Check EFI Password State Extension Attribute

Standard

JAMF have a great article on deploying the binary needed to set a firmware password on 2010+ Macs via the Casper Suite, here.

I recently had a chance to play with it, but found that the below command (which is used by the following EA to check EFI Password status) often returns nothing or just 0 after running. Regardless if an EFI password is set or not.

sudo /Library/Application\ Support/JAMF/bin/setregproptool -c

So below is a different version of the before linked Extension Attribute, using “expect” & maybe a inelegant check.. but hey, if it works!

Continue reading

Submit User Information From AD Into The JSS At Login v2

Standard

A couple of years ago I posted on how we “Submit User Information From AD Into The JSS At Login” Since the  Casper Suite 8.61 was release, the JSS has been able to perform this function. Below is a guide on how to leverage this.

Continue reading

Using Directory Utility To View An AD Objects Attributes

Standard

A number of my scripts leverage attributes found within an objects Active Directory record. I used to reach to either decl or Apache Directory Studio as per this article on JAMFNation in order to view this information when investigating my scripts.

However, since 10.7 (I think), I have more often found myself using Directory Utility to perform this task. the below is a quick run through on how to use it for this task.

Continue reading

ANNOUNCING: ADPassmon v2 fork

Standard

 

UPDATE: My fork of ADPassMon has now been merged with main & many changes have been made, for more information follow this link. The Wiki on the GitHub project replaces the details below.

icon

Over the past two posts, I have detailed two issues with 10.9

  1. No Password Expiration Warning At The Login Window
  2. The “Local Items” keychain

In looking at resolving issue 1, I revisited Peter Bukowinski’s excellent ADPassMon. This is a great app, but has never quite suited my environment, as such I grabbed the code off of GitHub & got stuck in.

This has resulted in me, on this most foolish of days & with a nervous excitement, announcing my ADPassMon fork. In time I hope this fork joins the is committed to the main release.

So why did I go to all this trouble? What does it do? Read below.

Continue reading

The “Local Items” Keychain In Mavericks

Standard 
UPDATE: My fork of ADPassMon has now been merged with main & many changes have been made, for more information follow this link.
Screen Shot 2014-03-29 at 11.21.15 PM

The “Local Items” keychain is something that you may have the misfortune of running into when changing passwords via an external directory service due to password expiry or a using forgetting their passwords in Mavericks.

I spent some time tackling it when forking ADPassMon to not only update Users passwords not via the pref pane, just through ADPassMon, & then also updating the users keychain password.

Below are my observations on the new keychain.

Continue reading

No Password Expiry Warning At The Login Window On 10.9

Standard 
UPDATE: My fork of ADPassMon has now been merged with main & many changes have been made, for more information follow this link.
10.8 Password Expiration

Over the past few Mac OS revisions, you’ve been able to alert users to impending password expiry. Shown above is this on 10.8.

Below are details on how I set the above, and the issue with Mavericks

Continue reading

How To Create An Never Booted OS.dmg Using Casper Admin

Standard 
UPDATE: AutoDMG makes this process, "stupid easy" so I'm going to move away from the below to using that tool. Also, if you're master distribution point is a JDS you cannot compile configurations. Again AutoDMG to the rescue.

Ever since Casper Admin has allowed for compiling configurations way back in the 10.5/6 days I have been successfully creating an OS.dmg via Casper Admin. I still use this method today & since 10.7 this DMG also includes the Restore Partition.

The end result is an DMG of the OS that has never been booted & is an asr image. Much like DMG’s created by InstaDMG & AutoDMG.

I’m not sure why I seem to be the only one doing this, but below is the how;

Continue reading

iDevice Clients Offered A Blank Certificate On Password Change When Connecting To Wireless Using RADIUS Authentication

Standard

We’ve been supporting iDevice clients for a few years now, but recently ran into an issue that even a Cisco TAC call & the ever helpful resources of JAMFNation & MacEnterprise we not able to resolve.

Our users authenticate to the wireless using their AD credentials, after a password change they should be prompted to enter their new password. Once done they should reconnect to the wireless.

Oddly, after a password change the iDevices started to be offered a blank cert such as that above

See below for more details

Continue reading

Mavericks & Preference Caching

Standard

Preference Caching is something that has been within OSX for some time, in Mountain Lion it was quite prominent with plists such as the Dock plist.

When Dockutil 1.1.4 was released it’s major change as noted in the release notes was to restart  this preference caching service called: cfprefsd, without which the settings written to the com.apple.dock.plist would later be overwritten.

So why am I mumbling along about this?

Well, recently i’ve been involved in discussions on this & wanted to post something to give others the heads up in case anyone else struggles with it.

Continue reading

VPP 2.0 & “A Question Of Morality”

Standard

Back in November last year, I posted some observations VPP 2.0, Mavericks, iLife ’13 & iWork ’13 which highlighted some of the technical difficulties with this new approach.

However, taking a step back we realised that we were going to struggle with licensing the software.

After several discussions with various Apple employees we came to a solution, which was summarised by the Apple employee as “a question of morality.”

So how did the conversations get to that point? Well, let me explain..

Continue reading