EFI Password already set?

I think there are issues with the accounts tab with the new tool.

I include a line like below in post image script to set it, You could write a script with line like below and push it out via policy.

/Library/Application Support/JAMF/bin/setregproptool –p newpassword -o oldpassword

The result I'm getting is:
Script Result: /private/tmp/EFI Password Set New.sh: line 5: /Library/Application: No such file or directory

I'm wondering if this is an issue like in Terminal where to change directories to a location that has a "space" in in (Application Support) you have to write it as /Application Support/

I attempted to update the script like that but also no luck. Any ideas what I'm doing incorrectly?

This is what you're looking for
/Library/Application Support/JAMF/bin/setregproptool -m command -p newpass -o oldpass

I'm not a scripting expert, but when in doubt, when I write a script, I drag the item to terminal to get the path it's looking for.

Still no luck. "Segmentation fault" is the error now, even though it shows the policy as successful. I tried a few variations of the above code with the mode -m command.

/usr/sbin/jamf is version 8.52
Executing Policy EFI Password...
[STEP 1 of 3]
Mounting afp://macserverwc01.belps.org/CasperShare to /Volumes/CasperShare...
[STEP 2 of 3]
Running Script EFI Password Set New.sh...
Script Exit Code:139
Script Result: /private/tmp/EFI Password Set New.sh: line 5: 16898 Segmentation fault: 11 /Library/Application Support/JAMF/bin/setregproptool -m command -p [password removed]
Unmounting file server...
[STEP 3 of 3]
Running Recon...
Searching Additional Path: /Users/
Gathering Application Usage Information...
Finding Extension Attributes...

Just curious, but do these Macs already have an existing firmware password applied to them? In your first sentence in your original post, it sounds like you're applying the EFI password for the first time. If that's the case, you can drop the -o oldpassword part of the command. Just do /path/to/setregproptool -m command -p password and see what happens. You would only need the 'oldpassword' if you were changing an existing password.

You can also try enclosing the path to the tool in double quote marks, as in:

"/Library/Application Support/JAMF/bin/setregproptool" -m command -p password

Aside from the machines I'm testing with right now, the idea is that the machines will NOT have an EFI password currently set.

I tried not including the -o oldpassword and adding quotes in various formats, but no luck with that. However, what I do seem to be having luck with is running it all through JAMF via (1) a package that installs the setregproptool to the bin directory; and then (2) using a JAMF policy to set the Accounts > Set Open Firmware/EFI Password; (3) using Mountain Lion machines (including a brand new imac and several MBPs). So far it looks like my Lion tests are failing 100% and Mtn Lions are succeeding 100%. And thus my question is this: The setregproptool that I got was from a mountain lion image - is that the source of my woes? If I use the same process to capture the setregproptool from a Lion image will that work for Lion machines?

Also please note that when I ran the above policy on Mtn Lion machines it actually allows me to 'succeed' with the policy many times - including if I change the password in the policy and rerun it - it doesn't actually seem to stick the EFI Password permanently until the machine is rebooted. Might want to force a reboot if we go this route.

The password gets applied with the command, but running a check for the setting via the setregproptool will always show as "not set" (or if removing it, shows as "set") until a reboot is done. Its just one of the quirks with this, so yes, you may want to include a reboot after the setting gets applied.

As for any difference in the setregproptool versions between OSes, I quite honestly don't know, but its certainly possible you may need to build one for each OS version to get it to work.

Sooooo...now that Lion is no longer in the store, and I can't get the ESD image on a thumbdrive to play the same way.....does anybody have a Lion setregproptool they want to pass along? Ha.

Boom - Using your instructions to acquire a 10.7 Lion version of the setregproptool, I just successfully ran EFI via JAMF on a 10.7 machine and it worked! I will test more later, but so far that looks way better than the results I was getting before. So, to summarize, it does look to me, at least in our environment, that the setregproptool for Lion is different than the setregproptool for Mtn Lion. All I've got going is one policy in JAMF that includes a package that distributes the setregproptool into the JAMF/bin folder and then the Account EFI settings that sets it to command mode with a password. THANKS FOR THE HELP!