com.apple.dockfixup.plist and High Sierra

Thus far in my (very) early testing of High Sierra 10.13 (17A365), I have noticed that the Dock is not getting configured as expected.

Dockutil 2.0.5 (current version) is installed and my user setup script (a first login script/policy) appears to be running, but new users arent getting my customized Dock like they did in 10.12 and earlier.

The Docutil site (https://github.com/kcrawford/dockutil) doesn't make any explicit mention of 10.13 High Sierra support yet, but it appears to run manually in my brief testing.

My Dock settings are very basic: Remove (most of) the Apple stock apps and then add a couple Office 2016 apps, etc.

I havent started investigating this issue too deep yet, but its on my list. I have bigger fish to fry - Im a LONG way from deploying High Sierra in production.

Is anyone else experiencing Docutil issues in High Sierra?

Thanks for the post. I am experiencing the same thing as you. High Sierra seems to be ignoring the com.apple.dockfixup.plist all together. Ill assume its an Apple issue and wait for 10.13.1 to hopefully correct this issue.

I was able to get the Dock to behave as I wanted to, but I had to do it in an unacceptable process, but it did allow me to determine that com.apple.dockfixup.plist is the start of the answer.

Booting into Target Mode, I mounted the Mac system and navigated to the following file:

/System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.pli st

Renamed it to com.apple.dockfixup.plistBKUP

Now a new user logs in for the first time and their Dock is preconfigured based upon the com.apple.dock.plist in the User Template

I tested (without dockutil) and didn't seem to have any trouble getting the same results from a User Template com.apple.dock.plist in Hi-C that I did in Sierra. I've found (YMMV) that it helps to avoid trying to add user home folder items to a custom dock. The OS (dockfixup) will add at least one home folder item back to every new dock automatically--Downloads.

Since I am using AutoDMG as part of my workflow a colleaugue of mine suggested making a pkg that replaces the dockfixup file while the system is unmounted thus avoiding SIP protect dockfixup file, will test and report what I find.

For anyone who was curious, the suggestion from @Cornoir rename the dockfixup plist worked for me in a netboot-based imaging workflow. While the computer is being imaged in netboot, I just added this script to run after the OS is installed and before reboot:

#!/bin/bash

#rename dockfixup plist so undesired Apple apps don't get added to Dock
echo "Renaming com.apple.dockfixup.plist to com.apple.dockfixup.plist-bk..."
mv /Volumes/Macintosh HD/System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.plist /Volumes/Macintosh HD/System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.plist-bk

This doesn't solve all of my problems because I still have relative path issues for folders on the Dock, and JSS policies with login hooks don't work reliably, so my script utilizing dockutil at login just works when it works, and doesn't when it doesn't. At least I finally got rid of Siri, Maps, Photos, and iBooks though...one problem at a time.

I have found this has the same effect

defaults write /System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.plist "add-app" ""
defaults write /System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.plist "add-doc" ""

For anyone interested Other Defaults I change for our mac's are

defaults write com.apple.desktopservices DSDontWriteNetworkStores true
defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool true
defaults write com.apple.finder ShowIconThumbnails -bool false
defaults write com.apple.finder ShowPreview -bool false
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeCloudSetup -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant LastSeenCloudProductVersion "${sw_vers}"
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant LastSeenBuddyBuildVersion "${sw_build}"
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeSiriSetup -bool TRUE defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant.plist DidSeeSyncSetup -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant.plist DidSeeSyncSetup2 -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeApplePaySetup -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeAvatarSetup -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeCloudDiagnostics -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeTouchIDSetup -bool true
defaults write /System/Library/User Template/English.lproj/Library/Preferences/com.apple.SetupAssistant DidSeeiCloudLoginForStorageServices -bool true

I've been using a policy that runs at "Recurring Check-In," "Once per user per computer" instead of a Configuration Profile or a script to set default Docks for my different departments.

The pre-work is to load all your app Dock icons into Jamf Admin first. By this I mean all the default Apple Dock apps, and the apps you want to install. I started by capturing all the Dock icons from a standard out of the box Mac into Jamf Pro. Then, install the third-party apps and capture those Dock icons.

When you create the policy, you can then set it to first remove any default Dock icons you want, and then add the new ones in the order that you want them to appear. You can create different policies scoped for different computer groups by just cloning your initial Dock policy, and then customize it for the next computer group and scope it appropriately. I work for a marketing company, so my Accounts folks don't get the same apps, and therefore the same Dock icons, as those in Creative or Production depts.

The policy can be set to run after you have installed the appropriate software for the scoped computer.

This effectively has the same functionality as the old Workgroup Manager option for setting the Dock "Once." The Dock is then free to be manipulated by the end user, but at least you have provided the aliases to your standard apps and removed the ones they won't use.

The other nice thing about running it as a policy is that you can also have it run scripts for other default settings. For example, I have it run scripts that set Dock behavior, Finder preferences, Launch Services defaults, and Spotlight settings.

Please see my screen shot as a basic example.