Don't allow reopen windows when logging back in... (Yosemite 10.10.2)

I would be interested in a solution as well. I've been using the same command as a Managed pref and it worked on 10.9, that's no longer the case with 10.10.3

OLD: com.apple.loginwindow TALLogoutSavesState = 0

NEW: First run script on 10.10: /usr/bin/defaults write com.apple.loginwindow TALLogoutSavesState -bool false

The 10.10 only works when it's run on the logged in user's account. I can no longer put it in the "First run script" during imaging, which would be ideal.

As a last resort, running it as a policy trigged at login would work. Scratch that, it sadly doesn't work.

Yeah, it seems that Apple made this a strictly user level setting that can't be set in the global loginwindow plist. Well, you can write it into that plist, but the OS won't respect it if the user has chosen to enable (or just forgotten to disable) the option when logging out.

One possible solution may be to write a simple script that runs in the user context that does the defaults write command, set up to deploy in a policy as a cached offline policy and set the trigger to Logout. When they log out, it should run the script and change the setting back to off, so when the Mac restarts or they log back in, windows won't reappear.

I haven't actually tested any of the above, but it should work. I may need to run a quick test to see if it does.

EDIT: OK, I've had partial success with this method. Try this and see if it works for you.

1. Create a new policy in the JSS
2. Set the Trigger to "Logout"
3. Set the Execution Frequency to "Ongoing"
4. Check the box to "Make Available Offline"
5. Set up the Files and Processes payload
6. In the Execute Command field, enter this:

   /usr/bin/defaults write /Users/$(ls -l /dev/console | awk '{print $3}')/Library/Preferences/com.apple.loginwindow.plist TALLogoutSavesState -bool NO; chown $(ls -l /dev/console | awk '{print $3}') /Users/$(ls -l /dev/console | awk '{print $3}')/Library/Preferences/com.apple.loginwindow.plist

   What this does is run the initial policy command at logout (and caches the command) that gets the logged in user name and writes the TALLogoutSavesState boolean value to NO to the user's loginwindow.plist, then corrects the permissions on the plist to make sure its owned by the user, so it can be read again at login. (It becomes owned by root when the command runs initially)

I tested this by opening a bunch of Finder windows, logging out and checking the box at the logout prompt to "Reopen windows when logging back in" After logging back in, the windows do not reappear, and at the next logout, that box is now unchecked.

The only reason I say partially successful is because I did see some applications re-open, but that might actually be getting stored in a different location or in a different plist, so I may need to investigate and see where its reading the open application list from.

I have a configuration profile that works, just tested on 10.10.3. Even if the user clicks on reopen windows when logging back in, it will revert back and when they log back in nothing will be open. Hope this helps, https://github.com/golbiga/Profiles/blob/master/disablereopenwindows.mobileconfig.

Allen

@golbiga Thanks, Allen. I'll test it in my environment and touch back.

nicely done, @golbiga - your config profile is working for me. thanks.

@golbiga Thanks for the profile. Worked great for us.

@golbiga Pardon my ignorance, but how does one implement this config profile? I'm familiar with plist custom uploads in the config profile menus in JSS, but where do I drop your file and set it up? Anyone?

Never mind... Got it. Need to use the "upload" button in Config Profiles, not "new" and then add it in the custom field...

@golbiga I've been testing your config on a 10.10.4 machine with no luck. It doesn't seem to work when run on either user or computer level. Is there something specific that needs to be done to make it function?

@McAwesome

Just to make sure, you didn't edit it before uploading and it's in a .mobileconfig format?

Computer level works, screenshots below.

optional image ALT text

optional image ALT text

@golbiga Uploaded the .mobileconfig file, changed the name through the JSS. No dice. Other than the name, it is identical to the screenshots you've posted.

@golbiga Nevermind. The problem with working on two test machines at the same time is you get their names mixed up. It works fine.

Any chance someone knows of a repository of "Configuration Profiles" like the one @golbiga compiled, so us newbies can roam thru them and find the ones we need for our specific environments?

Thanks in advance (all of you)

Mike D