edu
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/05c05fc6/attachment.html 

From tlarki at kckps.org  Tue Jan  6 07:28:14 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 06 Jan 2009 09:28:14 -0600
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>
References: <AclvisUd5YPZEMWJ80yB5K49QBeIOg==>
	<C587D358.1C4F6%david.lundgren@brooks.edu>
	<ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>
Message-ID: <4963242E.7141.0039.0@kckps.org>

I don't know if I think that is a totally wise idea.  I have read on
several occasions either at AFP548.com or macenterprise.org about moving
home directories and then connecting them by symbolic link.  While I
can't exactly recall the specifics other than it has to do with NetInfo
and the location of the home directory or with Open Directory (dscl in
10.5) and how the user database actually points to the home folder. 
Also, if I recall diskutility will not repair permissions on user data,
it only does it on system data.  I am not saying it won't work, I am
just saying there may be some issues as I have read from other people
posting and how NetInfo and Open Directory handle the user database. 
Please correct me if I am wrong on that, because I have never tried to
make a user partition on a local machine just for home directories, well
at least not in OS X.  In Linux I have. 

If you don't have network homes, or portable home directories I really
strongly suggest you look into something like that.  I know that 10gigs
of data for each user can eat up storage pretty quick, but storage is
actually well, kind of cheap these days.   

Over the summer we reimaged 6,000 Macbooks from 10.4 to 10.5.  10.5.4
was a damn nightmare but 10.5.5 smoothed most of those things out.  I
wiped out all of our servers, reloaded them, and since I house home
directories on separate volumes on the network I just pointed in WGM the
volume for home directories.  I also recommend a full wipe and fresh
import of LDAP.  I just exported mine to plain text (users and groups)
and then reimported them via WGM.  This will not preserve passwords, so
I did a master password reset.  I have tools now to set unique passwords
for users as well, and will be implementing that over next summer.  Next
summer I am wiping out everything and freshly loading every thing.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 8:01 AM >>>
If you don't mind doing some extra work now, you can move people's data
to another partition now, and in the future, you can do as you like with
the system volume going forward without worry about user data. 


Note that if you boot an existing Mac (with user data) to a Leopard
volume, you can create new partitions non-destructively and this task
can be scripted. 



I would (and do) do it like this: 



#!/bin/sh 

# 

##### HEADER BEGINS ##### 

# scr_sys_symlinkUsers.sh 

# 

# Created 20071011 by Miles A. Leacy IV 

# miles.leacy at themacadmin.com 

# Modified 20090106 by Miles A. Leacy IV 

# Copyright 2009 Miles A. Leacy IV 

# 

# This script may be copied and distributed freely as long as this
header remains intact. 

# 

# This script is provided "as is".  The author offers no warranty or
guarantee of any kind. 

# Use of this script is at your own risk.  The author takes no
responsibility for loss of use, 

# loss of data, loss of job, loss of socks, the onset of armageddon, or
any other negative effects. 

# 

# Test thoroughly in a lab environment before use on production systems.


# When you think it's ok, test again.  When you're certain it's ok, test
twice more. 

# 

# This script moves /Users to /Volumes/Data.  If your data volume is
named differently, 

# be sure to replace each instance of "/Volumes/Data" with the path to
your data volume. 

# Run as an "at reboot" script when imaging with Casper. 

# 

##### HEADER ENDS ##### 



/bin/mv /Users /Volumes/Data 



rm -R /Users 



/bin/ln -s /Volumes/Data /Users 



diskutil repairPermissions / 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Mon, Jan 5, 2009 at 4:10 PM, DaviWe have an Active Directory setup where the users home directories are
local
to the machine (our faculty often have 10GB+ of data, and some have
laptops).

We were contemplating doing separate user and OS partitions at the same
time
to make any future OS upgrades less painful, without having to worry
about
user data.

Thanks,

David Lundgren
IT Systems Administrator

Brooks Institute - "Passion, Vision, Excellence"
27 East Cota Street
Santa Barbara, CA 93101
(888) 304-3456 (toll-free)
(805) 690-7615 (office)
http://www.brooks.edu

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/61b9844b/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan  6 07:52:28 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 6 Jan 2009 10:52:28 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <4963242E.7141.0039.0@kckps.org>
References: <C587D358.1C4F6%david.lundgren@brooks.edu>
	<ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>
	<4963242E.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901060752v2aa75314pabed7efb23833c6b@mail.gmail.com>

I've been doing this in production environments (large enterprises as well
as my family's Macs) for at least two years on both Tiger and Leopard
without any issues.  What are the potential issues you're concerned about?
The reason for including the permissions repair is lost to antiquity and
poor documentation I'm afraid, but I seem to vaguely recall it having
something to do with the /Users/Shared folder.  Since it works, I'm not
overly concerned with uncovering the answer, but if you care to, you could
comment out the permissions repair line and see what the difference is.

Whether netinfo or ds is handling your home folders, it refers to them as a
filesystem path.  As far as my knowledge and experience goes, there is no
difference in how home folders function between a system with a genuine
/Users path and one with a symlinked /Users path.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Tue, Jan 6, 2009 at 10:28 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  I don't know if I think that is a totally wise idea.  I have read on
> several occasions either at AFP548.com or macenterprise.org about moving
> home directories and then connecting them by symbolic link.  While I can't
> exactly recall the specifics other than it has to do with NetInfo and the
> location of the home directory or with Open Directory (dscl in 10.5) and how
> the user database actually points to the home folder.  Also, if I recall
> diskutility will not repair permissions on user data, it only does it on
> system data.  I am not saying it won't work, I am just saying there may be
> some issues as I have read from other people posting and how NetInfo and
> Open Directory handle the user database.  Please correct me if I am wrong on
> that, because I have never tried to make a user partition on a local machine
> just for home directories, well at least not in OS X.  In Linux I have.
>
>  If you don't have network homes, or portable home directories I really
> strongly suggest you look into something like that.  I know that 10gigs of
> data for each user can eat up storage pretty quick, but storage is actually
> well, kind of cheap these days.
>
>  Over the summer we reimaged 6,000 Macbooks from 10.4 to 10.5.  10.5.4 was
> a damn nightmare but 10.5.5 smoothed most of those things out.  I wiped out
> all of our servers, reloaded them, and since I house home directories on
> separate volumes on the network I just pointed in WGM the volume for home
> directories.  I also recommend a full wipe and fresh import of LDAP.  I just
> exported mine to plain text (users and groups) and then reimported them via
> WGM.  This will not preserve passwords, so I did a master password reset.  I
> have tools now to set unique passwords for users as well, and will be
> implementing that over next summer.  Next summer I am wiping out everything
> and freshly loading every thing.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 8:01 AM >>>
>
> If you don't mind doing some extra work now, you can move people's data to
> another partition now, and in the future, you can do as you like with the
> system volume going forward without worry about user data.
>
>
>   Note that if you boot an existing Mac (with user data) to a Leopard
> volume, you can create new partitions non-destructively and this task can be
> scripted.
>
>
>   I would (and do) do it like this:
>
>
>    #!/bin/sh
>
> #
>
> ##### HEADER BEGINS #####
>
> # scr_sys_symlinkUsers.sh
>
> #
>
> # Created 20071011 by Miles A. Leacy IV
>
> # miles.leacy at themacadmin.com
>
> # Modified 20090106 by Miles A. Leacy IV
>
> # Copyright 2009 Miles A. Leacy IV
>
> #
>
> # This script may be copied and distributed freely as long as this header
> remains intact.
>
> #
>
> # This script is provided "as is".  The author offers no warranty or
> guarantee of any kind.
>
> # Use of this script is at your own risk.  The author takes no
> responsibility for loss of use,
>
> # loss of data, loss of job, loss of socks, the onset of armageddon, or any
> other negative effects.
>
> #
>
> # Test thoroughly in a lab environment before use on production systems.
>
> # When you think it's ok, test again.  When you're certain it's ok, test
> twice more.
>
> #
>
> # This script moves /Users to /Volumes/Data.  If your data volume is named
> differently,
>
> # be sure to replace each instance of "/Volumes/Data" with the path to your
> data volume.
>
> # Run as an "at reboot" script when imaging with Casper.
>
> #
>
> ##### HEADER ENDS #####
>
>
>   /bin/mv /Users /Volumes/Data
>
>
>   rm -R /Users
>
>
>   /bin/ln -s /Volumes/Data /Users
>
>
>   diskutil repairPermissions /
>
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Mon, Jan 5, 2009 at 4:10 PM, David Lundgren
>
> <david.lundgren at brooks.edu>
>
> wrote:
>
>>  I was wondering how you all have done migrations from Tiger to Leopard.
>>
>> We have an Active Directory setup where the users home directories are
>> local
>> to the machine (our faculty often have 10GB+ of data, and some have
>> laptops).
>>
>> We were contemplating doing separate user and OS partitions at the same
>> time
>> to make any future OS upgrades less painful, without having to worry about
>> user data.
>>
>> Thanks,
>>
>> David Lundgren
>> IT Systems Administrator
>>
>> Brooks Institute - "Passion, Vision, Excellence"
>> 27 East Cota Street
>> Santa Barbara, CA 93101
>> (888) 304-3456 (toll-free)
>> (805) 690-7615 (office)
>> http://www.brooks.edu
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/f0294f29/attachment.htm 

From tlarki at kckps.org  Tue Jan  6 08:27:54 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 06 Jan 2009 10:27:54 -0600
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <ec2e75ff0901060752v2aa75314pabed7efb23833c6b@mail.gmail.com>
References: <C587D358.1C4F6%david.lundgren@brooks.edu>
	<ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>
	<4963242E.7141.0039.0@kckps.org>
	<ec2e75ff0901060752v2aa75314pabed7efb23833c6b@mail.gmail.com>
Message-ID: <4963322A.7141.0039.0@kckps.org>

I guess I would rather do it in DS than by a sym link just because.  Sym
link goes bad lots of problems I think could happen.  Users could jack
it up them self as well since they own everything.  Especially with
NetInfo.  I saw so many weird quirks with it when we ran Tiger, and a
lot of times it would dupe local or mobile accounts to the machine and I
would have to go in and delete one of them to make the account work
again.  I guess I am just a bit paranoid, and I don't like touching
anything in production.  I would have to fully test the sym link thing
heavily before I did it in my live environment.  It is good to know it
works for you, maybe some day I will try it.   

Also, with laptops I don't think diskutility supports live resizing in
Tiger, so you would have to be a bit more creative because you couldn't
have a second volume nor could you script something to create a new
volume on the existing drive in Tiger.  I think that is one of the 300
new features of Leopard if I recall, to resize live partitions and
create a /users partition to house the directory. 

Plus with all the hard drive failures I see anyway every day on the
Macbooks, I would really suggest using mobile home directories.  Then
you can just wipe and resync the home directory and call it a day.  The
down side to that is that a home sync is not a true back up, it is a
synchronization, which some users just can't quite grasp. 

When you toss these in your production machines, are these servers or
are these like actual user machines?  I think working in education has
made me paranoid since students like to tinker, hack, exploit, and crash
machines whenever they can.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 9:52 AM >>>
I've been doing this in production environments (large enterprises as
well as my family's Macs) for at least two years on both Tiger and
Leopard without any issues.  What are the potential issues you're
concerned about? 


The reason for including the permissions repair is lost to antiquity and
poor documentation I'm afraid, but I seem to vaguely recall it having
something to do with the /Users/Shared folder.  Since it works, I'm not
overly concerned with uncovering the answer, but if you care to, you
could comment out the permissions repair line and see what the
difference is.



Whether netinfo or ds is handling your home folders, it refers to them
as a filesystem path.  As far as my knowledge and experience goes, there
is no difference in how home folders function between a system with a
genuine /Users path and one with a symlinked /Users path. 


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Tue, Jan 6, 2009 at 10:28 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


I don't know if I think that is a totally wise idea.  I have read on
several occasions either at AFP548.com or macenterprise.org about moving
home directories and then connecting them by symbolic link.  While I
can't exactly recall the specifics other than it has to do with NetInfo
and the location of the home directory or with Open Directory (dscl in
10.5) and how the user database actually points to the home folder. 
Also, if I recall diskutility will not repair permissions on user data,
it only does it on system data.  I am not saying it won't work, I am
just saying there may be some issues as I have read from other people
posting and how NetInfo and Open Directory handle the user database. 
Please correct me if I am wrong on that, because I have never tried to
make a user partition on a local machine just for home directories, well
at least not in OS X.  In Linux I have. 


If you don't have network homes, or strongly suggest you look into something like that.  I know that 10gigs
of data for each user can eat up storage pretty quick, but storage is
actually well, kind of cheap these days.   


Over the summer we reimaged 6,000 Macbooks from 10.4 to 10.5.  10.5.4
was a damn nightmare but 10.5.5 smoothed most of those things out.  I
wiped out all of our servers, reloaded them, and since I house home
directories on separate volumes on the network I just pointed in WGM the
volume for home directories.  I also recommend a full wipe and fresh
import of LDAP.  I just exported mine to plain text (users and groups)
and then reimported them via WGM.  This will not preserve passwords, so
I did a master password reset.  I have tools now to set unique passwords
for users as well, and will be implementing that over next summer.  Next
summer I am wiping out everything and freshly loading every thing.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 8:01 AM >>> 



If you don't mind doing some extra work now, you can move people's data
to another partition now, and in the future, you can do as you like with
the system volume going forward without worry about user data. 





Note that if you boot an existing Mac (with user data) to a Leopard
volume, you can create new partitions non-destructively and this task
can be scripted. 



I would (and do) do it like this: 



#!/bin/sh 

# 

##### HEADER BEGINS ##### 

# scr_sys_symlinkUsers.sh 

# 

# Created 20071011 by Miles A. Leacy IV 

# miles.leacy at themacadmin.com 

# Modified 20090106 by Miles A. Leacy IV 

# Copyright 2009 Miles A. Leacy IV 

# 

# This script may be copied and distributed freely as long as this
header remains intact. 

# 

# This script is provided "as is".  The author offers no warranty or
guarantee of any kind. 

# Use of this script is at your own risk.  The author takes no
responsibility for loss of use, 

# loss of data, loss of job, loss of socks, the onset of armageddon, or
any other negative effects. 

# 

# Test thoroughly in a lab environment before use on production systems.


# When you think it's ok, test again.  When you're certain it's ok, test
twice more. 

# 

# This script moves /Users to /Volumes/Data.  If your data volume is
named differently, 

# be sure to replace each instance of "/Volumes/Data" with the path to
your data volume. 

# Run as an "at reboot" script when imaging with Casper. 

# 

##### HEADER ENDS ##### 



/bin/mv /Users /Volumes/Data 



rm -R /Users 



/bin/ln -s /Volumes/Data /Users 



diskutil repairPermissions / 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Mon, Jan 5, 2009 at 4:10 PM, David Lundgren 
<david.lundgren at brooks.edu> 

wrote:


I was wondering how you all have done migrations from Tiger to Leopard.

We have an Active Directory setup where the users home directories are
local
to the machine (our faculty often have 10GB+ of data, and some have
laptops).

We were contemplating doing separate user and OS partitions at the same
time
to make any future OS upgrades less painful, without having to worry
about
user data.

Thanks,

David Lundgren
IT Systems Administrator

Brooks Institute - "Passion, Vision, Excellence"
27 East Cota Street
Santa Barbara, CA 93101
(888) 304-3456 (toll-free)
(805) 690-7615 (office)
http://www.brooks.edu

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper





-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/1dbb59a8/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan  6 09:01:43 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 6 Jan 2009 12:01:43 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <4963322A.7141.0039.0@kckps.org>
References: <C587D358.1C4F6%david.lundgren@brooks.edu>
	<ec2e75ff0901060601v6cffca8brf1c9b48deed2705c@mail.gmail.com>
	<4963242E.7141.0039.0@kckps.org>
	<ec2e75ff0901060752v2aa75314pabed7efb23833c6b@mail.gmail.com>
	<4963322A.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901060901k83ac0bbvf1c17584bee2701f@mail.gmail.com>

On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> Users could jack it up them self as well since they own everything.
>

They own /Users/<username>.  They don't own /Users.  <username> should not
be able to affect the /Users symlink.  If your users are admins, you've got
a host of problems and I suggest making a policy stating that no one is an
admin ASAP.  That's a separate discussion though.

On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> I saw so many weird quirks with it when we ran Tiger, and a lot of times it
> would dupe local or mobile accounts to the machine and I would have to go in
> and delete one of them to make the account work again.
>

This was a netinfo issue.  As far as I know, it does not occur in Leopard's
local ds.  Nicole Jacque from Apple distributed a lovely script to handle
this issue.  I'll paste it at the end of this message.  I run this script as
a policy triggered by every15 on a smart group consisting of all tiger
machines.

On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> I don't think diskutility supports live resizing in Tiger
>

It doesn't.  If you're migrating to Leopard, one of the first things I
suggest is to create a Leopard diagnostic/utility/imaging image.  If you
boot your Tiger system from an external drive imaged with this Leopard
image, you can take advantage of Leopard's diskutil command and its live
resizing options.


Plus with all the hard drive failures I see anyway every day on the
> Macbooks, I would really suggest using mobile home directories.  Then you
> can just wipe and resync the home directory and call it a day.
>

Network homes have never been an option in the environments I've worked
with.  The network infrastructure or storage infrastructure (or both) has
been a show-stopper.  Also, if you go this route, you need to resync the
entire home directory after a reimage.  With a separate data partition, you
don't lose time to file copying.  I'm not saying network homes are bad, just
that they don't solve the problem of time lost to data copying.

On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> When you toss these in your production machines, are these servers or are
> these like actual user machines?
>

I only do this for client machines.  Servers have a single "Server HD"
system volume with a default /Users path.  I put any service data and/or
share points on enterprise storage volumes.

On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> I think working in education has made me paranoid since students like to
> tinker, hack, exploit, and crash machines whenever they can.
>

I've worked in K-12 and I agree with you.  Unfortunately, adults aren't
always any better.  I've had to come up with almost as many interesting
management policies and processes in the corporate world as I did in
education.  A good mix of permissions, MCX and Casper policies should
prevent and/or revert any unauthorized tinkering.

# Script to remove 'disabled user' records from local directory

# This should work in both Tiger and Leopard

# Run this script as root or with sudo

#!/bin/sh

for cuser in `dscl . -list /Users AuthenticationAuthority | grep
DisabledUser | awk '{print $1}' | tr '\n' ' '`; do

    dscl . -delete /Users/$cuser

done

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Tue, Jan 6, 2009 at 11:27 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  I guess I would rather do it in DS than by a sym link just because.  Sym
> link goes bad lots of problems I think could happen.  Users could jack it up
> them self as well since they own everything.  Especially with NetInfo.  I
> saw so many weird quirks with it when we ran Tiger, and a lot of times it
> would dupe local or mobile accounts to the machine and I would have to go in
> and delete one of them to make the account work again.  I guess I am just a
> bit paranoid, and I don't like touching anything in production.  I would
> have to fully test the sym link thing heavily before I did it in my live
> environment.  It is good to know it works for you, maybe some day I will try
> it.
>
>  Also, with laptops I don't think diskutility supports live resizing in
> Tiger, so you would have to be a bit more creative because you couldn't have
> a second volume nor could you script something to create a new volume on the
> existing drive in Tiger.  I think that is one of the 300 new features of
> Leopard if I recall, to resize live partitions and create a /users partition
> to house the directory.
>
>  Plus with all the hard drive failures I see anyway every day on the
> Macbooks, I would really suggest using mobile home directories.  Then you
> can just wipe and resync the home directory and call it a day.  The down
> side to that is that a home sync is not a true back up, it is a
> synchronization, which some users just can't quite grasp.
>
>  When you toss these in your production machines, are these servers or are
> these like actual user machines?  I think working in education has made me
> paranoid since students like to tinker, hack, exploit, and crash machines
> whenever they can.
>
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 9:52 AM >>>
>
> I've been doing this in production environments (large enterprises as well
> as my family's Macs) for at least two years on both Tiger and Leopard
> without any issues.  What are the potential issues you're concerned about?
>
>
>   The reason for including the permissions repair is lost to antiquity and
> poor documentation I'm afraid, but I seem to vaguely recall it having
> something to do with the /Users/Shared folder.  Since it works, I'm not
> overly concerned with uncovering the answer, but if you care to, you could
> comment out the permissions repair line and see what the difference is.
>
>
>   Whether netinfo or ds is handling your home folders, it refers to them
> as a filesystem path.  As far as my knowledge and experience goes, there is
> no difference in how home folders function between a system with a genuine
> /Users path and one with a symlinked /Users path.
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Tue, Jan 6, 2009 at 10:28 AM, Thomas Larkin
>
> <tlarki at kckps.org>
>
> wrote:
>
>>  I don't know if I think that is a totally wise idea.  I have read on
>> several occasions either at AFP548.com or macenterprise.org about moving
>> home directories and then connecting them by symbolic link.  While I can't
>> exactly recall the specifics other than it has to do with NetInfo and the
>> location of the home directory or with Open Directory (dscl in 10.5) and how
>> the user database actually points to the home folder.  Also, if I recall
>> diskutility will not repair permissions on user data, it only does it on
>> system data.  I am not saying it won't work, I am just saying there may be
>> some issues as I have read from other people posting and how NetInfo and
>> Open Directory handle the user database.  Please correct me if I am wrong on
>> that, because I have never tried to make a user partition on a local machine
>> just for home directories, well at least not in OS X.  In Linux I have.
>>
>>
>>  If you don't have network homes, or portable home directories I really
>> strongly suggest you look into something like that.  I know that 10gigs of
>> data for each user can eat up storage pretty quick, but storage is actually
>> well, kind of cheap these days.
>>
>>
>>  Over the summer we reimaged 6,000 Macbooks from 10.4 to 10.5.  10.5.4
>> was a damn nightmare but 10.5.5 smoothed most of those things out.  I wiped
>> out all of our servers, reloaded them, and since I house home directories on
>> separate volumes on the network I just pointed in WGM the volume for home
>> directories.  I also recommend a full wipe and fresh import of LDAP.  I just
>> exported mine to plain text (users and groups) and then reimported them via
>> WGM.  This will not preserve passwords, so I did a master password reset.  I
>> have tools now to set unique passwords for users as well, and will be
>> implementing that over next summer.  Next summer I am wiping out everything
>> and freshly loading every thing.
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>> >>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/06/09 8:01 AM >>>
>>
>>
>> If you don't mind doing some extra work now, you can move people's data to
>> another partition now, and in the future, you can do as you like with the
>> system volume going forward without worry about user data.
>>
>>
>>
>>   Note that if you boot an existing Mac (with user data) to a Leopard
>> volume, you can create new partitions non-destructively and this task can be
>> scripted.
>>
>>
>>   I would (and do) do it like this:
>>
>>
>>    #!/bin/sh
>>
>> #
>>
>> ##### HEADER BEGINS #####
>>
>> # scr_sys_symlinkUsers.sh
>>
>> #
>>
>> # Created 20071011 by Miles A. Leacy IV
>>
>> # miles.leacy at themacadmin.com
>>
>> # Modified 20090106 by Miles A. Leacy IV
>>
>> # Copyright 2009 Miles A. Leacy IV
>>
>> #
>>
>> # This script may be copied and distributed freely as long as this header
>> remains intact.
>>
>> #
>>
>> # This script is provided "as is".  The author offers no warranty or
>> guarantee of any kind.
>>
>> # Use of this script is at your own risk.  The author takes no
>> responsibility for loss of use,
>>
>> # loss of data, loss of job, loss of socks, the onset of armageddon, or
>> any other negative effects.
>>
>> #
>>
>> # Test thoroughly in a lab environment before use on production systems.
>>
>> # When you think it's ok, test again.  When you're certain it's ok, test
>> twice more.
>>
>> #
>>
>> # This script moves /Users to /Volumes/Data.  If your data volume is named
>> differently,
>>
>> # be sure to replace each instance of "/Volumes/Data" with the path to
>> your data volume.
>>
>> # Run as an "at reboot" script when imaging with Casper.
>>
>> #
>>
>> ##### HEADER ENDS #####
>>
>>
>>   /bin/mv /Users /Volumes/Data
>>
>>
>>   rm -R /Users
>>
>>
>>   /bin/ln -s /Volumes/Data /Users
>>
>>
>>   diskutil repairPermissions /
>>
>>
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>>   On Mon, Jan 5, 2009 at 4:10 PM, David Lundgren
>>
>> <david.lundgren at brooks.edu>
>>
>> wrote:
>>
>>>  I was wondering how you all have done migrations from Tiger to Leopard.
>>>
>>> We have an Active Directory setup where the users home directories are
>>> local
>>> to the machine (our faculty often have 10GB+ of data, and some have
>>> laptops).
>>>
>>> We were contemplating doing separate user and OS partitions at the same
>>> time
>>> to make any future OS upgrades less painful, without having to worry
>>> about
>>> user data.
>>>
>>> Thanks,
>>>
>>> David Lundgren
>>> IT Systems Administrator
>>>
>>> Brooks Institute - "Passion, Vision, Excellence"
>>> 27 East Cota Street
>>> Santa Barbara, CA 93101
>>> (888) 304-3456 (toll-free)
>>> (805) 690-7615 (office)
>>> http://www.brooks.edu
>>>
>>> _______________________________________________
>>> Casper mailing list
>>> Casper at list.jamfsoftware.com
>>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/e20f8843/attachment.html 

From Tommy.Birchett at martinagency.com  Tue Jan  6 09:37:42 2009
From: Tommy.Birchett at martinagency.com (Tommy Birchett)
Date: Tue, 6 Jan 2009 12:37:42 -0500
Subject: [Casper] Deploy CS4
Message-ID: <C5890116.4EB0%tommy.birchett@martinagency.com>

Has anyone used Casper for deploying CS4? Does it basically work the same as CS3?
--
Tommy Birchett | The Martin Agency| 804-698-8592 | 804-389-3071
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090106/6aa6ff18/attachment.html 

From amir-bozorgzadeh at uiowa.edu  Wed Jan  7 05:57:54 2009
From: amir-bozorgzadeh at uiowa.edu (Bozorgzadeh, Amir J)
Date: Wed, 7 Jan 2009 07:57:54 -0600
Subject: [Casper] CS4
Message-ID: <C58A1102.1A0C1%amir-bozorgzadeh@uiowa.edu>

I am in the process of upgrading several lab machines to CS4.

I created the package and distributed and get a 150:30 error. I sent an email to Jamf and they sent back some fixes for it. The Licensing Service Update worked but is an applescript. The problem is it makes a lot of calls to several scripts so Jamf software says there is no way to make it distributable.

Has anyone had any experience with this? Is anyone getting CS4 to install. My license is a multiple site license if that makes any difference.

Any help would be appreciated.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/cbf2a518/attachment.htm 

From NATHANIEL.LINDLEY at spps.org  Wed Jan  7 06:45:48 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Wed, 7 Jan 2009 08:45:48 -0600
Subject: [Casper] JSS search box
Message-ID: <OF1EFAA22E.C5818915-ON86257537.004FA6D3-86257537.0051C12D@spps.org>

So, I like the new v6 JSS web but what does the search box in the top 
right actually do?    I type in "word" and it gives me the File Servers 
link and JSS Accounts.  I was hoping it would be a shortcut to Inventory 
search so that I can type an Asset Tag  in the search box and go right to 
that machine, instead of clicking Inventory and then the tag and then 
search.  Feature request I guess.

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/5c098aac/attachment.htm 

From ERNSTCS at uwec.edu  Wed Jan  7 06:56:56 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Wed, 7 Jan 2009 08:56:56 -0600
Subject: [Casper] JSS search box
In-Reply-To: <OF1EFAA22E.C5818915-ON86257537.004FA6D3-86257537.0051C12D@spps.org>
Message-ID: <C58A1ED8.123E2%ernstcs@uwec.edu>

That's meant to allow you to quickly locate a section within the JSS, like Directory Bindings. So if you typed in Directory and searched you'd get the Directory Bindings section listed.

The search that you want is strictly in the Inventory tab.

I could see that search box being convenient to search at minimum inventory for one less click into the inventory tab.

Craig


On 1/7/09 8:45 AM, "Nathaniel Lindley" <NATHANIEL.LINDLEY at spps.org> wrote:


So, I like the new v6 JSS web but what does the search box in the top right actually do?    I type in "word" and it gives me the File Servers link and JSS Accounts.  I was hoping it would be a shortcut to Inventory search so that I can type an Asset Tag  in the search box and go right to that machine, instead of clicking Inventory and then the tag and then search.  Feature request I guess.

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/1d038014/attachment.html 

From amir-bozorgzadeh at uiowa.edu  Wed Jan  7 10:25:56 2009
From: amir-bozorgzadeh at uiowa.edu (Bozorgzadeh, Amir J)
Date: Wed, 7 Jan 2009 12:25:56 -0600
Subject: [Casper] CS4
Message-ID: <C58A4FD4.1A0DD%amir-bozorgzadeh@uiowa.edu>

I am in the process of upgrading several lab machines to CS4.

I created the package and distributed and get a 150:30 error. I sent an email to Jamf and they sent back some fixes for it. The Licensing Service Update worked but is an applescript. The problem is it makes a lot of calls to several scripts so Jamf software says there is no way to make it distributable.

Has anyone had any experience with this? Is anyone getting CS4 to install. My license is a multiple site license if that makes any difference.

Any help would be appreciated.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/8765979c/attachment.html 

From rharter at uwsp.edu  Wed Jan  7 11:22:18 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 7 Jan 2009 13:22:18 -0600
Subject: [Casper] CS4
In-Reply-To: <C58A4FD4.1A0DD%amir-bozorgzadeh@uiowa.edu>
References: <C58A4FD4.1A0DD%amir-bozorgzadeh@uiowa.edu>
Message-ID: <25F354AD-DBA0-4197-B6AF-F08AC2ADF05E@uwsp.edu>

I'm currently testing it out right now.  How are you doing it.  Are  
you making dmg's and using Casper's Adobe Install just like CS3 or are  
you using the Deployment Utils from Adobe and using a custom policy?

I'm planning on making a Deployment package and a custom policy that  
will copy the installer and run the AdobeUberInstaller application for  
silent install.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 7, 2009, at 12:25 PM, Bozorgzadeh, Amir J wrote:

> I am in the process of upgrading several lab machines to CS4.
>
> I created the package and distributed and get a 150:30 error. I sent  
> an email to Jamf and they sent back some fixes for it. The Licensing  
> Service Update worked but is an applescript. The problem is it makes  
> a lot of calls to several scripts so Jamf software says there is no  
> way to make it distributable.
>
> Has anyone had any experience with this? Is anyone getting CS4 to  
> install. My license is a multiple site license if that makes any  
> difference.
>
> Any help would be appreciated.
>
> Thanks.
> Amir Bozorgzadeh
> Campus Technology Services
> University of Iowa
> 2800 UCC
> Iowa City, Iowa 52242
> 319-335-5480
>
>
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/2257e1a6/attachment.htm 

From rharter at uwsp.edu  Wed Jan  7 11:41:39 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 7 Jan 2009 13:41:39 -0600
Subject: [Casper] CS4
In-Reply-To: <C58A5DD3.1A0E8%amir-bozorgzadeh@uiowa.edu>
References: <C58A5DD3.1A0E8%amir-bozorgzadeh@uiowa.edu>
Message-ID: <5FD1ED6B-C082-4C2D-8F5F-FF95E4F3C42C@uwsp.edu>

If you have site licensing then you should have gotten an Adobe CS4  
Deployment Toolkit disk with your dvd's.  I just used that to create  
the package.

AFAIK Adobe licenses go into a database on the client, so if you make  
a package for that, the database won't work quite right, and if you  
make more than one package then one will overwrite the shared  
database.  We used to get around this by packaging them all on the  
same machine and making sure they went in the same order every time.   
That was in the CS2 days, however.

The Deployment toolkit makes a package (really just a folder) that  
contains:
/AdobeUberInstaller
/AdobeUberUninstaller
/AdobeUberInstaller.xml
/AdobeUberUninstaller.xml

The xml files point to the installer, which can be on an afp share,  
and running the AdobeUberInstaller as root runs a silent install and  
lets you suppress the EULA, etc.  My plan is to write a script that  
will:

1. Either use casper to copy the deployment package down or just mount  
a share to do it.
2. Run /AdobeUberInstaller
3. srm /CS4 Deployment Package

As far as I can think, it should be as simple as that.  Perhaps some  
extra testing to make sure we don't screw anything up, but that should  
be it.

What do you think?  Has anyone tried anything similar?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 7, 2009, at 1:25 PM, Bozorgzadeh, Amir J wrote:

> I did it pretty straight forward. I used composer installed CS4 and  
> all updates. Ran all apps.
>
> This did not work. Or at least I get the licensing error I  
> mentioned. Adobe installer on Casper does not work. It does not  
> support CS4. Errors that it is not an Adobe installer. Jamf Software  
> verified this and said the next version will support CS4.
>
> Let me know how your testing goes. Where do I find info on the Uber  
> installer I keep hearing about? I am not familiar with it.
>
> Thanks for response,
> Amir
>
>
> On 1/7/09 1:22 PM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>
> I'm currently testing it out right now.  How are you doing it.  Are  
> you making dmg's and using Casper's Adobe Install just like CS3 or  
> are you using the Deployment Utils from Adobe and using a custom  
> policy?
>
> I'm planning on making a Deployment package and a custom policy that  
> will copy the installer and run the AdobeUberInstaller application  
> for silent install.
>
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>
>
> On Jan 7, 2009, at 12:25 PM, Bozorgzadeh, Amir J wrote:
>
> I am in the process of upgrading several lab machines to CS4.
>
>  I created the package and distributed and get a 150:30 error. I  
> sent an email to Jamf and they sent back some fixes for it. The  
> Licensing Service Update worked but is an applescript. The problem  
> is it makes a lot of calls to several scripts so Jamf software says  
> there is no way to make it distributable.
>
>  Has anyone had any experience with this? Is anyone getting CS4 to  
> install. My license is a multiple site license if that makes any  
> difference.
>
>  Any help would be appreciated.
>
>  Thanks.
>
> Amir Bozorgzadeh
>  Campus Technology Services
>  University of Iowa
>  2800 UCC
>  Iowa City, Iowa 52242
>  319-335-5480
>
>
>
>
>
>   <ATT00001.txt>
>
>
>
> Amir Bozorgzadeh
> Campus Technology Services
> University of Iowa
> 2800 UCC
> Iowa City, Iowa 52242
> 319-335-5480
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/4c929c23/attachment.htm 

From bkvines at wgclawfirm.com  Wed Jan  7 13:51:11 2009
From: bkvines at wgclawfirm.com (Bryan Vines)
Date: Wed, 7 Jan 2009 15:51:11 -0600
Subject: [Casper] Upgrading from Tiger to Leopard
Message-ID: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>

David,

We began exploring the idea of having the user data on a separate  
partition for the same reason -- future OS upgrades will hopefully be  
less painful. We have been using a three-partition scheme: Restore,  
Macintosh HD, and Data.

Our partition sizes are:
     Restore: 15GB
     Macintosh HD: 30GB or so
     Data: The rest of the drive.

We've found we need at least an 80GB drive to allow the users about  
30GB of space. We deployed a few Tiger machines with this partitioning  
scheme, but then we went ahead and switched to deploying Leopard  
(mostly because of laptops which would only run Leopard).

User homes go on Data, so if the main boot partition ends up hosed, we  
can restore it from our standard configuration and get the user up and  
running again with a minimum of fuss.

We're now moving our older installed base to Leopard. We have to go  
touch each machine, either to repartition its hard drive or install a  
larger one. We're hoping we won't have to do that when Snow Leopard  
rolls around.

--
Bryan Vines
bkvines at wgclawfirm.com


> From: David Lundgren <david.lundgren at brooks.edu>
> Subject: [Casper] Upgrading from Tiger to Leopard
>
> I was wondering how you all have done migrations from Tiger to  
> Leopard.
>
> We have an Active Directory setup where the users home directories  
> are local
> to the machine (our faculty often have 10GB+ of data, and some have
> laptops).
>
> We were contemplating doing separate user and OS partitions at the  
> same time
> to make any future OS upgrades less painful, without having to worry  
> about
> user data.
>
> Thanks,
>
> David Lundgren
> IT Systems Administrator

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/99cfcbd0/attachment.htm 

From miles.leacy at themacadmin.com  Wed Jan  7 14:02:20 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 7 Jan 2009 17:02:20 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
Message-ID: <ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>

This is very similar to my client setups.
I give Macintosh HD 20GB on 80GB drives, 40GB on all others.

I strongly recommend using a Restore partition unless you have a robust
network and a netboot server.  Even if you do use netboot on site, having a
restore partition can get you out of a jam with a mobile user on the road.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/7 Bryan Vines <bkvines at wgclawfirm.com>

> David,
> We began exploring the idea of having the user data on a separate partition
> for the same reason -- future OS upgrades will hopefully be less painful. We
> have been using a three-partition scheme: Restore, Macintosh HD, and Data.
>
> Our partition sizes are:
>     Restore: 15GB
>     Macintosh HD: 30GB or so
>     Data: The rest of the drive.
>
> We've found we need at least an 80GB drive to allow the users about 30GB of
> space. We deployed a few Tiger machines with this partitioning scheme, but
> then we went ahead and switched to deploying Leopard (mostly because of
> laptops which would only run Leopard).
>
> User homes go on Data, so if the main boot partition ends up hosed, we can
> restore it from our standard configuration and get the user up and running
> again with a minimum of fuss.
>
> We're now moving our older installed base to Leopard. We have to go touch
> each machine, either to repartition its hard drive or install a larger one.
> We're hoping we won't have to do that when Snow Leopard rolls around.
>
> --
> Bryan Vines
> bkvines at wgclawfirm.com
>
>
> From: David Lundgren <david.lundgren at brooks.edu>
> Subject: [Casper] Upgrading from Tiger to Leopard
>
> I was wondering how you all have done migrations from Tiger to Leopard.
>
> We have an Active Directory setup where the users home directories are
> local
> to the machine (our faculty often have 10GB+ of data, and some have
> laptops).
>
> We were contemplating doing separate user and OS partitions at the same
> time
> to make any future OS upgrades less painful, without having to worry about
> user data.
>
> Thanks,
>
> David Lundgren
> IT Systems Administrator
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090107/fe78801f/attachment.htm 

From tlarki at kckps.org  Thu Jan  8 08:07:39 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 08 Jan 2009 10:07:39 -0600
Subject: [Casper] Self Service Feature REQ
Message-ID: <4965D06B.7141.0039.0@kckps.org>

So, 

It has come to my attention that certain users may need certain software and licenses are limited.  Instead of me doing bunches of manual data entries and finding out all the individual laptops (out of 6,000) and creating a smart group out of them, I would like the idea of putting a password on a self service install.  Then giving that password to that class, and so the students in that particular class can install it with their password.  Then make a smart group of all users that have that application installed to track the licenses.  I was talking to a teacher who wanted to buy 30 copies of some accounting software for a class.  I was dreading the thought of me having to track down each student, the asset tag of their computer, and creating yet another smart group, then I thought if I could just put like a password on the self service install, the student could install it them self with that password. 

I know that working in a 1:1 is way different but I have users that may switch laptops due to hardware failure and I just want them to be able to install it on whatever laptop they are given.  In many cases when a laptop goes out for repair a spare is issued.   

Thoughts? 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/f26c20d1/attachment.html 

From NATHANIEL.LINDLEY at spps.org  Thu Jan  8 08:17:39 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Thu, 8 Jan 2009 10:17:39 -0600
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <4965D06B.7141.0039.0@kckps.org>
Message-ID: <OFB7C4E7F8.9BE41541-ON86257538.005945B9-86257538.005A2B07@spps.org>

Tom,
Not sure if this would work, but could you create a user group that is 
allowed certain policies for self-service?   In AD we have a building tech 
group that can install apps that are licensed like Office, but that 
install is not available to anonymous.  I would think I could have a group 
in AD for the users that need that app and then maybe grant rights to that 
group to execute the install policy? 
I haven't tried it so I'm not sure if that would work.  And a single 
password would be much simpler, especially since you could disable the 
policy after the correct number of licenses have been installed. 


Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861



"Thomas Larkin" <tlarki at kckps.org> 
Sent by: casper-bounces at list.jamfsoftware.com
01/08/2009 10:00 AM

To
<casper at list.jamfsoftware.com>
cc

Subject
[Casper] Self Service Feature REQ






So, 

It has come to my attention that certain users may need certain software 
and licenses are limited.  Instead of me doing bunches of manual data 
entries and finding out all the individual laptops (out of 6,000) and 
creating a smart group out of them, I would like the idea of putting a 
password on a self service install.  Then giving that password to that 
class, and so the students in that particular class can install it with 
their password.  Then make a smart group of all users that have that 
application installed to track the licenses.  I was talking to a teacher 
who wanted to buy 30 copies of some accounting software for a class.  I 
was dreading the thought of me having to track down each student, the 
asset tag of their computer, and creating yet another smart group, then I 
thought if I could just put like a password on the self service install, 
the student could install it them self with that password. 

I know that working in a 1:1 is way different but I have users that may 
switch laptops due to hardware failure and I just want them to be able to 
install it on whatever laptop they are given.  In many cases when a laptop 
goes out for repair a spare is issued.   

Thoughts? 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351




_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/4a42fc17/attachment.htm 

From jstrauss at loyolahs.edu  Thu Jan  8 08:30:38 2009
From: jstrauss at loyolahs.edu (Jeff Strauss)
Date: Thu, 8 Jan 2009 08:30:38 -0800
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <4965D06B.7141.0039.0@kckps.org>
References: <4965D06B.7141.0039.0@kckps.org>
Message-ID: <8624C018-2041-4EDA-9B94-5164D5537405@loyolahs.edu>

Just a thought, and this is probably not very elegant, but it may work...

Can you get a list of the students in the class from the teacher and then create a smart group for computers with those logged-in users? Or manually search the inventory for users and match those to asset tags? I'm not in front of my JSS at the moment so I don't know if those options are feasible.

Do students in your environment go home with their laptops or are they issued a random one on a daily basis?

Jeff

Sent from my iPhone 3G

On Jan 8, 2009, at 8:11 AM, "Thomas Larkin" <tlarki at kckps.org<mailto:tlarki at kckps.org>> wrote:


So,


It has come to my attention that certain users may need certain software and licenses are limited.  Instead of me doing bunches of manual data entries and finding out all the individual laptops (out of 6,000) and creating a smart group out of them, I would like the idea of putting a password on a self service install.  Then giving that password to that class, and so the students in that particular class can install it with their password.  Then make a smart group of all users that have that application installed to track the licenses.  I was talking to a teacher who wanted to buy 30 copies of some accounting software for a class.  I was dreading the thought of me having to track down each student, the asset tag of their computer, and creating yet another smart group, then I thought if I could just put like a password on the self service install, the student could install it them self with that password.


I know that working in a 1:1 is way different but I have users that may switch laptops due to hardware failure and I just want them to be able to install it on whatever laptop they are given.  In many cases when a laptop goes out for repair a spare is issued.


Thoughts?

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
<mailto:tlarki at kckps.org>tlarki at kckps.org<mailto:tlarki at kckps.org>
blackberry:  913-449-7589
office:  913-627-0351





<ATT00001.c>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/22f96728/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan  8 08:36:33 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 8 Jan 2009 11:36:33 -0500
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <4965D06B.7141.0039.0@kckps.org>
References: <4965D06B.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901080836w2b7d3af2lf51ba45fd651b94b@mail.gmail.com>

Presumably, you have a record of which machine was issued to whom (Ideally,
that info is stored in the JSS).

In the case you describe, I would suggest creating a manual group of the 30
machines intended to receive the software.

This doesn't address your stated desire to give a client the ability to
reinstall the app on any machine they use.  To do that may take a few steps,
but I think you could get there with relative ease.  I am assuming you are
using some variety of LDAP, likely Active Directory or Open Directory.

Here's what I'd do:
1  Create an LDAP group consisting of the people who should have this
software.
2  a  Create a script that queries for the logged-in user's groups.  If your
"accounting software" group is found, the script issues a custom trigger for
the installation.  Run this script with a policy triggered by login, once
per user.
    b  If you want to keep the self-service aspect, have the custom trigger
in the script above kick off the installation of an empty package instead of
the accounting software.  Use the receipt from that empty package as the
criterion for a smart group to which the self-service policy is scoped.

I hope this helps.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/8 Thomas Larkin <tlarki at kckps.org>

>  So,
>
>  It has come to my attention that certain users may need certain software
> and licenses are limited.  Instead of me doing bunches of manual data
> entries and finding out all the individual laptops (out of 6,000) and
> creating a smart group out of them, I would like the idea of putting a
> password on a self service install.  Then giving that password to that
> class, and so the students in that particular class can install it with
> their password.  Then make a smart group of all users that have that
> application installed to track the licenses.  I was talking to a teacher who
> wanted to buy 30 copies of some accounting software for a class.  I was
> dreading the thought of me having to track down each student, the asset tag
> of their computer, and creating yet another smart group, then I thought if I
> could just put like a password on the self service install, the student
> could install it them self with that password.
>
>  I know that working in a 1:1 is way different but I have users that may
> switch laptops due to hardware failure and I just want them to be able to
> install it on whatever laptop they are given.  In many cases when a laptop
> goes out for repair a spare is issued.
>
>  Thoughts?
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/ef884a0d/attachment.html 

From rharter at uwsp.edu  Thu Jan  8 08:41:47 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Thu, 8 Jan 2009 10:41:47 -0600
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <ec2e75ff0901080836w2b7d3af2lf51ba45fd651b94b@mail.gmail.com>
References: <4965D06B.7141.0039.0@kckps.org>
	<ec2e75ff0901080836w2b7d3af2lf51ba45fd651b94b@mail.gmail.com>
Message-ID: <040528D5-FB1F-4F83-8FBA-BAA6820CDC4F@uwsp.edu>

I could be wrong, but can't you just require the user to login to self  
service and scope the policy to a specific group of users?  That way  
no matter what computer they're on, they can get it and it won't  
appear for anyone else.

I would think, assuming this is accurate, that this would be an easy  
solution because there is no shared password and they would just log  
on with their normal domain credentials.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 8, 2009, at 10:36 AM, Miles Leacy wrote:

> Presumably, you have a record of which machine was issued to whom  
> (Ideally, that info is stored in the JSS).
>
> In the case you describe, I would suggest creating a manual group of  
> the 30 machines intended to receive the software.
>
> This doesn't address your stated desire to give a client the ability  
> to reinstall the app on any machine they use.  To do that may take a  
> few steps, but I think you could get there with relative ease.  I am  
> assuming you are using some variety of LDAP, likely Active Directory  
> or Open Directory.
>
> Here's what I'd do:
> 1  Create an LDAP group consisting of the people who should have  
> this software.
> 2  a  Create a script that queries for the logged-in user's groups.   
> If your "accounting software" group is found, the script issues a  
> custom trigger for the installation.  Run this script with a policy  
> triggered by login, once per user.
>     b  If you want to keep the self-service aspect, have the custom  
> trigger in the script above kick off the installation of an empty  
> package instead of the accounting software.  Use the receipt from  
> that empty package as the criterion for a smart group to which the  
> self-service policy is scoped.
>
> I hope this helps.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/8 Thomas Larkin <tlarki at kckps.org>
> So,
>
> It has come to my attention that certain users may need certain  
> software and licenses are limited.  Instead of me doing bunches of  
> manual data entries and finding out all the individual laptops (out  
> of 6,000) and creating a smart group out of them, I would like the  
> idea of putting a password on a self service install.  Then giving  
> that password to that class, and so the students in that particular  
> class can install it with their password.  Then make a smart group  
> of all users that have that application installed to track the  
> licenses.  I was talking to a teacher who wanted to buy 30 copies of  
> some accounting software for a class.  I was dreading the thought of  
> me having to track down each student, the asset tag of their  
> computer, and creating yet another smart group, then I thought if I  
> could just put like a password on the self service install, the  
> student could install it them self with that password.
>
> I know that working in a 1:1 is way different but I have users that  
> may switch laptops due to hardware failure and I just want them to  
> be able to install it on whatever laptop they are given.  In many  
> cases when a laptop goes out for repair a spare is issued.
>
> Thoughts?
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/bed041fb/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan  8 09:02:39 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 8 Jan 2009 12:02:39 -0500
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <4965DA40.7141.0039.0@kckps.org>
References: <4965D06B.7141.0039.0@kckps.org>
	<ec2e75ff0901080836w2b7d3af2lf51ba45fd651b94b@mail.gmail.com>
	<4965DA40.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901080902y28232b02l9ebb5d678823f6e4@mail.gmail.com>

Only you know your environment and workflow, but it would seem to my eye
that the process you describe would save work on the front end only to
create work on the back end.
As I see the options, you can take steps to ensure the software is only
deployed to the appropriate users or you can take steps to clean up after
any unauthorized or otherwise undesired installs.  If you use a password to
enable a self-service policy, people may (and by may, I mean will) share the
password with individuals for whom no licenses were purchased and you'll get
unwanted installs which you will then have to track down and uninstall.  If
you use groups, only those people logging in with the correct account will
get the install.

Again, you know your environment better than anyone on the outside, but it
appears from my point of view that the groups method will be the easiest in
the long run.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 8, 2009 at 11:49 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  Those are all good ideas, and ideas I have already thought of.  Here in
> lies the problem though.  There are 5 of us for 6,000 laptops.  I am so busy
> with other things I don't want to have to deal with doing custom groups for
> this and that because once I do this for one group of students pandora's box
> will be open.  Then every department will want it and i will be doing these
> lits all the time.
>
>  I would much rather create a self service install, put a password on it,
> give that password to the teacher then make smart groups that list all
> machines that have it installed.  Then I can track it down that way, and
> also have casper uninstall it on machines that don't need it.  Lots of
> educational software is developed very poorly for enterprise type installs
> and is a pain.  The licensing is also somewhat ridiculous and not caught up
> to schools that do 1:1 deployments.
>
>  To give you an idea I have about 100 laptops in repair at any given time
> and 100 spares issued.  Sometimes less, sometimes a bit more, it just
> depends.  I get them back I have to reimage them make sure it was fixed
> properly, make sure it can log in, etc etc.
>
>  Basically, I just want to keep it simple and make it as easy as possible.
>
>  Thanks for your guy's tips though.
>
> >>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/08/09 10:36 AM >>>
>
> Presumably, you have a record of which machine was issued to whom (Ideally,
> that info is stored in the JSS).
>
>
>   In the case you describe, I would suggest creating a manual group of the
> 30 machines intended to receive the software.
>
>
>   This doesn't address your stated desire to give a client the ability to
> reinstall the app on any machine they use.  To do that may take a few steps,
> but I think you could get there with relative ease.  I am assuming you are
> using some variety of LDAP, likely Active Directory or Open Directory.
>
>
>   Here's what I'd do:
>
> 1  Create an LDAP group consisting of the people who should have this
> software.
>
> 2  a  Create a script that queries for the logged-in user's groups.  If
> your "accounting software" group is found, the script issues a custom
> trigger for the installation.  Run this script with a policy triggered by
> login, once per user.
>
>     b  If you want to keep the self-service aspect, have the custom trigger
> in the script above kick off the installation of an empty package instead of
> the accounting software.  Use the receipt from that empty package as the
> criterion for a smart group to which the self-service policy is scoped.
>
>
>   I hope this helps.
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   2009/1/8 Thomas Larkin
>
> <tlarki at kckps.org>
>
>
>   So,
>>
>>
>>  It has come to my attention that certain users may need certain software
>> and licenses are limited.  Instead of me doing bunches of manual data
>> entries and finding out all the individual laptops (out of 6,000) and
>> creating a smart group out of them, I would like the idea of putting a
>> password on a self service install.  Then giving that password to that
>> class, and so the students in that particular class can install it with
>> their password.  Then make a smart group of all users that have that
>> application installed to track the licenses.  I was talking to a teacher who
>> wanted to buy 30 copies of some accounting software for a class.  I was
>> dreading the thought of me having to track down each student, the asset tag
>> of their computer, and creating yet another smart group, then I thought if I
>> could just put like a password on the self service install, the student
>> could install it them self with that password.
>>
>>
>>  I know that working in a 1:1 is way different but I have users that may
>> switch laptops due to hardware failure and I just want them to be able to
>> install it on whatever laptop they are given.  In many cases when a laptop
>> goes out for repair a spare is issued.
>>
>>
>>  Thoughts?
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/e0636f2a/attachment.html 

From jared.nichols at ll.mit.edu  Thu Jan  8 09:23:53 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 8 Jan 2009 12:23:53 -0500
Subject: [Casper] Wake On LAN
Message-ID: <C58BA0D9.17BFF%jared.nichols@ll.mit.edu>

Is there any mechanism that folks know of to do wake on lan in Casper?  I can't seem to find anything in the documentation.  Or, do folks leave this up to ARD?

Thanks!

j
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/d014014d/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan  8 09:40:36 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 8 Jan 2009 12:40:36 -0500
Subject: [Casper] Wake On LAN
In-Reply-To: <C58BA0D9.17BFF%jared.nichols@ll.mit.edu>
References: <C58BA0D9.17BFF%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901080940g4ddfc4c1r9c3fcb3890517e66@mail.gmail.com>

I don't recall anything specifically in the Casper tools, however, if you
define a maintenance window, you could use a pmset script to ensure
computers are on and awake at a certain time.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/8 Nichols, Jared <jared.nichols at ll.mit.edu>

>  Is there any mechanism that folks know of to do wake on lan in Casper?  I
> can't seem to find anything in the documentation.  Or, do folks leave this
> up to ARD?
>
> Thanks!
>
> j
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/cce71fa8/attachment.htm 

From greg.lopez at wunderman.com  Thu Jan  8 12:21:16 2009
From: greg.lopez at wunderman.com (Gregory Lopez)
Date: Thu, 08 Jan 2009 12:21:16 -0800
Subject: [Casper] NAV 11 preventing ssh connections in Leopard
Message-ID: <C58BA03C.17F2%greg.lopez@wunderman.com>

Greetings.  I have a problem where Norton AntiVirus 11 is preventing ssh
connections on my Leopard macs (including my own) which in turn is
preventing me from using Casper to deploy software updates.  I've made sure
Remote Login is on and that the Firewall is allowing connections.

It's as if port 22 keeps toggling off despite the GUI saying otherwise.
Here's the message I get when I try to ssh into one of the macs:
XXX-XXXXX:~ xxxxxxxx$ ssh -vvv x.x.x.x
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to x.x.x.x http://x.x.x.x port 22.
debug1: connect to address x.x.x.x port 22: Connection refused
ssh: connect to host x.x.x.x port 22: Connection refused

The problem goes away when I uninstall NAV 11.  It temporarily goes away
when I run Disk Utility and repair disk permissions.  I am able to ssh in
for about 10-15 minutes before my connection is refused.  Here??s a log:

Repairing permissions for ??Macintosh HD??
Reading permissions database.
Reading the permissions database can take several minutes.

User differs on "private/etc/hostconfig", should be 0, user is 99.
Group differs on "private/etc/hostconfig", should be 0, group is 99.
User differs on "System/Library/LaunchDaemons/ssh.plist", should be 0, user
is 99.
Group differs on "System/Library/LaunchDaemons/ssh.plist", should be 0,
group is 99.
Group differs on "private/etc/cups", should be 0, group is 26.
Permissions differ on "private/var/spool/cups/cache/rss", should be
drwxr-xr-x , they are drwxrwxr-x .

Permissions repair complete

This problem is consistent from 10.5-10.5.6.  Anyone else run into this one?

G Lo
--
Gregory Lopez
Sr. Mac/Network Analyst
Wunderman - Seattle




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/16a34bd5/attachment.html 

From jeremymatthews at mac.com  Thu Jan  8 13:04:03 2009
From: jeremymatthews at mac.com (Jeremy Matthews)
Date: Thu, 08 Jan 2009 16:04:03 -0500
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <mailman.11.1231444812.22339.casper@list.jamfsoftware.com>
References: <mailman.11.1231444812.22339.casper@list.jamfsoftware.com>
Message-ID: <B2F50B90-930A-43B1-846F-C1421BC1207B@mac.com>

Since this is more or less a desire to limit the scope of an install,  
is it possible to create a network segment just for that class, and  
use it as the filter? You could limit DHCP expirations to something  
like an hour, or immediate (depending on the equipment) - just long  
enough to grab some software and install. No mucking around with  
groups and other such nonsense - more or less a giant filter is  
enabled without you having to know the details.

You could patch in a local subnet or VLAN (wired), or setup a WAP and  
give it a temporary password (put it on the blackboard or something  
simple) - set the policy in casper to allow self-service for that  
policy within that network seg.

Since this gets into the network side of life...you never know -  
depends on how nice those guys play. Then, when no longer needed, turn  
it off.

-j

From tlarki at kckps.org  Thu Jan  8 14:01:29 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 08 Jan 2009 16:01:29 -0600
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <B2F50B90-930A-43B1-846F-C1421BC1207B@mac.com>
References: <mailman.11.1231444812.22339.casper@list.jamfsoftware.com>
	<B2F50B90-930A-43B1-846F-C1421BC1207B@mac.com>
Message-ID: <49662359.7141.0039.0@kckps.org>

That would work but we run Layer3 VLANs here so the user keeps their first IP they get, which could be on a VLAN on the other side of the network.  Like I said, I am special, short bus special, because my users roam around in user space with laptops hahahaha.  I wish it was static desktops on set VLANs, life would be a walk in the park, and well boring too.  If I had more help it would be easier to get some things done as well, but 6,000 laptops and 6 guys running the show you tend to have to do all sorts of things all day every day.   

There is not a day that goes by that I don't reimage at least 10 laptops for whatever reason.  I probably have casper imaging nightmares by now, but luckily my conscious blocks it. 

I am just trying to figure out how to deploy educational software, which isn't developed for mass deployment in the first place to roaming users that could be anywhere at any given time on our network. 

The password thing was the first thing that came to mind.  Even the ones I have out now, looking at policy logs, kids don't install a text book if they don't need it.  I am not too worried about that, but some things I would want to limit with maybe a password.  It was just an idea, and I will try to think of other ways.  Since they can be anywhere at any time with their laptop I wanted to do self service since they could do it from anywhere in our network that way.

>>> Jeremy Matthews <jeremymatthews at mac.com> 01/08/09 3:04 PM >>>
Since this is more or less a desire to limit the scope of an install, 
is it possible to create a network segment just for that class, and 
use it as the filter? You could limit DHCP expirations to something 
like an hour, or immediate (depending on the equipment) - just long 
enough to grab some software and install. No mucking around with 
groups and other such nonsense - more or less a giant filter is 
enabled without you having to know the details.

You could patch in a local subnet or VLAN (wired), or setup a WAP and 
give it a temporary password (put it on the blackboard or something 
simple) - set the policy in casper to allow self-service for that 
policy within that network seg.

Since this gets into the network side of life...you never know - 
depends on how nice those guys play. Then, when no longer needed, turn 
it off.

-j

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/96130484/attachment.htm 

From jared.nichols at ll.mit.edu  Thu Jan  8 17:11:30 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 8 Jan 2009 20:11:30 -0500
Subject: [Casper] NAV 11 preventing ssh connections in Leopard
In-Reply-To: <C58BA03C.17F2%greg.lopez@wunderman.com>
Message-ID: <C58C0E72.17C20%jared.nichols@ll.mit.edu>

With NAV functioning ??properly?? can you do a sudo ipfw list and post the results?

Thanks

j


On 1/8/09 15:21 , "Gregory Lopez" <greg.lopez at wunderman.com> wrote:

Greetings.  I have a problem where Norton AntiVirus 11 is preventing ssh connections on my Leopard macs (including my own) which in turn is preventing me from using Casper to deploy software updates.  I've made sure Remote Login is on and that the Firewall is allowing connections.

It's as if port 22 keeps toggling off despite the GUI saying otherwise. Here's the message I get when I try to ssh into one of the macs:
XXX-XXXXX:~ xxxxxxxx$ ssh -vvv x.x.x.x
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to x.x.x.x http://x.x.x.x port 22.
debug1: connect to address x.x.x.x port 22: Connection refused
ssh: connect to host x.x.x.x port 22: Connection refused

The problem goes away when I uninstall NAV 11.  It temporarily goes away when I run Disk Utility and repair disk permissions.  I am able to ssh in for about 10-15 minutes before my connection is refused.  Here??s a log:

Repairing permissions for ??Macintosh HD??
Reading permissions database.
Reading the permissions database can take several minutes.

User differs on "private/etc/hostconfig", should be 0, user is 99.
Group differs on "private/etc/hostconfig", should be 0, group is 99.
User differs on "System/Library/LaunchDaemons/ssh.plist", should be 0, user
is 99.
Group differs on "System/Library/LaunchDaemons/ssh.plist", should be 0,
group is 99.
Group differs on "private/etc/cups", should be 0, group is 26.
Permissions differ on "private/var/spool/cups/cache/rss", should be
drwxr-xr-x , they are drwxrwxr-x .

Permissions repair complete

This problem is consistent from 10.5-10.5.6.  Anyone else run into this one?

G Lo
--
Gregory Lopez
Sr. Mac/Network Analyst
Wunderman - Seattle





--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/69ab43d5/attachment.html 

From jared.nichols at ll.mit.edu  Thu Jan  8 17:15:35 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 8 Jan 2009 20:15:35 -0500
Subject: [Casper] Self Service Feature REQ
In-Reply-To: <49662359.7141.0039.0@kckps.org>
Message-ID: <C58C0F67.17C22%jared.nichols@ll.mit.edu>

It almost sounds like you have a need for a keyserver.  Are there other pieces of software that could benefit from keying?  I've played around with K2 and it seemed to work well, independently of whether or not the software was key aware.

j


On 1/8/09 17:01 , "Thomas Larkin" <tlarki at kckps.org> wrote:



 That would work but we run Layer3 VLANs here so the user keeps their first IP they get, which could be on a VLAN on the other side of the network.  Like I said, I am special, short bus special, because my users roam around in user space with laptops hahahaha.  I wish it was static desktops on set VLANs, life would be a walk in the park, and well boring too.  If I had more help it would be easier to get some things done as well, but 6,000 laptops and 6 guys running the show you tend to have to do all sorts of things all day every day.



 There is not a day that goes by that I don't reimage at least 10 laptops for whatever reason.  I probably have casper imaging nightmares by now, but luckily my conscious blocks it.



 I am just trying to figure out how to deploy educational software, which isn't developed for mass deployment in the first place to roaming users that could be anywhere at any given time on our network.



 The password thing was the first thing that came to mind.  Even the ones I have out now, looking at policy logs, kids don't install a text book if they don't need it.  I am not too worried about that, but some things I would want to limit with maybe a password.  It was just an idea, and I will try to think of other ways.  Since they can be anywhere at any time with their laptop I wanted to do self service since they could do it from anywhere in our network that way.

>>> Jeremy Matthews <jeremymatthews at mac.com> 01/08/09 3:04 PM >>>
Since this is more or less a desire to limit the scope of an install,
is it possible to create a network segment just for that class, and
use it as the filter? You could limit DHCP expirations to something
like an hour, or immediate (depending on the equipment) - just long
enough to grab some software and install. No mucking around with
groups and other such nonsense - more or less a giant filter is
enabled without you having to know the details.

You could patch in a local subnet or VLAN (wired), or setup a WAP and
give it a temporary password (put it on the blackboard or something
simple) - set the policy in casper to allow self-service for that
policy within that network seg.

Since this gets into the network side of life...you never know -
depends on how nice those guys play. Then, when no longer needed, turn
it off.

-j



--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090108/79ca843b/attachment.htm 

From daniel.farnworth at thecreativepartnership.co.uk  Fri Jan  9 04:19:00 2009
From: daniel.farnworth at thecreativepartnership.co.uk (Daniel Farnworth)
Date: Fri, 9 Jan 2009 12:19:00 +0000
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
Message-ID: <353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>

Just chiming in with my 2 pence worth, we approach this in a slightly  
different way for a number of reasons.

I'm not sure about other applications, but we discovered that Avid  
applications do not like symlinks when it comes to /Users which they  
still rather irritatingly use to store various things (mostly in / 
Users/Shared)

What we do instead is have a separate Homes or Data partition and  
then use fstab to mount this directly to /Users, this gives us the  
best of both worlds, user data on a separate volume and no symlinks  
involved. It also this works a treat for the Avid apps as they just  
see that the /Users directory is in the correct place. I have a pre- 
install script that we use to do this for us if anyone is interested.

Cheers
Dan

On 7 Jan 2009, at 22:02, Miles Leacy wrote:

> This is very similar to my client setups.
>
> I give Macintosh HD 20GB on 80GB drives, 40GB on all others.
>
> I strongly recommend using a Restore partition unless you have a  
> robust network and a netboot server.  Even if you do use netboot on  
> site, having a restore partition can get you out of a jam with a  
> mobile user on the road.
>
> ----------
> Miles A. Leacy IV
>
>  Certified System Administrator 10.4
>  Certified Technical Coordinator 10.5
>  Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/7 Bryan Vines <bkvines at wgclawfirm.com>
> David,
>
> We began exploring the idea of having the user data on a separate  
> partition for the same reason -- future OS upgrades will hopefully  
> be less painful. We have been using a three-partition scheme:  
> Restore, Macintosh HD, and Data.
>
> Our partition sizes are:
>     Restore: 15GB
>     Macintosh HD: 30GB or so
>     Data: The rest of the drive.
>
> We've found we need at least an 80GB drive to allow the users about  
> 30GB of space. We deployed a few Tiger machines with this  
> partitioning scheme, but then we went ahead and switched to  
> deploying Leopard (mostly because of laptops which would only run  
> Leopard).
>
> User homes go on Data, so if the main boot partition ends up hosed,  
> we can restore it from our standard configuration and get the user  
> up and running again with a minimum of fuss.
>
> We're now moving our older installed base to Leopard. We have to go  
> touch each machine, either to repartition its hard drive or install  
> a larger one. We're hoping we won't have to do that when Snow  
> Leopard rolls around.
>
> --
> Bryan Vines
> bkvines at wgclawfirm.com
>
>
>> From: David Lundgren <david.lundgren at brooks.edu>
>> Subject: [Casper] Upgrading from Tiger to Leopard
>>
>>
>> I was wondering how you all have done migrations from Tiger to  
>> Leopard.
>>
>> We have an Active Directory setup where the users home directories  
>> are local
>> to the machine (our faculty often have 10GB+ of data, and some have
>> laptops).
>>
>> We were contemplating doing separate user and OS partitions at the  
>> same time
>> to make any future OS upgrades less painful, without having to  
>> worry about
>> user data.
>>
>> Thanks,
>>
>> David Lundgren
>> IT Systems Administrator
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

-- 
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.


From miles.leacy at themacadmin.com  Fri Jan  9 04:39:14 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 9 Jan 2009 07:39:14 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
Message-ID: <ec2e75ff0901090439x61a4e9a5n8d15e946f4f8a4b9@mail.gmail.com>

Wow.  That's really a great idea.  I may have to change my procedure.
Can you share more details?  Is this a launchd item, a policy, etc?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/9 Daniel Farnworth <daniel.farnworth at thecreativepartnership.co.uk>

> Just chiming in with my 2 pence worth, we approach this in a slightly
> different way for a number of reasons.
>
> I'm not sure about other applications, but we discovered that Avid
> applications do not like symlinks when it comes to /Users which they
> still rather irritatingly use to store various things (mostly in /
> Users/Shared)
>
> What we do instead is have a separate Homes or Data partition and
> then use fstab to mount this directly to /Users, this gives us the
> best of both worlds, user data on a separate volume and no symlinks
> involved. It also this works a treat for the Avid apps as they just
> see that the /Users directory is in the correct place. I have a pre-
> install script that we use to do this for us if anyone is interested.
>
> Cheers
> Dan
>
> On 7 Jan 2009, at 22:02, Miles Leacy wrote:
>
> > This is very similar to my client setups.
> >
> > I give Macintosh HD 20GB on 80GB drives, 40GB on all others.
> >
> > I strongly recommend using a Restore partition unless you have a
> > robust network and a netboot server.  Even if you do use netboot on
> > site, having a restore partition can get you out of a jam with a
> > mobile user on the road.
> >
> > ----------
> > Miles A. Leacy IV
> >
> >  Certified System Administrator 10.4
> >  Certified Technical Coordinator 10.5
> >  Certified Trainer
> > Certified Casper Administrator
> > ----------
> > voice: 1-347-277-7321
> > miles.leacy at themacadmin.com
> > www.themacadmin.com
> >
> >
> >
> >
> > 2009/1/7 Bryan Vines <bkvines at wgclawfirm.com>
> > David,
> >
> > We began exploring the idea of having the user data on a separate
> > partition for the same reason -- future OS upgrades will hopefully
> > be less painful. We have been using a three-partition scheme:
> > Restore, Macintosh HD, and Data.
> >
> > Our partition sizes are:
> >     Restore: 15GB
> >     Macintosh HD: 30GB or so
> >     Data: The rest of the drive.
> >
> > We've found we need at least an 80GB drive to allow the users about
> > 30GB of space. We deployed a few Tiger machines with this
> > partitioning scheme, but then we went ahead and switched to
> > deploying Leopard (mostly because of laptops which would only run
> > Leopard).
> >
> > User homes go on Data, so if the main boot partition ends up hosed,
> > we can restore it from our standard configuration and get the user
> > up and running again with a minimum of fuss.
> >
> > We're now moving our older installed base to Leopard. We have to go
> > touch each machine, either to repartition its hard drive or install
> > a larger one. We're hoping we won't have to do that when Snow
> > Leopard rolls around.
> >
> > --
> > Bryan Vines
> > bkvines at wgclawfirm.com
> >
> >
> >> From: David Lundgren <david.lundgren at brooks.edu>
> >> Subject: [Casper] Upgrading from Tiger to Leopard
> >>
> >>
> >> I was wondering how you all have done migrations from Tiger to
> >> Leopard.
> >>
> >> We have an Active Directory setup where the users home directories
> >> are local
> >> to the machine (our faculty often have 10GB+ of data, and some have
> >> laptops).
> >>
> >> We were contemplating doing separate user and OS partitions at the
> >> same time
> >> to make any future OS upgrades less painful, without having to
> >> worry about
> >> user data.
> >>
> >> Thanks,
> >>
> >> David Lundgren
> >> IT Systems Administrator
> >
> >
> > _______________________________________________
> > Casper mailing list
> > Casper at list.jamfsoftware.com
> > http://list.jamfsoftware.com/mailman/listinfo/casper
> >
> >
> > _______________________________________________
> > Casper mailing list
> > Casper at list.jamfsoftware.com
> > http://list.jamfsoftware.com/mailman/listinfo/casper
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely for the
> use of the individual or entity to whom it is addressed and others
> authorised to receive it. It may contain confidential or legally privileged
> information. If you are not the intended recipient you are hereby notified
> that any disclosure, copying, distribution or taking any action in reliance
> on the contents of this information is strictly prohibited and may be
> unlawful. If you have received this communication in error, please notify
> postmaster at thecreativepartnership.co.uk immediately and then delete this
> email from your system. Any views or opinions presented in this email are
> solely those of the author and do not necessarily represent those of The
> Creative Partnership. The Creative Partnership has taken every reasonable
> precaution to ensure that any attachment to this e-mail has been swept for
> viruses. However, The Creative Partnership cannot accept liability for any
> damage sustained as a result of software viruses and would advise that you
> carry out your own virus checks before opening any attachment.
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/108f4461/attachment.html 

From damien at mac.com  Fri Jan  9 04:44:08 2009
From: damien at mac.com (Damien Weiss)
Date: Fri, 9 Jan 2009 07:44:08 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
Message-ID: <6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>


YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I  
would implement almost immediately.

Thanks!
Damien

On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:

> I have a pre-
> install script that we use to do this for us if anyone is interested.
>
> Cheers
> Dan


From daniel.farnworth at thecreativepartnership.co.uk  Fri Jan  9 05:15:25 2009
From: daniel.farnworth at thecreativepartnership.co.uk (Daniel Farnworth)
Date: Fri, 9 Jan 2009 13:15:25 +0000
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
Message-ID: <5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>

He he, thought that'd be popular.

The script is fairly poorly written (I'm not a Bash wiz) so any  
improvements are welcome (please let me have any so I can improve mine).

We run it as a 'before' script during our imaging process and it  
takes a look at the internal disks, tries to figure out which is the  
system disk or otherwise the disk in the first bay (Mac Pros only I  
think) and then partitions it up into various volumes that we want.  
Our post-flight script then takes the names of these and builds an  
fstab file which it writes down to /etc. It also moves our admin  
user's ('lwsadmin' in the script) home directory to /var/homes. We  
figured this may be wise just in case the data partition goes dead  
for any reason. Our OS image is pre-confd with lwsadmin's home  
pointing at the correct location, so you may want to excise this  
section and rely on using root to login in bad circumstances.

Oh, the post script also 'hides' some of the partitions (Restore,  
Freespace etc) so they don't show on the desktop, check the resulting  
fstab to see how this is done.

Be careful using this, it is destructive. Usual disclaimers apply =)

### Pre-install Partition Script

#!/bin/bash -v

exec 2>&1

function rawdisksize {
FLOAT=$1
INT1=${FLOAT/.*}
#if $(( INT1 % 10 )) then
while (( INT1 % 10 ))
do
let INT1++
done
#fi
echo "$INT1"
}


function partitionsizes {

case $RAW_SIZE in

	30)
		INTHD_SIZE=15
		HOMES_SIZE=10
		SCRATCH_SIZE=3
		RESTORE_SIZE=0
		;;

	40)
		INTHD_SIZE=20
		HOMES_SIZE=10
		SCRATCH_SIZE=5
		RESTORE_SIZE=0
		;;

	60)
		INTHD_SIZE=30
		HOMES_SIZE=10
		SCRATCH_SIZE=10
		RESTORE_SIZE=5
		;;

	80)
		INTHD_SIZE=40
		HOMES_SIZE=10
		SCRATCH_SIZE=10
		RESTORE_SIZE=10
		;;

	120)
		INTHD_SIZE=60
		HOMES_SIZE=20
		SCRATCH_SIZE=10
		RESTORE_SIZE=20
		;;

	160)
		INTHD_SIZE=80
		HOMES_SIZE=25
		SCRATCH_SIZE=10
		RESTORE_SIZE=25
		;;

	240)
		INTHD_SIZE=160
		HOMES_SIZE=25
		SCRATCH_SIZE=10
		RESTORE_SIZE=25
		;;

	*)
		INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
		HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
		SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
		RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
		;;
esac

}


# Define a function to define whether this is a 'Bay Capable' machine
#function bayedmachine {

# This needs to be written fairly soon

#}


if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then

	echo ${1}
	TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk  
'{ print $3 }' | cut -c 1-5`
	echo ${TARGETDISK}
	
	# now to partition the disk
	#
	
	if [ ! -z $TARGETDISK ]
	then
		TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk  
'{ print $3 }'`
		RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
		partitionsizes
		
		echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
		echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
                 echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
                 echo "CP-Homes-01 Size: $HOMES_SIZE GB"
                 echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
                 echo "Restore Size: $RESTORE_SIZE GB"
		
		
		# Check processor type so we partition in the right format
		
		sysinfo=`system_profiler`
		
		countPPC=`echo ${sysinfo} | grep -c PowerPC`
		countIntel=`echo ${sysinfo} | grep -c Intel`
		
		if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
			echo "Got a PPC in here"
			partition_scheme_type="APMFormat"
			
		elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
			echo "Intel Inside"
			partition_scheme_type="GPTFormat"
			
		else
			echo "Can't work out what kinda proc, it either ain't got one or  
could be a Cray?"
			exit 1
			
		fi

		
		# Set the partition going
		
		if [ $RESTORE_SIZE -gt 0 ]; then
		
			diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
				"Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
				"Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
				"Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
				"Journaled HFS+" Restore "$RESTORE_SIZE"G
				
		else
		
			diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
				"Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
				"Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
				"Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G
				
		fi

	
			chown root:admin /Volumes/CP-Homes-01
			chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
			chown root:admin /Volumes/Restore
			chown root:admin /Volumes/Free-Space
	
			chmod g+w /Volumes/CP-Homes-01
			chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
			chmod g+w /Volumes/Restore
			chmod g+w /Volumes/Free-Space
	
			touch /Volumes/CP-IntHD-01/.cp-partition-done
			
	else
	
			echo "Problem acquiring target disk, exiting";
			exit 1

	fi
	
else
	
	echo "The partition scheme has already been created. Exiting"
	exit 0
	
fi

exit 0


### Post Install Script

#!/bin/bash -v

# Redirect STDERR to STDOUT
exec 2>&1

VOLSDIR="/Volumes/"

ROOTVOL="CP-IntHD-01"
HOMESVOL="CP-Homes-01"

ROOTPATH="${VOLSDIR}${ROOTVOL}"
HOMESPATH="${VOLSDIR}${HOMESVOL}"




if [ -e "${1}/.cp-partition-done" ]; then

	# Ditto the contents of $ROOTPART/Users/Shared to their new location
	
	ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
	if (( ! $? )); then
	
		# Remove the old copy of $ROOTPART/Users/Shared
		echo "Done dittoing..."
		rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
		rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store  
failed" ; }
		rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized  
failed" ; }
		
		if [ -e "${1}/var/homes/lwsadmin" ]; then
			rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin  
failed" ; }
		fi

		DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
		UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
		echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo  
"'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
		echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/ 
fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
		
		HIDDEN_VOLS=(Restore Free-Space)
		
		for volume in "${HIDDEN_VOLS[@]}"; do
		
			DEVID=`diskutil list | grep $volume | awk '{print $6}'`
			UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
			
			echo "# Set the volume $volume to not mount at startup" >> $1/etc/ 
fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit 1 ; }
			echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/ 
fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
		
		done
	
	fi
	
	touch "${1}/.cp-user-migration-done" || { echo "Task completion file  
could not be created" ; exit 1 ; }
	
	exit 0

else
	# Log the error
	echo "Could not find partition completion file. It would be wise not  
to continue"
	# Exit with above 0 status
	exit 1

fi






On 9 Jan 2009, at 12:44, Damien Weiss wrote:

>
> YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I  
> would implement almost immediately.
>
> Thanks!
> Damien
>
> On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
>
>> I have a pre-
>> install script that we use to do this for us if anyone is interested.
>>
>> Cheers
>> Dan
>

-- 
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.


From tlarki at kckps.org  Fri Jan  9 07:46:30 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 09 Jan 2009 09:46:30 -0600
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
Message-ID: <49671CF6.7141.0039.0@kckps.org>

When we did our massive dual boot image over this last summer I was looking at the /etc/fstab file to hide the windows partition from the OS X side.  I had so many problems getting fstab to work.  It would not work for me if I used volume name or the device mount point, ie /dev/disk1s3/.  It would work if I used UUID, but if you mass duplicate that UUID to tons of machines I found that it wouldn't work. 

What has been your experience using /etc/fstab in 10.5?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Daniel Farnworth <daniel.farnworth at thecreativepartnership.co.uk> 01/09/09 7:15 AM >>>
He he, thought that'd be popular.

The script is fairly poorly written (I'm not a Bash wiz) so any 
improvements are welcome (please let me have any so I can improve mine).

We run it as a 'before' script during our imaging process and it 
takes a look at the internal disks, tries to figure out which is the 
system disk or otherwise the disk in the first bay (Mac Pros only I 
think) and then partitions it up into various volumes that we want. 
Our post-flight script then takes the names of these and builds an 
fstab file which it writes down to /etc. It also moves our admin 
user's ('lwsadmin' in the script) home directory to /var/homes. We 
figured this may be wise just in case the data partition goes dead 
for any reason. Our OS image is pre-confd with lwsadmin's home 
pointing at the correct location, so you may want to excise this 
section and rely on using root to login in bad circumstances.

Oh, the post script also 'hides' some of the partitions (Restore, 
Freespace etc) so they don't show on the desktop, check the resulting 
fstab to see how this is done.

Be careful using this, it is destructive. Usual disclaimers apply =)

### Pre-install Partition Script

#!/bin/bash -v

exec 2>&1

function rawdisksize {
FLOAT=$1
INT1=${FLOAT/.*}
#if $(( INT1 % 10 )) then
while (( INT1 % 10 ))
do
let INT1++
done
#fi
echo "$INT1"
}


function partitionsizes {

case $RAW_SIZE in

30)
INTHD_SIZE=15
HOMES_SIZE=10
SCRATCH_SIZE=3
RESTORE_SIZE=0
;;

40)
INTHD_SIZE=20
HOMES_SIZE=10
SCRATCH_SIZE=5
RESTORE_SIZE=0
;;

60)
INTHD_SIZE=30
HOMES_SIZE=10
SCRATCH_SIZE=10
RESTORE_SIZE=5
;;

80)
INTHD_SIZE=40
HOMES_SIZE=10
SCRATCH_SIZE=10
RESTORE_SIZE=10
;;

120)
INTHD_SIZE=60
HOMES_SIZE=20
SCRATCH_SIZE=10
RESTORE_SIZE=20
;;

160)
INTHD_SIZE=80
HOMES_SIZE=25
SCRATCH_SIZE=10
RESTORE_SIZE=25
;;

240)
INTHD_SIZE=160
HOMES_SIZE=25
SCRATCH_SIZE=10
RESTORE_SIZE=25
;;

*)
INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
;;
esac

}


# Define a function to define whether this is a 'Bay Capable' machine
#function bayedmachine {

# This needs to be written fairly soon

#}


if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then

echo ${1}
TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk 
'{ print $3 }' | cut -c 1-5`
echo ${TARGETDISK}

# now to partition the disk
#

if [ ! -z $TARGETDISK ]
then
TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk 
'{ print $3 }'`
RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
partitionsizes

echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
                 echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
                 echo "CP-Homes-01 Size: $HOMES_SIZE GB"
                 echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
                 echo "Restore Size: $RESTORE_SIZE GB"


# Check processor type so we partition in the right format

sysinfo=`system_profiler`

countPPC=`echo ${sysinfo} | grep -c PowerPC`
countIntel=`echo ${sysinfo} | grep -c Intel`

if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
echo "Got a PPC in here"
partition_scheme_type="APMFormat"

elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
echo "Intel Inside"
partition_scheme_type="GPTFormat"

else
echo "Can't work out what kinda proc, it either ain't got one or 
could be a Cray?"
exit 1

fi


# Set the partition going

if [ $RESTORE_SIZE -gt 0 ]; then

diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
"Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
"Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
"Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
"Journaled HFS+" Restore "$RESTORE_SIZE"G

else

diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
"Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
"Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
"Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G

fi


chown root:admin /Volumes/CP-Homes-01
chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
chown root:admin /Volumes/Restore
chown root:admin /Volumes/Free-Space

chmod g+w /Volumes/CP-Homes-01
chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
chmod g+w /Volumes/Restore
chmod g+w /Volumes/Free-Space

touch /Volumes/CP-IntHD-01/.cp-partition-done

else

echo "Problem acquiring target disk, exiting";
exit 1

fi

else

echo "The partition scheme has already been created. Exiting"
exit 0

fi

exit 0


### Post Install Script

#!/bin/bash -v

# Redirect STDERR to STDOUT
exec 2>&1

VOLSDIR="/Volumes/"

ROOTVOL="CP-IntHD-01"
HOMESVOL="CP-Homes-01"

ROOTPATH="${VOLSDIR}${ROOTVOL}"
HOMESPATH="${VOLSDIR}${HOMESVOL}"




if [ -e "${1}/.cp-partition-done" ]; then

# Ditto the contents of $ROOTPART/Users/Shared to their new location

ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
if (( ! $? )); then

# Remove the old copy of $ROOTPART/Users/Shared
echo "Done dittoing..."
rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store 
failed" ; }
rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized 
failed" ; }

if [ -e "${1}/var/homes/lwsadmin" ]; then
rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin 
failed" ; }
fi

DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo 
"'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/
fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }

HIDDEN_VOLS=(Restore Free-Space)

for volume in "${HIDDEN_VOLS[@]}"; do

DEVID=`diskutil list | grep $volume | awk '{print $6}'`
UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`

echo "# Set the volume $volume to not mount at startup" >> $1/etc/
fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit 1 ; }
echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/
fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }

done

fi

touch "${1}/.cp-user-migration-done" || { echo "Task completion file 
could not be created" ; exit 1 ; }

exit 0

else
# Log the error
echo "Could not find partition completion file. It would be wise not 
to continue"
# Exit with above 0 status
exit 1

fi






On 9 Jan 2009, at 12:44, Damien Weiss wrote:

>
> YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I 
> would implement almost immediately.
>
> Thanks!
> Damien
>
> On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
>
>> I have a pre-
>> install script that we use to do this for us if anyone is interested.
>>
>> Cheers
>> Dan
>

--
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of s
oftware viruses and would advise that you carry out your own virus checks before opening any attachment.

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/aa086b3e/attachment.htm 

From miles.leacy at themacadmin.com  Fri Jan  9 08:19:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 9 Jan 2009 11:19:06 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
Message-ID: <ec2e75ff0901090819q1ead7c35r8ebd12d5177d58f@mail.gmail.com>

Thanks for sharing!  I'll have a poke at it to see how I can simplify it.
Are you still deploying Macs with hard drives smaller than 80GB?  For my own
purposes and the types of environments I've been in lately, I'd probably
just remove the whole case section pertaining to $RAW_SIZE.

I'm curious as to your reasoning for making the home partition so much
smaller while devoting the majority of the disk to the boot volume.  I
typically do it the other way around, though if you were concerned with
keeping home directory size under control, I can see using this approach.

My general disk space distribution is:

For 80GB (which is the smallest I encounter these days):
20GB Boot Volume
10GB Restore Volume
<remainder> Data Volume

For anything larger:
40GB Boot Volume
20GB Restore Volume
<remainder> Data Volume

I find that I don't need any more than 20GB for the OS and Applications.  In
practice, I have rarely deployed a system that required any more than 10GB.
 Where more disk space is available, I double it to allow for unexpected
growth.  For apps with large amounts of template & resource data (such as
Final Cut), I deploy it to the /Users/Shared directory.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 9, 2009 at 8:15 AM, Daniel Farnworth <
daniel.farnworth at thecreativepartnership.co.uk> wrote:

> He he, thought that'd be popular.
>
> The script is fairly poorly written (I'm not a Bash wiz) so any
> improvements are welcome (please let me have any so I can improve mine).
>
> We run it as a 'before' script during our imaging process and it
> takes a look at the internal disks, tries to figure out which is the
> system disk or otherwise the disk in the first bay (Mac Pros only I
> think) and then partitions it up into various volumes that we want.
> Our post-flight script then takes the names of these and builds an
> fstab file which it writes down to /etc. It also moves our admin
> user's ('lwsadmin' in the script) home directory to /var/homes. We
> figured this may be wise just in case the data partition goes dead
> for any reason. Our OS image is pre-confd with lwsadmin's home
> pointing at the correct location, so you may want to excise this
> section and rely on using root to login in bad circumstances.
>
> Oh, the post script also 'hides' some of the partitions (Restore,
> Freespace etc) so they don't show on the desktop, check the resulting
> fstab to see how this is done.
>
> Be careful using this, it is destructive. Usual disclaimers apply =)
>
> ### Pre-install Partition Script
>
> #!/bin/bash -v
>
> exec 2>&1
>
> function rawdisksize {
> FLOAT=$1
> INT1=${FLOAT/.*}
> #if $(( INT1 % 10 )) then
> while (( INT1 % 10 ))
> do
> let INT1++
> done
> #fi
> echo "$INT1"
> }
>
>
> function partitionsizes {
>
> case $RAW_SIZE in
>
>        30)
>                INTHD_SIZE=15
>                HOMES_SIZE=10
>                SCRATCH_SIZE=3
>                RESTORE_SIZE=0
>                ;;
>
>        40)
>                INTHD_SIZE=20
>                HOMES_SIZE=10
>                SCRATCH_SIZE=5
>                RESTORE_SIZE=0
>                ;;
>
>        60)
>                INTHD_SIZE=30
>                HOMES_SIZE=10
>                SCRATCH_SIZE=10
>                RESTORE_SIZE=5
>                ;;
>
>        80)
>                INTHD_SIZE=40
>                HOMES_SIZE=10
>                SCRATCH_SIZE=10
>                RESTORE_SIZE=10
>                ;;
>
>        120)
>                INTHD_SIZE=60
>                HOMES_SIZE=20
>                SCRATCH_SIZE=10
>                RESTORE_SIZE=20
>                ;;
>
>        160)
>                INTHD_SIZE=80
>                HOMES_SIZE=25
>                SCRATCH_SIZE=10
>                RESTORE_SIZE=25
>                ;;
>
>        240)
>                INTHD_SIZE=160
>                HOMES_SIZE=25
>                SCRATCH_SIZE=10
>                RESTORE_SIZE=25
>                ;;
>
>        *)
>                INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
>                HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                ;;
> esac
>
> }
>
>
> # Define a function to define whether this is a 'Bay Capable' machine
> #function bayedmachine {
>
> # This needs to be written fairly soon
>
> #}
>
>
> if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
>
>        echo ${1}
>        TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> '{ print $3 }' | cut -c 1-5`
>        echo ${TARGETDISK}
>
>        # now to partition the disk
>        #
>
>        if [ ! -z $TARGETDISK ]
>        then
>                TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" |
> awk
> '{ print $3 }'`
>                RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
>                partitionsizes
>
>                echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
>                echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
>                 echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
>                 echo "CP-Homes-01 Size: $HOMES_SIZE GB"
>                 echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
>                 echo "Restore Size: $RESTORE_SIZE GB"
>
>
>                # Check processor type so we partition in the right format
>
>                sysinfo=`system_profiler`
>
>                countPPC=`echo ${sysinfo} | grep -c PowerPC`
>                countIntel=`echo ${sysinfo} | grep -c Intel`
>
>                if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
>                        echo "Got a PPC in here"
>                        partition_scheme_type="APMFormat"
>
>                elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
>                        echo "Intel Inside"
>                        partition_scheme_type="GPTFormat"
>
>                else
>                        echo "Can't work out what kinda proc, it either
> ain't got one or
> could be a Cray?"
>                        exit 1
>
>                fi
>
>
>                # Set the partition going
>
>                if [ $RESTORE_SIZE -gt 0 ]; then
>
>                        diskutil partitionDisk $TARGETDISK 4
> $partition_scheme_type \
>                                "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G
> \
>                                "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G
> \
>                                "Journaled HFS+" CP-Scratch-NOT-BackedUp
> "$SCRATCH_SIZE"G \
>                                "Journaled HFS+" Restore "$RESTORE_SIZE"G
>
>                else
>
>                        diskutil partitionDisk $TARGETDISK 3
> $partition_scheme_type \
>                                "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G
> \
>                                "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G
> \
>                                "Journaled HFS+" CP-Scratch-NOT-BackedUp
> "$SCRATCH_SIZE"G
>
>                fi
>
>
>                        chown root:admin /Volumes/CP-Homes-01
>                        chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
>                        chown root:admin /Volumes/Restore
>                        chown root:admin /Volumes/Free-Space
>
>                        chmod g+w /Volumes/CP-Homes-01
>                        chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
>                        chmod g+w /Volumes/Restore
>                        chmod g+w /Volumes/Free-Space
>
>                        touch /Volumes/CP-IntHD-01/.cp-partition-done
>
>        else
>
>                        echo "Problem acquiring target disk, exiting";
>                        exit 1
>
>        fi
>
> else
>
>        echo "The partition scheme has already been created. Exiting"
>        exit 0
>
> fi
>
> exit 0
>
>
> ### Post Install Script
>
> #!/bin/bash -v
>
> # Redirect STDERR to STDOUT
> exec 2>&1
>
> VOLSDIR="/Volumes/"
>
> ROOTVOL="CP-IntHD-01"
> HOMESVOL="CP-Homes-01"
>
> ROOTPATH="${VOLSDIR}${ROOTVOL}"
> HOMESPATH="${VOLSDIR}${HOMESVOL}"
>
>
>
>
> if [ -e "${1}/.cp-partition-done" ]; then
>
>        # Ditto the contents of $ROOTPART/Users/Shared to their new location
>
>        ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
>        if (( ! $? )); then
>
>                # Remove the old copy of $ROOTPART/Users/Shared
>                echo "Done dittoing..."
>                rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared
> failed" ; }
>                rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> failed" ; }
>                rm -v "${1}/Users/.localized" || { echo "rm
> /Users/.localized
> failed" ; }
>
>                if [ -e "${1}/var/homes/lwsadmin" ]; then
>                        rm -vR "${1}/Users/lwsadmin" || { echo "rm
> /Users/lwsadmin
> failed" ; }
>                fi
>
>                DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
>                UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk
> {'print $2'}`
>                echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || {
> echo
> "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
>                echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >>
> $1/etc/
> fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
>
>                HIDDEN_VOLS=(Restore Free-Space)
>
>                for volume in "${HIDDEN_VOLS[@]}"; do
>
>                        DEVID=`diskutil list | grep $volume | awk '{print
> $6}'`
>                        UUID=`diskutil info $DEVID | grep UUID |
> /usr/bin/awk {'print $2'}`
>
>                        echo "# Set the volume $volume to not mount at
> startup" >> $1/etc/
> fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit 1 ; }
>                        echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n"
> >> $1/etc/
> fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
>
>                done
>
>        fi
>
>        touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> could not be created" ; exit 1 ; }
>
>        exit 0
>
> else
>        # Log the error
>        echo "Could not find partition completion file. It would be wise not
> to continue"
>        # Exit with above 0 status
>        exit 1
>
> fi
>
>
>
>
>
>
> On 9 Jan 2009, at 12:44, Damien Weiss wrote:
>
> >
> > YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
> > would implement almost immediately.
> >
> > Thanks!
> > Damien
> >
> > On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
> >
> >> I have a pre-
> >> install script that we use to do this for us if anyone is interested.
> >>
> >> Cheers
> >> Dan
> >
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely for the
> use of the individual or entity to whom it is addressed and others
> authorised to receive it. It may contain confidential or legally privileged
> information. If you are not the intended recipient you are hereby notified
> that any disclosure, copying, distribution or taking any action in reliance
> on the contents of this information is strictly prohibited and may be
> unlawful. If you have received this communication in error, please notify
> postmaster at thecreativepartnership.co.uk immediately and then delete this
> email from your system. Any views or opinions presented in this email are
> solely those of the author and do not necessarily represent those of The
> Creative Partnership. The Creative Partnership has taken every reasonable
> precaution to ensure that any attachment to this e-mail has been swept for
> viruses. However, The Creative Partnership cannot accept liability for any
> damage sustained as a result of software viruses and would advise that you
> carry out your own virus checks before opening any attachment.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/85ac7ae6/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan  9 08:30:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 9 Jan 2009 11:30:06 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <49671CF6.7141.0039.0@kckps.org>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
	<49671CF6.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901090830l4f1390ek8fbcdf1784d702a0@mail.gmail.com>

UUIDs, being universally unique, you can't reference a UUID from machine A
and disk A on machine B.  It's like telling someone to go to Guam when this
person doesn't know where Guam is and has neither a boat nor a plane.

I've just skimmed the script so far (I have some deadlines I'm working
today), but if I read it correctly, Dan's script is quite clever in that it
dynamically grabs the appropriate UUID from the disk being acted upon.  So,
if using the UUID is a best practice, then Dan's got quite a nugget of
scripty goodness here.

To make sure due diligence is performed, let me ask; What if any issues has
anyone using fstab in this way encountered?  Are there any theoretical
issues to be concerned about?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/9 Thomas Larkin <tlarki at kckps.org>

>  When we did our massive dual boot image over this last summer I was
> looking at the /etc/fstab file to hide the windows partition from the OS X
> side.  I had so many problems getting fstab to work.  It would not work for
> me if I used volume name or the device mount point, ie /dev/disk1s3/.  It
> would work if I used UUID, but if you mass duplicate that UUID to tons of
> machines I found that it wouldn't work.
>
>  What has been your experience using /etc/fstab in 10.5?
>
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Daniel Farnworth <daniel.farnworth at thecreativepartnership.co.uk>
> 01/09/09 7:15 AM >>>
>
> He he, thought that'd be popular.
>
> The script is fairly poorly written (I'm not a Bash wiz) so any
> improvements are welcome (please let me have any so I can improve mine).
>
> We run it as a 'before' script during our imaging process and it
> takes a look at the internal disks, tries to figure out which is the
> system disk or otherwise the disk in the first bay (Mac Pros only I
> think) and then partitions it up into various volumes that we want.
> Our post-flight script then takes the names of these and builds an
> fstab file which it writes down to /etc. It also moves our admin
> user's ('lwsadmin' in the script) home directory to /var/homes. We
> figured this may be wise just in case the data partition goes dead
> for any reason. Our OS image is pre-confd with lwsadmin's home
> pointing at the correct location, so you may want to excise this
> section and rely on using root to login in bad circumstances.
>
> Oh, the post script also 'hides' some of the partitions (Restore,
> Freespace etc) so they don't show on the desktop, check the resulting
> fstab to see how this is done.
>
> Be careful using this, it is destructive. Usual disclaimers apply =)
>
> ### Pre-install Partition Script
>
> #!/bin/bash -v
>
> exec 2>&1
>
> function rawdisksize {
> FLOAT=$1
> INT1=${FLOAT/.*}
> #if $(( INT1 % 10 )) then
> while (( INT1 % 10 ))
> do
> let INT1++
> done
> #fi
> echo "$INT1"
> }
>
>
> function partitionsizes {
>
> case $RAW_SIZE in
>
> 30)
> INTHD_SIZE=15
> HOMES_SIZE=10
> SCRATCH_SIZE=3
> RESTORE_SIZE=0
> ;;
>
> 40)
> INTHD_SIZE=20
> HOMES_SIZE=10
> SCRATCH_SIZE=5
> RESTORE_SIZE=0
> ;;
>
> 60)
> INTHD_SIZE=30
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=5
> ;;
>
> 80)
> INTHD_SIZE=40
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=10
> ;;
>
> 120)
> INTHD_SIZE=60
> HOMES_SIZE=20
> SCRATCH_SIZE=10
> RESTORE_SIZE=20
> ;;
>
> 160)
> INTHD_SIZE=80
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> 240)
> INTHD_SIZE=160
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> *)
> INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
> HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> ;;
> esac
>
> }
>
>
> # Define a function to define whether this is a 'Bay Capable' machine
> #function bayedmachine {
>
> # This needs to be written fairly soon
>
> #}
>
>
> if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
>
> echo ${1}
> TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> '{ print $3 }' | cut -c 1-5`
> echo ${TARGETDISK}
>
> # now to partition the disk
> #
>
> if [ ! -z $TARGETDISK ]
> then
> TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk
> '{ print $3 }'`
> RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
> partitionsizes
>
> echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
> echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
>                  echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
>                  echo "CP-Homes-01 Size: $HOMES_SIZE GB"
>                  echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
>                  echo "Restore Size: $RESTORE_SIZE GB"
>
>
> # Check processor type so we partition in the right format
>
> sysinfo=`system_profiler`
>
> countPPC=`echo ${sysinfo} | grep -c PowerPC`
> countIntel=`echo ${sysinfo} | grep -c Intel`
>
> if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
> echo "Got a PPC in here"
> partition_scheme_type="APMFormat"
>
> elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
> echo "Intel Inside"
> partition_scheme_type="GPTFormat"
>
> else
> echo "Can't work out what kinda proc, it either ain't got one or
> could be a Cray?"
> exit 1
>
> fi
>
>
> # Set the partition going
>
> if [ $RESTORE_SIZE -gt 0 ]; then
>
> diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
> "Journaled HFS+" Restore "$RESTORE_SIZE"G
>
> else
>
> diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G
>
> fi
>
>
> chown root:admin /Volumes/CP-Homes-01
> chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
> chown root:admin /Volumes/Restore
> chown root:admin /Volumes/Free-Space
>
> chmod g+w /Volumes/CP-Homes-01
> chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
> chmod g+w /Volumes/Restore
> chmod g+w /Volumes/Free-Space
>
> touch /Volumes/CP-IntHD-01/.cp-partition-done
>
> else
>
> echo "Problem acquiring target disk, exiting";
> exit 1
>
> fi
>
> else
>
> echo "The partition scheme has already been created. Exiting"
> exit 0
>
> fi
>
> exit 0
>
>
> ### Post Install Script
>
> #!/bin/bash -v
>
> # Redirect STDERR to STDOUT
> exec 2>&1
>
> VOLSDIR="/Volumes/"
>
> ROOTVOL="CP-IntHD-01"
> HOMESVOL="CP-Homes-01"
>
> ROOTPATH="${VOLSDIR}${ROOTVOL}"
> HOMESPATH="${VOLSDIR}${HOMESVOL}"
>
>
>
>
> if [ -e "${1}/.cp-partition-done" ]; then
>
> # Ditto the contents of $ROOTPART/Users/Shared to their new location
>
> ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
> if (( ! $? )); then
>
> # Remove the old copy of $ROOTPART/Users/Shared
> echo "Done dittoing..."
> rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
> rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> failed" ; }
> rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized
> failed" ; }
>
> if [ -e "${1}/var/homes/lwsadmin" ]; then
> rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin
> failed" ; }
> fi
>
> DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
> echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo
> "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
> echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
>
> HIDDEN_VOLS=(Restore Free-Space)
>
> for volume in "${HIDDEN_VOLS[@]}"; do
>
> DEVID=`diskutil list | grep $volume | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
>
> echo "# Set the volume $volume to not mount at startup" >> $1/etc/
> fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit 1 ; }
> echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
>
> done
>
> fi
>
> touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> could not be created" ; exit 1 ; }
>
> exit 0
>
> else
> # Log the error
> echo "Could not find partition completion file. It would be wise not
> to continue"
> # Exit with above 0 status
> exit 1
>
> fi
>
>
>
>
>
>
> On 9 Jan 2009, at 12:44, Damien Weiss wrote:
>
> >
> > YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
> > would implement almost immediately.
> >
> > Thanks!
> > Damien
> >
> > On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
> >
> >> I have a pre-
> >> install script that we use to do this for us if anyone is interested.
> >>
> >> Cheers
> >> Dan
> >
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely for the
> use of the individual or entity to whom it is addressed and others
> authorised to receive it. It may contain confidential or legally privileged
> information. If you are not the intended recipient you are hereby notified
> that any disclosure, copying, distribution or taking any action in reliance
> on the contents of this information is strictly prohibited and may be
> unlawful. If you have received this communication in error, please notify
> postmaster at thecreativepartnership.co.uk immediately and then delete this
> email from your system. Any views or opinions presented in this email are
> solely those of the author and do not necessarily represent those of The
> Creative Partnership. The Creative Partnership has taken every reasonable
> precaution to ensure that any attachment to this e-mail has been swept for
> viruses. However, The Creative Partnership cannot accept liability for any
> damage sustained as a result of s
> oftware viruses and would advise that you carry out your own virus checks
> before opening any attachment.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/c9ae3ebd/attachment.html 

From rharter at uwsp.edu  Fri Jan  9 09:56:16 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Fri, 9 Jan 2009 11:56:16 -0600
Subject: [Casper] Computer group from AD
Message-ID: <EA412F18-D5D1-48C1-82C7-BD5416410B05@uwsp.edu>

Hey Guys-

Has anyone created a smart group that would take members based on if  
the computer is a member of an AD group.

Essentially what I'm trying to do is scope a policy to a group of  
computers in AD, like you can with the User scope, but it doesn't seem  
to work with computers.

When user's register for our disaster recovery system, their computer  
is added to a group in AD, and I would like to install the backup  
client on their machine based on whether or not they are in this  
group.  Any ideas?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/95e010ad/attachment.html 

From ERNSTCS at uwec.edu  Fri Jan  9 09:57:24 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Fri, 9 Jan 2009 11:57:24 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <EA412F18-D5D1-48C1-82C7-BD5416410B05@uwsp.edu>
Message-ID: <C58CEC24.12581%ernstcs@uwec.edu>

Don't believe the JSS works with computer accounts in AD.

Craig E


On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:

Hey Guys-

Has anyone created a smart group that would take members based on if the computer is a member of an AD group.

Essentially what I'm trying to do is scope a policy to a group of computers in AD, like you can with the User scope, but it doesn't seem to work with computers.

When user's register for our disaster recovery system, their computer is added to a group in AD, and I would like to install the backup client on their machine based on whether or not they are in this group.  Any ideas?


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/2cfba74e/attachment.htm 

From jared.nichols at ll.mit.edu  Fri Jan  9 11:03:01 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Fri, 9 Jan 2009 14:03:01 -0500
Subject: [Casper] Computer group from AD
In-Reply-To: <C58CEC24.12581%ernstcs@uwec.edu>
Message-ID: <C58D0996.17C81%jared.nichols@ll.mit.edu>

Wouldn't you just create a smart computer group that goes off of the Active Directory Status attribute?  You could either make it "Active Directory Status" is <<name of AD>> (if you have more than one and you want to specify which) or you could make "Active Directory Status" is not "Not Bound"  It's a double negative, but that would return any machine bound to an AD, no matter what the AD is called.

See Attachment.

Maybe I don't understand completely your question?

j

On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:

Don't believe the JSS works with computer accounts in AD.

Craig E


On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:

Hey Guys-

Has anyone created a smart group that would take members based on if the computer is a member of an AD group.

Essentially what I'm trying to do is scope a policy to a group of computers in AD, like you can with the User scope, but it doesn't seem to work with computers.

When user's register for our disaster recovery system, their computer is added to a group in AD, and I would like to install the backup client on their machine based on whether or not they are in this group.  Any ideas?


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>





--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/dd40e315/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture 2.png
Type: application/octet-stream
Size: 47585 bytes
Desc: Picture 2.png
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/dd40e315/attachment.obj 

From miles.leacy at themacadmin.com  Fri Jan  9 11:35:46 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 9 Jan 2009 14:35:46 -0500
Subject: [Casper] Computer group from AD
In-Reply-To: <C58D0996.17C81%jared.nichols@ll.mit.edu>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>

"Bound to a directory" and "Member of a group" are different concepts.
I would also like the ability to recognize computer accounts and computer
groups.

You could work around the current situation with a script using logic like
so:

1. Query LDAP (AD) for the groups "my computer" ($2, assuming your machine
names are the same as your AD names) belongs to.
2. grep the output for the group you want to key on.
3. call a custom trigger

The ability for Casper to recognize computer accounts & groups would be
better than this, but this can give you the same net effect as scoping a
policy to an AD group.  This also assumes you have the ability to perform
LDAP lookups in AD.  If your JSS is taking advantage of LDAP, then you could
use the same account to perform the lookup in the script.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>

>  Wouldn't you just create a smart computer group that goes off of the
> Active Directory Status attribute?  You could either make it "Active
> Directory Status" is <<name of AD>> (if you have more than one and you want
> to specify which) or you could make "Active Directory Status" is not "Not
> Bound"  It's a double negative, but that would return any machine bound to
> an AD, no matter what the AD is called.
>
> See Attachment.
>
> Maybe I don't understand completely your question?
>
> j
>
>
> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>
> Don't believe the JSS works with computer accounts in AD.
>
> Craig E
>
>
> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>
> Hey Guys-
>
> Has anyone created a smart group that would take members based on if the
> computer is a member of an AD group.
>
> Essentially what I'm trying to do is scope a policy to a group of computers
> in AD, like you can with the User scope, but it doesn't seem to work with
> computers.
>
> When user's register for our disaster recovery system, their computer is
> added to a group in AD, and I would like to install the backup client on
> their machine based on whether or not they are in this group.  Any ideas?
>
> *
> Ryan Harter
> *UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu <Ryan.Harter at uwsp.edu>>
>
>
>
>
>
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/6a48c128/attachment.htm 

From rharter at uwsp.edu  Fri Jan  9 12:22:53 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Fri, 9 Jan 2009 14:22:53 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
	<ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
Message-ID: <CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>

This sounds like a good workaround.  I have emailed JAMF about this  
too, but haven't heard anything.  I'm sure they're all off at MacWorld:)

I was hoping for a solution that I could make a computer group with so  
that I could only run it on the computers that need it and not on  
every computer just for the 20% that actually need the client.

There is also talk of "leasing" CS3 licenses to departments on campus,  
in which case I would like to have self service only advertise the  
install on the computers that are in the CS3Licensed AD group.  I may  
do this by having us add the users to a group as well and scope it  
that way temporarily, but the ultimate goal is to have it available  
for department machines, not users.

I was thinking of some sort of logic like:

1. run a policy that will check dscl for the group memberships of the  
computer.
2. install a dummy package.
3. base a smart group on the receipt of the dummy package.
4. scope the policies to the smart group

That way, I can not only run the policy just for the group, but also  
keep a record of who's in it.  It's not a very elegant solution, but  
it may have to do.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:

> "Bound to a directory" and "Member of a group" are different concepts.
>
> I would also like the ability to recognize computer accounts and  
> computer groups.
>
> You could work around the current situation with a script using  
> logic like so:
>
> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your  
> machine names are the same as your AD names) belongs to.
> 2. grep the output for the group you want to key on.
> 3. call a custom trigger
>
> The ability for Casper to recognize computer accounts & groups would  
> be better than this, but this can give you the same net effect as  
> scoping a policy to an AD group.  This also assumes you have the  
> ability to perform LDAP lookups in AD.  If your JSS is taking  
> advantage of LDAP, then you could use the same account to perform  
> the lookup in the script.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
> Wouldn't you just create a smart computer group that goes off of the  
> Active Directory Status attribute?  You could either make it "Active  
> Directory Status" is <<name of AD>> (if you have more than one and  
> you want to specify which) or you could make "Active Directory  
> Status" is not "Not Bound"  It's a double negative, but that would  
> return any machine bound to an AD, no matter what the AD is called.
>
> See Attachment.
>
> Maybe I don't understand completely your question?
>
> j
>
>
> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>
> Don't believe the JSS works with computer accounts in AD.
>
> Craig E
>
>
> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>
> Hey Guys-
>
> Has anyone created a smart group that would take members based on if  
> the computer is a member of an AD group.
>
> Essentially what I'm trying to do is scope a policy to a group of  
> computers in AD, like you can with the User scope, but it doesn't  
> seem to work with computers.
>
> When user's register for our disaster recovery system, their  
> computer is added to a group in AD, and I would like to install the  
> backup client on their machine based on whether or not they are in  
> this group.  Any ideas?
>
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>
>
>
>
>
> -- 
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/51183c90/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan  9 12:50:13 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 9 Jan 2009 15:50:13 -0500
Subject: [Casper] Computer group from AD
In-Reply-To: <CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
	<ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
	<CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>
Message-ID: <ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>

I'm a big fan of smart groups based on dummy receipts.
To break it down (as I would do it, at least):

Run the initial policy on all machines (once per day, limited to off-hours
if there would be any performance concerns).  This policy does:
- run script that checks AD groups.
- if desired group is found, issue a custom trigger of "receipt exists".
- if desired group is not found, issue a custom trigger of "receipt does not
exist".

The "receipt exists" custom trigger policy does:
- Install the dummy package

The "receipt does not exist" custom trigger policy does:
- delete the dummy package's receipt

Smart group is scoped to the existence of the dummy receipt.

You can now scope to your smart group knowing that it consists of all
members of your target AD group, with up to a 24-hour lag behind changes in
group membership.  If 24 hours is too big of a window, you could set it to
every15 (or 30 or whatever your periodic trigger is) and execution frequency
of "ongoing".  This is pretty lightweight, so I don't think there's any
cause for performance concerns.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 9, 2009 at 3:22 PM, Ryan Harter <rharter at uwsp.edu> wrote:

> This sounds like a good workaround.  I have emailed JAMF about this too,
> but haven't heard anything.  I'm sure they're all off at MacWorld:)
> I was hoping for a solution that I could make a computer group with so that
> I could only run it on the computers that need it and not on every computer
> just for the 20% that actually need the client.
>
> There is also talk of "leasing" CS3 licenses to departments on campus, in
> which case I would like to have self service only advertise the install on
> the computers that are in the CS3Licensed AD group.  I may do this by having
> us add the users to a group as well and scope it that way temporarily, but
> the ultimate goal is to have it available for department machines, not
> users.
>
> I was thinking of some sort of logic like:
>
> 1. run a policy that will check dscl for the group memberships of the
> computer.
> 2. install a dummy package.
> 3. base a smart group on the receipt of the dummy package.
> 4. scope the policies to the smart group
>
> That way, I can not only run the policy just for the group, but also keep a
> record of who's in it.  It's not a very elegant solution, but it may have to
> do.
> *
> Ryan Harter*
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:
>
> "Bound to a directory" and "Member of a group" are different concepts.
> I would also like the ability to recognize computer accounts and computer
> groups.
>
> You could work around the current situation with a script using logic like
> so:
>
> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your machine
> names are the same as your AD names) belongs to.
> 2. grep the output for the group you want to key on.
> 3. call a custom trigger
>
> The ability for Casper to recognize computer accounts & groups would be
> better than this, but this can give you the same net effect as scoping a
> policy to an AD group.  This also assumes you have the ability to perform
> LDAP lookups in AD.  If your JSS is taking advantage of LDAP, then you could
> use the same account to perform the lookup in the script.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
>
>>  Wouldn't you just create a smart computer group that goes off of the
>> Active Directory Status attribute?  You could either make it "Active
>> Directory Status" is <<name of AD>> (if you have more than one and you want
>> to specify which) or you could make "Active Directory Status" is not "Not
>> Bound"  It's a double negative, but that would return any machine bound to
>> an AD, no matter what the AD is called.
>>
>> See Attachment.
>>
>> Maybe I don't understand completely your question?
>>
>> j
>>
>>
>> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>>
>> Don't believe the JSS works with computer accounts in AD.
>>
>> Craig E
>>
>>
>> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>>
>> Hey Guys-
>>
>> Has anyone created a smart group that would take members based on if the
>> computer is a member of an AD group.
>>
>> Essentially what I'm trying to do is scope a policy to a group of
>> computers in AD, like you can with the User scope, but it doesn't seem to
>> work with computers.
>>
>> When user's register for our disaster recovery system, their computer is
>> added to a group in AD, and I would like to install the backup client on
>> their machine based on whether or not they are in this group.  Any ideas?
>>
>> *
>> Ryan Harter
>> *UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu <Ryan.Harter at uwsp.edu>>
>>
>>
>>
>>
>>
>>
>> --
>> Jared Nichols
>> ISD Infrastructure and Operations ? Desktop Engineering
>> MIT Lincoln Laboratory
>> 244 Wood St.
>> Lexington, MA 02420-9108
>> (781) 981-5500
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/f0fb756f/attachment.htm 

From rharter at uwsp.edu  Fri Jan  9 12:58:02 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Fri, 9 Jan 2009 14:58:02 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <C58D0F96.125BA%ernstcs@uwec.edu>
References: <C58D0F96.125BA%ernstcs@uwec.edu>
Message-ID: <2BB873C2-2F31-45F8-9E75-2EFEFDD9BBDC@uwsp.edu>

Ideally I would like to create a smart group based on AD group  
membership.  The reason for this is that this is a cross platform  
venture.  For the backup system I was talking about, users register  
themselves at a web page that then adds them to a Bacula group in AD.   
On the PC side group policy will then install the client on their  
system because they have been added to that group.  As it stands on  
the mac side when someone registers for the service we have to  
manually install the client.

As for the CS3 installs, when their department "leases" a license  
they're computers will just be added to an AD group (presumably  
automated by a website, hasn't been implemented yet) and the PC guys  
will use that group membership to advertise the install with SCCM.  I  
would like the Mac side to be just as automated, once the website puts  
their computer in the AD group, the install will be advertised.

I think for the Bacula client install, the best solution would be to  
have a smart group based on the AD group, and then a run once per  
computer policy to install the client.  For CS3, a self service  
install scoped to a smart group based on the AD group, which you can  
already do with users, but with computers, so that when the computer  
is added, the install will be advertised.

Before Casper we used AD group membership extensively to define which  
scripts were run, and what maintenance tasks were performed.  The  
groups help us determine whether machines are labs, faculty, which  
particular faculty, and anything special about each (i.e. registered  
for backups).

Our network isn't segmented well enough to use segments (we have a lab  
and facstaff vlan for each building and that is all).

The major goal of this is to automate all of these processes.  We all  
know that Mac admins have a lot to do and adding every individual user  
who decides to sign up for something is not high on my list:)

What would also be cool is a documented way to tie into the JSS with a  
web page (perhaps PHP) so that I could make a web page where people  
could sign up for something, get all the information I need and send  
some pieces to the JSS and some to other systems.  Perhaps there's a  
way to do this.  I hadn't thought of it before but boy does that sound  
cool.

Thanks for all the input.  I really think mailing lists are a great  
way of narrowing down the best way to do something based on what other  
people have done.

Thanks again.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 9, 2009, at 2:28 PM, Ernst, Craig S. wrote:

> So you don?t want to use the tools for Groups or Smart Groups in  
> the JSS? Or do you have options to limit based on network segments?  
> If you know the machines that need it...create a group in the JSS  
> and assign accordingly. I?m not sure how you name machines, or  
> assign them in terms of department and what not in the JSS, but  
> that?s why those options are there.
>
> I?m not really sure why the desire to use AD...
>
> I only ask because we don?t use AD on the Macs for anything but  
> authentication, thus all of our Macs are in a single container in  
> AD. What do you use the groups in AD for Macs for?
>
> And to be clear...I?m not saying what your trying to do is wrong or  
> unnecessary...I just am trying to better understand what you are  
> trying to do and perhaps learn something.
>
> Craig E
>
>
> On 1/9/09 2:22 PM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>
> This sounds like a good workaround.  I have emailed JAMF about this  
> too, but haven't heard anything.  I'm sure they're all off at  
> MacWorld:)
>
> I was hoping for a solution that I could make a computer group with  
> so that I could only run it on the computers that need it and not on  
> every computer just for the 20% that actually need the client.
>
> There is also talk of "leasing" CS3 licenses to departments on  
> campus, in which case I would like to have self service only  
> advertise the install on the computers that are in the CS3Licensed  
> AD group.  I may do this by having us add the users to a group as  
> well and scope it that way temporarily, but the ultimate goal is to  
> have it available for department machines, not users.
>
> I was thinking of some sort of logic like:
>
> 1. run a policy that will check dscl for the group memberships of  
> the computer.
> 2. install a dummy package.
> 3. base a smart group on the receipt of the dummy package.
> 4. scope the policies to the smart group
>
> That way, I can not only run the policy just for the group, but also  
> keep a record of who's in it.  It's not a very elegant solution, but  
> it may have to do.
>
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>
>
> On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:
>
> "Bound to a directory" and "Member of a group" are different concepts.
>
> I would also like the ability to recognize computer accounts and  
> computer groups.
>
> You could work around the current situation with a script using  
> logic like so:
>
>
> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your  
> machine names are the same as your AD names) belongs to.
> 2. grep the output for the group you want to key on.
>
> 3. call a custom trigger
>
> The ability for Casper to recognize computer accounts & groups would  
> be better than this, but this can give you the same net effect as  
> scoping a policy to an AD group.  This also assumes you have the  
> ability to perform LDAP lookups in AD.  If your JSS is taking  
> advantage of LDAP, then you could use the same account to perform  
> the lookup in the script.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
>  ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
>  www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
>
>  Wouldn't you just create a smart computer group that goes off of  
> the Active Directory Status attribute?  You could either make it  
> "Active Directory Status" is <<name of AD>> (if you have more than  
> one and you want to specify which) or you could make "Active  
> Directory Status" is not "Not Bound"  It's a double negative, but  
> that would return any machine bound to an AD, no matter what the AD  
> is called.
>
>  See Attachment.
>
>  Maybe I don't understand completely your question?
>
>  j
>
>
>  On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu <http://ERNSTCS at uwec.edu 
> > > wrote:
>
>
> Don't believe the JSS works with computer accounts in AD.
>
>  Craig E
>
>
>  On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu <http://rharter at uwsp.edu 
> > > wrote:
>
>
> Hey Guys-
>
>  Has anyone created a smart group that would take members based on  
> if the computer is a member of an AD group.
>
>  Essentially what I'm trying to do is scope a policy to a group of  
> computers in AD, like you can with the User scope, but it doesn't  
> seem to work with computers.
>
>  When user's register for our disaster recovery system, their  
> computer is added to a group in AD, and I would like to install the  
> backup client on their machine based on whether or not they are in  
> this group.  Any ideas?
>
>
> Ryan Harter
>  UW - Stevens Point
>  Workstation Developer
>  715.346.2716
>  Ryan.Harter at uwsp.edu <http://Ryan.Harter at uwsp.edu> <mailto:Ryan.Harter at uwsp.edu 
> >
>
>
>
>
>
>
>
>  --
>  Jared Nichols
>  ISD Infrastructure and Operations ? Desktop Engineering
>  MIT Lincoln Laboratory
>  244 Wood St.
>  Lexington, MA 02420-9108
>  (781) 981-5500
>
>
> _______________________________________________
>  Casper mailing list
>  Casper at list.jamfsoftware.com
>  http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/d3d94c5c/attachment.html 

From rharter at uwsp.edu  Fri Jan  9 14:27:42 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Fri, 9 Jan 2009 16:27:42 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
	<ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
	<CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>
	<ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>
Message-ID: <21371DCC-0478-4393-AFF2-116CE8426B39@uwsp.edu>

 From Jamf:

> What you will want to do is log on to the JSS, go to Admin, and add  
> the LDAP server again, only scope it to computers rather than  
> Users.  That should give you the ability to scope to the AD groups.


That seems to work for getting computer and group records, but I  
haven't found yet how to scope a policy to that group, the JSS just  
seems to return Casper groups.  I'll let you know when I find this out.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 9, 2009, at 2:50 PM, Miles Leacy wrote:

> I'm a big fan of smart groups based on dummy receipts.
>
> To break it down (as I would do it, at least):
>
> Run the initial policy on all machines (once per day, limited to off- 
> hours if there would be any performance concerns).  This policy does:
> - run script that checks AD groups.
> - if desired group is found, issue a custom trigger of "receipt  
> exists".
> - if desired group is not found, issue a custom trigger of "receipt  
> does not exist".
>
> The "receipt exists" custom trigger policy does:
> - Install the dummy package
>
> The "receipt does not exist" custom trigger policy does:
> - delete the dummy package's receipt
>
> Smart group is scoped to the existence of the dummy receipt.
>
> You can now scope to your smart group knowing that it consists of  
> all members of your target AD group, with up to a 24-hour lag behind  
> changes in group membership.  If 24 hours is too big of a window,  
> you could set it to every15 (or 30 or whatever your periodic trigger  
> is) and execution frequency of "ongoing".  This is pretty  
> lightweight, so I don't think there's any cause for performance  
> concerns.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Fri, Jan 9, 2009 at 3:22 PM, Ryan Harter <rharter at uwsp.edu> wrote:
> This sounds like a good workaround.  I have emailed JAMF about this  
> too, but haven't heard anything.  I'm sure they're all off at  
> MacWorld:)
>
> I was hoping for a solution that I could make a computer group with  
> so that I could only run it on the computers that need it and not on  
> every computer just for the 20% that actually need the client.
>
> There is also talk of "leasing" CS3 licenses to departments on  
> campus, in which case I would like to have self service only  
> advertise the install on the computers that are in the CS3Licensed  
> AD group.  I may do this by having us add the users to a group as  
> well and scope it that way temporarily, but the ultimate goal is to  
> have it available for department machines, not users.
>
> I was thinking of some sort of logic like:
>
> 1. run a policy that will check dscl for the group memberships of  
> the computer.
> 2. install a dummy package.
> 3. base a smart group on the receipt of the dummy package.
> 4. scope the policies to the smart group
>
> That way, I can not only run the policy just for the group, but also  
> keep a record of who's in it.  It's not a very elegant solution, but  
> it may have to do.
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:
>
>> "Bound to a directory" and "Member of a group" are different  
>> concepts.
>>
>> I would also like the ability to recognize computer accounts and  
>> computer groups.
>>
>> You could work around the current situation with a script using  
>> logic like so:
>>
>> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your  
>> machine names are the same as your AD names) belongs to.
>> 2. grep the output for the group you want to key on.
>> 3. call a custom trigger
>>
>> The ability for Casper to recognize computer accounts & groups  
>> would be better than this, but this can give you the same net  
>> effect as scoping a policy to an AD group.  This also assumes you  
>> have the ability to perform LDAP lookups in AD.  If your JSS is  
>> taking advantage of LDAP, then you could use the same account to  
>> perform the lookup in the script.
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
>> Wouldn't you just create a smart computer group that goes off of  
>> the Active Directory Status attribute?  You could either make it  
>> "Active Directory Status" is <<name of AD>> (if you have more than  
>> one and you want to specify which) or you could make "Active  
>> Directory Status" is not "Not Bound"  It's a double negative, but  
>> that would return any machine bound to an AD, no matter what the AD  
>> is called.
>>
>> See Attachment.
>>
>> Maybe I don't understand completely your question?
>>
>> j
>>
>>
>> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>>
>> Don't believe the JSS works with computer accounts in AD.
>>
>> Craig E
>>
>>
>> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>>
>> Hey Guys-
>>
>> Has anyone created a smart group that would take members based on  
>> if the computer is a member of an AD group.
>>
>> Essentially what I'm trying to do is scope a policy to a group of  
>> computers in AD, like you can with the User scope, but it doesn't  
>> seem to work with computers.
>>
>> When user's register for our disaster recovery system, their  
>> computer is added to a group in AD, and I would like to install the  
>> backup client on their machine based on whether or not they are in  
>> this group.  Any ideas?
>>
>>
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>>
>>
>>
>>
>>
>> -- 
>> Jared Nichols
>> ISD Infrastructure and Operations ? Desktop Engineering
>> MIT Lincoln Laboratory
>> 244 Wood St.
>> Lexington, MA 02420-9108
>> (781) 981-5500
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090109/a918787c/attachment.html 

From david.lundgren at brooks.edu  Fri Jan  9 18:15:11 2009
From: david.lundgren at brooks.edu (David Lundgren)
Date: Fri, 9 Jan 2009 18:15:11 -0800
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
Message-ID: <C58D44AF.1C64F%david.lundgren@brooks.edu>

Thank you all for your help, ideas and definitely the script. I was going to
use python for the scripting part as my netinstall is leopard, but I'll just
modify yours as needed for our setup. If I refactor the script I'll shoot it
back to the list.

I ran into the same problem as a others saw with the symlink'd /Users when
installing CS4, it didn't like symlinks. So I setup the fstab on Leopard
(using vifs) and it worked for the CS4 install.

Thanks

Dave


On 1/9/09 5:15 AM, "Daniel Farnworth"
<daniel.farnworth at thecreativepartnership.co.uk> wrote:

> He he, thought that'd be popular.
> 
> The script is fairly poorly written (I'm not a Bash wiz) so any
> improvements are welcome (please let me have any so I can improve mine).
> 
> We run it as a 'before' script during our imaging process and it
> takes a look at the internal disks, tries to figure out which is the
> system disk or otherwise the disk in the first bay (Mac Pros only I
> think) and then partitions it up into various volumes that we want.
> Our post-flight script then takes the names of these and builds an
> fstab file which it writes down to /etc. It also moves our admin
> user's ('lwsadmin' in the script) home directory to /var/homes. We
> figured this may be wise just in case the data partition goes dead
> for any reason. Our OS image is pre-confd with lwsadmin's home
> pointing at the correct location, so you may want to excise this
> section and rely on using root to login in bad circumstances.
> 
> Oh, the post script also 'hides' some of the partitions (Restore,
> Freespace etc) so they don't show on the desktop, check the resulting
> fstab to see how this is done.
> 
> Be careful using this, it is destructive. Usual disclaimers apply =)
> 
> ### Pre-install Partition Script
> 
> #!/bin/bash -v
> 
> exec 2>&1
> 
> function rawdisksize {
> FLOAT=$1
> INT1=${FLOAT/.*}
> #if $(( INT1 % 10 )) then
> while (( INT1 % 10 ))
> do
> let INT1++
> done
> #fi
> echo "$INT1"
> }
> 
> 
> function partitionsizes {
> 
> case $RAW_SIZE in
> 
>         30)
>                 INTHD_SIZE=15
>                 HOMES_SIZE=10
>                 SCRATCH_SIZE=3
>                 RESTORE_SIZE=0
>                 ;;
> 
>         40)
>                 INTHD_SIZE=20
>                 HOMES_SIZE=10
>                 SCRATCH_SIZE=5
>                 RESTORE_SIZE=0
>                 ;;
> 
>         60)
>                 INTHD_SIZE=30
>                 HOMES_SIZE=10
>                 SCRATCH_SIZE=10
>                 RESTORE_SIZE=5
>                 ;;
> 
>         80)
>                 INTHD_SIZE=40
>                 HOMES_SIZE=10
>                 SCRATCH_SIZE=10
>                 RESTORE_SIZE=10
>                 ;;
> 
>         120)
>                 INTHD_SIZE=60
>                 HOMES_SIZE=20
>                 SCRATCH_SIZE=10
>                 RESTORE_SIZE=20
>                 ;;
> 
>         160)
>                 INTHD_SIZE=80
>                 HOMES_SIZE=25
>                 SCRATCH_SIZE=10
>                 RESTORE_SIZE=25
>                 ;;
> 
>         240)
>                 INTHD_SIZE=160
>                 HOMES_SIZE=25
>                 SCRATCH_SIZE=10
>                 RESTORE_SIZE=25
>                 ;;
> 
>         *)
>                 INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
>                 HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                 SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                 RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
>                 ;;
> esac
> 
> }
> 
> 
> # Define a function to define whether this is a 'Bay Capable' machine
> #function bayedmachine {
> 
> # This needs to be written fairly soon
> 
> #}
> 
> 
> if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
> 
>         echo ${1}
>         TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> '{ print $3 }' | cut -c 1-5`
>         echo ${TARGETDISK}
>        
>         # now to partition the disk
>         #
>        
>         if [ ! -z $TARGETDISK ]
>         then
>                 TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" |
> awk 
> '{ print $3 }'`
>                 RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
>                 partitionsizes
>                
>                 echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
>                 echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
>                  echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
>                  echo "CP-Homes-01 Size: $HOMES_SIZE GB"
>                  echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
>                  echo "Restore Size: $RESTORE_SIZE GB"
>                
>                
>                 # Check processor type so we partition in the right format
>                
>                 sysinfo=`system_profiler`
>                
>                 countPPC=`echo ${sysinfo} | grep -c PowerPC`
>                 countIntel=`echo ${sysinfo} | grep -c Intel`
>                
>                 if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
>                         echo "Got a PPC in here"
>                         partition_scheme_type="APMFormat"
>                  
>                 elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
>                         echo "Intel Inside"
>                         partition_scheme_type="GPTFormat"
>                  
>                 else
>                         echo "Can't work out what kinda proc, it either ain't
> got one or 
> could be a Cray?"
>                         exit 1
>                  
>                 fi
> 
>                
>                 # Set the partition going
>                
>                 if [ $RESTORE_SIZE -gt 0 ]; then
>                
>                         diskutil partitionDisk $TARGETDISK 4
> $partition_scheme_type \
>                                 "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
>                                 "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
>                                 "Journaled HFS+" CP-Scratch-NOT-BackedUp
> "$SCRATCH_SIZE"G \
>                                 "Journaled HFS+" Restore "$RESTORE_SIZE"G
>                  
>                 else
>                
>                         diskutil partitionDisk $TARGETDISK 3
> $partition_scheme_type \
>                                 "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
>                                 "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
>                                 "Journaled HFS+" CP-Scratch-NOT-BackedUp
> "$SCRATCH_SIZE"G
>                  
>                 fi
> 
>        
>                         chown root:admin /Volumes/CP-Homes-01
>                         chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
>                         chown root:admin /Volumes/Restore
>                         chown root:admin /Volumes/Free-Space
>        
>                         chmod g+w /Volumes/CP-Homes-01
>                         chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
>                         chmod g+w /Volumes/Restore
>                         chmod g+w /Volumes/Free-Space
>        
>                         touch /Volumes/CP-IntHD-01/.cp-partition-done
>                  
>         else
>        
>                         echo "Problem acquiring target disk, exiting";
>                         exit 1
> 
>         fi
>        
> else
>        
>         echo "The partition scheme has already been created. Exiting"
>         exit 0
>        
> fi
> 
> exit 0
> 
> 
> ### Post Install Script
> 
> #!/bin/bash -v
> 
> # Redirect STDERR to STDOUT
> exec 2>&1
> 
> VOLSDIR="/Volumes/"
> 
> ROOTVOL="CP-IntHD-01"
> HOMESVOL="CP-Homes-01"
> 
> ROOTPATH="${VOLSDIR}${ROOTVOL}"
> HOMESPATH="${VOLSDIR}${HOMESVOL}"
> 
> 
> 
> 
> if [ -e "${1}/.cp-partition-done" ]; then
> 
>         # Ditto the contents of $ROOTPART/Users/Shared to their new location
>        
>         ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
>         if (( ! $? )); then
>        
>                 # Remove the old copy of $ROOTPART/Users/Shared
>                 echo "Done dittoing..."
>                 rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed"
> ; }
>                 rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> failed" ; }
>                 rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized
> failed" ; }
>                
>                 if [ -e "${1}/var/homes/lwsadmin" ]; then
>                         rm -vR "${1}/Users/lwsadmin" || { echo "rm
> /Users/lwsadmin 
> failed" ; }
>                 fi
> 
>                 DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
>                 UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print
> $2'}`
>                 echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || {
> echo 
> "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
>                 echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >>
> $1/etc/
> fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
>                
>                 HIDDEN_VOLS=(Restore Free-Space)
>                
>                 for volume in "${HIDDEN_VOLS[@]}"; do
>                
>                         DEVID=`diskutil list | grep $volume | awk '{print
> $6}'`
>                         UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk
> {'print $2'}`
>                  
>                         echo "# Set the volume $volume to not mount at
> startup" >> $1/etc/
> fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit 1 ; }
>                         echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n"
> >> $1/etc/
> fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
>                
>                 done
>        
>         fi
>        
>         touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> could not be created" ; exit 1 ; }
>        
>         exit 0
> 
> else
>         # Log the error
>         echo "Could not find partition completion file. It would be wise not
> to continue"
>         # Exit with above 0 status
>         exit 1
> 
> fi
> 
> 
> 
> 
> 
> 
> On 9 Jan 2009, at 12:44, Damien Weiss wrote:
> 
>> 
>> YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
>> would implement almost immediately.
>> 
>> Thanks!
>> Damien
>> 
>> On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
>> 
>>> I have a pre-
>>> install script that we use to do this for us if anyone is interested.
>>> 
>>> Cheers
>>> Dan
>> 
> 
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
> 
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
> 
> PGP Public Key available
> 
> 
> 
> 
> 
> 
> The information contained in this communication is intended solely for the use
> of the individual or entity to whom it is addressed and others authorised to
> receive it. It may contain confidential or legally privileged information. If
> you are not the intended recipient you are hereby notified that any
> disclosure, copying, distribution or taking any action in reliance on the
> contents of this information is strictly prohibited and may be unlawful. If
> you have received this communication in error, please notify
> postmaster at thecreativepartnership.co.uk immediately and then delete this email
> from your system. Any views or opinions presented in this email are solely
> those of the author and do not necessarily represent those of The Creative
> Partnership. The Creative Partnership has taken every reasonable precaution to
> ensure that any attachment to this e-mail has been swept for viruses. However,
> The Creative Partnership cannot accept liability for any damage sustained as a
> result of software viruses and would advise that you carry out your own virus
> checks before opening any attachment.
> 
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

-- 
David Lundgren
IT Systems Administrator

Brooks Institute - "Passion, Vision, Excellence"
27 East Cota Street
Santa Barbara, CA 93101
(888) 304-3456 (toll-free)
(805) 690-7615 (office)
http://www.brooks.edu


From daniel.farnworth at thecreativepartnership.co.uk  Mon Jan 12 06:51:45 2009
From: daniel.farnworth at thecreativepartnership.co.uk (Daniel Farnworth)
Date: Mon, 12 Jan 2009 14:51:45 +0000
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <ec2e75ff0901090830l4f1390ek8fbcdf1784d702a0@mail.gmail.com>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
	<49671CF6.7141.0039.0@kckps.org>
	<ec2e75ff0901090830l4f1390ek8fbcdf1784d702a0@mail.gmail.com>
Message-ID: <242804D3-F369-47C4-9432-722A74F63B08@thecreativepartnership.co.uk>

Thanks Miles, your comments are much appreciated.

For what it's worth, the fstab will work just fine using  
LABEL=volume_name and this may in fact be more portable, but we  
figured that best practice was to use UUIDs wherever possible. The  
only area this may be an issue is if you where to move a physical  
data disk to another machine but not the system disk, but you'd only  
need to update the fstab appropriately and all would be well.

We've found this to be a very effective way of separating data from  
OS/applications, you just need to to remember to be careful when  
erasing, re-imaging and definitely when partitioning!

Cheers
Dan

On 9 Jan 2009, at 16:30, Miles Leacy wrote:

> UUIDs, being universally unique, you can't reference a UUID from  
> machine A and disk A on machine B.  It's like telling someone to go  
> to Guam when this person doesn't know where Guam is and has neither  
> a boat nor a plane.
>
> I've just skimmed the script so far (I have some deadlines I'm  
> working today), but if I read it correctly, Dan's script is quite  
> clever in that it dynamically grabs the appropriate UUID from the  
> disk being acted upon.  So, if using the UUID is a best practice,  
> then Dan's got quite a nugget of scripty goodness here.
>
> To make sure due diligence is performed, let me ask; What if any  
> issues has anyone using fstab in this way encountered?  Are there  
> any theoretical issues to be concerned about?
>
> ----------
> Miles A. Leacy IV
>
>  Certified System Administrator 10.4
>  Certified Technical Coordinator 10.5
>  Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/9 Thomas Larkin <tlarki at kckps.org>
> When we did our massive dual boot image over this last summer I was  
> looking at the /etc/fstab file to hide the windows partition from  
> the OS X side.  I had so many problems getting fstab to work.  It  
> would not work for me if I used volume name or the device mount  
> point, ie /dev/disk1s3/.  It would work if I used UUID, but if you  
> mass duplicate that UUID to tons of machines I found that it  
> wouldn't work.
>
> What has been your experience using /etc/fstab in 10.5?
>
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Daniel Farnworth  
> <daniel.farnworth at thecreativepartnership.co.uk> 01/09/09 7:15 AM >>>
>
> He he, thought that'd be popular.
>
> The script is fairly poorly written (I'm not a Bash wiz) so any
> improvements are welcome (please let me have any so I can improve  
> mine).
>
> We run it as a 'before' script during our imaging process and it
> takes a look at the internal disks, tries to figure out which is the
> system disk or otherwise the disk in the first bay (Mac Pros only I
> think) and then partitions it up into various volumes that we want.
> Our post-flight script then takes the names of these and builds an
> fstab file which it writes down to /etc. It also moves our admin
> user's ('lwsadmin' in the script) home directory to /var/homes. We
> figured this may be wise just in case the data partition goes dead
> for any reason. Our OS image is pre-confd with lwsadmin's home
> pointing at the correct location, so you may want to excise this
> section and rely on using root to login in bad circumstances.
>
> Oh, the post script also 'hides' some of the partitions (Restore,
> Freespace etc) so they don't show on the desktop, check the resulting
> fstab to see how this is done.
>
> Be careful using this, it is destructive. Usual disclaimers apply =)
>
> ### Pre-install Partition Script
>
> #!/bin/bash -v
>
> exec 2>&1
>
> function rawdisksize {
> FLOAT=$1
> INT1=${FLOAT/.*}
> #if $(( INT1 % 10 )) then
> while (( INT1 % 10 ))
> do
> let INT1++
> done
> #fi
> echo "$INT1"
> }
>
>
> function partitionsizes {
>
> case $RAW_SIZE in
>
> 30)
> INTHD_SIZE=15
> HOMES_SIZE=10
> SCRATCH_SIZE=3
> RESTORE_SIZE=0
> ;;
>
> 40)
> INTHD_SIZE=20
> HOMES_SIZE=10
> SCRATCH_SIZE=5
> RESTORE_SIZE=0
> ;;
>
> 60)
> INTHD_SIZE=30
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=5
> ;;
>
> 80)
> INTHD_SIZE=40
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=10
> ;;
>
> 120)
> INTHD_SIZE=60
> HOMES_SIZE=20
> SCRATCH_SIZE=10
> RESTORE_SIZE=20
> ;;
>
> 160)
> INTHD_SIZE=80
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> 240)
> INTHD_SIZE=160
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> *)
> INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
> HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> ;;
> esac
>
> }
>
>
> # Define a function to define whether this is a 'Bay Capable' machine
> #function bayedmachine {
>
> # This needs to be written fairly soon
>
> #}
>
>
> if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
>
> echo ${1}
> TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> '{ print $3 }' | cut -c 1-5`
> echo ${TARGETDISK}
>
> # now to partition the disk
> #
>
> if [ ! -z $TARGETDISK ]
> then
> TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk
> '{ print $3 }'`
> RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
> partitionsizes
>
> echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
> echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
>                  echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
>                  echo "CP-Homes-01 Size: $HOMES_SIZE GB"
>                  echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
>                  echo "Restore Size: $RESTORE_SIZE GB"
>
>
> # Check processor type so we partition in the right format
>
> sysinfo=`system_profiler`
>
> countPPC=`echo ${sysinfo} | grep -c PowerPC`
> countIntel=`echo ${sysinfo} | grep -c Intel`
>
> if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
> echo "Got a PPC in here"
> partition_scheme_type="APMFormat"
>
> elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
> echo "Intel Inside"
> partition_scheme_type="GPTFormat"
>
> else
> echo "Can't work out what kinda proc, it either ain't got one or
> could be a Cray?"
> exit 1
>
> fi
>
>
> # Set the partition going
>
> if [ $RESTORE_SIZE -gt 0 ]; then
>
> diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
> "Journaled HFS+" Restore "$RESTORE_SIZE"G
>
> else
>
> diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G
>
> fi
>
>
> chown root:admin /Volumes/CP-Homes-01
> chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
> chown root:admin /Volumes/Restore
> chown root:admin /Volumes/Free-Space
>
> chmod g+w /Volumes/CP-Homes-01
> chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
> chmod g+w /Volumes/Restore
> chmod g+w /Volumes/Free-Space
>
> touch /Volumes/CP-IntHD-01/.cp-partition-done
>
> else
>
> echo "Problem acquiring target disk, exiting";
> exit 1
>
> fi
>
> else
>
> echo "The partition scheme has already been created. Exiting"
> exit 0
>
> fi
>
> exit 0
>
>
> ### Post Install Script
>
> #!/bin/bash -v
>
> # Redirect STDERR to STDOUT
> exec 2>&1
>
> VOLSDIR="/Volumes/"
>
> ROOTVOL="CP-IntHD-01"
> HOMESVOL="CP-Homes-01"
>
> ROOTPATH="${VOLSDIR}${ROOTVOL}"
> HOMESPATH="${VOLSDIR}${HOMESVOL}"
>
>
>
>
> if [ -e "${1}/.cp-partition-done" ]; then
>
> # Ditto the contents of $ROOTPART/Users/Shared to their new location
>
> ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
> if (( ! $? )); then
>
> # Remove the old copy of $ROOTPART/Users/Shared
> echo "Done dittoing..."
> rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
> rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> failed" ; }
> rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized
> failed" ; }
>
> if [ -e "${1}/var/homes/lwsadmin" ]; then
> rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin
> failed" ; }
> fi
>
> DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
> echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo
> "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
> echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
>
> HIDDEN_VOLS=(Restore Free-Space)
>
> for volume in "${HIDDEN_VOLS[@]}"; do
>
> DEVID=`diskutil list | grep $volume | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
>
> echo "# Set the volume $volume to not mount at startup" >> $1/etc/
> fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit  
> 1 ; }
> echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
>
> done
>
> fi
>
> touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> could not be created" ; exit 1 ; }
>
> exit 0
>
> else
> # Log the error
> echo "Could not find partition completion file. It would be wise not
> to continue"
> # Exit with above 0 status
> exit 1
>
> fi
>
>
>
>
>
>
> On 9 Jan 2009, at 12:44, Damien Weiss wrote:
>
> >
> > YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
> > would implement almost immediately.
> >
> > Thanks!
> > Damien
> >
> > On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
> >
> >> I have a pre-
> >> install script that we use to do this for us if anyone is  
> interested.
> >>
> >> Cheers
> >> Dan
> >
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely  
> for the use of the individual or entity to whom it is addressed and  
> others authorised to receive it. It may contain confidential or  
> legally privileged information. If you are not the intended  
> recipient you are hereby notified that any disclosure, copying,  
> distribution or taking any action in reliance on the contents of  
> this information is strictly prohibited and may be unlawful. If you  
> have received this communication in error, please notify  
> postmaster at thecreativepartnership.co.uk immediately and then delete  
> this email from your system. Any views or opinions presented in  
> this email are solely those of the author and do not necessarily  
> represent those of The Creative Partnership. The Creative  
> Partnership has taken every reasonable precaution to ensure that  
> any attachment to this e-mail has been swept for viruses. However,  
> The Creative Partnership cannot accept liability for any damage  
> sustained as a result of s
> oftware viruses and would advise that you carry out your own virus  
> checks before opening any attachment.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

-- 
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.


From miles.leacy at themacadmin.com  Mon Jan 12 07:11:01 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 10:11:01 -0500
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <16A544D3-EA6B-4332-AD96-9279B2B30174@uwsp.edu>
References: <C58D2C23.1E014%Cyrus.Vahhaji@bestbuy.com>
	<16A544D3-EA6B-4332-AD96-9279B2B30174@uwsp.edu>
Message-ID: <ec2e75ff0901120711x11697048we19941f2cc44c7a2@mail.gmail.com>

Gents,
I'm taking this back on list because there may be others in the community
that would benefit from this discussion.

To Recap, there are two questions: how to use custom triggers and how to
create dummy receipts.

To use a custom trigger there are two things to do:
1. Create a policy and in the General tab, choose "other (Manually specify
the run at action in this field) -->" from the "Triggered by:" drop down
menu and enter your custom trigger in the text field next to this drop down
menu.  I use Apple-esque run-together phrases with caps, such as
"memberAccountingComputerGroup" for my custom triggers.  I'm not sure what
the upper limit is for custom trigger length, but I haven't hit it yet, and
I like to be descriptive with my triggers.

Re: "Dummy receipts"
The so-called "dummy receipt" is a receipt from a payload-free package.  I
create empty prebuilt Apple .pkg files using Composer like so...
1. Create an empty folder with the same name as your intended package (and
receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture
1.png")
2. Open Composer, choose this prebuilt package and save it as an Apple .pkg.
 (see attachment "Picture 2.png")

Some may find that using these "dummy receipts" creates clutter, but if you
integrate the concept into your workflows, document your work, and maintain
clear and consistent policies (in the general sense, not Casper Policies)
and naming conventions, use of receipts in this way can be a very efficient
and effective method to extend your management capabilities.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu> wrote:

> I haven't used dummy receipts before, I've been trying to avoid them if
> possible because it seems like more for me to keep track of.  Miles might be
> able to give you more help with that.
> As for the custom trigger, you've got it all figured out.  when you set a
> policy you can set triggered by to custom (I think it even has an ascii
> arrow ----->) and enter the trigger in the text box.  Then you call sudo
> jamf policy --trigger "custom trigger" and it will run that policy.  I
> currently do it as a workaround to get my adobe installs to run after boot
> time.
>
> Hope this helps,
> *
> Ryan Harter*
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:
>
> Miles, Ryan,
>
> I've been following "Computer group from AD" thread and you brought up
> dummy receipts and triggering custom policies and didn't want to hijack the
> thread with my question.
>
> What is the best way of creating a Dummy Receipt? Would it be an empty
> folder created in Composer?
>
> What do you mean by "custom trigger" here?
> - if desired group is found, issue a custom trigger of "receipt exists".
>  Is it triggering a policy to add the dummy receipt that the machine is in
> AD? If so, are you using something like "sudo jamf policy ?trigger "desired
> policy"
>
> Thanx,
>
> *Cyrus Vahhaji
> **Accenture
> Best Buy Technology Group
> *desk ? 612.291.3643
> fax ? 952.430.4260
> email ? mailto:cyrus.vahhaji at bestbuy.com <cyrus.vahhaji at bestbuy.com>
>
> This message is for the designated recipient only and may contain
> privileged, proprietary, or otherwise private information. If you have
> received it in error, please notify the sender immediately and delete the
> original. Any other use of the email by you is prohibited.
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/1a794e67/attachment-0001.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture 1.png
Type: image/png
Size: 119266 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/1a794e67/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture 2.png
Type: image/png
Size: 87124 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/1a794e67/attachment-0003.png 

From rharter at uwsp.edu  Mon Jan 12 07:38:55 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Mon, 12 Jan 2009 09:38:55 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
	<ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
	<CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>
	<ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>
Message-ID: <BFA01D44-1076-47EE-A585-46530399C15F@uwsp.edu>

I'd like to update everyone on this issue.  Jamf has replied to my  
emails saying that this is actually possible.  What you need to do is:

1. Set up a new LDAP server (even if you have one for users) and scope  
it to computers.
2. Click "Text Server" and make sure you can see the groups,  
computers, and computer's group membership.
3. The groups from AD should now appear in the "Static Computer  
Groups" section with their source being "Active Directory".

That is what Jamf says should be happening, however, I've gotten  
through setup two and they still don't show up in Groups.  It could be  
an environment specific problem, but I'll let you know how to get it  
working when I figure it out.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 9, 2009, at 2:50 PM, Miles Leacy wrote:

> I'm a big fan of smart groups based on dummy receipts.
>
> To break it down (as I would do it, at least):
>
> Run the initial policy on all machines (once per day, limited to off- 
> hours if there would be any performance concerns).  This policy does:
> - run script that checks AD groups.
> - if desired group is found, issue a custom trigger of "receipt  
> exists".
> - if desired group is not found, issue a custom trigger of "receipt  
> does not exist".
>
> The "receipt exists" custom trigger policy does:
> - Install the dummy package
>
> The "receipt does not exist" custom trigger policy does:
> - delete the dummy package's receipt
>
> Smart group is scoped to the existence of the dummy receipt.
>
> You can now scope to your smart group knowing that it consists of  
> all members of your target AD group, with up to a 24-hour lag behind  
> changes in group membership.  If 24 hours is too big of a window,  
> you could set it to every15 (or 30 or whatever your periodic trigger  
> is) and execution frequency of "ongoing".  This is pretty  
> lightweight, so I don't think there's any cause for performance  
> concerns.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Fri, Jan 9, 2009 at 3:22 PM, Ryan Harter <rharter at uwsp.edu> wrote:
> This sounds like a good workaround.  I have emailed JAMF about this  
> too, but haven't heard anything.  I'm sure they're all off at  
> MacWorld:)
>
> I was hoping for a solution that I could make a computer group with  
> so that I could only run it on the computers that need it and not on  
> every computer just for the 20% that actually need the client.
>
> There is also talk of "leasing" CS3 licenses to departments on  
> campus, in which case I would like to have self service only  
> advertise the install on the computers that are in the CS3Licensed  
> AD group.  I may do this by having us add the users to a group as  
> well and scope it that way temporarily, but the ultimate goal is to  
> have it available for department machines, not users.
>
> I was thinking of some sort of logic like:
>
> 1. run a policy that will check dscl for the group memberships of  
> the computer.
> 2. install a dummy package.
> 3. base a smart group on the receipt of the dummy package.
> 4. scope the policies to the smart group
>
> That way, I can not only run the policy just for the group, but also  
> keep a record of who's in it.  It's not a very elegant solution, but  
> it may have to do.
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:
>
>> "Bound to a directory" and "Member of a group" are different  
>> concepts.
>>
>> I would also like the ability to recognize computer accounts and  
>> computer groups.
>>
>> You could work around the current situation with a script using  
>> logic like so:
>>
>> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your  
>> machine names are the same as your AD names) belongs to.
>> 2. grep the output for the group you want to key on.
>> 3. call a custom trigger
>>
>> The ability for Casper to recognize computer accounts & groups  
>> would be better than this, but this can give you the same net  
>> effect as scoping a policy to an AD group.  This also assumes you  
>> have the ability to perform LDAP lookups in AD.  If your JSS is  
>> taking advantage of LDAP, then you could use the same account to  
>> perform the lookup in the script.
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
>> Wouldn't you just create a smart computer group that goes off of  
>> the Active Directory Status attribute?  You could either make it  
>> "Active Directory Status" is <<name of AD>> (if you have more than  
>> one and you want to specify which) or you could make "Active  
>> Directory Status" is not "Not Bound"  It's a double negative, but  
>> that would return any machine bound to an AD, no matter what the AD  
>> is called.
>>
>> See Attachment.
>>
>> Maybe I don't understand completely your question?
>>
>> j
>>
>>
>> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>>
>> Don't believe the JSS works with computer accounts in AD.
>>
>> Craig E
>>
>>
>> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>>
>> Hey Guys-
>>
>> Has anyone created a smart group that would take members based on  
>> if the computer is a member of an AD group.
>>
>> Essentially what I'm trying to do is scope a policy to a group of  
>> computers in AD, like you can with the User scope, but it doesn't  
>> seem to work with computers.
>>
>> When user's register for our disaster recovery system, their  
>> computer is added to a group in AD, and I would like to install the  
>> backup client on their machine based on whether or not they are in  
>> this group.  Any ideas?
>>
>>
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>>
>>
>>
>>
>>
>> -- 
>> Jared Nichols
>> ISD Infrastructure and Operations ? Desktop Engineering
>> MIT Lincoln Laboratory
>> 244 Wood St.
>> Lexington, MA 02420-9108
>> (781) 981-5500
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/77970a09/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 12 08:31:37 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 11:31:37 -0500
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <ec2e75ff0901120711x11697048we19941f2cc44c7a2@mail.gmail.com>
References: <C58D2C23.1E014%Cyrus.Vahhaji@bestbuy.com>
	<16A544D3-EA6B-4332-AD96-9279B2B30174@uwsp.edu>
	<ec2e75ff0901120711x11697048we19941f2cc44c7a2@mail.gmail.com>
Message-ID: <ec2e75ff0901120831k5755d4f5r19d280be3d4092bc@mail.gmail.com>

Oops, I realized that I forgot to mention the second thing to do to use
custom triggers.  Ryan mentioned it further back in the thread, but here it
is again...
After you save your policy that is triggered by "other", for example, let's
say that other="customTrigger".

You call the custom-triggered policy via the jamf binary like so:

sudo jamf policy --trigger "customTrigger"


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 10:11 AM, Miles Leacy
<miles.leacy at themacadmin.com>wrote:

> Gents,
> I'm taking this back on list because there may be others in the community
> that would benefit from this discussion.
>
> To Recap, there are two questions: how to use custom triggers and how to
> create dummy receipts.
>
> To use a custom trigger there are two things to do:
> 1. Create a policy and in the General tab, choose "other (Manually specify
> the run at action in this field) -->" from the "Triggered by:" drop down
> menu and enter your custom trigger in the text field next to this drop down
> menu.  I use Apple-esque run-together phrases with caps, such as
> "memberAccountingComputerGroup" for my custom triggers.  I'm not sure what
> the upper limit is for custom trigger length, but I haven't hit it yet, and
> I like to be descriptive with my triggers.
>
> Re: "Dummy receipts"
> The so-called "dummy receipt" is a receipt from a payload-free package.  I
> create empty prebuilt Apple .pkg files using Composer like so...
> 1. Create an empty folder with the same name as your intended package (and
> receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture
> 1.png")
> 2. Open Composer, choose this prebuilt package and save it as an Apple
> .pkg.  (see attachment "Picture 2.png")
>
> Some may find that using these "dummy receipts" creates clutter, but if you
> integrate the concept into your workflows, document your work, and maintain
> clear and consistent policies (in the general sense, not Casper Policies)
> and naming conventions, use of receipts in this way can be a very efficient
> and effective method to extend your management capabilities.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>
> On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu> wrote:
>
>> I haven't used dummy receipts before, I've been trying to avoid them if
>> possible because it seems like more for me to keep track of.  Miles might be
>> able to give you more help with that.
>> As for the custom trigger, you've got it all figured out.  when you set a
>> policy you can set triggered by to custom (I think it even has an ascii
>> arrow ----->) and enter the trigger in the text box.  Then you call sudo
>> jamf policy --trigger "custom trigger" and it will run that policy.  I
>> currently do it as a workaround to get my adobe installs to run after boot
>> time.
>>
>> Hope this helps,
>>  *
>> Ryan Harter*
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu
>>
>> On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:
>>
>> Miles, Ryan,
>>
>> I've been following "Computer group from AD" thread and you brought up
>> dummy receipts and triggering custom policies and didn't want to hijack the
>> thread with my question.
>>
>> What is the best way of creating a Dummy Receipt? Would it be an empty
>> folder created in Composer?
>>
>> What do you mean by "custom trigger" here?
>> - if desired group is found, issue a custom trigger of "receipt exists".
>>  Is it triggering a policy to add the dummy receipt that the machine is in
>> AD? If so, are you using something like "sudo jamf policy ?trigger "desired
>> policy"
>>
>> Thanx,
>>
>> *Cyrus Vahhaji
>> **Accenture
>> Best Buy Technology Group
>> *desk ? 612.291.3643
>> fax ? 952.430.4260
>> email ? mailto:cyrus.vahhaji at bestbuy.com <cyrus.vahhaji at bestbuy.com>
>>
>> This message is for the designated recipient only and may contain
>> privileged, proprietary, or otherwise private information. If you have
>> received it in error, please notify the sender immediately and delete the
>> original. Any other use of the email by you is prohibited.
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/35700732/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 12 09:26:09 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 12:26:09 -0500
Subject: [Casper] Search and destroy apps
Message-ID: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>

Hi all,
I have another script to share.  In more than one environment I've worked
with, users were not allowed to store or run apps in/from their home
folders.  Policies were made clear that any apps in one's home folder were
considered a policy violation, and subject to automatic deletion.  I put
together the following script to make sure I never had to go hunt for
someone's hidden apps again.

#!/bin/bash

##### HEADER BEGINS #####
# scr_maint_searchDestroyAppsInHomeFolder.bash
#
# Created 20080729 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090112 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
remains intact.
#
# This script is provided "as is".  The author offers no warranty or
guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
twice more.
#
# This script performs a search & destroy on any apps in the user's home
folder
# This script deletes user data.  Be sure of your organization's policies as
they may apply before using.
#
# Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what data
will be deleted and that it is
# permissible to delete that data before using this script.
#
# It is intended to be run as part of a Casper policy triggered by login.
#
# Note: This script can take several minutes to run on very large home
folders.
# It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
in testing.
#
##### HEADER ENDS #####

# Set $isapp to indicate whether an item is an application
# initial value is 0
# a value of 0 = not an application
# a value of 1 = an application
isapp=0

# return the absolute path of each item in the specified directory and act
upon them in the "do" loop.
find  /Users/$3 | while read file
do

# skip the contents of .app bundles
    [[ "$file" = *.app/* ]] && continue

# determine whether $file is an application and change value of $isapp if it
is
    isapp=`mdls -name kMDItemKind "$file"|grep -c Application`

# if $file is an application ($isapp contains any nonzero value), act upon
it.
    if [ $isapp -ne 0 ];
      then echo "Deleting" "$file";
    fi

# reset $isapp
    isapp=0

done

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/af46bca4/attachment.html 

From william.smith at merrillcorp.com  Mon Jan 12 09:38:22 2009
From: william.smith at merrillcorp.com (Smith, William)
Date: Mon, 12 Jan 2009 11:38:22 -0600
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <ec2e75ff0901120831k5755d4f5r19d280be3d4092bc@mail.gmail.com>
Message-ID: <C590DC2E.8505%william.smith@merrillcorp.com>

Very nifty!

I?d like to see this get added to the JAMF KB. Couldn?t find anything like
this there.

-- 

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

On 1/12/09 10:31 AM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

> Oops, I realized that I forgot to mention the second thing to do to use custom
> triggers.  Ryan mentioned it further back in the thread, but here it is
> again...
> 
> After you save your policy that is triggered by "other", for example, let's
> say that other="customTrigger".
> 
> You call the custom-triggered policy via the jamf binary like so:
> 
> sudo jamf policy --trigger "customTrigger"
> 
> On Mon, Jan 12, 2009 at 10:11 AM, Miles Leacy <miles.leacy at themacadmin.com>
> wrote:
>> Gents,
>> 
>> I'm taking this back on list because there may be others in the community
>> that would benefit from this discussion.
>> 
>> To Recap, there are two questions: how to use custom triggers and how to
>> create dummy receipts.
>> 
>> To use a custom trigger there are two things to do:
>> 1. Create a policy and in the General tab, choose "other (Manually specify
>> the run at action in this field) -->" from the "Triggered by:" drop down menu
>> and enter your custom trigger in the text field next to this drop down menu.
>> I use Apple-esque run-together phrases with caps, such as
>> "memberAccountingComputerGroup" for my custom triggers.  I'm not sure what
>> the upper limit is for custom trigger length, but I haven't hit it yet, and I
>> like to be descriptive with my triggers.
>> 
>> Re: "Dummy receipts"
>> The so-called "dummy receipt" is a receipt from a payload-free package.  I
>> create empty prebuilt Apple .pkg files using Composer like so...
>> 1. Create an empty folder with the same name as your intended package (and
>> receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture
>> 1.png")
>> 2. Open Composer, choose this prebuilt package and save it as an Apple .pkg.
>> (see attachment "Picture 2.png")
>> 
>> Some may find that using these "dummy receipts" creates clutter, but if you
>> integrate the concept into your workflows, document your work, and maintain
>> clear and consistent policies (in the general sense, not Casper Policies) and
>> naming conventions, use of receipts in this way can be a very efficient and
>> effective method to extend your management capabilities.
>> 
>> On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu> wrote:
>>> I haven't used dummy receipts before, I've been trying to avoid them if
>>> possible because it seems like more for me to keep track of.  Miles might be
>>> able to give you more help with that.
>>> 
>>> As for the custom trigger, you've got it all figured out.  when you set a
>>> policy you can set triggered by to custom (I think it even has an ascii
>>> arrow ----->) and enter the trigger in the text box.  Then you call sudo
>>> jamf policy --trigger "custom trigger" and it will run that policy.  I
>>> currently do it as a workaround to get my adobe installs to run after boot
>>> time.
>>> 
>>> On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:
>>> 
>>>>  Miles, Ryan,
>>>>  
>>>>  I've been following "Computer group from AD" thread and you brought up
>>>> dummy receipts and triggering custom policies and didn't want to hijack the
>>>> thread with my question.
>>>>  
>>>>  What is the best way of creating a Dummy Receipt? Would it be an empty
>>>> folder created in Composer?
>>>>  
>>>>  What do you mean by "custom trigger" here?
>>>>  - if desired group is found, issue a custom trigger of "receipt exists".
>>>>   Is it triggering a policy to add the dummy receipt that the machine is in
>>>> AD? If so, are you using something like "sudo jamf policy ?trigger "desired
>>>> policy"


From miles.leacy at themacadmin.com  Mon Jan 12 10:17:09 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 13:17:09 -0500
Subject: [Casper] Search and destroy apps
In-Reply-To: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
Message-ID: <ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>

I left out a command in the script in my first message.  Here is the
complete script:
#!/bin/bash

##### HEADER BEGINS #####
# scr_maint_searchDestroyAppsInHomeFolder.bash
#
# Created 20090112 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090112 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
remains intact.
#
# This script is provided "as is".  The author offers no warranty or
guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
twice more.
#
# This script performs a search & destroy on any apps in the user's home
folder
# This script deletes user data.  Be sure of your organization's policies as
they may apply before using.
#
# Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what data
will be deleted and that it is
# permissible to delete that data before using this script.
#
# It is intended to be run as part of a Casper policy triggered by login.
#
# Note: This script can take several minutes to run on very large home
folders.
# It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
in testing.
#
##### HEADER ENDS #####

# Set $isapp to indicate whether an item is an application
# initial value is 0
# a value of 0 = not an application
# a value of 1 = an application
isapp=0

# return the absolute path of each item in the specified directory and act
upon them in the "do" loop.
find  /Users/$3 | while read file
do

# skip the contents of .app bundles
    [[ "$file" = *.app/* ]] && continue

# determine whether $file is an application and change value of $isapp if it
is
    isapp=`mdls -name kMDItemKind "$file"|grep -c Application`

# if $file is an application ($isapp contains any nonzero value), act upon
it.
    if [ $isapp -ne 0 ];
      then echo "Deleting" "$file"; rm -R "$file"
    fi

# reset $isapp
    isapp=0

done


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 12:26 PM, Miles Leacy
<miles.leacy at themacadmin.com>wrote:

> Hi all,
> I have another script to share.  In more than one environment I've worked
> with, users were not allowed to store or run apps in/from their home
> folders.  Policies were made clear that any apps in one's home folder were
> considered a policy violation, and subject to automatic deletion.  I put
> together the following script to make sure I never had to go hunt for
> someone's hidden apps again.
>
> #!/bin/bash
>
> ##### HEADER BEGINS #####
> # scr_maint_searchDestroyAppsInHomeFolder.bash
> #
> # Created 20080729 by Miles A. Leacy IV
> # miles.leacy at themacadmin.com
> # Modified 20090112 by Miles A. Leacy IV
> # Copyright 2009 Miles A. Leacy IV
> #
> # This script may be copied and distributed freely as long as this header
> remains intact.
> #
> # This script is provided "as is".  The author offers no warranty or
> guarantee of any kind.
> # Use of this script is at your own risk.  The author takes no
> responsibility for loss of use,
> # loss of data, loss of job, loss of socks, the onset of armageddon, or any
> other negative effects.
> #
> # Test thoroughly in a lab environment before use on production systems.
> # When you think it's ok, test again.  When you're certain it's ok, test
> twice more.
> #
> # This script performs a search & destroy on any apps in the user's home
> folder
> # This script deletes user data.  Be sure of your organization's policies
> as they may apply before using.
> #
> # Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what data
> will be deleted and that it is
> # permissible to delete that data before using this script.
> #
> # It is intended to be run as part of a Casper policy triggered by login.
> #
> # Note: This script can take several minutes to run on very large home
> folders.
> # It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
> in testing.
> #
> ##### HEADER ENDS #####
>
> # Set $isapp to indicate whether an item is an application
> # initial value is 0
> # a value of 0 = not an application
> # a value of 1 = an application
> isapp=0
>
> # return the absolute path of each item in the specified directory and act
> upon them in the "do" loop.
> find  /Users/$3 | while read file
> do
>
> # skip the contents of .app bundles
>     [[ "$file" = *.app/* ]] && continue
>
> # determine whether $file is an application and change value of $isapp if
> it is
>     isapp=`mdls -name kMDItemKind "$file"|grep -c Application`
>
> # if $file is an application ($isapp contains any nonzero value), act upon
> it.
>     if [ $isapp -ne 0 ];
>       then echo "Deleting" "$file";
>     fi
>
> # reset $isapp
>     isapp=0
>
> done
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/f6988007/attachment.htm 

From Cyrus.Vahhaji at bestbuy.com  Mon Jan 12 10:50:02 2009
From: Cyrus.Vahhaji at bestbuy.com (Cyrus Vahhaji)
Date: Mon, 12 Jan 2009 12:50:02 -0600
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <ec2e75ff0901120831k5755d4f5r19d280be3d4092bc@mail.gmail.com>
Message-ID: <C590ECFA.1E059%Cyrus.Vahhaji@bestbuy.com>

Miles,

Thanx for your thorough info. Question on syntax used below. Should there be
two dashes ?--? or one dash ?-? before trigger? Noticed Ryan also using two
dashes but Jamf help pages has only one.

Thanx for clarifying this.
Cyrus



From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Mon, 12 Jan 2009 11:31:37 -0500
To: Ryan Harter <rharter at uwsp.edu>
Cc: Cyrus Vahhaji <cyrus.vahhaji at bestbuy.com>, "Harter, Ryan"
<Ryan.Harter at uwsp.edu>, Jamf List Serve <casper at list.jamfsoftware.com>
Subject: Re: Dummy Receipts and Custom Triggering a Policy

Oops, I realized that I forgot to mention the second thing to do to use
custom triggers.  Ryan mentioned it further back in the thread, but here it
is again...

After you save your policy that is triggered by "other", for example, let's
say that other="customTrigger".

You call the custom-triggered policy via the jamf binary like so:

sudo jamf policy --trigger "customTrigger"


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




On Mon, Jan 12, 2009 at 10:11 AM, Miles Leacy <miles.leacy at themacadmin.com>
wrote:
> Gents,
> 
> I'm taking this back on list because there may be others in the community that
> would benefit from this discussion.
> 
> To Recap, there are two questions: how to use custom triggers and how to
> create dummy receipts.
> 
> To use a custom trigger there are two things to do:
> 1. Create a policy and in the General tab, choose "other (Manually specify the
> run at action in this field) -->" from the "Triggered by:" drop down menu and
> enter your custom trigger in the text field next to this drop down menu.  I
> use Apple-esque run-together phrases with caps, such as
> "memberAccountingComputerGroup" for my custom triggers.  I'm not sure what the
> upper limit is for custom trigger length, but I haven't hit it yet, and I like
> to be descriptive with my triggers.
> 
> Re: "Dummy receipts"
> The so-called "dummy receipt" is a receipt from a payload-free package.  I
> create empty prebuilt Apple .pkg files using Composer like so...
> 1. Create an empty folder with the same name as your intended package (and
> receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture
> 1.png")
> 2. Open Composer, choose this prebuilt package and save it as an Apple .pkg.
> (see attachment "Picture 2.png")
> 
> Some may find that using these "dummy receipts" creates clutter, but if you
> integrate the concept into your workflows, document your work, and maintain
> clear and consistent policies (in the general sense, not Casper Policies) and
> naming conventions, use of receipts in this way can be a very efficient and
> effective method to extend your management capabilities.
> 
> ----------
> Miles A. Leacy IV
> 
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
> 
> 
> 
> 
> 
> On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu> wrote:
>> I haven't used dummy receipts before, I've been trying to avoid them if
>> possible because it seems like more for me to keep track of.  Miles might be
>> able to give you more help with that.
>> 
>> As for the custom trigger, you've got it all figured out.  when you set a
>> policy you can set triggered by to custom (I think it even has an ascii arrow
>> ----->) and enter the trigger in the text box.  Then you call sudo jamf
>> policy --trigger "custom trigger" and it will run that policy.  I currently
>> do it as a workaround to get my adobe installs to run after boot time.
>> 
>> Hope this helps,
>>  
>> 
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>>  
>> 
>> On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:
>> 
>>>  Miles, Ryan,
>>>  
>>>  I've been following "Computer group from AD" thread and you brought up
>>> dummy receipts and triggering custom policies and didn't want to hijack the
>>> thread with my question.
>>>  
>>>  What is the best way of creating a Dummy Receipt? Would it be an empty
>>> folder created in Composer?
>>>  
>>>  What do you mean by "custom trigger" here?
>>>  - if desired group is found, issue a custom trigger of "receipt exists".
>>>   Is it triggering a policy to add the dummy receipt that the machine is in
>>> AD? If so, are you using something like "sudo jamf policy ?trigger "desired
>>> policy"
>>>  
>>>  Thanx,
>>>   
>>>  Cyrus Vahhaji
>>>  Accenture
>>>  Best Buy Technology Group
>>>  desk ? 612.291.3643
>>>  fax ? 952.430.4260
>>>  email ? mailto:cyrus.vahhaji at bestbuy.com
>>>  
>>>  This message is for the designated recipient only and may contain
>>> privileged, proprietary, or otherwise private information. If you have
>>> received it in error, please notify the sender immediately and delete the
>>> original. Any other use of the email by you is prohibited.
>>>   
>>>   
>> 
> 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/7cb00d67/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 12 10:52:23 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 13:52:23 -0500
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <C590ECFA.1E059%Cyrus.Vahhaji@bestbuy.com>
References: <ec2e75ff0901120831k5755d4f5r19d280be3d4092bc@mail.gmail.com>
	<C590ECFA.1E059%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <ec2e75ff0901121052s74132494x94c30245c160e161@mail.gmail.com>

A single dash is correct.  Sorry for the typo.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 1:50 PM, Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com>wrote:

>  Miles,
>
> Thanx for your thorough info. Question on syntax used below. Should there
> be two dashes "--" or one dash "-" before trigger? Noticed Ryan also using
> two dashes but Jamf help pages has only one.
>
> Thanx for clarifying this.
> Cyrus
>
>
> ------------------------------
> *From: *Miles Leacy <miles.leacy at themacadmin.com>
> *Date: *Mon, 12 Jan 2009 11:31:37 -0500
> *To: *Ryan Harter <rharter at uwsp.edu>
> *Cc: *Cyrus Vahhaji <cyrus.vahhaji at bestbuy.com>, "Harter, Ryan" <
> Ryan.Harter at uwsp.edu>, Jamf List Serve <casper at list.jamfsoftware.com>
> *Subject: *Re: Dummy Receipts and Custom Triggering a Policy
>
> Oops, I realized that I forgot to mention the second thing to do to use
> custom triggers.  Ryan mentioned it further back in the thread, but here it
> is again...
>
> After you save your policy that is triggered by "other", for example, let's
> say that other="customTrigger".
>
> You call the custom-triggered policy via the jamf binary like so:
>
> sudo jamf policy --trigger "customTrigger"
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> On Mon, Jan 12, 2009 at 10:11 AM, Miles Leacy <miles.leacy at themacadmin.com>
> wrote:
>
> Gents,
>
> I'm taking this back on list because there may be others in the community
> that would benefit from this discussion.
>
> To Recap, there are two questions: how to use custom triggers and how to
> create dummy receipts.
>
> To use a custom trigger there are two things to do:
> 1. Create a policy and in the General tab, choose "other (Manually specify
> the run at action in this field) -->" from the "Triggered by:" drop down
> menu and enter your custom trigger in the text field next to this drop down
> menu.  I use Apple-esque run-together phrases with caps, such as
> "memberAccountingComputerGroup" for my custom triggers.  I'm not sure what
> the upper limit is for custom trigger length, but I haven't hit it yet, and
> I like to be descriptive with my triggers.
>
> Re: "Dummy receipts"
> The so-called "dummy receipt" is a receipt from a payload-free package.  I
> create empty prebuilt Apple .pkg files using Composer like so...
> 1. Create an empty folder with the same name as your intended package (and
> receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture
> 1.png")
> 2. Open Composer, choose this prebuilt package and save it as an Apple
> .pkg.  (see attachment "Picture 2.png")
>
> Some may find that using these "dummy receipts" creates clutter, but if you
> integrate the concept into your workflows, document your work, and maintain
> clear and consistent policies (in the general sense, not Casper Policies)
> and naming conventions, use of receipts in this way can be a very efficient
> and effective method to extend your management capabilities.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
>
> On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu> wrote:
>
> I haven't used dummy receipts before, I've been trying to avoid them if
> possible because it seems like more for me to keep track of.  Miles might be
> able to give you more help with that.
>
> As for the custom trigger, you've got it all figured out.  when you set a
> policy you can set triggered by to custom (I think it even has an ascii
> arrow ----->) and enter the trigger in the text box.  Then you call sudo
> jamf policy --trigger "custom trigger" and it will run that policy.  I
> currently do it as a workaround to get my adobe installs to run after boot
> time.
>
> Hope this helps,
>
> *
> Ryan Harter
> *UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu <Ryan.Harter at uwsp.edu>>
>
>
> On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:
>
>  Miles, Ryan,
>
>  I've been following "Computer group from AD" thread and you brought up
> dummy receipts and triggering custom policies and didn't want to hijack the
> thread with my question.
>
>  What is the best way of creating a Dummy Receipt? Would it be an empty
> folder created in Composer?
>
>  What do you mean by "custom trigger" here?
>  - if desired group is found, issue a custom trigger of "receipt exists".
>   Is it triggering a policy to add the dummy receipt that the machine is in
> AD? If so, are you using something like "sudo jamf policy ?trigger "desired
> policy"
>
>  Thanx,
>
>  *Cyrus Vahhaji
>  **Accenture
>  Best Buy Technology Group
>  *desk ? 612.291.3643
>  fax ? 952.430.4260
>  email ? mailto:cyrus.vahhaji at bestbuy.com <cyrus.vahhaji at bestbuy.com>
>
>  This message is for the designated recipient only and may contain
> privileged, proprietary, or otherwise private information. If you have
> received it in error, please notify the sender immediately and delete the
> original. Any other use of the email by you is prohibited.
>
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/4dcede57/attachment.html 

From ERNSTCS at uwec.edu  Mon Jan 12 11:08:27 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Mon, 12 Jan 2009 13:08:27 -0600
Subject: [Casper] Dummy Receipts and Custom Triggering a Policy
In-Reply-To: <ec2e75ff0901121052s74132494x94c30245c160e161@mail.gmail.com>
Message-ID: <C590F14B.12713%ernstcs@uwec.edu>

So now that you have all these message compile a single one that's all correct. =)

Thanks, for the info, Miles!!

Craig E

On 1/12/09 12:52 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

A single dash is correct.  Sorry for the typo.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




On Mon, Jan 12, 2009 at 1:50 PM, Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com> wrote:
Miles,

Thanx for your thorough info. Question on syntax used below. Should there be two dashes "--" or one dash "-" before trigger? Noticed Ryan also using two dashes but Jamf help pages has only one.

Thanx for clarifying this.
Cyrus


________________________________
From: Miles Leacy <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com> >
Date: Mon, 12 Jan 2009 11:31:37 -0500
To: Ryan Harter <rharter at uwsp.edu <http://rharter at uwsp.edu> >
Cc: Cyrus Vahhaji <cyrus.vahhaji at bestbuy.com <http://cyrus.vahhaji at bestbuy.com> >, "Harter, Ryan" <Ryan.Harter at uwsp.edu <http://Ryan.Harter at uwsp.edu> >, Jamf List Serve <casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com> >

Subject: Re: Dummy Receipts and Custom Triggering a Policy

Oops, I realized that I forgot to mention the second thing to do to use custom triggers.  Ryan mentioned it further back in the thread, but here it is again...

After you save your policy that is triggered by "other", for example, let's say that other="customTrigger".

You call the custom-triggered policy via the jamf binary like so:

sudo jamf policy --trigger "customTrigger"


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com>  <http://www.themacadmin.com>




On Mon, Jan 12, 2009 at 10:11 AM, Miles Leacy <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com> > wrote:
Gents,

I'm taking this back on list because there may be others in the community that would benefit from this discussion.

To Recap, there are two questions: how to use custom triggers and how to create dummy receipts.

To use a custom trigger there are two things to do:
1. Create a policy and in the General tab, choose "other (Manually specify the run at action in this field) -->" from the "Triggered by:" drop down menu and enter your custom trigger in the text field next to this drop down menu.  I use Apple-esque run-together phrases with caps, such as "memberAccountingComputerGroup" for my custom triggers.  I'm not sure what the upper limit is for custom trigger length, but I haven't hit it yet, and I like to be descriptive with my triggers.

Re: "Dummy receipts"
The so-called "dummy receipt" is a receipt from a payload-free package.  I create empty prebuilt Apple .pkg files using Composer like so...
1. Create an empty folder with the same name as your intended package (and receipt) in /Applications/The Casper Suite/Temp/ (see attachment "Picture 1.png")
2. Open Composer, choose this prebuilt package and save it as an Apple .pkg.  (see attachment "Picture 2.png")

Some may find that using these "dummy receipts" creates clutter, but if you integrate the concept into your workflows, document your work, and maintain clear and consistent policies (in the general sense, not Casper Policies) and naming conventions, use of receipts in this way can be a very efficient and effective method to extend your management capabilities.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com>  <http://www.themacadmin.com>





On Fri, Jan 9, 2009 at 5:39 PM, Ryan Harter <rharter at uwsp.edu <http://rharter at uwsp.edu> > wrote:
I haven't used dummy receipts before, I've been trying to avoid them if possible because it seems like more for me to keep track of.  Miles might be able to give you more help with that.

As for the custom trigger, you've got it all figured out.  when you set a policy you can set triggered by to custom (I think it even has an ascii arrow ----->) and enter the trigger in the text box.  Then you call sudo jamf policy --trigger "custom trigger" and it will run that policy.  I currently do it as a workaround to get my adobe installs to run after boot time.

Hope this helps,


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <http://Ryan.Harter at uwsp.edu> <mailto:Ryan.Harter at uwsp.edu>


On Jan 9, 2009, at 4:30 PM, Cyrus Vahhaji wrote:

Miles, Ryan,

 I've been following "Computer group from AD" thread and you brought up dummy receipts and triggering custom policies and didn't want to hijack the thread with my question.

 What is the best way of creating a Dummy Receipt? Would it be an empty folder created in Composer?

 What do you mean by "custom trigger" here?
 - if desired group is found, issue a custom trigger of "receipt exists".
  Is it triggering a policy to add the dummy receipt that the machine is in AD? If so, are you using something like "sudo jamf policy -trigger "desired policy"

 Thanx,

 Cyrus Vahhaji
 Accenture
 Best Buy Technology Group
 desk - 612.291.3643
 fax - 952.430.4260
 email - mailto:cyrus.vahhaji at bestbuy.com

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.








-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/1e626483/attachment.html 

From hbonath at computersitecolumbus.com  Mon Jan 12 11:27:53 2009
From: hbonath at computersitecolumbus.com (Henry Bonath)
Date: Mon, 12 Jan 2009 14:27:53 -0500
Subject: [Casper] Remotely configure Directory Utility
Message-ID: <C59103E9.9720%hbonath@computersitecolumbus.com>

Is there any way out there to remotely configure LDAPv3 plugin for server search paths?
So far, the only way that may be possible that I can see is to push out .plist files with directory info to /Library/Preferences/DirectoryService

Thanks in advance!
-Henry
________________________________

[http://www.computersitecolumbus.com/images/CSC_Logo.jpg]
Henry Bonath
Network Engineer
Computer Site Columbus
6155-N Huntley Road
Columbus, OH 43229
computersitecolumbus.com
Tel: 614.786.7100
Cell: 614.738.0822
Fax: 614.786.7310

Your I.T. Department


________________________________
14:29:15 Mon 12 Jan 2009


This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/22a17cf2/attachment.htm 

From swood at integerdallas.com  Mon Jan 12 11:38:39 2009
From: swood at integerdallas.com (Steve Wood)
Date: Mon, 12 Jan 2009 13:38:39 -0600
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <C59103E9.9720%hbonath@computersitecolumbus.com>
Message-ID: <C590F85F.19E4D%swood@integerdallas.com>

Unless Miles or someone else has a better way, this is how I?ve done it in
the past, using these commands in a script:



#!/bin/bash/
OD_SERVER=yourODServer.name'
AD_DOMAIN='yourADdomain'
SiteId='NHV'
OldName=`scutil --get ComputerName`
SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
scutil --set ComputerName $SiteId$SERIALNUM
scutil --set LocalHostName $SiteId$SERIALNUM
scutil --set HostName $SiteId$SERIALNUM
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resource
s/kickstart -configure -computerinfo -set1 -1 $OldName

computerid=`scutil --get ComputerName`

dsconfigldap -v -f -a $OD_SERVER -n OD_SERVER -c $computerid -u diradmin -p
'pass'
sleep 10
dsconfigad -f -a $computerid -domain $AD_DOMAIN -u swood -p 'pass' -ou
"CN=Unsorted Computers,OU=Locations,DC=yourad,DC=net"
sleep 20

dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search -append / CSPSearchPath /LDAPv3/$OD_SERVER
dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"

sleep 10
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/$OD_SERVER
dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All
Domains"





Steve Wood
Director of IT
swood at integerdallas.com

The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
T 214.758.6813 | F 214.758.6901 | C 940.312.2475




From: Henry Bonath <hbonath at computersitecolumbus.com>
Date: Mon, 12 Jan 2009 14:27:53 -0500
To: "casper at list.jamfsoftware.com" <casper at list.jamfsoftware.com>
Subject: [Casper] Remotely configure Directory Utility

Is there any way out there to remotely configure LDAPv3 plugin for server
search paths?
So far, the only way that may be possible that I can see is to push out
.plist files with directory info to /Library/Preferences/DirectoryService

Thanks in advance! 
-Henry 

 
Henry Bonath
Network Engineer
Computer Site Columbus
6155-N Huntley Road
Columbus, OH 43229
computersitecolumbus.com
Tel: 614.786.7100
Cell: 614.738.0822 
Fax: 614.786.7310 Your I.T. Department

14:29:15 Mon 12 Jan 2009
This message (and any associated files) is intended only for the use of the
individual or entity to which it is addressed and may contain information
that is confidential, subject to copyright or constitutes a trade secret. If
you are not the intended recipient you are hereby notified that any
dissemination, copying or distribution of this message, or files associated
with this message, is strictly prohibited. If you have received this message
in error, please notify us immediately by replying to the message and
deleting it from your computer.


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



--
The information contained in this email transmission is solely for the addressee(s) named above and is privileged and/or confidential.  If the reader of this message is not the intended recipient or the person responsible to deliver it to the intended recipient; he or she is prohibited from reading or disclosing the information contained in this transmission.  Any examination, use, dissemination, distribution, or copying of this communication is strictly prohibited.  Please contact us immediately by telephone for instructions if you have received this communication in error: (214) 758-6800
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/60d5359b/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 12 11:42:01 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 14:42:01 -0500
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <C59103E9.9720%hbonath@computersitecolumbus.com>
References: <C59103E9.9720%hbonath@computersitecolumbus.com>
Message-ID: <ec2e75ff0901121142o3b5ce0dbj4eccd5ee51e352f0@mail.gmail.com>

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_dsConfigLDAP.bash
#
# Created 20070212 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090106 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
remains intact.
#
# This script is provided "as is".  The author offers no warranty or
guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
twice more.
#
# This script adds an LDAP configuration and sets the custom search path.
# Replace "ldap.server.ext" with your LDAP server's FQDN or use a script
parameter to pass
# a value from Casper.
#
# If you don't use Active directory, comment out or delete all lines that
# contain "Active Directory".
#
# This script is intended for use as an "At Reboot" script with Casper
Imaging.
#
##### HEADER ENDS #####

# add LDAP config
dsconfigldap -v -a ldap.server.ext

# set up the custom search paths
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
dscl /Search -append / CSPSearchPath /LDAPv3/ldap.server.ext
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All
Domains"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/ldap.server.ext



----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/12 Henry Bonath <hbonath at computersitecolumbus.com>

>     Is there any way out there to remotely configure LDAPv3 plugin for
> server search paths?
> So far, the only way that may be possible that I can see is to push out
> .plist files with directory info to /Library/Preferences/DirectoryService
>
> Thanks in advance!
> -Henry
>
> ------------------------------
>
>
>
> [image: CSC Logo]
> Henry Bonath
> Network Engineer
> Computer Site Columbus
> 6155-N Huntley Road
> Columbus, OH 43229
> computersitecolumbus.com
> Tel: 614.786.7100
> Cell: 614.738.0822
> Fax: 614.786.7310
>
> *Your I.T. Department*
>
>   ------------------------------
>
> 14:29:15 Mon 12 Jan 2009
>
>
> This message (and any associated files) is intended only for the use of the
> individual or entity to which it is addressed and may contain information
> that is confidential, subject to copyright or constitutes a trade secret. If
> you are not the intended recipient you are hereby notified that any
> dissemination, copying or distribution of this message, or files associated
> with this message, is strictly prohibited. If you have received this message
> in error, please notify us immediately by replying to the message and
> deleting it from your computer.
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/3b46b087/attachment.htm 

From hbonath at computersitecolumbus.com  Mon Jan 12 11:54:26 2009
From: hbonath at computersitecolumbus.com (Henry Bonath)
Date: Mon, 12 Jan 2009 14:54:26 -0500
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <ec2e75ff0901121142o3b5ce0dbj4eccd5ee51e352f0@mail.gmail.com>
Message-ID: <C5910A22.9727%hbonath@computersitecolumbus.com>

Thanks so much!


On 1/12/09 2:42 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_dsConfigLDAP.bash
#
# Created 20070212 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090106 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header remains intact.
#
# This script is provided "as is".  The author offers no warranty or guarantee of any kind.
# Use of this script is at your own risk.  The author takes no responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test twice more.
#
# This script adds an LDAP configuration and sets the custom search path.
# Replace "ldap.server.ext" with your LDAP server's FQDN or use a script parameter to pass
# a value from Casper.
#
# If you don't use Active directory, comment out or delete all lines that
# contain "Active Directory".
#
# This script is intended for use as an "At Reboot" script with Casper Imaging.
#
##### HEADER ENDS #####

# add LDAP config
dsconfigldap -v -a ldap.server.ext

# set up the custom search paths
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
dscl /Search -append / CSPSearchPath /LDAPv3/ldap.server.ext
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/ldap.server.ext



----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




2009/1/12 Henry Bonath <hbonath at computersitecolumbus.com>
Is there any way out there to remotely configure LDAPv3 plugin for server search paths?
So far, the only way that may be possible that I can see is to push out .plist files with directory info to /Library/Preferences/DirectoryService

Thanks in advance!
-Henry
________________________________

Henry Bonath
Network Engineer
Computer Site Columbus
6155-N Huntley Road
Columbus, OH 43229
computersitecolumbus.com <http://computersitecolumbus.com>
Tel: 614.786.7100
Cell: 614.738.0822

Fax: 614.786.7310 Your I.T. Department

________________________________

14:29:15 Mon 12 Jan 2009

This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/ed5b44ad/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 12 12:08:03 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 15:08:03 -0500
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <C590F85F.19E4D%swood@integerdallas.com>
References: <C59103E9.9720%hbonath@computersitecolumbus.com>
	<C590F85F.19E4D%swood@integerdallas.com>
Message-ID: <ec2e75ff0901121208g233c0054s6c75a37a5c4133d5@mail.gmail.com>

I let Casper's built-in mechanism handle AD binding to avoid putting account
credentials in a script.  I hold not putting account credentials in a script
as a best practice.
Steve's script will get you to the same place, as well as binding to AD, but
you'll have to do the following:

(Forgive me if my explanations seem simplistic to anyone.  I'm aiming this
at the new admin who would look at this script and be overwhelmed.)

1. Specify "yourODServer.name" and "yourADdomain", or pass in the values as
parameters.
2. The following lines set the target machine's name to
<siteId><serialnumber> and places the previous name in ARD custom data.  If
you don't want to do this, remove the following lines:

SiteId='NHV'
OldName=`scutil --get ComputerName`
SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
scutil --set ComputerName $SiteId$SERIALNUM
scutil --set LocalHostName $SiteId$SERIALNUM
scutil --set HostName $SiteId$SERIALNUM
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart
-configure -computerinfo -set1 -1 $OldName

3. The script assumes that you want to use the Mac's computer name as the AD
and LDAP machine name to bind to.  If this is not the case, you'll need to
change the following line to get the computerid that will match your machine
account in AD and/or LDAP:

computerid=`scutil --get ComputerName`

4. In the "dsconfigldap" command, "diradmin" needs to be replaced with an
LDAP account that has permissions to bind clients and "'pass'" needs to be
replaced with that account's password.

5. In the "dsconfigad" command, "swood" should be replaced with an AD
account ID that has permissions to bind machines to existing computer
records (if the record already exists in AD) or permissions to create
computer objects in the target OU (if the record does not exist).  "'pass'"
needs to be replaced with that account's password.  "CN=Unsorted
Computers,OU=Locations,DC=yourad,DC=net" needs to be replaced with the AD
path to the container that contains your computer records (or in which you
will be creating them).

I prefer the script I provided in my previous message, however it is
important to note that it assumes that your LDAP server does not require
authenticated bindings.  I would love to see a Casper feature similar to the
AD binding feature that would allow authenticated LDAP bindings without
putting passwords into scripts.

I leave setting computer names and turning on ARD to casper built-in
functionality and a separate script, respectively.  This is out of an
overarching management approach of being as modular as possible by breaking
down actions into their smallest practical parts.

I hope this is useful.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/12 Steve Wood <swood at integerdallas.com>

>  Unless Miles or someone else has a better way, this is how I've done it
> in the past, using these commands in a script:
>
>
>
> #!/bin/bash/
> OD_SERVER=yourODServer.name'
> AD_DOMAIN='yourADdomain'
> SiteId='NHV'
> OldName=`scutil --get ComputerName`
> SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
> scutil --set ComputerName $SiteId$SERIALNUM
> scutil --set LocalHostName $SiteId$SERIALNUM
> scutil --set HostName $SiteId$SERIALNUM
> /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart
> -configure -computerinfo -set1 -1 $OldName
>
> computerid=`scutil --get ComputerName`
>
> dsconfigldap -v -f -a $OD_SERVER -n OD_SERVER -c $computerid -u diradmin -p
> 'pass'
> sleep 10
> dsconfigad -f -a $computerid -domain $AD_DOMAIN -u swood -p 'pass' -ou
> "CN=Unsorted Computers,OU=Locations,DC=yourad,DC=net"
> sleep 20
>
> dscl /Search -create / SearchPolicy CSPSearchPath
> dscl /Search -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
>
> sleep 10
> dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
> dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All
> Domains"
>
>
>
> *
>
> Steve Wood
> Director of IT
> *swood at integerdallas.com
>
> The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
> T 214.758.6813 | F 214.758.6901 | C 940.312.2475
>
>
>
> ------------------------------
> *From: *Henry Bonath <hbonath at computersitecolumbus.com>
> *Date: *Mon, 12 Jan 2009 14:27:53 -0500
> *To: *"casper at list.jamfsoftware.com" <casper at list.jamfsoftware.com>
> *Subject: *[Casper] Remotely configure Directory Utility
>
> Is there any way out there to remotely configure LDAPv3 plugin for server
> search paths?
> So far, the only way that may be possible that I can see is to push out
> .plist files with directory info to /Library/Preferences/DirectoryService
>
> Thanks in advance!
>
> -Henry
> ------------------------------
>
> Henry Bonath
> Network Engineer
> Computer Site Columbus
> 6155-N Huntley Road
> Columbus, OH 43229
> computersitecolumbus.com
> Tel: 614.786.7100
> Cell: 614.738.0822
>
> Fax: 614.786.7310 *Your I.T. Department*
>
> ------------------------------
>
> 14:29:15 Mon 12 Jan 2009
>
>   This message (and any associated files) is intended only for the use of
> the individual or entity to which it is addressed and may contain
> information that is confidential, subject to copyright or constitutes a
> trade secret. If you are not the intended recipient you are hereby notified
> that any dissemination, copying or distribution of this message, or files
> associated with this message, is strictly prohibited. If you have received
> this message in error, please notify us immediately by replying to the
> message and deleting it from your computer.
>
> ------------------------------
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> ------------------------------
> --
>
> The information contained in this email transmission is solely for the addressee(s) named above and is privileged and/or confidential.  If the reader of this message is not the intended recipient or the person responsible to deliver it to the intended recipient; he or she is prohibited from reading or disclosing the information contained in this transmission.  Any examination, use, dissemination, distribution, or copying of this communication is strictly prohibited.  Please contact us immediately by telephone for instructions if you have received this communication in error: (214) 758-6800
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/9dd985fe/attachment.htm 

From swood at integerdallas.com  Mon Jan 12 12:12:51 2009
From: swood at integerdallas.com (Steve Wood)
Date: Mon, 12 Jan 2009 14:12:51 -0600
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <ec2e75ff0901121208g233c0054s6c75a37a5c4133d5@mail.gmail.com>
Message-ID: <C5910063.19E59%swood@integerdallas.com>

Thanks for clarifying what I forgot to clarify.  :-)  I sent that in a rush
and shouldn?t have.

That script was for work at my old company and we did not have the benefit
of Casper.  I agree with Miles, that you should not be passing credentials
in the scripts if you can, and let Casper do your AD binding and your
machine re-naming.


Steve Wood
Director of IT
swood at integerdallas.com

The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
T 214.758.6813 | F 214.758.6901 | C 940.312.2475




From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Mon, 12 Jan 2009 15:08:03 -0500
To: Steve Wood <swood at integerdallas.com>
Cc: Henry Bonath <hbonath at computersitecolumbus.com>,
"casper at list.jamfsoftware.com" <casper at list.jamfsoftware.com>
Subject: Re: [Casper] Remotely configure Directory Utility

I let Casper's built-in mechanism handle AD binding to avoid putting account
credentials in a script.  I hold not putting account credentials in a script
as a best practice.

Steve's script will get you to the same place, as well as binding to AD, but
you'll have to do the following:

(Forgive me if my explanations seem simplistic to anyone.  I'm aiming this
at the new admin who would look at this script and be overwhelmed.)

1. Specify "yourODServer.name" and "yourADdomain", or pass in the values as
parameters.
2. The following lines set the target machine's name to
<siteId><serialnumber> and places the previous name in ARD custom data.  If
you don't want to do this, remove the following lines:

SiteId='NHV'
OldName=`scutil --get ComputerName`
SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
scutil --set ComputerName $SiteId$SERIALNUM
scutil --set LocalHostName $SiteId$SERIALNUM
scutil --set HostName $SiteId$SERIALNUM
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resource
s/kickstart -configure -computerinfo -set1 -1 $OldName

3. The script assumes that you want to use the Mac's computer name as the AD
and LDAP machine name to bind to.  If this is not the case, you'll need to
change the following line to get the computerid that will match your machine
account in AD and/or LDAP:

computerid=`scutil --get ComputerName`

4. In the "dsconfigldap" command, "diradmin" needs to be replaced with an
LDAP account that has permissions to bind clients and "'pass'" needs to be
replaced with that account's password.

5. In the "dsconfigad" command, "swood" should be replaced with an AD
account ID that has permissions to bind machines to existing computer
records (if the record already exists in AD) or permissions to create
computer objects in the target OU (if the record does not exist).  "'pass'"
needs to be replaced with that account's password.  "CN=Unsorted
Computers,OU=Locations,DC=yourad,DC=net" needs to be replaced with the AD
path to the container that contains your computer records (or in which you
will be creating them).

I prefer the script I provided in my previous message, however it is
important to note that it assumes that your LDAP server does not require
authenticated bindings.  I would love to see a Casper feature similar to the
AD binding feature that would allow authenticated LDAP bindings without
putting passwords into scripts.

I leave setting computer names and turning on ARD to casper built-in
functionality and a separate script, respectively.  This is out of an
overarching management approach of being as modular as possible by breaking
down actions into their smallest practical parts.

I hope this is useful.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




2009/1/12 Steve Wood <swood at integerdallas.com>
> Unless Miles or someone else has a better way, this is how I've done it in the
> past, using these commands in a script:
> 
> 
> 
> #!/bin/bash/
> OD_SERVER=yourODServer.name'
> AD_DOMAIN='yourADdomain'
> SiteId='NHV'
> OldName=`scutil --get ComputerName`
> SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
> scutil --set ComputerName $SiteId$SERIALNUM
> scutil --set LocalHostName $SiteId$SERIALNUM
> scutil --set HostName $SiteId$SERIALNUM
> /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/
> kickstart -configure -computerinfo -set1 -1 $OldName
> 
> computerid=`scutil --get ComputerName`
> 
> dsconfigldap -v -f -a $OD_SERVER -n OD_SERVER -c $computerid -u diradmin -p
> 'pass'
> sleep 10
> dsconfigad -f -a $computerid -domain $AD_DOMAIN -u swood -p 'pass' -ou
> "CN=Unsorted Computers,OU=Locations,DC=yourad,DC=net"
> sleep 20
> 
> dscl /Search -create / SearchPolicy CSPSearchPath
> dscl /Search -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
> 
> sleep 10
> dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
> dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"
> 
> 
> 
> 
> 
> Steve Wood
> Director of IT
> swood at integerdallas.com <http://swood at integerdallas.com>
> 
> The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
> T 214.758.6813 | F 214.758.6901 | C 940.312.2475
> 
> 
> 
> 
> From: Henry Bonath <hbonath at computersitecolumbus.com
> <http://hbonath at computersitecolumbus.com> >
> Date: Mon, 12 Jan 2009 14:27:53 -0500
> To: "casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com> "
> <casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com> >
> Subject: [Casper] Remotely configure Directory Utility
> 
> Is there any way out there to remotely configure LDAPv3 plugin for server
> search paths?
> So far, the only way that may be possible that I can see is to push out .plist
> files with directory info to /Library/Preferences/DirectoryService
> 
> Thanks in advance!
> -Henry 
> 
>  
> Henry Bonath
> Network Engineer
> Computer Site Columbus
> 6155-N Huntley Road
> Columbus, OH 43229
> computersitecolumbus.com <http://computersitecolumbus.com>
> Tel: 614.786.7100
> Cell: 614.738.0822
> Fax: 614.786.7310 Your I.T. Department
> 
> 14:29:15 Mon 12 Jan 2009
> This message (and any associated files) is intended only for the use of the
> individual or entity to which it is addressed and may contain information that
> is confidential, subject to copyright or constitutes a trade secret. If you
> are not the intended recipient you are hereby notified that any dissemination,
> copying or distribution of this message, or files associated with this
> message, is strictly prohibited. If you have received this message in error,
> please notify us immediately by replying to the message and deleting it from
> your computer. 
> 
> 
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com <http://Casper at list.jamfsoftware.com>
> http://list.jamfsoftware.com/mailman/listinfo/casper
> 
> 
> 
> --
> The information contained in this email transmission is solely for the
> addressee(s) named above and is privileged and/or confidential.  If the reader
> of this message is not the intended recipient or the person responsible to
> deliver it to the intended recipient; he or she is prohibited from reading or
> disclosing the information contained in this transmission.  Any examination,
> use, dissemination, distribution, or copying of this communication is strictly
> prohibited.  Please contact us immediately by telephone for instructions if
> you have received this communication in error: (214) 758-6800
> 
> 
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
> 
> 
> 



--
The information contained in this email transmission is solely for the addressee(s) named above and is privileged and/or confidential.  If the reader of this message is not the intended recipient or the person responsible to deliver it to the intended recipient; he or she is prohibited from reading or disclosing the information contained in this transmission.  Any examination, use, dissemination, distribution, or copying of this communication is strictly prohibited.  Please contact us immediately by telephone for instructions if you have received this communication in error: (214) 758-6800
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/f7adbc50/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 12 12:23:30 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 15:23:30 -0500
Subject: [Casper] Remotely configure Directory Utility
In-Reply-To: <C5910063.19E59%swood@integerdallas.com>
References: <ec2e75ff0901121208g233c0054s6c75a37a5c4133d5@mail.gmail.com>
	<C5910063.19E59%swood@integerdallas.com>
Message-ID: <ec2e75ff0901121223q18365984wc3f3fc7c5604a755@mail.gmail.com>

On Mon, Jan 12, 2009 at 3:12 PM, Steve Wood <swood at integerdallas.com> wrote:

> Thanks for clarifying what I forgot to clarify.  :-)  I sent that in a rush
> and shouldn't have.
>

No worries.  Thanks for the more comprehensive script.

One item I think that bears mentioning in regard to AD/OD interoperability
is the fact that if you are using the same computer name in both
directories, and your OD Master is bound to AD, all new machine names must
be created in OD first, then AD.  If you do it the other way around, OD,
being bound to AD, will see the AD machine name and not allow you to create
the same name in OD since it already exists.  I am certain that this is an
issue in 10.4.11 with Windows Server 2003.  I am fairly sure it is still an
issue in Leopard through 10.5.3 and with Windows Server 2008.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 3:12 PM, Steve Wood <swood at integerdallas.com> wrote:

>  Thanks for clarifying what I forgot to clarify.  :-)  I sent that in a
> rush and shouldn't have.
>
> That script was for work at my old company and we did not have the benefit
> of Casper.  I agree with Miles, that you should not be passing credentials
> in the scripts if you can, and let Casper do your AD binding and your
> machine re-naming.
> *
>
> Steve Wood
> Director of IT
> *swood at integerdallas.com
>
> The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
> T 214.758.6813 | F 214.758.6901 | C 940.312.2475
>
>
>
> ------------------------------
> *From: *Miles Leacy <miles.leacy at themacadmin.com>
> *Date: *Mon, 12 Jan 2009 15:08:03 -0500
> *To: *Steve Wood <swood at integerdallas.com>
> *Cc: *Henry Bonath <hbonath at computersitecolumbus.com>, "
> casper at list.jamfsoftware.com" <casper at list.jamfsoftware.com>
> *Subject: *Re: [Casper] Remotely configure Directory Utility
>
>
> I let Casper's built-in mechanism handle AD binding to avoid putting
> account credentials in a script.  I hold not putting account credentials in
> a script as a best practice.
>
> Steve's script will get you to the same place, as well as binding to AD,
> but you'll have to do the following:
>
> (Forgive me if my explanations seem simplistic to anyone.  I'm aiming this
> at the new admin who would look at this script and be overwhelmed.)
>
> 1. Specify "yourODServer.name" and "yourADdomain", or pass in the values as
> parameters.
> 2. The following lines set the target machine's name to
> <siteId><serialnumber> and places the previous name in ARD custom data.  If
> you don't want to do this, remove the following lines:
>
> SiteId='NHV'
> OldName=`scutil --get ComputerName`
> SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
> scutil --set ComputerName $SiteId$SERIALNUM
> scutil --set LocalHostName $SiteId$SERIALNUM
> scutil --set HostName $SiteId$SERIALNUM
> /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart
> -configure -computerinfo -set1 -1 $OldName
>
> 3. The script assumes that you want to use the Mac's computer name as the
> AD and LDAP machine name to bind to.  If this is not the case, you'll need
> to change the following line to get the computerid that will match your
> machine account in AD and/or LDAP:
>
> computerid=`scutil --get ComputerName`
>
> 4. In the "dsconfigldap" command, "diradmin" needs to be replaced with an
> LDAP account that has permissions to bind clients and "'pass'" needs to be
> replaced with that account's password.
>
> 5. In the "dsconfigad" command, "swood" should be replaced with an AD
> account ID that has permissions to bind machines to existing computer
> records (if the record already exists in AD) or permissions to create
> computer objects in the target OU (if the record does not exist).  "'pass'"
> needs to be replaced with that account's password.  "CN=Unsorted
> Computers,OU=Locations,DC=yourad,DC=net" needs to be replaced with the AD
> path to the container that contains your computer records (or in which you
> will be creating them).
>
> I prefer the script I provided in my previous message, however it is
> important to note that it assumes that your LDAP server does not require
> authenticated bindings.  I would love to see a Casper feature similar to the
> AD binding feature that would allow authenticated LDAP bindings without
> putting passwords into scripts.
>
> I leave setting computer names and turning on ARD to casper built-in
> functionality and a separate script, respectively.  This is out of an
> overarching management approach of being as modular as possible by breaking
> down actions into their smallest practical parts.
>
> I hope this is useful.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> 2009/1/12 Steve Wood <swood at integerdallas.com>
>
> Unless Miles or someone else has a better way, this is how I've done it in
> the past, using these commands in a script:
>
>
>
> #!/bin/bash/
> OD_SERVER=yourODServer.name'
> AD_DOMAIN='yourADdomain'
> SiteId='NHV'
> OldName=`scutil --get ComputerName`
> SERIALNUM=`system_profiler | grep "Serial Number" | awk '{print $3}'`
> scutil --set ComputerName $SiteId$SERIALNUM
> scutil --set LocalHostName $SiteId$SERIALNUM
> scutil --set HostName $SiteId$SERIALNUM
> /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart
> -configure -computerinfo -set1 -1 $OldName
>
> computerid=`scutil --get ComputerName`
>
> dsconfigldap -v -f -a $OD_SERVER -n OD_SERVER -c $computerid -u diradmin -p
> 'pass'
> sleep 10
> dsconfigad -f -a $computerid -domain $AD_DOMAIN -u swood -p 'pass' -ou
> "CN=Unsorted Computers,OU=Locations,DC=yourad,DC=net"
> sleep 20
>
> dscl /Search -create / SearchPolicy CSPSearchPath
> dscl /Search -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
>
> sleep 10
> dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
> dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/$OD_SERVER
> dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All
> Domains"
>
>
>
> *
>
> Steve Wood
> Director of IT
> *
> swood at integerdallas.com <http://swood at integerdallas.com>
>
> The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
> T 214.758.6813 | F 214.758.6901 | C 940.312.2475
>
>
>
> ------------------------------
> *From: *Henry Bonath <hbonath at computersitecolumbus.com <
> http://hbonath at computersitecolumbus.com> >
> *Date: *Mon, 12 Jan 2009 14:27:53 -0500
> *To: *"casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com>
> " <casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com> >
> *Subject: *[Casper] Remotely configure Directory Utility
>
> Is there any way out there to remotely configure LDAPv3 plugin for server
> search paths?
> So far, the only way that may be possible that I can see is to push out
> .plist files with directory info to /Library/Preferences/DirectoryService
>
> Thanks in advance!
> -Henry
> ------------------------------
>
> Henry Bonath
> Network Engineer
> Computer Site Columbus
> 6155-N Huntley Road
> Columbus, OH 43229
> computersitecolumbus.com <http://computersitecolumbus.com>
> Tel: 614.786.7100
> Cell: 614.738.0822
> Fax: 614.786.7310
> *Your I.T. Department*
>
> ------------------------------
>
> 14:29:15 Mon 12 Jan 2009
> This message (and any associated files) is intended only for the use of the
> individual or entity to which it is addressed and may contain information
> that is confidential, subject to copyright or constitutes a trade secret. If
> you are not the intended recipient you are hereby notified that any
> dissemination, copying or distribution of this message, or files associated
> with this message, is strictly prohibited. If you have received this message
> in error, please notify us immediately by replying to the message and
> deleting it from your computer.
>
> ------------------------------
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com <http://Casper at list.jamfsoftware.com>
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> ------------------------------
> --
> The information contained in this email transmission is solely for the
> addressee(s) named above and is privileged and/or confidential.  If the
> reader of this message is not the intended recipient or the person
> responsible to deliver it to the intended recipient; he or she is prohibited
> from reading or disclosing the information contained in this transmission.
>  Any examination, use, dissemination, distribution, or copying of this
> communication is strictly prohibited.  Please contact us immediately by
> telephone for instructions if you have received this communication in error:
> (214) 758-6800
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
>
>
> ------------------------------
> --
>
> The information contained in this email transmission is solely for the addressee(s) named above and is privileged and/or confidential.  If the reader of this message is not the intended recipient or the person responsible to deliver it to the intended recipient; he or she is prohibited from reading or disclosing the information contained in this transmission.  Any examination, use, dissemination, distribution, or copying of this communication is strictly prohibited.  Please contact us immediately by telephone for instructions if you have received this communication in error: (214) 758-6800
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/cc394864/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 12 12:30:21 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 15:30:21 -0500
Subject: [Casper] Search and destroy apps
In-Reply-To: <ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
Message-ID: <ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>

I received a note about my script from someone at Apple, and I want to make
sure to mention that Leopard's MCX will allow you to prohibit launching apps
from a user's home folder.  In fact, you can allow or disallow the launching
of apps from any folder(s).
The script I provided is an option if you:
have Tiger clients
don't have OD
don't want to mess with using MCX in the local directory service
want to delete the app(s) as well as deny launching

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 1:17 PM, Miles Leacy <miles.leacy at themacadmin.com>wrote:

> I left out a command in the script in my first message.  Here is the
> complete script:
> #!/bin/bash
>
> ##### HEADER BEGINS #####
> # scr_maint_searchDestroyAppsInHomeFolder.bash
> #
> # Created 20090112 by Miles A. Leacy IV
> # miles.leacy at themacadmin.com
> # Modified 20090112 by Miles A. Leacy IV
> # Copyright 2009 Miles A. Leacy IV
> #
> # This script may be copied and distributed freely as long as this header
> remains intact.
> #
> # This script is provided "as is".  The author offers no warranty or
> guarantee of any kind.
> # Use of this script is at your own risk.  The author takes no
> responsibility for loss of use,
> # loss of data, loss of job, loss of socks, the onset of armageddon, or any
> other negative effects.
> #
> # Test thoroughly in a lab environment before use on production systems.
> # When you think it's ok, test again.  When you're certain it's ok, test
> twice more.
> #
> # This script performs a search & destroy on any apps in the user's home
> folder
> # This script deletes user data.  Be sure of your organization's policies
> as they may apply before using.
> #
> # Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what data
> will be deleted and that it is
> # permissible to delete that data before using this script.
> #
> # It is intended to be run as part of a Casper policy triggered by login.
> #
> # Note: This script can take several minutes to run on very large home
> folders.
> # It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
> in testing.
> #
> ##### HEADER ENDS #####
>
> # Set $isapp to indicate whether an item is an application
> # initial value is 0
> # a value of 0 = not an application
> # a value of 1 = an application
> isapp=0
>
> # return the absolute path of each item in the specified directory and act
> upon them in the "do" loop.
> find  /Users/$3 | while read file
> do
>
> # skip the contents of .app bundles
>     [[ "$file" = *.app/* ]] && continue
>
> # determine whether $file is an application and change value of $isapp if
> it is
>     isapp=`mdls -name kMDItemKind "$file"|grep -c Application`
>
> # if $file is an application ($isapp contains any nonzero value), act upon
> it.
>     if [ $isapp -ne 0 ];
>       then echo "Deleting" "$file"; rm -R "$file"
>     fi
>
> # reset $isapp
>     isapp=0
>
> done
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Mon, Jan 12, 2009 at 12:26 PM, Miles Leacy <miles.leacy at themacadmin.com
> > wrote:
>
>> Hi all,
>> I have another script to share.  In more than one environment I've worked
>> with, users were not allowed to store or run apps in/from their home
>> folders.  Policies were made clear that any apps in one's home folder were
>> considered a policy violation, and subject to automatic deletion.  I put
>> together the following script to make sure I never had to go hunt for
>> someone's hidden apps again.
>>
>> #!/bin/bash
>>
>> ##### HEADER BEGINS #####
>> # scr_maint_searchDestroyAppsInHomeFolder.bash
>> #
>> # Created 20080729 by Miles A. Leacy IV
>> # miles.leacy at themacadmin.com
>> # Modified 20090112 by Miles A. Leacy IV
>> # Copyright 2009 Miles A. Leacy IV
>> #
>> # This script may be copied and distributed freely as long as this header
>> remains intact.
>> #
>>  # This script is provided "as is".  The author offers no warranty or
>> guarantee of any kind.
>> # Use of this script is at your own risk.  The author takes no
>> responsibility for loss of use,
>> # loss of data, loss of job, loss of socks, the onset of armageddon, or
>> any other negative effects.
>> #
>> # Test thoroughly in a lab environment before use on production systems.
>> # When you think it's ok, test again.  When you're certain it's ok, test
>> twice more.
>> #
>> # This script performs a search & destroy on any apps in the user's home
>> folder
>> # This script deletes user data.  Be sure of your organization's policies
>> as they may apply before using.
>> #
>> # Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what
>> data will be deleted and that it is
>> # permissible to delete that data before using this script.
>> #
>> # It is intended to be run as part of a Casper policy triggered by login.
>> #
>> # Note: This script can take several minutes to run on very large home
>> folders.
>> # It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
>> in testing.
>> #
>> ##### HEADER ENDS #####
>>
>> # Set $isapp to indicate whether an item is an application
>> # initial value is 0
>> # a value of 0 = not an application
>> # a value of 1 = an application
>> isapp=0
>>
>> # return the absolute path of each item in the specified directory and act
>> upon them in the "do" loop.
>> find  /Users/$3 | while read file
>> do
>>
>> # skip the contents of .app bundles
>>     [[ "$file" = *.app/* ]] && continue
>>
>> # determine whether $file is an application and change value of $isapp if
>> it is
>>     isapp=`mdls -name kMDItemKind "$file"|grep -c Application`
>>
>> # if $file is an application ($isapp contains any nonzero value), act upon
>> it.
>>     if [ $isapp -ne 0 ];
>>       then echo "Deleting" "$file";
>>     fi
>>
>> # reset $isapp
>>     isapp=0
>>
>> done
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/508ec704/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 12 13:47:19 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 16:47:19 -0500
Subject: [Casper] Search and destroy apps
In-Reply-To: <496B611B.7141.0039.0@kckps.org>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
	<ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>
	<496B611B.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>

I too have encountered some of the hardships that Thomas describes.  Thanks
to Casper, MCX and UNIX, with some tinkering, you may be able to get things
managed despite those developers that refuse to follow Apple's developer
guidelines.
If you have a folder that *must* be writable in a place where you don't want
people writing files, I'd try linking it elsewhere (such as /Users/Shared)
and be sure that apps are not allowed in that directory or (if the developer
was thoughtful) changing the location in the app's preferences.  If the app
uses the folder as "scratch space" but there is no persistent data, I'd have
a policy that runs a script which deletes the contents of the folder at
logout.

To have tight control of which apps can run and which can't, disallow
applications within "/" or "/Applications", and then add your allowable apps
to the "Always allow these applications:" list.  It could be tedious, but it
would be tightly controlled.  If you use Workgroup Manager to administer
your MCX (which most people do and it's a free download from Apple), you can
mitigate the tedium by creating presets.  If you handle your MCX via
scripting, you can use Casper smart groups and policies to mitigate the
tedium.

Be sure to test your apps thoroughly, including giving them to live users
toward the end of the testing process.  During your testing, you can
determine the most restrictive permissions that still allow the desired
functions.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 4:26 PM, Thomas Larkin <tlarki at kckps.org> wrote:

>  I would like to add to that as I run a pure Leopard environment since we
> upgraded from Tiger last summer.
>
>  Yes, you can restrict access of where applications can run, and we do
> that here at my work.  I no longer have an approve/block list of
> applications and MCX does configure this.  However, if you have an app that
> requires to have write permissions for everyone, the user can simply drop
> whatever app they want in that directory and it will work, or if you don't
> modify your permissions to give standard users read and execute only access.
>  So, when you make your composer packages MAKE SURE you have proper
> permissions or if  you have an Application that requires the user to have
> write access to a folder with in the /Applications directory this whole
> point is moot.
>
>  Learn from my mistakes people, I copied a package from last years image
> and it had write permissions on it for everyone, in one freaking folder, a
> small over sight.  I did not create the image last year though, Apple and a
> contractor did, then I was hired on afterward to take the reigns of the 1:1.
>  The students figured out that one folder you could write to and dropped
> every game they could get their hands on into it and it works.
>
>  So, if you do decide to use the WGM and MCX managed preferences to
> restrict applications from running from only one folder make sure you do
> your permissions correctly.  Also, some developers are ridiculous and like
> to have things run from /Library as well.  So, yes it is entirely true you
> can restrict access to a given folder that can or can't run applications
> from, but that doesn't mean you just hit the easy button and its now secure.
>  You will have to take the precautions and if you don't you'll end up like
> me with casper policies running ownership and permission scripts fixing the
> issue.  I assure that this will not happen in the next image.  I was rush to
> get 6,000 macbooks imaged with both OS X and Windows XP and we did the best
> we could in the very limited time we had.
>
>  So it is always good to have a back up plan and this is a good one to
> have.  Just in case.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/12/09 2:30 PM >>>
>
> I received a note about my script from someone at Apple, and I want to make
> sure to mention that Leopard's MCX will allow you to prohibit launching apps
> from a user's home folder
>
>  .  In fact, you can allow or disallow the launching of apps from any
> folder(s).
>
>
>    The script I provided is an option if you:
>
> have Tiger clients
>
> don't have OD
>
> don't want to mess with using MCX in the local directory service
>
> want to delete the app(s) as well as deny launching
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Mon, Jan 12, 2009 at 1:17 PM, Miles Leacy
>
> <miles.leacy at themacadmin.com>
>
> wrote:
>
>>  I left out a command in the script in my first message.  Here is the
>> complete script:
>>
>>
>>    #!/bin/bash
>>
>>
>>   ##### HEADER BEGINS #####
>>
>> # scr_maint_searchDestroyAppsInHomeFolder.bash
>>
>> #
>>
>> # Created 20090112 by Miles A. Leacy IV
>>
>> # miles.leacy at themacadmin.com
>>
>>   # Modified 20090112 by Miles A. Leacy IV
>>
>> # Copyright 2009 Miles A. Leacy IV
>>
>> #
>>
>> # This script may be copied and distributed freely as long as this header
>> remains intact.
>>
>> #
>>
>> # This script is provided "as is".  The author offers no warranty or
>> guarantee of any kind.
>>
>> # Use of this script is at your own risk.  The author takes no
>> responsibility for loss of use,
>>
>> # loss of data, loss of job, loss of socks, the onset of armageddon, or
>> any other negative effects.
>>
>> #
>>
>> # Test thoroughly in a lab environment before use on production systems.
>>
>> # When you think it's ok, test again.  When you're certain it's ok, test
>> twice more.
>>
>> #
>>
>> # This script performs a search & destroy on any apps in the user's home
>> folder
>>
>> # This script deletes user data.  Be sure of your organization's policies
>> as they may apply before using.
>>
>> #
>>
>> # Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what
>> data will be deleted and that it is
>>
>> # permissible to delete that data before using this script.
>>
>> #
>>
>> # It is intended to be run as part of a Casper policy triggered by login.
>>
>> #
>>
>> # Note: This script can take several minutes to run on very large home
>> folders.
>>
>> # It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac Pro
>> in testing.
>>
>> #
>>
>> ##### HEADER ENDS #####
>>
>>
>>   # Set $isapp to indicate whether an item is an application
>>
>> # initial value is 0
>>
>> # a value of 0 = not an application
>>
>> # a value of 1 = an application
>>
>> isapp=0
>>
>>
>>   # return the absolute path of each item in the specified directory and
>> act upon them in the "do" loop.
>>
>> find  /Users/$3 | while read file
>>
>> do
>>
>>
>>   # skip the contents of .app bundles
>>
>>     [[ "$file" = *.app/* ]] && continue
>>
>>
>>   # determine whether $file is an application and change value of $isapp
>> if it is
>>
>>     isapp=`mdls -name kMDItemKind "$file"|grep -c Application`
>>
>>
>>   # if $file is an application ($isapp contains any nonzero value), act
>> upon it.
>>
>>     if [ $isapp -ne 0 ];
>>
>>       then echo "Deleting" "$file"; rm -R "$file"
>>
>>     fi
>>
>>
>>   # reset $isapp
>>
>>     isapp=0
>>
>>
>>   done
>>
>>
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>>
>>   On Mon, Jan 12, 2009 at 12:26 PM, Miles Leacy
>>
>> <miles.leacy at themacadmin.com>
>>
>> wrote:
>>
>>>  Hi all,
>>>
>>>
>>>   I have another script to share.  In more than one environment I've
>>> worked with, users were not allowed to store or run apps in/from their home
>>> folders.  Policies were made clear that any apps in one's home folder were
>>> considered a policy violation, and subject to automatic deletion.  I put
>>> together the following script to make sure I never had to go hunt for
>>> someone's hidden apps again.
>>>
>>>
>>>    #!/bin/bash
>>>
>>>
>>>   ##### HEADER BEGINS #####
>>>
>>> # scr_maint_searchDestroyAppsInHomeFolder.bash
>>>
>>> #
>>>
>>> # Created 20080729 by Miles A. Leacy IV
>>>
>>> # miles.leacy at themacadmin.com
>>>
>>> # Modified 20090112 by Miles A. Leacy IV
>>>
>>> # Copyright 2009 Miles A. Leacy IV
>>>
>>> #
>>>
>>> # This script may be copied and distributed freely as long as this header
>>> remains intact.
>>>
>>> #
>>>
>>> # This script is provided "as is".  The author offers no warranty or
>>> guarantee of any kind.
>>>
>>> # Use of this script is at your own risk.  The author takes no
>>> responsibility for loss of use,
>>>
>>> # loss of data, loss of job, loss of socks, the onset of armageddon, or
>>> any other negative effects.
>>>
>>> #
>>>
>>> # Test thoroughly in a lab environment before use on production systems.
>>>
>>> # When you think it's ok, test again.  When you're certain it's ok, test
>>> twice more.
>>>
>>> #
>>>
>>> # This script performs a search & destroy on any apps in the user's home
>>> folder
>>>
>>> # This script deletes user data.  Be sure of your organization's policies
>>> as they may apply before using.
>>>
>>> #
>>>
>>> # Again, THIS SCRIPT DELETES USER DATA.  Make sure you understand what
>>> data will be deleted and that it is
>>>
>>> # permissible to delete that data before using this script.
>>>
>>> #
>>>
>>> # It is intended to be run as part of a Casper policy triggered by login.
>>>
>>>
>>> #
>>>
>>> # Note: This script can take several minutes to run on very large home
>>> folders.
>>>
>>> # It took 5 minutes and 31 seconds on a 146.77 GB home folder on a Mac
>>> Pro in testing.
>>>
>>> #
>>>
>>> ##### HEADER ENDS #####
>>>
>>>
>>>   # Set $isapp to indicate whether an item is an application
>>>
>>> # initial value is 0
>>>
>>> # a value of 0 = not an application
>>>
>>> # a value of 1 = an application
>>>
>>> isapp=0
>>>
>>>
>>>   # return the absolute path of each item in the specified directory and
>>> act upon them in the "do" loop.
>>>
>>> find  /Users/$3 | while read file
>>>
>>> do
>>>
>>>
>>>   # skip the contents of .app bundles
>>>
>>>     [[ "$file" = *.app/* ]] && continue
>>>
>>>
>>>   # determine whether $file is an application and change value of $isapp
>>> if it is
>>>
>>>     isapp=`mdls -name kMDItemKind "$file"|grep -c Application`
>>>
>>>
>>>   # if $file is an application ($isapp contains any nonzero value), act
>>> upon it.
>>>
>>>     if [ $isapp -ne 0 ];
>>>
>>>       then echo "Deleting" "$file";
>>>
>>>     fi
>>>
>>>
>>>   # reset $isapp
>>>
>>>     isapp=0
>>>
>>>
>>>   done
>>>
>>>
>>> ----------
>>> Miles A. Leacy IV
>>>
>>> ? Certified System Administrator 10.4
>>> ? Certified Technical Coordinator 10.5
>>> ? Certified Trainer
>>> Certified Casper Administrator
>>> ----------
>>> voice: 1-347-277-7321
>>> miles.leacy at themacadmin.com
>>> www.themacadmin.com
>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/8f82013d/attachment.html 

From greg.lopez at wunderman.com  Mon Jan 12 17:58:15 2009
From: greg.lopez at wunderman.com (Gregory Lopez)
Date: Mon, 12 Jan 2009 17:58:15 -0800
Subject: [Casper] NAV 11 preventing ssh connections in Leopard
In-Reply-To: <C58C0E72.17C20%jared.nichols@ll.mit.edu>
Message-ID: <C5913537.188B%greg.lopez@wunderman.com>

Here??s what I get:

65535 allow ip from any to any

Interestingly, I??m able to ssh into a few, but not all macs now.  Hmmmm.

G Lo
--
Gregory Lopez
Sr. Mac/Network Analyst
Wunderman - Seattle




From: "Nichols, Jared" <jared.nichols at ll.mit.edu>
Date: Thu, 8 Jan 2009 20:11:30 -0500
To: Gregory Lopez <greg.lopez at wunderman.com>, "casper at list.jamfsoftware.com"
<casper at list.jamfsoftware.com>
Subject: Re: [Casper] NAV 11 preventing ssh connections in Leopard

With NAV functioning ??properly?? can you do a sudo ipfw list and post the
results?

Thanks

j


On 1/8/09 15:21 , "Gregory Lopez" <greg.lopez at wunderman.com> wrote:

> Greetings.  I have a problem where Norton AntiVirus 11 is preventing ssh
> connections on my Leopard macs (including my own) which in turn is preventing
> me from using Casper to deploy software updates.  I've made sure Remote Login
> is on and that the Firewall is allowing connections.
> 
> It's as if port 22 keeps toggling off despite the GUI saying otherwise. Here's
> the message I get when I try to ssh into one of the macs:
> XXX-XXXXX:~ xxxxxxxx$ ssh -vvv x.x.x.x
> OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
> debug1: Reading configuration data /etc/ssh_config
> debug2: ssh_connect: needpriv 0
> debug1: Connecting to x.x.x.x http://x.x.x.x port 22.
> debug1: connect to address x.x.x.x port 22: Connection refused
> ssh: connect to host x.x.x.x port 22: Connection refused
> 
> The problem goes away when I uninstall NAV 11.  It temporarily goes away when
> I run Disk Utility and repair disk permissions.  I am able to ssh in for about
> 10-15 minutes before my connection is refused.  Here??s a log:
> 
> Repairing permissions for ??Macintosh HD??
> Reading permissions database.
> Reading the permissions database can take several minutes.
> 
> User differs on "private/etc/hostconfig", should be 0, user is 99.
> Group differs on "private/etc/hostconfig", should be 0, group is 99.
> User differs on "System/Library/LaunchDaemons/ssh.plist", should be 0, user
> is 99.
> Group differs on "System/Library/LaunchDaemons/ssh.plist", should be 0,
> group is 99.
> Group differs on "private/etc/cups", should be 0, group is 26.
> Permissions differ on "private/var/spool/cups/cache/rss", should be
> drwxr-xr-x , they are drwxrwxr-x .
> 
> Permissions repair complete
> 
> This problem is consistent from 10.5-10.5.6.  Anyone else run into this one?
> 
> G Lo
> --
> Gregory Lopez
> Sr. Mac/Network Analyst
> Wunderman - Seattle
> 
> 
> 
> 

-- 
Jared Nichols
ISD Infrastructure and Operations ?? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/09627f5a/attachment.htm 

From detroye1 at apple.com  Mon Jan 12 18:15:18 2009
From: detroye1 at apple.com (John DeTroye)
Date: Mon, 12 Jan 2009 19:15:18 -0700
Subject: [Casper] Search and destroy apps
In-Reply-To: <ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
	<ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>
	<496B611B.7141.0039.0@kckps.org>
	<ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>
Message-ID: <7F05AD5D-EF50-4D3D-AB98-9095A9F87BB6@apple.com>

Actually, if you use the "Applications" pane versus the "Folders" pane  
to assign allowed apps, you are allowing those applications to be  
dragged/copied anywhere on the user's system and launched. Use the  
"Folders" (which should really be called "Paths") to set up allowed  
and disallowed apps/locations(/paths).

johnd
-- 
John DeTroye                        Email: johnd at apple.com
Sr. Consulting Engineer         Systems Management Specialist
Apple - Education                   iChat: johnd at mac.com
Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
Tips and Tricks Docs - http://web.me.com/johnd/
--

On Jan 12, 2009, at 2:47 PM, Miles Leacy wrote:

> To have tight control of which apps can run and which can't,  
> disallow applications within "/" or "/Applications", and then add  
> your allowable apps to the "Always allow these applications:" list.   
> It could be tedious, but it would be tightly controlled


From miles.leacy at themacadmin.com  Mon Jan 12 18:23:52 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 12 Jan 2009 21:23:52 -0500
Subject: [Casper] Search and destroy apps
In-Reply-To: <7F05AD5D-EF50-4D3D-AB98-9095A9F87BB6@apple.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
	<ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>
	<496B611B.7141.0039.0@kckps.org>
	<ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>
	<7F05AD5D-EF50-4D3D-AB98-9095A9F87BB6@apple.com>
Message-ID: <ec2e75ff0901121823ldd67459t1e66e7bb0ff2c524@mail.gmail.com>

Thanks for the info!
So, am I correct that an item appearing in the "Applications" pane is
allowed even if its enclosing folder appears in the disallowed folders list?

Thanks again,

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 12, 2009 at 9:15 PM, John DeTroye <detroye1 at apple.com> wrote:

> Actually, if you use the "Applications" pane versus the "Folders" pane to
> assign allowed apps, you are allowing those applications to be
> dragged/copied anywhere on the user's system and launched. Use the "Folders"
> (which should really be called "Paths") to set up allowed and disallowed
> apps/locations(/paths).
>
> johnd
> --
> John DeTroye                        Email: johnd at apple.com
> Sr. Consulting Engineer         Systems Management Specialist
> Apple - Education                   iChat: johnd at mac.com
> Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
> Tips and Tricks Docs - http://web.me.com/johnd/
> --
>
> On Jan 12, 2009, at 2:47 PM, Miles Leacy wrote:
>
>  To have tight control of which apps can run and which can't, disallow
>> applications within "/" or "/Applications", and then add your allowable apps
>> to the "Always allow these applications:" list.  It could be tedious, but it
>> would be tightly controlled
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090112/b3d4bfcb/attachment.html 

From daniel.farnworth at thecreativepartnership.co.uk  Tue Jan 13 01:36:13 2009
From: daniel.farnworth at thecreativepartnership.co.uk (Daniel Farnworth)
Date: Tue, 13 Jan 2009 09:36:13 +0000
Subject: [Casper] Search and destroy apps
In-Reply-To: <ec2e75ff0901121823ldd67459t1e66e7bb0ff2c524@mail.gmail.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
	<ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>
	<496B611B.7141.0039.0@kckps.org>
	<ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>
	<7F05AD5D-EF50-4D3D-AB98-9095A9F87BB6@apple.com>
	<ec2e75ff0901121823ldd67459t1e66e7bb0ff2c524@mail.gmail.com>
Message-ID: <B2E4C4B7-1852-452A-AB0C-083093F7C12E@thecreativepartnership.co.uk>

We've not jumped up to Leopard yet (may skip directly to the whiter  
cat in fact). Could either of you guys clarify whether the Apps and  
Folders panes can be used together in conjunction?

Cheers
Dan

On 13 Jan 2009, at 02:23, Miles Leacy wrote:

> Thanks for the info!
>
> So, am I correct that an item appearing in the "Applications" pane  
> is allowed even if its enclosing folder appears in the disallowed  
> folders list?
>
> Thanks again,
>
> ----------
> Miles A. Leacy IV
>
>  Certified System Administrator 10.4
>  Certified Technical Coordinator 10.5
>  Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Mon, Jan 12, 2009 at 9:15 PM, John DeTroye <detroye1 at apple.com>  
> wrote:
> Actually, if you use the "Applications" pane versus the "Folders"  
> pane to assign allowed apps, you are allowing those applications to  
> be dragged/copied anywhere on the user's system and launched. Use  
> the "Folders" (which should really be called "Paths") to set up  
> allowed and disallowed apps/locations(/paths).
>
>
> johnd
> -- 
> John DeTroye                        Email: johnd at apple.com
> Sr. Consulting Engineer         Systems Management Specialist
> Apple - Education                   iChat: johnd at mac.com
> Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
> Tips and Tricks Docs - http://web.me.com/johnd/
> --
>
> On Jan 12, 2009, at 2:47 PM, Miles Leacy wrote:
>
> To have tight control of which apps can run and which can't,  
> disallow applications within "/" or "/Applications", and then add  
> your allowable apps to the "Always allow these applications:"  
> list.  It could be tedious, but it would be tightly controlled
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

-- 
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.


From detroye1 at apple.com  Tue Jan 13 06:22:21 2009
From: detroye1 at apple.com (John DeTroye)
Date: Tue, 13 Jan 2009 07:22:21 -0700
Subject: [Casper] Search and destroy apps
In-Reply-To: <ec2e75ff0901121823ldd67459t1e66e7bb0ff2c524@mail.gmail.com>
References: <ec2e75ff0901120926o29d5ab94mac87b9e76b856086@mail.gmail.com>
	<ec2e75ff0901121017u28e7f97ew2aac100156134d9b@mail.gmail.com>
	<ec2e75ff0901121230t7c832456qc23db9c824c90d59@mail.gmail.com>
	<496B611B.7141.0039.0@kckps.org>
	<ec2e75ff0901121347n4e46c1c2p710e392b6dc72a14@mail.gmail.com>
	<7F05AD5D-EF50-4D3D-AB98-9095A9F87BB6@apple.com>
	<ec2e75ff0901121823ldd67459t1e66e7bb0ff2c524@mail.gmail.com>
Message-ID: <95DA65B7-8513-4E8F-AF56-095419EB25B2@apple.com>

Yes. The "Applications" pane is for signing apps and setting up  
universally allowed apps. Here's an explanation I posted to one of the  
other lists:
----
The WGM/Prefs settings for Applications often confuses a lot of  
people. Let me try to explain what the gears and tubes are doing.

The Applications tab is where you digitally sign apps and designate  
them for use regardless of location. The apps, when signed on an admin  
system, must then be cloned onto every client machine. This is because  
the signing affects only that copy of the app. App signing keeps a  
user from editing the app bundle and trying to fake out the mgmt to  
think it's something else - think "I'm not Terminal, I'm really  
Calculator
" The problem with using that tab to set application permissions is  
that you are allowing users to drag the app into their homedir or  
anyplace else they want to run it. It also doesn't account for all of  
the other portions of some applications, such as the support apps they  
need.

The Folders tab should really be called "Paths" since you designate  
the location of the allowed, and disallowed, application(s). It works  
the same as a firewall, with denies overriding allows. It is important  
to allow locations such as the /Library/Application Support folder,  
and often, the entire /Library folder when 3rd party apps dump stuff  
all over the place. This may be the case with SketchUp.

The old "Allow apps to sublaunch" from Tiger is active all the time in  
Leopard; but in a much more limited way - it allows items inside the  
same folder that you designated plus any system-owned items (unix apps).

And finally, all of this assumes well-behaved apps.
-----

johnd
-- 
John DeTroye                        Email: johnd at apple.com
Sr. Consulting Engineer         Systems Management Specialist
Apple - Education                   iChat: johnd at mac.com
Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
Tips and Tricks Docs - http://web.me.com/johnd/
--

On Jan 12, 2009, at 7:23 PM, Miles Leacy wrote:

> Thanks for the info!
>
> So, am I correct that an item appearing in the "Applications" pane  
> is allowed even if its enclosing folder appears in the disallowed  
> folders list?
>
> Thanks again,
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Mon, Jan 12, 2009 at 9:15 PM, John DeTroye <detroye1 at apple.com>  
> wrote:
> Actually, if you use the "Applications" pane versus the "Folders"  
> pane to assign allowed apps, you are allowing those applications to  
> be dragged/copied anywhere on the user's system and launched. Use  
> the "Folders" (which should really be called "Paths") to set up  
> allowed and disallowed apps/locations(/paths).
>
>
> johnd
> -- 
> John DeTroye                        Email: johnd at apple.com
> Sr. Consulting Engineer         Systems Management Specialist
> Apple - Education                   iChat: johnd at mac.com
> Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
> Tips and Tricks Docs - http://web.me.com/johnd/
> --
>
> On Jan 12, 2009, at 2:47 PM, Miles Leacy wrote:
>
> To have tight control of which apps can run and which can't,  
> disallow applications within "/" or "/Applications", and then add  
> your allowable apps to the "Always allow these applications:" list.   
> It could be tedious, but it would be tightly controlled
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/e9c28141/attachment.html 

From daniel.farnworth at thecreativepartnership.co.uk  Tue Jan 13 08:44:03 2009
From: daniel.farnworth at thecreativepartnership.co.uk (Daniel Farnworth)
Date: Tue, 13 Jan 2009 16:44:03 +0000
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <49671CF6.7141.0039.0@kckps.org>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
	<49671CF6.7141.0039.0@kckps.org>
Message-ID: <217A3B56-E8F3-4398-8B09-92A2B624FCE3@thecreativepartnership.co.uk>

Hi Thomas,

Just to clarify, the reason that we wrote the script is that this  
will need to be run on each machine as it is imaged. When you  
partition a disk, the UUID that is assigned to each volume is  
completely unique; thus is you write the fstab in advance of the  
machines being partitioned, you are confined to using Labels as each  
machines disks/volumes will have globally unique UUIDs. This is why  
we run this as a pre-image script.

Hope this helps
Dan

On 9 Jan 2009, at 15:46, Thomas Larkin wrote:

> When we did our massive dual boot image over this last summer I was  
> looking at the /etc/fstab file to hide the windows partition from  
> the OS X side.  I had so many problems getting fstab to work.  It  
> would not work for me if I used volume name or the device mount  
> point, ie /dev/disk1s3/.  It would work if I used UUID, but if you  
> mass duplicate that UUID to tons of machines I found that it  
> wouldn't work.
>
> What has been your experience using /etc/fstab in 10.5?
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Daniel Farnworth  
> <daniel.farnworth at thecreativepartnership.co.uk> 01/09/09 7:15 AM >>>
> He he, thought that'd be popular.
>
> The script is fairly poorly written (I'm not a Bash wiz) so any
> improvements are welcome (please let me have any so I can improve  
> mine).
>
> We run it as a 'before' script during our imaging process and it
> takes a look at the internal disks, tries to figure out which is the
> system disk or otherwise the disk in the first bay (Mac Pros only I
> think) and then partitions it up into various volumes that we want.
> Our post-flight script then takes the names of these and builds an
> fstab file which it writes down to /etc. It also moves our admin
> user's ('lwsadmin' in the script) home directory to /var/homes. We
> figured this may be wise just in case the data partition goes dead
> for any reason. Our OS image is pre-confd with lwsadmin's home
> pointing at the correct location, so you may want to excise this
> section and rely on using root to login in bad circumstances.
>
> Oh, the post script also 'hides' some of the partitions (Restore,
> Freespace etc) so they don't show on the desktop, check the resulting
> fstab to see how this is done.
>
> Be careful using this, it is destructive. Usual disclaimers apply =)
>
> ### Pre-install Partition Script
>
> #!/bin/bash -v
>
> exec 2>&1
>
> function rawdisksize {
> FLOAT=$1
> INT1=${FLOAT/.*}
> #if $(( INT1 % 10 )) then
> while (( INT1 % 10 ))
> do
> let INT1++
> done
> #fi
> echo "$INT1"
> }
>
>
> function partitionsizes {
>
> case $RAW_SIZE in
>
> 30)
> INTHD_SIZE=15
> HOMES_SIZE=10
> SCRATCH_SIZE=3
> RESTORE_SIZE=0
> ;;
>
> 40)
> INTHD_SIZE=20
> HOMES_SIZE=10
> SCRATCH_SIZE=5
> RESTORE_SIZE=0
> ;;
>
> 60)
> INTHD_SIZE=30
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=5
> ;;
>
> 80)
> INTHD_SIZE=40
> HOMES_SIZE=10
> SCRATCH_SIZE=10
> RESTORE_SIZE=10
> ;;
>
> 120)
> INTHD_SIZE=60
> HOMES_SIZE=20
> SCRATCH_SIZE=10
> RESTORE_SIZE=20
> ;;
>
> 160)
> INTHD_SIZE=80
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> 240)
> INTHD_SIZE=160
> HOMES_SIZE=25
> SCRATCH_SIZE=10
> RESTORE_SIZE=25
> ;;
>
> *)
> INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
> HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> ;;
> esac
>
> }
>
>
> # Define a function to define whether this is a 'Bay Capable' machine
> #function bayedmachine {
>
> # This needs to be written fairly soon
>
> #}
>
>
> if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
>
> echo ${1}
> TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> '{ print $3 }' | cut -c 1-5`
> echo ${TARGETDISK}
>
> # now to partition the disk
> #
>
> if [ ! -z $TARGETDISK ]
> then
> TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk
> '{ print $3 }'`
> RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
> partitionsizes
>
> echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
> echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
>                  echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
>                  echo "CP-Homes-01 Size: $HOMES_SIZE GB"
>                  echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
>                  echo "Restore Size: $RESTORE_SIZE GB"
>
>
> # Check processor type so we partition in the right format
>
> sysinfo=`system_profiler`
>
> countPPC=`echo ${sysinfo} | grep -c PowerPC`
> countIntel=`echo ${sysinfo} | grep -c Intel`
>
> if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
> echo "Got a PPC in here"
> partition_scheme_type="APMFormat"
>
> elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
> echo "Intel Inside"
> partition_scheme_type="GPTFormat"
>
> else
> echo "Can't work out what kinda proc, it either ain't got one or
> could be a Cray?"
> exit 1
>
> fi
>
>
> # Set the partition going
>
> if [ $RESTORE_SIZE -gt 0 ]; then
>
> diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
> "Journaled HFS+" Restore "$RESTORE_SIZE"G
>
> else
>
> diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
> "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G
>
> fi
>
>
> chown root:admin /Volumes/CP-Homes-01
> chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
> chown root:admin /Volumes/Restore
> chown root:admin /Volumes/Free-Space
>
> chmod g+w /Volumes/CP-Homes-01
> chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
> chmod g+w /Volumes/Restore
> chmod g+w /Volumes/Free-Space
>
> touch /Volumes/CP-IntHD-01/.cp-partition-done
>
> else
>
> echo "Problem acquiring target disk, exiting";
> exit 1
>
> fi
>
> else
>
> echo "The partition scheme has already been created. Exiting"
> exit 0
>
> fi
>
> exit 0
>
>
> ### Post Install Script
>
> #!/bin/bash -v
>
> # Redirect STDERR to STDOUT
> exec 2>&1
>
> VOLSDIR="/Volumes/"
>
> ROOTVOL="CP-IntHD-01"
> HOMESVOL="CP-Homes-01"
>
> ROOTPATH="${VOLSDIR}${ROOTVOL}"
> HOMESPATH="${VOLSDIR}${HOMESVOL}"
>
>
>
>
> if [ -e "${1}/.cp-partition-done" ]; then
>
> # Ditto the contents of $ROOTPART/Users/Shared to their new location
>
> ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
> if (( ! $? )); then
>
> # Remove the old copy of $ROOTPART/Users/Shared
> echo "Done dittoing..."
> rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
> rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> failed" ; }
> rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized
> failed" ; }
>
> if [ -e "${1}/var/homes/lwsadmin" ]; then
> rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin
> failed" ; }
> fi
>
> DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
> echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo
> "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
> echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
>
> HIDDEN_VOLS=(Restore Free-Space)
>
> for volume in "${HIDDEN_VOLS[@]}"; do
>
> DEVID=`diskutil list | grep $volume | awk '{print $6}'`
> UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
>
> echo "# Set the volume $volume to not mount at startup" >> $1/etc/
> fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit  
> 1 ; }
> echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/
> fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
>
> done
>
> fi
>
> touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> could not be created" ; exit 1 ; }
>
> exit 0
>
> else
> # Log the error
> echo "Could not find partition completion file. It would be wise not
> to continue"
> # Exit with above 0 status
> exit 1
>
> fi
>
>
>
>
>
>
> On 9 Jan 2009, at 12:44, Damien Weiss wrote:
>
> >
> > YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
> > would implement almost immediately.
> >
> > Thanks!
> > Damien
> >
> > On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
> >
> >> I have a pre-
> >> install script that we use to do this for us if anyone is  
> interested.
> >>
> >> Cheers
> >> Dan
> >
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely  
> for the use of the individual or entity to whom it is addressed and  
> others authorised to receive it. It may contain confidential or  
> legally privileged information. If you are not the intended  
> recipient you are hereby notified that any disclosure, copying,  
> distribution or taking any action in reliance on the contents of  
> this information is strictly prohibited and may be unlawful. If you  
> have received this communication in error, please notify  
> postmaster at thecreativepartnership.co.uk immediately and then delete  
> this email from your system. Any views or opinions presented in  
> this email are solely those of the author and do not necessarily  
> represent those of The Creative Partnership. The Creative  
> Partnership has taken every reasonable precaution to ensure that  
> any attachment to this e-mail has been swept for viruses. However,  
> The Creative Partnership cannot accept liability for any damage  
> sustained as a result of s
> oftware viruses and would advise that you carry out your own virus  
> checks before opening any attachment.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

-- 
Daniel Farnworth
IT Manager
The Creative Partnership
daniel.farnworth at thecreativepartnership.co.uk

http://www.thecreativepartnership.co.uk
Tel: +44 (0)20 7439 7762
Fax: +44 (0)20 7437 1467

PGP Public Key available






The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify postmaster at thecreativepartnership.co.uk immediately and then delete this email from your system. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of The Creative Partnership. The Creative Partnership has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, The Creative Partnership cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.


From ron.prue at mynoahs.com  Tue Jan 13 10:46:42 2009
From: ron.prue at mynoahs.com (Ron Prue)
Date: Tue, 13 Jan 2009 11:46:42 -0700
Subject: [Casper] Quickadd Failing
Message-ID: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>

Hi all,

I am seeing an issue with my quickadd.pkg failing to run a "post- 
flight script" on some machines.  It is not adding the machine to my  
JSS and I have repaired permissions and run it again with the same  
result.

Any ideas?




Ron Prue
Technical Services
Noah Corporation
435.214.2927
ron.prue at mynoahs.com






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/2314fdc8/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Noahs Logo.png
Type: image/png
Size: 11936 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/2314fdc8/attachment.png 

From miles.leacy at themacadmin.com  Tue Jan 13 10:52:52 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 13 Jan 2009 13:52:52 -0500
Subject: [Casper] MS Office 2008 configuration
In-Reply-To: <C5923591.7E35%john_wetter@hopkins.k12.mn.us>
References: <ec2e75ff0901130936y74dc03c2h6679ddfbf9005a20@mail.gmail.com>
	<C5923591.7E35%john_wetter@hopkins.k12.mn.us>
Message-ID: <ec2e75ff0901131052m33b5adfcs5570cacef80defc1@mail.gmail.com>

This is in re: to my script that sets the default save formats in MS Office
2008 apps to .doc, .xls, and .ppt in order to avoid any file compatibility
issues with systems that are not up to date on their Office versions.  I
will paste in the original script at the end of this message.

I'm taking this on-list in case anyone else needs this info.  The issue
turns out to be that I didn't test this fully, and I was, in fact, managing
these preferences via Open Directory and MCX.
The commands are sound, but as John Wetter found in testing, they're being
run by root, so they are not setting the preferences for the user in
question.  The script functions properly if you run it as the user in
question.

I see a couple of options to fix this...

1. Use the script with the full paths to the user's plists, then add a chown
command to the end of the script to return ownership to the user.  To do
this:

- Insert "/Users/$3/Library/Preferences/" in front of each of the
"com.microsoft" preference domains in the script.
- add the following line to the end of the script:
chown $3 /Users/$3/Library/Preferences/com.microsoft*

2. Write the plist to /Library/Preferences instead of ~/Library/Preferences
and grant read permissions to everyone.  I like this best since you'll only
have to do it once per computer, rather than once per user.  To do this:

- Insert "/Library/Preferences/" in front of each of the "com.microsoft"
preference domains in the script.
- Add the following line to the end of the script:
chmod a+r /Users/$3/Library/Preferences/com.microsoft*

2. If you have Open Directory in place, open the Preferences Details pane in
Workgroup Manager, add the Office apps to the list and set the preference
values within Workgroup manager.

3. Use dscl to manage MCX settings in the local directory service.

4. I haven't tried this, and it may not work because I think it generates a
new shell which could cause problems, but you might try adding `su $3` to
the beginning of the script to have the commands executed as the correct
user.

Here's the original script:

#!/bin/bash

# scr_app_office2008FileFormats.bash
#
# Set Office 2008 apps to save in .doc, .xls. .ppt rather than docx, etc.
#
# Written by Miles A. Leacy IV
# Last modified 20080612

# Word
defaults write com.microsoft.Word 2008\\Default\ Save\\Default\ Format
-string Doc97

# Excel
defaults write com.microsoft.Excel 2008\\Default\ Save\\Default\ Format -int
57

# Powerpoint
defaults write com.microsoft.Powerpoint 2008\\Default\ Save\\Default\
Save\\Default\ Format -string Microsoft\ PowerPoint\ 98\ Presentation

exit 0

### end script
----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/1ee885ec/attachment.htm 

From miles.leacy at themacadmin.com  Tue Jan 13 11:00:11 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 13 Jan 2009 14:00:11 -0500
Subject: [Casper] Quickadd Failing
In-Reply-To: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
Message-ID: <ec2e75ff0901131100i66f74dddgec4c0717509f8236@mail.gmail.com>

Ron,
If I recall correctly, the QuickAdd.pkg must be built while logged in as a
local admin.  I believe that if you create a QuickAdd.pkg while logged in
with a network account, the pkg will be created but it won't work.

I may not be remembering this 100% correctly, so you might want to give JAMF
support a quick call to be sure.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/13 Ron Prue <ron.prue at mynoahs.com>

> Hi all,
> I am seeing an issue with my quickadd.pkg failing to run a "post-flight
> script" on some machines.  It is not adding the machine to my JSS and I have
> repaired permissions and run it again with the same result.
>
> Any ideas?
>
>
>
>
> *Ron Prue*
> *Technical Services*
> *Noah Corporation*
> *435.214.2927*
> *ron.prue at mynoahs.com*
> *
> *
> *
>
>
>
> *
> **
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/86c55165/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 11936 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/86c55165/attachment.png 

From rharter at uwsp.edu  Tue Jan 13 11:00:34 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Tue, 13 Jan 2009 13:00:34 -0600
Subject: [Casper] Quickadd Failing
In-Reply-To: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
Message-ID: <61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>

Is your QuickAdd.pkg making it's way across a Windows share on it's  
way to your client?  Or are you copying it using scp?

I've seen some inconsistent issues with either of these methods where  
some of the special data on the file will get stripped and cause the  
postflight script to no longer be flagged as executable.  I would  
suggest zipping (right click > "Compress") or tarring (tar cpvf  
QuickAdd.pkg) the file before you transfer to be sure.

Also, on the client it is failing on, you can check that the  
postflight script is executable by entering the following into a  
terminal:

ls -l /path/to/QuickAdd.pkg/Content/Resources/

and look for  the 'x' in the left hand colomn.

-rwxrwxrwx  1 rharter  UWSPDOM\domain users      97 Nov 18 17:34  
postflight

Hope it helps.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 13, 2009, at 12:46 PM, Ron Prue wrote:

> Hi all,
>
> I am seeing an issue with my quickadd.pkg failing to run a "post- 
> flight script" on some machines.  It is not adding the machine to my  
> JSS and I have repaired permissions and run it again with the same  
> result.
>
> Any ideas?
>
>
>
>
> Ron Prue
> Technical Services
> Noah Corporation
> 435.214.2927
> ron.prue at mynoahs.com
>
>
> <Noahs Logo.png>
>
>
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/e1839e6f/attachment.html 

From ron.prue at mynoahs.com  Tue Jan 13 11:19:57 2009
From: ron.prue at mynoahs.com (Ron Prue)
Date: Tue, 13 Jan 2009 12:19:57 -0700
Subject: [Casper] Quickadd Failing
In-Reply-To: <61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
	<61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>
Message-ID: <4A4D43E3-2ED0-4EF2-84FD-A0C04EA9C85D@mynoahs.com>

Miles-

The package was created with an admin account originally.

Ryan-

The permissions are indeed not correct.  No allowance for an execute  
command on any of the contents.  Not sure how this ever happened as I  
have used this accross 26 machines in the past 2 months with no  
problem until now.  However we did do a server rebuild recently which  
may have reset the permission on the file.

 From your example it looks as if it should be rwx for users, group  
and other.  Any reason I can't just use the 'chmod' command and  
correct this?


Ron Prue
Technical Services
Noah Corporation
435.214.2927
ron.prue at mynoahs.com






On Jan 13, 2009, at 12:00 PM, Ryan Harter wrote:

> Is your QuickAdd.pkg making it's way across a Windows share on it's  
> way to your client?  Or are you copying it using scp?
>
> I've seen some inconsistent issues with either of these methods  
> where some of the special data on the file will get stripped and  
> cause the postflight script to no longer be flagged as executable.   
> I would suggest zipping (right click > "Compress") or tarring (tar  
> cpvf QuickAdd.pkg) the file before you transfer to be sure.
>
> Also, on the client it is failing on, you can check that the  
> postflight script is executable by entering the following into a  
> terminal:
>
> ls -l /path/to/QuickAdd.pkg/Content/Resources/
>
> and look for  the 'x' in the left hand colomn.
>
> -rwxrwxrwx  1 rharter  UWSPDOM\domain users      97 Nov 18 17:34  
> postflight
>
> Hope it helps.
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 13, 2009, at 12:46 PM, Ron Prue wrote:
>
>> Hi all,
>>
>> I am seeing an issue with my quickadd.pkg failing to run a "post- 
>> flight script" on some machines.  It is not adding the machine to  
>> my JSS and I have repaired permissions and run it again with the  
>> same result.
>>
>> Any ideas?
>>
>>
>>
>>
>> Ron Prue
>> Technical Services
>> Noah Corporation
>> 435.214.2927
>> ron.prue at mynoahs.com
>>
>>
>> <Noahs Logo.png>
>>
>>
>>
>> <ATT00001.txt>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/64ef7c12/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Noahs Logo.png
Type: image/png
Size: 11936 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/64ef7c12/attachment.png 

From rharter at uwsp.edu  Tue Jan 13 11:21:46 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Tue, 13 Jan 2009 13:21:46 -0600
Subject: [Casper] Quickadd Failing
In-Reply-To: <4A4D43E3-2ED0-4EF2-84FD-A0C04EA9C85D@mynoahs.com>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
	<61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>
	<4A4D43E3-2ED0-4EF2-84FD-A0C04EA9C85D@mynoahs.com>
Message-ID: <0FA99F86-0CF9-4B9D-9806-0773C0CBAFBD@uwsp.edu>

chmod should work just fine.  I run a script to install a different  
pkg that is stored on a windows machine on some clients and have it  
run chmod +x on the scripts just incase.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 13, 2009, at 1:19 PM, Ron Prue wrote:

> Miles-
>
> The package was created with an admin account originally.
>
> Ryan-
>
> The permissions are indeed not correct.  No allowance for an execute  
> command on any of the contents.  Not sure how this ever happened as  
> I have used this accross 26 machines in the past 2 months with no  
> problem until now.  However we did do a server rebuild recently  
> which may have reset the permission on the file.
>
> From your example it looks as if it should be rwx for users, group  
> and other.  Any reason I can't just use the 'chmod' command and  
> correct this?
>
>
> Ron Prue
> Technical Services
> Noah Corporation
> 435.214.2927
> ron.prue at mynoahs.com
>
>
> <Noahs Logo.png>
>
>
>
> On Jan 13, 2009, at 12:00 PM, Ryan Harter wrote:
>
>> Is your QuickAdd.pkg making it's way across a Windows share on it's  
>> way to your client?  Or are you copying it using scp?
>>
>> I've seen some inconsistent issues with either of these methods  
>> where some of the special data on the file will get stripped and  
>> cause the postflight script to no longer be flagged as executable.   
>> I would suggest zipping (right click > "Compress") or tarring (tar  
>> cpvf QuickAdd.pkg) the file before you transfer to be sure.
>>
>> Also, on the client it is failing on, you can check that the  
>> postflight script is executable by entering the following into a  
>> terminal:
>>
>> ls -l /path/to/QuickAdd.pkg/Content/Resources/
>>
>> and look for  the 'x' in the left hand colomn.
>>
>> -rwxrwxrwx  1 rharter  UWSPDOM\domain users      97 Nov 18 17:34  
>> postflight
>>
>> Hope it helps.
>>
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu
>>
>> On Jan 13, 2009, at 12:46 PM, Ron Prue wrote:
>>
>>> Hi all,
>>>
>>> I am seeing an issue with my quickadd.pkg failing to run a "post- 
>>> flight script" on some machines.  It is not adding the machine to  
>>> my JSS and I have repaired permissions and run it again with the  
>>> same result.
>>>
>>> Any ideas?
>>>
>>>
>>>
>>>
>>> Ron Prue
>>> Technical Services
>>> Noah Corporation
>>> 435.214.2927
>>> ron.prue at mynoahs.com
>>>
>>>
>>> <Noahs Logo.png>
>>>
>>>
>>>
>>> <ATT00001.txt>
>>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/905a36fa/attachment.html 

From tlarki at kckps.org  Tue Jan 13 11:34:41 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 13 Jan 2009 13:34:41 -0600
Subject: [Casper] Quickadd Failing
In-Reply-To: <0FA99F86-0CF9-4B9D-9806-0773C0CBAFBD@uwsp.edu>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
	<61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>
	<4A4D43E3-2ED0-4EF2-84FD-A0C04EA9C85D@mynoahs.com>
	<0FA99F86-0CF9-4B9D-9806-0773C0CBAFBD@uwsp.edu>
Message-ID: <496C9870.7141.0039.0@kckps.org>

Are  you having it create an managed account or modifying an existing account?  If the account doesn't exist you will need to create it.

>>> Ryan Harter <rharter at uwsp.edu> 01/13/09 1:21 PM >>>
chmod should work just fine.  I run a script to install a different pkg that is stored on a windows machine on some clients and have it run chmod +x on the scripts just incase.


Ryan Harter 

UW - Stevens Point 

Workstation Developer 

715.346.2716 


Ryan.Harter at uwsp.edu 



On Jan 13, 2009, at 1:19 PM, Ron Prue wrote: 




Miles- 



The package was created with an admin account originally. 



Ryan- 



The permissions are indeed not correct.  No allowance for an execute command on any of the contents.  Not sure how this ever happened as I have used this accross 26 machines in the past 2 months with no problem until now.  However we did do a server rebuild recently which may have reset the permission on the file. 




From bogus@does.not.exist.com  Fri Jan  2 08:38:22 2009
From: bogus@does.not.exist.com ()
Date: Fri, 02 Jan 2009 16:38:22 -0000
Subject: No subject
Message-ID: <mailman.5.1231875302.17143.casper@list.jamfsoftware.com>

other.  Any reason I can't just use the 'chmod' command and correct this? =
=20





Ron Prue=20

Technical Services=20

Noah Corporation=20

435.214.2927=20

ron.prue at mynoahs.com=20






<Noahs Logo.png>=20







On Jan 13, 2009, at 12:00 PM, Ryan Harter wrote:=20




Is your QuickAdd.pkg making it's way across a Windows share on it's way to =
your client?  Or are you copying it using scp?=20



I've seen some inconsistent issues with either of these methods where some =
of the special data on the file will get stripped and cause the postflight =
script to no longer be flagged as executable.  I would suggest zipping =
(right click > "Compress") or tarring (tar cpvf QuickAdd.pkg) the file =
before you transfer to be sure.=20



Also, on the client it is failing on, you can check that the postflight =
script is executable by entering the following into a terminal:=20



ls -l /path/to/QuickAdd.pkg/Content/Resources/=20



and look for  the 'x' in the left hand colomn.=20



-rwxrwxrwx  1 rharter  UWSPDOM\domain users      97 Nov 18 17:34 postflight=
=20



Hope it helps.=20


Ryan Harter=20

UW - Stevens Point=20

Workstation Developer=20

715.346.2716=20


Ryan.Harter at uwsp.edu=20



On Jan 13, 2009, at 12:46 PM, Ron Prue wrote:=20




Hi all,=20



I am seeing an issue with my quickadd.pkg failing to run a "post-flight =
script" on some machines.  It is not adding the machine to my JSS and I =
have repaired permissions and run it again with the same result.  =20



Any ideas?=20








Ron Prue=20

Technical Services=20

Noah Corporation=20

435.214.2927=20

ron.prue at mynoahs.com=20






<Noahs Logo.png>=20







<ATT00001.txt>=20








--=__Part604848C1.0__=
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Description: HTML

<html>
  <head>
    <style type=3D"text/css">
      <!--
        body { margin-top: 4px; margin-bottom: 1px; line-height: normal; =
font-variant: normal; margin-right: 4px; margin-left: 4px }
        p { margin-top: 0; margin-bottom: 0 }
      -->
    </style>
   =20
  </head>
  <body>
    <p style=3D"margin-bottom: 0; margin-top: 0">
      <font face=3D"Lucida Grande" size=3D"3">Are &nbsp;you having it =
create an managed account or modifying an existing account&#63; &nbsp;If =
the account doesn&#39;t exist you will need to create it.</font><br><br>&gt=
;&gt;&gt; Ryan Harter &lt;rharter at uwsp.edu&gt; 01/13/09 1:21 PM &gt;&gt;&gt=
;<br>chmod should work just fine.&nbsp;&#160;I run a script to install a =
different pkg that is stored on a windows machine on some clients and have =
it run chmod &#43;x on the scripts just incase.<br>    </p>
    <div>
      <div style=3D"font-variant: normal; white-space: normal; font-style: =
normal; word-spacing: 0px; text-transform: none; font-family: Helvetica; =
font-size: 12px; text-align: auto; color: rgb(0, 0, 0); text-indent: 0px; =
line-height: normal; font-weight: normal; letter-spacing: normal" =
class=3D"apple-style-span">
        <div style=3D"margin-top: 0px; margin-bottom: 0px; margin-right: =
0px; margin-left: 0px">
          <p style=3D"margin-bottom: 0; margin-top: 0">
            <b style=3D"font-size: 14px; color: rgb(135, 118, 179); =
font-weight: bold"><font color=3D"#8776B3" size=3D"4" class=3D"apple-style-=
span"><br style=3D"color: rgb(135, 118, 179); font-size: 14px; font-weight:=
 bold" class=3D"apple-interchange-newline">
            Ryan Harter</font></b>          </p>
        </div>
        <div style=3D"margin-top: 0px; margin-bottom: 0px; margin-right: =
0px; margin-left: 0px">
          <p style=3D"margin-bottom: 0; margin-top: 0">
            <font color=3D"#8776B3" size=3D"2" class=3D"apple-style-span">U=
W - Stevens Point</font>          </p>
        </div>
        <div style=3D"margin-top: 0px; margin-bottom: 0px; margin-right: =
0px; margin-left: 0px">
          <p style=3D"margin-bottom: 0; margin-top: 0">
            <font color=3D"#8776B3" size=3D"2" class=3D"apple-style-span">W=
orkstation Developer</font>          </p>
        </div>
        <div style=3D"margin-top: 0px; margin-bottom: 0px; margin-right: =
0px; margin-left: 0px">
          <p style=3D"margin-bottom: 0; margin-top: 0">
            <font color=3D"#8776B3" size=3D"2" class=3D"apple-style-span">7=
15.346.2716</font>          </p>
        </div>
        <div style=3D"margin-top: 0px; margin-bottom: 0px; margin-right: =
0px; margin-left: 0px">
<br>           =20
          <div style=3D"color: rgb(0, 0, 238)" class=3D"apple-style-span">
            <p style=3D"margin-bottom: 0; margin-top: 0">
              Ryan.Harter at uwsp.edu            </p>
          </div>
        </div>
      </div>
    </div>
    <p style=3D"margin-bottom: 0; margin-top: 0">
      <br>
          </p>
    <div>
      <div>
        <p style=3D"margin-bottom: 0; margin-top: 0">
          On Jan 13&#44; 2009&#44; at 1:19 PM&#44; Ron Prue wrote:        =
</p>
      </div>
      <p style=3D"margin-bottom: 0; margin-top: 0">
        <br class=3D"apple-interchange-newline">
              </p>
      <blockquote type=3D"cite">
        <div>
          <p style=3D"margin-bottom: 0; margin-top: 0">
            Miles-          </p>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              <br>
                          </p>
          </div>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              The package was created with an admin account originally.    =
        </p>
          </div>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              <br>
                          </p>
          </div>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              Ryan-            </p>
          </div>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              <br>
                          </p>
          </div>
          <div>
            <p style=3D"margin-bottom: 0; margin-top: 0">
              The permissions are indeed not correct.&nbsp;&#160;No =
allowance for an execute command on any of the contents.&nbsp;&#160;Not =
sure how this ever happened as I have used this accross 26 machines in the =
past 2 months with no problem until now.&nbsp;&#160;However we did do a =
server rebuild recently which may have reset the permission on the file.   =
         </p>
            <div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                <br>
                              </p>
            </div>
            <div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                From your example it looks as if it should be rwx for =
users&#44; group and other.&nbsp;&#160;Any reason I can&#39;t just use the =
&#39;chmod&#39; command and correct this&#63;&#160;              </p>
            </div>
            <div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                <br>
                              </p>
            </div>
            <div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                <br>
                              </p>
              <div apple-content-edited=3D"true">
                <div style=3D"font-variant: normal; white-space: normal; =
font-style: normal; word-spacing: 0px; text-transform: none; font-family: =
Helvetica; font-size: 12px; text-align: auto; color: rgb(0, 0, 0); =
text-indent: 0px; line-height: normal; font-weight: bold; letter-spacing: =
normal" class=3D"apple-style-span">
                  <div style=3D"font-variant: normal; white-space: normal; =
font-style: normal; word-spacing: 0px; text-transform: none; font-family: =
Helvetica; font-size: 12px; color: rgb(0, 0, 0); text-indent: 0px; =
line-height: normal; font-weight: normal; letter-spacing: normal" =
class=3D"apple-style-span">
                    <div style=3D"font-variant: normal; white-space: =
normal; font-style: normal; word-spacing: 0px; text-transform: none; =
font-family: Helvetica; font-size: 12px; color: rgb(0, 0, 0); text-indent: =
0px; line-height: normal; font-weight: normal; letter-spacing: normal" =
class=3D"apple-style-span">
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b>Ron Prue</b>                        </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b>Technical Services</b>                        =
</p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b>Noah Corporation</b>                        =
</p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b>435.214.2927</b>                        </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b><a href=3D"mailto:ron.prue at mynoahs.com">ron.pr=
ue at mynoahs.com</a></b>                        </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b><br style=3D"font-weight: bold">
                          </b>                        </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <b><br style=3D"font-weight: bold" class=3D"apple=
-interchange-newline">
                          </b>                        </p>
                        <div>
<br>                           =20
                        </div>
                        <div>
                          <div>
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              &lt;Noahs Logo.png&gt;                       =
     </p>
                          </div>
                        </div>
                        <div style=3D"font-variant: normal; white-space: =
normal; font-style: normal; word-spacing: 0px; text-transform: none; =
font-family: Helvetica; font-size: 12px; text-align: auto; color: rgb(0, =
0, 0); text-indent: 0px; line-height: normal; font-weight: bold; letter-spa=
cing: normal" class=3D"apple-style-span">
                          <div style=3D"font-variant: normal; white-space: =
normal; font-style: normal; word-spacing: 0px; text-transform: none; =
font-family: Helvetica; font-size: 12px; color: rgb(0, 0, 0); text-indent: =
0px; line-height: normal; font-weight: bold; letter-spacing: normal" =
class=3D"apple-style-span">
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <br class=3D"apple-interchange-newline">
                              <br class=3D"apple-interchange-newline">
                              <br class=3D"apple-interchange-newline">
                                                          </p>
                          </div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                <br>
                              </p>
              <div>
                <div>
                  <p style=3D"margin-bottom: 0; margin-top: 0">
                    On Jan 13&#44; 2009&#44; at 12:00 PM&#44; Ryan Harter =
wrote:                  </p>
                </div>
                <p style=3D"margin-bottom: 0; margin-top: 0">
                  <br class=3D"apple-interchange-newline">
                                  </p>
                <blockquote type=3D"cite">
                  <div>
                    <p style=3D"margin-bottom: 0; margin-top: 0">
                      Is your QuickAdd.pkg making it&#39;s way&#160;across&=
#160;a Windows share on it&#39;s way to your client&#63;&nbsp;&#160;Or are =
you copying it using scp&#63;                    </p>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        I&#39;ve seen some inconsistent issues with either =
of these methods where some of the special data on the file will get =
stripped and cause the postflight script to no longer be flagged as =
executable.&nbsp;&#160;I would suggest zipping &#40;right click &gt; =
&quot;Compress&quot;&#41; or tarring &#40;tar cpvf QuickAdd.pkg&#41; the =
file before you transfer to be sure.                      </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        Also&#44; on the client it is failing on&#44; you =
can check that the postflight script is executable by entering the =
following into a terminal:                      </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        ls -l /path/to/QuickAdd.pkg/Content/Resources/     =
                 </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        and look for&nbsp;&#160;the &#39;x&#39; in the =
left hand colomn.                      </p>
                    </div>
                    <div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                    <div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          -rwxrwxrwx&nbsp;&#160;1 rharter&nbsp;&#160;UWSPDO=
M&#92;domain users&nbsp;&#160;&nbsp;&#160;&nbsp;&#160;97 Nov 18 17:34 =
postflight                        </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <br>
                                                  </p>
                      </div>
                      <div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          Hope it helps.                        </p>
                      </div>
                      <div>
                        <div style=3D"font-variant: normal; white-space: =
normal; font-style: normal; word-spacing: 0px; text-transform: none; =
font-family: Helvetica; font-size: 12px; text-align: auto; color: rgb(0, =
0, 0); text-indent: 0px; line-height: normal; font-weight: normal; =
letter-spacing: normal" class=3D"apple-style-span">
                          <div style=3D"margin-top: 0px; margin-bottom: =
0px; margin-right: 0px; margin-left: 0px">
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <b style=3D"font-size: 14px; color: rgb(135, =
118, 179); font-weight: bold"><font color=3D"#8776B3" size=3D"4" class=3D"a=
pple-style-span"><br style=3D"color: rgb(135, 118, 179); font-size: 14px; =
font-weight: bold" class=3D"apple-interchange-newline">
                              Ryan Harter</font></b>                       =
     </p>
                          </div>
                          <div style=3D"margin-top: 0px; margin-bottom: =
0px; margin-right: 0px; margin-left: 0px">
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <font color=3D"#8776B3" size=3D"2" class=3D"a=
pple-style-span">UW - Stevens Point</font>                            </p>
                          </div>
                          <div style=3D"margin-top: 0px; margin-bottom: =
0px; margin-right: 0px; margin-left: 0px">
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <font color=3D"#8776B3" size=3D"2" class=3D"a=
pple-style-span">Workstation Developer</font>                            =
</p>
                          </div>
                          <div style=3D"margin-top: 0px; margin-bottom: =
0px; margin-right: 0px; margin-left: 0px">
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <font color=3D"#8776B3" size=3D"2" class=3D"a=
pple-style-span">715.346.2716</font>                            </p>
                          </div>
                          <div style=3D"margin-top: 0px; margin-bottom: =
0px; margin-right: 0px; margin-left: 0px">
<br>                             =20
                            <div style=3D"color: rgb(0, 0, 238)" class=3D"a=
pple-style-span">
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                Ryan.Harter at uwsp.edu                       =
       </p>
                            </div>
                          </div>
                        </div>
                      </div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                      <div>
                        <div>
                          <p style=3D"margin-bottom: 0; margin-top: 0">
                            On Jan 13&#44; 2009&#44; at 12:46 PM&#44; Ron =
Prue wrote:                          </p>
                        </div>
                        <p style=3D"margin-bottom: 0; margin-top: 0">
                          <br class=3D"apple-interchange-newline">
                                                  </p>
                        <blockquote type=3D"cite">
                          <div>
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              Hi all&#44;                            </p>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                <br>
                                                              </p>
                            </div>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                I am seeing an issue with my quickadd.pkg =
failing to run a &quot;post-flight script&quot; on some machines.&nbsp;&#16=
0;It is not adding the machine to my JSS and I have repaired permissions =
and run it again with the same result.&nbsp;&#160;                         =
     </p>
                            </div>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                <br>
                                                              </p>
                            </div>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                Any ideas&#63;                             =
 </p>
                            </div>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                <br>
                                                              </p>
                            </div>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                <br>
                                                              </p>
                            </div>
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <br>
                              <br>
                                                          </p>
                            <div apple-content-edited=3D"true">
                              <div style=3D"font-variant: normal; =
white-space: normal; font-style: normal; word-spacing: 0px; text-transform:=
 none; font-family: Helvetica; font-size: 12px; text-align: auto; color: =
rgb(0, 0, 0); text-indent: 0px; line-height: normal; font-weight: bold; =
letter-spacing: normal" class=3D"apple-style-span">
                                <div style=3D"font-variant: normal; =
white-space: normal; font-style: normal; word-spacing: 0px; text-transform:=
 none; font-family: Helvetica; font-size: 12px; color: rgb(0, 0, 0); =
text-indent: 0px; line-height: normal; font-weight: normal; letter-spacing:=
 normal" class=3D"apple-style-span">
                                  <div style=3D"font-variant: normal; =
white-space: normal; font-style: normal; word-spacing: 0px; text-transform:=
 none; font-family: Helvetica; font-size: 12px; color: rgb(0, 0, 0); =
text-indent: 0px; line-height: normal; font-weight: normal; letter-spacing:=
 normal" class=3D"apple-style-span">
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b>Ron Prue</b>                    =
                  </p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b>Technical Services</b>          =
                            </p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b>Noah Corporation</b>            =
                          </p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b>435.214.2927</b>                =
                      </p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b><a href=3D"mailto:ron.prue at mynoa=
hs.com">ron.prue at mynoahs.com</a></b>                                      =
</p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b><br style=3D"font-weight: =
bold">
                                        </b>                               =
       </p>
                                    </div>
                                    <div>
                                      <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                        <b><br style=3D"font-weight: bold" =
class=3D"apple-interchange-newline">
                                        </b>                               =
       </p>
                                      <div>
<br>                                         =20
                                      </div>
                                      <div>
                                        <div>
                                          <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                            &lt;Noahs Logo.png&gt;         =
                                 </p>
                                        </div>
                                      </div>
                                      <div style=3D"font-variant: normal; =
white-space: normal; font-style: normal; word-spacing: 0px; text-transform:=
 none; font-family: Helvetica; font-size: 12px; text-align: auto; color: =
rgb(0, 0, 0); text-indent: 0px; line-height: normal; font-weight: bold; =
letter-spacing: normal" class=3D"apple-style-span">
                                        <div style=3D"font-variant: =
normal; white-space: normal; font-style: normal; word-spacing: 0px; =
text-transform: none; font-family: Helvetica; font-size: 12px; color: =
rgb(0, 0, 0); text-indent: 0px; line-height: normal; font-weight: bold; =
letter-spacing: normal" class=3D"apple-style-span">
                                          <p style=3D"margin-bottom: 0; =
margin-top: 0">
                                            <br class=3D"apple-interchange-=
newline">
                                            <br class=3D"apple-interchange-=
newline">
                                            <br class=3D"apple-interchange-=
newline">
                                                                           =
           </p>
                                        </div>
                                      </div>
                                    </div>
                                  </div>
                                </div>
                              </div>
                            </div>
                            <p style=3D"margin-bottom: 0; margin-top: 0">
                              <br>
                                                          </p>
                            <div>
                              <p style=3D"margin-bottom: 0; margin-top: =
0">
                                &lt;ATT00001.txt&gt;                       =
       </p>
                            </div>
                          </div>
                        </blockquote>
                      </div>
                      <p style=3D"margin-bottom: 0; margin-top: 0">
                        <br>
                                              </p>
                    </div>
                  </div>
                </blockquote>
              </div>
              <p style=3D"margin-bottom: 0; margin-top: 0">
                <br>
                              </p>
            </div>
          </div>
        </div>
      </blockquote>
    </div>
    <p style=3D"margin-bottom: 0; margin-top: 0">
      <br>
    </p>
  </body>
</html>

--=__Part604848C1.0__=--

From ron.prue at mynoahs.com  Tue Jan 13 11:43:10 2009
From: ron.prue at mynoahs.com (Ron Prue)
Date: Tue, 13 Jan 2009 12:43:10 -0700
Subject: [Casper] Quickadd Failing
In-Reply-To: <0FA99F86-0CF9-4B9D-9806-0773C0CBAFBD@uwsp.edu>
References: <3F4D1BC4-BB83-4B7E-AEB2-C221A2DDF416@mynoahs.com>
	<61C5D69E-54E9-42E5-A95A-3B869D17724D@uwsp.edu>
	<4A4D43E3-2ED0-4EF2-84FD-A0C04EA9C85D@mynoahs.com>
	<0FA99F86-0CF9-4B9D-9806-0773C0CBAFBD@uwsp.edu>
Message-ID: <BC0D9D30-B4C5-4299-BD82-27647DD95117@mynoahs.com>

Permissions problem.  Chmod worked great.  Thanks all.


Ron Prue
Technical Services
Noah Corporation
435.214.2927
ron.prue at mynoahs.com






On Jan 13, 2009, at 12:21 PM, Ryan Harter wrote:

> chmod should work just fine.  I run a script to install a different  
> pkg that is stored on a windows machine on some clients and have it  
> run chmod +x on the scripts just incase.
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 13, 2009, at 1:19 PM, Ron Prue wrote:
>
>> Miles-
>>
>> The package was created with an admin account originally.
>>
>> Ryan-
>>
>> The permissions are indeed not correct.  No allowance for an  
>> execute command on any of the contents.  Not sure how this ever  
>> happened as I have used this accross 26 machines in the past 2  
>> months with no problem until now.  However we did do a server  
>> rebuild recently which may have reset the permission on the file.
>>
>> From your example it looks as if it should be rwx for users, group  
>> and other.  Any reason I can't just use the 'chmod' command and  
>> correct this?
>>
>>
>> Ron Prue
>> Technical Services
>> Noah Corporation
>> 435.214.2927
>> ron.prue at mynoahs.com
>>
>>
>> <Noahs Logo.png>
>>
>>
>>
>> On Jan 13, 2009, at 12:00 PM, Ryan Harter wrote:
>>
>>> Is your QuickAdd.pkg making it's way across a Windows share on  
>>> it's way to your client?  Or are you copying it using scp?
>>>
>>> I've seen some inconsistent issues with either of these methods  
>>> where some of the special data on the file will get stripped and  
>>> cause the postflight script to no longer be flagged as  
>>> executable.  I would suggest zipping (right click > "Compress") or  
>>> tarring (tar cpvf QuickAdd.pkg) the file before you transfer to be  
>>> sure.
>>>
>>> Also, on the client it is failing on, you can check that the  
>>> postflight script is executable by entering the following into a  
>>> terminal:
>>>
>>> ls -l /path/to/QuickAdd.pkg/Content/Resources/
>>>
>>> and look for  the 'x' in the left hand colomn.
>>>
>>> -rwxrwxrwx  1 rharter  UWSPDOM\domain users      97 Nov 18 17:34  
>>> postflight
>>>
>>> Hope it helps.
>>>
>>> Ryan Harter
>>> UW - Stevens Point
>>> Workstation Developer
>>> 715.346.2716
>>> Ryan.Harter at uwsp.edu
>>>
>>> On Jan 13, 2009, at 12:46 PM, Ron Prue wrote:
>>>
>>>> Hi all,
>>>>
>>>> I am seeing an issue with my quickadd.pkg failing to run a "post- 
>>>> flight script" on some machines.  It is not adding the machine to  
>>>> my JSS and I have repaired permissions and run it again with the  
>>>> same result.
>>>>
>>>> Any ideas?
>>>>
>>>>
>>>>
>>>>
>>>> Ron Prue
>>>> Technical Services
>>>> Noah Corporation
>>>> 435.214.2927
>>>> ron.prue at mynoahs.com
>>>>
>>>>
>>>> <Noahs Logo.png>
>>>>
>>>>
>>>>
>>>> <ATT00001.txt>
>>>
>>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/314b52a5/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Noahs Logo.png
Type: image/png
Size: 11936 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/314b52a5/attachment.png 

From tlarki at kckps.org  Tue Jan 13 12:12:48 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 13 Jan 2009 14:12:48 -0600
Subject: [Casper] disable ad hoc networking
Message-ID: <496CA160.7141.0039.0@kckps.org>

I am looking at just disabling the ability to create an ad hoc network.  A simple look at the given command line tools says I can't do this.  So, now I am venturing into the real of editing a plist to disable that function. 

Any pointers or suggestions? 

Thanks, 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/cec78cf8/attachment.html 

From detroye1 at apple.com  Tue Jan 13 12:19:04 2009
From: detroye1 at apple.com (John DeTroye)
Date: Tue, 13 Jan 2009 13:19:04 -0700
Subject: [Casper] disable ad hoc networking
In-Reply-To: <496CA160.7141.0039.0@kckps.org>
References: <496CA160.7141.0039.0@kckps.org>
Message-ID: <72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>

For Airport? From Terminal,  sudo /usr/libexec/airportd en1 - 
ibss_admin 1

or for remote deployment:

expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof'

johnd
-- 
John DeTroye                        Email: johnd at apple.com
Sr. Consulting Engineer         Systems Management Specialist
Apple - Education                   iChat: johnd at mac.com
Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
Tips and Tricks Docs - http://web.me.com/johnd/
--

On Jan 13, 2009, at 1:12 PM, Thomas Larkin wrote:

> I am looking at just disabling the ability to create an ad hoc  
> network.  A simple look at the given command line tools says I can't  
> do this.  So, now I am venturing into the real of editing a plist to  
> disable that function.
>
> Any pointers or suggestions?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/51bc75a1/attachment.htm 

From miles.leacy at themacadmin.com  Tue Jan 13 12:55:25 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 13 Jan 2009 15:55:25 -0500
Subject: [Casper] disable ad hoc networking
In-Reply-To: <72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>
References: <496CA160.7141.0039.0@kckps.org>
	<72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>
Message-ID: <ec2e75ff0901131255q78cad941v1ae8fcbb12fcf1d8@mail.gmail.com>

Thanks!  Could you explain what the "-ibss_admin" switch means? How would
this be undone if you needed to?
If your airport interface is not "en1", would you need to discover the
correct value and substitute it in the command? Isn't airport en2 on Mac
Pros and en0 on MacBook Airs?

Such as:
airport_interface=`system_profiler SPNetworkDataType| grep -A 1 "Hardware:
AirPort"` airport_interface=${airport_interface: -3}

expect -c 'spawn /usr/libexec/airportd $airport_interface -ibss_admin 1;
expect eof'


Thanks again for the great info!

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/13 John DeTroye <detroye1 at apple.com>

> For Airport? From Terminal,  sudo /usr/libexec/airportd en1 -ibss_admin 1
> or for remote deployment:
> expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof'
>
> johnd
>     --
> John DeTroye                        Email: johnd at apple.com
> Sr. Consulting Engineer         Systems Management Specialist
> Apple - Education                   iChat: johnd at mac.com
> Systems Management Guide - http://www.apple.com/education/go/sysmgmt/
> Tips and Tricks Docs - http://web.me.com/johnd/
> --
>
> On Jan 13, 2009, at 1:12 PM, Thomas Larkin wrote:
>
> I am looking at just disabling the ability to create an ad hoc network.  A
> simple look at the given command line tools says I can't do this.  So, now I
> am venturing into the real of editing a plist to disable that function.
>
> Any pointers or suggestions?
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/fe98712d/attachment.html 

From ERNSTCS at uwec.edu  Tue Jan 13 12:59:25 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Tue, 13 Jan 2009 14:59:25 -0600
Subject: [Casper] disable ad hoc networking
In-Reply-To: <ec2e75ff0901131255q78cad941v1ae8fcbb12fcf1d8@mail.gmail.com>
Message-ID: <C5925CCD.127C0%ernstcs@uwec.edu>

My guess...in the world of bits...

ibss_admin 0

;)

Craig E


On 1/13/09 2:55 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

Thanks!  Could you explain what the "-ibss_admin" switch means?  How would this be undone if you needed to?

If your airport interface is not "en1", would you need to discover the correct value and substitute it in the command?  Isn't airport en2 on Mac Pros and en0 on MacBook Airs?

Such as:
airport_interface=`system_profiler SPNetworkDataType| grep -A 1 "Hardware: AirPort"` airport_interface=${airport_interface: -3}

expect -c 'spawn /usr/libexec/airportd $airport_interface -ibss_admin 1; expect eof'


Thanks again for the great info!

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




2009/1/13 John DeTroye <detroye1 at apple.com>
For Airport? From Terminal,  sudo /usr/libexec/airportd en1 -ibss_admin 1

or for remote deployment:

expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof'

johnd

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/2d0f509f/attachment.htm 

From tlarki at kckps.org  Tue Jan 13 13:05:36 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 13 Jan 2009 15:05:36 -0600
Subject: [Casper] disable ad hoc networking
In-Reply-To: <72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>
References: <496CA160.7141.0039.0@kckps.org>
	<72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>
Message-ID: <496CADC0.7141.0039.0@kckps.org>

Awesome! 

OK, so what file does this actually write to?  I am thinking a one liner casper policy should suffice for this 

Thanks,


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> John DeTroye <detroye1 at apple.com> 01/13/09 2:19 PM >>>
For Airport? From Terminal,   
sudo /usr/libexec/airportd en1 -ibss_admin 1  



or for remote deployment: 



expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof' 





johnd

--  

John DeTroye                        Email: johnd at apple.com 

Sr. Consulting Engineer         
  

Systems Management Specialist 

Apple - Education                   iChat: johnd at mac.com 

Systems Management Guide - http://www.apple.com/education/go/sysmgmt/ 

Tips and Tricks Docs - http://web.me.com/johnd/ 

-- 



On Jan 13, 2009, at 1:12 PM, Thomas Larkin wrote: 




I am looking at just disabling the ability to create an ad hoc network.  A simple look at the given command line tools says I can't do this.  So, now I am venturing into the real of editing a plist to disable that function. 



Any pointers or suggestions? 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/d7ecf304/attachment.html 

From tlarki at kckps.org  Tue Jan 13 13:28:35 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 13 Jan 2009 15:28:35 -0600
Subject: [Casper] disable ad hoc networking
In-Reply-To: <C5925CCD.127C0%ernstcs@uwec.edu>
References: <ec2e75ff0901131255q78cad941v1ae8fcbb12fcf1d8@mail.gmail.com>
	<C5925CCD.127C0%ernstcs@uwec.edu>
Message-ID: <496CB323.7141.0039.0@kckps.org>

Craig, if I were a betting man, I'd bet you are most likely right 

looking at the airportd daemon I want to know what other commands I can
use with it.  The man page is seriously lacking.  In fact it doesn't
display any information.  I will search the Apple White pages and see if
I can come up with something else, but the documentation is really light
on this. 

Thanks,

>>> "Ernst, Craig S." <ERNSTCS at uwec.edu> 01/13/09 2:59 PM >>>

My guess...in the world of bits...

ibss_admin 0

;)

Craig E


On 1/13/09 2:55 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:


Thanks!  Could you explain what the "-ibss_admin" switch means?  How
would this be undone if you needed to?

If your airport interface is not "en1", would you need to discover the
correct value and substitute it in the command?  Isn't airport en2 on
Mac Pros and en0 on MacBook Airs?

Such as:
airport_interface=`system_profiler SPNetworkDataType| grep -A 1
"Hardware: AirPort"` airport_interface=${airport_interface: -3}

expect -c 'spawn /usr/libexec/airportd $airport_interface -ibss_admin 1;
expect eof'


Thanks again for the great info!

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




2009/1/13 John DeTroye <detroye1 at apple.com>

For Airport? From Terminal,  sudo /usr/libexec/airportd en1 -ibss_admin
1

or for remote deployment:

expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof'

johnd
  



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/a14abac4/attachment.html 

From eanderson at mitty.com  Tue Jan 13 14:32:05 2009
From: eanderson at mitty.com (Eric Anderson)
Date: Tue, 13 Jan 2009 14:32:05 -0800
Subject: [Casper] MS Office 2008 configuration
In-Reply-To: <ec2e75ff0901131052m33b5adfcs5570cacef80defc1@mail.gmail.com>
References: <ec2e75ff0901130936y74dc03c2h6679ddfbf9005a20@mail.gmail.com>
	<C5923591.7E35%john_wetter@hopkins.k12.mn.us>
	<ec2e75ff0901131052m33b5adfcs5570cacef80defc1@mail.gmail.com>
Message-ID: <76d2eca30901131432m3975ae7amdbdedf67cb26d98a@mail.gmail.com>

Since I have network home directories on multiple servers, I added
"$HOME/Library/Preferences/" in front of each com.microsoft. That took care
of the fact that home folder paths were different depending on the user.
Eric Anderson
Director of Information Technology
Archbishop Mitty High School
408-342-4240 (Direct)

2009/1/13 Miles Leacy <miles.leacy at themacadmin.com>

> This is in re: to my script that sets the default save formats in MS Office
> 2008 apps to .doc, .xls, and .ppt in order to avoid any file compatibility
> issues with systems that are not up to date on their Office versions.  I
> will paste in the original script at the end of this message.
>
> I'm taking this on-list in case anyone else needs this info.  The issue
> turns out to be that I didn't test this fully, and I was, in fact, managing
> these preferences via Open Directory and MCX.
> The commands are sound, but as John Wetter found in testing, they're being
> run by root, so they are not setting the preferences for the user in
> question.  The script functions properly if you run it as the user in
> question.
>
> I see a couple of options to fix this...
>
> 1. Use the script with the full paths to the user's plists, then add a
> chown command to the end of the script to return ownership to the user.  To
> do this:
>
> - Insert "/Users/$3/Library/Preferences/" in front of each of the
> "com.microsoft" preference domains in the script.
> - add the following line to the end of the script:
> chown $3 /Users/$3/Library/Preferences/com.microsoft*
>
> 2. Write the plist to /Library/Preferences instead of ~/Library/Preferences
> and grant read permissions to everyone.  I like this best since you'll only
> have to do it once per computer, rather than once per user.  To do this:
>
> - Insert "/Library/Preferences/" in front of each of the "com.microsoft"
> preference domains in the script.
> - Add the following line to the end of the script:
> chmod a+r /Users/$3/Library/Preferences/com.microsoft*
>
> 2. If you have Open Directory in place, open the Preferences Details pane
> in Workgroup Manager, add the Office apps to the list and set the preference
> values within Workgroup manager.
>
> 3. Use dscl to manage MCX settings in the local directory service.
>
> 4. I haven't tried this, and it may not work because I think it generates a
> new shell which could cause problems, but you might try adding `su $3` to
> the beginning of the script to have the commands executed as the correct
> user.
>
> Here's the original script:
>
> #!/bin/bash
>
> # scr_app_office2008FileFormats.bash
> #
> # Set Office 2008 apps to save in .doc, .xls. .ppt rather than docx, etc.
> #
> # Written by Miles A. Leacy IV
> # Last modified 20080612
>
> # Word
> defaults write com.microsoft.Word 2008\\Default\ Save\\Default\ Format
> -string Doc97
>
> # Excel
> defaults write com.microsoft.Excel 2008\\Default\ Save\\Default\ Format
> -int 57
>
> # Powerpoint
> defaults write com.microsoft.Powerpoint 2008\\Default\ Save\\Default\
> Save\\Default\ Format -string Microsoft\ PowerPoint\ 98\ Presentation
>
> exit 0
>
> ### end script
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/462d88e3/attachment.html 

From rharter at uwsp.edu  Tue Jan 13 15:54:32 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Tue, 13 Jan 2009 17:54:32 -0600
Subject: [Casper] Changing default save format in Office 2008 (regarding Re:
	MS Office 2008 configuration)
Message-ID: <F09E927E-66F2-4F76-AFB5-55F63FAE5CF9@uwsp.edu>

I have some thoughts about changing the default save format for Office  
2008 and just wanted to see what other people think.

I've decided to leave the default format for Office 2008 as openxml  
(docx, etc).  I decided that the more openxml documents are floating  
around, the better, since it will force people who might not have  
Office 2008 to download the free converter.  This way, they will be  
able to open all document types and I feel that they will be less  
confused when the time comes, inevitably, that they will receive  
office 2008 documents.

I've put together mass mailings (UWSP Message of the Day) stating that  
if you can't open a document that there is a new tool that I've  
deployed that will allow you to convert it.  And since we have a  
campus wide license for Office 2008, if anyone still has Office 2004  
and doesn't want to deal with conversions, they should contact me so I  
can push Office 2008 to their machines.

I think that having one standard file type for documents is the ideal  
solution, and that OpenXML documents are an inevitable switch.  In my  
opinion, trying to fend off OpenXML will only perpetuate the confusion  
of having two different file types, and I think, in my situation, that  
embracing that change will make things easier in the long run.

I have to say that since we deployed Office 2008 last spring/summer,  
having left the default file type as Office 2008, I haven't heard any  
complaints or questions about handling the file types.  Granted, I  
don't work first tier support, so they were probably all fended off at  
the help desk.

I'm not trying to say that a plan to change the default file type is a  
bad one.  And I know that every environment is different.  I'm just  
curious to hear what other people, many of which probably have more  
experience than me in this field, think about this topic.  I'm always  
interested in good discussions.



Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/f5924a17/attachment.htm 

From miles.leacy at themacadmin.com  Tue Jan 13 16:23:35 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 13 Jan 2009 19:23:35 -0500
Subject: [Casper] Changing default save format in Office 2008 (regarding
	Re: MS Office 2008 configuration)
In-Reply-To: <F09E927E-66F2-4F76-AFB5-55F63FAE5CF9@uwsp.edu>
References: <F09E927E-66F2-4F76-AFB5-55F63FAE5CF9@uwsp.edu>
Message-ID: <ec2e75ff0901131623l17134adfkaa0952b639033205@mail.gmail.com>

I completely agree with your points, but I don't trust users to act in, or
even know what is in, their best interests.
For clarification, using the older office file formats as defaults isn't an
effort to resist change.  It's an effort to reduce calls of "Bob sent me the
critically-important document for the big meeting and the stupid computer
you gave me couldn't open it, so we lost the account/the paper was
late/we're going out of business."

Once everyone (or at least a clear majority, including all VIPs) is using MS
Office 2008 for Mac, 2007 for Windows or Open Office, then I'll recommend
defaulting to OpenXML.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/13 Ryan Harter <rharter at uwsp.edu>

> I have some thoughts about changing the default save format for Office 2008
> and just wanted to see what other people think.
> I've decided to leave the default format for Office 2008 as openxml (docx,
> etc).  I decided that the more openxml documents are floating around, the
> better, since it will force people who might not have Office 2008 to
> download the free converter.  This way, they will be able to open all
> document types and I feel that they will be less confused when the time
> comes, inevitably, that they will receive office 2008 documents.
>
> I've put together mass mailings (UWSP Message of the Day) stating that if
> you can't open a document that there is a new tool that I've deployed that
> will allow you to convert it.  And since we have a campus wide license for
> Office 2008, if anyone still has Office 2004 and doesn't want to deal with
> conversions, they should contact me so I can push Office 2008 to their
> machines.
>
> I think that having one standard file type for documents is the ideal
> solution, and that OpenXML documents are an inevitable switch.  In my
> opinion, trying to fend off OpenXML will only perpetuate the confusion of
> having two different file types, and I think, in my situation, that
> embracing that change will make things easier in the long run.
>
> I have to say that since we deployed Office 2008 last spring/summer, having
> left the default file type as Office 2008, I haven't heard any complaints or
> questions about handling the file types.  Granted, I don't work first tier
> support, so they were probably all fended off at the help desk.
>
> I'm not trying to say that a plan to change the default file type is a bad
> one.  And I know that every environment is different.  I'm just curious to
> hear what other people, many of which probably have more experience than me
> in this field, think about this topic.  I'm always interested in good
> discussions.
>
>
> *
> Ryan Harter*
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/f6225ac6/attachment.htm 

From Ryan.Harter at uwsp.edu  Tue Jan 13 16:29:38 2009
From: Ryan.Harter at uwsp.edu (Ryan Harter)
Date: Tue, 13 Jan 2009 18:29:38 -0600
Subject: [Casper] Changing default save format in Office 2008 (regarding
	Re: MS Office 2008 configuration)
In-Reply-To: <ec2e75ff0901131623l17134adfkaa0952b639033205@mail.gmail.com>
References: <F09E927E-66F2-4F76-AFB5-55F63FAE5CF9@uwsp.edu>
	<ec2e75ff0901131623l17134adfkaa0952b639033205@mail.gmail.com>
Message-ID: <2E3E30F2-6F6B-42BC-93D4-22E9B87D0119@uwsp.edu>

I think that makes sense.  In our situation we ran a fairly successful  
effort to get everyone up to 07/08 last summer, so I don't really have  
to worry about that as much, granted I'm still doing the upgrades  
(just did one yesterday, and another today).

My attitude to this issue was to make sure that the converter was my  
top priority when 08 came out, then once that was deployed I made my  
best effort to inform everyone that it was there and how to use it.   
Not to sound cold, but from that point on it was their  
responsibility.  Of course we still offer support if someone needs  
help using the converter, but I made it clear that we provide the  
tools, and whether you use them or not is up to you.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 13, 2009, at 6:23 PM, Miles Leacy wrote:

> I completely agree with your points, but I don't trust users to act  
> in, or even know what is in, their best interests.
>
> For clarification, using the older office file formats as defaults  
> isn't an effort to resist change.  It's an effort to reduce calls of  
> "Bob sent me the critically-important document for the big meeting  
> and the stupid computer you gave me couldn't open it, so we lost the  
> account/the paper was late/we're going out of business."
>
> Once everyone (or at least a clear majority, including all VIPs) is  
> using MS Office 2008 for Mac, 2007 for Windows or Open Office, then  
> I'll recommend defaulting to OpenXML.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/13 Ryan Harter <rharter at uwsp.edu>
> I have some thoughts about changing the default save format for  
> Office 2008 and just wanted to see what other people think.
>
> I've decided to leave the default format for Office 2008 as openxml  
> (docx, etc).  I decided that the more openxml documents are floating  
> around, the better, since it will force people who might not have  
> Office 2008 to download the free converter.  This way, they will be  
> able to open all document types and I feel that they will be less  
> confused when the time comes, inevitably, that they will receive  
> office 2008 documents.
>
> I've put together mass mailings (UWSP Message of the Day) stating  
> that if you can't open a document that there is a new tool that I've  
> deployed that will allow you to convert it.  And since we have a  
> campus wide license for Office 2008, if anyone still has Office 2004  
> and doesn't want to deal with conversions, they should contact me so  
> I can push Office 2008 to their machines.
>
> I think that having one standard file type for documents is the  
> ideal solution, and that OpenXML documents are an inevitable  
> switch.  In my opinion, trying to fend off OpenXML will only  
> perpetuate the confusion of having two different file types, and I  
> think, in my situation, that embracing that change will make things  
> easier in the long run.
>
> I have to say that since we deployed Office 2008 last spring/summer,  
> having left the default file type as Office 2008, I haven't heard  
> any complaints or questions about handling the file types.  Granted,  
> I don't work first tier support, so they were probably all fended  
> off at the help desk.
>
> I'm not trying to say that a plan to change the default file type is  
> a bad one.  And I know that every environment is different.  I'm  
> just curious to hear what other people, many of which probably have  
> more experience than me in this field, think about this topic.  I'm  
> always interested in good discussions.
>
>
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090113/54cba56e/attachment.html 

From tlarki at kckps.org  Wed Jan 14 06:41:12 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 14 Jan 2009 08:41:12 -0600
Subject: [Casper] disable ad hoc networking
In-Reply-To: <ec2e75ff0901131255q78cad941v1ae8fcbb12fcf1d8@mail.gmail.com>
References: <496CA160.7141.0039.0@kckps.org>
	<72547DC1-3CC1-4CCB-BB31-E1D0849F9B5A@apple.com>
	<ec2e75ff0901131255q78cad941v1ae8fcbb12fcf1d8@mail.gmail.com>
Message-ID: <496DA528.7141.0039.0@kckps.org>

After testing out that command it seems all it does is just require
admin rights to create ad hoc networks.  So if you don't have admin
rights you can't create them. 

Nifty

>>> "Miles Leacy" <miles.leacy at themacadmin.com> 01/13/09 2:55 PM >>>
Thanks!  Could you explain what the " 
-ibss_admin" switch means? How would this be undone if you needed to? 



If your airport interface is not "en1", would you need to discover the
correct value and substitute it in the command? Isn't airport en2 on Mac
Pros and en0 on MacBook Airs? 



Such as: 


airport_interface=`system_profiler SPNetworkDataType| grep -A 1
"Hardware: AirPort"` airport_interface=${airport_interface: -3}



expect -c 'spawn /usr/libexec/airportd $ 
airport_interface 
 -ibss_admin 1; expect eof' 





Thanks again for the great info! 


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/13 John DeTroye 
<detroye1 at apple.com> 




For Airport? From Terminal,   
sudo /usr/libexec/airportd en1 -ibss_admin 1  



or for remote deployment: 



expect -c 'spawn /usr/libexec/airportd en1 -ibss_admin 1; expect eof' 





johnd

--  

John DeTroye                        Email: johnd at apple.com 

Sr. Consulting Engineer         

  

Systems Management Specialist 

Apple - Education                   iChat: johnd at mac.com 

Systems Management Guide - http://www.apple.com/education/go/sysmgmt/ 

Tips and Tricks Docs - http://web.me.com/johnd/ 

-- 



On Jan 13, 2009, at 1:12 PM, Thomas Larkin wrote: 




I am looking at just disabling the ability to create an ad hoc network. 
A simple look at the given command line tools says I can't do this.  So,
now I am venturing into the real of editing a plist to disable that
function. 



Any pointers or suggestions? 




_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/4f7f75c5/attachment.html 

From rharter at uwsp.edu  Wed Jan 14 08:38:48 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 14 Jan 2009 10:38:48 -0600
Subject: [Casper] Can't drag items on desktop.
Message-ID: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>

Hey all-

I just imaged a machine with our standard build.  There's nothing  
unusual about it.  After the image I installed CS4 Design suite and  
Quark 8 from DVD.

Now, for some reason, whenever the user logs in the items on her  
desktop are un-draggable.  All of the permissions are correct.  I  
double checked this by opening the Terminal in her account and cp'ing  
a file from her desktop to another folder that she is unable to do  
through the gui.  This works fine under her account from the Terminal,  
but the GUI doesn't work.

Now one of the really strange things about this is that the GUI  
doesn't respond like it doesn't have permissions to the file or  
desktop.  She can select the icon and it highlights, she can right  
click it and get info, or compress it and it will create the zip  
archive right next to it on the desktop.  But when she attempts to  
drag the icon, normally the icon turns translucent and follows the  
mouse, but this is not the case in this instance.  It highlights the  
icon but the icon doesn't move.

This is a weird issue that I've never come across before.  Does anyone  
have any clue why this might be happening?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/b68966dd/attachment.htm 

From eric.winkelhake at mundocomww.com  Wed Jan 14 08:43:05 2009
From: eric.winkelhake at mundocomww.com (Eric Winkelhake)
Date: Wed, 14 Jan 2009 10:43:05 -0600
Subject: [Casper] Can't drag items on desktop.
In-Reply-To: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>
Message-ID: <OF24552619.DC5EA3DA-ON8625753E.005BC0D9-8625753E.005BD5D5@lionresources.com>

quick guess.....check the settings in universal access, that always causes 
crazy problems.

Eric Winkelhake
MundocomWW
312.220.1669
312.504.5155
eric.winkelhake at mundocomww.com



Ryan Harter <rharter at uwsp.edu> 
Sent by: casper-bounces at list.jamfsoftware.com
01/14/09 10:39 AM

To
Apple - WI-Edu <wi-edu at lists.apple.com>, List Casper 
<casper at list.jamfsoftware.com>, Keith Mountin <mountin at apple.com>
cc

Subject
[Casper] Can't drag items on desktop.






Hey all-

I just imaged a machine with our standard build.  There's nothing unusual 
about it.  After the image I installed CS4 Design suite and Quark 8 from 
DVD. 

Now, for some reason, whenever the user logs in the items on her desktop 
are un-draggable.  All of the permissions are correct.  I double checked 
this by opening the Terminal in her account and cp'ing a file from her 
desktop to another folder that she is unable to do through the gui.  This 
works fine under her account from the Terminal, but the GUI doesn't work.

Now one of the really strange things about this is that the GUI doesn't 
respond like it doesn't have permissions to the file or desktop.  She can 
select the icon and it highlights, she can right click it and get info, or 
compress it and it will create the zip archive right next to it on the 
desktop.  But when she attempts to drag the icon, normally the icon turns 
translucent and follows the mouse, but this is not the case in this 
instance.  It highlights the icon but the icon doesn't move.

This is a weird issue that I've never come across before.  Does anyone 
have any clue why this might be happening?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


------------------------------------------------------------------------
Disclaimer 
The information in this email and any attachments may contain proprietary and confidential information that is intended for the addressee(s) only. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or use of the contents of this information is prohibited.  When addressed to our clients or vendors, any information contained in this e-mail or any attachments is subject to the terms and conditions in any governing contract. If you have received this e-mail in error, please immediately contact the sender and delete the e-mail.
------------------------------------------------------------------------
Mundocom UK Limited, Registered in England and Wales. Registration Number 2882166. Registered Office: Warwick Building, Kensington Village, Avonmore Road, London W14 8HQ.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/fd6f9c2d/attachment.html 

From miles.leacy at themacadmin.com  Wed Jan 14 08:44:08 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 14 Jan 2009 11:44:08 -0500
Subject: [Casper] Can't drag items on desktop.
In-Reply-To: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>
References: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>
Message-ID: <ec2e75ff0901140844k2f459a27hc859418736941a93@mail.gmail.com>

That's very odd.  To help troubleshoot, I have a few questions...
What's in your imaging log?
What's in your configuration (packages, scripts)?
What was in the "plan" of your imaging task ("Show Plan" button in Casper
Imaging)?
Are any other user accounts affected by this?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/14 Ryan Harter <rharter at uwsp.edu>

> Hey all-
> I just imaged a machine with our standard build.  There's nothing unusual
> about it.  After the image I installed CS4 Design suite and Quark 8 from
> DVD.
>
> Now, for some reason, whenever the user logs in the items on her desktop
> are un-draggable.  All of the permissions are correct.  I double checked
> this by opening the Terminal in her account and cp'ing a file from her
> desktop to another folder that she is unable to do through the gui.  This
> works fine under her account from the Terminal, but the GUI doesn't work.
>
> Now one of the really strange things about this is that the GUI doesn't
> respond like it doesn't have permissions to the file or desktop.  She can
> select the icon and it highlights, she can right click it and get info, or
> compress it and it will create the zip archive right next to it on the
> desktop.  But when she attempts to drag the icon, normally the icon
> turns translucent and follows the mouse, but this is not the case in this
> instance.  It highlights the icon but the icon doesn't move.
>
> This is a weird issue that I've never come across before.  Does anyone have
> any clue why this might be happening?
> *
> Ryan Harter*
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/23b7d0b8/attachment.htm 

From rharter at uwsp.edu  Wed Jan 14 08:59:56 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 14 Jan 2009 10:59:56 -0600
Subject: [Casper] Can't drag items on desktop.
In-Reply-To: <ec2e75ff0901140844k2f459a27hc859418736941a93@mail.gmail.com>
References: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>
	<ec2e75ff0901140844k2f459a27hc859418736941a93@mail.gmail.com>
Message-ID: <2CC142D8-BB63-44EA-9133-BB5456D94B7B@uwsp.edu>

Here is my install log:

###############################################################
Formatted Macintosh HD on 1/13/09 at 1:47 PM
###############################################################



2009-1-13 13:56:12 Performed Block Copy of 10.5.6 Base 17122008.dmg
Tue Jan 13 13:56:13 adm's MacBook jamf[429]: Installing Acrobat Reader  
9 Intel.dmg...
Tue Jan 13 13:56:55 adm's MacBook jamf[511]: Installing Admit Mac  
4.1.3.dmg...
Tue Jan 13 13:57:07 adm's MacBook jamf[578]: Installing Endnote  
X1.1.dmg...
Tue Jan 13 13:57:42 adm's MacBook jamf[657]: Installing Energy  
Prefs.dmg...
Tue Jan 13 13:57:45 adm's MacBook jamf[724]: Installing FAP.4.0.2- 
plugins-080813.dmg...
Tue Jan 13 13:59:53 adm's MacBook jamf[807]: Installing Firefox.dmg...
Tue Jan 13 14:00:02 adm's MacBook jamf[883]: Installing Flash  
Player.dmg...
Tue Jan 13 14:00:05 adm's MacBook jamf[949]: Installing Flip4Mac  
2.2.dmg...
Tue Jan 13 14:00:13 adm's MacBook jamf[1025]: Installing K2 Client  
6.1.4.1.dmg...
Tue Jan 13 14:00:16 adm's MacBook jamf[1091]: Installing MS Office  
2008 SP1.dmg...
Tue Jan 13 14:03:43 adm's MacBook jamf[1181]: Installing NSNotify 1.02  
31102008.dmg...
Tue Jan 13 14:03:46 adm's MacBook jamf[1248]: Installing RDC 2.0.dmg...
Tue Jan 13 14:03:53 adm's MacBook jamf[1313]: Installing RealPlayer  
11.dmg...
Tue Jan 13 14:04:05 adm's MacBook jamf[1391]: Installing Self  
Service.dmg...
Tue Jan 13 14:04:10 adm's MacBook jamf[1456]: Installing Stuffit  
Expander 2009.dmg...
Tue Jan 13 14:04:16 adm's MacBook jamf[1523]: Set Computer Name to  
mkstedl
Tue Jan 13 14:04:16 adm's MacBook jamf[1548]: Created /private/etc/ 
jamf.conf.

You can also see my packages.  There's nothing unusual in there.

I'll check when she goes out to lunch if it happens with other  
accounts.  I can't believe I forgot to try that!

There are two scripts that we run at login that mount some shares, but  
those are running all over campus and don't seem to effect anyone else.

Thanks

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 14, 2009, at 10:44 AM, Miles Leacy wrote:

> That's very odd.  To help troubleshoot, I have a few questions...
>
> What's in your imaging log?
> What's in your configuration (packages, scripts)?
> What was in the "plan" of your imaging task ("Show Plan" button in  
> Casper Imaging)?
> Are any other user accounts affected by this?
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/14 Ryan Harter <rharter at uwsp.edu>
> Hey all-
>
> I just imaged a machine with our standard build.  There's nothing  
> unusual about it.  After the image I installed CS4 Design suite and  
> Quark 8 from DVD.
>
> Now, for some reason, whenever the user logs in the items on her  
> desktop are un-draggable.  All of the permissions are correct.  I  
> double checked this by opening the Terminal in her account and  
> cp'ing a file from her desktop to another folder that she is unable  
> to do through the gui.  This works fine under her account from the  
> Terminal, but the GUI doesn't work.
>
> Now one of the really strange things about this is that the GUI  
> doesn't respond like it doesn't have permissions to the file or  
> desktop.  She can select the icon and it highlights, she can right  
> click it and get info, or compress it and it will create the zip  
> archive right next to it on the desktop.  But when she attempts to  
> drag the icon, normally the icon turns translucent and follows the  
> mouse, but this is not the case in this instance.  It highlights the  
> icon but the icon doesn't move.
>
> This is a weird issue that I've never come across before.  Does  
> anyone have any clue why this might be happening?
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/70c6f4e9/attachment.html 

From miles.leacy at themacadmin.com  Wed Jan 14 09:05:39 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 14 Jan 2009 12:05:39 -0500
Subject: [Casper] Can't drag items on desktop.
In-Reply-To: <2CC142D8-BB63-44EA-9133-BB5456D94B7B@uwsp.edu>
References: <96E09471-3687-4DC4-B206-48DF6495A959@uwsp.edu>
	<ec2e75ff0901140844k2f459a27hc859418736941a93@mail.gmail.com>
	<2CC142D8-BB63-44EA-9133-BB5456D94B7B@uwsp.edu>
Message-ID: <ec2e75ff0901140905j179cd185ya440d21af0d0d00a@mail.gmail.com>

Assuming it's not just this one account that's broken, let's identify the
variables between deployments that work and this one.
Are any of your packages new?
Is this the first client to receive CS4 and Quark 8?  How were these apps
installed?
What scripts, if any, are part of the configuration and/or imaging task used
on this machine?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 14, 2009 at 11:59 AM, Ryan Harter <rharter at uwsp.edu> wrote:

> Here is my install log:
> ###############################################################
> Formatted Macintosh HD on 1/13/09 at 1:47 PM
> ###############################################################
>
>
>
> 2009-1-13 13:56:12 Performed Block Copy of 10.5.6 Base 17122008.dmg
> Tue Jan 13 13:56:13 adm's MacBook jamf[429]: Installing Acrobat Reader 9
> Intel.dmg...
> Tue Jan 13 13:56:55 adm's MacBook jamf[511]: Installing Admit Mac
> 4.1.3.dmg...
> Tue Jan 13 13:57:07 adm's MacBook jamf[578]: Installing Endnote X1.1.dmg...
> Tue Jan 13 13:57:42 adm's MacBook jamf[657]: Installing Energy Prefs.dmg...
> Tue Jan 13 13:57:45 adm's MacBook jamf[724]: Installing
> FAP.4.0.2-plugins-080813.dmg...
> Tue Jan 13 13:59:53 adm's MacBook jamf[807]: Installing Firefox.dmg...
> Tue Jan 13 14:00:02 adm's MacBook jamf[883]: Installing Flash Player.dmg...
> Tue Jan 13 14:00:05 adm's MacBook jamf[949]: Installing Flip4Mac 2.2.dmg...
> Tue Jan 13 14:00:13 adm's MacBook jamf[1025]: Installing K2 Client
> 6.1.4.1.dmg...
> Tue Jan 13 14:00:16 adm's MacBook jamf[1091]: Installing MS Office 2008
> SP1.dmg...
> Tue Jan 13 14:03:43 adm's MacBook jamf[1181]: Installing NSNotify 1.02
> 31102008.dmg...
> Tue Jan 13 14:03:46 adm's MacBook jamf[1248]: Installing RDC 2.0.dmg...
> Tue Jan 13 14:03:53 adm's MacBook jamf[1313]: Installing RealPlayer
> 11.dmg...
> Tue Jan 13 14:04:05 adm's MacBook jamf[1391]: Installing Self
> Service.dmg...
> Tue Jan 13 14:04:10 adm's MacBook jamf[1456]: Installing Stuffit Expander
> 2009.dmg...
> Tue Jan 13 14:04:16 adm's MacBook jamf[1523]: Set Computer Name to mkstedl
> Tue Jan 13 14:04:16 adm's MacBook jamf[1548]: Created
> /private/etc/jamf.conf.
>
> You can also see my packages.  There's nothing unusual in there.
>
> I'll check when she goes out to lunch if it happens with other accounts.  I
> can't believe I forgot to try that!
>
> There are two scripts that we run at login that mount some shares, but
> those are running all over campus and don't seem to effect anyone else.
>
> Thanks
> *
> Ryan Harter*
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 14, 2009, at 10:44 AM, Miles Leacy wrote:
>
> That's very odd.  To help troubleshoot, I have a few questions...
> What's in your imaging log?
> What's in your configuration (packages, scripts)?
> What was in the "plan" of your imaging task ("Show Plan" button in Casper
> Imaging)?
> Are any other user accounts affected by this?
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> 2009/1/14 Ryan Harter <rharter at uwsp.edu>
>
>> Hey all-
>> I just imaged a machine with our standard build.  There's nothing unusual
>> about it.  After the image I installed CS4 Design suite and Quark 8 from
>> DVD.
>>
>> Now, for some reason, whenever the user logs in the items on her desktop
>> are un-draggable.  All of the permissions are correct.  I double checked
>> this by opening the Terminal in her account and cp'ing a file from her
>> desktop to another folder that she is unable to do through the gui.  This
>> works fine under her account from the Terminal, but the GUI doesn't work.
>>
>> Now one of the really strange things about this is that the GUI doesn't
>> respond like it doesn't have permissions to the file or desktop.  She can
>> select the icon and it highlights, she can right click it and get info, or
>> compress it and it will create the zip archive right next to it on the
>> desktop.  But when she attempts to drag the icon, normally the icon
>> turns translucent and follows the mouse, but this is not the case in this
>> instance.  It highlights the icon but the icon doesn't move.
>>
>> This is a weird issue that I've never come across before.  Does anyone
>> have any clue why this might be happening?
>>  *
>> Ryan Harter*
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/b2c28dd4/attachment.htm 

From rharter at uwsp.edu  Wed Jan 14 09:47:46 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 14 Jan 2009 11:47:46 -0600
Subject: [Casper] Can't drag items on desktop.
In-Reply-To: <C5937848.2ADD%jonah@jamfsoftware.com>
References: <C5937848.2ADD%jonah@jamfsoftware.com>
Message-ID: <11BD9E3D-0C81-4248-B3FC-DFC62B0ED3AF@uwsp.edu>

Turns out this was the problem.  I deleted the .DS_Store file in the  
user's desktop, when she logged out and back in the problem was gone.

Thanks to Jonah Klevesahl at Jamf for this one!

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 14, 2009, at 11:08 AM, Jonah Klevesahl wrote:

> Hey Ryan,
>
> I ran into this issue once before after installing an app where drag- 
> copy
> wouldn't work, but terminal copy would and it was the result of a  
> corrupted
> .DS_Store file in /Users/username/Desktop. Might be worth a shot?
>
> ...............................................................
> Jonah Klevesahl
> Systems Engineer
> ...............................................................
> JAMF Software
> 1011 Washington Ave Suite 350
> Minneapolis, MN 55415
> ...............................................................
> Office     (612) 605-6625
> Mobile    (612) 801-6275
> Support  (612) 216-1296
>
>
>
>> From: Ryan Harter <rharter at uwsp.edu>
>> Date: Wed, 14 Jan 2009 08:38:48 -0800
>> To: Apple - WI-Edu <wi-edu at lists.apple.com>, List Casper
>> <casper at list.jamfsoftware.com>, Keith Mountin <mountin at apple.com>
>> Subject: [Casper] Can't drag items on desktop.
>>
>> Hey all-
>>
>> I just imaged a machine with our standard build.  There's nothing  
>> unusual
>> about it.  After the image I installed CS4 Design suite and Quark 8  
>> from DVD.
>>
>> Now, for some reason, whenever the user logs in the items on her  
>> desktop are
>> un-draggable.  All of the permissions are correct.  I double  
>> checked this by
>> opening the Terminal in her account and cp'ing a file from her  
>> desktop to
>> another folder that she is unable to do through the gui.  This  
>> works fine
>> under her account from the Terminal, but the GUI doesn't work.
>>
>> Now one of the really strange things about this is that the GUI  
>> doesn't
>> respond like it doesn't have permissions to the file or desktop.   
>> She can
>> select the icon and it highlights, she can right click it and get  
>> info, or
>> compress it and it will create the zip archive right next to it on  
>> the
>> desktop.  But when she attempts to drag the icon, normally the icon  
>> turns
>> translucent and follows the mouse, but this is not the case in this  
>> instance.
>> It highlights the icon but the icon doesn't move.
>>
>> This is a weird issue that I've never come across before.  Does  
>> anyone have
>> any clue why this might be happening?
>>
>>
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>>
>>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/a7bbf937/attachment.html 

From rharter at uwsp.edu  Wed Jan 14 13:43:14 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 14 Jan 2009 15:43:14 -0600
Subject: [Casper] Computer group from AD
In-Reply-To: <BFA01D44-1076-47EE-A585-46530399C15F@uwsp.edu>
References: <C58CEC24.12581%ernstcs@uwec.edu>
	<C58D0996.17C81%jared.nichols@ll.mit.edu>
	<ec2e75ff0901091135u522d594dv8527d8f2aecc48dd@mail.gmail.com>
	<CD8DEF47-FA94-4D62-AC54-4272F75B04FE@uwsp.edu>
	<ec2e75ff0901091250s73f7b000wf49ffee1585c1bfc@mail.gmail.com>
	<BFA01D44-1076-47EE-A585-46530399C15F@uwsp.edu>
Message-ID: <D9E5CCCF-57FF-4333-8091-7F05F83ED626@uwsp.edu>

I've written a script that will check for specific group membership in  
AD.  This should get you started scoping to AD groups if you need to.   
The workflow is as follows:

1.  This script runs as a daily policy on all machines.
2.  The gmark_SCLBaculaClient202 trigger that this fires off installs  
an empty package called gmark_SCLBaculaClient202.dmg
3.  A smart group is scoped to the package receipt of the  
gmark_SCLBaculaClient202.dmg, allowing me to scope policies to  
computers in that group.

I have to say thanks to Miles A. Leacy for the header ;)  And  
hopefully some future release of Casper will have the ability to pull  
groups from AD. I already submitted it as a feature req.

#!/bin/bash

##### HEADER BEGINS #####
# gmark_checkSCLBaculaClients2.0.2.bash
#
# Created 14012009 by Ryan Harter
# ryan at ryanharter.com
# Copyright 2009 Ryan Harter
#
# This script may be copied and distributed freely as long as this  
header remains intact.
#
# This script is provided "as is".  The author offers no warranty or  
guarantee of any kind.
# Use of this script is at your own risk.  The author takes no  
responsibility for loss of data
# or damage that may result from use of this script.
#
# It is intended to be run as part of a Casper policy triggered by  
login.
#
# Note: This script will need to be modified to fit your environment.   
This is how it works
# for me, but is provided as a template.
#
##### HEADER ENDS #####

# Standard error redirect and UWSP logging function
exec 2> >(logger -p local7.error)

function log {
     syslog -s -k Facility local7 Level Info Message "$1"
}

# Environment Specific Variables - You need to change these.
LDAPURI=ldap.uwsp.edu
BASEOU="ou=uwsp workstations,dc=uwsp,dc=edu"
HOSTNAME=`hostname | awk -F"." '{print $1}'`
ADGROUP="SCL Bacula Client 2.0.2"

# Trigger for Casper Policy
TRIGGER=gmark_SCLBaculaClient202

### Below this line shouldn't need to be modified

log "Searching for $ADGROUP membership for $HOSTNAME."

ldapsearch -Q -H ldap://$LDAPURI -b "$BASEOU" -u "(cn=$HOSTNAME)"  
memberOf | grep "$ADGROUP"

if [ $? -eq 0 ];then
     log "$HOSTNAME is a member of the $ADGROUP group.  Installing  
dummy package..."

     # Run the policy to install the dummy package.
     jamf policy -trigger "$TRIGGER"

     # Updates inventory so the smart group gets updated
     jamf recon
fi

exit 0

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 12, 2009, at 9:38 AM, Ryan Harter wrote:

> I'd like to update everyone on this issue.  Jamf has replied to my  
> emails saying that this is actually possible.  What you need to do is:
>
> 1. Set up a new LDAP server (even if you have one for users) and  
> scope it to computers.
> 2. Click "Text Server" and make sure you can see the groups,  
> computers, and computer's group membership.
> 3. The groups from AD should now appear in the "Static Computer  
> Groups" section with their source being "Active Directory".
>
> That is what Jamf says should be happening, however, I've gotten  
> through setup two and they still don't show up in Groups.  It could  
> be an environment specific problem, but I'll let you know how to get  
> it working when I figure it out.
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu
>
> On Jan 9, 2009, at 2:50 PM, Miles Leacy wrote:
>
>> I'm a big fan of smart groups based on dummy receipts.
>>
>> To break it down (as I would do it, at least):
>>
>> Run the initial policy on all machines (once per day, limited to  
>> off-hours if there would be any performance concerns).  This policy  
>> does:
>> - run script that checks AD groups.
>> - if desired group is found, issue a custom trigger of "receipt  
>> exists".
>> - if desired group is not found, issue a custom trigger of "receipt  
>> does not exist".
>>
>> The "receipt exists" custom trigger policy does:
>> - Install the dummy package
>>
>> The "receipt does not exist" custom trigger policy does:
>> - delete the dummy package's receipt
>>
>> Smart group is scoped to the existence of the dummy receipt.
>>
>> You can now scope to your smart group knowing that it consists of  
>> all members of your target AD group, with up to a 24-hour lag  
>> behind changes in group membership.  If 24 hours is too big of a  
>> window, you could set it to every15 (or 30 or whatever your  
>> periodic trigger is) and execution frequency of "ongoing".  This is  
>> pretty lightweight, so I don't think there's any cause for  
>> performance concerns.
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>> On Fri, Jan 9, 2009 at 3:22 PM, Ryan Harter <rharter at uwsp.edu> wrote:
>> This sounds like a good workaround.  I have emailed JAMF about this  
>> too, but haven't heard anything.  I'm sure they're all off at  
>> MacWorld:)
>>
>> I was hoping for a solution that I could make a computer group with  
>> so that I could only run it on the computers that need it and not  
>> on every computer just for the 20% that actually need the client.
>>
>> There is also talk of "leasing" CS3 licenses to departments on  
>> campus, in which case I would like to have self service only  
>> advertise the install on the computers that are in the CS3Licensed  
>> AD group.  I may do this by having us add the users to a group as  
>> well and scope it that way temporarily, but the ultimate goal is to  
>> have it available for department machines, not users.
>>
>> I was thinking of some sort of logic like:
>>
>> 1. run a policy that will check dscl for the group memberships of  
>> the computer.
>> 2. install a dummy package.
>> 3. base a smart group on the receipt of the dummy package.
>> 4. scope the policies to the smart group
>>
>> That way, I can not only run the policy just for the group, but  
>> also keep a record of who's in it.  It's not a very elegant  
>> solution, but it may have to do.
>>
>> Ryan Harter
>> UW - Stevens Point
>> Workstation Developer
>> 715.346.2716
>> Ryan.Harter at uwsp.edu
>>
>> On Jan 9, 2009, at 1:35 PM, Miles Leacy wrote:
>>
>>> "Bound to a directory" and "Member of a group" are different  
>>> concepts.
>>>
>>> I would also like the ability to recognize computer accounts and  
>>> computer groups.
>>>
>>> You could work around the current situation with a script using  
>>> logic like so:
>>>
>>> 1. Query LDAP (AD) for the groups "my computer" ($2, assuming your  
>>> machine names are the same as your AD names) belongs to.
>>> 2. grep the output for the group you want to key on.
>>> 3. call a custom trigger
>>>
>>> The ability for Casper to recognize computer accounts & groups  
>>> would be better than this, but this can give you the same net  
>>> effect as scoping a policy to an AD group.  This also assumes you  
>>> have the ability to perform LDAP lookups in AD.  If your JSS is  
>>> taking advantage of LDAP, then you could use the same account to  
>>> perform the lookup in the script.
>>>
>>> ----------
>>> Miles A. Leacy IV
>>>
>>> ? Certified System Administrator 10.4
>>> ? Certified Technical Coordinator 10.5
>>> ? Certified Trainer
>>> Certified Casper Administrator
>>> ----------
>>> voice: 1-347-277-7321
>>> miles.leacy at themacadmin.com
>>> www.themacadmin.com
>>>
>>>
>>>
>>>
>>> 2009/1/9 Nichols, Jared <jared.nichols at ll.mit.edu>
>>> Wouldn't you just create a smart computer group that goes off of  
>>> the Active Directory Status attribute?  You could either make it  
>>> "Active Directory Status" is <<name of AD>> (if you have more than  
>>> one and you want to specify which) or you could make "Active  
>>> Directory Status" is not "Not Bound"  It's a double negative, but  
>>> that would return any machine bound to an AD, no matter what the  
>>> AD is called.
>>>
>>> See Attachment.
>>>
>>> Maybe I don't understand completely your question?
>>>
>>> j
>>>
>>>
>>> On 1/9/09 12:57 , "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>>>
>>> Don't believe the JSS works with computer accounts in AD.
>>>
>>> Craig E
>>>
>>>
>>> On 1/9/09 11:56 AM, "Ryan Harter" <rharter at uwsp.edu> wrote:
>>>
>>> Hey Guys-
>>>
>>> Has anyone created a smart group that would take members based on  
>>> if the computer is a member of an AD group.
>>>
>>> Essentially what I'm trying to do is scope a policy to a group of  
>>> computers in AD, like you can with the User scope, but it doesn't  
>>> seem to work with computers.
>>>
>>> When user's register for our disaster recovery system, their  
>>> computer is added to a group in AD, and I would like to install  
>>> the backup client on their machine based on whether or not they  
>>> are in this group.  Any ideas?
>>>
>>>
>>> Ryan Harter
>>> UW - Stevens Point
>>> Workstation Developer
>>> 715.346.2716
>>> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
>>>
>>>
>>>
>>>
>>>
>>> -- 
>>> Jared Nichols
>>> ISD Infrastructure and Operations ? Desktop Engineering
>>> MIT Lincoln Laboratory
>>> 244 Wood St.
>>> Lexington, MA 02420-9108
>>> (781) 981-5500
>>>
>>> _______________________________________________
>>> Casper mailing list
>>> Casper at list.jamfsoftware.com
>>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>>
>>>
>>
>>
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/c1fbccba/attachment.htm 

From miles.leacy at themacadmin.com  Wed Jan 14 14:00:59 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 14 Jan 2009 17:00:59 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <217A3B56-E8F3-4398-8B09-92A2B624FCE3@thecreativepartnership.co.uk>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
	<49671CF6.7141.0039.0@kckps.org>
	<217A3B56-E8F3-4398-8B09-92A2B624FCE3@thecreativepartnership.co.uk>
Message-ID: <ec2e75ff0901141400s79941267n7fd95e47c6acd0e9@mail.gmail.com>

Dan,
I've been dissecting your script, and I'm unable to get the part that
appears to retrieve a volume's UUID working properly.

If I execute
DEVID=`diskutil list | grep Macintosh\ HD| awk '{print $6}'`
echo $DEVID

I get the following output:
Gi

There is no such thing as "diskGi", so the next line in the script, so after
executing:
UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
echo $UUID

I get the following output:
diskutil info

It appears that you're attempting to capture the disk identifier in $DEVID
(e.g., disk0) for the volume in question and then use that disk identifier
to retrieve the UUID by capturing the output of `diskutil info <disk
identifier>`.  Regardless of whether we are able to correctly capture a disk
identifier, I think there's a problem.  Since the UUID we're after is the
volume's UUID, we need to use the volume name in the `diskutil info` command
instead of the disk identifier.

Maybe I've misunderstood or poorly dissected the script, if that's the case,
please let me know.

In any event, the following two lines should capture the UUID of volume
"Macintosh HD" to $uuid:

uuid=`diskutil info "/Volumes/Macintosh HD"| grep UUID`
uuid=${uuid: -36}

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Tue, Jan 13, 2009 at 11:44 AM, Daniel Farnworth <
daniel.farnworth at thecreativepartnership.co.uk> wrote:

> Hi Thomas,
>
> Just to clarify, the reason that we wrote the script is that this
> will need to be run on each machine as it is imaged. When you
> partition a disk, the UUID that is assigned to each volume is
> completely unique; thus is you write the fstab in advance of the
> machines being partitioned, you are confined to using Labels as each
> machines disks/volumes will have globally unique UUIDs. This is why
> we run this as a pre-image script.
>
> Hope this helps
> Dan
>
> On 9 Jan 2009, at 15:46, Thomas Larkin wrote:
>
> > When we did our massive dual boot image over this last summer I was
> > looking at the /etc/fstab file to hide the windows partition from
> > the OS X side.  I had so many problems getting fstab to work.  It
> > would not work for me if I used volume name or the device mount
> > point, ie /dev/disk1s3/.  It would work if I used UUID, but if you
> > mass duplicate that UUID to tons of machines I found that it
> > wouldn't work.
> >
> > What has been your experience using /etc/fstab in 10.5?
> >
> >
> > ___________________________
> > Thomas Larkin
> > TIS Department
> > KCKPS USD500
> > tlarki at kckps.org
> > blackberry:  913-449-7589
> > office:  913-627-0351
> >
> >
> >
> >
> >
> > >>> Daniel Farnworth
> > <daniel.farnworth at thecreativepartnership.co.uk> 01/09/09 7:15 AM >>>
> > He he, thought that'd be popular.
> >
> > The script is fairly poorly written (I'm not a Bash wiz) so any
> > improvements are welcome (please let me have any so I can improve
> > mine).
> >
> > We run it as a 'before' script during our imaging process and it
> > takes a look at the internal disks, tries to figure out which is the
> > system disk or otherwise the disk in the first bay (Mac Pros only I
> > think) and then partitions it up into various volumes that we want.
> > Our post-flight script then takes the names of these and builds an
> > fstab file which it writes down to /etc. It also moves our admin
> > user's ('lwsadmin' in the script) home directory to /var/homes. We
> > figured this may be wise just in case the data partition goes dead
> > for any reason. Our OS image is pre-confd with lwsadmin's home
> > pointing at the correct location, so you may want to excise this
> > section and rely on using root to login in bad circumstances.
> >
> > Oh, the post script also 'hides' some of the partitions (Restore,
> > Freespace etc) so they don't show on the desktop, check the resulting
> > fstab to see how this is done.
> >
> > Be careful using this, it is destructive. Usual disclaimers apply =)
> >
> > ### Pre-install Partition Script
> >
> > #!/bin/bash -v
> >
> > exec 2>&1
> >
> > function rawdisksize {
> > FLOAT=$1
> > INT1=${FLOAT/.*}
> > #if $(( INT1 % 10 )) then
> > while (( INT1 % 10 ))
> > do
> > let INT1++
> > done
> > #fi
> > echo "$INT1"
> > }
> >
> >
> > function partitionsizes {
> >
> > case $RAW_SIZE in
> >
> > 30)
> > INTHD_SIZE=15
> > HOMES_SIZE=10
> > SCRATCH_SIZE=3
> > RESTORE_SIZE=0
> > ;;
> >
> > 40)
> > INTHD_SIZE=20
> > HOMES_SIZE=10
> > SCRATCH_SIZE=5
> > RESTORE_SIZE=0
> > ;;
> >
> > 60)
> > INTHD_SIZE=30
> > HOMES_SIZE=10
> > SCRATCH_SIZE=10
> > RESTORE_SIZE=5
> > ;;
> >
> > 80)
> > INTHD_SIZE=40
> > HOMES_SIZE=10
> > SCRATCH_SIZE=10
> > RESTORE_SIZE=10
> > ;;
> >
> > 120)
> > INTHD_SIZE=60
> > HOMES_SIZE=20
> > SCRATCH_SIZE=10
> > RESTORE_SIZE=20
> > ;;
> >
> > 160)
> > INTHD_SIZE=80
> > HOMES_SIZE=25
> > SCRATCH_SIZE=10
> > RESTORE_SIZE=25
> > ;;
> >
> > 240)
> > INTHD_SIZE=160
> > HOMES_SIZE=25
> > SCRATCH_SIZE=10
> > RESTORE_SIZE=25
> > ;;
> >
> > *)
> > INTHD_SIZE=$(( ($RAW_SIZE / 100) * 66 ))
> > HOMES_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> > SCRATCH_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> > RESTORE_SIZE=$(( ($RAW_SIZE / 100) * 11 ))
> > ;;
> > esac
> >
> > }
> >
> >
> > # Define a function to define whether this is a 'Bay Capable' machine
> > #function bayedmachine {
> >
> > # This needs to be written fairly soon
> >
> > #}
> >
> >
> > if [ ! -e /Volumes/CP-IntHD-01/.cp-partition-done ]; then
> >
> > echo ${1}
> > TARGETDISK=`diskutil info ${1} | grep "Device Identifier:" | awk
> > '{ print $3 }' | cut -c 1-5`
> > echo ${TARGETDISK}
> >
> > # now to partition the disk
> > #
> >
> > if [ ! -z $TARGETDISK ]
> > then
> > TOTAL_SIZE=`diskutil info $TARGETDISK | grep "Total Size" | awk
> > '{ print $3 }'`
> > RAW_SIZE=$(rawdisksize $TOTAL_SIZE)
> > partitionsizes
> >
> > echo "Total size of $TARGETDISK: $TOTAL_SIZE GB"
> > echo "Raw size of $TARGETDISK: $RAW_SIZE GB"
> >                  echo "CP-IntHD-01 Size: $INTHD_SIZE GB"
> >                  echo "CP-Homes-01 Size: $HOMES_SIZE GB"
> >                  echo "CP-Scratch-NOT-BackedUp Size: $SCRATCH_SIZE GB"
> >                  echo "Restore Size: $RESTORE_SIZE GB"
> >
> >
> > # Check processor type so we partition in the right format
> >
> > sysinfo=`system_profiler`
> >
> > countPPC=`echo ${sysinfo} | grep -c PowerPC`
> > countIntel=`echo ${sysinfo} | grep -c Intel`
> >
> > if [ ${countPPC} -ge 1 -a ${countIntel} -eq 0 ]; then
> > echo "Got a PPC in here"
> > partition_scheme_type="APMFormat"
> >
> > elif [ ${countIntel} -ge 1 -a ${countPPC} -eq 0 ]; then
> > echo "Intel Inside"
> > partition_scheme_type="GPTFormat"
> >
> > else
> > echo "Can't work out what kinda proc, it either ain't got one or
> > could be a Cray?"
> > exit 1
> >
> > fi
> >
> >
> > # Set the partition going
> >
> > if [ $RESTORE_SIZE -gt 0 ]; then
> >
> > diskutil partitionDisk $TARGETDISK 4 $partition_scheme_type \
> > "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> > "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> > "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G \
> > "Journaled HFS+" Restore "$RESTORE_SIZE"G
> >
> > else
> >
> > diskutil partitionDisk $TARGETDISK 3 $partition_scheme_type \
> > "Journaled HFS+" CP-IntHD-01 "$INTHD_SIZE"G \
> > "Journaled HFS+" CP-Homes-01 "$HOMES_SIZE"G \
> > "Journaled HFS+" CP-Scratch-NOT-BackedUp "$SCRATCH_SIZE"G
> >
> > fi
> >
> >
> > chown root:admin /Volumes/CP-Homes-01
> > chown root:admin /Volumes/CP-Scratch-NOT-BackedUp
> > chown root:admin /Volumes/Restore
> > chown root:admin /Volumes/Free-Space
> >
> > chmod g+w /Volumes/CP-Homes-01
> > chmod g+w /Volumes/CP-Scratch-NOT-BackedUp
> > chmod g+w /Volumes/Restore
> > chmod g+w /Volumes/Free-Space
> >
> > touch /Volumes/CP-IntHD-01/.cp-partition-done
> >
> > else
> >
> > echo "Problem acquiring target disk, exiting";
> > exit 1
> >
> > fi
> >
> > else
> >
> > echo "The partition scheme has already been created. Exiting"
> > exit 0
> >
> > fi
> >
> > exit 0
> >
> >
> > ### Post Install Script
> >
> > #!/bin/bash -v
> >
> > # Redirect STDERR to STDOUT
> > exec 2>&1
> >
> > VOLSDIR="/Volumes/"
> >
> > ROOTVOL="CP-IntHD-01"
> > HOMESVOL="CP-Homes-01"
> >
> > ROOTPATH="${VOLSDIR}${ROOTVOL}"
> > HOMESPATH="${VOLSDIR}${HOMESVOL}"
> >
> >
> >
> >
> > if [ -e "${1}/.cp-partition-done" ]; then
> >
> > # Ditto the contents of $ROOTPART/Users/Shared to their new location
> >
> > ditto -v "${1}/Users/Shared" "${HOMESPATH}/Shared"
> > if (( ! $? )); then
> >
> > # Remove the old copy of $ROOTPART/Users/Shared
> > echo "Done dittoing..."
> > rm -vR "${1}/Users/Shared" || { echo "rm /Users/Shared failed" ; }
> > rm -v "${1}/Users/.DS_Store" || { echo "rm /Users/.DS_Store
> > failed" ; }
> > rm -v "${1}/Users/.localized" || { echo "rm /Users/.localized
> > failed" ; }
> >
> > if [ -e "${1}/var/homes/lwsadmin" ]; then
> > rm -vR "${1}/Users/lwsadmin" || { echo "rm /Users/lwsadmin
> > failed" ; }
> > fi
> >
> > DEVID=`diskutil list | grep $HOMESVOL | awk '{print $6}'`
> > UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
> > echo "# Remap the $HOMESPATH to /Users" >> $1/etc/fstab || { echo
> > "'fstab' Stage 1 failed: $HOMESPATH" ; exit 1 ; }
> > echo -e "UUID=${UUID}\t/Users\thfs\trw,nobrowse\t1\t1\n" >> $1/etc/
> > fstab || { echo "'fstab' Stage 2 failed: $HOMESPATH" ; exit 1 ; }
> >
> > HIDDEN_VOLS=(Restore Free-Space)
> >
> > for volume in "${HIDDEN_VOLS[@]}"; do
> >
> > DEVID=`diskutil list | grep $volume | awk '{print $6}'`
> > UUID=`diskutil info $DEVID | grep UUID | /usr/bin/awk {'print $2'}`
> >
> > echo "# Set the volume $volume to not mount at startup" >> $1/etc/
> > fstab || { echo "'fstab' Stage 3 ($volume) failed: $volume" ; exit
> > 1 ; }
> > echo -e "UUID=${UUID}\tnone\thfs\trw,noauto\t1\t1\n" >> $1/etc/
> > fstab || { echo "'fstab' Stage 4 ($volume) failed: $UUID" ; exit 1 ; }
> >
> > done
> >
> > fi
> >
> > touch "${1}/.cp-user-migration-done" || { echo "Task completion file
> > could not be created" ; exit 1 ; }
> >
> > exit 0
> >
> > else
> > # Log the error
> > echo "Could not find partition completion file. It would be wise not
> > to continue"
> > # Exit with above 0 status
> > exit 1
> >
> > fi
> >
> >
> >
> >
> >
> >
> > On 9 Jan 2009, at 12:44, Damien Weiss wrote:
> >
> > >
> > > YES!!!!!  PLEASE!!!!  Send that script on.  That's something that I
> > > would implement almost immediately.
> > >
> > > Thanks!
> > > Damien
> > >
> > > On Jan 9, 2009, at 7:19 AM, Daniel Farnworth wrote:
> > >
> > >> I have a pre-
> > >> install script that we use to do this for us if anyone is
> > interested.
> > >>
> > >> Cheers
> > >> Dan
> > >
> >
> > --
> > Daniel Farnworth
> > IT Manager
> > The Creative Partnership
> > daniel.farnworth at thecreativepartnership.co.uk
> >
> > http://www.thecreativepartnership.co.uk
> > Tel: +44 (0)20 7439 7762
> > Fax: +44 (0)20 7437 1467
> >
> > PGP Public Key available
> >
> >
> >
> >
> >
> >
> > The information contained in this communication is intended solely
> > for the use of the individual or entity to whom it is addressed and
> > others authorised to receive it. It may contain confidential or
> > legally privileged information. If you are not the intended
> > recipient you are hereby notified that any disclosure, copying,
> > distribution or taking any action in reliance on the contents of
> > this information is strictly prohibited and may be unlawful. If you
> > have received this communication in error, please notify
> > postmaster at thecreativepartnership.co.uk immediately and then delete
> > this email from your system. Any views or opinions presented in
> > this email are solely those of the author and do not necessarily
> > represent those of The Creative Partnership. The Creative
> > Partnership has taken every reasonable precaution to ensure that
> > any attachment to this e-mail has been swept for viruses. However,
> > The Creative Partnership cannot accept liability for any damage
> > sustained as a result of s
> > oftware viruses and would advise that you carry out your own virus
> > checks before opening any attachment.
> >
> > _______________________________________________
> > Casper mailing list
> > Casper at list.jamfsoftware.com
> > http://list.jamfsoftware.com/mailman/listinfo/casper
>
> --
> Daniel Farnworth
> IT Manager
> The Creative Partnership
> daniel.farnworth at thecreativepartnership.co.uk
>
> http://www.thecreativepartnership.co.uk
> Tel: +44 (0)20 7439 7762
> Fax: +44 (0)20 7437 1467
>
> PGP Public Key available
>
>
>
>
>
>
> The information contained in this communication is intended solely for the
> use of the individual or entity to whom it is addressed and others
> authorised to receive it. It may contain confidential or legally privileged
> information. If you are not the intended recipient you are hereby notified
> that any disclosure, copying, distribution or taking any action in reliance
> on the contents of this information is strictly prohibited and may be
> unlawful. If you have received this communication in error, please notify
> postmaster at thecreativepartnership.co.uk immediately and then delete this
> email from your system. Any views or opinions presented in this email are
> solely those of the author and do not necessarily represent those of The
> Creative Partnership. The Creative Partnership has taken every reasonable
> precaution to ensure that any attachment to this e-mail has been swept for
> viruses. However, The Creative Partnership cannot accept liability for any
> damage sustained as a result of software viruses and would advise that you
> carry out your own virus checks before opening any attachment.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090114/f9539cd4/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan 15 06:26:16 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 15 Jan 2009 09:26:16 -0500
Subject: [Casper] Upgrading from Tiger to Leopard
In-Reply-To: <AE2BA70D-7906-4E57-B956-CBE7538A02EE@mac.com>
References: <DC484A17-2FC5-497C-8DED-F700A2767A4C@wgclawfirm.com>
	<ec2e75ff0901071402l32b95b5dl90f07a200f61ffad@mail.gmail.com>
	<353C2EA2-A3AE-4853-A20F-864B9B2D76E8@thecreativepartnership.co.uk>
	<6AC8A1F5-80F0-4928-9778-0F7012EABFDB@mac.com>
	<5C92A9E0-6021-4E3D-B75C-94999CE11483@thecreativepartnership.co.uk>
	<49671CF6.7141.0039.0@kckps.org>
	<217A3B56-E8F3-4398-8B09-92A2B624FCE3@thecreativepartnership.co.uk>
	<ec2e75ff0901141400s79941267n7fd95e47c6acd0e9@mail.gmail.com>
	<AE2BA70D-7906-4E57-B956-CBE7538A02EE@mac.com>
Message-ID: <ec2e75ff0901150626u5672d703ja59b8d3715c5a17c@mail.gmail.com>

Ah.  Thanks for the clarification.  I'm not as awk-proficient as I'd like to
be.
However, I'm curious as to why one would choose to use the device identifier
to retrieve the UUID as opposed to using the volume name.  You can return
the UUID by supplying either one, and presumably, your volume name is
already a known value.

The following gets you a volume's UUID, based on the volume name, in one
line:

uuid=`diskutil info "/Volumes/Macintosh HD"| grep UUID| awk '{print $3}'`


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 15, 2009 at 8:35 AM, Daniel Flynn <daniel.flynn at mac.com> wrote:

>
> On Jan 14, 2009, at 5:00 PM, Miles Leacy wrote:
>
>  If I execute
>> DEVID=`diskutil list | grep Macintosh\ HD| awk '{print $6}'`
>> echo $DEVID
>>
>> I get the following output:
>> Gi
>>
>
> awk must be seeing Macintosh\ HD as two fields, so in this case field 6 is
> 'Gi'
>
> DEVID=`diskutil list | grep Macintosh\ HD | awk '{print $7}'`
>
> if the logical volume did not contain whitespaces, $6 should work.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090115/cef9ed2c/attachment.html 

From Dustin.Dorey at district196.org  Thu Jan 15 06:29:50 2009
From: Dustin.Dorey at district196.org (Dorey, Dustin)
Date: Thu, 15 Jan 2009 08:29:50 -0600
Subject: [Casper] GSX integration behind a proxy
Message-ID: <DFFCE7044F8AFF41AB2262F92C78216208A09617@do-mail03.district196.org>

Sooo is anyone using the GSX integration behind a proxy?   When we try
to mass edit or anything within the GSX portion of the JSS we get this

 

org.apache.jasper.JasperException: An exception occurred processing JSP
page /WEB-INF/jsp/massEditWarranty.jsp at line 41

 

38: 

39: 

 

 

When we route it around the proxy it works fine,  and there is no where
in the JSS to enter proxy info, and the server had the proxy in it's
network settings properly.    Ideas?   Tomcat?   

 

Dustin  Dorey

Technology Support Cluster Specialist

ISD 196 Apple Valley, Eagan, Rosemount

dustin.dorey at district196.org

952|423|7971

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090115/e51e26d2/attachment.html 

From tlarki at kckps.org  Fri Jan 16 07:48:53 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 09:48:53 -0600
Subject: [Casper] one of those days, can't remember syntax
Message-ID: <49705804.7141.0039.0@kckps.org>

of dscl to remove someone from a group 

I thought it was 

sudo dscl . delete /Groups/admin GroupMembership <shortname> 

That returns an error 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/f7236e8d/attachment.htm 

From miles.leacy at themacadmin.com  Fri Jan 16 07:59:27 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 10:59:27 -0500
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <49705804.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>

You need to use the GUID.  If I'm not mistaken, it's stored in the user's
record as the "GeneratedUID".

dscl . -delete /Groups/<group> GroupMembers <GUID>

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/16 Thomas Larkin <tlarki at kckps.org>

>  of dscl to remove someone from a group
>
>  I thought it was
>
>  sudo dscl . delete /Groups/admin GroupMembership <shortname>
>
>  That returns an error
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/cd4c59b4/attachment.htm 

From tlarki at kckps.org  Fri Jan 16 08:04:58 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 10:04:58 -0600
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
Message-ID: <49705BCA.7141.0039.0@kckps.org>

These are Directory users that have promoted them self to admin via an
old test account and we are cleaning it up, would that make any
difference? 

I would have sworn in the past I have used what I posted a few minutes
ago.

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>

You need to use the GUID.  If I'm not mistaken, it's stored in the
user's record as the "GeneratedUID". 



dscl . -delete /Groups/<group> GroupMembers <GUID> 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/16 Thomas Larkin 
<tlarki at kckps.org> 




of dscl to remove someone from a group 


I thought it was 


sudo dscl . delete /Groups/admin GroupMembership <shortname> 


That returns an error 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/6052dfef/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 16 08:08:36 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 11:08:36 -0500
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <49705BCA.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>

What error is your command returning?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  These are Directory users that have promoted them self to admin via an
> old test account and we are cleaning it up, would that make any difference?
>
>  I would have sworn in the past I have used what I posted a few minutes
> ago.
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>
>
> You need to use the GUID.  If I'm not mistaken, it's stored in the user's
> record as the "GeneratedUID".
>
>
>   dscl . -delete /Groups/<group> GroupMembers <GUID>
>
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   2009/1/16 Thomas Larkin
>
> <tlarki at kckps.org>
>
>
>   of dscl to remove someone from a group
>>
>>
>>  I thought it was
>>
>>
>>  sudo dscl . delete /Groups/admin GroupMembership <shortname>
>>
>>
>>  That returns an error
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/fb189a3d/attachment.htm 

From tlarki at kckps.org  Fri Jan 16 08:11:25 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 10:11:25 -0600
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
Message-ID: <49705D4D.7141.0039.0@kckps.org>

DS error -14134 (eDSAttributeNotFound) 

If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
up with their GUID so I know that they are in fact there


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>>
What error is your command returning?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


These are Directory users that have promoted them self to admin via an
old test account and we are cleaning it up, would that make any
difference? 


I would have sworn in the past I have used what I posted a few minutes
ago.

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>


You need to use the GUID.  If I'm not mistaken, it's stored in the
user's record as the "GeneratedUID". 



dscl . -delete /Groups/<group> GroupMembers <GUID> 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/16 Thomas Larkin 
<tlarki at kckps.org> 




of dscl to remove someone from a group 


I thought it was 


sudo dscl . delete /Groups/admin GroupMembership <shortname> 


That returns an error 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/2dbe53a4/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 16 08:18:18 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 11:18:18 -0500
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <49705D4D.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>

I'm not sure what's going on there, however I'm fairly certain that using
the GUID will get you where you need to be.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 16, 2009 at 11:11 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  DS error -14134 (eDSAttributeNotFound)
>
>  If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
> up with their GUID so I know that they are in fact there
>
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>>
>
> What error is your command returning?
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin
>
> <tlarki at kckps.org>
>
> wrote:
>
>>  These are Directory users that have promoted them self to admin via an
>> old test account and we are cleaning it up, would that make any difference?
>>
>>
>>  I would have sworn in the past I have used what I posted a few minutes
>> ago.
>>
>> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>
>>
>>   You need to use the GUID.  If I'm not mistaken, it's stored in the
>> user's record as the "GeneratedUID".
>>
>>
>>   dscl . -delete /Groups/<group> GroupMembers <GUID>
>>
>>
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>>   2009/1/16 Thomas Larkin
>>
>> <tlarki at kckps.org>
>>
>>
>>   of dscl to remove someone from a group
>>>
>>>
>>>  I thought it was
>>>
>>>
>>>  sudo dscl . delete /Groups/admin GroupMembership <shortname>
>>>
>>>
>>>  That returns an error
>>>
>>>
>>> ___________________________
>>> Thomas Larkin
>>> TIS Department
>>> KCKPS USD500
>>> tlarki at kckps.org
>>> blackberry:  913-449-7589
>>> office:  913-627-0351
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Casper mailing list
>>> Casper at list.jamfsoftware.com
>>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/dcf8c105/attachment.htm 

From tlarki at kckps.org  Fri Jan 16 08:23:08 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 10:23:08 -0600
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
	<ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
Message-ID: <4970600C.7141.0039.0@kckps.org>

OK 

This is what confuses me and frightens me... 

jamf listUsers returns the localized mobile account as having the <true>
value as the account being an admin 

dscl . read /Groups/admin Does not list the account 

dscl . -delete /Groups/admin GroupMembership <shortname> or <UID>
returns an error that the attribute is not found, so I am guessing that
means that the account isn't in that group 


Is this a bug with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:18 AM >>>
I'm not sure what's going on there, however I'm fairly certain that
using the GUID will get you where you need to be.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Fri, Jan 16, 2009 at 11:11 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


DS error -14134 (eDSAttributeNotFound) 


If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
up with their GUID so I know that they are in fact there 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>> 



What error is your command returning?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com







On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


These are Directory users that have promoted them self to admin via an
old test account and we are cleaning it up, would that make any
difference? 


I would have sworn in the past I have used what I posted a few minutes
ago.

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>



You need to use the GUID.  If I'm not mistaken, it's stored in the
user's record as the "GeneratedUID". 



dscl . -delete /Groups/<group> GroupMembers <GUID> 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/16 Thomas Larkin 
<tlarki at kckps.org> 




of dscl to remove someone from a group 


I thought it was 


sudo dscl . delete /Groups/admin GroupMembership <shortname> 


That returns an error 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper








-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/39f5cdef/attachment.htm 

From Cyrus.Vahhaji at bestbuy.com  Fri Jan 16 08:24:29 2009
From: Cyrus.Vahhaji at bestbuy.com (Cyrus Vahhaji)
Date: Fri, 16 Jan 2009 10:24:29 -0600
Subject: [Casper] Upgrading Casper
Message-ID: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>

I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on
10.4.11 which I would also like to upgrade at some point. Wanted to see if
any of you on the list has any recommendations on which to upgrade first
based on your experiences? My main objective is to upgrade JSS to latest
version. OS X server is only being used to run JSS and currently I?m not
utilizing any other features. And while on this topic I?m curious to see if
you have a fail over solution if JSS goes down and how you go about doing
this.

Thanx in advance,
Cyrus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/0b2c7daf/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 16 08:31:56 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 11:31:56 -0500
Subject: [Casper] Upgrading Casper
In-Reply-To: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
References: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <ec2e75ff0901160831w1faf4b9bwd6b11ded5b69c7c4@mail.gmail.com>

How big is your environment?  Do you have other Mac servers?
When you can schedule some acceptable downtime, I'd backup, wipe the box,
install 10.5, update to 10.5.6, then install Casper and restore your backup.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/16 Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com>

>  I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on
> 10.4.11 which I would also like to upgrade at some point. Wanted to see if
> any of you on the list has any recommendations on which to upgrade first
> based on your experiences? My main objective is to upgrade JSS to latest
> version. OS X server is only being used to run JSS and currently I'm not
> utilizing any other features. And while on this topic I'm curious to see if
> you have a fail over solution if JSS goes down and how you go about doing
> this.
>
> Thanx in advance,
> Cyrus
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/a9b5dc9a/attachment.htm 

From Dustin.Dorey at district196.org  Fri Jan 16 08:47:00 2009
From: Dustin.Dorey at district196.org (Dorey, Dustin)
Date: Fri, 16 Jan 2009 10:47:00 -0600
Subject: [Casper] Spam:  Upgrading Casper
In-Reply-To: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
References: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <DFFCE7044F8AFF41AB2262F92C78216208A09B05@do-mail03.district196.org>

Personal recommendation from what we saw in our environment.    Do not
just run the updates.  Back up your JSS and wipe the server clean, I
prefer to zero the drives but that might just be me.    Do a clean
install of the server, do an install of the Casper Suite 6.1 then
restore your backup.  

We originally upgraded a 10.4 server to 10.5 then upgraded from casper
suite 5 to 6 and ran into a number of issues that JAMF could not
replicate, then we set up a mini environment and tested further there
and found that with clean installs we couldn't replicate the issues
either.    Ended up taking a week to take everything down, Main server,
load balancing server, Distribution points.   We rebuilt them all and
have been much better off for it, other than the GSX integration which
I'm just starting to look into.  Per my previous e-mail.

 

-Dusty-

 

 

Dustin  Dorey

Technology Support Cluster Specialist

ISD 196 Apple Valley, Eagan, Rosemount

dustin.dorey at district196.org

952|423|7971

 

 

 

From: casper-bounces at list.jamfsoftware.com
[mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Cyrus Vahhaji
Sent: Friday, January 16, 2009 10:24 AM
To: Jamf List Serve
Subject: Spam: [Casper] Upgrading Casper

 

I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on
10.4.11 which I would also like to upgrade at some point. Wanted to see
if any of you on the list has any recommendations on which to upgrade
first based on your experiences? My main objective is to upgrade JSS to
latest version. OS X server is only being used to run JSS and currently
I'm not utilizing any other features. And while on this topic I'm
curious to see if you have a fail over solution if JSS goes down and how
you go about doing this.

Thanx in advance,
Cyrus 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/588036fa/attachment.htm 

From ERNSTCS at uwec.edu  Fri Jan 16 08:48:20 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Fri, 16 Jan 2009 10:48:20 -0600
Subject: [Casper] Upgrading Casper
In-Reply-To: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <C5961674.12979%ernstcs@uwec.edu>

Hi Cyrus,

I would agree with the path that Miles has suggested. Create a backup of the JSS database and your CasperShare data if it's not on a separate partition, wipe the box, install 10.5, patch it, then install the new Casper and restore your files and database.

I personally felt that Leopard use to run poor on the older Xserves if you don't have Intel based servers.

The JSS documentation has a lot of the information on how to do the JSS portions.

As for a fail over solution. I house our primary Xserve on our main server floor, and I house a second in our backup center. I have the second server setup as a secondary distribution point with nightly sync. Inside of the CasperShare folder I also house the automated database backups so they are also automatically carried over to the second server. That's how I deal with at least making sure the files and database are somewhere else in the most lazy way possible.

However, this doesn't do anything for making sure the JSS has a fail over solution that's automatic. If the main JSS goes and I need something for the clients to talk to I'd have to install the JSS on the second server and make sure the DNS pointer gets updated. As it stands the clients aren't aware of a second server they can turn to if the primary is down.

I'm not saying how I do it here is the right way, and I'd love any suggestions on how to do it better. I know that there are several requests for failover of services into JAMF already, me included.

But who are we kidding...the JSS never goes down. ;)

Craig E

On 1/16/09 10:24 AM, "Cyrus Vahhaji" <Cyrus.Vahhaji at bestbuy.com> wrote:

I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on 10.4.11 which I would also like to upgrade at some point. Wanted to see if any of you on the list has any recommendations on which to upgrade first based on your experiences? My main objective is to upgrade JSS to latest version. OS X server is only being used to run JSS and currently I'm not utilizing any other features. And while on this topic I'm curious to see if you have a fail over solution if JSS goes down and how you go about doing this.

Thanx in advance,
Cyrus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/4f3aa0e6/attachment.htm 

From NATHANIEL.LINDLEY at spps.org  Fri Jan 16 08:43:09 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Fri, 16 Jan 2009 10:43:09 -0600
Subject: [Casper] Upgrading Casper
In-Reply-To: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <OF33F3B82B.F2383382-ON86257540.005BC075-86257540.005C8351@spps.org>

I agree with pervious posts.   We had better luck when doing a clean 
install of OS X 10.5 server first. Installing JSS and then restoring from 
backup.  Much better performance than the upgrade in place. 


Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861



Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com> 
Sent by: casper-bounces at list.jamfsoftware.com
01/16/09 10:17 AM

To
Jamf List Serve <casper at list.jamfsoftware.com>
cc

Subject
[Casper] Upgrading Casper






I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on 
10.4.11 which I would also like to upgrade at some point. Wanted to see if 
any of you on the list has any recommendations on which to upgrade first 
based on your experiences? My main objective is to upgrade JSS to latest 
version. OS X server is only being used to run JSS and currently I?m not 
utilizing any other features. And while on this topic I?m curious to see 
if you have a fail over solution if JSS goes down and how you go about 
doing this.

Thanx in advance,
Cyrus _______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/47f2eedd/attachment.html 

From tlarki at kckps.org  Fri Jan 16 08:56:32 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 10:56:32 -0600
Subject: [Casper] Upgrading Casper
In-Reply-To: <OF33F3B82B.F2383382-ON86257540.005BC075-86257540.005C8351@spps.org>
References: <C59610DD.1E23C%Cyrus.Vahhaji@bestbuy.com>
	<OF33F3B82B.F2383382-ON86257540.005BC075-86257540.005C8351@spps.org>
Message-ID: <497067E0.7141.0039.0@kckps.org>

I upgraded this summer this is what I did 

Make a back up of version 5 

Wipe and reload and upgrade to 10.5 server, loaded server clean, set up
IP and DNS, install JSS clean, import database 

No problems really at all

>>> <NATHANIEL.LINDLEY at spps.org> 01/16/09 10:43 AM >>>

I agree with pervious posts.   We had better luck when doing a clean
install of OS X 10.5 server first. Installing JSS and then restoring
from backup.  Much better performance than the upgrade in place.   


Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861




Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com> 
Sent by: casper-bounces at list.jamfsoftware.com 
01/16/09 10:17 AM 

To 

Jamf List Serve <casper at list.jamfsoftware.com> 

cc 


Subject 

[Casper] Upgrading Casper 











I like to upgrade Casper from 5.13 to 6.01. Our JSS server is running on
10.4.11 which I would also like to upgrade at some point. Wanted to see
if any of you on the list has any recommendations on which to upgrade
first based on your experiences? My main objective is to upgrade JSS to
latest version. OS X server is only being used to run JSS and currently
I?m not utilizing any other features. And while on this topic I?m
curious to see if you have a fail over solution if JSS goes down and how
you go about doing this.

Thanx in advance,
Cyrus _______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/b40d8f44/attachment.htm 

From tlarki at kckps.org  Fri Jan 16 10:27:15 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 12:27:15 -0600
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <4970600C.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
	<ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
	<4970600C.7141.0039.0@kckps.org>
Message-ID: <49707D23.7141.0039.0@kckps.org>

Well 

On some machines it shows the admin value as true and on others it
doesn't.  This inconsistency is really making me think that some users
promoted their accounts to admin via an older test account which they
got the password to.  Then again, dscl returns that they are not admins.
  Some of these machines have obviously been changed by someone other
than the IT staff, so I know some of them have been promoted. 

I was looking at a way to loop /Users and make sure all users are
demoted just back to staff and not admin at all.  However, I am getting
conflicting information from dscl and jamf listUsers 

Thoughts?

>>> "Thomas Larkin" <tlarki at kckps.org> 01/16/09 10:23 AM >>>

OK 


This is what confuses me and frightens me... 


jamf listUsers returns the localized mobile account as having the <true>
value as the account being an admin 


dscl . read /Groups/admin Does not list the account 


dscl . -delete /Groups/admin GroupMembership <shortname> or <UID>
returns an error that the attribute is not found, so I am guessing that
means that the account isn't in that group 



Is this a bug with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:18 AM >>>
I'm not sure what's going on there, however I'm fairly certain that
using the GUID will get you where you need to be.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Fri, Jan 16, 2009 at 11:11 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


DS error -14134 (eDSAttributeNotFound) 


If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
up with their GUID so I know that they are in fact there 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>> 




What error is your command returning?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com









On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


These are Directory users that have promoted them self to admin via an
old test account and we are cleaning it up, would that make any
difference? 


I would have sworn in the past I have used what I posted a few minutes
ago.

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>



You need to use the GUID.  If I'm not mistaken, it's stored in the
user's record as the "GeneratedUID". 



dscl . -delete /Groups/<group> GroupMembers <GUID> 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/16 Thomas Larkin 
<tlarki at kckps.org> 




of dscl to remove someone from a group 


I thought it was 


sudo dscl . delete /Groups/admin GroupMembership <shortname> 


That returns an error 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper








-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/d4e4e1e8/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 16 14:03:02 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 17:03:02 -0500
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <4970600C.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
	<ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
	<4970600C.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901161403m51066867hd741c924b3db0ca5@mail.gmail.com>

On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin <tlarki at kckps.org> wrote:

> jamf listUsers returns the localized mobile account as having the <true>
> value as the account being an admin
>
> dscl . read /Groups/admin Does not list the account
>

That's just odd.  Can you verify that these accounts actually have admin
privileges?  Maybe someone at jamf can comment on how Casper determines
whether an account is an admin?  At a confident guess, I'd say that the
"jamf listUsers" information is only as good as your last Recon of that
machine.  Are you updating inventory regularly?  I check the "update
inventory" box on just about every policy I create to make sure I've got up
to date information.

This weirdness aside for a moment, assuming you have an account that is
verifiably a member of a group that you don't want it to be a part of, you
can run this command to take it out of the group.

sudo dseditgroup -o edit -d <username to be removed from group> -t user
<group>

The UUID method I mentioned earlier also ought to work, but I've tested the
dseditgroup method this afternoon.

I assume that you've got some legitimate admins on the systems that you'd
want to skip, so you could do something like...


for i in $( dscl . -read /Groups/admin| grep GroupMembership:| awk '{for
(j=3; j<=NF; j++) printf " %s", $j; printf "\n" }' )
  do
    case $i in
      <legitadmin1>)
        done
        ;;
      <legitadmin2>)
        done
        ;;      *)
        dseditgroup -o edit -d $i -t user admin
        ;;
    esac
  done

Test, test, test.  Be very careful when editing your directory service.  You
may want to create a new group to test with so you don't risk breaking the
admin group or your legit admin accounts.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin <tlarki at kckps.org> wrote:

>  OK
>
>  This is what confuses me and frightens me...
>
>  jamf listUsers returns the localized mobile account as having the <true>
> value as the account being an admin
>
>  dscl . read /Groups/admin Does not list the account
>
>  dscl . -delete /Groups/admin GroupMembership <shortname> or <UID> returns
> an error that the attribute is not found, so I am guessing that means that
> the account isn't in that group
>
>
>  Is this a bug with Casper?
>
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:18 AM >>>
>
> I'm not sure what's going on there, however I'm fairly certain that using
> the GUID will get you where you need to be.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>    On Fri, Jan 16, 2009 at 11:11 AM, Thomas Larkin
>
> <tlarki at kckps.org>
>
> wrote:
>
>>  DS error -14134 (eDSAttributeNotFound)
>>
>>
>>  If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
>> up with their GUID so I know that they are in fact there
>>
>>
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>>   >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>>
>>
>>
>> What error is your command returning?
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>>
>>
>>   On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin
>>
>> <tlarki at kckps.org>
>>
>> wrote:
>>
>>>  These are Directory users that have promoted them self to admin via an
>>> old test account and we are cleaning it up, would that make any difference?
>>>
>>>
>>>  I would have sworn in the past I have used what I posted a few minutes
>>> ago.
>>>
>>> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>
>>>
>>>
>>>    You need to use the GUID.  If I'm not mistaken, it's stored in the
>>> user's record as the "GeneratedUID".
>>>
>>>
>>>   dscl . -delete /Groups/<group> GroupMembers <GUID>
>>>
>>>
>>>
>>> ----------
>>> Miles A. Leacy IV
>>>
>>> ? Certified System Administrator 10.4
>>> ? Certified Technical Coordinator 10.5
>>> ? Certified Trainer
>>> Certified Casper Administrator
>>> ----------
>>> voice: 1-347-277-7321
>>> miles.leacy at themacadmin.com
>>> www.themacadmin.com
>>>
>>>
>>>
>>>
>>>   2009/1/16 Thomas Larkin
>>>
>>> <tlarki at kckps.org>
>>>
>>>
>>>   of dscl to remove someone from a group
>>>>
>>>>
>>>>  I thought it was
>>>>
>>>>
>>>>  sudo dscl . delete /Groups/admin GroupMembership <shortname>
>>>>
>>>>
>>>>  That returns an error
>>>>
>>>>
>>>> ___________________________
>>>> Thomas Larkin
>>>> TIS Department
>>>> KCKPS USD500
>>>> tlarki at kckps.org
>>>> blackberry:  913-449-7589
>>>> office:  913-627-0351
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Casper mailing list
>>>> Casper at list.jamfsoftware.com
>>>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/79bcc220/attachment.htm 

From tlarki at kckps.org  Fri Jan 16 14:09:24 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 16 Jan 2009 16:09:24 -0600
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <ec2e75ff0901161403m51066867hd741c924b3db0ca5@mail.gmail.com>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
	<ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
	<4970600C.7141.0039.0@kckps.org>
	<ec2e75ff0901161403m51066867hd741c924b3db0ca5@mail.gmail.com>
Message-ID: <4970B134.7141.0039.0@kckps.org>

Thanks for that. 

I am wondering if at one time they did promote them self to admin is
all.  Also, by design in my image all proper admin accounts are stored
in /private/var so any user in /Users should never be an admin account
on the student machines.   Teacher machines do have a local admin
account in /Users but there is also a hidden admin account on there as
well. 

All IT staff have access to the local hidden admin account. 

So as long as the user lives in /Users I can demote it back to staff and
get it out of the admin group. 

Thanks for the replies, have a good weekend everyone.  Three day weekend
for us people in education, gotta love those holidays we get off. 

Later 

Tom

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 4:03 PM >>>
On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin  
<tlarki at kckps.org> 

 wrote:



jamf listUsers returns the localized mobile account as having the <true>
value as the account being an admin 




dscl . read /Groups/admin Does not list the account 



That's just odd.  Can you verify that these accounts actually have admin
privileges?  Maybe someone at jamf can comment on how Casper determines
whether an account is an admin?  At a confident guess, I'd say that the
"jamf listUsers" information is only as good as your last Recon of that
machine.  Are you updating inventory regularly?  I check the "update
inventory" box on just about every policy I create to make sure I've got
up to date information. 



This weirdness aside for a moment, assuming you have an account that is
verifiably a member of a group that you don't want it to be a part of,
you can run this command to take it out of the group. 



sudo dseditgroup -o edit -d <username to be removed from group> -t user
<group> 



The UUID method I mentioned earlier also ought to work, but I've tested
the dseditgroup method this afternoon. 



I assume that you've got some legitimate admins on the systems that
you'd want to skip, so you could do something like... 





for i in $( dscl . -read /Groups/admin| grep GroupMembership:| awk '{for
(j=3; j<=NF; j++) printf " %s", $j; printf "\n" }' ) 

  do 

    case $i in  

      <legitadmin1>) 

        done 

        ;; 

      <legitadmin2>) 

        done 

        ;; 

      *) 

        dseditgroup -o edit -d $i -t user admin 

        ;; 

    esac 

  done 



Test, test, test.  Be very careful when editing your directory service. 
You may want to create a new group to test with so you don't risk
breaking the admin group or your legit admin accounts. 


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


OK 


This is what confuses me and frightens me... 


jamf listUsers returns the localized mobile account as having the <true>
value as the account being an admin 


dscl . read /Groups/admin Does not list the account 


dscl . -delete /Groups/admin GroupMembership <shortname> or <UID>
returns an error that the attribute is not found, so I am guessing that
means that the account isn't in that group 



Is this a bug with Casper? 




___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:18 AM >>> 



I'm not sure what's going on there, however I'm fairly certain that
using the GUID will get you where you need to be.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com







If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
up with their GUID so I know that they are in fact there 




___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>> 




What error is your command returning?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com









On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


These are Directory users that have promoted them self to admin via an
old test account and we are cleaning it up, would that make any
difference? 


I would have sworn in the past I have used what I posted a few minutes
ago.

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>



You need to use the GUID.  If I'm not mistaken, it's stored in the
user's record as the "GeneratedUID". 



dscl . -delete /Groups/<group> GroupMembers <GUID> 




----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/16 Thomas Larkin 
<tlarki at kckps.org> 




of dscl to remove someone from a group 


I thought it was 


sudo dscl . delete /Groups/admin GroupMembership <shortname> 


That returns an error 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper










-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/c6b97adb/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 16 14:20:07 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 16 Jan 2009 17:20:07 -0500
Subject: [Casper] one of those days, can't remember syntax
In-Reply-To: <4970B134.7141.0039.0@kckps.org>
References: <49705804.7141.0039.0@kckps.org>
	<ec2e75ff0901160759y772b2cbay44031dc6585dea7e@mail.gmail.com>
	<49705BCA.7141.0039.0@kckps.org>
	<ec2e75ff0901160808l1bab54c9r53f6173ca8b63cdb@mail.gmail.com>
	<49705D4D.7141.0039.0@kckps.org>
	<ec2e75ff0901160818r230df99enc3de882ebee798b9@mail.gmail.com>
	<4970600C.7141.0039.0@kckps.org>
	<ec2e75ff0901161403m51066867hd741c924b3db0ca5@mail.gmail.com>
	<4970B134.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901161420l128b3253g91ccf71a691b8a86@mail.gmail.com>

What if the clever little hackers created admin accounts with homes
somewhere other than /Users?
That bit of code in the for statement grabs all members of the admin group
using dscl (except root - that was intentional to avoid any messiness),
regardless of where their home folder lives.  You also don't need to contend
with /Users/Shared this way.

Anyhow, enjoy the weekend.  Some of us corporate drones have Monday off too.
 :)

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 16, 2009 at 5:09 PM, Thomas Larkin <tlarki at kckps.org> wrote:

>  Thanks for that.
>
>  I am wondering if at one time they did promote them self to admin is all.
>  Also, by design in my image all proper admin accounts are stored in
> /private/var so any user in /Users should never be an admin account on the
> student machines.   Teacher machines do have a local admin account in /Users
> but there is also a hidden admin account on there as well.
>
>  All IT staff have access to the local hidden admin account.
>
>  So as long as the user lives in /Users I can demote it back to staff and
> get it out of the admin group.
>
>  Thanks for the replies, have a good weekend everyone.  Three day weekend
> for us people in education, gotta love those holidays we get off.
>
>  Later
>
>  Tom
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 4:03 PM >>>
>
> On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin
>
>  <tlarki at kckps.org>
>
>  wrote:
>
>>
>>  jamf listUsers returns the localized mobile account as having the <true>
>> value as the account being an admin
>>
>>
>>
>>  dscl . read /Groups/admin Does not list the account
>>
>
>   That's just odd.  Can you verify that these accounts actually have admin
> privileges?  Maybe someone at jamf can comment on how Casper determines
> whether an account is an admin?  At a confident guess, I'd say that the
> "jamf listUsers" information is only as good as your last Recon of that
> machine.  Are you updating inventory regularly?  I check the "update
> inventory" box on just about every policy I create to make sure I've got up
> to date information.
>
>
>   This weirdness aside for a moment, assuming you have an account that is
> verifiably a member of a group that you don't want it to be a part of, you
> can run this command to take it out of the group.
>
>
>   sudo dseditgroup -o edit -d <username to be removed from group> -t user
> <group>
>
>
>   The UUID method I mentioned earlier also ought to work, but I've tested
> the dseditgroup method this afternoon.
>
>
>   I assume that you've got some legitimate admins on the systems that
> you'd want to skip, so you could do something like...
>
>
>
>    for i in $( dscl . -read /Groups/admin| grep GroupMembership:| awk
> '{for (j=3; j<=NF; j++) printf " %s", $j; printf "\n" }' )
>
>   do
>
>     case $i in
>
>       <legitadmin1>)
>
>         done
>
>         ;;
>
>       <legitadmin2>)
>
>         done
>
>         ;;
>
>       *)
>
>         dseditgroup -o edit -d $i -t user admin
>
>         ;;
>
>     esac
>
>   done
>
>
>   Test, test, test.  Be very careful when editing your directory
> service.  You may want to create a new group to test with so you don't risk
> breaking the admin group or your legit admin accounts.
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Fri, Jan 16, 2009 at 11:23 AM, Thomas Larkin
>
> <tlarki at kckps.org>
>
> wrote:
>
>>  OK
>>
>>
>>  This is what confuses me and frightens me...
>>
>>
>>  jamf listUsers returns the localized mobile account as having the <true>
>> value as the account being an admin
>>
>>
>>  dscl . read /Groups/admin Does not list the account
>>
>>
>>  dscl . -delete /Groups/admin GroupMembership <shortname> or <UID>
>> returns an error that the attribute is not found, so I am guessing that
>> means that the account isn't in that group
>>
>>
>>
>>  Is this a bug with Casper?
>>
>>
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>>   >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:18 AM >>>
>>
>>
>> I'm not sure what's going on there, however I'm fairly certain that using
>> the GUID will get you where you need to be.
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>> www.themacadmin.com
>>
>>
>>
>>
>>
>>
>>   On Fri, Jan 16, 2009 at 11:11 AM, Thomas Larkin
>>
>> <tlarki at kckps.org>
>>
>> wrote:
>>
>>>  DS error -14134 (eDSAttributeNotFound)
>>>
>>>
>>>  If I do a dscl . list /Users UniqueID | grep <shortname> the user shows
>>> up with their GUID so I know that they are in fact there
>>>
>>>
>>>
>>>
>>> ___________________________
>>> Thomas Larkin
>>> TIS Department
>>> KCKPS USD500
>>> tlarki at kckps.org
>>> blackberry:  913-449-7589
>>> office:  913-627-0351
>>>
>>>
>>>
>>>
>>>
>>>   >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 10:08 AM >>>
>>>
>>>
>>>
>>> What error is your command returning?
>>>
>>> ----------
>>> Miles A. Leacy IV
>>>
>>> ? Certified System Administrator 10.4
>>> ? Certified Technical Coordinator 10.5
>>> ? Certified Trainer
>>> Certified Casper Administrator
>>> ----------
>>> voice: 1-347-277-7321
>>> miles.leacy at themacadmin.com
>>> www.themacadmin.com
>>>
>>>
>>>
>>>
>>>
>>>
>>>    On Fri, Jan 16, 2009 at 11:04 AM, Thomas Larkin
>>>
>>> <tlarki at kckps.org>
>>>
>>> wrote:
>>>
>>>>  These are Directory users that have promoted them self to admin via an
>>>> old test account and we are cleaning it up, would that make any difference?
>>>>
>>>>
>>>>  I would have sworn in the past I have used what I posted a few minutes
>>>> ago.
>>>>
>>>> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/16/09 9:59 AM >>>
>>>>
>>>>
>>>>    You need to use the GUID.  If I'm not mistaken, it's stored in the
>>>> user's record as the "GeneratedUID".
>>>>
>>>>
>>>>   dscl . -delete /Groups/<group> GroupMembers <GUID>
>>>>
>>>>
>>>>
>>>> ----------
>>>> Miles A. Leacy IV
>>>>
>>>> ? Certified System Administrator 10.4
>>>> ? Certified Technical Coordinator 10.5
>>>> ? Certified Trainer
>>>> Certified Casper Administrator
>>>> ----------
>>>> voice: 1-347-277-7321
>>>> miles.leacy at themacadmin.com
>>>> www.themacadmin.com
>>>>
>>>>
>>>>
>>>>
>>>>   2009/1/16 Thomas Larkin
>>>>
>>>> <tlarki at kckps.org>
>>>>
>>>>
>>>>   of dscl to remove someone from a group
>>>>>
>>>>>
>>>>>  I thought it was
>>>>>
>>>>>
>>>>>  sudo dscl . delete /Groups/admin GroupMembership <shortname>
>>>>>
>>>>>
>>>>>  That returns an error
>>>>>
>>>>>
>>>>> ___________________________
>>>>> Thomas Larkin
>>>>> TIS Department
>>>>> KCKPS USD500
>>>>> tlarki at kckps.org
>>>>> blackberry:  913-449-7589
>>>>> office:  913-627-0351
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Casper mailing list
>>>>> Casper at list.jamfsoftware.com
>>>>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>>>>
>>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090116/179f9b91/attachment.htm 

From CMyers at uclan.ac.uk  Mon Jan 19 03:46:39 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Mon, 19 Jan 2009 11:46:39 +0000
Subject: [Casper] imaging problem and recon
Message-ID: <4974681F.BB96.0081.0@uclan.ac.uk>

Hi All, 

I am trying to image a new imac and after imaging it doesnt get added to the JSS. 

The imaging log list the computer as 

Computer Deleted (ID: -1) 

When i run jamf recon on the local box it come back with bad username and password 

The image hasn't changed, the same configuration works fine on other computers, the log shows no errors 

Any ideas? 

Regards 

Criss 
Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090119/139ef0cd/attachment.htm 

From CMyers at uclan.ac.uk  Tue Jan 20 01:39:45 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Tue, 20 Jan 2009 09:39:45 +0000
Subject: [Casper] privilages for accounts in the JSS
Message-ID: <49759BE1.BB96.0081.0@uclan.ac.uk>

Hi Guys, 

I need to create a JSS user who can image computers but i dont want to give it any more privileges than needed, can you tell me what privileges I need to grant a user so they can image a mac via casper imaging from the client but dont need to do anything else. 

Cheers 

Criss 
Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/607c9f35/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan 20 05:25:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 20 Jan 2009 08:25:06 -0500
Subject: [Casper] privilages for accounts in the JSS
In-Reply-To: <49759BE1.BB96.0081.0@uclan.ac.uk>
References: <49759BE1.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901200525w60bdeb01le49aa72ca6e89393@mail.gmail.com>

In the account privileges tab, you're looking for the "Casper Imaging"
section (see attached screenshot).  The options seem fairly straightforward
as to what they do, just be sure to grant permission for specific actions
that may be part of your workflow, such as binding to AD.
I'm not sure if you'd need to grant Inventory search permissions to allow
the user to search machines within the Casper Imaging app.  If no one else
chimes in on this, it would be easy enough to test.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Criss Myers <CMyers at uclan.ac.uk>

>  Hi Guys,
>
>  I need to create a JSS user who can image computers but i dont want to
> give it any more privileges than needed, can you tell me what privileges I
> need to grant a user so they can image a mac via casper imaging from the
> client but dont need to do anything else.
>
>  Cheers
>
>  Criss
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/1d0f1da3/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture 1.png
Type: image/png
Size: 22765 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/1d0f1da3/attachment.png 

From miles.leacy at themacadmin.com  Tue Jan 20 05:31:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 20 Jan 2009 08:31:06 -0500
Subject: [Casper] imaging problem and recon
In-Reply-To: <4974681F.BB96.0081.0@uclan.ac.uk>
References: <4974681F.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901200531s128c3fc3o8e7caa13b66578a6@mail.gmail.com>

I haven't seen this before, but for troubleshooting, I'd try deleting the
computer's record from the JSS and the Recon preferences from the client
then run Recon on the client and see if the issue persists.
When deleting, search the JSS inventory using the client's MAC address and
make sure to delete any matching entries.  (you may want to record any
nonsystem data (username, location, asset tag, etc.) you may be storing in
the computer's record before deleting.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/19 Criss Myers <CMyers at uclan.ac.uk>

>  Hi All,
>
>  I am trying to image a new imac and after imaging it doesnt get added to
> the JSS.
>
>  The imaging log list the computer as
>
>  Computer Deleted (ID: -1)
>
>  When i run jamf recon on the local box it come back with bad username and
> password
>
>  The image hasn't changed, the same configuration works fine on other
> computers, the log shows no errors
>
>  Any ideas?
>
>  Regards
>
>  Criss
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/5cfa136e/attachment.htm 

From miles.leacy at themacadmin.com  Tue Jan 20 05:47:52 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 20 Jan 2009 08:47:52 -0500
Subject: [Casper] imaging problem and recon
In-Reply-To: <4975D2D2.BB96.0081.0@uclan.ac.uk>
References: <4974681F.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901200531s128c3fc3o8e7caa13b66578a6@mail.gmail.com>
	<4975D2D2.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901200547pa59cc4dqf3ceee2354091439@mail.gmail.com>

Take a look at the Recon privileges section in the account Privileges tab.
 You'll probably need to grant "Add Hardware" and/or "Add Computers
Remotely" to this user.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Tue, Jan 20, 2009 at 8:34 AM, Criss Myers <CMyers at uclan.ac.uk> wrote:

>  hi,
>
>  i completely re-imaged the mac and it did the same thing, and never add a
> record to the jss which is my prob, however i think it might be related to
> my last question about grant privileges to users to image macs, as i later
> re-imaged using my account which has full privileges and it worked first
> time.
>
>  so hopefully that will solve it
>
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
> >>> On Tue, Jan 20, 2009 at  1:31 PM, in message <
> ec2e75ff0901200531s128c3fc3o8e7caa13b66578a6 at mail.gmail.com>, Miles Leacy
> <miles.leacy at themacadmin.com> wrote:
>
>  I haven't seen this before, but for troubleshooting, I'd try deleting the
> computer's record from the JSS and the Recon preferences from the client
> then run Recon on the client and see if the issue persists.
>
>
>   When deleting, search the JSS inventory using the client's MAC address
> and make sure to delete any matching entries.  (you may want to record any
> nonsystem data (username, location, asset tag, etc.) you may be storing in
> the computer's record before deleting.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   2009/1/19 Criss Myers
>
> <CMyers at uclan.ac.uk>
>
>
>   Hi All,
>>
>>
>>  I am trying to image a new imac and after imaging it doesnt get added to
>> the JSS.
>>
>>
>>  The imaging log list the computer as
>>
>>
>>  Computer Deleted (ID: -1)
>>
>>
>>  When i run jamf recon on the local box it come back with bad username
>> and password
>>
>>
>>  The image hasn't changed, the same configuration works fine on other
>> computers, the log shows no errors
>>
>>
>>  Any ideas?
>>
>>
>>  Regards
>>
>>
>>  Criss
>>
>>
>> Criss Myers
>> Senior Customer Support Analyst (Mac Services)
>> Apple Certified Technical Coordinator v10.5
>> LIS Business Support Team
>> Library 301
>> University of Central Lancashire
>> Preston PR1 2HE
>> Ex 5054
>> 01772 895054
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/57b755ab/attachment.html 

From Dustin.Dorey at district196.org  Tue Jan 20 06:44:46 2009
From: Dustin.Dorey at district196.org (Dorey, Dustin)
Date: Tue, 20 Jan 2009 08:44:46 -0600
Subject: [Casper] Feature request Maybe
Message-ID: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org>

Hello there,

I was wondering if anyone knew of a good way to grab down information
that would normally be found in the System Profiler.

For example, with the growing list of possible bad hard drives from
Seagate and other companies I'd love to be able to create a smartlist
built around what machines have drives with certain model numbers.    

Does this sound crazy?   Or is there already a good way to do this that
I'm over looking?

 

Have a good one.

-Dusty-

 

Dustin  Dorey

Technology Support Cluster Specialist

ISD 196 Apple Valley, Eagan, Rosemount

dustin.dorey at district196.org

952|423|7971

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/a30e5727/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan 20 07:00:14 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 20 Jan 2009 10:00:14 -0500
Subject: [Casper] Feature request Maybe
In-Reply-To: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org>
Message-ID: <ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>

This would be a perfect problem to solve with scripts and dummy receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to install the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down information that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from Seagate
> and other companies I'd love to be able to create a smartlist built around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/5a99e258/attachment.html 

From tlarki at kckps.org  Tue Jan 20 08:55:32 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 20 Jan 2009 10:55:32 -0600
Subject: [Casper] Feature request Maybe
In-Reply-To: <ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org>
	<ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
Message-ID: <4975ADA4.7141.0039.0@kckps.org>

Yup, 

Just see the system_profile binary in terminal.  There are many data
types and that is how casper inventories machines.  You can use grep or
sed to get specific information and have it run as a policy or over ARD
Admin and run custom reports.

I did a custom report for battery information on laptops last year for
someone.  Can't remember what exactly I used syntax wise but it
basically pulled out how many power cycles the battery has had and its
current charge along with the computer name and serial number and then
dumped them into a spread sheet.

There is no way from the GUI to do this to my knowledge, so you may
have to get down and dirty with the command line. 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/20/09 9:00 AM >>> 
This would be a perfect problem to solve with scripts and dummy
receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to install
the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to
those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down information
that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from
Seagate
> and other companies I'd love to be able to create a smartlist built
around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this
that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>


From tlarki at kckps.org  Tue Jan 20 08:56:59 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 20 Jan 2009 10:56:59 -0600
Subject: [Casper] imaging problem and recon
In-Reply-To: <4974681F.BB96.0081.0@uclan.ac.uk>
References: <4974681F.BB96.0081.0@uclan.ac.uk>
Message-ID: <4975ADFB.7141.0039.0@kckps.org>

Did you change your casper account password for the machines?  If you changed the password for the account that casper uses for recon, inventory, imaging, etc then you will get that authentication error.

 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/19/09 5:46 AM >>> 
Hi All, 

I am trying to image a new imac and after imaging it doesnt get added to the JSS. 

The imaging log list the computer as 

Computer Deleted (ID: -1) 

When i run jamf recon on the local box it come back with bad username and password 

The image hasn't changed, the same configuration works fine on other computers, the log shows no errors 

Any ideas? 

Regards 

Criss 
Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054





From Dustin.Dorey at district196.org  Tue Jan 20 10:26:54 2009
From: Dustin.Dorey at district196.org (Dorey, Dustin)
Date: Tue, 20 Jan 2009 12:26:54 -0600
Subject: [Casper] Feature request Maybe
In-Reply-To: <4975ADA4.7141.0039.0@kckps.org>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org><ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
	<4975ADA4.7141.0039.0@kckps.org>
Message-ID: <DFFCE7044F8AFF41AB2262F92C78216208A81840@do-mail03.district196.org>

Looks like I'm going to have to script this out, thanks for the input folks.   I may have to use your idea on the battery cycles too as that will be good info as well.

Thanks again.
-Dusty-


Dustin  Dorey
Technology Support Cluster Specialist
ISD 196 Apple Valley, Eagan, Rosemount
dustin.dorey at district196.org
952|423|7971



-----Original Message-----
From: casper-bounces at list.jamfsoftware.com [mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Thomas Larkin
Sent: Tuesday, January 20, 2009 10:56 AM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: Re: [Casper] Feature request Maybe

Yup, 

Just see the system_profile binary in terminal.  There are many data
types and that is how casper inventories machines.  You can use grep or
sed to get specific information and have it run as a policy or over ARD
Admin and run custom reports.

I did a custom report for battery information on laptops last year for
someone.  Can't remember what exactly I used syntax wise but it
basically pulled out how many power cycles the battery has had and its
current charge along with the computer name and serial number and then
dumped them into a spread sheet.

There is no way from the GUI to do this to my knowledge, so you may
have to get down and dirty with the command line. 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/20/09 9:00 AM >>> 
This would be a perfect problem to solve with scripts and dummy
receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to install
the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to
those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down information
that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from
Seagate
> and other companies I'd love to be able to create a smartlist built
around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this
that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

From tlarki at kckps.org  Tue Jan 20 12:57:11 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Tue, 20 Jan 2009 14:57:11 -0600
Subject: [Casper] Feature request Maybe
In-Reply-To: <DFFCE7044F8AFF41AB2262F92C78216208A81840@do-mail03.district196.org>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org><ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
	<4975ADA4.7141.0039.0@kckps.org>
	<DFFCE7044F8AFF41AB2262F92C78216208A81840@do-mail03.district196.org>
Message-ID: <4975E647.7141.0039.0@kckps.org>

Due to our increasing number of drive failures in our laptops I too am
looking into what is causing it.  I do not know if the Seagate recall
affects laptop drives or not, but it is my most promising lead at the
moment. 

You could run a report that did this and it works for me so far 

system_profiler SPSerialATADataType -detaillevel mini 

Then you may want to input a variable of listed affected model numbers,
do an if then statement to see if the models match and then if they do,
to output that text to a log file or pipe out an email command so you
can inventory it. 

If you come up with anything please post it. 

Thanks, 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Dorey, Dustin" <Dustin.Dorey at district196.org> 01/20/09 12:26 PM >>>
Looks like I'm going to have to script this out, thanks for the input
folks.   I may have to use your idea on the battery cycles too as that
will be good info as well.

Thanks again.
-Dusty-


Dustin  Dorey
Technology Support Cluster Specialist
ISD 196 Apple Valley, Eagan, Rosemount
dustin.dorey at district196.org
952|423|7971



-----Original Message-----
From: casper-bounces at list.jamfsoftware.com
[mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Thomas Larkin
Sent: Tuesday, January 20, 2009 10:56 AM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: Re: [Casper] Feature request Maybe

Yup,

Just see the system_profile binary in terminal.  There are many data
types and that is how casper inventories machines.  You can use grep or
sed to get specific information and have it run as a policy or over ARD
Admin and run custom reports.

I did a custom report for battery information on laptops last year for
someone.  Can't remember what exactly I used syntax wise but it
basically pulled out how many power cycles the battery has had and its
current charge along with the computer name and serial number and then
dumped them into a spread sheet.

There is no way from the GUI to do this to my knowledge, so you may
have to get down and dirty with the command line.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/20/09 9:00 AM >>>
This would be a perfect problem to solve with scripts and dummy
receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to install
the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to
those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down information
that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from
Seagate
> and other companies I'd love to be able to create a smartlist built
around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this
that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftwar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/f7d5560a/attachment.html 

From Dustin.Dorey at district196.org  Tue Jan 20 13:06:06 2009
From: Dustin.Dorey at district196.org (Dorey, Dustin)
Date: Tue, 20 Jan 2009 15:06:06 -0600
Subject: [Casper] Feature request Maybe
In-Reply-To: <4975E647.7141.0039.0@kckps.org>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org><ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
	<4975ADA4.7141.0039.0@kckps.org>
	<DFFCE7044F8AFF41AB2262F92C78216208A81840@do-mail03.district196.org>
	<4975E647.7141.0039.0@kckps.org>
Message-ID: <DFFCE7044F8AFF41AB2262F92C78216208A81A0D@do-mail03.district196.org>

The most recent issue with the Seagate drives affects drives produced in December, so I?m not sure how many are ?in the wild? and where they are.   But there was an article in tuaw today about it and it links to the Seagate Knowledge Base and such.   I was earlier thinking more in terms of that bad batch of drives that was known to have gone into macbooks about 18 months ago or so.    We had one school that had about a 30% failure rate on HD?s in Macbooks in less than 18 months which seems high.  And even in our office out of 4 Macboks purchased the summer of 07 three have had the Hard drives replaced.  So I am looking into more in depth reports on the laptops.

http://www.tuaw.com/2009/01/19/tick-tick-tick-significant-number-of-seagate-hard-drives-fail/

-Dusty-

 

Dustin  Dorey

Technology Support Cluster Specialist

ISD 196 Apple Valley, Eagan, Rosemount

dustin.dorey at district196.org

952|423|7971

 

 

 

From: Thomas Larkin [mailto:tlarki at kckps.org] 
Sent: Tuesday, January 20, 2009 2:57 PM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: RE: [Casper] Feature request Maybe

 

Due to our increasing number of drive failures in our laptops I too am looking into what is causing it.  I do not know if the Seagate recall affects laptop drives or not, but it is my most promising lead at the moment. 

 

You could run a report that did this and it works for me so far 

 

system_profiler SPSerialATADataType -detaillevel mini 

 

Then you may want to input a variable of listed affected model numbers, do an if then statement to see if the models match and then if they do, to output that text to a log file or pipe out an email command so you can inventory it. 

 

If you come up with anything please post it. 

 

Thanks, 

 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Dorey, Dustin" <Dustin.Dorey at district196.org> 01/20/09 12:26 PM >>>
Looks like I'm going to have to script this out, thanks for the input folks.   I may have to use your idea on the battery cycles too as that will be good info as well.

Thanks again.
-Dusty-


Dustin  Dorey
Technology Support Cluster Specialist
ISD 196 Apple Valley, Eagan, Rosemount
dustin.dorey at district196.org
952|423|7971



-----Original Message-----
From: casper-bounces at list.jamfsoftware.com [mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Thomas Larkin
Sent: Tuesday, January 20, 2009 10:56 AM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: Re: [Casper] Feature request Maybe

Yup,

Just see the system_profile binary in terminal.  There are many data
types and that is how casper inventories machines.  You can use grep or
sed to get specific information and have it run as a policy or over ARD
Admin and run custom reports.

I did a custom report for battery information on laptops last year for
someone.  Can't remember what exactly I used syntax wise but it
basically pulled out how many power cycles the battery has had and its
current charge along with the computer name and serial number and then
dumped them into a spread sheet.

There is no way from the GUI to do this to my knowledge, so you may
have to get down and dirty with the command line.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/20/09 9:00 AM >>>
This would be a perfect problem to solve with scripts and dummy
receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to install
the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to
those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down information
that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from
Seagate
> and other companies I'd love to be able to create a smartlist built
around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this
that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090120/4898f6cc/attachment.html 

From ganderson at phrd.ab.ca  Wed Jan 21 12:35:46 2009
From: ganderson at phrd.ab.ca (Gene Anderson)
Date: Wed, 21 Jan 2009 13:35:46 -0700
Subject: [Casper]  Flushing User Caches
Message-ID: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>

Good day to all!

I'm looking to find a script/policy/action that would on a user login flush the user's cache folder. Specifically I'd like to dump the Safari cache, but I'll settle for flushing the entire cache folder. I'd like to do it on login rather than logout. I tried using the JamF flushusercaches.sh script that is included with the downloadable Resource kit, but it doesn't seem to want to work, and policy log only indicates script execution and no other details. I tried my own custom script, but it didn't
seem to work either as it executes at a system level rather than as the logged in user. 

I'd like to do this with Casper if possible as I don't have access for an OpenDirectory server for all my users. Any suggestions on the best way to do this would be appreciated. 



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



From tlarki at kckps.org  Wed Jan 21 12:50:48 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 14:50:48 -0600
Subject: [Casper] Flushing User Caches
In-Reply-To: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
Message-ID: <49773648.7141.0039.0@kckps.org>

Gene,

What you can do is have a policy set for log in via JSS web front end and have it execute the script.  Can you post your script?  I assume removing the temp and cache files the application will create new ones upon next launch, and they are stored in that user's home directory.  So you can wild card or loop it for user's that are located in /Users and exclude shared if need be.

Thanks, 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Gene Anderson" <ganderson at phrd.ab.ca> 01/21/09 2:35 PM >>> 
Good day to all!

I'm looking to find a script/policy/action that would on a user login flush the user's cache folder. Specifically I'd like to dump the Safari cache, but I'll settle for flushing the entire cache folder. I'd like to do it on login rather than logout. I tried using the JamF flushusercaches.sh script that is included with the downloadable Resource kit, but it doesn't seem to want to work, and policy log only indicates script execution and no other details. I tried my own custom script, but it didn't
seem to work either as it executes at a system level rather than as the logged in user. 

I'd like to do this with Casper if possible as I don't have access for an OpenDirectory server for all my users. Any suggestions on the best way to do this would be appreciated. 



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


From tlarki at kckps.org  Wed Jan 21 12:53:57 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 14:53:57 -0600
Subject: [Casper] Feature request Maybe
In-Reply-To: <DFFCE7044F8AFF41AB2262F92C78216208A81A0D@do-mail03.district196.org>
References: <DFFCE7044F8AFF41AB2262F92C78216208A815A8@do-mail03.district196.org><ec2e75ff0901200700n6e518cefl6f3c6983cdda0de@mail.gmail.com>
	<4975ADA4.7141.0039.0@kckps.org>
	<DFFCE7044F8AFF41AB2262F92C78216208A81840@do-mail03.district196.org>
	<4975E647.7141.0039.0@kckps.org>
	<DFFCE7044F8AFF41AB2262F92C78216208A81A0D@do-mail03.district196.org>
Message-ID: <49773705.7141.0039.0@kckps.org>

We partnered with a local apple authorized service center to do all of
our warranty work as we do not have the staff to do hardware repairs on
6,000 Macbooks.  I asked them if this was maybe related to our HD
failures, they said they don't get seagate HDs from Apple.  They for the
most part get Samsung and Hitachi.  

I am seeing lots and lots of HD failures though like the issue
explained which makes me think maybe it is a chip level problem since
probably only maybe one or two companies actually develop the HD
components them self.

Keep us posted what you find. 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Dorey, Dustin" <Dustin.Dorey at district196.org> 01/20/09 3:06 PM >>>

The most recent issue with the Seagate drives affects drives produced
in December, so I?m not sure how many are ?in the wild? and where
they are.   But there was an article in tuaw today about it and it links
to the Seagate Knowledge Base and such.   I was earlier thinking more in
terms of that bad batch of drives that was known to have gone into
macbooks about 18 months ago or so.    We had one school that had about
a 30% failure rate on HD?s in Macbooks in less than 18 months which
seems high.  And even in our office out of 4 Macboks purchased the
summer of 07 three have had the Hard drives replaced.  So I am looking
into more in depth reports on the laptops.

http://www.tuaw.com/2009/01/19/tick-tick-tick-significant-number-of-seagate-hard-drives-fail/

-Dusty-

 

Dustin  Dorey

Technology Support Cluster Specialist

ISD 196 Apple Valley, Eagan, Rosemount

dustin.dorey at district196.org

952|423|7971

 

 

 

From: Thomas Larkin [mailto:tlarki at kckps.org] 
Sent: Tuesday, January 20, 2009 2:57 PM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: RE: [Casper] Feature request Maybe

 

Due to our increasing number of drive failures in our laptops I too am
looking into what is causing it.  I do not know if the Seagate recall
affects laptop drives or not, but it is my most promising lead at the
moment. 

 

You could run a report that did this and it works for me so far 

 

system_profiler SPSerialATADataType -detaillevel mini 

 

Then you may want to input a variable of listed affected model numbers,
do an if then statement to see if the models match and then if they do,
to output that text to a log file or pipe out an email command so you
can inventory it. 

 

If you come up with anything please post it. 

 

Thanks, 

 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Dorey, Dustin" <Dustin.Dorey at district196.org> 01/20/09 12:26 PM
>>>
Looks like I'm going to have to script this out, thanks for the input
folks.   I may have to use your idea on the battery cycles too as that
will be good info as well.

Thanks again.
-Dusty-


Dustin  Dorey
Technology Support Cluster Specialist
ISD 196 Apple Valley, Eagan, Rosemount
dustin.dorey at district196.org
952|423|7971



-----Original Message-----
From: casper-bounces at list.jamfsoftware.com
[mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Thomas
Larkin
Sent: Tuesday, January 20, 2009 10:56 AM
To: Dorey, Dustin; Miles Leacy
Cc: Jamf List Serve
Subject: Re: [Casper] Feature request Maybe

Yup,

Just see the system_profile binary in terminal.  There are many data
types and that is how casper inventories machines.  You can use grep
or
sed to get specific information and have it run as a policy or over
ARD
Admin and run custom reports.

I did a custom report for battery information on laptops last year for
someone.  Can't remember what exactly I used syntax wise but it
basically pulled out how many power cycles the battery has had and its
current charge along with the computer name and serial number and then
dumped them into a spread sheet.

There is no way from the GUI to do this to my knowledge, so you may
have to get down and dirty with the command line.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/20/09 9:00 AM >>>
This would be a perfect problem to solve with scripts and dummy
receipts.
Capture the output of:

system_profiler SPSerialATADataType

grep for the model number.  If found, issue a custom trigger to
install
the
dummy receipt.  If not found, delete the dummy receipt.

Scope your smart group of "machines with suspect Seagate drives" to
those
with this receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/20 Dorey, Dustin <Dustin.Dorey at district196.org>

>  Hello there,
>
> I was wondering if anyone knew of a good way to grab down
information
that
> would normally be found in the System Profiler.
>
> For example, with the growing list of possible bad hard drives from
Seagate
> and other companies I'd love to be able to create a smartlist built
around
> what machines have drives with certain model numbers.
>
> Does this sound crazy?   Or is there already a good way to do this
that I'm
> over looking?
>
>
>
> Have a good one.
>
> -Dusty-
>
>
>
> *Dustin  Dorey*
>
> *Technology Support Cluster Specialist*
>
> *ISD 196 Apple Valley, Eagan, Rosemount*
>
> *dustin.dorey at district196.org*
>
> *952|423|7971*
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper



From ganderson at phrd.ab.ca  Wed Jan 21 12:58:30 2009
From: ganderson at phrd.ab.ca (Gene Anderson)
Date: Wed, 21 Jan 2009 13:58:30 -0700
Subject: [Casper] Flushing User Caches
In-Reply-To: <49773648.7141.0039.0@kckps.org>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
Message-ID: <fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>

"Thomas Larkin" <tlarki at kckps.org> writes:
>What you can do is have a policy set for log in via JSS web front end and have it execute the script.  Can you post your script? 

rm -Rf ~/Library/Caches/Safari/*

> I assume removing the temp and cache files the application will create new ones upon next launch, and they are stored in that user's home directory.  

yes. I'm mostly interested in the Safari cache. 

>So you can wild card or loop it for user's that are located in /Users and exclude shared if need be.

Casper policy is set to execute on login, frequency ongoing, scope for all desired machines, and the script is specified in the Scripts tab.

Do I have to specify any of the extra paramter options?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



From craig at creativetechs.com  Wed Jan 21 13:21:57 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Wed, 21 Jan 2009 13:21:57 -0800
Subject: [Casper] Policy to Disable Automatic Updates?
Message-ID: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>

Hi, this is my first post to the Casper list. I'm hoping someone else  
has already got an easy answer documented.

We want a series of policies that disables/turns-off automatic updates  
for:

- Apple Software Update
- Microsoft Office (2004 and 2008)
- Adobe Creative Suite (CS3 and CS4)

Does anyone already have an existing script or solution?

Thanks!

~Craig Swanson

---
Phone: 206-682-4315
Email: help at creativetechs.com
Web: www.creativetechs.com
Tagline: Left-brain support for Right-brain Pros.


From miles.leacy at themacadmin.com  Wed Jan 21 13:30:15 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 16:30:15 -0500
Subject: [Casper] Flushing User Caches
In-Reply-To: <fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
	<fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
Message-ID: <ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>

I see two problems with your script...

1. I don't believe "~" will work in your script since it's run by root.  I
use the Casper variables to indicate "the home folder of the account logged
in (or being logged in).  See my commands below.
2. If your clients are Leopard clients, you won't find anything at
~/Library/Caches/Safari/.  See below for the locations to be concerned with.

If you want to emulate the "Reset Safari" menu item put this in your script
instead:

m -Rf /Users/$3/Library/Cookies/*
m -Rf /Users/$3/Library/Safari/*
rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist

You will, of course, need to reset any preferences you did want in there
such as a default home page.  You can do this with "defaults write" or
"PlistBuddy" at the end of your script.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 3:58 PM, Gene Anderson <ganderson at phrd.ab.ca> wrote:

> "Thomas Larkin" <tlarki at kckps.org> writes:
> >What you can do is have a policy set for log in via JSS web front end and
> have it execute the script.  Can you post your script?
>
> rm -Rf ~/Library/Caches/Safari/*
>
> > I assume removing the temp and cache files the application will create
> new ones upon next launch, and they are stored in that user's home
> directory.
>
> yes. I'm mostly interested in the Safari cache.
>
> >So you can wild card or loop it for user's that are located in /Users and
> exclude shared if need be.
>
> Casper policy is set to execute on login, frequency ongoing, scope for all
> desired machines, and the script is specified in the Scripts tab.
>
> Do I have to specify any of the extra paramter options?
>
>
>
> Gene Anderson
> Systems Analyst, ACTC, MCP
> Pembina Hills Regional Division No.7
> Phone: (780) 674-8535 ext 6860
> email: ganderson at phrd.ab.ca
>
> "Passwords are like bubble gum, strongest when fresh, should never be
> used by groups and create a sticky mess when left laying around"
>
> -anon
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/1f322460/attachment.html 

From tlarki at kckps.org  Wed Jan 21 13:42:56 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 15:42:56 -0600
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
	<fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
	<ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
Message-ID: <49774280.7141.0039.0@kckps.org>

Yeah, the tidal can be a weird thing when it comes to syntax which I
have found out the hard way.  You can create a variable and that seems
to do it.

I would write the script like this personally:

#!/bin/sh

#go through user's home folder and get rid of cache files

home=~
file="   
        $home/Library/Cookies/*
        $home/Library/Safari/*
        $home/Library/Caches/Metadata/Safari/*
        $home/Library/Preferences/com.apple.Safari.plist
        $home/Library/Preferences/com.apple.Safari.RSS.plist
      "

for file in $file

   do

   if  [[ -e $file ]]

   then 

         rm -rf $file

   else 0

        echo "no file found"

done
exit

Of course I haven't quite tested it and you may need to tweak it, but
that is a quick and non tested version of what I would attempt at
doing.
 
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/21/09 3:30 PM >>> 
I see two problems with your script...

1. I don't believe "~" will work in your script since it's run by root.
 I
use the Casper variables to indicate "the home folder of the account
logged
in (or being logged in).  See my commands below.
2. If your clients are Leopard clients, you won't find anything at
~/Library/Caches/Safari/.  See below for the locations to be concerned
with.

If you want to emulate the "Reset Safari" menu item put this in your
script
instead:

m -Rf /Users/$3/Library/Cookies/*
m -Rf /Users/$3/Library/Safari/*
rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist

You will, of course, need to reset any preferences you did want in
there
such as a default home page.  You can do this with "defaults write" or
"PlistBuddy" at the end of your script.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 3:58 PM, Gene Anderson <ganderson at phrd.ab.ca>
wrote:

> "Thomas Larkin" <tlarki at kckps.org> writes:
> >What you can do is have a policy set for log in via JSS web front
end and
> have it execute the script.  Can you post your script?
>
> rm -Rf ~/Library/Caches/Safari/*
>
> > I assume removing the temp and cache files the application will
create
> new ones upon next launch, and they are stored in that user's home
> directory.
>
> yes. I'm mostly interested in the Safari cache.
>
> >So you can wild card or loop it for user's that are located in
/Users and
> exclude shared if need be.
>
> Casper policy is set to execute on login, frequency ongoing, scope
for all
> desired machines, and the script is specified in the Scripts tab.
>
> Do I have to specify any of the extra paramter options?
>
>
>
> Gene Anderson
> Systems Analyst, ACTC, MCP
> Pembina Hills Regional Division No.7
> Phone: (780) 674-8535 ext 6860
> email: ganderson at phrd.ab.ca
>
> "Passwords are like bubble gum, strongest when fresh, should never
be
> used by groups and create a sticky mess when left laying around"
>
> -anon
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>


From tlarki at kckps.org  Wed Jan 21 13:53:41 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 15:53:41 -0600
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
	<fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
	<ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
Message-ID: <49774505.7141.0039.0@kckps.org>

Forgot to mention, this is written as a log in hook, so the it will pull
the current user's home directory.  If you run it otherwise it won't
work as it will look for root's home since it will be running most
likely as root.  
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/21/09 3:30 PM >>> 
I see two problems with your script...

1. I don't believe "~" will work in your script since it's run by root.
 I
use the Casper variables to indicate "the home folder of the account
logged
in (or being logged in).  See my commands below.
2. If your clients are Leopard clients, you won't find anything at
~/Library/Caches/Safari/.  See below for the locations to be concerned
with.

If you want to emulate the "Reset Safari" menu item put this in your
script
instead:

m -Rf /Users/$3/Library/Cookies/*
m -Rf /Users/$3/Library/Safari/*
rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist

You will, of course, need to reset any preferences you did want in
there
such as a default home page.  You can do this with "defaults write" or
"PlistBuddy" at the end of your script.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 3:58 PM, Gene Anderson <ganderson at phrd.ab.ca>
wrote:

> "Thomas Larkin" <tlarki at kckps.org> writes:
> >What you can do is have a policy set for log in via JSS web front
end and
> have it execute the script.  Can you post your script?
>
> rm -Rf ~/Library/Caches/Safari/*
>
> > I assume removing the temp and cache files the application will
create
> new ones upon next launch, and they are stored in that user's home
> directory.
>
> yes. I'm mostly interested in the Safari cache.
>
> >So you can wild card or loop it for user's that are located in
/Users and
> exclude shared if need be.
>
> Casper policy is set to execute on login, frequency ongoing, scope
for all
> desired machines, and the script is specified in the Scripts tab.
>
> Do I have to specify any of the extra paramter options?
>
>
>
> Gene Anderson
> Systems Analyst, ACTC, MCP
> Pembina Hills Regional Division No.7
> Phone: (780) 674-8535 ext 6860
> email: ganderson at phrd.ab.ca
>
> "Passwords are like bubble gum, strongest when fresh, should never
be
> used by groups and create a sticky mess when left laying around"
>
> -anon
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>


From miles.leacy at themacadmin.com  Wed Jan 21 14:11:23 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 17:11:23 -0500
Subject: [Casper] Flushing User Caches
In-Reply-To: <49774505.7141.0039.0@kckps.org>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
	<fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
	<ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
	<49774505.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>

When you run a script via a Casper policy, $3 = the user's shortname.  This
is why I structure my commands to target /Users/$3/
This may be a matter of preference, but I would skip the $file variable and
the for loop in this case.  We're operating on known values.  To me, at
least, it seems unnecessary to declare $file and then set up a for/if
structure when we can just operate on each item and save lines.

The script below accomplishes the goal with just a few lines and is set up
to be run as part of a Casper policy triggered by login.

## Start script
#!/bin/bash

m -Rf /Users/$3/Library/Cookies/*
m -Rf /Users/$3/Library/Safari/*
rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist

## End script

I save "for" loops for situations where you need to discover the item to act
upon, i.e.
for i in $( dscl . -read /Groups/admin| grep GroupMembership:| awk '{for (j=3;
j<=NF; j++) printf " %s", $j; printf "\n" }' )
to get a list of all members of the admin group, other than root.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 4:53 PM, Thomas Larkin <tlarki at kckps.org> wrote:

> Forgot to mention, this is written as a log in hook, so the it will pull
> the current user's home directory.  If you run it otherwise it won't
> work as it will look for root's home since it will be running most
> likely as root.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/21/09 3:30 PM >>>
> I see two problems with your script...
>
> 1. I don't believe "~" will work in your script since it's run by root.
>  I
> use the Casper variables to indicate "the home folder of the account
> logged
> in (or being logged in).  See my commands below.
> 2. If your clients are Leopard clients, you won't find anything at
> ~/Library/Caches/Safari/.  See below for the locations to be concerned
> with.
>
> If you want to emulate the "Reset Safari" menu item put this in your
> script
> instead:
>
> m -Rf /Users/$3/Library/Cookies/*
> m -Rf /Users/$3/Library/Safari/*
> rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
> rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
> rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist
>
> You will, of course, need to reset any preferences you did want in
> there
> such as a default home page.  You can do this with "defaults write" or
> "PlistBuddy" at the end of your script.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Wed, Jan 21, 2009 at 3:58 PM, Gene Anderson <ganderson at phrd.ab.ca>
> wrote:
>
> > "Thomas Larkin" <tlarki at kckps.org> writes:
> > >What you can do is have a policy set for log in via JSS web front
> end and
> > have it execute the script.  Can you post your script?
> >
> > rm -Rf ~/Library/Caches/Safari/*
> >
> > > I assume removing the temp and cache files the application will
> create
> > new ones upon next launch, and they are stored in that user's home
> > directory.
> >
> > yes. I'm mostly interested in the Safari cache.
> >
> > >So you can wild card or loop it for user's that are located in
> /Users and
> > exclude shared if need be.
> >
> > Casper policy is set to execute on login, frequency ongoing, scope
> for all
> > desired machines, and the script is specified in the Scripts tab.
> >
> > Do I have to specify any of the extra paramter options?
> >
> >
> >
> > Gene Anderson
> > Systems Analyst, ACTC, MCP
> > Pembina Hills Regional Division No.7
> > Phone: (780) 674-8535 ext 6860
> > email: ganderson at phrd.ab.ca
> >
> > "Passwords are like bubble gum, strongest when fresh, should never
> be
> > used by groups and create a sticky mess when left laying around"
> >
> > -anon
> >
> >
> > _______________________________________________
> > Casper mailing list
> > Casper at list.jamfsoftware.com
> > http://list.jamfsoftware.com/mailman/listinfo/casper
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/c155b06c/attachment.htm 

From tlarki at kckps.org  Wed Jan 21 14:20:08 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 16:20:08 -0600
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
References: <fc.000f4ccf020234f6000f4ccf020234f6.2023641@phrd.ab.ca>
	<49773648.7141.0039.0@kckps.org>
	<fc.000f4ccf02023cad000f4ccf020234f6.2023d72@phrd.ab.ca>
	<ec2e75ff0901211330l504eca6m685a6c06f7e72145@mail.gmail.com>
	<49774505.7141.0039.0@kckps.org>
	<ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
Message-ID: <49774B38.7141.0039.0@kckps.org>

I just like using loops because I can change the rm -rf command to ls
-al for testing purposes and I don't have to rewrite a bunch of lines of
code, and I can use a large list of file paths.   That way nothing is
harmed.  Also, when working in home directories users can change things
around, so sometimes I use if and the touch command so if they rename
the file, then I create it, if the file exists then I delete it.

I have had users rename files for only god knows why in their home
directory.   Luckily none of my users by default have terminal access.

Your method works out fine as well, it is purely a preference thing.  I
sometimes also like to add a bit of chatting to my scripts so logs tell
me what they do, also a preference.
 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/21/09 4:11 PM >>> 
When you run a script via a Casper policy, $3 = the user's shortname. 
This
is why I structure my commands to target /Users/$3/
This may be a matter of preference, but I would skip the $file variable
and
the for loop in this case.  We're operating on known values.  To me,
at
least, it seems unnecessary to declare $file and then set up a for/if
structure when we can just operate on each item and save lines.

The script below accomplishes the goal with just a few lines and is set
up
to be run as part of a Casper policy triggered by login.

## Start script
#!/bin/bash

m -Rf /Users/$3/Library/Cookies/*
m -Rf /Users/$3/Library/Safari/*
rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist

## End script

I save "for" loops for situations where you need to discover the item
to act
upon, i.e.
for i in $( dscl . -read /Groups/admin| grep GroupMembership:| awk
'{for (j=3;
j<=NF; j++) printf " %s", $j; printf "\n" }' )
to get a list of all members of the admin group, other than root.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 4:53 PM, Thomas Larkin <tlarki at kckps.org>
wrote:

> Forgot to mention, this is written as a log in hook, so the it will
pull
> the current user's home directory.  If you run it otherwise it won't
> work as it will look for root's home since it will be running most
> likely as root.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/21/09 3:30 PM >>>
> I see two problems with your script...
>
> 1. I don't believe "~" will work in your script since it's run by
root.
>  I
> use the Casper variables to indicate "the home folder of the account
> logged
> in (or being logged in).  See my commands below.
> 2. If your clients are Leopard clients, you won't find anything at
> ~/Library/Caches/Safari/.  See below for the locations to be
concerned
> with.
>
> If you want to emulate the "Reset Safari" menu item put this in your
> script
> instead:
>
> m -Rf /Users/$3/Library/Cookies/*
> m -Rf /Users/$3/Library/Safari/*
> rm -Rf /Users/$3/Library/Caches/Metadata/Safari/*
> rm -f /Users/$3/Library/Preferences/com.apple.Safari.plist
> rm -f /Users/$3/Library/Preferences/com.apple.Safari.RSS.plist
>
> You will, of course, need to reset any preferences you did want in
> there
> such as a default home page.  You can do this with "defaults write"
or
> "PlistBuddy" at the end of your script.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Wed, Jan 21, 2009 at 3:58 PM, Gene Anderson
<ganderson at phrd.ab.ca>
> wrote:
>
> > "Thomas Larkin" <tlarki at kckps.org> writes:
> > >What you can do is have a policy set for log in via JSS web front
> end and
> > have it execute the script.  Can you post your script?
> >
> > rm -Rf ~/Library/Caches/Safari/*
> >
> > > I assume removing the temp and cache files the application will
> create
> > new ones upon next launch, and they are stored in that user's home
> > directory.
> >
> > yes. I'm mostly interested in the Safari cache.
> >
> > >So you can wild card or loop it for user's that are located in
> /Users and
> > exclude shared if need be.
> >
> > Casper policy is set to execute on login, frequency ongoing, scope
> for all
> > desired machines, and the script is specified in the Scripts tab.
> >
> > Do I have to specify any of the extra paramter options?
> >
> >
> >
> > Gene Anderson
> > Systems Analyst, ACTC, MCP
> > Pembina Hills Regional Division No.7
> > Phone: (780) 674-8535 ext 6860
> > email: ganderson at phrd.ab.ca
> >
> > "Passwords are like bubble gum, strongest when fresh, should never
> be
> > used by groups and create a sticky mess when left laying around"
> >
> > -anon
> >
> >
> > _______________________________________________
> > Casper mailing list
> > Casper at list.jamfsoftware.com
> > http://list.jamfsoftware.com/mailman/listinfo/casper
> >
>
>


From miles.leacy at themacadmin.com  Wed Jan 21 14:29:33 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 17:29:33 -0500
Subject: [Casper] Policy to Disable Automatic Updates?
In-Reply-To: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
References: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
Message-ID: <ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>

Test this, I'm writing it from memory.

Software Update:
defaults -currentHost write com.apple.SoftwareUpdate AutomaticDownload -bool
false

Office 2008:

defaults write com.microsoft.autoupdate2 HowToCheck -string "Manual"

I don't recall Adobe or Office 2004 offhand.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 4:21 PM, Craig Swanson <craig at creativetechs.com>wrote:

> Hi, this is my first post to the Casper list. I'm hoping someone else
> has already got an easy answer documented.
>
> We want a series of policies that disables/turns-off automatic updates
> for:
>
> - Apple Software Update
> - Microsoft Office (2004 and 2008)
> - Adobe Creative Suite (CS3 and CS4)
>
> Does anyone already have an existing script or solution?
>
> Thanks!
>
> ~Craig Swanson
>
> ---
> Phone: 206-682-4315
> Email: help at creativetechs.com
> Web: www.creativetechs.com
> Tagline: Left-brain support for Right-brain Pros.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/dd1eebd8/attachment.html 

From craig at creativetechs.com  Wed Jan 21 14:34:14 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Wed, 21 Jan 2009 14:34:14 -0800
Subject: [Casper] Policy to Disable Automatic Updates?
In-Reply-To: <ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
References: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
	<ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
Message-ID: <11D896E6-4E7F-44C8-AA8D-81E9EFB97555@creativetechs.com>

Thanks Miles,

We'll test and post the results.

~Craig

On Jan 21, 2009, at 2:29 PM, Miles Leacy wrote:

> Test this, I'm writing it from memory.
>
> Software Update:
>
> defaults -currentHost write com.apple.SoftwareUpdate  
> AutomaticDownload -bool false
>
> Office 2008:
>
> defaults write com.microsoft.autoupdate2 HowToCheck -string "Manual"
>
> I don't recall Adobe or Office 2004 offhand.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Wed, Jan 21, 2009 at 4:21 PM, Craig Swanson <craig at creativetechs.com 
> > wrote:
> Hi, this is my first post to the Casper list. I'm hoping someone else
> has already got an easy answer documented.
>
> We want a series of policies that disables/turns-off automatic updates
> for:
>
> - Apple Software Update
> - Microsoft Office (2004 and 2008)
> - Adobe Creative Suite (CS3 and CS4)
>
> Does anyone already have an existing script or solution?
>
> Thanks!
>
> ~Craig Swanson
>
> ---
> Phone: 206-682-4315
> Email: help at creativetechs.com
> Web: www.creativetechs.com
> Tagline: Left-brain support for Right-brain Pros.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>


From Rich.Dagel at landor.com  Wed Jan 21 15:23:50 2009
From: Rich.Dagel at landor.com (Dagel, Rich)
Date: Wed, 21 Jan 2009 15:23:50 -0800
Subject: [Casper] Master Image Creation Checklist
Message-ID: <C59CEE86.24A3F%Rich.Dagel@landor.com>

I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/70cc3f25/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/70cc3f25/attachment.gif 

From tlarki at kckps.org  Wed Jan 21 15:43:34 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 21 Jan 2009 17:43:34 -0600
Subject: [Casper] Master Image Creation Checklist
Message-ID: <49775EA9020000390000812D@gwoes4.kckps.org>

I am currently on hold on my cell phone calling a utilities company so I am very bored and can't do anything.  I am also not in my office so I don't have my complete list of notes on my image handy but I can give you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from /Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a symbolic link to the file in question typically in /Users/shared so no one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
14)  Test with a test account to make sure mobile accounts sync, then of course delete said account
15)  Triple check that everything works, log ins, group policy and MCX, apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front of me, that is basically the idea though.  I also have a few post image scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com



From miles.leacy at themacadmin.com  Wed Jan 21 16:14:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 19:14:06 -0500
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <C59CEE86.24A3F%Rich.Dagel@landor.com>
References: <C59CEE86.24A3F%Rich.Dagel@landor.com>
Message-ID: <ec2e75ff0901211614s7ee3f81fub2b733a3595857e5@mail.gmail.com>

If we're talking about a base OS image, I do very little...
1. Perform OS custom install with all selectable options turned off.
2. Run latest Mac OS Combo updater
3. Go through Setup Assistant, create primary IT admin account.
4. Turn on SSH (Remote Login) and ARD (both for admin account only).
5. Change machine name to "unmanagedclient"

That's it.  Everything else is done via packages or scripts.  I believe in
keeping it as modular as possible.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/21 Dagel, Rich <Rich.Dagel at landor.com>

>  I am updating my documentation on master image creation.  Just wondering
> what others are doing to customize their master image.  Such as:
> Turning of external accounts,
> Setting time machine to not offer new disks for backup
> Deleting networkinterfaces plist
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> **Rich.Dagel at landor.com*
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/c28b9411/attachment.htm 

From miles.leacy at themacadmin.com  Wed Jan 21 18:36:20 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 21:36:20 -0500
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <C59CFE69.24A4F%Rich.Dagel@landor.com>
References: <ec2e75ff0901211614s7ee3f81fub2b733a3595857e5@mail.gmail.com>
	<C59CFE69.24A4F%Rich.Dagel@landor.com>
Message-ID: <ec2e75ff0901211836p7185eecdl6a2220838dc7572d@mail.gmail.com>

I have yet to encounter any LKDC problems, however, they have been widely
reported and I have no reason to believe that these reports are bogus.
 Therefore, in the interest of eliminating potential problems, I see
destroying the LKDC as a best practice.  You can do this before creating
your base image, or you can do it as an "after" script in your
configuration.
Guess which I prefer.  :)

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Wed, Jan 21, 2009 at 7:31 PM, Dagel, Rich <Rich.Dagel at landor.com> wrote:

>  I have been hearing things about AD machine passwords timing out and you
> should set it not to when binding to the AD.  And also local that the local
> KDC needs to be deleted.  We have moved to 10.5.4 and have been seeing some
> problems with computer not being able to login even with a green light for
> the AD account being ready.  Wondering if you have run across that or have
> heard of it.
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> *
> *Rich.Dagel at landor.com
> *
>
> ------------------------------
> *From: *Miles Leacy <miles.leacy at themacadmin.com>
> *Date: *Wed, 21 Jan 2009 19:14:06 -0500
> *To: *Rich Dagel <rich.dagel at landor.com>
> *Cc: *Casper List <casper at list.jamfsoftware.com>
> *Subject: *Re: [Casper] Master Image Creation Checklist
>
> If we're talking about a base OS image, I do very little...
>
> 1. Perform OS custom install with all selectable options turned off.
> 2. Run latest Mac OS Combo updater
> 3. Go through Setup Assistant, create primary IT admin account.
> 4. Turn on SSH (Remote Login) and ARD (both for admin account only).
> 5. Change machine name to "unmanagedclient"
>
> That's it.  Everything else is done via packages or scripts.  I believe in
> keeping it as modular as possible.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> 2009/1/21 Dagel, Rich <Rich.Dagel at landor.com>
>
> I am updating my documentation on master image creation.  Just wondering
> what others are doing to customize their master image.  Such as:
> Turning of external accounts,
> Setting time machine to not offer new disks for backup
> Deleting networkinterfaces plist
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> *
> *Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>
> *
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/052d12c5/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/052d12c5/attachment.gif 

From john_wetter at hopkins.k12.mn.us  Wed Jan 21 19:50:36 2009
From: john_wetter at hopkins.k12.mn.us (John Wetter)
Date: Wed, 21 Jan 2009 21:50:36 -0600
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <ec2e75ff0901211836p7185eecdl6a2220838dc7572d@mail.gmail.com>
Message-ID: <C59D492C.807C%john_wetter@hopkins.k12.mn.us>

Miles,

Are you just doing a destroy and rebuild in one script like this?

sudo rm -rf /var/db/krb5kdc
sudo /usr/libexec/configureLocalKDC

I'm going to have to give this a try as lately we have been seeing some issues with users not being able to log in to AD even when everything is showing as green.  We are running a triangle with AD-OD in part of our environment and this is a problem, so I wonder if this might be one thing to check.

-John

On 1/21/09 8:36 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

I have yet to encounter any LKDC problems, however, they have been widely reported and I have no reason to believe that these reports are bogus.  Therefore, in the interest of eliminating potential problems, I see destroying the LKDC as a best practice.  You can do this before creating your base image, or you can do it as an "after" script in your configuration.

Guess which I prefer.  :)

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




On Wed, Jan 21, 2009 at 7:31 PM, Dagel, Rich <Rich.Dagel at landor.com> wrote:
I have been hearing things about AD machine passwords timing out and you should set it not to when binding to the AD.  And also local that the local KDC needs to be deleted.  We have moved to 10.5.4 and have been seeing some problems with computer not being able to login even with a green light for the AD account being ready.  Wondering if you have run across that or have heard of it.


Rich Dagel
Senior Technology Specialist
[cid:3315419436_1741991]
Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>


________________________________
From: Miles Leacy <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com> >
Date: Wed, 21 Jan 2009 19:14:06 -0500
To: Rich Dagel <rich.dagel at landor.com <http://rich.dagel at landor.com> >
Cc: Casper List <casper at list.jamfsoftware.com <http://casper at list.jamfsoftware.com> >
Subject: Re: [Casper] Master Image Creation Checklist


If we're talking about a base OS image, I do very little...

1. Perform OS custom install with all selectable options turned off.
2. Run latest Mac OS Combo updater
3. Go through Setup Assistant, create primary IT admin account.
4. Turn on SSH (Remote Login) and ARD (both for admin account only).
5. Change machine name to "unmanagedclient"

That's it.  Everything else is done via packages or scripts.  I believe in keeping it as modular as possible.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com>  <http://www.themacadmin.com>




2009/1/21 Dagel, Rich <Rich.Dagel at landor.com <http://Rich.Dagel at landor.com> >
I am updating my documentation on master image creation.  Just wondering what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>  <http://Rich.Dagel at landor.com>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com <http://Casper at list.jamfsoftware.com>
http://list.jamfsoftware.com/mailman/listinfo/casper






--
John Wetter
Technology Support Administrator
Educational Technology, Media & Information Services
Hopkins Public Schools
952-988-5373
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/7659bd71/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.gif
Type: image/gif
Size: 580 bytes
Desc: image.gif
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/7659bd71/attachment.gif 

From miles.leacy at themacadmin.com  Wed Jan 21 19:57:41 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 21 Jan 2009 22:57:41 -0500
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <C59D492C.807C%john_wetter@hopkins.k12.mn.us>
References: <ec2e75ff0901211836p7185eecdl6a2220838dc7572d@mail.gmail.com>
	<C59D492C.807C%john_wetter@hopkins.k12.mn.us>
Message-ID: <ec2e75ff0901211957n1c8bc041haa8092c9b061d524@mail.gmail.com>

I threw the following together after reading Rich's message.  This has not
been tested yet.
#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_deleteLKDC.bash
#
# Created 20090121 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090121 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as
# this header remains intact.
#
# This script is provided "as is".  The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon,
# or any other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
# twice more.
#
# This script deletes Leopard's Local KDC and preps the system to
# create a new one on first boot.
# Use as an "after" script in your Casper core configuration.
#
##### HEADER ENDS #####

systemkeychain -k $1/Library/Keychains/System.keychain -C -f

rm -fr $1/var/db/krb5kdc

defaults delete $1/System/Library/LaunchDaemons/com.apple.configureLocalKDC
Disabled


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/21 John Wetter <john_wetter at hopkins.k12.mn.us>

>  Miles,
>
> Are you just doing a destroy and rebuild in one script like this?
>
> sudo rm -rf /var/db/krb5kdc
> sudo /usr/libexec/configureLocalKDC
>
> I'm going to have to give this a try as lately we have been seeing some
> issues with users not being able to log in to AD even when everything is
> showing as green.  We are running a triangle with AD-OD in part of our
> environment and this is a problem, so I wonder if this might be one thing to
> check.
>
> -John
>
> On 1/21/09 8:36 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:
>
> I have yet to encounter any LKDC problems, however, they have been widely
> reported and I have no reason to believe that these reports are bogus.
>  Therefore, in the interest of eliminating potential problems, I see
> destroying the LKDC as a best practice.  You can do this before creating
> your base image, or you can do it as an "after" script in your
> configuration.
>
> Guess which I prefer.  :)
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> On Wed, Jan 21, 2009 at 7:31 PM, Dagel, Rich <Rich.Dagel at landor.com>
> wrote:
>
> I have been hearing things about AD machine passwords timing out and you
> should set it not to when binding to the AD.  And also local that the local
> KDC needs to be deleted.  We have moved to 10.5.4 and have been seeing some
> problems with computer not being able to login even with a green light for
> the AD account being ready.  Wondering if you have run across that or have
> heard of it.
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> *
> *Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>
> *
>
>
> ------------------------------
> *From: *Miles Leacy <miles.leacy at themacadmin.com <
> http://miles.leacy at themacadmin.com> >
> *Date: *Wed, 21 Jan 2009 19:14:06 -0500
> *To: *Rich Dagel <rich.dagel at landor.com <http://rich.dagel at landor.com> >
> *Cc: *Casper List <casper at list.jamfsoftware.com <
> http://casper at list.jamfsoftware.com> >
> *Subject: *Re: [Casper] Master Image Creation Checklist
>
>
> If we're talking about a base OS image, I do very little...
>
> 1. Perform OS custom install with all selectable options turned off.
> 2. Run latest Mac OS Combo updater
> 3. Go through Setup Assistant, create primary IT admin account.
> 4. Turn on SSH (Remote Login) and ARD (both for admin account only).
> 5. Change machine name to "unmanagedclient"
>
> That's it.  Everything else is done via packages or scripts.  I believe in
> keeping it as modular as possible.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com>
> www.themacadmin.com <http://www.themacadmin.com>  <
> http://www.themacadmin.com>
>
>
>
>
> 2009/1/21 Dagel, Rich <Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>
> >
>
> I am updating my documentation on master image creation.  Just wondering
> what others are doing to customize their master image.  Such as:
> Turning of external accounts,
> Setting time machine to not offer new disks for backup
> Deleting networkinterfaces plist
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> *
> *Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>  <
> http://Rich.Dagel at landor.com>
> *
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com <http://Casper at list.jamfsoftware.com>
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
>
>
>
> --
> John Wetter
> Technology Support Administrator
> Educational Technology, Media & Information Services
> Hopkins Public Schools
> 952-988-5373
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/52b024ae/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/52b024ae/attachment.gif 

From ganderson at phrd.ab.ca  Wed Jan 21 20:31:44 2009
From: ganderson at phrd.ab.ca (Gene Anderson)
Date: Wed, 21 Jan 2009 21:31:44 -0700
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
References: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
Message-ID: <fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>

Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname. This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable and the for loop in this case. We're operating on known values. To me, at least, it seems unnecessary to declare $file and then set up a for/if structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work. Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger workstations, trigger on login and frequency ongoing. The policy reports no errors. Should this command work from the Terminal? How does the $3 value in the script get assigned? If I manually execute the script from the Terminal the full path comes back as "/Users//Library/Caches". Does Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



From Rich.Dagel at landor.com  Wed Jan 21 21:51:58 2009
From: Rich.Dagel at landor.com (Dagel, Rich)
Date: Wed, 21 Jan 2009 21:51:58 -0800
Subject: [Casper] SystemConfigTrigger to turn of airport when someone plugs
	back into ethernet
Message-ID: <769F61946876F740BDEDA5A4BA0A85F0054C596E@sfo1001ex02.na.corp.yr.com>

Has anyone tried this yet from the resources kit?  Not sure how to go about scripting systemconfigtrigger to do it, but was told it could be done.

rich

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090121/bed86332/attachment.htm 

From CMyers at uclan.ac.uk  Thu Jan 22 01:52:54 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 09:52:54 +0000
Subject: [Casper] Policy to Disable Automatic Updates?
In-Reply-To: <11D896E6-4E7F-44C8-AA8D-81E9EFB97555@creativetechs.com>
References: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
	<ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
	<11D896E6-4E7F-44C8-AA8D-81E9EFB97555@creativetechs.com>
Message-ID: <497841F6.BB96.0081.0@uclan.ac.uk>

HI, 

Personally i use WGM to point my software update to a non existent
address, as a managed preference. 

For office and adobe i delete the update tools, that way they never run,


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 10:34 PM, in message
<11D896E6-4E7F-44C8-AA8D-81E9EFB97555 at creativetechs.com>, Craig Swanson
<craig at creativetechs.com> wrote:

Thanks Miles,

We'll test and post the results.

~Craig

On Jan 21, 2009, at 2:29 PM, Miles Leacy wrote:

> Test this, I'm writing it from memory.
>
> Software Update:
>
> defaults -currentHost write com.apple.SoftwareUpdate 
> AutomaticDownload -bool false
>
> Office 2008:
>
> defaults write com.microsoft.autoupdate2 HowToCheck -string "Manual"
>
> I don't recall Adobe or Office 2004 offhand.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
> On Wed, Jan 21, 2009 at 4:21 PM, Craig Swanson
<craig at creativetechs.com
> > wrote:
> Hi, this is my first post to the Casper list. I'm hoping someone else
> has already got an easy answer documented.
>
> We want a series of policies that disables/turns-off automatic updates
> for:
>
> - Apple Software Update
> - Microsoft Office (2004 and 2008)
> - Adobe Creative Suite (CS3 and CS4)
>
> Does anyone already have an existing script or solution?
>
> Thanks!
>
> ~Craig Swanson
>
> ---
> Phone: 206-682-4315
> Email: help at creativetechs.com
> Web: www.creativetechs.com
> Tagline: Left-brain support for Right-brain Pros.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/38dd844c/attachment.html 

From CMyers at uclan.ac.uk  Thu Jan 22 04:13:33 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 12:13:33 +0000
Subject: [Casper] Flushing User Caches
In-Reply-To: <fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>
References: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
	<fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>
Message-ID: <497862EC.BB96.0081.0@uclan.ac.uk>

Hi, 

Could you not just redirect the cache folder to the local HD on login and then delete at logout, 

i use WGM to redirect the Cache and fonts folder on login from a network Home folder, to /tmp/ they then get deleted at logout, 

A login hook could do the same, 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  4:31 AM, in message <fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene Anderson" <ganderson at phrd.ab.ca> wrote:

Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname. This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable and the for loop in this case. We're operating on known values. To me, at least, it seems unnecessary to declare $file and then set up a for/if structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work. Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger workstations, trigger on login and frequency ongoing. The policy reports no errors. Should this command work from the Terminal? How does the $3 value in the script get assigned? If I manually execute the script from the Terminal the full path comes back as "/Users//Library/Caches". Does Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/b5bd18d9/attachment.htm 

From CMyers at uclan.ac.uk  Thu Jan 22 04:17:49 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 12:17:49 +0000
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <ec2e75ff0901211836p7185eecdl6a2220838dc7572d@mail.gmail.com>
References: <ec2e75ff0901211614s7ee3f81fub2b733a3595857e5@mail.gmail.com>
	<C59CFE69.24A4F%Rich.Dagel@landor.com>
	<ec2e75ff0901211836p7185eecdl6a2220838dc7572d@mail.gmail.com>
Message-ID: <497863EC.BB96.0081.0@uclan.ac.uk>

I found problems with LKDC when binding clients to the OD, 
Destorying the LKDC worked fine, not sure if this was fixed in an os
update since i created by Base Image, 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  2:36 AM, in message
<ec2e75ff0901211836p7185eecdl6a2220838dc7572d at mail.gmail.com>, Miles
Leacy <miles.leacy at themacadmin.com> wrote:

I have yet to encounter any LKDC problems, however, they have been
widely reported and I have no reason to believe that these reports are
bogus.  Therefore, in the interest of eliminating potential problems, I
see destroying the LKDC as a best practice.  You can do this before
creating your base image, or you can do it as an "after" script in your
configuration. 


Guess which I prefer.  :)



----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Wed, Jan 21, 2009 at 7:31 PM, Dagel, Rich 
<Rich.Dagel at landor.com> 

wrote:


I have been hearing things about AD machine passwords timing out and you
should set it not to when binding to the AD.  And also local that the
local KDC needs to be deleted.  We have moved to 10.5.4 and have been
seeing some problems with computer not being able to login even with a
green light for the AD account being ready.  Wondering if you have run
across that or have heard of it.



Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com

Rich.Dagel at landor.com



From: Miles Leacy <miles.leacy at themacadmin.com>
Date: Wed, 21 Jan 2009 19:14:06 -0500
To: Rich Dagel <rich.dagel at landor.com>
Cc: Casper List <casper at list.jamfsoftware.com>
Subject: Re: [Casper] Master Image Creation Checklist 


If we're talking about a base OS image, I do very little...

1. Perform OS custom install with all selectable options turned off.
2. Run latest Mac OS Combo updater
3. Go through Setup Assistant, create primary IT admin account.
4. Turn on SSH (Remote Login) and ARD (both for admin account only).
5. Change machine name to "unmanagedclient"

That's it.  Everything else is done via packages or scripts.  I believe
in keeping it as modular as possible.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com

www.themacadmin.com <http://www.themacadmin.com>





2009/1/21 Dagel, Rich <Rich.Dagel at landor.com>

I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist



Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com

Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper







-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/3c3e4bf2/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: CompuServe GIF graphic
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/3c3e4bf2/attachment.gif 

From CMyers at uclan.ac.uk  Thu Jan 22 04:27:12 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 12:27:12 +0000
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49775EA9020000390000812D@gwoes4.kckps.org>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
Message-ID: <49786620.BB96.0081.0@uclan.ac.uk>

I do pretty much the same as Thomas, 

I install all Web 2.0 based apps such as firewfox, realplayer, flash plugin, shockwave plugin, google notifier, web links, adobe media player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus system hacks such as modfied login window, logout messages, about this mac hack, delete unwanted Utilites and apps such as Applescript editor, Mail, Chess etc, relocate Apps into different folder, such as an Accessories folder, install key drivers for added hardware. Remove all network devices settings but Ethernet and set to DHCP. 

Then i bind to OD and AD to test with network users, and then unbind and make a master image. 

I then use Casper to install applications, hooks, updates and patches and local accounts, set the efi password, add printers, and manage the clients with WGM. 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message <49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I am very bored and can't do anything.  I am also not in my office so I don't have my complete list of notes on my image handy but I can give you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from /Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a symbolic link to the file in question typically in /Users/shared so no one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
14)  Test with a test account to make sure mobile accounts sync, then of course delete said account
15)  Triple check that everything works, log ins, group policy and MCX, apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front of me, that is basically the idea though.  I also have a few post image scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/82410471/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 22 04:31:01 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 07:31:01 -0500
Subject: [Casper] Flushing User Caches
In-Reply-To: <497862EC.BB96.0081.0@uclan.ac.uk>
References: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
	<fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>
	<497862EC.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68@mail.gmail.com>

I believe for $3 and login policies in general to work, you need to check
"Create Login/Logout Hooks", "Log IP/Username with Login/Logout Hooks" and
"Check for Policies with Login/Logout Hooks" in Management Preferences,
which is found in the Management tab.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers <CMyers at uclan.ac.uk> wrote:

>  Hi,
>
>  Could you not just redirect the cache folder to the local HD on login and
> then delete at logout,
>
>  i use WGM to redirect the Cache and fonts folder on login from a network
> Home folder, to /tmp/ they then get deleted at logout,
>
>  A login hook could do the same,
>
>  Criss
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
>
> >>> On Thu, Jan 22, 2009 at  4:31 AM, in message <
> fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene Anderson" <
> ganderson at phrd.ab.ca> wrote:
>
>  Miles Leacy <miles.leacy at themacadmin.com> writes:
> >When you run a script via a Casper policy, $3 = the user's shortname. This
> is why I structure my commands to target /Users/$3/
> >
> >This may be a matter of preference, but I would skip the $file variable
> and the for loop in this case. We're operating on known values. To me, at
> least, it seems unnecessary to declare $file and then set up a for/if
> structure when we can just operate on each item and save lines.
> >
> >The script below accomplishes the goal with just a few lines and is set up
> to be run as part of a Casper policy triggered by login.
>
> Okay, I must be missing something here because I can't get this to work.
> Script is:
>
> rm -Rf /Users/$3/Library/Caches/*
>
> being executed on Tiger clients. Policy is set to execute on all Tiger
> workstations, trigger on login and frequency ongoing. The policy reports no
> errors. Should this command work from the Terminal? How does the $3 value in
> the script get assigned? If I manually execute the script from the Terminal
> the full path comes back as "/Users//Library/Caches". Does Casper somehow
> fill in the value for the script?
>
>
>
> Gene Anderson
> Systems Analyst, ACTC, MCP
> Pembina Hills Regional Division No.7
> Phone: (780) 674-8535 ext 6860
> email: ganderson at phrd.ab.ca
>
> "Passwords are like bubble gum, strongest when fresh, should never be
> used by groups and create a sticky mess when left laying around"
>
> -anon
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/58ef6e59/attachment.htm 

From CMyers at uclan.ac.uk  Thu Jan 22 05:11:32 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 13:11:32 +0000
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68@mail.gmail.com>
References: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
	<fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>
	<497862EC.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68@mail.gmail.com>
Message-ID: <49787084.BB96.0081.0@uclan.ac.uk>

or Use iHook 

I use iHook rather than using Casper for login hooks 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at 12:31 PM, in message
<ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles
Leacy <miles.leacy at themacadmin.com> wrote:

I believe for $3 and login policies in general to work, you need to
check "Create Login/Logout Hooks", "Log IP/Username with Login/Logout
Hooks" and "Check for Policies with Login/Logout Hooks" in Management
Preferences, which is found in the Management tab.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers 
<CMyers at uclan.ac.uk> 

wrote:


Hi, 


Could you not just redirect the cache folder to the local HD on login
and then delete at logout, 


i use WGM to redirect the Cache and fonts folder on login from a network
Home folder, to /tmp/ they then get deleted at logout, 


A login hook could do the same, 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054 




>>> On Thu, Jan 22, 2009 at  4:31 AM, in message
<fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene
Anderson" <ganderson at phrd.ab.ca> wrote:




Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname.
This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable
and the for loop in this case. We're operating on known values. To me,
at least, it seems unnecessary to declare $file and then set up a for/if
structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set
up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work.
Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger
workstations, trigger on login and frequency ongoing. The policy reports
no errors. Should this command work from the Terminal? How does the $3
value in the script get assigned? If I manually execute the script from
the Terminal the full path comes back as "/Users//Library/Caches". Does
Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/474184a1/attachment.html 

From CMyers at uclan.ac.uk  Thu Jan 22 05:14:58 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 13:14:58 +0000
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68@mail.gmail.com>
References: <ec2e75ff0901211411i1b14b867h2e89af0a9f84b116@mail.gmail.com>
	<fc.000f4ccf02026db3000f4ccf020234f6.2026dea@phrd.ab.ca>
	<497862EC.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68@mail.gmail.com>
Message-ID: <49787152.BB96.0081.0@uclan.ac.uk>

not sure about for Casper but for normal login hooks to work you need to
activate login hook for the root loginwindow.plist


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at 12:31 PM, in message
<ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles
Leacy <miles.leacy at themacadmin.com> wrote:

I believe for $3 and login policies in general to work, you need to
check "Create Login/Logout Hooks", "Log IP/Username with Login/Logout
Hooks" and "Check for Policies with Login/Logout Hooks" in Management
Preferences, which is found in the Management tab.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers 
<CMyers at uclan.ac.uk> 

wrote:


Hi, 


Could you not just redirect the cache folder to the local HD on login
and then delete at logout, 


i use WGM to redirect the Cache and fonts folder on login from a network
Home folder, to /tmp/ they then get deleted at logout, 


A login hook could do the same, 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054 




>>> On Thu, Jan 22, 2009 at  4:31 AM, in message
<fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene
Anderson" <ganderson at phrd.ab.ca> wrote:




Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname.
This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable
and the for loop in this case. We're operating on known values. To me,
at least, it seems unnecessary to declare $file and then set up a for/if
structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set
up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work.
Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger
workstations, trigger on login and frequency ongoing. The policy reports
no errors. Should this command work from the Terminal? How does the $3
value in the script get assigned? If I manually execute the script from
the Terminal the full path comes back as "/Users//Library/Caches". Does
Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/48e47d3c/attachment.htm 

From ERNSTCS at uwec.edu  Thu Jan 22 05:18:52 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Thu, 22 Jan 2009 07:18:52 -0600
Subject: [Casper] Flushing User Caches
In-Reply-To: <49787152.BB96.0081.0@uclan.ac.uk>
Message-ID: <C59DCE5C.12C18%ernstcs@uwec.edu>

For Casper...I just check the box in the management preferences and it just works...

Craig E


On 1/22/09 7:14 AM, "Criss Myers" <cmyers at uclan.ac.uk> wrote:



 not sure about for Casper but for normal login hooks to work you need to activate login hook for the root loginwindow.plist


Criss Myers

Senior Customer Support Analyst (Mac Services)

Apple Certified Technical Coordinator v10.5

LIS Business Support Team

Library 301

University of Central Lancashire

Preston PR1 2HE

Ex 5054

01772 895054

>>> On Thu, Jan 22, 2009 at 12:31 PM, in message <ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles Leacy <miles.leacy at themacadmin.com> wrote:




 I believe for $3 and login policies in general to work, you need to check "Create Login/Logout Hooks", "Log IP/Username with Login/Logout Hooks" and "Check for Policies with Login/Logout Hooks" in Management Preferences, which is found in the Management tab.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>








 On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers



 <CMyers at uclan.ac.uk>



 wrote:





 Hi,






 Could you not just redirect the cache folder to the local HD on login and then delete at logout,






 i use WGM to redirect the Cache and fonts folder on login from a network Home folder, to /tmp/ they then get deleted at logout,






 A login hook could do the same,






 Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054









 >>> On Thu, Jan 22, 2009 at  4:31 AM, in message <fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene Anderson" <ganderson at phrd.ab.ca> wrote:













 Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname. This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable and the for loop in this case. We're operating on known values. To me, at least, it seems unnecessary to declare $file and then set up a for/if structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work. Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger workstations, trigger on login and frequency ongoing. The policy reports no errors. Should this command work from the Terminal? How does the $3 value in the script get assigned? If I manually execute the script from the Terminal the full path comes back as "/Users//Library/Caches". Does Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon








 _______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper













-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/c58e299c/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 22 05:39:52 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 08:39:52 -0500
Subject: [Casper] Flushing User Caches
In-Reply-To: <C59DCE5C.12C18%ernstcs@uwec.edu>
References: <49787152.BB96.0081.0@uclan.ac.uk>
	<C59DCE5C.12C18%ernstcs@uwec.edu>
Message-ID: <ec2e75ff0901220539m7607dd69x119e0547fdd62033@mail.gmail.com>

I've used iHook in the past (back when I was a Radmind admin), but it's been
a while and I don't recall off hand how to properly write scripts for it.
I gave up Radmind and iHook because with Casper I get a commercial product
with support, and an interface that I can teach to and document for
inexperienced techs rather easily.

I'd suggest dropping, or at least starting the slow, testing-heavy process
of moving from iHook to scripting through Casper policies.  An iHook script
will only ever be a login script.  A script, once it's in your JSS, can be
deployed via nearly any policy you can think up, or as an ad-hoc action
through Casper Remote.

Of course, the best solution is the one that works for you, so please don't
think I'm telling you you're doing anything wrong.  I'm just offering my
point of view and the benefit of my experience.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 22, 2009 at 8:18 AM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:

>  For Casper...I just check the box in the management preferences and it
> just works...
>
> Craig E
>
>
> On 1/22/09 7:14 AM, "Criss Myers" <cmyers at uclan.ac.uk> wrote:
>
>
>
>  not sure about for Casper but for normal login hooks to work you need to
> activate login hook for the root loginwindow.plist
>
>
> Criss Myers
>
> Senior Customer Support Analyst (Mac Services)
>
> Apple Certified Technical Coordinator v10.5
>
> LIS Business Support Team
>
> Library 301
>
> University of Central Lancashire
>
> Preston PR1 2HE
>
> Ex 5054
>
> 01772 895054
>
> >>> On Thu, Jan 22, 2009 at 12:31 PM, in message <
> ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles Leacy
> <miles.leacy at themacadmin.com> wrote:
>
>
>
>
>  I believe for $3 and login policies in general to work, you need to check
> "Create Login/Logout Hooks", "Log IP/Username with Login/Logout Hooks" and
> "Check for Policies with Login/Logout Hooks" in Management Preferences,
> which is found in the Management tab.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
>
>
>
>
>  On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers
>
>
>
>  <CMyers at uclan.ac.uk>
>
>
>
>  wrote:
>
>
>
>
>
>
>  Hi,
>
>
>
>
>
>
>  Could you not just redirect the cache folder to the local HD on login and
> then delete at logout,
>
>
>
>
>
>
>  i use WGM to redirect the Cache and fonts folder on login from a network
> Home folder, to /tmp/ they then get deleted at logout,
>
>
>
>
>
>
>  A login hook could do the same,
>
>
>
>
>
>
>  Criss
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
>
>
>
>
>
>
>
>
>  >>> On Thu, Jan 22, 2009 at  4:31 AM, in message <
> fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene Anderson" <
> ganderson at phrd.ab.ca> wrote:
>
>
>
>
>
>
>
>
>
>
>
>
>
>  Miles Leacy <miles.leacy at themacadmin.com> writes:
> >When you run a script via a Casper policy, $3 = the user's shortname. This
> is why I structure my commands to target /Users/$3/
> >
> >This may be a matter of preference, but I would skip the $file variable
> and the for loop in this case. We're operating on known values. To me, at
> least, it seems unnecessary to declare $file and then set up a for/if
> structure when we can just operate on each item and save lines.
> >
> >The script below accomplishes the goal with just a few lines and is set up
> to be run as part of a Casper policy triggered by login.
>
> Okay, I must be missing something here because I can't get this to work.
> Script is:
>
> rm -Rf /Users/$3/Library/Caches/*
>
> being executed on Tiger clients. Policy is set to execute on all Tiger
> workstations, trigger on login and frequency ongoing. The policy reports no
> errors. Should this command work from the Terminal? How does the $3 value in
> the script get assigned? If I manually execute the script from the Terminal
> the full path comes back as "/Users//Library/Caches". Does Casper somehow
> fill in the value for the script?
>
>
>
> Gene Anderson
> Systems Analyst, ACTC, MCP
> Pembina Hills Regional Division No.7
> Phone: (780) 674-8535 ext 6860
> email: ganderson at phrd.ab.ca
>
> "Passwords are like bubble gum, strongest when fresh, should never be
> used by groups and create a sticky mess when left laying around"
>
> -anon
>
>
>
>
>
>
>
>
>  _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/beb970f3/attachment.htm 

From CMyers at uclan.ac.uk  Thu Jan 22 05:56:33 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 13:56:33 +0000
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901220539m7607dd69x119e0547fdd62033@mail.gmail.com>
References: <49787152.BB96.0081.0@uclan.ac.uk>
	<C59DCE5C.12C18%ernstcs@uwec.edu>
	<ec2e75ff0901220539m7607dd69x119e0547fdd62033@mail.gmail.com>
Message-ID: <49787B11.BB96.0081.0@uclan.ac.uk>

ihooks are just bash scripts that have extension .hook and placed in the
hooks folder in /etc, with login hooks filename beginning with LI and
logout hooks LO, e.g LIFonts.hook , LOFonts.hook. All LI files are run
at login and all LO at logout one after the other, each can have custom
pictures or branding and each can display an output via echo so a user
can see the progress and state of the hook, this also helps for testing,
the size of the window can also be altered. 

You can have as many login and logout hooks as you like, i keep mine
modular so i have a separate hook for each command so i can easily
remove or update by deploying new hooks via Casper. 

For example I have a login hook that resets the Audio settings for the
audio hardware thats connected to a particular machine, its called
LIAudio.hook and has our company branding on it, it displays via echo
what is happening informing the user that is it copying the new
settings, i can then use this output to check that the hook is running
properly. 

I also have a logout hook that displays a custom picture remind the user
to remove their USB drivers when they logout, it doesn't run any command
just changes to this picture and when done the other scripts run their
own picture. 

Personally as my system was setup before Casper and i already had
working login and logout hooks which i can customize with my own company
branding i preferred to keep them rather than moving to Casper. I prefer
the flexibility that ihook offers to display feedback to the user as
well as custom pictures per hook. 

I can deploy a new login hook by creating a package for it and deploying
it via Casper, if i need to remove it i can unistall it with Capser or
amend and deploy an updated version. 

Personally I find this offers me what i want, BUT i have never used
Capser login hooks so do not know what feedback and display the output
for the user. 

I also use ihook for running shell scripts that the user can execute
themselves without need terminal and give a graphical feedback. 

For example i have a script which moves the contents of a backup folder
to the users home folder, which they can run themselves to recover data,
The double click and it opens the script via iHook with a custom picture
telling them whats happening and again feedback via echo. 

Hope this all makes sense 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  1:39 PM, in message
<ec2e75ff0901220539m7607dd69x119e0547fdd62033 at mail.gmail.com>, Miles
Leacy <miles.leacy at themacadmin.com> wrote:

I've used iHook in the past (back when I was a Radmind admin), but it's
been a while and I don't recall off hand how to properly write scripts
for it. 


I gave up Radmind and iHook because with Casper I get a commercial
product with support, and an interface that I can teach to and document
for inexperienced techs rather easily.


I'd suggest dropping, or at least starting the slow, testing-heavy
process of moving from iHook to scripting through Casper policies.  An
iHook script will only ever be a login script.  A script, once it's in
your JSS, can be deployed via nearly any policy you can think up, or as
an ad-hoc action through Casper Remote. 



Of course, the best solution is the one that works for you, so please
don't think I'm telling you you're doing anything wrong.  I'm just
offering my point of view and the benefit of my experience. 


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Thu, Jan 22, 2009 at 8:18 AM, Ernst, Craig S. 
<ERNSTCS at uwec.edu> 

wrote:


For Casper...I just check the b
ox in the management preferences not sure about for Casper but for normal login hooks to work you need to
activate login hook for the root loginwindow.plist



Criss Myers

Senior Customer Support Analyst (Mac Services)

Apple Certified Technical Coordinator v10.5

LIS Business Support Team

Library 301

University of Central Lancashire

Preston PR1 2HE

Ex 5054

01772 895054

>>> On Thu, Jan 22, 2009 at 12:31 PM, in message
<ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles
Leacy <miles.leacy at themacadmin.com> wrote:
    
 
 

 I believe for $3 and login policies in general to work, you need to
check "Create Login/Logout Hooks", "Log IP/Username with Login/Logout
Hooks" and "Check for Policies with Login/Logout Hooks" in Management
Preferences, which is found in the Management tab.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com

www.themacadmin.com <http://www.themacadmin.com>






      
 
 

 On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers        
 
 

 <CMyers at uclan.ac.uk>          
 
 

 wrote:
        
 



 

  

Hi, 

           
 

 
 
 

  

Could you not just redirect the cache folder to the local HD on login
and then delete at logout, 

           
 

 
 
 

  

i use WGM to redirect the Cache and fonts folder on login from a network
Home folder, to /tmp/ they then get deleted at logout, 

           
 

 
 
 

  

A login hook could do the same, 

           
 

 
 
 

  

Criss



Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054            
 
 

                   
 
 

 
 
 >>> On Thu, Jan 22, 2009 at  4:31 AM, in message
<fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene
Anderson" <ganderson at phrd.ab.ca> wrote:
                
 
 

               

                 
 

                     
 
 

 Miles Leacy <miles.leacy at themacadmin.com> writes:
>When you run a script via a Casper policy, $3 = the user's shortname.
This is why I structure my commands to target /Users/$3/
>
>This may be a matter of preference, but I would skip the $file variable
and the for loop in this case. We're operating on known values. To me,
at least, it seems unnecessary to declare $file and then set up a for/if
structure when we can just operate on each item and save lines.
>
>The script below accomplishes the goal with just a few lines and is set
up to be run as part of a Casper policy triggered by login.

Okay, I must be missing something here because I can't get this to work.
Script is:

rm -Rf /Users/$3/Library/Caches/*

being executed on Tiger clients. Policy is set to execute on all Tiger
workstations, trigger on login and frequency ongoing. The policy reports
no errors. Should this command work from the Terminal? How does the $3
value in the script get assigned? If I manually execute the script from
the Terminal the full path comes back as "/Users//Library/Caches". Does
Casper somehow fill in the value for the script?



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon


                  
 
 
 
 

 _______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper
                
 

                 
 
 


 

 
 
 
 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/613afc75/attachment.html 

From tlarki at kckps.org  Thu Jan 22 06:40:55 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 22 Jan 2009 08:40:55 -0600
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49786620.BB96.0081.0@uclan.ac.uk>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk>
Message-ID: <49783117.7141.0039.0@kckps.org>

Yup, and when you are mass imaging thousands of machines block copying one master image instead of a base image and then a bunch of separate packages is more efficient.  I have a PDF that I am tossing together of the basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of AFP throughput graphs from our servers, both G5 desktops, G5 PPC Xserves and of course our new Intel Xserves.   

AFP throughput drops tremendously when you have tons of unicasting connections that are pulling down packages at different times.  Package based deployment is really nice and I love it, but when you are going to image thousands of machines at once you can chop off minutes per a machine by doing a larger block copy of a complete image. 

AFP kind of sucks in that sense.  I have yet to try out the multi-casting abilities of Casper. 

Anyone use multi-casting with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>

I do pretty much the same as Thomas, 


I install all Web 2.0 based apps such as firewfox, realplayer, flash plugin, shockwave plugin, google notifier, web links, adobe media player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus system hacks such as modfied login window, logout messages, about this mac hack, delete unwanted Utilites and apps such as Applescript editor, Mail, Chess etc, relocate Apps into different folder, such as an Accessories folder, install key drivers for added hardware. Remove all network devices settings but Ethernet and set to DHCP. 


Then i bind to OD and AD to test with network users, and then unbind and make a master image. 


I then use Casper to install applications, hooks, updates and patches and local accounts, set the efi password, add printers, and manage the clients with WGM. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message <49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I am very bored and can't do anything.  I am also not in my office so I don't have my complete list of notes on my image handy but I can give you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from /Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a symbolic link to the file in question typically in /Users/shared so no one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
14)  Test with a test account to make sure mobile accounts sync, then of course delete said account
15)  Triple check that everything works, log ins, group policy and MCX, apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front of me, that is basically the idea though.  I also have a few post image scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/8a964b56/attachment.html 

From CMyers at uclan.ac.uk  Thu Jan 22 06:44:41 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 14:44:41 +0000
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49783117.7141.0039.0@kckps.org>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
Message-ID: <49788659.BB96.0081.0@uclan.ac.uk>

not tried multicast as its banned here, i used ARD which mutlicasts and that didnt go down well with the networks guys, 

If one can set mulitcast so it doesnt upset a network then id try it


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  2:40 PM, in message <49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

Yup, and when you are mass imaging thousands of machines block copying one master image instead of a base image and then a bunch of separate packages is more efficient.  I have a PDF that I am tossing together of the basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of AFP throughput graphs from our servers, both G5 desktops, G5 PPC Xserves and of course our new Intel Xserves.   


AFP throughput drops tremendously when you have tons of unicasting connections that are pulling down packages at different times.  Package based deployment is really nice and I love it, but when you are going to image thousands of machines at once you can chop off minutes per a machine by doing a larger block copy of a complete image. 


AFP kind of sucks in that sense.  I have yet to try out the multi-casting abilities of Casper. 


Anyone use multi-casting with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>

I do pretty much the same as Thomas, 


I install all Web 2.0 based apps such as firewfox, realplayer, flash plugin, shockwave plugin, google notifier, web links, adobe media player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus system hacks such as modfied login window, logout messages, about this mac hack, delete unwanted Utilites and apps such as Applescript editor, Mail, Chess etc, relocate Apps into different folder, such as an Accessories folder, install key drivers for added hardware. Remove all network devices settings but Ethernet and set to DHCP. 


Then i bind to OD and AD to test with network users, and then unbind and make a master image. 


I then use Casper to install applications, hooks, updates and patches and local accounts, set the efi password, add printers, and manage the clients with WGM. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message <49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I am very bored and can't do anything.  I am also not in my office so I don't have my complete list of notes on my image handy but I can give you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from /Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a symbolic link to the file in question typically in /Users/shared so no one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
14)  Test with a test account to make sure mobile accounts sync, then of course delete said account
15)  Triple check that everything works, log ins, group policy and MCX, apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front of me, that is basically the idea though.  I also have a few post image scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/9e16e203/attachment.htm 

From tlarki at kckps.org  Thu Jan 22 06:47:56 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 22 Jan 2009 08:47:56 -0600
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49788659.BB96.0081.0@uclan.ac.uk>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
	<49788659.BB96.0081.0@uclan.ac.uk>
Message-ID: <497832BC.7141.0039.0@kckps.org>

Yeah I tried it once about 2 years ago at my previous job.  Ultimately, our old Cisco guy was pretty much a hater of letting us try anything different.  We found that portfast and spanning tree did not like our multicasting ways.  We tried it on an unmanaged switch but didn't see any performance increases.  I suspect you only see performance boosts when you are multi casting 100s of machines at a time.   

I don't think we even have the space to set up 100 macbooks and image them at once.  That would be a lot of data drops and patch cables in one set area.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 8:44 AM >>>

not tried multicast as its banned here, i used ARD which mutlicasts and that didnt go down well with the networks guys, 


If one can set mulitcast so it doesnt upset a network then id try it


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  2:40 PM, in message <49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

Yup, and when you are mass imaging thousands of machines block copying one master image instead of a base image and then a bunch of separate packages is more efficient.  I have a PDF that I am tossing together of the basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of AFP throughput graphs from our servers, both G5 desktops, G5 PPC Xserves and of course our new Intel Xserves.   


AFP throughput drops tremendously when you have tons of unicasting connections that are pulling down packages at different times.  Package based deployment is really nice and I love it, but when you are going to image thousands of machines at once you can chop off minutes per a machine by doing a larger block copy of a complete image. 


AFP kind of sucks in that sense.  I have yet to try out the multi-casting abilities of Casper. 


Anyone use multi-casting with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>

I do pretty much the same as Thomas, 


I install all Web 2.0 based apps such as firewfox, realplayer, flash plugin, shockwave plugin, google notifier, web links, adobe media player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus system hacks such as modfied login window, logout messages, about this mac hack, delete unwanted Utilites and apps such as Applescript editor, Mail, Chess etc, relocate Apps into different folder, such as an Accessories folder, install key drivers for added hardware. Remove all network devices settings but Ethernet and set to DHCP. 


Then i bind to OD and AD to test with network users, and then unbind and make a master image. 


I then use Casper to install applications, hooks, updates and patches and local accounts, set the efi password, add printers, and manage the clients with WGM. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message <49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I am very bored and can't do anything.  I am also not in my office so I don't have my complete list of notes on my image handy but I can give you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from /Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a symbolic link to the file in question typically in /Users/shared so no one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
14)  Test with a test account to make sure mobile accounts sync, then of course delete said account
15)  Triple check that everything works, log ins, group policy and MCX, apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front of me, that is basically the idea though.  I also have a few post image scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/e7176843/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan 22 06:59:14 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 09:59:14 -0500
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49788659.BB96.0081.0@uclan.ac.uk>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
	<49788659.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901220659x3e1537adufe676d63afc459f2@mail.gmail.com>

I haven't had a chance to use the Casper Multicast app from the Resource Kit
yet.
If your organization is big enough to have twitchy network guys, hopefully
its big enough to have a lab where you can have your own isolated switch on
which to run multicast sessions.

If you do have a dedicated network group, keep in mind that you're their
customer much as the end user is your customer.  Request a network segment
where you *can* multicast.  This is a request for technology needed to
perform your job, and it's as valid as a graphic designer requesting a
Photoshop installation.  Be nice, try not to be the kind of user you dislike
dealing with, but at the same time, understand that you are requesting
something that is both possible and necessary.  Don't be afraid to resort to
bribery.  Donuts, Mountain Dew & beer are some generally accepted geek
bribes.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/22 Criss Myers <CMyers at uclan.ac.uk>

>  not tried multicast as its banned here, i used ARD which mutlicasts and
> that didnt go down well with the networks guys,
>
>  If one can set mulitcast so it doesnt upset a network then id try it
>
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
> >>> On Thu, Jan 22, 2009 at  2:40 PM, in message <
> 49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:
>
>  Yup, and when you are mass imaging thousands of machines block copying
> one master image instead of a base image and then a bunch of separate
> packages is more efficient.  I have a PDF that I am tossing together of the
> basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of AFP
> throughput graphs from our servers, both G5 desktops, G5 PPC Xserves and of
> course our new Intel Xserves.
>
>
>  AFP throughput drops tremendously when you have tons of unicasting
> connections that are pulling down packages at different times.  Package
> based deployment is really nice and I love it, but when you are going to
> image thousands of machines at once you can chop off minutes per a machine
> by doing a larger block copy of a complete image.
>
>
>  AFP kind of sucks in that sense.  I have yet to try out the multi-casting
> abilities of Casper.
>
>
>  Anyone use multi-casting with Casper?
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>
>
> I do pretty much the same as Thomas,
>
>
>  I install all Web 2.0 based apps such as firewfox, realplayer, flash
> plugin, shockwave plugin, google notifier, web links, adobe media
> player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus
> system hacks such as modfied login window, logout messages, about this mac
> hack, delete unwanted Utilites and apps such as Applescript editor, Mail,
> Chess etc, relocate Apps into different folder, such as an Accessories
> folder, install key drivers for added hardware. Remove all network devices
> settings but Ethernet and set to DHCP.
>
>
>  Then i bind to OD and AD to test with network users, and then unbind and
> make a master image.
>
>
>  I then use Casper to install applications, hooks, updates and patches and
> local accounts, set the efi password, add printers, and manage the clients
> with WGM.
>
>
>  Criss
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
> >>> On Wed, Jan 21, 2009 at 11:43 PM, in message <
> 49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <
> tlarki at kckps.org> wrote:
>
> I am currently on hold on my cell phone calling a utilities company so I am
> very bored and can't do anything.  I am also not in my office so I don't
> have my complete list of notes on my image handy but I can give you a rough
> draft of what I do to create a master image.
>
> 1)  Wipe and reload OS on a machine to create master image
> 2)  Install desired apps I wanted bundled in the default image, and casper
> client
> 3)  run any and all updates
> 4)  configure remote management
> 5)  create hidden admin accounts, one for casper, one for local
> administration, one for others who may need admin access
> 6)  delete all local user accounts that are not hidden
> 7)  create a very basic, limited user account that is local, for just in
> case scenarios
> 8)  move all "admin only" apps to /Applications/Utilities
> 9)  change ownership of /Applications to root:admin
> 10)  change permissions of /Applications/Utilities to 770 so any user not
> in the admin group is denied access
> 11)  In WGM create nested group and only allow apps to run from
> /Applications and no where else.
> 12)  If a developer makes an app that needs to be writeable, I create a
> symbolic link to the file in question typically in /Users/shared so no one
> but admins can write to /Applications
> 13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
> 14)  Test with a test account to make sure mobile accounts sync, then of
> course delete said account
> 15)  Triple check that everything works, log ins, group policy and MCX,
> apps, network connection, etc
> 16)  clear all cahces, temp files, and logs
> 17)  create image
>
> I am sure I am missing a few things as I do not have my notes in front of
> me, that is basically the idea though.  I also have a few post image scripts
> that run that are building specific.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
> >>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
> I am updating my documentation on master image creation.  Just wondering
> what others are doing to customize their master image.  Such as:
> Turning of external accounts,
> Setting time machine to not offer new disks for backup
> Deleting networkinterfaces plist
>
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> http://www.landor.com
> Rich.Dagel at landor.com
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/3e097f8d/attachment.html 

From tlarki at kckps.org  Thu Jan 22 07:16:59 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 22 Jan 2009 09:16:59 -0600
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <ec2e75ff0901220659x3e1537adufe676d63afc459f2@mail.gmail.com>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
	<49788659.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901220659x3e1537adufe676d63afc459f2@mail.gmail.com>
Message-ID: <4978398B.7141.0039.0@kckps.org>

hahahaha mountain dew and donuts.  I used to bring in home made
meatballs (family recipe) and our old Cisco guy would snarf them up,
still woulnd't give me access to a switch.  My current job my Cisco guy
is way cooler and way more laid back.  He would give me a switch (if he
can spare it) to test things like this out, where as my last job the guy
was a nut job and super secretive.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/22/09 8:59 AM >>>
I haven't had a chance to use the Casper Multicast app from the Resource
Kit yet. 


If your organization is big enough to have twitchy network guys,
hopefully its big enough to have a lab where you can have your own
isolated switch on which to run multicast sessions. 



If you do have a dedicated network group, keep in mind that you're their
customer much as the end user is your customer.  Request a network
segment where you *can* multicast.  This is a request for technology
needed to perform your job, and it's as valid as a graphic designer
requesting a Photoshop installation.  Be nice, try not to be the kind of
user you dislike dealing with, but at the same time, understand that you
are requesting something that is both possible and necessary.  Don't be
afraid to resort to bribery.  Donuts, Mountain Dew & beer are some
generally accepted geek bribes.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/22 Criss Myers 
<CMyers at uclan.ac.uk> 




not tried multicast as its banned here, i used ARD which mutlicasts and
that didnt go down well with the networks guys, 


If one can set mulitcast so it doesnt upset a network then id try it 




Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054



>>> On Thu, Jan 22, 2009 at  2:40 PM, in message
<49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org>
wrote:



Yup, and when you are mass imaging thousands of machines block copying
one master image instead of a base image and then a bunch of separate
packages is more efficient.  I have a PDF that I am tossing together of
the basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of
AFP throughput graphs from our servers, both G5 desktops, G5 PPC Xserves
and of course our new Intel Xserves.   


AFP throughput drops tremendously when you have tons of unicasting
connections that are pulling down packages at different times.  Package
based deployment is really nice and I love it, but when you are going to
image thousands of machines at once you can chop off minutes per a
machine by doing a larger block copy of a complete image. 


AFP kind of sucks in that sense.  I have yet to try out the
multi-casting abilities of Casper. 


Anyone use multi-casting with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>

I do pretty much the same as Thomas, 


I install all Web 2.0 based apps such as firewfox, realplayer, flash
plugin, shockwave plugin, google notifier, web links, adobe media
player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl,
plus system hacks such as modfied login window, logout messages, about
this mac hack, delete unwanted Utilites and apps such as Applescript
editor, Mail, Chess etc, relocate Apps into different folder, such as an
Accessories folder, install key drivers for added hardware. Remove all
network devices settings but Ethernet and set toI then use Casper to install applications, hooks, updates and patches
and local accounts, set the efi password, add printers, and manage the
clients with WGM. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message
<49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin"
<tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I
am very bored and can't do anything.  I am also not in my office so I
don't have my complete list of notes on my image handy but I can give
you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and
casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local
administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in
case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user
not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from
/Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a
symbolic link to the file in question typically in /Users/shared so no
one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND,
etc
14)  Test with a test account to make sure mobile accounts sync, then of
course delete said account
15)  Triple check that everything works, log ins, group policy and MCX,
apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front
of me, that is basically the idea though.  I also have a few post image
scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/3b5a378e/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan 22 07:19:26 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 10:19:26 -0500
Subject: [Casper] Flushing User Caches
In-Reply-To: <49787B11.BB96.0081.0@uclan.ac.uk>
References: <49787152.BB96.0081.0@uclan.ac.uk>
	<C59DCE5C.12C18%ernstcs@uwec.edu>
	<ec2e75ff0901220539m7607dd69x119e0547fdd62033@mail.gmail.com>
	<49787B11.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901220719v6f46b917qc0a2132a675de847@mail.gmail.com>

It makes sense, it's just a different way of doing things than I use.

If you want to accomplish the same things using Casper, you can...

display messages to the end user by using osascript.  There is an example in
the Resource Kit.  You can display your own icons in a dialog box using an
applescript via osascript.
deploy or remove a login item by creating/deleting/enabling/disabling a
policy.

let users run shell scripts or items that would normally require admin
authentication via Casper's Self Service app.  The Self Service app runs a
policy, so you could include osascript dialog box(es) in your policy if you
want to give user feedback.
----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 22, 2009 at 8:56 AM, Criss Myers <CMyers at uclan.ac.uk> wrote:

>  ihooks are just bash scripts that have extension .hook and placed in the
> hooks folder in /etc, with login hooks filename beginning with LI and logout
> hooks LO, e.g LIFonts.hook , LOFonts.hook. All LI files are run at login and
> all LO at logout one after the other, each can have custom pictures or
> branding and each can display an output via echo so a user can see the
> progress and state of the hook, this also helps for testing, the size of the
> window can also be altered.
>
>  You can have as many login and logout hooks as you like, i keep mine
> modular so i have a separate hook for each command so i can easily remove or
> update by deploying new hooks via Casper.
>
>  For example I have a login hook that resets the Audio settings for the
> audio hardware thats connected to a particular machine, its called
> LIAudio.hook and has our company branding on it, it displays via echo what
> is happening informing the user that is it copying the new settings, i can
> then use this output to check that the hook is running properly.
>
>  I also have a logout hook that displays a custom picture remind the user
> to remove their USB drivers when they logout, it doesn't run any command
> just changes to this picture and when done the other scripts run their own
> picture.
>
>  Personally as my system was setup before Casper and i already had working
> login and logout hooks which i can customize with my own company branding i
> preferred to keep them rather than moving to Casper. I prefer the
> flexibility that ihook offers to display feedback to the user as well as
> custom pictures per hook.
>
>  I can deploy a new login hook by creating a package for it and deploying
> it via Casper, if i need to remove it i can unistall it with Capser or amend
> and deploy an updated version.
>
>  Personally I find this offers me what i want, BUT i have never used
> Capser login hooks so do not know what feedback and display the output for
> the user.
>
>  I also use ihook for running shell scripts that the user can execute
> themselves without need terminal and give a graphical feedback.
>
>  For example i have a script which moves the contents of a backup folder
> to the users home folder, which they can run themselves to recover data, The
> double click and it opens the script via iHook with a custom picture telling
> them whats happening and again feedback via echo.
>
>  Hope this all makes sense
>
>  Criss
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
> >>> On Thu, Jan 22, 2009 at  1:39 PM, in message <
> ec2e75ff0901220539m7607dd69x119e0547fdd62033 at mail.gmail.com>, Miles Leacy
> <miles.leacy at themacadmin.com> wrote:
>
>  I've used iHook in the past (back when I was a Radmind admin), but it's
> been a while and I don't recall off hand how to properly write scripts for
> it.
>
>
>   I gave up Radmind and iHook because with Casper I get a commercial
> product with support, and an interface that I can teach to and document for
> inexperienced techs rather easily.
>
>   I'd suggest dropping, or at least starting the slow, testing-heavy
> process of moving from iHook to scripting through Casper policies.  An iHook
> script will only ever be a login script.  A script, once it's in your JSS,
> can be deployed via nearly any policy you can think up, or as an ad-hoc
> action through Casper Remote.
>
>
>   Of course, the best solution is the one that works for you, so please
> don't think I'm telling you you're doing anything wrong.  I'm just offering
> my point of view and the benefit of my experience.
>
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   On Thu, Jan 22, 2009 at 8:18 AM, Ernst, Craig S.
>
> <ERNSTCS at uwec.edu>
>
> wrote:
>
>>   For Casper...I just check the box in the management preferences and it
>> just works...
>>
>> Craig E
>>
>>
>>
>>
>> On 1/22/09 7:14 AM, "Criss Myers" <cmyers at uclan.ac.uk> wrote:
>>
>>
>>
>>
>>
>> not sure about for Casper but for normal login hooks to work you need to
>> activate login hook for the root loginwindow.plist
>>
>>
>>
>> Criss Myers
>>
>> Senior Customer Support Analyst (Mac Services)
>>
>> Apple Certified Technical Coordinator v10.5
>>
>> LIS Business Support Team
>>
>> Library 301
>>
>> University of Central Lancashire
>>
>> Preston PR1 2HE
>>
>> Ex 5054
>>
>> 01772 895054
>>
>> >>> On Thu, Jan 22, 2009 at 12:31 PM, in message <
>> ec2e75ff0901220431v16ef1bdfi1dddb70e39e3ad68 at mail.gmail.com>, Miles Leacy
>> <miles.leacy at themacadmin.com> wrote:
>>
>>
>>
>>
>>  I believe for $3 and login policies in general to work, you need to check
>> "Create Login/Logout Hooks", "Log IP/Username with Login/Logout Hooks" and
>> "Check for Policies with Login/Logout Hooks" in Management Preferences,
>> which is found in the Management tab.
>>
>> ----------
>> Miles A. Leacy IV
>>
>> ? Certified System Administrator 10.4
>> ? Certified Technical Coordinator 10.5
>> ? Certified Trainer
>> Certified Casper Administrator
>> ----------
>> voice: 1-347-277-7321
>> miles.leacy at themacadmin.com
>>
>> www.themacadmin.com <http://www.themacadmin.com>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>  On Thu, Jan 22, 2009 at 7:13 AM, Criss Myers
>>
>>
>>
>>  <CMyers at uclan.ac.uk>
>>
>>
>>
>>  wrote:
>>
>>
>>
>>
>>
>>
>>
>>
>> Hi,
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> Could you not just redirect the cache folder to the local HD on login and
>> then delete at logout,
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> i use WGM to redirect the Cache and fonts folder on login from a network
>> Home folder, to /tmp/ they then get deleted at logout,
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> A login hook could do the same,
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> Criss
>>
>>
>>
>> Criss Myers
>> Senior Customer Support Analyst (Mac Services)
>> Apple Certified Technical Coordinator v10.5
>> LIS Business Support Team
>> Library 301
>> University of Central Lancashire
>> Preston PR1 2HE
>> Ex 5054
>> 01772 895054
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>  >>> On Thu, Jan 22, 2009 at  4:31 AM, in message <
>> fc.000f4ccf02026db3000f4ccf020234f6.2026dea at phrd.ab.ca>, "Gene Anderson"
>> <ganderson at phrd.ab.ca> wrote:
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>  Miles Leacy <miles.leacy at themacadmin.com> writes:
>> >When you run a script via a Casper policy, $3 = the user's shortname.
>> This is why I structure my commands to target /Users/$3/
>> >
>> >This may be a matter of preference, but I would skip the $file variable
>> and the for loop in this case. We're operating on known values. To me, at
>> least, it seems unnecessary to declare $file and then set up a for/if
>> structure when we can just operate on each item and save lines.
>> >
>> >The script below accomplishes the goal with just a few lines and is set
>> up to be run as part of a Casper policy triggered by login.
>>
>> Okay, I must be missing something here because I can't get this to work.
>> Script is:
>>
>> rm -Rf /Users/$3/Library/Caches/*
>>
>> being executed on Tiger clients. Policy is set to execute on all Tiger
>> workstations, trigger on login and frequency ongoing. The policy reports no
>> errors. Should this command work from the Terminal? How does the $3 value in
>> the script get assigned? If I manually execute the script from the Terminal
>> the full path comes back as "/Users//Library/Caches". Does Casper somehow
>> fill in the value for the script?
>>
>>
>>
>> Gene Anderson
>> Systems Analyst, ACTC, MCP
>> Pembina Hills Regional Division No.7
>> Phone: (780) 674-8535 ext 6860
>> email: ganderson at phrd.ab.ca
>>
>> "Passwords are like bubble gum, strongest when fresh, should never be
>> used by groups and create a sticky mess when left laying around"
>>
>> -anon
>>
>>
>>
>>
>>
>>
>>
>>
>>  _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/60d9890c/attachment.html 

From john_wetter at hopkins.k12.mn.us  Thu Jan 22 07:19:22 2009
From: john_wetter at hopkins.k12.mn.us (John Wetter)
Date: Thu, 22 Jan 2009 09:19:22 -0600
Subject: [Casper] SystemConfigTrigger to turn of airport when someone
 plugs	back into ethernet
In-Reply-To: <769F61946876F740BDEDA5A4BA0A85F0054C596E@sfo1001ex02.na.corp.yr.com>
References: <769F61946876F740BDEDA5A4BA0A85F0054C596E@sfo1001ex02.na.corp.yr.com>
Message-ID: <F26880432BE828418CB54064D40C0C640CE36085CD@hopexch.hopkins.hopkinsschools.org>

I actually have this as part of my base, I set the connection order to ethernet, airport, firewire, bluetooth.  This way it will use ethernet whenever present.

-John

--
John Wetter
Technology Support Administrator
Educationsl Technology, Media  & Information Services
Hopkins Public Schools
952-988-5373
________________________________
From: casper-bounces at list.jamfsoftware.com [casper-bounces at list.jamfsoftware.com] On Behalf Of Dagel, Rich [Rich.Dagel at landor.com]
Sent: Wednesday, January 21, 2009 11:51 PM
To: Casper List
Subject: [Casper] SystemConfigTrigger to turn of airport when someone plugs back into ethernet


Has anyone tried this yet from the resources kit?  Not sure how to go about scripting systemconfigtrigger to do it, but was told it could be done.

rich

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/d91cf3ec/attachment.htm 

From CMyers at uclan.ac.uk  Thu Jan 22 07:23:15 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 22 Jan 2009 15:23:15 +0000
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <4978398B.7141.0039.0@kckps.org>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
	<49788659.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901220659x3e1537adufe676d63afc459f2@mail.gmail.com>
	<4978398B.7141.0039.0@kckps.org>
Message-ID: <49788F63.BB96.0081.0@uclan.ac.uk>

well some of our network guys are super paranoid and what they dont know
scares em and they dont know macs, but the head of networks is my old
boss and mate so i can get things via him, 

with remote desktop and task server (which uses mulitcast but doesnt
document that anywhere) i used an unmanaged 1gb switch and pushed
software packages out via ARD to 40 macs and it was way faster. 

Can Capsers mulitcast be edited to only multicast to certain ips etc? i
don't really know mulitcast. 

The macs being 1gb had no problem with mulitcast but we still have
servers on 10mb and  it took them down. 

We were meant to have a separate VLan for the Macs but again networks
wont do it, and seeing as we have 250macs and 5000 PC's they wont submit


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 22, 2009 at  3:16 PM, in message
<4978398B.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org>
wrote:

hahahaha mountain dew and donuts.  I used to bring in home made
meatballs (family recipe) and our old Cisco guy would snarf them up,
still woulnd't give me access to a switch.  My current job my Cisco guy
is way cooler and way more laid back.  He would give me a switch (if he
can spare it) to test things like this out, where as my last job the guy
was a nut job and super secretive.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/22/09 8:59 AM >>>
I haven't had a chance to use the Casper Multicast app from the Resource
Kit yet. 


If your organization is big enough to have twitchy network guys,
hopefully its big enough to have a lab where you can have your own
isolated switch on which to run multicast sessions. 



If you do have a dedicated network group, keep in mind that you're their
customer much as the end user is your customer.  Request a network
segment where you *can* multicast.  This is a request for technology
needed to perform your job, and it's as valid as a graphic designer
requesting a Photoshop installation.  Be nice, try not to be the kind of
user you dislike dealing with, but at the same time, understand that you
are requesting something that is both possible and necessary.  Don't be
afraid to resort to bribery.  Donuts, Mountain Dew & beer are some
generally accepted geek bribes.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/22 Criss Myers 
<CMyers at uclan.ac.uk> 




not tried multicast as its banned here, i used ARD which mutlicasts and
that didnt go down well with the networks guys, 


If one can set mulitcast so it doesnt upset a network then id try it 




Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054




>>> On Thu, Jan 22, 2009 at  2:40 PM, in message
<49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org>
wrote:





Yup, and when you are mass imaging thousands of machines block copying
one master image instead of a base image and then a bunch of separate
packages is more efficient.  I have a PDF that I am tossing together of
the basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of
AFP throughput graphs from our servers, both G5 desktops, G5 PPC Xserves
and of course our new Intel Xserves.   


AFP throughput drops tremendously when you have tons of unicasting
connections that are pulling down packages at different times.  Package

based deployment is really nice machine by doing a larger block copy of a complete image. 


AFP kind of sucks in that sense.  I have yet to try out the
multi-casting abilities of Casper. 


Anyone use multi-casting with Casper?


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>

I do pretty much the same as Thomas, 


I install all Web 2.0 based apps such as firewfox, realplayer, flash
plugin, shockwave plugin, google notifier, web links, adobe media
player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl,
plus system hacks such as modfied login window, logout messages, about
this mac hack, delete unwanted Utilites and apps such as Applescript
editor, Mail, Chess etc, relocate Apps into different folder, such as an
Accessories folder, install key drivers for added hardware. Remove all
network devices settings but Ethernet and set to DHCP. 


Then i bind to OD and AD to test with network users, and then unbind and
make a master image. 


I then use Casper to install applications, hooks, updates and patches
and local accounts, set the efi password, add printers, and manage the
clients with WGM. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 21, 2009 at 11:43 PM, in message
<49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin"
<tlarki at kckps.org> wrote:

I am currently on hold on my cell phone calling a utilities company so I
am very bored and can't do anything.  I am also not in my office so I
don't have my complete list of notes on my image handy but I can give
you a rough draft of what I do to create a master image.

1)  Wipe and reload OS on a machine to create master image
2)  Install desired apps I wanted bundled in the default image, and
casper client
3)  run any and all updates
4)  configure remote management
5)  create hidden admin accounts, one for casper, one for local
administration, one for others who may need admin access
6)  delete all local user accounts that are not hidden
7)  create a very basic, limited user account that is local, for just in
case scenarios
8)  move all "admin only" apps to /Applications/Utilities
9)  change ownership of /Applications to root:admin
10)  change permissions of /Applications/Utilities to 770 so any user
not in the admin group is denied access
11)  In WGM create nested group and only allow apps to run from
/Applications and no where else.
12)  If a developer makes an app that needs to be writeable, I create a
symbolic link to the file in question typically in /Users/shared so no
one but admins can write to /Applications
13)  Set any environment specific settings up, ie Network, DNS, BIND,
etc
14)  Test with a test account to make sure mobile accounts sync, then of
course delete said account
15)  Triple check that everything works, log ins, group policy and MCX,
apps, network connection, etc
16)  clear all cahces, temp files, and logs
17)  create image

I am sure I am missing a few things as I do not have my notes in front
of me, that is basically the idea though.  I also have a few post image
scripts that run that are building specific.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
I am updating my documentation on master image creation.  Just wondering
what others are doing to customize their master image.  Such as:
Turning of external accounts,
Setting time machine to not offer new disks for backup
Deleting networkinterfaces plist


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United 
States
415 365 3933
http://wCasper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/d62147c3/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan 22 07:31:52 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 10:31:52 -0500
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49788F63.BB96.0081.0@uclan.ac.uk>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
	<49788659.BB96.0081.0@uclan.ac.uk>
	<ec2e75ff0901220659x3e1537adufe676d63afc459f2@mail.gmail.com>
	<4978398B.7141.0039.0@kckps.org> <49788F63.BB96.0081.0@uclan.ac.uk>
Message-ID: <ec2e75ff0901220731q36a2f104uc30c7d7b646a82e@mail.gmail.com>

What would happen in your organization if you refused to deploy an
application that an end user needed?  If someone in your organization
refuses to deliver a necessary item to you, it's an analogous situation.

If you've been as nice as you can be and followed any established policies
and/or processes involved, yet someone refuses to give you something that is
both possible and necessary to your job, I'd say that's a matter to take to
your boss and possibly theirs as well.  Just be sure you've exhausted all
diplomatic possibilities before escalating the issue.
----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 22, 2009 at 10:23 AM, Criss Myers <CMyers at uclan.ac.uk> wrote:

>  well some of our network guys are super paranoid and what they dont know
> scares em and they dont know macs, but the head of networks is my old boss
> and mate so i can get things via him,
>
>  with remote desktop and task server (which uses mulitcast but doesnt
> document that anywhere) i used an unmanaged 1gb switch and pushed software
> packages out via ARD to 40 macs and it was way faster.
>
>  Can Capsers mulitcast be edited to only multicast to certain ips etc? i
> don't really know mulitcast.
>
>  The macs being 1gb had no problem with mulitcast but we still have
> servers on 10mb and  it took them down.
>
>  We were meant to have a separate VLan for the Macs but again networks
> wont do it, and seeing as we have 250macs and 5000 PC's they wont submit
>
>
>
> Criss Myers
> Senior Customer Support Analyst (Mac Services)
> Apple Certified Technical Coordinator v10.5
> LIS Business Support Team
> Library 301
> University of Central Lancashire
> Preston PR1 2HE
> Ex 5054
> 01772 895054
>
> >>> On Thu, Jan 22, 2009 at  3:16 PM, in message <
> 4978398B.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:
>
>  hahahaha mountain dew and donuts.  I used to bring in home made meatballs
> (family recipe) and our old Cisco guy would snarf them up, still woulnd't
> give me access to a switch.  My current job my Cisco guy is way cooler and
> way more laid back.  He would give me a switch (if he can spare it) to test
> things like this out, where as my last job the guy was a nut job and super
> secretive.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/22/09 8:59 AM >>>
> I haven't had a chance to use the Casper Multicast app from the Resource
> Kit yet.
>
>
>   If your organization is big enough to have twitchy network guys,
> hopefully its big enough to have a lab where you can have your own isolated
> switch on which to run multicast sessions.
>
>
>   If you do have a dedicated network group, keep in mind that you're their
> customer much as the end user is your customer.  Request a network segment
> where you *can* multicast.  This is a request for technology needed to
> perform your job, and it's as valid as a graphic designer requesting a
> Photoshop installation.  Be nice, try not to be the kind of user you dislike
> dealing with, but at the same time, understand that you are requesting
> something that is both possible and necessary.  Don't be afraid to resort to
> bribery.  Donuts, Mountain Dew & beer are some generally accepted geek
> bribes.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   2009/1/22 Criss Myers
>
> <CMyers at uclan.ac.uk>
>
>
>   not tried multicast as its banned here, i used ARD which mutlicasts and
>> that didnt go down well with the networks guys,
>>
>>
>>  If one can set mulitcast so it doesnt upset a network then id try it
>>
>>
>>
>>
>> Criss Myers
>> Senior Customer Support Analyst (Mac Services)
>> Apple Certified Technical Coordinator v10.5
>> LIS Business Support Team
>> Library 301
>> University of Central Lancashire
>> Preston PR1 2HE
>> Ex 5054
>> 01772 895054
>>
>>
>>   >>> On Thu, Jan 22, 2009 at  2:40 PM, in message <
>> 49783117.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org>
>> wrote:
>>
>>
>>
>>    Yup, and when you are mass imaging thousands of machines block copying
>> one master image instead of a base image and then a bunch of separate
>> packages is more efficient.  I have a PDF that I am tossing together of the
>> basics.  Last summer when we reimaged 6,000 Macbooks I took a ton of AFP
>> throughput graphs from our servers, both G5 desktops, G5 PPC Xserves and of
>> course our new Intel Xserves.
>>
>>
>>  AFP throughput drops tremendously when you have tons of unicasting
>> connections that are pulling down packages at different times.  Package
>> based deployment is really nice and I love it, but when you are going to
>> image thousands of machines at once you can chop off minutes per a machine
>> by doing a larger block copy of a complete image.
>>
>>
>>  AFP kind of sucks in that sense.  I have yet to try out the
>> multi-casting abilities of Casper.
>>
>>
>>  Anyone use multi-casting with Casper?
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>> >>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/22/09 6:27 AM >>>
>>
>> I do pretty much the same as Thomas,
>>
>>
>>  I install all Web 2.0 based apps such as firewfox, realplayer, flash
>> plugin, shockwave plugin, google notifier, web links, adobe media
>> player,  flip4mac, as well as Keyserver client, Autobind, MSN, growl, plus
>> system hacks such as modfied login window, logout messages, about this mac
>> hack, delete unwanted Utilites and apps such as Applescript editor, Mail,
>> Chess etc, relocate Apps into different folder, such as an Accessories
>> folder, install key drivers for added hardware. Remove all network devices
>> settings but Ethernet and set to DHCP.
>>
>>
>>  Then i bind to OD and AD to test with network users, and then unbind and
>> make a master image.
>>
>>
>>  I then use Casper to install applications, hooks, updates and patches
>> and local accounts, set the efi password, add printers, and manage the
>> clients with WGM.
>>
>>
>>  Criss
>>
>>
>> Criss Myers
>> Senior Customer Support Analyst (Mac Services)
>> Apple Certified Technical Coordinator v10.5
>> LIS Business Support Team
>> Library 301
>> University of Central Lancashire
>> Preston PR1 2HE
>> Ex 5054
>> 01772 895054
>>
>> >>> On Wed, Jan 21, 2009 at 11:43 PM, in message <
>> 49775EA9020000390000812D at gwoes4.kckps.org>, "Thomas Larkin" <
>> tlarki at kckps.org> wrote:
>>
>> I am currently on hold on my cell phone calling a utilities company so I
>> am very bored and can't do anything.  I am also not in my office so I don't
>> have my complete list of notes on my image handy but I can give you a rough
>> draft of what I do to create a master image.
>>
>> 1)  Wipe and reload OS on a machine to create master image
>> 2)  Install desired apps I wanted bundled in the default image, and casper
>> client
>> 3)  run any and all updates
>> 4)  configure remote management
>> 5)  create hidden admin accounts, one for casper, one for local
>> administration, one for others who may need admin access
>> 6)  delete all local user accounts that are not hidden
>> 7)  create a very basic, limited user account that is local, for just in
>> case scenarios
>> 8)  move all "admin only" apps to /Applications/Utilities
>> 9)  change ownership of /Applications to root:admin
>> 10)  change permissions of /Applications/Utilities to 770 so any user not
>> in the admin group is denied access
>> 11)  In WGM create nested group and only allow apps to run from
>> /Applications and no where else.
>> 12)  If a developer makes an app that needs to be writeable, I create a
>> symbolic link to the file in question typically in /Users/shared so no one
>> but admins can write to /Applications
>> 13)  Set any environment specific settings up, ie Network, DNS, BIND, etc
>> 14)  Test with a test account to make sure mobile accounts sync, then of
>> course delete said account
>> 15)  Triple check that everything works, log ins, group policy and MCX,
>> apps, network connection, etc
>> 16)  clear all cahces, temp files, and logs
>> 17)  create image
>>
>> I am sure I am missing a few things as I do not have my notes in front of
>> me, that is basically the idea though.  I also have a few post image scripts
>> that run that are building specific.
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>> >>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/21/09 5:29 PM >>>
>> I am updating my documentation on master image creation.  Just wondering
>> what others are doing to customize their master image.  Such as:
>> Turning of external accounts,
>> Setting time machine to not offer new disks for backup
>> Deleting networkinterfaces plist
>>
>>
>> Rich Dagel
>> Senior Technology Specialist
>>
>> Landor Associates
>> 1001 Front Street
>> San Francisco, CA 94111
>> United States
>> 415 365 3933
>> http://www.landor.com
>> Rich.Dagel at landor.com
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/c5751a3e/attachment.html 

From ganderson at phrd.ab.ca  Thu Jan 22 07:59:14 2009
From: ganderson at phrd.ab.ca (Gene Anderson)
Date: Thu, 22 Jan 2009 08:59:14 -0700
Subject: [Casper] Flushing User Caches
In-Reply-To: <ec2e75ff0901220719v6f46b917qc0a2132a675de847@mail.gmail.com>
References: <ec2e75ff0901220719v6f46b917qc0a2132a675de847@mail.gmail.com>
Message-ID: <fc.000f4ccf020287853b9aca0044498296.2028e8b@phrd.ab.ca>

Thanks to everyone for their input on this issue. I think I have enough information to figure out what I'm going to do next -> which is contact JamF support. Once I used local user accounts for testing everyone's wonderful suggestions, everything worked as expected using Casper policies. However as soon as I took a working machine and used an ActiveDirectory network account with contains a _space_ in the name, then nothing works. 

I had contacted and confirmed a issue with JamF regarding adding Dock icons using Casper policies and we discovered that ActiveDirectory user accounts which contain spaces in the user's names breaks the policy and yields random results. I think this is related to the same issue in that all the scripting breaks with users who have spaces in their short names.

Thanks for your help everyone. 



Gene Anderson
Systems Analyst, ACTC, MCP
Pembina Hills Regional Division No.7
Phone: (780) 674-8535 ext 6860
email: ganderson at phrd.ab.ca

"Passwords are like bubble gum, strongest when fresh, should never be
used by groups and create a sticky mess when left laying around"

-anon



From Orlando.Castaneda at cbs.com  Thu Jan 22 09:49:16 2009
From: Orlando.Castaneda at cbs.com (Castaneda, Orlando)
Date: Thu, 22 Jan 2009 09:49:16 -0800
Subject: [Casper] adobe plugins inventory in Casper
Message-ID: <F0EAC3E495F20D469FEF8783537B23CB08A371AB@CATCNX11.cbs.ad.cbs.net>

Greetings everyone,

 

We have a need to be able to inventory after effects plugins via Casper.
I am new to this program and was wondering if anyone had experience in
this area

And could recommend a way to go to a Casper client and probe it for
serial and version number etc for AE plugins. Instead of having to go to
each individual

effect and manually entering these numbers one at a time. 

 

Thanks for your assistance.

 

orlando.castaneda at cbs.com

CBS TV

323-575-2347

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/edf01976/attachment.htm 

From miles.leacy at themacadmin.com  Thu Jan 22 10:02:29 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 22 Jan 2009 13:02:29 -0500
Subject: [Casper] adobe plugins inventory in Casper
In-Reply-To: <F0EAC3E495F20D469FEF8783537B23CB08A371AB@CATCNX11.cbs.ad.cbs.net>
References: <F0EAC3E495F20D469FEF8783537B23CB08A371AB@CATCNX11.cbs.ad.cbs.net>
Message-ID: <ec2e75ff0901221002r442a6a9ci241bde928323b30b@mail.gmail.com>

Casper tracks plugins by default.
You should be able to package serialized plugins, and deploy them via
policies, imaging or one-off remote tasks.  Some stubborn plugins may
require you to create a script to get it configured properly, or you could
negotiate with the manufacturer to provide you with an "enterprise
deployment-friendly" version of their product.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/22 Castaneda, Orlando <Orlando.Castaneda at cbs.com>

>  Greetings everyone,
>
>
>
> We have a need to be able to inventory after effects plugins via Casper. I
> am new to this program and was wondering if anyone had experience in this
> area
>
> And could recommend a way to go to a Casper client and probe it for serial
> and version number etc for AE plugins. Instead of having to go to each
> individual
>
> effect and manually entering these numbers one at a time.
>
>
>
> Thanks for your assistance.
>
>
>
> orlando.castaneda at cbs.com
>
> CBS TV
>
> 323-575-2347
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090122/b68acfe9/attachment.htm 

From craig at creativetechs.com  Thu Jan 22 16:27:48 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Thu, 22 Jan 2009 16:27:48 -0800
Subject: [Casper] Policy to Disable Automatic Updates?
In-Reply-To: <ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
References: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
	<ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
Message-ID: <17C08130-1049-463E-8CB3-7B51BBE92CF2@creativetechs.com>

> defaults -currentHost write com.apple.SoftwareUpdate  
> AutomaticDownload -bool false

Miles,

We just tested this. Setting AutomaticDownload turns off the  
background downloading, but does not stop the user notification of new  
updates. Here is the solution we found that looks like it will work  
for now. The softwareupdate binary seems to provide a number of  
controls, including the ability to turn off the schedule:

softwareupdate --schedule off

Thanks for your help. We are working on testing Word and hunting for  
Adobe updates next.

~Craig

From craig at creativetechs.com  Thu Jan 22 16:51:06 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Thu, 22 Jan 2009 16:51:06 -0800
Subject: [Casper] Policy to Disable Automatic Updates?
In-Reply-To: <ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
References: <F0EFC87B-C6DB-42F1-B854-5F7A6CD422FB@creativetechs.com>
	<ec2e75ff0901211429g6601456aj10a3da582eb18d65@mail.gmail.com>
Message-ID: <DBBDBDB4-5437-4B7F-926C-EFBCEAAAD437@creativetechs.com>

> defaults write com.microsoft.autoupdate2 HowToCheck -string "Manual"

Miles, We just tested this, and it appears to work perfectly. And I  
can add a couple more details.

To turn off Microsoft AutoUpdate for Office 2004:
defaults write com.microsoft.autoupdate HowToCheck -string "Manual"

To turn off Microsoft AutoUpdate for Office 2008:
defaults write com.microsoft.autoupdate2 HowToCheck -string "Manual"

And as an interesting aside, there are two separate update utilities.  
The 2004 update utility is "Microsoft AutoUpdate" is generally loose  
in Applications, while the 2008 update utility is tucked away in  
Library/Application Support/Microsoft/MAU 2.0/

~Craig

From pcummins at plc.wa.edu.au  Thu Jan 22 23:36:59 2009
From: pcummins at plc.wa.edu.au (Philip Cummins)
Date: Fri, 23 Jan 2009 16:36:59 +0900
Subject: [Casper] Master Image Creation Checklist
In-Reply-To: <49783117.7141.0039.0@kckps.org>
References: <49775EA9020000390000812D@gwoes4.kckps.org>
	<49786620.BB96.0081.0@uclan.ac.uk> <49783117.7141.0039.0@kckps.org>
Message-ID: <C40C3A95-EEE6-434B-93AC-E2B109D4DFF3@plc.wa.edu.au>

Hello,

> AFP throughput drops tremendously when you have tons of unicasting  
> connections that are pulling down packages at different times.   
> Package based deployment is really nice and I love it, but when you  
> are going to image thousands of machines at once you can chop off  
> minutes per a machine by doing a larger block copy of a complete  
> image.

AFP suffers massive penalties the more connections and more file  
accesses you do (DMG's are usually OK if you have good FS caches, but  
lots of small files will punish). If the network is set up properly  
multicasting can do effectively 1 to thousands of computers without  
too much of a problem. We blast over 17 GiB (compressed) to about 40  
computers at a time and it will finish in a guaranteed 40 or so  
minutes (we could probably trim it down to 35 or 30 minutes if we push  
the data rate but you can run the risk of packet loss). Our main  
limiting factor is space to set up laptops with power/connectivity for  
NetBoot. Adding additional switches for 20+ laptops at a time is not a  
problem except for NetBoot (if I make a custom MC image that would  
work OK). Cisco switches require IGMP snooping and the querier running  
to handle clients joining and leaving the multicast network properly.  
In addition the port interfaces require igmp snooping on tcn flood to  
be disabled so if new clients join/connect to the port they don't get  
swamped with packets of multicast data, esp if you mix 10/100 and  
Gigabit devices. In a controlled network this should be possible (ie,  
private network + switches), otherwise some work will be needed to  
support it on the internal networks as people mention. Testing is  
essential, you can easily start getting hundreds of MB's a second  
going over multicast if you have multiple images running  
simultaneously which can hammer a Gig to 100 MBps connection easily  
when they each start going at 15+ MiB/sec.

> AFP kind of sucks in that sense.  I have yet to try out the multi- 
> casting abilities of Casper. Anyone use multi-casting with Casper?

We don't use Casper for multicasting but I'd imagine a script could be  
made after NetBoot into Casper Imaging to accept a connection to  
restore a large disk image via multicast. At the moment we use  
multicast via asr to dump the image, then restart and join Casper  
afterwards. The setup usually is to configure the server with multiple  
multicast IP's and ports (ie, 224.x.x.31:7831, 224.x.x.32:7832) in the  
asr plist configuration and adjust the multicast data rates to avoid  
packet loss. So, probably easiest to start with a unmanaged switch (or  
good quality one if you plan on multiple multicasts), private network  
+ private Gig Ethernet connection and test from there.

Philip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090123/f15c78da/attachment.htm 

From jared.nichols at ll.mit.edu  Fri Jan 23 09:08:34 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Fri, 23 Jan 2009 12:08:34 -0500
Subject: [Casper] Defaults write set software update interval
Message-ID: <C59F63C2.1AB92%jared.nichols@ll.mit.edu>

Hi-

What's the best way to set the software update interval (daily/monthly/weekly) with defaults write?  Basically, I want to ensure machines are checking in weekly with our internal update server.

Thanks

j
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090123/3f355756/attachment.htm 

From jared.nichols at ll.mit.edu  Fri Jan 23 09:08:34 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Fri, 23 Jan 2009 12:08:34 -0500
Subject: [Casper] Defaults write set software update interval
Message-ID: <C59F63C2.1AB92%jared.nichols@ll.mit.edu>

Hi-

What's the best way to set the software update interval (daily/monthly/weekly) with defaults write?  Basically, I want to ensure machines are checking in weekly with our internal update server.

Thanks

j
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090123/3f355756/attachment.html 

From miles.leacy at themacadmin.com  Fri Jan 23 12:40:56 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 23 Jan 2009 15:40:56 -0500
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <C59F63C2.1AB92%jared.nichols@ll.mit.edu>
References: <C59F63C2.1AB92%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901231240h200a8dcbua9359eaf346090b5@mail.gmail.com>

Jared,
It's a byhost preference called com.apple.scheduler.  I'd have to sit with
it for a bit to get the exact sequence of commands, and PlistBuddy would be
easier than defaults.

What would be even easier would be to turn off the schedule on the client,
enter your Software Update Server's info into your JSS, and run Software
Update via Casper policy.  Software Update is a checkbox in the Packages
tab, and you can have your policy run every day, week or month.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/23 Nichols, Jared <jared.nichols at ll.mit.edu>

>  Hi-
>
> What's the best way to set the software update interval
> (daily/monthly/weekly) with defaults write?  Basically, I want to ensure
> machines are checking in weekly with our internal update server.
>
> Thanks
>
> j
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090123/a1a099dc/attachment.html 

From tlarki at kckps.org  Sun Jan 25 13:26:00 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Sun, 25 Jan 2009 15:26:00 -0600
Subject: [Casper] drop box group
Message-ID: <497C83F502000039000082E2@gwoes4.kckps.org>

Everyone

I have had a drop box account for a while now at www.getdropbox.com.  I was thinking it would be cool if we maybe signed up and started a Macintosh System's Administrator group.  Instead of emailing scripts, configs, and documents to each other we can just share our shared drop box folders.  The service is web based, free, uses HTTPS port 443, and while there is no way to set up groups yet but we could share our files and keep them sync'd instead of hunting down that email you maybe saved or maybe trashed.

Anyone think this is a good idea let me know and I will share my dropbox with you.  I already have a scripts folder I share with my fellow IT workers.

thx

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351




From mahughe at kckps.org  Sun Jan 25 16:40:38 2009
From: mahughe at kckps.org (Mark Hughes)
Date: Sun, 25 Jan 2009 18:40:38 -0600
Subject: [Casper] drop box group
Message-ID: <497CB226020000A30000A7B0@gwoes4.kckps.org>

Maybe our friends at Casper could setup a space for us somewhere with them since the group is already together.


Mark Hughes, Apple Technician
TIS Department, KCKPS USD500
Cell 913-449-7791
mahughe at kckps.org
>>> "Thomas Larkin" <tlarki at kckps.org> 01/25/09 3:26 PM >>>
Everyone

I have had a drop box account for a while now at www.getdropbox.com.  I was thinking it would be cool if we maybe signed up and started a Macintosh System's Administrator group.  Instead of emailing scripts, configs, and documents to each other we can just share our shared drop box folders.  The service is web based, free, uses HTTPS port 443, and while there is no way to set up groups yet but we could share our files and keep them sync'd instead of hunting down that email you maybe saved or maybe trashed.

Anyone think this is a good idea let me know and I will share my dropbox with you.  I already have a scripts folder I share with my fellow IT workers.

thx

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


From jared.nichols at ll.mit.edu  Mon Jan 26 05:33:25 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Mon, 26 Jan 2009 08:33:25 -0500
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <ec2e75ff0901231240h200a8dcbua9359eaf346090b5@mail.gmail.com>
Message-ID: <C5A325D8.1ABD1%jared.nichols@ll.mit.edu>

That's exactly my goal :)  I asked about setting the interval on the plist because I want to disable it on the clients and run it strictly from a policy.

Now that I know it's in the scheduler plist that sets me on the right track.

Thanks!

j


On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

What would be even easier would be to turn off the schedule on the client, enter your Software Update Server's info into your JSS, and run Software Update via Casper policy.  Software Update is a checkbox in the Packages tab, and you can have your policy run every day, week or month.

--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/e994bb01/attachment.htm 

From ERNSTCS at uwec.edu  Mon Jan 26 05:58:28 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Mon, 26 Jan 2009 07:58:28 -0600
Subject: [Casper] drop box group
In-Reply-To: <497CB226020000A30000A7B0@gwoes4.kckps.org>
Message-ID: <C5A31DA4.12F20%ernstcs@uwec.edu>

Sounds like something for the resourcekit group. Copying it there so Nick sees it (even though Nick sees everything, I know it).

Craig E


On 1/25/09 6:40 PM, "Mark Hughes" <mahughe at kckps.org> wrote:

Maybe our friends at Casper could setup a space for us somewhere with them since the group is already together.


Mark Hughes, Apple Technician
TIS Department, KCKPS USD500
Cell 913-449-7791
mahughe at kckps.org
>>> "Thomas Larkin" <tlarki at kckps.org> 01/25/09 3:26 PM >>>
Everyone

I have had a drop box account for a while now at www.getdropbox.com.  I was thinking it would be cool if we maybe signed up and started a Macintosh System's Administrator group.  Instead of emailing scripts, configs, and documents to each other we can just share our shared drop box folders.  The service is web based, free, uses HTTPS port 443, and while there is no way to set up groups yet but we could share our files and keep them sync'd instead of hunting down that email you maybe saved or maybe trashed.

Anyone think this is a good idea let me know and I will share my dropbox with you.  I already have a scripts folder I share with my fellow IT workers.

thx

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/8b1ad9db/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 26 06:01:16 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 26 Jan 2009 09:01:16 -0500
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <C5A325D8.1ABD1%jared.nichols@ll.mit.edu>
References: <ec2e75ff0901231240h200a8dcbua9359eaf346090b5@mail.gmail.com>
	<C5A325D8.1ABD1%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901260601n6f8a6278y50617e80145c0789@mail.gmail.com>

To turn the automatic checking off, use this command...
softwareupdate --schedule off

That's a lot easier than messing with plists.

You can put that into a policy for existing computers, and/or make it a part
of your configuration for new deployments.  If you do, make sure you set it
to be an "at reboot" script.

Then you can simply use the checkbox in the "Packages" tab of your policy to
call software update.

I consider this a best practice and these are among the first
policies/scripts I create when installing a JSS.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu>wrote:

>  That's exactly my goal :)  I asked about setting the interval on the
> plist because I want to disable it on the clients and run it strictly from a
> policy.
>
> Now that I know it's in the scheduler plist that sets me on the right
> track.
>
> Thanks!
>
> j
>
>
> On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:
>
> What would be even easier would be to turn off the schedule on the client,
> enter your Software Update Server's info into your JSS, and run Software
> Update via Casper policy.  Software Update is a checkbox in the Packages
> tab, and you can have your policy run every day, week or month.
>
>
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/f3bb86c9/attachment.htm 

From NATHANIEL.LINDLEY at spps.org  Mon Jan 26 07:47:48 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Mon, 26 Jan 2009 09:47:48 -0600
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <ec2e75ff0901260601n6f8a6278y50617e80145c0789@mail.gmail.com>
Message-ID: <OF283EDA02.B5A46C41-ON8625754A.00569AFE-8625754A.005775A1@spps.org>

Thanks for the command to turn off software update checking, I couldn't 
get it to stop reliably before.  It there a way to set this script to FEU 
and FUT?   A system wide "softwareupdate --schedule off"  Otherwise it 
appears that new users have software update checking on.
Thanks,

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861



Miles Leacy <miles.leacy at themacadmin.com> 
Sent by: casper-bounces at list.jamfsoftware.com
01/26/09 07:54 AM

To
"Nichols, Jared" <jared.nichols at ll.mit.edu>
cc
Casper List <casper at list.jamfsoftware.com>
Subject
Re: [Casper] Defaults write set software update interval






To turn the automatic checking off, use this command...

softwareupdate --schedule off

That's a lot easier than messing with plists.

You can put that into a policy for existing computers, and/or make it a 
part of your configuration for new deployments.  If you do, make sure you 
set it to be an "at reboot" script.

Then you can simply use the checkbox in the "Packages" tab of your policy 
to call software update.

I consider this a best practice and these are among the first 
policies/scripts I create when installing a JSS.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu> 
wrote:
That's exactly my goal :)  I asked about setting the interval on the plist 
because I want to disable it on the clients and run it strictly from a 
policy.

Now that I know it's in the scheduler plist that sets me on the right 
track.

Thanks!

j



On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

What would be even easier would be to turn off the schedule on the client, 
enter your Software Update Server's info into your JSS, and run Software 
Update via Casper policy.  Software Update is a checkbox in the Packages 
tab, and you can have your policy run every day, week or month.

-- 
Jared Nichols
ISD Infrastructure and Operations ? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/641f757e/attachment.htm 

From john_wetter at hopkins.k12.mn.us  Mon Jan 26 08:11:45 2009
From: john_wetter at hopkins.k12.mn.us (John Wetter)
Date: Mon, 26 Jan 2009 10:11:45 -0600
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <OF283EDA02.B5A46C41-ON8625754A.00569AFE-8625754A.005775A1@spps.org>
Message-ID: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>

I seldom use that anymore because it only applies it to the root user.  I have it set as a command to run once for each user, but it seems to be running it as root, so it isn't applying it to the user logging in.  This looks to be the same issue as we ran in to trying to change the Office plists.

So, for now I guess moving plists is still what we'll have to do...  Unless there is a way to get these to apply to each individual user?

-John


On 1/26/09 9:47 AM, "NATHANIEL.LINDLEY at spps.org" <NATHANIEL.LINDLEY at spps.org> wrote:


Thanks for the command to turn off software update checking, I couldn't get it to stop reliably before.  It there a way to set this script to FEU and FUT?   A system wide "softwareupdate --schedule off"  Otherwise it appears that new users have software update checking on.
Thanks,

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861


Miles Leacy <miles.leacy at themacadmin.com>
Sent by: casper-bounces at list.jamfsoftware.com 01/26/09 07:54 AM

To

"Nichols, Jared" <jared.nichols at ll.mit.edu>

cc

Casper List <casper at list.jamfsoftware.com>

Subject

Re: [Casper] Defaults write set software update interval




To turn the automatic checking off, use this command...

softwareupdate --schedule off

That's a lot easier than messing with plists.

You can put that into a policy for existing computers, and/or make it a part of your configuration for new deployments.  If you do, make sure you set it to be an "at reboot" script.

Then you can simply use the checkbox in the "Packages" tab of your policy to call software update.

I consider this a best practice and these are among the first policies/scripts I create when installing a JSS.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <mailto:miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com/>




On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu <mailto:jared.nichols at ll.mit.edu> > wrote:
That's exactly my goal :)  I asked about setting the interval on the plist because I want to disable it on the clients and run it strictly from a policy.

Now that I know it's in the scheduler plist that sets me on the right track.

Thanks!

j



On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com/> > wrote:

What would be even easier would be to turn off the schedule on the client, enter your Software Update Server's info into your JSS, and run Software Update via Casper policy.  Software Update is a checkbox in the Packages tab, and you can have your policy run every day, week or month.

--
John Wetter
Technology Support Administrator
Educational Technology, Media & Information Services
Hopkins Public Schools
952-988-5373
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/33ba319a/attachment.htm 

From ERNSTCS at uwec.edu  Mon Jan 26 08:15:51 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Mon, 26 Jan 2009 10:15:51 -0600
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
Message-ID: <C5A33DD7.12F48%ernstcs@uwec.edu>

I have a user environment package that disables software updates which is applied to the user template.


 *   Set your desired Software Update settings using the same account you create your software packages from
 *   Run Composer, go to the User Environment tab, check Software Update Settings, and click Save to...
 *   Add to your JSS with Casper Admin and make sure Fill User Templates is checked.

Every new user profile created on a machine with that package will no longer have updates on. You can even push the package out to existing users if you really wanted to.

Craig E


On 1/26/09 10:11 AM, "John Wetter" <john_wetter at hopkins.k12.mn.us> wrote:

I seldom use that anymore because it only applies it to the root user.  I have it set as a command to run once for each user, but it seems to be running it as root, so it isn't applying it to the user logging in.  This looks to be the same issue as we ran in to trying to change the Office plists.

So, for now I guess moving plists is still what we'll have to do...  Unless there is a way to get these to apply to each individual user?

-John


On 1/26/09 9:47 AM, "NATHANIEL.LINDLEY at spps.org" <NATHANIEL.LINDLEY at spps.org> wrote:


Thanks for the command to turn off software update checking, I couldn't get it to stop reliably before.  It there a way to set this script to FEU and FUT?   A system wide "softwareupdate --schedule off"  Otherwise it appears that new users have software update checking on.
Thanks,

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861


Miles Leacy <miles.leacy at themacadmin.com>
Sent by: casper-bounces at list.jamfsoftware.com 01/26/09 07:54 AM

To

"Nichols, Jared" <jared.nichols at ll.mit.edu>

cc

Casper List <casper at list.jamfsoftware.com>

Subject

Re: [Casper] Defaults write set software update interval




To turn the automatic checking off, use this command...

softwareupdate --schedule off

That's a lot easier than messing with plists.

You can put that into a policy for existing computers, and/or make it a part of your configuration for new deployments.  If you do, make sure you set it to be an "at reboot" script.

Then you can simply use the checkbox in the "Packages" tab of your policy to call software update.

I consider this a best practice and these are among the first policies/scripts I create when installing a JSS.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <mailto:miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com/>




On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu <mailto:jared.nichols at ll.mit.edu> > wrote:
That's exactly my goal :)  I asked about setting the interval on the plist because I want to disable it on the clients and run it strictly from a policy.

Now that I know it's in the scheduler plist that sets me on the right track.

Thanks!

j



On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com/> > wrote:

What would be even easier would be to turn off the schedule on the client, enter your Software Update Server's info into your JSS, and run Software Update via Casper policy.  Software Update is a checkbox in the Packages tab, and you can have your policy run every day, week or month.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/e9ae7af4/attachment.htm 

From craig at creativetechs.com  Mon Jan 26 08:16:05 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Mon, 26 Jan 2009 08:16:05 -0800
Subject: [Casper] Scripts for Disabling Updates: Apple, Adobe, Microsoft
Message-ID: <7ACFC2FB-1EC8-4B1F-9B3B-24D0C4CD1F48@creativetechs.com>

For everyone who wants an easy way to turn off automatic updates, here  
is a link to download a tested script that disables:
	- Apple Software Update
	- Adobe CS3/CS4 Updater
	- Microsoft Office 2004/2008 AutoUpdate

http://www.makemacwork.com/disable-automatic-updates.htm

We spent a lot of time working and testing various scripts last week,  
and this one seems to be working properly on all our test systems when  
deployed with Casper.

I hope this is useful. We had a lot of fun working on it.

I'm including the resourcekit group in this email too, in case Nick  
thinks this might something good to include in future kits.

We'd appreciate any feedback on this script. We'll make updates as  
needed.

~Craig

---
Phone: 206-682-4315
Email: help at creativetechs.com
Web: http://www.creativetechs.com
Twitter: http://twitter.com/creativetechs
Tagline: Left-brain support for Right-brain Pros.

From craig at creativetechs.com  Mon Jan 26 08:29:47 2009
From: craig at creativetechs.com (Craig Swanson)
Date: Mon, 26 Jan 2009 08:29:47 -0800
Subject: [Casper] Scripts for Disabling Updates: Apple, Adobe, Microsoft
In-Reply-To: <C5A33FCE.8148%john_wetter@hopkins.k12.mn.us>
References: <C5A33FCE.8148%john_wetter@hopkins.k12.mn.us>
Message-ID: <91BB3FF9-8E2A-4019-B699-603E263FDA7B@creativetechs.com>

> Craig, have you gotten that to apply for every user on a computer  
> using Casper?  I?m still having issues with stuff only running as  
> root which makes this not apply when deploying using Casper 6.01.

John, that's what I'm most proud of in this script.

You are correct. We found that deploying the "softwareupdate -- 
schedule off" command via Casper only applies the change to the root  
user by default.

This script uses sudo to run the softwareupdate commands while  
masquerading as all the other users on a machine. Which lets you push  
out this (and other commands) system wide.

That technique also applies to Office and Adobe automatic updaters.

It took us a fair bit of testing to come up with this technique.  
(Note: We ls command to get a list of all the directories in /Users,  
so I can imagine some unique environments where this technique might  
not apply.)

Read Jordan's post at our technical blog, Make Mac Work. He's done a  
nice job writing up the full technique in detail:

http://www.makemacwork.com/disable-automatic-updates.htm

~Craig

PS> I like an earlier suggestion to incorporate those changes to the  
new user template as well -- we'll have to incorporate that into a  
future update. 

From jstrauss at loyolahs.edu  Mon Jan 26 08:31:26 2009
From: jstrauss at loyolahs.edu (Jeff Strauss)
Date: Mon, 26 Jan 2009 08:31:26 -0800
Subject: [Casper] Keychain addition during imaging
Message-ID: <C5A3255E.329C%jstrauss@loyolahs.edu>

Hey all,

Is there a way to add an entry to the Keychain during imaging with a script? Basically, I'd like to use one base image, but insert one of a few scripts somewhere that will add the client to a specified wireless SSID. Possible, or does the SSID have to be added to the keychain before taking a base image?

Thanks,


Jeffrey A. Strauss
Department of Educational Technology
Systems Administrator
Loyola High School of Los Angeles
1901 Venice Blvd.
Los Angeles, Ca 90006
(213) 381-5121 x265

Please consider the environment before printing this e-mail.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/33fdcfb9/attachment.htm 

From miles.leacy at themacadmin.com  Mon Jan 26 08:42:43 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 26 Jan 2009 11:42:43 -0500
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
References: <OF283EDA02.B5A46C41-ON8625754A.00569AFE-8625754A.005775A1@spps.org>
	<C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
Message-ID: <ec2e75ff0901260842g36565324ye4ff1c23902f8c11@mail.gmail.com>

Right.
Thanks for picking up on that.  I'm doing a little too much multitasking
right now...  :)

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/26 John Wetter <john_wetter at hopkins.k12.mn.us>

>  I seldom use that anymore because it only applies it to the root user.  I
> have it set as a command to run once for each user, but it seems to be
> running it as root, so it isn't applying it to the user logging in.  This
> looks to be the same issue as we ran in to trying to change the Office
> plists.
>
> So, for now I guess moving plists is still what we'll have to do...  Unless
> there is a way to get these to apply to each individual user?
>
> -John
>
>
> On 1/26/09 9:47 AM, "NATHANIEL.LINDLEY at spps.org" <
> NATHANIEL.LINDLEY at spps.org> wrote:
>
>
> Thanks for the command to turn off software update checking, I couldn't get
> it to stop reliably before.  It there a way to set this script to FEU and
> FUT?   A system wide "softwareupdate --schedule off"  Otherwise it appears
> that new users have software update checking on.
> Thanks,
>
> Nathaniel Lindley
>
> ++++++++++++++++++
> Educational Technology
> Saint Paul Public Schools
> Saint Paul, Minnesota
> nathaniel.lindley at spps.org
> phone:  651-248-6861
>
>
> *Miles Leacy <miles.leacy at themacadmin.com>*
> Sent by: casper-bounces at list.jamfsoftware.com 01/26/09 07:54 AM
>
> To
>
> "Nichols, Jared" <jared.nichols at ll.mit.edu>
>
> cc
>
> Casper List <casper at list.jamfsoftware.com>
>
> Subject
>
> Re: [Casper] Defaults write set software update interval
>
>
>
>
> To turn the automatic checking off, use this command...
>
> softwareupdate --schedule off
>
> That's a lot easier than messing with plists.
>
> You can put that into a policy for existing computers, and/or make it a
> part of your configuration for new deployments.  If you do, make sure you
> set it to be an "at reboot" script.
>
> Then you can simply use the checkbox in the "Packages" tab of your policy
> to call software update.
>
> I consider this a best practice and these are among the first
> policies/scripts I create when installing a JSS.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> *miles.leacy at themacadmin.com* <mailto:miles.leacy at themacadmin.com<miles.leacy at themacadmin.com>>
>
> *www.themacadmin.com* <http://www.themacadmin.com/>
>
>
>
>
> On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <*jared.nichols at ll.mit.edu
> * <mailto:jared.nichols at ll.mit.edu <jared.nichols at ll.mit.edu>> > wrote:
>
> That's exactly my goal :)  I asked about setting the interval on the plist
> because I want to disable it on the clients and run it strictly from a
> policy.
>
> Now that I know it's in the scheduler plist that sets me on the right
> track.
>
> Thanks!
>
> j
>
>
>
> On 1/23/09 15:40 , "Miles Leacy" <*miles.leacy at themacadmin.com* <
> http://miles.leacy at themacadmin.com/> > wrote:
>
> What would be even easier would be to turn off the schedule on the client,
> enter your Software Update Server's info into your JSS, and run Software
> Update via Casper policy.  Software Update is a checkbox in the Packages
> tab, and you can have your policy run every day, week or month.
>
>
> --
> John Wetter
> Technology Support Administrator
> Educational Technology, Media & Information Services
> Hopkins Public Schools
> 952-988-5373
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/7d6acbd2/attachment.html 

From tlarki at kckps.org  Mon Jan 26 08:43:30 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Mon, 26 Jan 2009 10:43:30 -0600
Subject: [Casper] Keychain addition during imaging
In-Reply-To: <C5A3255E.329C%jstrauss@loyolahs.edu>
References: <C5A3255E.329C%jstrauss@loyolahs.edu>
Message-ID: <497D93D2.7141.0039.0@kckps.org>

I have Apple Enterprise support and I tried doing this exact same thing.
 This is what I was told by Apple engineers in a nutshell.  Using the
networksetup binary along with the security binary fill in fact add the
SSID you want and it will create a keychain, however there is no way to
input any kind of encryption key due to it's limitation.  I was told by
them to just replace the whole system keychain, which can be packaged
with Composer and installed as a post image package. 

here is the down side, it will over write any existing keychain thus
destroying anything the user has in place with their keychain.  If you
sync user keychains I am not sure what would happen.  I asked them to
forward it to development as a feature request. 

If you can actually make it work I would love to know I came up with
dead ends and ended up creating a new package via Composer.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Jeff Strauss <jstrauss at loyolahs.edu> 01/26/09 10:31 AM >>>

Hey all,

Is there a way to add an entry to the Keychain during imaging with a
script? Basically, I?d like to use one base image, but insert one of a
few scripts somewhere that will add the client to a specified wireless
SSID. Possible, or does the SSID have to be added to the keychain before
taking a base image?

Thanks,


Jeffrey A. Strauss
Department of Educational Technology
Systems Administrator
Loyola High School of Los Angeles
1901 Venice Blvd.
Los Angeles, Ca 90006
(213) 381-5121 x265
 
Please consider the environment before printing this e-mail.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/e82718e6/attachment.htm 

From hbonath at computersitecolumbus.com  Mon Jan 26 08:45:59 2009
From: hbonath at computersitecolumbus.com (Henry Bonath)
Date: Mon, 26 Jan 2009 11:45:59 -0500
Subject: [Casper] Automate configuring of Entourage
Message-ID: <C5A352F7.9A18%hbonath@computersitecolumbus.com>

Do any of you have any experience automating the configuration of Entourage?
I have found an AppleScript that will do some of it, but it isn't truly hands-off and requires some end user interaction.
I'm just looking for some info/insight on this and what you guys have done to deploy Entourage remotely in an Exchange environment.
Thanks!
________________________________

[http://www.computersitecolumbus.com/images/CSC_Logo.jpg]
Henry Bonath
Network Engineer
Computer Site Columbus
6155-N Huntley Road
Columbus, OH 43229
computersitecolumbus.com
Tel: 614.786.7100
Cell: 614.738.0822
Fax: 614.786.7310

Your I.T. Department


________________________________
11:47:41 Mon 26 Jan 2009


This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/d8e0d71a/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 26 08:52:07 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 26 Jan 2009 11:52:07 -0500
Subject: [Casper] Keychain addition during imaging
In-Reply-To: <497D93D2.7141.0039.0@kckps.org>
References: <C5A3255E.329C%jstrauss@loyolahs.edu>
	<497D93D2.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901260852q42bf41ar2ca143d54ca31c44@mail.gmail.com>

How secure does it have to be?
The following, as an "at reboot" script should do the trick.

networksetup -setairportnetwork <network> <password>

Of course, that means putting a password in a script, which shouldn't be
done lightly.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/26 Thomas Larkin <tlarki at kckps.org>

>  I have Apple Enterprise support and I tried doing this exact same thing.
>  This is what I was told by Apple engineers in a nutshell.  Using the
> networksetup binary along with the security binary fill in fact add the SSID
> you want and it will create a keychain, however there is no way to input any
> kind of encryption key due to it's limitation.  I was told by them to just
> replace the whole system keychain, which can be packaged with Composer and
> installed as a post image package.
>
>  here is the down side, it will over write any existing keychain thus
> destroying anything the user has in place with their keychain.  If you sync
> user keychains I am not sure what would happen.  I asked them to forward it
> to development as a feature request.
>
>  If you can actually make it work I would love to know I came up with dead
> ends and ended up creating a new package via Composer.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Jeff Strauss <jstrauss at loyolahs.edu> 01/26/09 10:31 AM >>>
>
> Hey all,
>
> Is there a way to add an entry to the Keychain during imaging with a
> script? Basically, I'd like to use one base image, but insert one of a few
> scripts somewhere that will add the client to a specified wireless SSID.
> Possible, or does the SSID have to be added to the keychain before taking a
> base image?
>
> Thanks,
>
>
> *Jeffrey A. Strauss
> *Department of Educational Technology
> *Systems Administrator
> *Loyola High School of Los Angeles
> 1901 Venice Blvd.
> Los Angeles, Ca 90006
> (213) 381-5121 x265
>
> Please consider the environment before printing this e-mail.
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/5cb4435d/attachment.htm 

From cmyers at uclan.ac.uk  Mon Jan 26 08:53:31 2009
From: cmyers at uclan.ac.uk (Criss Myers)
Date: Mon, 26 Jan 2009 16:53:31 +0000
Subject: [Casper] Keychain addition during imaging
In-Reply-To: <497D93D2.7141.0039.0@kckps.org>
References: <C5A3255E.329C%jstrauss@loyolahs.edu>
	<497D93D2.7141.0039.0@kckps.org>
Message-ID: <EA9A3ACB-E40E-415D-BCDF-61EEFF036CA5@uclan.ac.uk>

So u want to add a wireless ssid to a computer with a password that  
the client doesn't have?

Rather than get each client to login to the ssid?

Is that right? So when they login the mac connects to the ssid with an  
existing password

Criss

On 26 Jan 2009, at 16:43, "Thomas Larkin" <tlarki at kckps.org> wrote:

> I have Apple Enterprise support and I tried doing this exact same  
> thing.  This is what I was told by Apple engineers in a nutshell.   
> Using the networksetup binary along with the security binary fill in  
> fact add the SSID you want and it will create a keychain, however  
> there is no way to input any kind of encryption key due to it's  
> limitation.  I was told by them to just replace the whole system  
> keychain, which can be packaged with Composer and installed as a  
> post image package.
>
> here is the down side, it will over write any existing keychain thus  
> destroying anything the user has in place with their keychain.  If  
> you sync user keychains I am not sure what would happen.  I asked  
> them to forward it to development as a feature request.
>
> If you can actually make it work I would love to know I came up with  
> dead ends and ended up creating a new package via Composer.
>
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> >>> Jeff Strauss <jstrauss at loyolahs.edu> 01/26/09 10:31 AM >>>
> Hey all,
>
> Is there a way to add an entry to the Keychain during imaging with a  
> script? Basically, I?d like to use one base image, but insert one of 
>  a few scripts somewhere that will add the client to a specified wir 
> eless SSID. Possible, or does the SSID have to be added to the keych 
> ain before taking a base image?
>
> Thanks,
>
>
> Jeffrey A. Strauss
> Department of Educational Technology
> Systems Administrator
> Loyola High School of Los Angeles
> 1901 Venice Blvd.
> Los Angeles, Ca 90006
> (213) 381-5121 x265
>
> Please consider the environment before printing this e-mail.
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/f4956abb/attachment.html 

From cmyers at uclan.ac.uk  Mon Jan 26 08:55:18 2009
From: cmyers at uclan.ac.uk (Criss Myers)
Date: Mon, 26 Jan 2009 16:55:18 +0000
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
References: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
Message-ID: <4B8E655A-E888-4DD0-B58D-B49BD179FE33@uclan.ac.uk>

Hi

Do you guys not use Xserves and workgroup manager ? As I do all this  
in workgroup manager

On 26 Jan 2009, at 16:11, John Wetter <john_wetter at hopkins.k12.mn.us>  
wrote:

> I seldom use that anymore because it only applies it to the root  
> user.  I have it set as a command to run once for each user, but it  
> seems to be running it as root, so it isn?t applying it to the user  
> logging in.  This looks to be the same issue as we ran in to trying  
> to change the Office plists.
>
> So, for now I guess moving plists is still what we?ll have to do...  
>  Unless there is a way to get these to apply to each individual user?
>
> -John
>
>
> On 1/26/09 9:47 AM, "NATHANIEL.LINDLEY at spps.org" <NATHANIEL.LINDLEY at spps.org 
> > wrote:
>
>
> Thanks for the command to turn off software update checking, I  
> couldn't get it to stop reliably before.  It there a way to set this  
> script to FEU and FUT?   A system wide "softwareupdate --schedule  
> off"  Otherwise it appears that new users have software update  
> checking on.
> Thanks,
>
> Nathaniel Lindley
>
> ++++++++++++++++++
> Educational Technology
> Saint Paul Public Schools
> Saint Paul, Minnesota
> nathaniel.lindley at spps.org
> phone:  651-248-6861
>
>
> Miles Leacy <miles.leacy at themacadmin.com>
> Sent by: casper-bounces at list.jamfsoftware.com 01/26/09 07:54 AM
> To
>
> "Nichols, Jared" <jared.nichols at ll.mit.edu>
>
> cc
>
> Casper List <casper at list.jamfsoftware.com>
>
> Subject
>
> Re: [Casper] Defaults write set software update interval
>
>
>
>
> To turn the automatic checking off, use this command...
>
> softwareupdate --schedule off
>
> That's a lot easier than messing with plists.
>
> You can put that into a policy for existing computers, and/or make  
> it a part of your configuration for new deployments.  If you do,  
> make sure you set it to be an "at reboot" script.
>
> Then you can simply use the checkbox in the "Packages" tab of your  
> policy to call software update.
>
> I consider this a best practice and these are among the first  
> policies/scripts I create when installing a JSS.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com <mailto:miles.leacy at themacadmin.com>
> www.themacadmin.com <http://www.themacadmin.com/>
>
>
>
>
> On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu 
>  <mailto:jared.nichols at ll.mit.edu> > wrote:
> That's exactly my goal :)  I asked about setting the interval on the  
> plist because I want to disable it on the clients and run it  
> strictly from a policy.
>
> Now that I know it's in the scheduler plist that sets me on the  
> right track.
>
> Thanks!
>
> j
>
>
>
> On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com/ 
> > > wrote:
>
> What would be even easier would be to turn off the schedule on the  
> client, enter your Software Update Server's info into your JSS, and  
> run Software Update via Casper policy.  Software Update is a  
> checkbox in the Packages tab, and you can have your policy run every  
> day, week or month.
>
>
> -- 
> John Wetter
> Technology Support Administrator
> Educational Technology, Media & Information Services
> Hopkins Public Schools
> 952-988-5373
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/087e7881/attachment.htm 

From william.smith at merrillcorp.com  Mon Jan 26 08:57:36 2009
From: william.smith at merrillcorp.com (Smith, William)
Date: Mon, 26 Jan 2009 10:57:36 -0600
Subject: [Casper] Automate configuring of Entourage
In-Reply-To: <C5A352F7.9A18%hbonath@computersitecolumbus.com>
Message-ID: <C5A347A0.8A64%william.smith@merrillcorp.com>

Hi Henry!

I?m finishing an update to my Exchange setup script that was included in the
Resource Kit and have been looking for testers.

The update does what you?re asking. The script will execute at first-run of
Entourage rather than requiring users to double-click it the first time. It
also allows the administrator to set all default preferences for a new
Entourage identity as well.

If you?re willing to help test to get it out the door then I?d be glad to
send it to you this evening. Feedback I?ve had so far has been very
positive. At this point I?d consider the script at RC1 instead of beta.

-- 

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

On 1/26/09 10:45 AM, "Henry Bonath" <hbonath at computersitecolumbus.com>
wrote:

> Do any of you have any experience automating the configuration of Entourage?
> I have found an AppleScript that will do some of it, but it isn?t truly
> hands-off and requires some end user interaction.
> I?m just looking for some info/insight on this and what you guys have done to
> deploy Entourage remotely in an Exchange environment.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/1c362707/attachment.html 

From miles.leacy at themacadmin.com  Mon Jan 26 08:59:47 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Mon, 26 Jan 2009 11:59:47 -0500
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <4B8E655A-E888-4DD0-B58D-B49BD179FE33@uclan.ac.uk>
References: <C5A33CE1.813F%john_wetter@hopkins.k12.mn.us>
	<4B8E655A-E888-4DD0-B58D-B49BD179FE33@uclan.ac.uk>
Message-ID: <ec2e75ff0901260859m13063d1dw9e607a044f7e90d4@mail.gmail.com>

I've used that method in some environments.  Speaking of MCX, you could set
it in the local directory service, using MCX, via a dscl script.  If you
apply your MCX setting to staff (20), that should get all of your intended
users.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/26 Criss Myers <cmyers at uclan.ac.uk>

> Hi
>
> Do you guys not use Xserves and workgroup manager ? As I do all this in
> workgroup manager
>
>
> On 26 Jan 2009, at 16:11, John Wetter <john_wetter at hopkins.k12.mn.us>
> wrote:
>
> I seldom use that anymore because it only applies it to the root user.  I
> have it set as a command to run once for each user, but it seems to be
> running it as root, so it isn't applying it to the user logging in.  This
> looks to be the same issue as we ran in to trying to change the Office
> plists.
>
> So, for now I guess moving plists is still what we'll have to do...  Unless
> there is a way to get these to apply to each individual user?
>
> -John
>
>
> On 1/26/09 9:47 AM, " <http://NATHANIEL.LINDLEY at spps.org>
> NATHANIEL.LINDLEY at spps.org" < <http://NATHANIEL.LINDLEY at spps.org>
> NATHANIEL.LINDLEY at spps.org> wrote:
>
>
> Thanks for the command to turn off software update checking, I couldn't get
> it to stop reliably before.  It there a way to set this script to FEU and
> FUT?   A system wide "softwareupdate --schedule off"  Otherwise it appears
> that new users have software update checking on.
> Thanks,
>
> Nathaniel Lindley
>
> ++++++++++++++++++
> Educational Technology
> Saint Paul Public Schools
> Saint Paul, Minnesota
>  <http://nathaniel.lindley at spps.org>nathaniel.lindley at spps.org
> phone:  651-248-6861
>
>
> *Miles Leacy < <http://miles.leacy at themacadmin.com>
> miles.leacy at themacadmin.com>*
> Sent by: <http://casper-bounces at list.jamfsoftware.com>
> casper-bounces at list.jamfsoftware.com 01/26/09 07:54 AM
>
> To
>
> "Nichols, Jared" < <http://jared.nichols at ll.mit.edu>
> jared.nichols at ll.mit.edu>
>
> cc
>
> Casper List < <http://casper at list.jamfsoftware.com>
> casper at list.jamfsoftware.com>
>
> Subject
>
> Re: [Casper] Defaults write set software update interval
>
>
>
>
> To turn the automatic checking off, use this command...
>
> softwareupdate --schedule off
>
> That's a lot easier than messing with plists.
>
> You can put that into a policy for existing computers, and/or make it a
> part of your configuration for new deployments.  If you do, make sure you
> set it to be an "at reboot" script.
>
> Then you can simply use the checkbox in the "Packages" tab of your policy
> to call software update.
>
> I consider this a best practice and these are among the first
> policies/scripts I create when installing a JSS.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> * <http://miles.leacy at themacadmin.com>miles.leacy at themacadmin.com* <<miles.leacy at themacadmin.com>
> mailto:miles.leacy at themacadmin.com <miles.leacy at themacadmin.com>>
> *www.themacadmin.com* < <http://www.themacadmin.com/>
> http://www.themacadmin.com/>
>
>
>
>
> On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <*<http://jared.nichols at ll.mit.edu>
> jared.nichols at ll.mit.edu* < <jared.nichols at ll.mit.edu>
> mailto:jared.nichols at ll.mit.edu <jared.nichols at ll.mit.edu>> > wrote:
> That's exactly my goal :)  I asked about setting the interval on the plist
> because I want to disable it on the clients and run it strictly from a
> policy.
>
> Now that I know it's in the scheduler plist that sets me on the right
> track.
>
> Thanks!
>
> j
>
>
>
> On 1/23/09 15:40 , "Miles Leacy" <* <http://miles.leacy at themacadmin.com>
> miles.leacy at themacadmin.com* < <http://miles.leacy at themacadmin.com/>
> http://miles.leacy at themacadmin.com/> > wrote:
>
> What would be even easier would be to turn off the schedule on the client,
> enter your Software Update Server's info into your JSS, and run Software
> Update via Casper policy.  Software Update is a checkbox in the Packages
> tab, and you can have your policy run every day, week or month.
>
>
> --
> John Wetter
> Technology Support Administrator
> Educational Technology, Media & Information Services
> Hopkins Public Schools
> 952-988-5373
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/fb3821dc/attachment.htm 

From hbonath at computersitecolumbus.com  Mon Jan 26 09:00:03 2009
From: hbonath at computersitecolumbus.com (Henry Bonath)
Date: Mon, 26 Jan 2009 12:00:03 -0500
Subject: [Casper] Automate configuring of Entourage
In-Reply-To: <C5A347A0.8A64%william.smith@merrillcorp.com>
Message-ID: <C5A35643.9A21%hbonath@computersitecolumbus.com>

I would love to test it out, I'm about a month away from deploying and I want to have a solid plan together.
So if you could send it, I would appreciate it.
Our exchange environment is hosted and contains some non-standard configs, modified LDAP Search base, etc. So this would be a good environment to test in.

-Henry


On 1/26/09 11:57 AM, "Smith, William" <william.smith at merrillcorp.com> wrote:

Hi Henry!

I'm finishing an update to my Exchange setup script that was included in the Resource Kit and have been looking for testers.

The update does what you're asking. The script will execute at first-run of Entourage rather than requiring users to double-click it the first time. It also allows the administrator to set all default preferences for a new Entourage identity as well.

If you're willing to help test to get it out the door then I'd be glad to send it to you this evening. Feedback I've had so far has been very positive. At this point I'd consider the script at RC1 instead of beta.
________________________________

[http://www.computersitecolumbus.com/images/CSC_Logo.jpg]
Henry Bonath
Network Engineer
Computer Site Columbus
6155-N Huntley Road
Columbus, OH 43229
computersitecolumbus.com
Tel: 614.786.7100
Cell: 614.738.0822
Fax: 614.786.7310

Your I.T. Department


________________________________
12:01:44 Mon 26 Jan 2009


This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/0e533215/attachment.html 

From john_wetter at hopkins.k12.mn.us  Mon Jan 26 09:28:14 2009
From: john_wetter at hopkins.k12.mn.us (John Wetter)
Date: Mon, 26 Jan 2009 11:28:14 -0600
Subject: [Casper] Defaults write set software update interval
In-Reply-To: <4B8E655A-E888-4DD0-B58D-B49BD179FE33@uclan.ac.uk>
Message-ID: <C5A34ECE.8159%john_wetter@hopkins.k12.mn.us>

We only use it in a small subset of our environment.  Overall, our experience with Managed Preferences has not been a good one as there are just too many issues with it (authentication, time-outs, mobile home directory sync errors, off-site timeout issues, system performance issues).  With the number of computers we're supporting with our staffing, we need something that works more reliably than the MCX's from OpenDirectory.  We've used it for about 4 years and I'm not thrilled to do anything with it in the future.  In my experience, Casper has been reliable, and Managed Preferences have not.  It's a matter of for mass numbers of student laptops with similar environments, Apple has forced our hand to almost require managed preferences, even with the laundry list of issues.

</soapbox rant>

-John


On 1/26/09 10:55 AM, "Criss Myers" <cmyers at uclan.ac.uk> wrote:

> Hi
>
> Do you guys not use Xserves and workgroup manager ? As I do all this in
> workgroup manager
>
> On 26 Jan 2009, at 16:11, John Wetter <john_wetter at hopkins.k12.mn.us> wrote:
>
>> I seldom use that anymore because it only applies it to the root user.  I
>> have it set as a command to run once for each user, but it seems to be
>> running it as root, so it isn't applying it to the user logging in.  This
>> looks to be the same issue as we ran in to trying to change the Office
>> plists.
>>
>> So, for now I guess moving plists is still what we'll have to do...  Unless
>> there is a way to get these to apply to each individual user?
>>
>> -John
>>
>>
>> On 1/26/09 9:47 AM, "NATHANIEL.LINDLEY at spps.org
>> <mailto:NATHANIEL.LINDLEY at spps.org> " <NATHANIEL.LINDLEY at spps.org
>> <mailto:NATHANIEL.LINDLEY at spps.org> > wrote:
>>
>>>
>>> Thanks for the command to turn off software update checking, I couldn't get
>>> it to stop reliably before.  It there a way to set this script to FEU and
>>> FUT?   A system wide "softwareupdate --schedule off"  Otherwise it appears
>>> that new users have software update checking on.
>>> Thanks,
>>>
>>> Nathaniel Lindley
>>>
>>> ++++++++++++++++++
>>> Educational Technology
>>> Saint Paul Public Schools
>>> Saint Paul, Minnesota
>>> nathaniel.lindley at spps.org <mailto:nathaniel.lindley at spps.org>
>>> phone:  651-248-6861
>>>
>>>
>>> Miles Leacy <miles.leacy at themacadmin.com
>>> <mailto:miles.leacy at themacadmin.com> >
>>> Sent by: casper-bounces at list.jamfsoftware.com
>>> <mailto:casper-bounces at list.jamfsoftware.com>  01/26/09 07:54 AM
>>> To
>>>
>>> "Nichols, Jared" <jared.nichols at ll.mit.edu <mailto:jared.nichols at ll.mit.edu>
>>> >
>>>
>>> cc
>>>
>>> Casper List <casper at list.jamfsoftware.com
>>> <mailto:casper at list.jamfsoftware.com> >
>>>
>>> Subject
>>>
>>> Re: [Casper] Defaults write set software update interval
>>>
>>>
>>>
>>>
>>> To turn the automatic checking off, use this command...
>>>
>>> softwareupdate --schedule off
>>>
>>> That's a lot easier than messing with plists.
>>>
>>> You can put that into a policy for existing computers, and/or make it a part
>>> of your configuration for new deployments.  If you do, make sure you set it
>>> to be an "at reboot" script.
>>>
>>> Then you can simply use the checkbox in the "Packages" tab of your policy to
>>> call software update.
>>>
>>> I consider this a best practice and these are among the first
>>> policies/scripts I create when installing a JSS.
>>>
>>> ----------
>>> Miles A. Leacy IV
>>>
>>> ? Certified System Administrator 10.4
>>> ? Certified Technical Coordinator 10.5
>>> ? Certified Trainer
>>> Certified Casper Administrator
>>> ----------
>>> voice: 1-347-277-7321
>>> miles.leacy at themacadmin.com <mailto:miles.leacy at themacadmin.com>
>>> <mailto:miles.leacy at themacadmin.com <mailto:miles.leacy at themacadmin.com> >
>>> www.themacadmin.com <http://www.themacadmin.com>
>>> <http://www.themacadmin.com/ <http://www.themacadmin.com/> >
>>>
>>>
>>>
>>>
>>> On Mon, Jan 26, 2009 at 8:33 AM, Nichols, Jared <jared.nichols at ll.mit.edu
>>> <mailto:jared.nichols at ll.mit.edu>  <mailto:jared.nichols at ll.mit.edu
>>> <mailto:jared.nichols at ll.mit.edu> > > wrote:
>>> That's exactly my goal :)  I asked about setting the interval on the plist
>>> because I want to disable it on the clients and run it strictly from a
>>> policy.
>>>
>>> Now that I know it's in the scheduler plist that sets me on the right track.
>>>
>>> Thanks!
>>>
>>> j
>>>
>>>
>>>
>>> On 1/23/09 15:40 , "Miles Leacy" <miles.leacy at themacadmin.com
>>> <mailto:miles.leacy at themacadmin.com>  <http://miles.leacy at themacadmin.com/
>>> <http://miles.leacy at themacadmin.com/> > > wrote:
>>>
>>> What would be even easier would be to turn off the schedule on the client,
>>> enter your Software Update Server's info into your JSS, and run Software
>>> Update via Casper policy.  Software Update is a checkbox in the Packages
>>> tab, and you can have your policy run every day, week or month.

--
John Wetter
Technology Support Administrator
Educational Technology, Media & Information Services
Hopkins Public Schools
952-988-5373
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/17b07d11/attachment.html 

From tlarki at kckps.org  Mon Jan 26 10:57:14 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Mon, 26 Jan 2009 12:57:14 -0600
Subject: [Casper] Keychain addition during imaging
In-Reply-To: <ec2e75ff0901260852q42bf41ar2ca143d54ca31c44@mail.gmail.com>
References: <C5A3255E.329C%jstrauss@loyolahs.edu>
	<497D93D2.7141.0039.0@kckps.org>
	<ec2e75ff0901260852q42bf41ar2ca143d54ca31c44@mail.gmail.com>
Message-ID: <497DB32A.7141.0039.0@kckps.org>

That will not add in the encryption key into the keychain though, that
is the whole snag


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Miles Leacy <miles.leacy at themacadmin.com> 01/26/09 10:52 AM >>>
How secure does it have to be? 


The following, as an "at reboot" script should do the trick. 



networksetup -setairportnetwork <network> <password> 



Of course, that means putting a password in a script, which shouldn't be
done lightly.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/26 Thomas Larkin 
<tlarki at kckps.org> 




I have Apple Enterprise support and I tried doing this exact same thing.
 This is what I was told by Apple engineers in a nutshell.  Using the
networksetup binary along with the security binary fill in fact add the
SSID you want and it will create a keychain, however there is no way to
input any kind of encryption key due to it's limitation.  I was told by
them to just replace the whole system keychain, which can be packaged
with Composer and installed as a post image package. 


here is the down side, it will over write any existing keychain thus
destroying anything the user has in place with their keychain.  If you
sync user keychains I am not sure what would happen.  I asked them to
forward it to development as a feature request. 


If you can actually make it work I would love to know I came up with
dead ends and ended up creating a new package via Composer.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> Jeff Strauss <jstrauss at loyolahs.edu> 01/26/09 10:31 AM >>>


Hey all,

Is there a way to add an entry to the Keychain during imaging with a
script? Basically, I'd like to use one base image, but insert one of a
few scripts somewhere that will add the client to a specified wireless
SSID. Possible, or does the SSID have to be added to the keychain before
taking a base image?

Thanks,


Jeffrey A. Strauss
Department of Educational Technology
Systems Administrator
Loyola High School of Los Angeles
1901 Venice Blvd.
Los Angeles, Ca 90006
(213) 381-5121 x265
 
Please consider the environment before printing this e-mail.



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/d3048145/attachment.htm 

From rharter at uwsp.edu  Mon Jan 26 12:07:30 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Mon, 26 Jan 2009 14:07:30 -0600
Subject: [Casper] Smart Group update times
Message-ID: <C7CFE447-A978-43DA-BBC9-2BAE2B4D1029@uwsp.edu>

Hey All-

Does anyone know how long it takes smart groups to update their  
membership?  I have created one based on a dummy package and when I  
install it on a machine and then update recon it doesn't seem to be  
added to the group.  I've just done it and left it sit for about 4  
hours and still no update.

Any Thoughts?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/0dce2e28/attachment.html 

From ERNSTCS at uwec.edu  Mon Jan 26 12:43:17 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Mon, 26 Jan 2009 14:43:17 -0600
Subject: [Casper] Smart Group update times
In-Reply-To: <C7CFE447-A978-43DA-BBC9-2BAE2B4D1029@uwsp.edu>
Message-ID: <C5A37C85.12F94%ernstcs@uwec.edu>

Smart groups should update anytime an inventory cycle or other change to trigger it happens.

Craig E


On 1/26/09 2:07 PM, "Ryan Harter" <rharter at uwsp.edu> wrote:

Hey All-

Does anyone know how long it takes smart groups to update their membership?  I have created one based on a dummy package and when I install it on a machine and then update recon it doesn't seem to be added to the group.  I've just done it and left it sit for about 4 hours and still no update.

Any Thoughts?


Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/b9bc06aa/attachment.htm 

From chad.brewer at bend.k12.or.us  Mon Jan 26 12:46:35 2009
From: chad.brewer at bend.k12.or.us (Chad Brewer)
Date: Mon, 26 Jan 2009 12:46:35 -0800
Subject: [Casper] Smart Group update times
In-Reply-To: <C7CFE447-A978-43DA-BBC9-2BAE2B4D1029@uwsp.edu>
References: <C7CFE447-A978-43DA-BBC9-2BAE2B4D1029@uwsp.edu>
Message-ID: <fc.011f04d200711d923b9aca007a08ace8.711db3@bend.k12.or.us>

There are some known problems where Smart Groups don't update properly. 
You should open the Smart Group and then save it and see if the computer
gets added.

Jamf told me they will fix it in 6.1.

Chad

Ryan Harter <rharter at uwsp.edu> on January 26, 2009 at 12:07 PM -0800 wrote:
>Hey All-
>
>
>Does anyone know how long it takes smart groups to update their
>membership?  I have created one based on a dummy package and when I
>install it on a machine and then update recon it doesn't seem to be added
>to the group.  I've just done it and left it sit for about 4 hours and
>still no update.
>
>
>Any Thoughts?
>
>Ryan Harter
>UW - Stevens Point
>Workstation Developer
>715.346.2716
>[ mailto:Ryan.Harter at uwsp.edu ]Ryan.Harter at uwsp.edu 
>_______________________________________________
>Casper mailing list
>Casper at list.jamfsoftware.com
>http://list.jamfsoftware.com/mailman/listinfo/casper


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/d21ade61/attachment.html 

From ERNSTCS at uwec.edu  Mon Jan 26 12:54:05 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Mon, 26 Jan 2009 14:54:05 -0600
Subject: [Casper] Smart Group update times
In-Reply-To: <fc.011f04d200711d923b9aca007a08ace8.711db3@bend.k12.or.us>
Message-ID: <C5A37F0D.12F99%ernstcs@uwec.edu>

What, you mean like this? =) Granted, I've got some other really funky stuff going on right now with the JSS...

-- Email Notice --

MAC-B50-15 added to Curricular - HFA219

Computer Name:  MAC-B50-15

Department:             Learning & Technology Svs
Room:                   Brewer 50

Model:                  iMac5,1
Serial Number:          QP7240VRX1W
Total RAM:              2 GB
Processor:              2.0 GHz x2 (Intel Core 2 Duo i386)
Operating System:       Mac OS X 10.5.5 (9F33)


The criteria for this group is:

        "Computer Name" like "MAC-HFA219-"

-- End Email Notice --

It later magically removed itself, too.

Craig E

On 1/26/09 2:46 PM, "Chad Brewer" <chad.brewer at bend.k12.or.us> wrote:

There are some known problems where Smart Groups don't update properly.  You should open the Smart Group and then save it and see if the computer gets added.

Jamf told me they will fix it in 6.1.

Chad

Ryan Harter <rharter at uwsp.edu> on January 26, 2009 at 12:07 PM -0800 wrote:
Hey All-


Does anyone know how long it takes smart groups to update their membership?  I have created one based on a dummy package and when I install it on a machine and then update recon it doesn't seem to be added to the group.  I've just done it and left it sit for about 4 hours and still no update.


Any Thoughts?

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/efb35e1e/attachment.htm 

From rharter at uwsp.edu  Mon Jan 26 13:27:19 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Mon, 26 Jan 2009 15:27:19 -0600
Subject: [Casper] Smart Group update times
In-Reply-To: <C5A37F0D.12F99%ernstcs@uwec.edu>
References: <C5A37F0D.12F99%ernstcs@uwec.edu>
Message-ID: <BA98A005-96DA-47CC-B802-FE4DC63E799A@uwsp.edu>

Well I've got a smart group to tell me when hard drives are filling  
up, criteria is "Hard Drive" is more than "90%".  This one works  
fine.  But the one where the criteria is the dummy package receipt  
requires me to 'resave' the smart group before it finds the new  
computers.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 26, 2009, at 2:54 PM, Ernst, Craig S. wrote:

> What, you mean like this? =) Granted, I?ve got some other really  
> funky stuff going on right now with the JSS...
>
> -- Email Notice --
>
> MAC-B50-15 added to Curricular - HFA219
>
> Computer Name:  MAC-B50-15
>
> Department:             Learning & Technology Svs
> Room:                   Brewer 50
>
> Model:                  iMac5,1
> Serial Number:          QP7240VRX1W
> Total RAM:              2 GB
> Processor:              2.0 GHz x2 (Intel Core 2 Duo i386)
> Operating System:       Mac OS X 10.5.5 (9F33)
>
>
> The criteria for this group is:
>
>         "Computer Name" like "MAC-HFA219-"
>
> -- End Email Notice --
>
> It later magically removed itself, too.
>
> Craig E
>
> On 1/26/09 2:46 PM, "Chad Brewer" <chad.brewer at bend.k12.or.us> wrote:
>
> There are some known problems where Smart Groups don't update  
> properly.  You should open the Smart Group and then save it and see  
> if the computer gets added.
>
> Jamf told me they will fix it in 6.1.
>
> Chad
>
> Ryan Harter <rharter at uwsp.edu> on January 26, 2009 at 12:07 PM -0800  
> wrote:
> Hey All-
>
>
> Does anyone know how long it takes smart groups to update their  
> membership?  I have created one based on a dummy package and when I  
> install it on a machine and then update recon it doesn't seem to be  
> added to the group.  I've just done it and left it sit for about 4  
> hours and still no update.
>
>
> Any Thoughts?
>
> Ryan Harter
> UW - Stevens Point
> Workstation Developer
> 715.346.2716
> Ryan.Harter at uwsp.edu <mailto:Ryan.Harter at uwsp.edu>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090126/a0889863/attachment.htm 

From pbenham at bates.edu  Tue Jan 27 10:24:45 2009
From: pbenham at bates.edu (Paul Benham)
Date: Tue, 27 Jan 2009 13:24:45 -0500
Subject: [Casper] Request for testimonials
Message-ID: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>

Hi,

I have recently proposed to our IT department that we purchase the  
Casper suite and have received a preliminary approval from the powers  
that be. Before they finally commit the funds for the purchase they  
asked me to solicit some testimonials for JAMF Software as to their  
reliability and customer service (as opposed to the case studies that  
are available on the JAMF website). I would be grateful if any of you  
out there in Casper land could drop me a couple of lines in order to  
facilitate our purchase.

thanks in advance,

paul
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Paul Benham
Desktop Operations Specialist
Bates College
110 Russell Street
Lewiston, ME 04240
PH: 207-786-6382
pbenham at bates.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090127/c5453c8e/attachment.html 

From miles.leacy at themacadmin.com  Tue Jan 27 10:37:25 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Tue, 27 Jan 2009 13:37:25 -0500
Subject: [Casper] Request for testimonials
In-Reply-To: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
Message-ID: <ec2e75ff0901271037y51ff47efr9667e1b93e7881fb@mail.gmail.com>

Hello Paul,
I am currently the head of Apple Infrastructure for Time Inc.  I use the
Casper Suite to manage our Mac OS X servers around the world.  Prior to
coming to Time, I was responsible for global Mac Technology at Polo Ralph
Lauren, where I used the Casper Suite to manage high-demand creative
environments, including in-house advertising and media groups.

The tool is solid, and provides a framework to get just about anything done
on a system that doesn't require physically touching the hardware.  Both the
folks at JAMF and the people on this list are constantly finding new ways to
get more done more efficiently with the suite.

JAMF support is fast and knowledgeable.  You won't get a typical call center
experience when you contact support.  The person who answers the phone is
well-versed in the product and can solve most issues in a few minutes.  In
the instances where I've had a real stumper of an issue, I've been on hold
for a couple of minutes at most while the support person checks with an even
more knowledgeable person (who always seems to be close at hand).

All in all, I can't recommend Casper enough.  I don't like to manage more
than one Mac without it.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/27 Paul Benham <pbenham at bates.edu>

> Hi,
> I have recently proposed to our IT department that we purchase the Casper
> suite and have received a preliminary approval from the powers that be.
> Before they finally commit the funds for the purchase they asked me to
> solicit some testimonials for JAMF Software as to their reliability and
> customer service (as opposed to the case studies that are available on the
> JAMF website). I would be grateful if any of you out there in Casper land
> could drop me a couple of lines in order to facilitate our purchase.
>
> thanks in advance,
>
> paul
> _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
> Paul Benham
> Desktop Operations Specialist
> Bates College
> 110 Russell Street
> Lewiston, ME 04240
> PH: 207-786-6382
> pbenham at bates.edu
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090127/58825f98/attachment.html 

From jared.nichols at ll.mit.edu  Tue Jan 27 10:38:56 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Tue, 27 Jan 2009 13:38:56 -0500
Subject: [Casper] Maintenance
Message-ID: <C5A4BEF0.1AC74%jared.nichols@ll.mit.edu>

Hi All-

I'm in the process of getting Casper ready for primetime here.  I've got just about everything nailed down, software updates, Self Service distribution etc.  One question for everyone: what scripts/maintenance do you find yourself doing either frequently by hand or in an automated fashion?  I need to have everything documented and I'm sure I'm missing something as this is my first Casper roll out.

Thanks!
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090127/cb0841c8/attachment.htm 

From jstrauss at loyolahs.edu  Tue Jan 27 10:56:10 2009
From: jstrauss at loyolahs.edu (Jeff Strauss)
Date: Tue, 27 Jan 2009 10:56:10 -0800
Subject: [Casper] Maintenance
In-Reply-To: <C5A4BEF0.1AC74%jared.nichols@ll.mit.edu>
Message-ID: <C5A498CA.32C2%jstrauss@loyolahs.edu>

Same question here... Any cache stuff? General cleanup?


On 1/27/09 10:38 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:

Hi All-

I'm in the process of getting Casper ready for primetime here.  I've got just about everything nailed down, software updates, Self Service distribution etc.  One question for everyone: what scripts/maintenance do you find yourself doing either frequently by hand or in an automated fashion?  I need to have everything documented and I'm sure I'm missing something as this is my first Casper roll out.

Thanks!

Jeffrey A. Strauss
Department of Educational Technology
Systems Administrator
Loyola High School of Los Angeles
1901 Venice Blvd.
Los Angeles, Ca 90006
(213) 381-5121 x265

Please consider the environment before printing this e-mail.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090127/a0616c77/attachment.htm 

From william.smith at merrillcorp.com  Tue Jan 27 11:16:26 2009
From: william.smith at merrillcorp.com (Smith, William)
Date: Tue, 27 Jan 2009 13:16:26 -0600
Subject: [Casper] Maintenance
In-Reply-To: <C5A498CA.32C2%jstrauss@loyolahs.edu>
Message-ID: <C5A4B9AA.8AFA%william.smith@merrillcorp.com>

We have a shared computer environment, so login/logout is well-practiced
here.

I clear user caches and Quark jaws font caches at logout and run weekly
maintenance (repair permissions, clear user/system caches, etc.) with a
reboot at the end. I also have Symantec Antivirus check daily for updates
from our internal LiveUpdate server.

Just this little bit and I have little to no user support calls with regard
to Mac OS, application or font issues.

-- 

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

On 1/27/09 12:56 PM, "Jeff Strauss" <jstrauss at loyolahs.edu> wrote:

> Same question here... Any cache stuff? General cleanup?
> 
> 
> On 1/27/09 10:38 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:
> 
>> Hi All-
>> 
>> I?m in the process of getting Casper ready for primetime here.  I?ve got just
>> about everything nailed down, software updates, Self Service distribution
>> etc.  One question for everyone: what scripts/maintenance do you find
>> yourself doing either frequently by hand or in an automated fashion?  I need
>> to have everything documented and I?m sure I?m missing something as this is
>> my first Casper roll out.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090127/ed7dce46/attachment.htm 

From jared.nichols at ll.mit.edu  Wed Jan 28 05:37:34 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Wed, 28 Jan 2009 08:37:34 -0500
Subject: [Casper] Maintenance
In-Reply-To: <C5A4B9AA.8AFA%william.smith@merrillcorp.com>
Message-ID: <C5A5C9CE.1AC92%jared.nichols@ll.mit.edu>

Cool.  Thus far, I have a weekly maintenance policy that:
* Fixes permissions
* Flushes user caches
* Flushes system caches.

Currently, there is no forced reboot with this policy.  At the moment, we have a customer group that is determining exactly what they want for a standard desktop - this includes Mac and PC, what kind of maintenance windows will be ok, applications that are centrally supported/distributed etc etc.  So, much of what I need is waiting for them.  This will determine things such as software update frequency/mandatory-ness.

Question: Does flushing the user cache kill the font cache as well?  Does doing so seem to solve the issue with Office 2008 complaining about corrupt fonts?

Thanks

j


On 1/27/09 14:16 , "Smith, William" <william.smith at merrillcorp.com> wrote:

We have a shared computer environment, so login/logout is well-practiced here.

I clear user caches and Quark jaws font caches at logout and run weekly maintenance (repair permissions, clear user/system caches, etc.) with a reboot at the end. I also have Symantec Antivirus check daily for updates from our internal LiveUpdate server.

Just this little bit and I have little to no user support calls with regard to Mac OS, application or font issues.

--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/6b37cb88/attachment.html 

From miles.leacy at themacadmin.com  Wed Jan 28 06:55:12 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 28 Jan 2009 09:55:12 -0500
Subject: [Casper] Maintenance
In-Reply-To: <C5A5C9CE.1AC92%jared.nichols@ll.mit.edu>
References: <C5A4B9AA.8AFA%william.smith@merrillcorp.com>
	<C5A5C9CE.1AC92%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901280655t4fdbf3fpaec603472d89fda3@mail.gmail.com>

I generally have a policy that runs once a week, "in the middle of the
night" (defining that term is up to you and your organization), and hits an
internal Apple Software Update Server and reboots regardless of whether an
update requires it or if anyone is logged in.
I have a launchd item that uses osascript to show a dialog box reminder of
the mandatory reboot.  The message is something along the lines of

<exclamation point icon> Mandatory Reboot This Evening
All computers in our organization are subject to a mandatory reboot policy
to allow necessary maintenance and update tasks to run.  This reboot keeps
our computers running smoothly.  The reboot will occur at 11:55 PM this
evening.  Please be sure you have saved all of your work and logged out by
then.  Any documents left open at the time of the reboot may be damaged or
lost.  If you have any questions, you may review the reboot policy at
http://intranet.ourcompany.com/it/policies/rebootpolicy.htm or contact the
help desk at extension xxx.


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/28 Nichols, Jared <jared.nichols at ll.mit.edu>

>  Cool.  Thus far, I have a weekly maintenance policy that:
> ? Fixes permissions
> ? Flushes user caches
> ? Flushes system caches.
>
> Currently, there is no forced reboot with this policy.  At the moment, we
> have a customer group that is determining exactly what they want for a
> standard desktop ? this includes Mac and PC, what kind of maintenance
> windows will be ok, applications that are centrally supported/distributed
> etc etc.  So, much of what I need is waiting for them.  This will determine
> things such as software update frequency/mandatory-ness.
>
> Question: Does flushing the user cache kill the font cache as well?  Does
> doing so seem to solve the issue with Office 2008 complaining about corrupt
> fonts?
>
> Thanks
>
> j
>
>
> On 1/27/09 14:16 , "Smith, William" <william.smith at merrillcorp.com> wrote:
>
> We have a shared computer environment, so login/logout is well-practiced
> here.
>
> I clear user caches and Quark jaws font caches at logout and run weekly
> maintenance (repair permissions, clear user/system caches, etc.) with a
> reboot at the end. I also have Symantec Antivirus check daily for updates
> from our internal LiveUpdate server.
>
> Just this little bit and I have little to no user support calls with regard
> to Mac OS, application or font issues.
>
>
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/6e320cd6/attachment.htm 

From tlarki at kckps.org  Wed Jan 28 06:59:31 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 28 Jan 2009 08:59:31 -0600
Subject: [Casper] Request for testimonials
In-Reply-To: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
Message-ID: <49801E73.7141.0039.0@kckps.org>

I was working on a three part blog on my website.  I was going to cover Apple in enterprise environments, working in a 1:1 laptop deployment and using the Casper Suite was going to be Part 3.  Well, due to me being busy only part 1 is written so far, but I was going to give Casper it's own part all together.  I can tell you right now no matter what anyone says here, it won't really describe what Casper really is.   

I have been working with Macs since right around 1999/2000 when I landed my first IT job right out of high school.   Since then I have always been the "Mac Guy" at every job I have had, not because I prefer the platform, but just because I know it.  I am versed in Microsoft, Novell, and Linux as well.  However, last year my current employer hired me on to help maintain our 1:1 Macbook deployment.  I started working about 2 weeks before we deployed which means I hit the ground running.  I had never even heard of Casper before working at this current job.  At my last job there were maybe at maximum 300 Macs me and one other guy managed and like 2 xserves.  The Macs at my old job just lived in their own little world and we managed them by hand because we lacked the tools to manage them like you would a PC using Active Directory.  I had never worked with 6,000+ mac clients and 30+ xserves or Open Directory before at all at this point.  All of my server experience was Novell, SuSe and Microsoft.   

So, I had two weeks before we deployed 5,700 Macbooks, and I had never once heard of Casper.  Josh Holland came down from JAMF and gave me a two day crash course on how to use their product.  By about the 2nd month in from our deployment I was already pushing out packages and creating some policies.  Spliced up all the VLANs into network segments and made smart groups of teacher and Student machines.   

Looking back now, there is no way that I can manage all my clients with out Casper at all.  Well, I take that back, I could do it, but I would prefer to have Casper any time.  I have only been using it about a year total. 

To give you a testimonial on the imaging process.  June 1st, 2008, my boss dropped a huge bomb on me and my fellow IT workers.  We were going to load Windows XP Pro on 6,000 Macbooks because of licensing issues with virtual machines (it was way too expensive) and we had one piece of testing software that would not run on intel Macs at all.  So, I created a master image of OS X and Windows XP Professional and in basically the whole month of July, we were able to image 6,000 Macbooks.  I think our record was about 450ish laptops in one 12 hour work day.  Not too shabby.  I also use the self service application from casper to allow all my users to dual boot into Windows XP with out giving them admin rights and while maintaining firmware passwords and keeping firmware locked down.  I posted a video of how it works on youtube.com.   

The best part of this whole thing was is that we had no idea exactly how we were going to do it, we just jumped right in with a dual boot image, and at the time Casper 6.0 wasn't even released yet, but I had gone to the CCA training course two weeks prior and got to see a sneak preview of it.  

>>> Paul Benham <pbenham at bates.edu> 01/27/09 12:24 PM >>>
Hi, 



I have recently proposed to our IT department that we purchase the Casper suite and have received a preliminary approval from the powers that be. Before they finally commit the funds for the purchase they asked me to solicit some testimonials for JAMF Software as to their reliability and customer service (as opposed to the case studies that are available on the JAMF website). I would be grateful if any of you out there in Casper land could drop me a couple of lines in order to facilitate our purchase. 



thanks in advance, 



paul 

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Paul Benham
Desktop Operations Specialist
Bates College
110 Russell Street
Lewiston, ME 04240
PH: 207-786-6382
pbenham at bates.edu 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/ed407a00/attachment.html 

From CMyers at uclan.ac.uk  Wed Jan 28 07:18:05 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Wed, 28 Jan 2009 15:18:05 +0000
Subject: [Casper] Request for testimonials
In-Reply-To: <49801E73.7141.0039.0@kckps.org>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
	<49801E73.7141.0039.0@kckps.org>
Message-ID: <4980772D.BB96.0081.0@uclan.ac.uk>

I agree with Thomas and others that have replied, 

I manage only 260 macs and 6 servers, but using Casper makes the job soooo much easier and smoother. 

I started using macs with os 8.6 as an IT Admin and have used all version of os x and os x server, have built and run linux servers and PC's 

I have used lots of software from various companys and non can compare to the leave of support you will get from Jamf. Its like having your own expert in the building. Its not the best being from the UK as we have different working hours but this email list means someone ALWAYS has an answer. 

The fact that Jamf actually listen to their customers and adds features as requested by their customers is partically unheard of in other companys. 

There are no words to describe how good Capser is but to say that if you have the money uve really gotta buy it, its worth every penny ten times over. 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 28, 2009 at  2:59 PM, in message <49801E73.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I was working on a three part blog on my website.  I was going to cover Apple in enterprise environments, working in a 1:1 laptop deployment and using the Casper Suite was going to be Part 3.  Well, due to me being busy only part 1 is written so far, but I was going to give Casper it's own part all together.  I can tell you right now no matter what anyone says here, it won't really describe what Casper really is.   


I have been working with Macs since right around 1999/2000 when I landed my first IT job right out of high school.   Since then I have always been the "Mac Guy" at every job I have had, not because I prefer the platform, but just because I know it.  I am versed in Microsoft, Novell, and Linux as well.  However, last year my current employer hired me on to help maintain our 1:1 Macbook deployment.  I started working about 2 weeks before we deployed which means I hit the ground running.  I had never even heard of Casper before working at this current job.  At my last job there were maybe at maximum 300 Macs me and one other guy managed and like 2 xserves.  The Macs at my old job just lived in their own little world and we managed them by hand because we lacked the tools to manage them like you would a PC using Active Directory.  I had never worked with 6,000+ mac clients and 30+ xserves or Open Directory before at all at this point.  All of my server experience was Novell, SuSe and Microsoft.   


So, I had two weeks before we deployed 5,700 Macbooks, and I had never once heard of Casper.  Josh Holland came down from JAMF and gave me a two day crash course on how to use their product.  By about the 2nd month in from our deployment I was already pushing out packages and creating some policies.  Spliced up all the VLANs into network segments and made smart groups of teacher and Student machines.   


Looking back now, there is no way that I can manage all my clients with out Casper at all.  Well, I take that back, I could do it, but I would prefer to have Casper any time.  I have only been using it about a year total. 


To give you a testimonial on the imaging process.  June 1st, 2008, my boss dropped a huge bomb on me and my fellow IT workers.  We were going to load Windows XP Pro on 6,000 Macbooks because of licensing issues with virtual machines (it was way too expensive) and we had one piece of testing software that would not run on intel Macs at all.  So, I created a master image of OS X and Windows XP Professional and in basically the whole month of July, we were able to image 6,000 Macbooks.  I think our record was about 450ish laptops in one 12 hour work day.  Not too shabby.  I also use the self service application from casper to allow all my users to dual boot into Windows XP with out giving them admin rights and while maintaining firmware passwords and keeping firmware locked down.  I posted a video of how it works on youtube.com.   


The best part of this whole thing was is that we had no idea exactly how we were going to do it, we just jumped right in with a dual boot image, and at the time Casper 6.0 wasn't even released yet, but I had gone to the CCA training course two weeks prior and got to see a sneak preview of it.  

>>> Paul Benham <pbenham at bates.edu> 01/27/09 12:24 PM >>>
Hi, 



I have recently proposed to our IT department that we purchase the Casper suite and have received a preliminary approval from the powers that be. Before they finally commit the funds for the purchase they asked me to solicit some testimonials for JAMF Software as to their reliability and customer service (as opposed to the case studies that are available on the JAMF website). I would be grateful if any of you out there in Casper land could drop me a couple of lines in order to facilitate our purchase. 



thanks in advance, 



paul 

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Paul Benham
Desktop Operations Specialist
Bates College
110 Russell Street
Lewiston, ME 04240
PH: 207-786-6382
pbenham at bates.edu 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/18bf9fc8/attachment.html 

From tlarki at kckps.org  Wed Jan 28 07:20:52 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 28 Jan 2009 09:20:52 -0600
Subject: [Casper] Maintenance
In-Reply-To: <C5A4B9AA.8AFA%william.smith@merrillcorp.com>
References: <C5A498CA.32C2%jstrauss@loyolahs.edu>
	<C5A4B9AA.8AFA%william.smith@merrillcorp.com>
Message-ID: <49802374.7141.0039.0@kckps.org>

I have some of the same 

I have a policy that runs which makes sure certain accounts have the
right passwords, that any and all packages in certain folders have our
default permissions which we use to manage the clients.  I also have a
policy that sets firmware password and mode, just in case someone
decides to take a part a machine to clear out the firmware.  Of course I
have inventory updates I do not run every day.  At first I did, and my
database just go so huge and chunky with all those receipts, so I
decided to just update it once to twice a week.  The machines still
check in and their locations are updated but it doesn't do a full update
of applications and all of that.  My database is 15gigs in size. 

I keep usage logs and never delete them.  That way I can see what user
logged into what machine on what date.  This has been a very handy to
say the least.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Smith, William" <william.smith at merrillcorp.com> 01/27/09 1:16 PM
>>>

We have a shared computer environment, so login/logout is well-practiced
here.

I clear user caches and Quark jaws font caches at logout and run weekly
maintenance (repair permissions, clear user/system caches, etc.) with a
reboot at the end. I also have Symantec Antivirus check daily for
updates from our internal LiveUpdate server.

Just this little bit and I have little to no user support calls with
regard to Mac OS, application or font issues.



--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

On 1/27/09 12:56 PM, "Jeff Strauss" <jstrauss at loyolahs.edu> wrote:


Same question here... Any cache stuff? General cleanup?


On 1/27/09 10:38 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:


Hi All-

I?m in the process of getting Casper ready for primetime here.  I?ve got
just about everything nailed down, software updates, Self Service
distribution etc.  One question for everyone: what scripts/maintenance
do you find yourself doing either frequently by hand or in an automated
fashion?  I need to have everything documented and I?m sure I?m missing
something as this is my first Casper roll out. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/d7921d82/attachment.htm 

From tlarki at kckps.org  Wed Jan 28 07:21:44 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 28 Jan 2009 09:21:44 -0600
Subject: [Casper] Request for testimonials
In-Reply-To: <4980772D.BB96.0081.0@uclan.ac.uk>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
	<49801E73.7141.0039.0@kckps.org> <4980772D.BB96.0081.0@uclan.ac.uk>
Message-ID: <498023A8.7141.0039.0@kckps.org>

Yeah I forgot to add our greedy feature list, and how we always ask for more.  JAMF actually does listen to us, which is nice.

>>> "Criss  Myers" <CMyers at uclan.ac.uk> 01/28/09 9:18 AM >>>

I agree with Thomas and others that have replied, 


I manage only 260 macs and 6 servers, but using Casper makes the job soooo much easier and smoother. 


I started using macs with os 8.6 as an IT Admin and have used all version of os x and os x server, have built and run linux servers and PC's 


I have used lots of software from various companys and non can compare to the leave of support you will get from Jamf. Its like having your own expert in the building. Its not the best being from the UK as we have different working hours but this email list means someone ALWAYS has an answer. 


The fact that Jamf actually listen to their customers and adds features as requested by their customers is partically unheard of in other companys. 


There are no words to describe how good Capser is but to say that if you have the money uve really gotta buy it, its worth every penny ten times over. 


Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Wed, Jan 28, 2009 at  2:59 PM, in message <49801E73.7141.0039.0 at kckps.org>, "Thomas Larkin" <tlarki at kckps.org> wrote:

I was working on a three part blog on my website.  I was going to cover Apple in enterprise environments, working in a 1:1 laptop deployment and using the Casper Suite was going to be Part 3.  Well, due to me being busy only part 1 is written so far, but I was going to give Casper it's own part all together.  I can tell you right now no matter what anyone says here, it won't really describe what Casper really is.   


I have been working with Macs since right around 1999/2000 when I landed my first IT job right out of high school.   Since then I have always been the "Mac Guy" at every job I have had, not because I prefer the platform, but just because I know it.  I am versed in Microsoft, Novell, and Linux as well.  However, last year my current employer hired me on to help maintain our 1:1 Macbook deployment.  I started working about 2 weeks before we deployed which means I hit the ground running.  I had never even heard of Casper before working at this current job.  At my last job there were maybe at maximum 300 Macs me and one other guy managed and like 2 xserves.  The Macs at my old job just lived in their own little world and we managed them by hand because we lacked the tools to manage them like you would a PC using Active Directory.  I had never worked with 6,000+ mac clients and 30+ xserves or Open Directory before at all at this point.  All of my server experience was Novell, SuSe and Microsoft.   


So, I had two weeks before we deployed 5,700 Macbooks, and I had never once heard of Casper.  Josh Holland came down from JAMF and gave me a two day crash course on how to use their product.  By about the 2nd month in from our deployment I was already pushing out packages and creating some policies.  Spliced up all the VLANs into network segments and made smart groups of teacher and Student machines.   


Looking back now, there is no way that I can manage all my clients with out Casper at all.  Well, I take that back, I could do it, but I would prefer to have Casper any time.  I have only been using it about a year total. 


To give you a testimonial on the imaging process.  June 1st, 2008, my boss dropped a huge bomb on me and my fellow IT workers.  We were going to load Windows XP Pro on 6,000 Macbooks because of licensing issues with virtual machines (it was way too expensive) and we had one piece of testing software that would not run on intel Macs at all.  So, I created a master image of OS X and Windows XP Professional and in basically the whole month of July, we were able to image 6,000 Macbooks.  I think our record was about 450ish laptops in one 12 hour work day.  Not too shabby.  I also use the self service application from casper to allow all my users to dual boot into Windows XP with out giving them admin rights and while maintaining firmware passwords and keeping firmware locked down.  I posted a video of how it works on youtube.com.   


The best part of this whole thing was is that we had no idea exactly how we were going to do it, we just jumped right in with a dual boot image, and at the time Casper 6.0 wasn't even released yet, but I had gone to the CCA training course two weeks prior and got to see a sneak preview of it.  

>>> Paul Benham <pbenham at bates.edu> 01/27/09 12:24 PM >>>
Hi, 



I have recently proposed to our IT department that we purchase the Casper suite and have received a preliminary approval from the powers that be. Before they finally commit the funds for the purchase they asked me to solicit some testimonials for JAMF Software as to their reliability and customer service (as opposed to the case studies that are available on the JAMF website). I would be grateful if any of you out there in Casper land could drop me a couple of lines in order to facilitate our purchase. 



thanks in advance, 



paul 

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Paul Benham
Desktop Operations Specialist
Bates College
110 Russell Street
Lewiston, ME 04240
PH: 207-786-6382
pbenham at bates.edu 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/fdcd6393/attachment.html 

From ralee at tecoenergy.com  Wed Jan 28 08:22:35 2009
From: ralee at tecoenergy.com (Lee, Roger A.)
Date: Wed, 28 Jan 2009 11:22:35 -0500
Subject: [Casper] Request for testimonials
In-Reply-To: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
Message-ID: <3BBC08693F2C2849A0DAA308FDD1062F15F640BB33@YBOR-1EXMAIL.tec.net>

Paul,

Wanted to add some info on a testimonial that I don't know if was covered. Besides the fact that other replies cover what a great tool suite Casper is to administrate your Apple systems from start to end and everything in between, a point that I wanted to express is that, I have a challenging environment. I administer 100 workstations, 4 servers in a 3500 wintel, 150 novell/Active Directory server  network. To top that off, we are a regulated utility company that has to comply with not only SOX using COBIT framework but have adopted ITILv3 standards as well. This brings in patch management reporting, development and production testing and deployment, policy enforcement, change control requests. CAB compliancy, Licensing tracking and many other controls that are required to comply with these standards. From a corporate business standpoint, this type of management is becoming mandatory. Casper suite was a easy sell alone on being able to give these types of reporting and management . Good Luck.


Roger Lee
Tampa Electric
702 N. Franklin St. - Plaza 3
Tampa, FL 33602

http://www.tampaelectric.com<http://www.tampaelectric.com/>
mailto:ralee at tecoenergy.com
Office  (813) 228-4424
iPhone  (813) 610-1485
Facsimile   (813) 228-4259
...........................................................................
A TECO Energy Company
(NYSE: TE<http://www.nyse.com/about/listed/lcddata.html?ticker=TE>)
http://www.tecoenergy.com<http://www.tecoenergy.com/>
...........................................................................





From: casper-bounces at list.jamfsoftware.com [mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Paul Benham
Sent: Tuesday, January 27, 2009 1:25 PM
To: casper at list.jamfsoftware.com
Subject: [Casper] Request for testimonials

Hi,

I have recently proposed to our IT department that we purchase the Casper suite and have received a preliminary approval from the powers that be. Before they finally commit the funds for the purchase they asked me to solicit some testimonials for JAMF Software as to their reliability and customer service (as opposed to the case studies that are available on the JAMF website). I would be grateful if any of you out there in Casper land could drop me a couple of lines in order to facilitate our purchase.

thanks in advance,

paul
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Paul Benham
Desktop Operations Specialist
Bates College
110 Russell Street
Lewiston, ME 04240
PH: 207-786-6382
pbenham at bates.edu<mailto:pbenham at bates.edu>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/41c9e18d/attachment.html 

From rharter at uwsp.edu  Wed Jan 28 09:28:57 2009
From: rharter at uwsp.edu (Ryan Harter)
Date: Wed, 28 Jan 2009 11:28:57 -0600
Subject: [Casper] Request for testimonials
In-Reply-To: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
References: <BBD9B958-571E-43E0-B489-1E4D1618F661@bates.edu>
Message-ID: <9F97079D-94AF-4CB8-8FE9-AF2CE27DE4AA@uwsp.edu>

I'll probably be echoing what everyone else has said, but I just  
thought I would give you a sense of my thoughts on Casper, Jamf, and  
the process.

Before adopting Casper about 9 months ago in my 300+ mac environment  
with 2 xserves, we actually had a custom built system in place that  
did many of the same things.  This was basically a bunch of scripts  
that 1 other guy and I wrote that could make packages (in tarballs  
instead of dmgs), verify them, extract (install) them.  We also had an  
"autobuild" system that would get a config, which was just a directory  
structure in a tar.bz2 file, and setup a specific lab load  
automatically.

We had no database/webservice back end.  Inventory reporting was a  
script that parsed system_profiler output and used curl to inject what  
it found into a db.

One of our biggest concerns when purchasing Casper was if the costs  
were justified since it was mostly stuff we were already doing with a  
prettier interface.  After 9 months I've found that without having to  
work on the end user experience AND the infrastructure I've been able  
to make the Mac user experience exponentially better because I can  
focus more of my time on just that.

Jamf has been an excellent company to work with, as well.  I've come  
to know many of the support people, and they are always excellent when  
I need anything.  I have made several requests based on things we used  
to do in our old system, and have been pleasantly surprised by the  
fact that they listen.  They are always extremely helpful, and  
definitely a customer oriented company.  It's been a pleasure working  
with them.

Ryan Harter
UW - Stevens Point
Workstation Developer
715.346.2716
Ryan.Harter at uwsp.edu

On Jan 27, 2009, at 12:24 PM, Paul Benham wrote:

> Hi,
>
> I have recently proposed to our IT department that we purchase the  
> Casper suite and have received a preliminary approval from the  
> powers that be. Before they finally commit the funds for the  
> purchase they asked me to solicit some testimonials for JAMF  
> Software as to their reliability and customer service (as opposed to  
> the case studies that are available on the JAMF website). I would be  
> grateful if any of you out there in Casper land could drop me a  
> couple of lines in order to facilitate our purchase.
>
> thanks in advance,
>
> paul
> _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
> Paul Benham
> Desktop Operations Specialist
> Bates College
> 110 Russell Street
> Lewiston, ME 04240
> PH: 207-786-6382
> pbenham at bates.edu
>
> <ATT00001.txt>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/97fbec43/attachment.html 

From tlarki at kckps.org  Wed Jan 28 10:19:19 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Wed, 28 Jan 2009 12:19:19 -0600
Subject: [Casper] weird JSS issue with TomCat
Message-ID: <49804D47.7141.0039.0@kckps.org>

So, we had our Winter break in December and I decided not to work for 15 days in a row.  I come back from my vacation and the JSS has never been the same since I got back.   Whenever I try to use casper remote or casper imaging off a netboot server and the client tries to connect to the JSS it errors out and asks for authentication, then it says invalid JSS.  I try to hop on the web front end and I got nothing.  So, I remote into the JSS server and everything is running and looks good.  If I stop and restart TomCat then everything goes right back to working. 

I see no error messages and nothing jumps out in front of me that is causing this.  Only myself and one other person have access to this server and nothing was changed over break, but I didn't touch it for 15 days. 

I did reboot it once just to see if the magic of rebooting fixed it.  This problem is very intermittent but happens randomly a few times a week. 

Any ideas? 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/189d6ca6/attachment.htm 

From amir-bozorgzadeh at uiowa.edu  Wed Jan 28 12:52:02 2009
From: amir-bozorgzadeh at uiowa.edu (Bozorgzadeh, Amir J)
Date: Wed, 28 Jan 2009 14:52:02 -0600
Subject: [Casper] CS3 serial number
Message-ID: <C5A62192.1A6D0%amir-bozorgzadeh@uiowa.edu>

Ok I am not upgrading to CS4 until a newer version of casper is released since I am having issues with the image creation of CS4.

I am reinstalling and creating a package for CS3. It seems to work well to use Caspers installer mechanism with the exception that it is not taking the serial number I put in the Adobe Installer info section. It is a site license and it is correct as I when I launch the app I use the same serial number and it goes fine.

Anyone have any idea why it wouldn't populate the machine with the serial number I provide?

I am guessing I am not first to have this issue.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/10699c96/attachment.htm 

From ERNSTCS at uwec.edu  Wed Jan 28 13:00:07 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Wed, 28 Jan 2009 15:00:07 -0600
Subject: [Casper] CS3 serial number
In-Reply-To: <C5A62192.1A6D0%amir-bozorgzadeh@uiowa.edu>
Message-ID: <C5A62377.13100%ernstcs@uwec.edu>

Are you launching Photoshop first before other applications? That's like the "master application" to run after imaging to fully register the license information.

If you launch another application before you've launch Photoshop you may be prompted to serialize the applications again. Just launch Photoshop.

I believe this is a known thing by Adobe with intent to change or fix.

Craig E


On 1/28/09 2:52 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu> wrote:

Ok I am not upgrading to CS4 until a newer version of casper is released since I am having issues with the image creation of CS4.

I am reinstalling and creating a package for CS3. It seems to work well to use Caspers installer mechanism with the exception that it is not taking the serial number I put in the Adobe Installer info section. It is a site license and it is correct as I when I launch the app I use the same serial number and it goes fine.

Anyone have any idea why it wouldn't populate the machine with the serial number I provide?

I am guessing I am not first to have this issue.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/94ad78a2/attachment.htm 

From ERNSTCS at uwec.edu  Wed Jan 28 13:13:29 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Wed, 28 Jan 2009 15:13:29 -0600
Subject: [Casper] CS3 serial number
In-Reply-To: <C5A6258A.1A6D6%amir-bozorgzadeh@uiowa.edu>
Message-ID: <C5A62699.13105%ernstcs@uwec.edu>

I haven't gotten to that point yet. It's just a known thing here that people know to do it at this point. If they call the help desk that's what they tell them to do.

One thing I am going to explore is that I have this really complicated patching mechanism for after a machine is imaged that does an autologon of a generic user to patch the adobe products while a user is logged in. I thought of actually adding something there that launching Photoshop is added to that generic user accounts open at login options.

That's about all I know, I'll copy this back to the list to see if anyone else has a method they use.

Craig E


On 1/28/09 3:08 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu> wrote:

So how do I do that through Casper? How do I get it to launch photoshop?

The idea is to not have to visit the machines and log in and launch photoshop. LOL

Maybe I am missing an easy fix somewhere tomake it log in and launch photoshop through the remote tool.




On 1/28/09 3:00 PM, "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:

Are you launching Photoshop first before other applications? That's like the "master application" to run after imaging to fully register the license information.

If you launch another application before you've launch Photoshop you may be prompted to serialize the applications again. Just launch Photoshop.

I believe this is a known thing by Adobe with intent to change or fix.

Craig E


On 1/28/09 2:52 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu> wrote:

Ok I am not upgrading to CS4 until a newer version of casper is released since I am having issues with the image creation of CS4.

I am reinstalling and creating a package for CS3. It seems to work well to use Caspers installer mechanism with the exception that it is not taking the serial number I put in the Adobe Installer info section. It is a site license and it is correct as I when I launch the app I use the same serial number and it goes fine.

Anyone have any idea why it wouldn't populate the machine with the serial number I provide?

I am guessing I am not first to have this issue.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480




________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/4ff22aa8/attachment.htm 

From ERNSTCS at uwec.edu  Wed Jan 28 13:15:18 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Wed, 28 Jan 2009 15:15:18 -0600
Subject: [Casper] CS3 serial number
In-Reply-To: <C5A62699.13105%ernstcs@uwec.edu>
Message-ID: <C5A62706.13107%ernstcs@uwec.edu>

Or, can you package up just the finalized license db file(s) and blow those down after the fact? Got me...just thinking out loud.


On 1/28/09 3:13 PM, "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:

I haven't gotten to that point yet. It's just a known thing here that people know to do it at this point. If they call the help desk that's what they tell them to do.

One thing I am going to explore is that I have this really complicated patching mechanism for after a machine is imaged that does an autologon of a generic user to patch the adobe products while a user is logged in. I thought of actually adding something there that launching Photoshop is added to that generic user accounts open at login options.

That's about all I know, I'll copy this back to the list to see if anyone else has a method they use.

Craig E


On 1/28/09 3:08 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu> wrote:

So how do I do that through Casper? How do I get it to launch photoshop?

The idea is to not have to visit the machines and log in and launch photoshop. LOL

Maybe I am missing an easy fix somewhere tomake it log in and launch photoshop through the remote tool.




On 1/28/09 3:00 PM, "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:

Are you launching Photoshop first before other applications? That's like the "master application" to run after imaging to fully register the license information.

If you launch another application before you've launch Photoshop you may be prompted to serialize the applications again. Just launch Photoshop.

I believe this is a known thing by Adobe with intent to change or fix.

Craig E


On 1/28/09 2:52 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu> wrote:

Ok I am not upgrading to CS4 until a newer version of casper is released since I am having issues with the image creation of CS4.

I am reinstalling and creating a package for CS3. It seems to work well to use Caspers installer mechanism with the exception that it is not taking the serial number I put in the Adobe Installer info section. It is a site license and it is correct as I when I launch the app I use the same serial number and it goes fine.

Anyone have any idea why it wouldn't populate the machine with the serial number I provide?

I am guessing I am not first to have this issue.

Thanks.

________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480




________________________________
Amir Bozorgzadeh
Campus Technology Services
University of Iowa
2800 UCC
Iowa City, Iowa 52242
319-335-5480



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/b3f9161a/attachment.html 

From miles.leacy at themacadmin.com  Wed Jan 28 13:19:40 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Wed, 28 Jan 2009 16:19:40 -0500
Subject: [Casper] CS3 serial number
In-Reply-To: <C5A62706.13107%ernstcs@uwec.edu>
References: <C5A62699.13105%ernstcs@uwec.edu> <C5A62706.13107%ernstcs@uwec.edu>
Message-ID: <ec2e75ff0901281319m3a1f790aiced5250ce4fb9168@mail.gmail.com>

How about using a self-destructing LaunchAgent?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/28 Ernst, Craig S. <ERNSTCS at uwec.edu>

>  Or, can you package up just the finalized license db file(s) and blow
> those down after the fact? Got me...just thinking out loud.
>
>
>
> On 1/28/09 3:13 PM, "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>
> I haven't gotten to that point yet. It's just a known thing here that
> people know to do it at this point. If they call the help desk that's what
> they tell them to do.
>
> One thing I am going to explore is that I have this really complicated
> patching mechanism for after a machine is imaged that does an autologon of a
> generic user to patch the adobe products while a user is logged in. I
> thought of actually adding something there that launching Photoshop is added
> to that generic user accounts open at login options.
>
> That's about all I know, I'll copy this back to the list to see if anyone
> else has a method they use.
>
> Craig E
>
>
> On 1/28/09 3:08 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu>
> wrote:
>
> So how do I do that through Casper? How do I get it to launch photoshop?
>
> The idea is to not have to visit the machines and log in and launch
> photoshop. LOL
>
> Maybe I am missing an easy fix somewhere tomake it log in and launch
> photoshop through the remote tool.
>
>
>
>
> On 1/28/09 3:00 PM, "Ernst, Craig S." <ERNSTCS at uwec.edu> wrote:
>
> Are you launching Photoshop first before other applications? That's like
> the "master application" to run after imaging to fully register the license
> information.
>
> If you launch another application before you've launch Photoshop you may be
> prompted to serialize the applications again. Just launch Photoshop.
>
> I believe this is a known thing by Adobe with intent to change or fix.
>
> Craig E
>
>
> On 1/28/09 2:52 PM, "Bozorgzadeh, Amir J" <amir-bozorgzadeh at uiowa.edu>
> wrote:
>
> Ok I am not upgrading to CS4 until a newer version of casper is released
> since I am having issues with the image creation of CS4.
>
> I am reinstalling and creating a package for CS3. It seems to work well to
> use Caspers installer mechanism with the exception that it is not taking the
> serial number I put in the Adobe Installer info section. It is a site
> license and it is correct as I when I launch the app I use the same serial
> number and it goes fine.
>
> Anyone have any idea why it wouldn't populate the machine with the serial
> number I provide?
>
> I am guessing I am not first to have this issue.
>
> Thanks.
>
> ------------------------------
> Amir Bozorgzadeh
> Campus Technology Services
> University of Iowa
> 2800 UCC
> Iowa City, Iowa 52242
> 319-335-5480
>
>
>
>
>  ------------------------------
> Amir Bozorgzadeh
> Campus Technology Services
> University of Iowa
> 2800 UCC
> Iowa City, Iowa 52242
> 319-335-5480
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/72adabf2/attachment.htm 

From Rich.Dagel at landor.com  Wed Jan 28 15:43:59 2009
From: Rich.Dagel at landor.com (Dagel, Rich)
Date: Wed, 28 Jan 2009 15:43:59 -0800
Subject: [Casper] Errors during imaging
Message-ID: <C5A62DBF.268E8%Rich.Dagel@landor.com>

We just rolled out Casper to another one of our remote offices.  We are
having issues imaging computers.  Some of the packages fail to install.  It
usually is a different package each time.  I have make sure all permissions
are correct.  I even recopied all of the files to the share to make sure
they where not damaged some how.  No luck.  I am thinking that the computer
is dropping the share while imaging.  Any way to check and see if that is
the case?

Example error

An error occurred while Casper was imaging the computer "MX61-Landor PB 15".

Event log from imaging:

    Preparing installation...
    Initializing Imaging Process...
    Mounting afp://xxx.xxx.xxx.xxx/MEX_CasperShare...
    Verifying Packages...
    Verifying Scripts...
    Preparing disk for block copy...
    Performing Block Copy of OS-10.5.4. V1.0.2.dmg...
    Cleaning up after block copy...
    Installing creative-Adobe CS2 v2.dmg...
    Installing Firefox 3.0.1.dmg...
    Installing MEXOffice2008 12.1.14.dmg...
    Installing Required Fonts.dmg...
    Installing UI 10.5 Landor Desktop With Boats.dmg...
    Installing UI 10.5 Landor Screen Saver.dmg...
    Installing UI 10.5 Login Items.dmg...
    Installing UI 10.5 Mouse.dmg...
    Installing UI 10.5 Screen Saver.dmg...
    Installing UI 10.5 Software Update Set.dmg...
    Installing UI 10.5 Sound.dmg...
    Installing UI 10.5 TimeMachine.dmg...
    Installing UI 10.5 Universal Access.dmg...
    Installing UI MEX Base dock.dmg...
    Installing util-EasyFind 4.0.1.dmg...
    Installing UTIL-Fixpermissions 1.01.dmg...
    Installing UTIL-Recon 6.0.1.v1.01dmg.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Installing UTIL-SFO-Sav 10.2.0.dmg...
    Installing util-Stuffit Standard 12.01.dmg...
    Installing util-Timbuktu 8.7 sf v1.01.dmg...
    Installing UI-MEX CS2 dock.dmg...
    Installing MEX_AdobeCS2 updates.dmg...
    Installing UI 10.5 Disk Buring verification.dmg...
    Installing UI 10.5 Internation Menu.dmg...
    Installing UI 10.5 Sidebar.dmg...
    Installing OFFICE 2008 Database New User.dmg...
    Installing Office-Landor MS Templates.dmg...
    Installing Timbuktu Sender 1.2.dmg...
    Installing UI Mexico Server.dmg...
    Installing Font Explorer CS 2 plugins.dmg...
    Installing Font Exporer 1.2.3 v1.0.3.dmg...
    Installing MEX HP Printer Software.dmg...
    Installing Software updates off.dmg...
    Installing UI-Firewall off.dmg...
    Installing UI-LaAdmin Dock Leopard.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Setting computer name to "MX61-Landor PB 15"...
    Creating /private/etc/jamf.conf...
    Creating /usr/sbin/jamf...
    Creating Startup Script...
    Creating Login/Logout Hooks...
    Creating /usr/sbin/jamfvnc...
    Creating First Run Script...
    Blessing System...
    Ensuring system files are hidden...
    Unmounting File Server...

Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/da019033/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090128/da019033/attachment.gif 

From cmyers at uclan.ac.uk  Thu Jan 29 01:27:23 2009
From: cmyers at uclan.ac.uk (Criss Myers)
Date: Thu, 29 Jan 2009 09:27:23 +0000
Subject: [Casper] Errors during imaging
In-Reply-To: <C5A62DBF.268E8%Rich.Dagel@landor.com>
References: <C5A62DBF.268E8%Rich.Dagel@landor.com>
Message-ID: <201CA598-E4D7-4721-8177-D88CE97D8BA7@uclan.ac.uk>

Are you using http?

I had errors like this before.

Check permissions. Check the pkg's

My problem was installing pkg's, I've also seen this with permissions  
issues so I always propergate premissions with server admin.

On 28 Jan 2009, at 23:43, "Dagel, Rich" <Rich.Dagel at landor.com> wrote:

> We just rolled out Casper to another one of our remote offices.  We  
> are having issues imaging computers.  Some of the packages fail to  
> install.  It usually is a different package each time.  I have make  
> sure all permissions are correct.  I even recopied all of the files  
> to the share to make sure they where not damaged some how.  No  
> luck.  I am thinking that the computer is dropping the share while  
> imaging.  Any way to check and see if that is the case?
>
> Example error
>
> An error occurred while Casper was imaging the computer "MX61-Landor  
> PB 15".
>
> Event log from imaging:
>
>     Preparing installation...
>     Initializing Imaging Process...
>     Mounting afp://xxx.xxx.xxx.xxx/MEX_CasperShare...
>     Verifying Packages...
>     Verifying Scripts...
>     Preparing disk for block copy...
>     Performing Block Copy of OS-10.5.4. V1.0.2.dmg...
>     Cleaning up after block copy...
>     Installing creative-Adobe CS2 v2.dmg...
>     Installing Firefox 3.0.1.dmg...
>     Installing MEXOffice2008 12.1.14.dmg...
>     Installing Required Fonts.dmg...
>     Installing UI 10.5 Landor Desktop With Boats.dmg...
>     Installing UI 10.5 Landor Screen Saver.dmg...
>     Installing UI 10.5 Login Items.dmg...
>     Installing UI 10.5 Mouse.dmg...
>     Installing UI 10.5 Screen Saver.dmg...
>     Installing UI 10.5 Software Update Set.dmg...
>     Installing UI 10.5 Sound.dmg...
>     Installing UI 10.5 TimeMachine.dmg...
>     Installing UI 10.5 Universal Access.dmg...
>     Installing UI MEX Base dock.dmg...
>     Installing util-EasyFind 4.0.1.dmg...
>     Installing UTIL-Fixpermissions 1.01.dmg...
>     Installing UTIL-Recon 6.0.1.v1.01dmg.dmg...
>     Error: The file creative-Adobe CS2 v2.dmg does not exist.
>     Installing UTIL-SFO-Sav 10.2.0.dmg...
>     Installing util-Stuffit Standard 12.01.dmg...
>     Installing util-Timbuktu 8.7 sf v1.01.dmg...
>     Installing UI-MEX CS2 dock.dmg...
>     Installing MEX_AdobeCS2 updates.dmg...
>     Installing UI 10.5 Disk Buring verification.dmg...
>     Installing UI 10.5 Internation Menu.dmg...
>     Installing UI 10.5 Sidebar.dmg...
>     Installing OFFICE 2008 Database New User.dmg...
>     Installing Office-Landor MS Templates.dmg...
>     Installing Timbuktu Sender 1.2.dmg...
>     Installing UI Mexico Server.dmg...
>     Installing Font Explorer CS 2 plugins.dmg...
>     Installing Font Exporer 1.2.3 v1.0.3.dmg...
>     Installing MEX HP Printer Software.dmg...
>     Installing Software updates off.dmg...
>     Installing UI-Firewall off.dmg...
>     Installing UI-LaAdmin Dock Leopard.dmg...
>     Error: The file creative-Adobe CS2 v2.dmg does not exist.
>     Setting computer name to "MX61-Landor PB 15"...
>     Creating /private/etc/jamf.conf...
>     Creating /usr/sbin/jamf...
>     Creating Startup Script...
>     Creating Login/Logout Hooks...
>     Creating /usr/sbin/jamfvnc...
>     Creating First Run Script...
>     Blessing System...
>     Ensuring system files are hidden...
>     Unmounting File Server...
>
> Rich Dagel
> Senior Technology Specialist
> <image.gif>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> http://www.landor.com
> Rich.Dagel at landor.com
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/217313be/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 29 05:56:18 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 08:56:18 -0500
Subject: [Casper] Errors during imaging
In-Reply-To: <C5A62DBF.268E8%Rich.Dagel@landor.com>
References: <C5A62DBF.268E8%Rich.Dagel@landor.com>
Message-ID: <ec2e75ff0901290556m47e08858t3ff872ce91007bb3@mail.gmail.com>

Is this happening on a wired or wireless connection?
Have you had trouble with this part of the network before?
Where is your Distribution Point in relation to your client?

Is it always the same packages that fail, or does it vary?  It looks like
your Adobe CS2 package is what failed here.  Depending on your version of
the suite, that package can be more than 2 GB.  That's quite a chunk of data
to push around.  Of course, I imagine your Leopard OS image is probably
around 3 GB.  However, if you've got network concerns with this remote
office, I'd try putting a distribution point on the remote office's local
network. I don't like pushing images over a WAN link.  I've done it, but
with varying results.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/28 Dagel, Rich <Rich.Dagel at landor.com>

>  We just rolled out Casper to another one of our remote offices.  We are
> having issues imaging computers.  Some of the packages fail to install.  It
> usually is a different package each time.  I have make sure all permissions
> are correct.  I even recopied all of the files to the share to make sure
> they where not damaged some how.  No luck.  I am thinking that the computer
> is dropping the share while imaging.  Any way to check and see if that is
> the case?
>
> Example error
>
> An error occurred while Casper was imaging the computer "MX61-Landor PB
> 15".
>
> Event log from imaging:
>
>     Preparing installation...
>     Initializing Imaging Process...
>     Mounting *afp://xxx.xxx.xxx.xxx/MEX_CasperShare..*.
>     Verifying Packages...
>     Verifying Scripts...
>     Preparing disk for block copy...
>     Performing Block Copy of OS-10.5.4. V1.0.2.dmg...
>     Cleaning up after block copy...
>     Installing creative-Adobe CS2 v2.dmg...
>     Installing Firefox 3.0.1.dmg...
>     Installing MEXOffice2008 12.1.14.dmg...
>     Installing Required Fonts.dmg...
>     Installing UI 10.5 Landor Desktop With Boats.dmg...
>     Installing UI 10.5 Landor Screen Saver.dmg...
>     Installing UI 10.5 Login Items.dmg...
>     Installing UI 10.5 Mouse.dmg...
>     Installing UI 10.5 Screen Saver.dmg...
>     Installing UI 10.5 Software Update Set.dmg...
>     Installing UI 10.5 Sound.dmg...
>     Installing UI 10.5 TimeMachine.dmg...
>     Installing UI 10.5 Universal Access.dmg...
>     Installing UI MEX Base dock.dmg...
>     Installing util-EasyFind 4.0.1.dmg...
>     Installing UTIL-Fixpermissions 1.01.dmg...
>     Installing UTIL-Recon 6.0.1.v1.01dmg.dmg...
>     Error: The file creative-Adobe CS2 v2.dmg does not exist.
>     Installing UTIL-SFO-Sav 10.2.0.dmg...
>     Installing util-Stuffit Standard 12.01.dmg...
>     Installing util-Timbuktu 8.7 sf v1.01.dmg...
>     Installing UI-MEX CS2 dock.dmg...
>     Installing MEX_AdobeCS2 updates.dmg...
>     Installing UI 10.5 Disk Buring verification.dmg...
>     Installing UI 10.5 Internation Menu.dmg...
>     Installing UI 10.5 Sidebar.dmg...
>     Installing OFFICE 2008 Database New User.dmg...
>     Installing Office-Landor MS Templates.dmg...
>     Installing Timbuktu Sender 1.2.dmg...
>     Installing UI Mexico Server.dmg...
>     Installing Font Explorer CS 2 plugins.dmg...
>     Installing Font Exporer 1.2.3 v1.0.3.dmg...
>     Installing MEX HP Printer Software.dmg...
>     Installing Software updates off.dmg...
>     Installing UI-Firewall off.dmg...
>     Installing UI-LaAdmin Dock Leopard.dmg...
>     Error: The file creative-Adobe CS2 v2.dmg does not exist.
>     Setting computer name to "MX61-Landor PB 15"...
>     Creating /private/etc/jamf.conf...
>     Creating /usr/sbin/jamf...
>     Creating Startup Script...
>     Creating Login/Logout Hooks...
>     Creating /usr/sbin/jamfvnc...
>     Creating First Run Script...
>     Blessing System...
>     Ensuring system files are hidden...
>     Unmounting File Server...
>
> Rich Dagel
> Senior Technology Specialist
>
> Landor Associates
> 1001 Front Street
> San Francisco, CA 94111
> United States
> 415 365 3933
> *http://www.landor.com
> **Rich.Dagel at landor.com*
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/3c732a9b/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/3c732a9b/attachment.gif 

From NATHANIEL.LINDLEY at spps.org  Thu Jan 29 05:58:20 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Thu, 29 Jan 2009 07:58:20 -0600
Subject: [Casper] Errors during imaging
In-Reply-To: <C5A62DBF.268E8%Rich.Dagel@landor.com>
Message-ID: <OFF9802D03.6B9974F8-ON8625754D.004C59BD-8625754D.004D71BA@spps.org>

Rich,
I get errors like that occasionally at remote sites where it will say 
"Error installing .....package" or "Script is missing"   But I know they 
are there and sometimes it worked even with the error and then sometimes I 
don't get errors and the machine is not bootable.  I've seen a couple 
cases where the package (especially OS package) is bad at the remote site 
and when I replace it as you did, it works.   Strange.  I'm curious about 
network issues causing this?   why would it say "script or package not 
found" when I know it is there and permissions are good.

On the side, do the permissions on a package or script need to be r - - or 
 r - x   to work for install?   I've seen both and don't think it matters, 
just curious.

Nathaniel Lindley

++++++++++++++++++
Educational Technology
Saint Paul Public Schools
Saint Paul, Minnesota
nathaniel.lindley at spps.org
phone:  651-248-6861



"Dagel, Rich" <Rich.Dagel at landor.com> 
Sent by: casper-bounces at list.jamfsoftware.com
01/28/2009 05:36 PM

To
<casper at list.jamfsoftware.com>
cc

Subject
[Casper] Errors during imaging






We just rolled out Casper to another one of our remote offices.  We are 
having issues imaging computers.  Some of the packages fail to install. It 
usually is a different package each time.  I have make sure all 
permissions are correct.  I even recopied all of the files to the share to 
make sure they where not damaged some how.  No luck.  I am thinking that 
the computer is dropping the share while imaging.  Any way to check and 
see if that is the case?

Example error

An error occurred while Casper was imaging the computer "MX61-Landor PB 
15".

Event log from imaging:

    Preparing installation...
    Initializing Imaging Process...
    Mounting afp://xxx.xxx.xxx.xxx/MEX_CasperShare...
    Verifying Packages...
    Verifying Scripts...
    Preparing disk for block copy...
    Performing Block Copy of OS-10.5.4. V1.0.2.dmg...
    Cleaning up after block copy...
    Installing creative-Adobe CS2 v2.dmg...
    Installing Firefox 3.0.1.dmg...
    Installing MEXOffice2008 12.1.14.dmg...
    Installing Required Fonts.dmg...
    Installing UI 10.5 Landor Desktop With Boats.dmg...
    Installing UI 10.5 Landor Screen Saver.dmg...
    Installing UI 10.5 Login Items.dmg...
    Installing UI 10.5 Mouse.dmg...
    Installing UI 10.5 Screen Saver.dmg...
    Installing UI 10.5 Software Update Set.dmg...
    Installing UI 10.5 Sound.dmg...
    Installing UI 10.5 TimeMachine.dmg...
    Installing UI 10.5 Universal Access.dmg...
    Installing UI MEX Base dock.dmg...
    Installing util-EasyFind 4.0.1.dmg...
    Installing UTIL-Fixpermissions 1.01.dmg...
    Installing UTIL-Recon 6.0.1.v1.01dmg.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Installing UTIL-SFO-Sav 10.2.0.dmg...
    Installing util-Stuffit Standard 12.01.dmg...
    Installing util-Timbuktu 8.7 sf v1.01.dmg...
    Installing UI-MEX CS2 dock.dmg...
    Installing MEX_AdobeCS2 updates.dmg...
    Installing UI 10.5 Disk Buring verification.dmg...
    Installing UI 10.5 Internation Menu.dmg...
    Installing UI 10.5 Sidebar.dmg...
    Installing OFFICE 2008 Database New User.dmg...
    Installing Office-Landor MS Templates.dmg...
    Installing Timbuktu Sender 1.2.dmg...
    Installing UI Mexico Server.dmg...
    Installing Font Explorer CS 2 plugins.dmg...
    Installing Font Exporer 1.2.3 v1.0.3.dmg...
    Installing MEX HP Printer Software.dmg...
    Installing Software updates off.dmg...
    Installing UI-Firewall off.dmg...
    Installing UI-LaAdmin Dock Leopard.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Setting computer name to "MX61-Landor PB 15"...
    Creating /private/etc/jamf.conf...
    Creating /usr/sbin/jamf...
    Creating Startup Script...
    Creating Login/Logout Hooks...
    Creating /usr/sbin/jamfvnc...
    Creating First Run Script...
    Blessing System...
    Ensuring system files are hidden...
    Unmounting File Server...

Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/7e0c2300/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/7e0c2300/attachment.gif 

From tlarki at kckps.org  Thu Jan 29 06:34:38 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 29 Jan 2009 08:34:38 -0600
Subject: [Casper] Errors during imaging
In-Reply-To: <C5A62DBF.268E8%Rich.Dagel@landor.com>
References: <C5A62DBF.268E8%Rich.Dagel@landor.com>
Message-ID: <49816A1D.7141.0039.0@kckps.org>

I set up all my Casper Servers the same way.  One local admin account and two managed local accounts.  The two local accounts are casperinstall and casperadmin, they are the read only and the read/write users of the casper packages.   Then I create an ACL that allows these accounts full read/write and read only access to those folders.  I like to keep it simple that way.  Then in the JSS add those two users as my read only and read/write user accounts, and I let the local admin account be the owner of all said files.  Then i replicate that across all my casper servers 


have not had a problem yet. 



___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/28/09 5:43 PM >>>

We just rolled out Casper to another one of our remote offices.  We are having issues imaging computers.  Some of the packages fail to install.  It usually is a different package each time.  I have make sure all permissions are correct.  I even recopied all of the files to the share to make sure they where not damaged some how.  No luck.  I am thinking that the computer is dropping the share while imaging.  Any way to check and see if that is the case?

Example error


An error occurred while Casper was imaging the computer "MX61-Landor PB 15".

Event log from imaging:

    Preparing installation...
    Initializing Imaging Process...
    Mounting afp://xxx.xxx.xxx.xxx/MEX_CasperShare...
    Verifying Packages...
    Verifying Scripts...
    Preparing disk for block copy...
    Performing Block Copy of OS-10.5.4. V1.0.2.dmg...
    Cleaning up after block copy...
    Installing creative-Adobe CS2 v2.dmg...
    Installing Firefox 3.0.1.dmg...
    Installing MEXOffice2008 12.1.14.dmg...
    Installing Required Fonts.dmg...
    Installing UI 10.5 Landor Desktop With Boats.dmg...
    Installing UI 10.5 Landor Screen Saver.dmg...
    Installing UI 10.5 Login Items.dmg...
    Installing UI 10.5 Mouse.dmg...
    Installing UI 10.5 Screen Saver.dmg...
    Installing UI 10.5 Software Update Set.dmg...
    Installing UI 10.5 Sound.dmg...
    Installing UI 10.5 TimeMachine.dmg...
    Installing UI 10.5 Universal Access.dmg...
    Installing UI MEX Base dock.dmg...
    Installing util-EasyFind 4.0.1.dmg...
    Installing UTIL-Fixpermissions 1.01.dmg...
    Installing UTIL-Recon 6.0.1.v1.01dmg.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Installing UTIL-SFO-Sav 10.2.0.dmg...
    Installing util-Stuffit Standard 12.01.dmg...
    Installing util-Timbuktu 8.7 sf v1.01.dmg...
    Installing UI-MEX CS2 dock.dmg...
    Installing MEX_AdobeCS2 updates.dmg...
    Installing UI 10.5 Disk Buring verification.dmg...
    Installing UI 10.5 Internation Menu.dmg...
    Installing UI 10.5 Sidebar.dmg...
    Installing OFFICE 2008 Database New User.dmg...
    Installing Office-Landor MS Templates.dmg...
    Installing Timbuktu Sender 1.2.dmg...
    Installing UI Mexico Server.dmg...
    Installing Font Explorer CS 2 plugins.dmg...
    Installing Font Exporer 1.2.3 v1.0.3.dmg...
    Installing MEX HP Printer Software.dmg...
    Installing Software updates off.dmg...
    Installing UI-Firewall off.dmg...
    Installing UI-LaAdmin Dock Leopard.dmg...
    Error: The file creative-Adobe CS2 v2.dmg does not exist.
    Setting computer name to "MX61-Landor PB 15"...
    Creating /private/etc/jamf.conf...
    Creating /usr/sbin/jamf...
    Creating Startup Script...
    Creating Login/Logout Hooks...
    Creating /usr/sbin/jamfvnc...
    Creating First Run Script...
    Blessing System...
    Ensuring system files are hidden...
    Unmounting File Server...



Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com

Rich.Dagel at landor.com 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/c44546eb/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: CompuServe GIF graphic
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/c44546eb/attachment.gif 

From jared.nichols at ll.mit.edu  Thu Jan 29 06:44:58 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 29 Jan 2009 09:44:58 -0500
Subject: [Casper] Screen Sharing
Message-ID: <C5A72B1A.1ACE3%jared.nichols@ll.mit.edu>

Off the Casper topic, but what the hey, you folks are smart...

I'm using Screen Sharing in Leopard to admin servers when I need to use the GUI.  The server is in Active Directory, and I have a group in our AD that can admin the server.  AD users in that group are able to add the servers in Server Admin, Server Monitor etc and everything works as expected.  However, when you try to use an AD account to connect to the server in Screen Sharing, you're repeatedly denied access unless you use a local admin account.

Can anyone shed some light on this?  I thought that as long as you were in the Admin group, (which those AD accounts are in the AD plugin) you could use screen sharing with those credentials...

Thanks!
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/53d99c1f/attachment.html 

From CMyers at uclan.ac.uk  Thu Jan 29 07:27:51 2009
From: CMyers at uclan.ac.uk (Criss  Myers)
Date: Thu, 29 Jan 2009 15:27:51 +0000
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A72B1A.1ACE3%jared.nichols@ll.mit.edu>
References: <C5A72B1A.1ACE3%jared.nichols@ll.mit.edu>
Message-ID: <4981CAF7.BB96.0081.0@uclan.ac.uk>

Screen sharing uses the local kdc 

 I use apple remote desktop 

Screen sharing also uses bonjour 

I disable bonjour for polictal networking issues around mDNS and i also
destroy the lkdc as it messes with binding to an open directory server 

Criss


Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

>>> On Thu, Jan 29, 2009 at  2:44 PM, in message
<C5A72B1A.1ACE3%jared.nichols at ll.mit.edu>, "Nichols, Jared"
<jared.nichols at ll.mit.edu> wrote:

Off the Casper topic, but what the hey, you folks are smart...

I?m using Screen Sharing in Leopard to admin servers when I need to use
the GUI.  The server is in Active Directory, and I have a group in our
AD that can admin the server.  AD users in that group are able to add
the servers in Server Admin, Server Monitor etc and everything works as
expected.  However, when you try to use an AD account to connect to the
server in Screen Sharing, you?re repeatedly denied access unless you use
a local admin account.

Can anyone shed some light on this?  I thought that as long as you were
in the Admin group, (which those AD accounts are in the AD plugin) you
could use screen sharing with those credentials...

Thanks!
--
Jared Nichols
ISD Infrastructure and Operations * Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/df713fa7/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 29 07:57:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 10:57:06 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A72B1A.1ACE3%jared.nichols@ll.mit.edu>
References: <C5A72B1A.1ACE3%jared.nichols@ll.mit.edu>
Message-ID: <ec2e75ff0901290757o7ce2d122t89b6aca7da0a6b4c@mail.gmail.com>

Is ARD enabled for these users?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/29 Nichols, Jared <jared.nichols at ll.mit.edu>

>  Off the Casper topic, but what the hey, you folks are smart...
>
> I'm using Screen Sharing in Leopard to admin servers when I need to use the
> GUI.  The server is in Active Directory, and I have a group in our AD that
> can admin the server.  AD users in that group are able to add the servers in
> Server Admin, Server Monitor etc and everything works as expected.  However,
> when you try to use an AD account to connect to the server in Screen
> Sharing, you're repeatedly denied access unless you use a local admin
> account.
>
> Can anyone shed some light on this?  I thought that as long as you were in
> the Admin group, (which those AD accounts are in the AD plugin) you could
> use screen sharing with those credentials...
>
> Thanks!
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/bda14469/attachment.htm 

From jared.nichols at ll.mit.edu  Thu Jan 29 07:48:23 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 29 Jan 2009 10:48:23 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <4981CAF7.BB96.0081.0@uclan.ac.uk>
Message-ID: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>

I imagine I'll need to use ARD anyway down the road as our user focus group will likely deem that remote assistance/management will need some sort of notification for the users (which currently as far as I'm aware doesn't happen with Casper Remote and the management account).  This is just a short term solution for additional admins.

j


On 1/29/09 10:27 , "Criss  Myers" <CMyers at uclan.ac.uk> wrote:



 Screen sharing uses the local kdc



  I use apple remote desktop



 Screen sharing also uses bonjour



 I disable bonjour for polictal networking issues around mDNS and i also destroy the lkdc as it messes with binding to an open directory server



 Criss


Criss Myers

Senior Customer Support Analyst (Mac Services)

Apple Certified Technical Coordinator v10.5

LIS Business Support Team

Library 301

University of Central Lancashire

Preston PR1 2HE

Ex 5054

01772 895054

>>> On Thu, Jan 29, 2009 at  2:44 PM, in message <C5A72B1A.1ACE3%jared.nichols at ll.mit.edu>, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:





 Off the Casper topic, but what the hey, you folks are smart...

I'm using Screen Sharing in Leopard to admin servers when I need to use the GUI.  The server is in Active Directory, and I have a group in our AD that can admin the server.  AD users in that group are able to add the servers in Server Admin, Server Monitor etc and everything works as expected.  However, when you try to use an AD account to connect to the server in Screen Sharing, you're repeatedly denied access unless you use a local admin account.

Can anyone shed some light on this?  I thought that as long as you were in the Admin group, (which those AD accounts are in the AD plugin) you could use screen sharing with those credentials...

Thanks!
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500





--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/30c7258b/attachment.html 

From william.smith at merrillcorp.com  Thu Jan 29 08:40:08 2009
From: william.smith at merrillcorp.com (Smith, William)
Date: Thu, 29 Jan 2009 10:40:08 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
Message-ID: <C5A73808.8D41%william.smith@merrillcorp.com>

On 1/29/09 9:48 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:

> I imagine I?ll need to use ARD anyway down the road as our user focus group
> will likely deem that remote assistance/management will need some sort of
> notification for the users (which currently as far as I?m aware doesn?t happen
> with Casper Remote and the management account).  This is just a short term
> solution for additional admins.
 
Actually, one of the features I requested a few of versions back was to
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable the
following privileges for all our admins:

    ? Observe Remote Computers
    ? Observe Remote Computers Without Asking At Login Window
      Observe Remote Computers Without Asking
    ? Control Remote Computers
    ? Control Remote Computers Without Asking At Login Window
      Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in your
administrative arsenal.

-- 

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492


From miles.leacy at themacadmin.com  Thu Jan 29 08:54:06 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 11:54:06 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A73808.8D41%william.smith@merrillcorp.com>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
Message-ID: <ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>

This reminds me of a point I'm dealing with now and have dealt with before.
 Most of the help desk and NOC staffs I have dealt with typically use
Windows desktops.  I would love to have a Casper VNC client for Windows.
I'm more than happy that Casper is a Mac-only management tool, but not being
able to delegate tasks to anyone who isn't using a Mac is often a hindrance.
 Since it is logged, can require user permission and is only initiated when
an authorized user makes a connection, I would love to use the Casper VNC as
my primary, if not only, VNC tool.  To do that, I'll need a client for
Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 29, 2009 at 11:40 AM, Smith, William <
william.smith at merrillcorp.com> wrote:

> On 1/29/09 9:48 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:
>
> > I imagine I?ll need to use ARD anyway down the road as our user focus
> group
> > will likely deem that remote assistance/management will need some sort of
> > notification for the users (which currently as far as I?m aware doesn?t
> happen
> > with Casper Remote and the management account).  This is just a short
> term
> > solution for additional admins.
>
> Actually, one of the features I requested a few of versions back was to
> enforce requests/responses for connecting to remote workstations using
> Casper. This has been available since at least version 5.0. We enable the
> following privileges for all our admins:
>
>    ? Observe Remote Computers
>    ? Observe Remote Computers Without Asking At Login Window
>      Observe Remote Computers Without Asking
>    ? Control Remote Computers
>    ? Control Remote Computers Without Asking At Login Window
>      Control Remote Computers Without Asking
>
> To date, ARD doesn't offer this feature but it's still worth having in your
> administrative arsenal.
>
> --
>
> bill
>
> William M. Smith, Technical Analyst
> MCS IT
> Merrill Communications, LLC
> (651) 632-1492
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/711bf76e/attachment.htm 

From NATHANIEL.LINDLEY at spps.org  Thu Jan 29 08:51:28 2009
From: NATHANIEL.LINDLEY at spps.org (NATHANIEL.LINDLEY at spps.org)
Date: Thu, 29 Jan 2009 10:51:28 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
Message-ID: <OF85DD02B3.FB587B4A-ON8625754D.005C7B97-8625754D.005D4BE6@spps.org>

OK, how about this. 
 Get rid of all the local apps and make them all run from a web-browser. 
or a web-browser that will download the app automatically when requested 
to run something like Casper Remote or CasperVNC. . . .

that might be cool :)




Miles Leacy <miles.leacy at themacadmin.com> 
Sent by: casper-bounces at list.jamfsoftware.com
01/29/2009 10:46 AM

To
"Smith, William" <william.smith at merrillcorp.com>
cc
Casper List <casper at list.jamfsoftware.com>
Subject
Re: [Casper] Screen Sharing






This reminds me of a point I'm dealing with now and have dealt with 
before.  Most of the help desk and NOC staffs I have dealt with typically 
use Windows desktops.  I would love to have a Casper VNC client for 
Windows.

I'm more than happy that Casper is a Mac-only management tool, but not 
being able to delegate tasks to anyone who isn't using a Mac is often a 
hindrance.  Since it is logged, can require user permission and is only 
initiated when an authorized user makes a connection, I would love to use 
the Casper VNC as my primary, if not only, VNC tool.  To do that, I'll 
need a client for Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Thu, Jan 29, 2009 at 11:40 AM, Smith, William <
william.smith at merrillcorp.com> wrote:
On 1/29/09 9:48 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:

> I imagine I?ll need to use ARD anyway down the road as our user focus 
group
> will likely deem that remote assistance/management will need some sort 
of
> notification for the users (which currently as far as I?m aware doesn?t 
happen
> with Casper Remote and the management account).  This is just a short 
term
> solution for additional admins.

Actually, one of the features I requested a few of versions back was to
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable the
following privileges for all our admins:

   ? Observe Remote Computers
   ? Observe Remote Computers Without Asking At Login Window
     Observe Remote Computers Without Asking
   ? Control Remote Computers
   ? Control Remote Computers Without Asking At Login Window
     Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in 
your
administrative arsenal.

--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper
_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/51bd8e48/attachment.html 

From aw_aca_bre at nwoca.org  Thu Jan 29 10:06:57 2009
From: aw_aca_bre at nwoca.org (Brad Rellinger)
Date: Thu, 29 Jan 2009 13:06:57 -0500
Subject: [Casper] Imaging with NeoOffice Patches
Message-ID: <F27FB48F-2A90-4CF5-9AD4-6A7FDCF9CE5A@nwoca.org>

Hello,

If you are familiar with NeoOffice you know that they release patches  
often.  They come in a nice PKG format that are easy to deploy with  
ARD or policies.

Here my problem: I can't seem to get the patches to install correctly  
while the computer is imaging.  I have it setup to first install a  
NeoOffice 2.2.5 Patch 0 DMG Package that I created with Composer.   
Then it installs the Patch 6 that I downloaded right from the  
NeoOffice website.  After the computer reboots, I log in, launch  
NeoOffice and it comes up as Patch 0.  The Patch 6 never installs  
correctly, but there are no errors.

The Patch 6 does install correctly if I set it up to install upon  
login, as a policy.

Has anyone come across this problem?

Thanks
----------
Brad Rellinger
Technology Specialist
Anthony Wayne Schools K-12
aw_aca_bre at nwoca.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/8787d21b/attachment.htm 

From ERNSTCS at uwec.edu  Thu Jan 29 10:59:22 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Thu, 29 Jan 2009 12:59:22 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
Message-ID: <E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>

Get a Mac and run Windows and switch back when they need OS X.

The windows based remote app has been asked for before, by me included... long way back.

Bottom line to me, if you support Macs get one and use one on your support areas and staff.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

On Jan 29, 2009, at 9:54 AM, "Miles Leacy" <miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>> wrote:

This reminds me of a point I'm dealing with now and have dealt with before.  Most of the help desk and NOC staffs I have dealt with typically use Windows desktops.  I would love to have a Casper VNC client for Windows.

I'm more than happy that Casper is a Mac-only management tool, but not being able to delegate tasks to anyone who isn't using a Mac is often a hindrance.  Since it is logged, can require user permission and is only initiated when an authorized user makes a connection, I would love to use the Casper VNC as my primary, if not only, VNC tool.  To do that, I'll need a client for Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
<mailto:miles.leacy at themacadmin.com>miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>
<http://www.themacadmin.com>www.themacadmin.com<http://www.themacadmin.com>




On Thu, Jan 29, 2009 at 11:40 AM, Smith, William <<mailto:william.smith at merrillcorp.com>william.smith at merrillcorp.com<mailto:william.smith at merrillcorp.com>> wrote:
On 1/29/09 9:48 AM, "Nichols, Jared" <<mailto:jared.nichols at ll.mit.edu>jared.nichols at ll.mit.edu<mailto:jared.nichols at ll.mit.edu>> wrote:

> I imagine I?ll need to use ARD anyway down the road as our user focus group
> will likely deem that remote assistance/management will need some sort of
> notification for the users (which currently as far as I?m aware doesn?t happen
> with Casper Remote and the management account).  This is just a short term
> solution for additional admins.

Actually, one of the features I requested a few of versions back was to
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable the
following privileges for all our admins:

   ? Observe Remote Computers
   ? Observe Remote Computers Without Asking At Login Window
     Observe Remote Computers Without Asking
   ? Control Remote Computers
   ? Control Remote Computers Without Asking At Login Window
     Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in your
administrative arsenal.

--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

_______________________________________________
Casper mailing list
<mailto:Casper at list.jamfsoftware.com>Casper at list.jamfsoftware.com<mailto:Casper at list.jamfsoftware.com>
<http://list.jamfsoftware.com/mailman/listinfo/casper>http://list.jamfsoftware.com/mailman/listinfo/casper

_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com<mailto:Casper at list.jamfsoftware.com>
http://list.jamfsoftware.com/mailman/listinfo/casper
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/832ec54e/attachment.html 

From tlarki at kckps.org  Thu Jan 29 11:18:25 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 29 Jan 2009 13:18:25 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
	<E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
Message-ID: <4981ACA1.7141.0039.0@kckps.org>

You guys know that MS has a remote desktop client for OS X right?  I use
it at work all the time and it is free.  You can download it from here 

http://www.microsoft.com/mac/products/remote-desktop/default.mspx 

if you have a Windows directory, ie AD or ED you can plug a computer
name list right into it.   

FYI

>>> "Ernst, Craig S." <ERNSTCS at uwec.edu> 01/29/09 12:59 PM >>>

Get a Mac and run Windows and switch back when they need OS X. 



The windows based remote app has been asked for before, by me
included... long way back. 



Bottom line to me, if you support Macs get one and use one on your
support areas and staff.

Craig Ernst 

UW-Eau Claire 

(715) 836-3639 



Sent from my iPhone 


On Jan 29, 2009, at 9:54 AM, "Miles Leacy" <miles.leacy at themacadmin.com>
wrote:




This reminds me of a point I'm dealing with now and have dealt with
before.  Most of the help desk and NOC staffs I have dealt with
typically use Windows desktops.  I would love to have a Casper VNC
client for Windows. 



I'm more than happy that Casper is a Mac-only management tool, but not
being able to delegate tasks to anyone who isn't using a Mac is often a
hindrance.  Since it is logged, can require user permission and is only
initiated when an authorized user makes a connection, I would love to
use the Casper VNC as my primary, if not only, VNC tool.  To do that,
I'll need a client for Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Thu, Jan 29, 2009 at 11:40 AM, Smith, William 
<william.smith at merrillcorp.com> 

wrote:


On 1/29/09 9:48 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:

> I imagine I?ll need to use ARD anyway down the road as our user focus
group
> will likely deem that remote assistance/management will need some sort
of
> notification for the users (which currently as far as I?m aware
doesn?t happen
> with Casper Remote and the management account).  This is just a short
term
> solution for additional admins.


Actually, one of the features I requested a few of versions back was to
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable
the
following privileges for all our admins:

   ? Observe Remote Computers
   ? Observe Remote Computers Without Asking At Login Window
     Observe Remote Computers Without Asking
   ? Control Remote Computers
   ? Control Remote Computers Without Asking At Login Window
     Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in
your
administrative arsenal.

--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492



_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




_______________________________________________ 



Casper mailing list 



Casper at list.jamfsoftware.com 



http://list.jamfsoftware.com/mailman/listinfo/casper 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/8eb311c2/attachment.htm 

From ERNSTCS at uwec.edu  Thu Jan 29 11:25:21 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Thu, 29 Jan 2009 13:25:21 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <4981ACA1.7141.0039.0@kckps.org>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
	<E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
	<4981ACA1.7141.0039.0@kckps.org>
Message-ID: <5609F322-70B7-4B75-B918-F671D63782D9@uwec.edu>

Thats the reverse point really, Tom. We want to remote in to managed Macs via JAMF's secure VNC and SSH from a Windows clients which is typically dominant in help desks and other support centers.

Our help desk finally has a Mac or two so they can offer the same remote assistance Windows has afforded us for years. It took too long to get there though.

I have a pack of that software since I remote into a terminal server for our help desk system (IE ONLY BLEH), and for AD Work.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

On Jan 29, 2009, at 12:18 PM, "Thomas Larkin" <tlarki at kckps.org<mailto:tlarki at kckps.org>> wrote:


You guys know that MS has a remote desktop client for OS X right?  I use it at work all the time and it is free.  You can download it from here


<http://www.microsoft.com/mac/products/remote-desktop/default.mspx>http://www.microsoft.com/mac/products/remote-desktop/default.mspx


if you have a Windows directory, ie AD or ED you can plug a computer name list right into it.


FYI

>>> "Ernst, Craig S." <ERNSTCS at uwec.edu<mailto:ERNSTCS at uwec.edu>> 01/29/09 12:59 PM >>>

Get a Mac and run Windows and switch back when they need OS X.


The windows based remote app has been asked for before, by me included... long way back.


Bottom line to me, if you support Macs get one and use one on your support areas and staff.

Craig Ernst

UW-Eau Claire

(715) 836-3639


Sent from my iPhone

On Jan 29, 2009, at 9:54 AM, "Miles Leacy" <<mailto:miles.leacy at themacadmin.com>miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>> wrote:



This reminds me of a point I'm dealing with now and have dealt with before.  Most of the help desk and NOC staffs I have dealt with typically use Windows desktops.  I would love to have a Casper VNC client for Windows.


I'm more than happy that Casper is a Mac-only management tool, but not being able to delegate tasks to anyone who isn't using a Mac is often a hindrance.  Since it is logged, can require user permission and is only initiated when an authorized user makes a connection, I would love to use the Casper VNC as my primary, if not only, VNC tool.  To do that, I'll need a client for Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
<mailto:miles.leacy at themacadmin.com>miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>
<http://www.themacadmin.com>www.themacadmin.com<http://www.themacadmin.com>





On Thu, Jan 29, 2009 at 11:40 AM, Smith, William

<<mailto:william.smith at merrillcorp.com>william.smith at merrillcorp.com<mailto:william.smith at merrillcorp.com>>

wrote:

On 1/29/09 9:48 AM, "Nichols, Jared" <<mailto:jared.nichols at ll.mit.edu>jared.nichols at ll.mit.edu<mailto:jared.nichols at ll.mit.edu>> wrote:

> I imagine I?ll need to use ARD anyway down the road as our user focus group
> will likely deem that remote assistance/management will need some sort of
> notification for the users (which currently as far as I?m aware doesn?t happen
> with Casper Remote and the management account).  This is just a short term
> solution for additional admins.


Actually, one of the features I requested a few of versions back was to
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable the
following privileges for all our admins:

   ? Observe Remote Computers
   ? Observe Remote Computers Without Asking At Login Window
     Observe Remote Computers Without Asking
   ? Control Remote Computers
   ? Control Remote Computers Without Asking At Login Window
     Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in your
administrative arsenal.

--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492


_______________________________________________
Casper mailing list
<mailto:Casper at list.jamfsoftware.com>Casper at list.jamfsoftware.com<mailto:Casper at list.jamfsoftware.com>
<http://list.jamfsoftware.com/mailman/listinfo/casper><http://list.jamfsoftware.com/mailman/listinfo/casper>http://list.jamfsoftware.com/mailman/listinfo/casper


_______________________________________________


Casper mailing list


<mailto:Casper at list.jamfsoftware.com>Casper at list.jamfsoftware.com<mailto:Casper at list.jamfsoftware.com>


<http://list.jamfsoftware.com/mailman/listinfo/casper>http://list.jamfsoftware.com/mailman/listinfo/casper

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/3bad102a/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 29 11:26:49 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 14:26:49 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
	<E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
Message-ID: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>

On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:

> Get a Mac and run Windows and switch back when they need OS X.
>

I'd love to.  However, outfitting a corporate call center with Macs to
replace or even to supplement their PCs is expensive, a political
near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which
allows the help desk staff to observe and control Macs than it would be to:

? replace their computers or put a second computer on their desk
? Train help desk staff on a new operating system and new set of tools.
? Convince management that this is a good idea.
? Get management to pay a premium for Macs when PCs have a lower entry cost
(I know the TCO on a Mac is better, but unless you can convince the help
desk management and the finance people, they just see the bigger number on
the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC
makers in order to maintain a contracted pricing structure.  Suggesting a
sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three
separate and distinct groups within IT that the "Mac guy" (or gal) has to
deal with.  1. Desktop/Client support  2.
Infrastructure/Engineering/Platform management 3. Help desk.  Most
situations I see have the "Mac guy" as part of group 1 or group 2, and
occasionally both 1 and 2.  The help desk is often a separate group with
it's own leadership and goals, and sometimes it is outsourced.  I think it
would be infinitely easier to say "Here, use this app to observe and control
Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/e1e2bc69/attachment.htm 

From ERNSTCS at uwec.edu  Thu Jan 29 11:34:05 2009
From: ERNSTCS at uwec.edu (Ernst, Craig S.)
Date: Thu, 29 Jan 2009 13:34:05 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
	<E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
	<ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
Message-ID: <A02210F3-1E18-464F-81E4-BD2839845076@uwec.edu>

Not that I wanted to get carried of on the political side topic, but I did say 1 Mac, or at least meant that.

I also realize there are exclusive single company contracts people adhere to for price breaks.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

On Jan 29, 2009, at 12:26 PM, "Miles Leacy" <miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>> wrote:

On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <<mailto:ERNSTCS at uwec.edu>ERNSTCS at uwec.edu<mailto:ERNSTCS at uwec.edu>> wrote:
Get a Mac and run Windows and switch back when they need OS X.

I'd love to.  However, outfitting a corporate call center with Macs to replace or even to supplement their PCs is expensive, a political near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which allows the help desk staff to observe and control Macs than it would be to:

? replace their computers or put a second computer on their desk
? Train help desk staff on a new operating system and new set of tools.
? Convince management that this is a good idea.
? Get management to pay a premium for Macs when PCs have a lower entry cost (I know the TCO on a Mac is better, but unless you can convince the help desk management and the finance people, they just see the bigger number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC makers in order to maintain a contracted pricing structure.  Suggesting a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three separate and distinct groups within IT that the "Mac guy" (or gal) has to deal with.  1. Desktop/Client support  2. Infrastructure/Engineering/Platform management 3. Help desk.  Most situations I see have the "Mac guy" as part of group 1 or group 2, and occasionally both 1 and 2.  The help desk is often a separate group with it's own leadership and goals, and sometimes it is outsourced.  I think it would be infinitely easier to say "Here, use this app to observe and control Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
<mailto:miles.leacy at themacadmin.com>miles.leacy at themacadmin.com<mailto:miles.leacy at themacadmin.com>
<http://www.themacadmin.com>www.themacadmin.com<http://www.themacadmin.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/ceb1ef16/attachment.html 

From jared.nichols at ll.mit.edu  Thu Jan 29 11:34:45 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 29 Jan 2009 14:34:45 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
Message-ID: <C5A76F05.1AD20%jared.nichols@ll.mit.edu>

Maybe the solution is for Apple to change the terms of OS X's client license to allow virtualization so you could run it on a VMWare Infrastructure server and your help desk clients could run it from their desk...

Just sayin'

j


On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:
Get a Mac and run Windows and switch back when they need OS X.

I'd love to.  However, outfitting a corporate call center with Macs to replace or even to supplement their PCs is expensive, a political near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which allows the help desk staff to observe and control Macs than it would be to:

* replace their computers or put a second computer on their desk
* Train help desk staff on a new operating system and new set of tools.
* Convince management that this is a good idea.
* Get management to pay a premium for Macs when PCs have a lower entry cost (I know the TCO on a Mac is better, but unless you can convince the help desk management and the finance people, they just see the bigger number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC makers in order to maintain a contracted pricing structure.  Suggesting a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three separate and distinct groups within IT that the "Mac guy" (or gal) has to deal with.  1. Desktop/Client support  2. Infrastructure/Engineering/Platform management 3. Help desk.  Most situations I see have the "Mac guy" as part of group 1 or group 2, and occasionally both 1 and 2.  The help desk is often a separate group with it's own leadership and goals, and sometimes it is outsourced.  I think it would be infinitely easier to say "Here, use this app to observe and control Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/3f6edc47/attachment.htm 

From dustin.dorey at district196.org  Thu Jan 29 11:54:21 2009
From: dustin.dorey at district196.org (Dustin Dorey)
Date: Thu, 29 Jan 2009 13:54:21 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <A02210F3-1E18-464F-81E4-BD2839845076@uwec.edu>
References: <C5A739F7.1ACED%jared.nichols@ll.mit.edu>
	<C5A73808.8D41%william.smith@merrillcorp.com>
	<ec2e75ff0901290854m58fce927i81dbefa03de8c118@mail.gmail.com>
	<E37C97C7-7369-4BFF-87C7-7B9EDC377055@uwec.edu>
	<ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
	<A02210F3-1E18-464F-81E4-BD2839845076@uwec.edu>
Message-ID: <1233258861.7630.12.camel@do-a-doreynix>

Different worlds colliding here folks, Corporate IT is run different
than Educational IT.  The differences can be only minor to wildly
different.   Most of the people here that come from Education Support
backgrounds may see a use for such a tool, but not necessarily the need
based on how their IT department is structured.   Where as someone in a
Corporate environment where IT support is incredibly compartmentalized
would see a huge advantage to a tool like this.

For instance if you are tier 1 support or helpdesk at a major
corporation, you could go your entire career there without ever seeing
the inside of the server room.   How many of you in education support
can say the same thing?  From what I've seen on both sides is that often
times you find people in corporations have a very set job, and goal, and
the tools provided to them are done in such a manner that it fills the
need of only that job.   Where as in Educational IT your tech support
person may not have quite as clear of a job description and has many
more tools made available to them, simply because they must fill more
roles.

That may not seem to have anything to do with this conversation but it
does.  What I'm getting at is the corporation is only going to give
those lower end support people the tools the NEED to do their job
because anything more would be a waste.    Simply saying "get a mac"
isn't going to cut it.   Especially when many companies would love to
cut IT all together as to them all they see is money going out.
Perceived value is paramount and it's pretty hard to tell finance you
need to pay that apple tax. Especially when you may have 50 people in a
support area at different desks or cubicles at different times of the
day.  Getting one mac isn't going to cut it.

Not trying to make anyone mad, just explaining the rules are very
different between corporate environments and educational environments.

have a good day everyone!





On Thu, 2009-01-29 at 13:34 -0600, Ernst, Craig S. wrote:
> Not that I wanted to get carried of on the political side topic, but I
> did say 1 Mac, or at least meant that.
> 
> 
> I also realize there are exclusive single company contracts people
> adhere to for price breaks.
> 
> Craig Ernst
> UW-Eau Claire
> (715) 836-3639
> 
> 
> Sent from my iPhone
> 
> On Jan 29, 2009, at 12:26 PM, "Miles Leacy"
> <miles.leacy at themacadmin.com> wrote:
> 
> 
> 
> > On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig
> > S. <ERNSTCS at uwec.edu> wrote:
> >         Get a Mac and run Windows and switch back when they need OS
> >         X.
> > 
> > 
> > I'd love to.  However, outfitting a corporate call center with Macs
> > to replace or even to supplement their PCs is expensive, a political
> > near-impossibility, and in my opinion, unnecessary.
> > 
> > 
> > It would be a lot easier and more practical to get a software tool
> > which allows the help desk staff to observe and control Macs than it
> > would be to:
> > 
> > 
> > ? replace their computers or put a second computer on their desk
> > ? Train help desk staff on a new operating system and new set of
> > tools.
> > ? Convince management that this is a good idea.
> > ? Get management to pay a premium for Macs when PCs have a lower
> > entry cost (I know the TCO on a Mac is better, but unless you can
> > convince the help desk management and the finance people, they just
> > see the bigger number on the invoice.)
> > 
> > 
> > Corporate purchasing groups often have purchasing quotas to meet
> > with PC makers in order to maintain a contracted pricing structure.
> >  Suggesting a sudden drop in deployed PCs will get those folks after
> > you.
> > 
> > 
> > In the larger organizations I've been involved with, there are three
> > separate and distinct groups within IT that the "Mac guy" (or gal)
> > has to deal with.  1. Desktop/Client support  2.
> > Infrastructure/Engineering/Platform management 3. Help desk.  Most
> > situations I see have the "Mac guy" as part of group 1 or group 2,
> > and occasionally both 1 and 2.  The help desk is often
> > a separate group with it's own leadership and goals, and sometimes
> > it is outsourced.  I think it would be infinitely easier to say
> > "Here, use this app to observe and control Macs" than it would be to
> > say "You need to buy Macs for all of your people."
> > 
> > 
> > Besides, we get a Recon.exe with the suite, so why not a
> > CasperVNC.exe?
> > 
> > ----------
> > Miles A. Leacy IV
> > 
> > ? Certified System Administrator 10.4
> > ? Certified Technical Coordinator 10.5
> > ? Certified Trainer
> > Certified Casper Administrator
> > ----------
> > voice: 1-347-277-7321
> > miles.leacy at themacadmin.com
> > www.themacadmin.com
> > 
> > 
> > 
> > 
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper

From tlarki at kckps.org  Thu Jan 29 11:55:45 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 29 Jan 2009 13:55:45 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A76F05.1AD20%jared.nichols@ll.mit.edu>
References: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
	<C5A76F05.1AD20%jared.nichols@ll.mit.edu>
Message-ID: <4981B560.7141.0039.0@kckps.org>

I have been to several Apple sponsored training events with Server,
Directory Services, and all of that jazz they offer for edu
organizations.  I have brought up virtual machines many many times and
always get the same answer, NO! 

VMs would be invaluable for us IT guys/gals but it isn't going to happen
any time soon.  Of course you could always try using OS X x86 and put it
into a VM no idea if that would even work or if it would be worth the
hassle, but just saying.

>>> "Nichols, Jared" <jared.nichols at ll.mit.edu> 01/29/09 1:34 PM >>>

Maybe the solution is for Apple to change the terms of OS X?s client
license to allow virtualization so you could run it on a VMWare
Infrastructure server and your help desk clients could run it from their
desk...

Just sayin?

j


On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:


On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu>
wrote:

Get a Mac and run Windows and switch back when they need OS X.


I'd love to.  However, outfitting a corporate call center with Macs to
replace or even to supplement their PCs is expensive, a political
near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which
allows the help desk staff to observe and control Macs than it would be
to:

  ? replace their computers or put a second computer on their desk
  ? Train help desk staff on a new operating system and new set of
tools.
  ? Convince management that this is a good idea.
  ? Get management to pay a premium for Macs when PCs have a lower entry
cost (I know the TCO on a Mac is better, but unless you can convince the
help desk management and the finance people, they just see the bigger
number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC
makers in order to maintain a contracted pricing structure.  Suggesting
a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three
separate and distinct groups within IT that the "Mac guy" (or gal) has
to deal with.  1. Desktop/Client support  2.
Infrastructure/Engineering/Platform management 3. Help desk.  Most
situations I see have the "Mac guy" as part of group 1 or group 2, and
occasionally both 1 and 2.  The help desk is often a separate group with
it's own leadership and goals, and sometimes it is outsourced.  I think
it would be infinitely easier to say "Here, use this app to observe and
control Macs" than it would be to say "You need to buy Macs for all of
your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>





--
Jared Nichols
ISD Infrastructure and Operations ? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/474135a7/attachment.htm 

From jared.nichols at ll.mit.edu  Thu Jan 29 11:58:45 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Thu, 29 Jan 2009 14:58:45 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <4981B560.7141.0039.0@kckps.org>
Message-ID: <C5A774A5.1AD2A%jared.nichols@ll.mit.edu>

I really, really don't understand their reasoning.  Make the VM run on Apple hardware at least.  That's fine - they do this with Server today!.  Having 8 partitions on a machine for testing purposes, always rebuilding/reimaging one of them in SO rediculous.

j


On 1/29/09 14:55 , "Thomas Larkin" <tlarki at kckps.org> wrote:



 I have been to several Apple sponsored training events with Server, Directory Services, and all of that jazz they offer for edu organizations.  I have brought up virtual machines many many times and always get the same answer, NO!



 VMs would be invaluable for us IT guys/gals but it isn't going to happen any time soon.  Of course you could always try using OS X x86 and put it into a VM no idea if that would even work or if it would be worth the hassle, but just saying.

>>> "Nichols, Jared" <jared.nichols at ll.mit.edu> 01/29/09 1:34 PM >>>




 Maybe the solution is for Apple to change the terms of OS X's client license to allow virtualization so you could run it on a VMWare Infrastructure server and your help desk clients could run it from their desk...

Just sayin'

j


On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:







 On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:






 Get a Mac and run Windows and switch back when they need OS X.







 I'd love to.  However, outfitting a corporate call center with Macs to replace or even to supplement their PCs is expensive, a political near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which allows the help desk staff to observe and control Macs than it would be to:

  * replace their computers or put a second computer on their desk
  * Train help desk staff on a new operating system and new set of tools.
  * Convince management that this is a good idea.
  * Get management to pay a premium for Macs when PCs have a lower entry cost (I know the TCO on a Mac is better, but unless you can convince the help desk management and the finance people, they just see the bigger number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC makers in order to maintain a contracted pricing structure.  Suggesting a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three separate and distinct groups within IT that the "Mac guy" (or gal) has to deal with.  1. Desktop/Client support  2. Infrastructure/Engineering/Platform management 3. Help desk.  Most situations I see have the "Mac guy" as part of group 1 or group 2, and occasionally both 1 and 2.  The help desk is often a separate group with it's own leadership and goals, and sometimes it is outsourced.  I think it would be infinitely easier to say "Here, use this app to observe and control Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>










 --
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500




--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/6b27146f/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 29 12:14:45 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 15:14:45 -0500
Subject: [Casper] Screen Sharing
In-Reply-To: <4981B560.7141.0039.0@kckps.org>
References: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
	<C5A76F05.1AD20%jared.nichols@ll.mit.edu>
	<4981B560.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901291214n71d36645mf0e006b96e5845e8@mail.gmail.com>

I'm looking into Aqua Connect, but to remote into one machine to use as an
intermediary to remote to a second machine doesn't seem very logical or very
speedy to me.
It would be simpler and faster to directly connect to the machine in
question.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/29 Thomas Larkin <tlarki at kckps.org>

>  I have been to several Apple sponsored training events with Server,
> Directory Services, and all of that jazz they offer for edu organizations.
>  I have brought up virtual machines many many times and always get the same
> answer, NO!
>
>  VMs would be invaluable for us IT guys/gals but it isn't going to happen
> any time soon.  Of course you could always try using OS X x86 and put it
> into a VM no idea if that would even work or if it would be worth the
> hassle, but just saying.
>
> >>> "Nichols, Jared" <jared.nichols at ll.mit.edu> 01/29/09 1:34 PM >>>
>
> Maybe the solution is for Apple to change the terms of OS X's client
> license to allow virtualization so you could run it on a VMWare
> Infrastructure server and your help desk clients could run it from their
> desk...
>
> Just sayin'
>
> j
>
>
> On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:
>
>    On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu>
> wrote:
>
>  Get a Mac and run Windows and switch back when they need OS X.
>
>
> I'd love to.  However, outfitting a corporate call center with Macs to
> replace or even to supplement their PCs is expensive, a political
> near-impossibility, and in my opinion, unnecessary.
>
> It would be a lot easier and more practical to get a software tool which
> allows the help desk staff to observe and control Macs than it would be to:
>
>   ? replace their computers or put a second computer on their desk
>   ? Train help desk staff on a new operating system and new set of tools.
>   ? Convince management that this is a good idea.
>   ? Get management to pay a premium for Macs when PCs have a lower entry
> cost (I know the TCO on a Mac is better, but unless you can convince the
> help desk management and the finance people, they just see the bigger number
> on the invoice.)
>
> Corporate purchasing groups often have purchasing quotas to meet with PC
> makers in order to maintain a contracted pricing structure.  Suggesting a
> sudden drop in deployed PCs will get those folks after you.
>
> In the larger organizations I've been involved with, there are three
> separate and distinct groups within IT that the "Mac guy" (or gal) has to
> deal with.  1. Desktop/Client support  2.
> Infrastructure/Engineering/Platform management 3. Help desk.  Most
> situations I see have the "Mac guy" as part of group 1 or group 2, and
> occasionally both 1 and 2.  The help desk is often a separate group with
> it's own leadership and goals, and sometimes it is outsourced.  I think it
> would be infinitely easier to say "Here, use this app to observe and control
> Macs" than it would be to say "You need to buy Macs for all of your people."
>
> Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com <http://www.themacadmin.com>
>
>
>
>
> --
> Jared Nichols
> ISD Infrastructure and Operations ? Desktop Engineering
> MIT Lincoln Laboratory
> 244 Wood St.
> Lexington, MA 02420-9108
> (781) 981-5500
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/3e97f56c/attachment.htm 

From tlarki at kckps.org  Thu Jan 29 13:00:30 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Thu, 29 Jan 2009 15:00:30 -0600
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A774A5.1AD2A%jared.nichols@ll.mit.edu>
References: <4981B560.7141.0039.0@kckps.org>
	<C5A774A5.1AD2A%jared.nichols@ll.mit.edu>
Message-ID: <4981C48E.7141.0039.0@kckps.org>

Well for one, straight from the horses mouth to quote Jobs, "Apple is
not an enterprise company."  That is their attitude towards it.  They
also think it would hurt their sales since people could run VMs on PCs. 
I don't think they can code the TPM in a VM to make sure its running on
a Mac since it is all x86 hardware and VMs run on that virtual layer. 
Yes it is freaking ridiculous.  I have a FW HD with 4 partitions on it. 
OS X 10.4 server/client and OS X 10.5 server/client so I can target mode
boot off them for testing purposes. 

Every time I go to an Apple sponsored event I always ask out loud when
we can see OS X in a VM.  I figure if I ask enough maybe someday we will
get it.


___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351





>>> "Nichols, Jared" <jared.nichols at ll.mit.edu> 01/29/09 1:58 PM >>>

I really, really don?t understand their reasoning.  Make the VM run on
Apple hardware at least.  That?s fine ? they do this with Server today!.
 Having 8 partitions on a machine for testing purposes, always
rebuilding/reimaging one of them in SO rediculous.

j


On 1/29/09 14:55 , "Thomas Larkin" <tlarki at kckps.org> wrote:


  

  

I have been to several Apple sponsored training events with Server,
Directory Services, and all of that jazz they offer for edu
organizations.  I have brought up virtual machines many many times and
always get the same answer, NO! 

   

       

  

VMs would be invaluable for us IT guys/gals but it isn't going to happen
any time soon.  Of course you could always try using OS X x86 and put it
into a VM no idea if that would even work or if it would be worth the
hassle, but just saying.


>>> "Nichols, Jared" <jared.nichols at ll.mit.edu> 01/29/09 1:34 PM >>>
    
 
 

 Maybe the solution is for Apple to change the terms of OS X?s client
license to allow virtualization so you could run it on a VMWare
Infrastructure server and your help desk clients could run it from their
desk...

Just sayin?

j


On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

      
 
 


 

 On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu>
wrote:
        
 
 


 

 Get a Mac and run Windows and switch back when they need OS X.
          
 
 


 

 
 I'd love to.  However, outfitting a corporate call center with Macs to
replace or even to supplement their PCs is expensive, a political
near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which
allows the help desk staff to observe and control Macs than it would be
to:

  ? replace their computers or put a second computer on their desk
  ? Train help desk staff on a new operating system and new set of
tools.
  ? Convince management that this is a good idea.
  ? Get management to pay a premium for Macs when PCs have a lower entry
cost (I know the TCO on a Mac is better, but unless you can convince the
help desk management and the finance people, they just see the bigger
number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC
makers in order to maintain a contracted pricing structure.  Suggesting
a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three
separate and distinct groups within IT that the "Mac guy" (or gal) has
to deal with.  1. Desktop/Client support  2.
Infrastructure/Engineering/Platform management 3. Help desk.  Most
situations I see have the "Mac guy" as part of group 1 or group 2, and
occasionally both 1 and 2.  The help desk is often a separate group with
it's own leadership and goals, and sometimes it is outsourced.  I think
it would be infinitely easier to say "Here, use this app to observe and
control Macs" than it would be to say "You need to buy Macs for all of
your people."

Besides, we get a Recon.? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>



        
 
 


 

 
 --
Jared Nichols
ISD Infrastructure and Operations ? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
 
 
 


--
Jared Nichols
ISD Infrastructure and Operations ? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/d413fa78/attachment.htm 

From Cyrus.Vahhaji at bestbuy.com  Thu Jan 29 13:23:57 2009
From: Cyrus.Vahhaji at bestbuy.com (Cyrus Vahhaji)
Date: Thu, 29 Jan 2009 15:23:57 -0600
Subject: [Casper] Packaging Server OS
Message-ID: <C5A77A8D.1E65E%Cyrus.Vahhaji@bestbuy.com>

Are any of you packaging OS X server? If so can you share how you go about
packaging it and if you can comment on the following questions I have?
* Recommendations on serializing when no site license available. Is it
possible to script serialization/registration during build process? If so
can you share this script, not the serial numbers :)
* Can I assume I can script network configuration by creating a script using
networksetup? 
* What services can be configured in an image without any repercussions?
* Any other do?s and don?ts?

Thanx,
Cyrus


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/dd2529eb/attachment.html 

From miles.leacy at themacadmin.com  Thu Jan 29 13:40:03 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Thu, 29 Jan 2009 16:40:03 -0500
Subject: [Casper] Packaging Server OS
In-Reply-To: <C5A77A8D.1E65E%Cyrus.Vahhaji@bestbuy.com>
References: <C5A77A8D.1E65E%Cyrus.Vahhaji@bestbuy.com>
Message-ID: <ec2e75ff0901291340p56f54b44k7c66e2299d4ca822@mail.gmail.com>

2009/1/29 Cyrus Vahhaji <Cyrus.Vahhaji at bestbuy.com>

> Are any of you packaging OS X server?
>

Yep.

The Joker said "If you're good at something, never do it for free."  Then
again, he's a homicidal clown.


>    - Recommendations on serializing when no site license available. Is it
>    possible to script serialization/registration during build process? If so
>    can you share this script, not the serial numbers :)
>
>
# Change serial to $4 from JSS

/System/Library/ServerSetup/serversetup -setServerSerialNumber "$4"



>
>    -
>    - Can I assume I can script network configuration by creating a script
>    using networksetup?
>
>
Yup.  Just make sure you use "at reboot" scripts.  Actually, all of this
should be "at reboot".  I actually let Casper Imaging (or autorun/prestage)
take care of my network settings.  I use networksetup to turn off IPv6 on
all interfaces and to disable the firewire network interface.


>
>    -
>    - What services can be configured in an image without any
>    repercussions?
>
>
I don't configure any services in an image.  Depending on the service it may
be possible to configure a service by using a script that writes to, or a
package that deploys the service's config files.  Just make sure to
carefully examine and research the service to make sure you get all of it's
parts.


>
>    -
>    - Any other do's and don'ts?
>
> My server core configuration in Casper Admin consists of the OS, our
enterprise backup client, and the casper tools.  Scripts (all "at reboot")
include backup client configuration, enable ARD for admin user, set server
serial, turn time machine nag off, turn off IPv6 on all interfaces, disable
firewire networking.

Anything else depends on what the server is for and what software needs to
be deployed to it.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090129/d8aae3f5/attachment.htm 

From lopez at embl.de  Fri Jan 30 03:36:15 2009
From: lopez at embl.de (Carmelo Lopez)
Date: Fri, 30 Jan 2009 12:36:15 +0100
Subject: [Casper] Netinstall too slow on new Imac Silver
Message-ID: <15FC73BC-2C92-429F-B863-0156B795CDF6@embl.de>

Dear All,

I have the issue that when I want to deploy a new system via Casper  
Netinstall  on the new imac Silver the process takes double the time  
that on a new macbook or macbook pro or on a mac-mini

I did a new OS image from the iMac as well as a new Netboot/Netinstall  
set with Casper Netinstall Image Creator

Do somebody know how to fix this?
thanks in advance

cheers

Carmelo Lopez Portilla

ITS EMBL Heidelberg
Tel. +49 (0) 6221 387 8444
Fax +49 (0) 6221 387 8517
email: lopez at embl.de



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/236e1cb3/attachment.html 

From jared.nichols at ll.mit.edu  Fri Jan 30 07:51:27 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Fri, 30 Jan 2009 10:51:27 -0500
Subject: [Casper] Screen Sharing Issue
Message-ID: <C5A88C2F.1AD4D%jared.nichols@ll.mit.edu>

FYI... I had asked if there was a way to inform people they were being remote observed/controlled as my machines weren't informing users of this and I thought that there was a way to integrate it into the ARD binoculars...

As it turns out, in the JSS accounts permissions, I had "Observe Remote Computers Without Asking" and "Control Remote Computers Without Asking" checked.  With these checked, it takes precedence over the "Observe Remote Computers" and "Control Remote Computers" permissions and thus wasn't prompting the user for permission to observe/control.

Jamf support of course pointed me to the right place... Figured someone else might run into this...

j
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/ec803c1a/attachment.htm 

From tlarki at kckps.org  Fri Jan 30 08:23:21 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 10:23:21 -0600
Subject: [Casper] wrapping an application in apple script,
	then mass deploying	it
Message-ID: <4982D519.7141.0039.0@kckps.org>

It's Friday so I figured I would ask a ridiculous question.  I have an application that is a super pain.  It is actually a Windows app, wrapped in the cross over API that runs on Intel Macs.  The app itself runs well actually but it needs to map to a network drive to connect to a database.  So, if I manually map the drive the app works great and if I point the app via the app config file to the shared volume it will not try to map it next launch.  The problem is, the DB is on a novell share, and the Novell share has AFP running and if I manually map it before I launch the application it works great.  Since OS X maps network shares in /Volumes it keeps looking for that network share in /Volumes, well if it isn't mapped it just errors out.  I have tried putting the afp:\\path\to\share in the configuration file and still no dice. 

So, I am in contact with the developer now trying to get a solution, but just in case as a back up, I figured i can wrap this thing up in an Apple Script that will mount the share in question (each user will authenticate to the share with their LDAP credentials) and then launch the app after the mount has been verified. 

Anyone want to give me any pointers?   

Thanks, 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/d1cf86ae/attachment.html 

From cmyers at uclan.ac.uk  Fri Jan 30 08:36:07 2009
From: cmyers at uclan.ac.uk (Criss Myers)
Date: Fri, 30 Jan 2009 16:36:07 +0000
Subject: [Casper] wrapping an application in apple script,
	then mass deploying	it
In-Reply-To: <4982D519.7141.0039.0@kckps.org>
References: <4982D519.7141.0039.0@kckps.org>
Message-ID: <0BAD09BC-6EB1-41F7-8BE6-372A6D34B226@uclan.ac.uk>

What about a login automount with WGM ?

On 30 Jan 2009, at 16:23, "Thomas Larkin" <tlarki at kckps.org> wrote:

> It's Friday so I figured I would ask a ridiculous question.  I have  
> an application that is a super pain.  It is actually a Windows app,  
> wrapped in the cross over API that runs on Intel Macs.  The app  
> itself runs well actually but it needs to map to a network drive to  
> connect to a database.  So, if I manually map the drive the app  
> works great and if I point the app via the app config file to the  
> shared volume it will not try to map it next launch.  The problem  
> is, the DB is on a novell share, and the Novell share has AFP  
> running and if I manually map it before I launch the application it  
> works great.  Since OS X maps network shares in /Volumes it keeps  
> looking for that network share in /Volumes, well if it isn't mapped  
> it just errors out.  I have tried putting the afp:\\path\to\share in  
> the configuration file and still no dice.
>
> So, I am in contact with the developer now trying to get a solution,  
> but just in case as a back up, I figured i can wrap this thing up in  
> an Apple Script that will mount the share in question (each user  
> will authenticate to the share with their LDAP credentials) and then  
> launch the app after the mount has been verified.
>
> Anyone want to give me any pointers?
>
> Thanks,
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/b9d724a4/attachment.htm 

From tlarki at kckps.org  Fri Jan 30 09:49:27 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 11:49:27 -0600
Subject: [Casper] Running inventory reports by partition schema
Message-ID: <4982E947.7141.0039.0@kckps.org>

We now have a need to figure out how many machines have windows on them or not.  I would like to run a report with Casper that will go through inventory and if a Mac doesn't have a NTFS partition on it with Windows I want it on one list, and if it does I want it on another list so we can tell what machines dual boot and which ones don't. 

Any ideas? 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/fe30981f/attachment.htm 

From miles.leacy at themacadmin.com  Fri Jan 30 10:07:50 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 30 Jan 2009 13:07:50 -0500
Subject: [Casper] Running inventory reports by partition schema
In-Reply-To: <4982E947.7141.0039.0@kckps.org>
References: <4982E947.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901301007wa7ac96cv85be2050be9d6818@mail.gmail.com>

Dummy package.  Loop through your /Volumes with:
haswindows=`diskutil info $volume | grep -c NTFS`

if [ $haswindows -ne 0 ] ; then

issue the custom trigger to install the dummy package.  Scope your smart
group to the existence of the dummy package.

You may want to double check that "NTFS" is what you want to grep for.  I
don't have any NTFS volumes to test this with.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




2009/1/30 Thomas Larkin <tlarki at kckps.org>

>  We now have a need to figure out how many machines have windows on them
> or not.  I would like to run a report with Casper that will go through
> inventory and if a Mac doesn't have a NTFS partition on it with Windows I
> want it on one list, and if it does I want it on another list so we can tell
> what machines dual boot and which ones don't.
>
>  Any ideas?
>
> ___________________________
> Thomas Larkin
> TIS Department
> KCKPS USD500
> tlarki at kckps.org
> blackberry:  913-449-7589
> office:  913-627-0351
>
>
>
>
>
>
> _______________________________________________
> Casper mailing list
> Casper at list.jamfsoftware.com
> http://list.jamfsoftware.com/mailman/listinfo/casper
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/e08d7440/attachment.html 

From tlarki at kckps.org  Fri Jan 30 10:29:28 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 12:29:28 -0600
Subject: [Casper] Running inventory reports by partition schema
In-Reply-To: <ec2e75ff0901301007wa7ac96cv85be2050be9d6818@mail.gmail.com>
References: <4982E947.7141.0039.0@kckps.org>
	<ec2e75ff0901301007wa7ac96cv85be2050be9d6818@mail.gmail.com>
Message-ID: <4982F2A8.7141.0039.0@kckps.org>

will this dummy package log only machines that have windows then in the
policy logs?  How exactly does this work?

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/30/09 12:07 PM >>>
Dummy package.  Loop through your /Volumes with: 


haswindows=`diskutil info $volume | grep -c NTFS` 



if [ $haswindows -ne 0 ] ; then 



issue the custom trigger to install the dummy package.  Scope your smart
group to the existence of the dummy package. 



You may want to double check that "NTFS" is what you want to grep for. 
I don't have any NTFS volumes to test this with.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/30 Thomas Larkin 
<tlarki at kckps.org> 




We now have a need to figure out how many machines have windows on them
or not.  I would like to run a report with Casper that will go through
inventory and if a Mac doesn't have a NTFS partition on it with Windows
I want it on one list, and if it does I want it on another list so we
can tell what machines dual boot and which ones don't. 


Any ideas? 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/a210b371/attachment.htm 

From miles.leacy at themacadmin.com  Fri Jan 30 10:35:49 2009
From: miles.leacy at themacadmin.com (Miles Leacy)
Date: Fri, 30 Jan 2009 13:35:49 -0500
Subject: [Casper] Running inventory reports by partition schema
In-Reply-To: <4982F2A8.7141.0039.0@kckps.org>
References: <4982E947.7141.0039.0@kckps.org>
	<ec2e75ff0901301007wa7ac96cv85be2050be9d6818@mail.gmail.com>
	<4982F2A8.7141.0039.0@kckps.org>
Message-ID: <ec2e75ff0901301035q6643621tc024b8a81802a0ef@mail.gmail.com>

A dummy package is just an empty package.  Name it something appropriate and
recognizable such as "windowsMachines.pkg".
Create a policy with a custom trigger to install this package.

Create a second policy that runs on all of your machines which runs the
script that I half-wrote in my last message.  That script issues the custom
trigger for the policy to install the dummy package if it finds an NTFS
volume.

What you end up with is each machine that has an NTFS volume also has a
receipt for windowsMachines.pkg.  You then create a smart group whose
criteria is machines with the windowsMachines.pkg receipt.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com




On Fri, Jan 30, 2009 at 1:29 PM, Thomas Larkin <tlarki at kckps.org> wrote:

>  will this dummy package log only machines that have windows then in the
> policy logs?  How exactly does this work?
>
> >>> Miles Leacy <miles.leacy at themacadmin.com> 01/30/09 12:07 PM >>>
>
> Dummy package.  Loop through your /Volumes with:
>
>
>   haswindows=`diskutil info $volume | grep -c NTFS`
>
>
>   if [ $haswindows -ne 0 ] ; then
>
>
>   issue the custom trigger to install the dummy package.  Scope your smart
> group to the existence of the dummy package.
>
>
>   You may want to double check that "NTFS" is what you want to grep
> for.  I don't have any NTFS volumes to test this with.
>
> ----------
> Miles A. Leacy IV
>
> ? Certified System Administrator 10.4
> ? Certified Technical Coordinator 10.5
> ? Certified Trainer
> Certified Casper Administrator
> ----------
> voice: 1-347-277-7321
> miles.leacy at themacadmin.com
> www.themacadmin.com
>
>
>
>
>   2009/1/30 Thomas Larkin
>
> <tlarki at kckps.org>
>
>
>   We now have a need to figure out how many machines have windows on them
>> or not.  I would like to run a report with Casper that will go through
>> inventory and if a Mac doesn't have a NTFS partition on it with Windows I
>> want it on one list, and if it does I want it on another list so we can tell
>> what machines dual boot and which ones don't.
>>
>>
>>  Any ideas?
>>
>>
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry:  913-449-7589
>> office:  913-627-0351
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/6c1bc683/attachment.html 

From jared.nichols at ll.mit.edu  Fri Jan 30 10:17:19 2009
From: jared.nichols at ll.mit.edu (Nichols, Jared)
Date: Fri, 30 Jan 2009 13:17:19 -0500
Subject: [Casper] Running inventory reports by partition schema
In-Reply-To: <4982E947.7141.0039.0@kckps.org>
Message-ID: <C5A8AE5F.1AD9A%jared.nichols@ll.mit.edu>

Hi-

Looking through the man page for df, you may be able to use the -T flag to specify NTFS (or whatever that partition type shows up as in the OS).

So for example, you could get an output of everything that's hfs by doing
%df -T hfs

Or, everything that's not hfs by doing
%df -T nohfs

Wonder if the same could be held for NTFS (can't try as I don't have a windows partition on anything)

j


On 1/30/09 12:49 , "Thomas Larkin" <tlarki at kckps.org> wrote:



 We now have a need to figure out how many machines have windows on them or not.  I would like to run a report with Casper that will go through inventory and if a Mac doesn't have a NTFS partition on it with Windows I want it on one list, and if it does I want it on another list so we can tell what machines dual boot and which ones don't.



 Any ideas?

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/2bb305d9/attachment.htm 

From tlarki at kckps.org  Fri Jan 30 10:44:16 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 12:44:16 -0600
Subject: [Casper] Running inventory reports by partition schema
In-Reply-To: <ec2e75ff0901301035q6643621tc024b8a81802a0ef@mail.gmail.com>
References: <4982E947.7141.0039.0@kckps.org>
	<ec2e75ff0901301007wa7ac96cv85be2050be9d6818@mail.gmail.com>
	<4982F2A8.7141.0039.0@kckps.org>
	<ec2e75ff0901301035q6643621tc024b8a81802a0ef@mail.gmail.com>
Message-ID: <4982F620.7141.0039.0@kckps.org>

ah got it, so basically the install will only tirgger if the criteria of
having an ntfs partition is met and then of course the policy log will
have a recipt of every machine that it runs on.  That is a damn creative
way to do that.  I like it. 

In response to Jared Nichols email, you sir are correct.  I just test it
out.  df -T ntfs does in fact show the volume that the windows partition
is on and nothing else.  good call on that one

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/30/09 12:35 PM >>>
A dummy package is just an empty package.  Name it something appropriate
and recognizable such as "windowsMachines.pkg". 


Create a policy with a custom trigger to install this package. 



Create a second policy that runs on all of your machines which runs the
script that I half-wrote in my last message.  That script issues the
custom trigger for the policy to install the dummy package if it finds
an NTFS volume. 



What you end up with is each machine that has an NTFS volume also has a
receipt for windowsMachines.pkg.  You then create a smart group whose
criteria is machines with the windowsMachines.pkg receipt.


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





On Fri, Jan 30, 2009 at 1:29 PM, Thomas Larkin 
<tlarki at kckps.org> 

wrote:


will this dummy package log only machines that have windows then in the
policy logs?  How exactly does this work?

>>> Miles Leacy <miles.leacy at themacadmin.com> 01/30/09 12:07 PM >>> 



Dummy package.  Loop through your /Volumes with: 





haswindows=`diskutil info $volume | grep -c NTFS` 



if [ $haswindows -ne 0 ] ; then 



issue the custom trigger to install the dummy package.  Scope your smart
group to the existence of the dummy package. 



You may want to double check that "NTFS" is what you want to grep for. 
I don't have any NTFS volumes to test this with.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com





2009/1/30 Thomas Larkin 
<tlarki at kckps.org> 




We now have a need to figure out how many machines have windows on them
or not.  I would like to run a report with Casper that will go through
inventory and if a Mac doesn't have a NTFS partition on it with Windows
I want it on one list, and if it does I want it on another list so we
can tell what machines dual boot and which ones don't. 


Any ideas? 

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/75d2202c/attachment.html 

From john_wetter at hopkins.k12.mn.us  Fri Jan 30 12:31:13 2009
From: john_wetter at hopkins.k12.mn.us (John Wetter)
Date: Fri, 30 Jan 2009 14:31:13 -0600
Subject: [Casper] Apple releases article regarding LKDC imaging information
 - was: (Re: Master Image Creation Checklist)
In-Reply-To: <ec2e75ff0901211957n1c8bc041haa8092c9b061d524@mail.gmail.com>
Message-ID: <C5A8BFB1.82F1%john_wetter@hopkins.k12.mn.us>

Hello all,
I see that Apple has posted something on this now...  It's updated in the admin tools 10.5.6 released on January 22nd.

http://support.apple.com/kb/TS1245

The article says updated in December, but I don't see how that is possible as it references things that came out on January 22nd....

A question to the JAMF folks on list is do we need to follow the last of the information on this page as though it's creating a NetInstall image, or will Composer take care of this for us in a future (or current) version?  If it'll take an update, consider this a feature request.

-John


On 1/21/09 9:57 PM, "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

I threw the following together after reading Rich's message.  This has not been tested yet.

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_deleteLKDC.bash
#
# Created 20090121 by Miles A. Leacy IV
# miles.leacy at themacadmin.com
# Modified 20090121 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as
# this header remains intact.
#
# This script is provided "as is".  The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon,
# or any other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
# twice more.
#
# This script deletes Leopard's Local KDC and preps the system to
# create a new one on first boot.
# Use as an "after" script in your Casper core configuration.
#
##### HEADER ENDS #####

systemkeychain -k $1/Library/Keychains/System.keychain -C -f

rm -fr $1/var/db/krb5kdc

defaults delete $1/System/Library/LaunchDaemons/com.apple.configureLocalKDC Disabled


----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com>




2009/1/21 John Wetter <john_wetter at hopkins.k12.mn.us>
Miles,

Are you just doing a destroy and rebuild in one script like this?

sudo rm -rf /var/db/krb5kdc
sudo /usr/libexec/configureLocalKDC

I'm going to have to give this a try as lately we have been seeing some issues with users not being able to log in to AD even when everything is showing as green.  We are running a triangle with AD-OD in part of our environment and this is a problem, so I wonder if this might be one thing to check.

-John


On 1/21/09 8:36 PM, "Miles Leacy" <miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com> > wrote:

I have yet to encounter any LKDC problems, however, they have been widely reported and I have no reason to believe that these reports are bogus.  Therefore, in the interest of eliminating potential problems, I see destroying the LKDC as a best practice.  You can do this before creating your base image, or you can do it as an "after" script in your configuration.

Guess which I prefer.  :)

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com <http://miles.leacy at themacadmin.com>
www.themacadmin.com <http://www.themacadmin.com>  <http://www.themacadmin.com>




On Wed, Jan 21, 2009 at 7:31 PM, Dagel, Rich <Rich.Dagel at landor.com <http://Rich.Dagel at landor.com> > wrote:
I have been hearing things about AD machine passwords timing out and you should set it not to when binding to the AD.  And also local that the local KDC needs to be deleted.  We have moved to 10.5.4 and have been seeing some problems with computer not being able to login even with a green light for the AD account being ready.  Wondering if you have run across that or have heard of it.


Rich Dagel
Senior Technology Specialist
[cid:3316170673_2665234]
Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com <http://Rich.Dagel at landor.com>  <http://Rich.Dagel at landor.com>

--
John Wetter
Technology Support Administrator
Educational Technology, Media & Information Services
Hopkins Public Schools
952-988-5373
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/c6eb16b2/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.gif
Type: image/gif
Size: 580 bytes
Desc: image.gif
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/c6eb16b2/attachment.gif 

From tlarki at kckps.org  Fri Jan 30 13:38:54 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 15:38:54 -0600
Subject: [Casper] wrapping an application in apple script,
	then	massdeploying it
In-Reply-To: <C5A8CD42.C506%john.brenner@merrillcorp.com>
References: <4982D519.7141.0039.0@kckps.org>
	<C5A8CD42.C506%john.brenner@merrillcorp.com>
Message-ID: <49831F0E.7141.0039.0@kckps.org>

Here is basically what I want to accomplish and I am pretty sure it is possible, I will just list them in order of how the end user would execute the app in question. 

1)  End user opens up application from apps folder 
2)  Instead of it opening the app first, it launches an apple script 
3)  AppleScript maps a network drive and waits for authenticaiton 
4)  Once authenticated and mapped, runs do shell script command and chflags to hide the network volume from the finder 
5)  launches application which needs to connect to the mapped drive (database) 
6)  when app exits, applescript unmounts network share 

is this possible?  I think it most likely is

>>> "Brenner, John" <john.brenner at merrillcorp.com> 01/30/09 3:29 PM >>>

How about this? Create a file at the root of the share have the apple script check for the existence of the file and then continue.  Loop the script with a  5 count and error if it cant find it.  




On 1/30/09 10:23 AM, "Thomas Larkin" <tlarki at kckps.org> wrote:


  

  

It's Friday so I figured I would ask a ridiculous question.  I have an application that is a super pain.  It is actually a Windows app, wrapped in the cross over API that runs on Intel Macs.  The app itself runs well actually but it needs to map to a network drive to connect to a database.  So, if I manually map the drive the app works great and if I point the app via the app config file to the shared volume it will not try to map it next launch.  The problem is, the DB is on a novell share, and the Novell share has AFP running and if I manually map it before I launch the application it works great.  Since OS X maps network shares in /Volumes it keeps looking for that network share in /Volumes, well if it isn't mapped it just errors out.  I have tried putting the afp:\\path\to\share ( afp:\\path\to\share ) in the configuration file and still no dice. 

   

       

  

So, I am in contact with the developer now trying to get a solution, but just in case as a back up, I figured i can wrap this thing up in an Apple Script that will mount the share in question (each user will authenticate to the share with their LDAP credentials) and then launch the app after the mount has been verified. 

   

       

  

Anyone want to give me any pointers?   

   

       

  

Thanks, 


 
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351







_______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper




John Brenner    |   Merrill Corporation     |   IOG IT   |  651-632-4072










-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/b432b503/attachment.html 

From john.brenner at merrillcorp.com  Fri Jan 30 13:52:42 2009
From: john.brenner at merrillcorp.com (Brenner, John)
Date: Fri, 30 Jan 2009 15:52:42 -0600
Subject: [Casper] wrapping an application in apple script,
 then massdeploying it
In-Reply-To: <49831F0E.7141.0039.0@kckps.org>
Message-ID: <C5A8D2CA.C50C%john.brenner@merrillcorp.com>

I would be easier to do this entirely from the shell with applescript
wrapper to pass the user input variables eg username and password.  You
would have to write a daemon to watch the named process for the application
and then unmount the volume after.

Just a thought.... 


On 1/30/09 3:38 PM, "Thomas Larkin" <tlarki at kckps.org> wrote:

>    
> 
>  Here is basically what I want to accomplish and I am pretty sure it is
> possible, I will just list them in order of how the end user would execute the
> app in question. 
> 
>        
> 
>  1)  End user opens up application from apps folder
>  
> 
>  2)  Instead of it opening the app first, it launches an apple script
>  
> 
>  3)  AppleScript maps a network drive and waits for authenticaiton
>  
> 
>  4)  Once authenticated and mapped, runs do shell script command and chflags
> to hide the network volume from the finder
>  
> 
>  5)  launches application which needs to connect to the mapped drive
> (database)    
>  
> 
>  6)  when app exits, applescript unmounts network share
> 
>        
> 
>  is this possible?  I think it most likely is
> 
>>>> >>> "Brenner, John" <john.brenner at merrillcorp.com> 01/30/09 3:29 PM >>>
>     
>  
>  
> 
>  How about this? Create a file at the root of the share have the apple script
> check for the existence of the file and then continue. ?Loop the script with a
> ?5 count and error if it cant find it. ?
> 
> 
> 
> 
> On 1/30/09 10:23 AM, "Thomas Larkin" <tlarki at kckps.org> wrote:
> 
>       
>  
>  
>>  
>>  
>> 
>>  ??
>> 
>> ?        
>>  
>>  
>>  
>> 
>>  It's Friday so I figured I would ask a ridiculous question. ?I have an
>> application that is a super pain. ?It is actually a Windows app, wrapped in
>> the cross over API that runs on Intel Macs. ?The app itself runs well
>> actually but it needs to map to a network drive to connect to a database.
>> ?So, if I manually map the drive the app works great and if I point the app
>> via the app config file to the shared volume it will not try to map it next
>> launch. ?The problem is, the DB is on a novell share, and the Novell share
>> has AFP running and if I manually map it before I launch the application it
>> works great. ?Since OS X maps network shares in /Volumes it keeps looking for
>> that network share in /Volumes, well if it isn't mapped it just errors out.
>> ?I have tried putting the afp:\\path\to\share in the configuration file and
>> still no dice.  
>>  
>>  
>>  
>> 
>>  ???
>> 
>> ???????
>> 
>> ?        
>>  
>>  
>>  
>> 
>>  So, I am in contact with the developer now trying to get a solution, but
>> just in case as a back up, I figured i can wrap this thing up in an Apple
>> Script that will mount the share in question (each user will authenticate to
>> the share with their LDAP credentials) and then launch the app after the
>> mount has been verified.
>>  
>>  
>>  
>> 
>>  ???
>> 
>> ???????
>> 
>> ?        
>>  
>>  
>>  
>> 
>>  Anyone want to give me any pointers? ?
>>  
>>  
>>  
>> 
>>  ???
>> 
>> ???????
>> 
>> ?        
>>  
>>  
>>  
>> 
>>  Thanks,        
>>  
>>  
>>  
>> 
>>  
>>  ?
>> ___________________________
>> Thomas Larkin
>> TIS Department
>> KCKPS USD500
>> tlarki at kckps.org
>> blackberry: ?913-449-7589
>> office: ?913-627-0351
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>>         
>>  
>>  
>>  
>> 
>>  _______________________________________________
>> Casper mailing list
>> Casper at list.jamfsoftware.com
>> http://list.jamfsoftware.com/mailman/listinfo/casper
>>         
>>  
>>  
>  
> 
>          
> 
>        
>  
> 
>  
> 
>  
>  
>  
>  
> 
>  John Brenner ???| ??Merrill Corporation ????| ??IOG IT ??| ?651-632-4072
>       
>  
>  
>  
> 
>  
>  
>  
>  
>  
> 
>  
> 
>  
>  
>  
> 
>          
> 
>        
>  
> 
>  
>  
>  
>  
>  
> 
>  
>  
>  
>  


John Brenner    |   Merrill Corporation     |   IOG IT   |  651-632-4072






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/5d40e49d/attachment.htm 

From tlarki at kckps.org  Fri Jan 30 14:01:19 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 16:01:19 -0600
Subject: [Casper] wrapping an application in apple script,
	thenmassdeploying it
In-Reply-To: <C5A8D2CA.C50C%john.brenner@merrillcorp.com>
References: <49831F0E.7141.0039.0@kckps.org>
	<C5A8D2CA.C50C%john.brenner@merrillcorp.com>
Message-ID: <4983244F.7141.0039.0@kckps.org>

I am now thinking of just creating a local user account with that mapped network drive as a log in item.  So they can log into that local user account just for testing.  Of course that may go into the image for next year, not quite feasible right this second. 

I want to be able to package all of this via composer in one nice little app.  There has to be a way to tell the test taker executable to launch the apple script instead of the application itself, then have the script launch the application after the drive is mapped.

>>> "Brenner, John" <john.brenner at merrillcorp.com> 01/30/09 3:52 PM >>>

I would be easier to do this entirely from the shell with applescript wrapper to pass the user input variables eg username and password.  You would have to write a daemon to watch the named process for the application and then unmount the volume after.   

Just a thought....


On 1/30/09 3:38 PM, "Thomas Larkin" <tlarki at kckps.org> wrote:


  

  

Here is basically what I want to accomplish and I am pretty sure it is possible, I will just list them in order of how the end user would execute the app in question. 

   

       

  

1)  End user opens up application from apps folder 

   
 

  

2)  Instead of it opening the app first, it launches an apple script 

   
 

  

3)  AppleScript maps a network drive and waits for authenticaiton 

   
 

  

4)  Once authenticated and mapped, runs do shell script command and chflags to hide the network volume from the finder 

   
 

  

5)  launches application which needs to connect to the mapped drive (database) 

   
 

  

6)  when app exits, applescript unmounts network share 

   

       

  

is this possible?  I think it most likely is


>>> "Brenner, John" <john.brenner at merrillcorp.com> 01/30/09 3:29 PM >>>
    
 
 

 How about this? Create a file at the root of the share have the apple script check for the existence of the file and then continue.  Loop the script with a  5 count and error if it cant find it.  




On 1/30/09 10:23 AM, "Thomas Larkin" <tlarki at kckps.org> wrote:

      
 
 


 

   

         
 
 



 It's Friday so I figured I would ask a ridiculous question.  I have an application that is a super pain.  It is actually a Windows app, wrapped in the cross over API that runs on Intel Macs.  The app itself runs well actually but it needs to map to a network drive to connect to a database.  So, if I manually map the drive the app works great and if I point the app via the app config file to the shared volume it will not try to map it next launch.  The problem is, the DB is on a novell share, and the Novell share has AFP running and if I manually map it before I launch the application it works great.  Since OS X maps network shares in /Volumes it keeps looking for that network share in /Volumes, well if it isn't mapped it just errors out.  I have tried putting the afp:\\path\to\share ( afp:\\path\to\share ) in the configuration file and still no dice.        
 


 

    

       

         
 
 



 So, I am in contact with the developer now trying to get a solution, but just in case as a back up, I figured i can wrap this thing up in an Apple Script that will mount the share in question (each user will authenticate to the share with their LDAP credentials) and then launch the app after the mount has been verified.        
 


 

    

       

         
 
 



 Anyone want to give me any pointers?          
 


 

    

       

         
 
 



 Thanks,        
 


 

 
  
___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351






       
 
 



 _______________________________________________
Casper mailing list
Casper at list.jamfsoftware.com
http://list.jamfsoftware.com/mailman/listinfo/casper
        
 






         


       



 

 





 John Brenner    |   Merrill Corporation     |   IOG IT   |  651-632-4072
      
 





 
 
 





 

 



         

       



 
 
 


 

 
 
 
 




John Brenner    |   Merrill Corporation     |   IOG IT   |  651-632-4072










-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/1c1423af/attachment.html 

From ric.getter at pcc.edu  Fri Jan 30 16:46:14 2009
From: ric.getter at pcc.edu (Ric Getter)
Date: Fri, 30 Jan 2009 16:46:14 -0800
Subject: [Casper] Screen Sharing
In-Reply-To: <C5A76F05.1AD20%jared.nichols@ll.mit.edu>
References: <ec2e75ff0901291126o2756ece2s8f94035c7fc2965f@mail.gmail.com>
	<C5A76F05.1AD20%jared.nichols@ll.mit.edu>
Message-ID: <009101c9833d$5259f280$f70dd780$@getter@pcc.edu>

I haven?t tried it with Leopard, but we used to have some success with Real VNC (http://www.realvnc.com/) talking to a 10.4 Server. It suffers from some lag compared to OS-native software (RDC or ARD), but it runs the standard VNC protocol and I believe that you can point it at other ports.

 

Ric

 

 --
Ric Getter
Portland Community College/Sylvania
Coordinator, Computer Resource Center
(503)977-8036

From: casper-bounces at list.jamfsoftware.com [mailto:casper-bounces at list.jamfsoftware.com] On Behalf Of Nichols, Jared
Sent: Thursday, January 29, 2009 11:35 AM
To: Casper List
Subject: Re: [Casper] Screen Sharing

 

Maybe the solution is for Apple to change the terms of OS X?s client license to allow virtualization so you could run it on a VMWare Infrastructure server and your help desk clients could run it from their desk...

Just sayin?

j


On 1/29/09 14:26 , "Miles Leacy" <miles.leacy at themacadmin.com> wrote:

On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:

Get a Mac and run Windows and switch back when they need OS X.


I'd love to.  However, outfitting a corporate call center with Macs to replace or even to supplement their PCs is expensive, a political near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which allows the help desk staff to observe and control Macs than it would be to:

? replace their computers or put a second computer on their desk
? Train help desk staff on a new operating system and new set of tools.
? Convince management that this is a good idea.
? Get management to pay a premium for Macs when PCs have a lower entry cost (I know the TCO on a Mac is better, but unless you can convince the help desk management and the finance people, they just see the bigger number on the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC makers in order to maintain a contracted pricing structure.  Suggesting a sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three separate and distinct groups within IT that the "Mac guy" (or gal) has to deal with.  1. Desktop/Client support  2. Infrastructure/Engineering/Platform management 3. Help desk.  Most situations I see have the "Mac guy" as part of group 1 or group 2, and occasionally both 1 and 2.  The help desk is often a separate group with it's own leadership and goals, and sometimes it is outsourced.  I think it would be infinitely easier to say "Here, use this app to observe and control Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com <http://www.themacadmin.com> 





-- 
Jared Nichols
ISD Infrastructure and Operations ? Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/8ed21bfa/attachment.html 

From Rich.Dagel at landor.com  Fri Jan 30 16:54:17 2009
From: Rich.Dagel at landor.com (Dagel, Rich)
Date: Fri, 30 Jan 2009 16:54:17 -0800
Subject: [Casper] Self Service Usage
Message-ID: <C5A8E139.26A1B%Rich.Dagel@landor.com>

We are about to roll out the self service feature.   I am wondering what
cool things others are using it for.

I have added all of our printers to ours.
Have a fix my mac policy that dose most of the stuff under the advanced tab
of casper remote.
Fix keychains
Change password by bringing the user to the accounts systems prefs password
change screen
Remove font cache files

Any ideas would be great!


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/5fcb5c90/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 580 bytes
Desc: not available
Url : http://list.jamfsoftware.com/pipermail/casper/attachments/20090130/5fcb5c90/attachment.gif 

From tlarki at kckps.org  Fri Jan 30 20:19:21 2009
From: tlarki at kckps.org (Thomas Larkin)
Date: Fri, 30 Jan 2009 22:19:21 -0600
Subject: [Casper] Self Service Usage
Message-ID: <49837C62020000390000876F@gwoes4.kckps.org>

I have a self service policy that triggers a reboot into windows XP Pro on the client machine with out the user having admin rights at all.  I use the bless command to make it happen, and wrapped up in the GUI of self service.

___________________________
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry:  913-449-7589
office:  913-627-0351



>>> "Dagel, Rich" <Rich.Dagel at landor.com> 01/30/09 6:58 PM >>>
We are about to roll out the self service feature.   I am wondering what
cool things others are using it for.

I have added all of our printers to ours.
Have a fix my mac policy that dose most of the stuff under the advanced tab
of casper remote.
Fix keychains
Change password by bringing the user to the accounts systems prefs password
change screen
Remove font cache files

Any ideas would be great!


Rich Dagel
Senior Technology Specialist

Landor Associates
1001 Front Street
San Francisco, CA 94111
United States
415 365 3933
http://www.landor.com
Rich.Dagel at landor.com