There may be better/easier ways, but we did a simple snapshot/package and triggered by a script that ensures Safari/Firefox are not running (thanks Steve, Tom, etc.).

Don

Thank you

Do you have a copy of your script?

Patrick Bachuwa
Client Technical Services
Sears Holdings Corporation
Michigan Campus
3000 W. 14 Mile Road
Royal Oak, MI  48073-1717
Phone: 248 637-0350
Patrick.Bachuwa at searshc.com

I created a package to run at startup - its so small I figured pretty low chance of happening with browser opened. I'd be interested to see the script too.

Just run at logout, then the browser is not running

Sent from my iPad

!/bin/sh

##########################################################
#
# CHECK SAFARI PROCESS AND TRIGGER THE FLASH PLAYER POLICY
# IF SAFARI IS RUNNING ON CLIENT MACHINES, THE SCRIPT WILL
# EXIT ELSE FLASH PLAYER POLICY WILL BE TRIGGERED
#
##########################################################

if [[ $(ps ax | grep [/]Safari) ]]
then
exit

else
jamf policy -trigger FlashPlayer
fi

If you view the package contents of the Adobe installer you will see it is just a GUI wrapped over an actual PKG file. I just dropped that PKG file into Casper Admin and called it a day. You can even install it with Firefox running, I just did this myself. Though, I need to verify so I went here:

http://kb2.adobe.com/cps/155/tn_15507.html

It says I am running 10.1.85.3 where as before I was running 10.1.54.x. You can install it and it works but it won't get applied until Firefox is restarted. So, I would create a manual trigger policy installs flash and then script it to where it installs and when it is done it gives the user a message to restart firefox as updates have been applied.

sudo jamf displayMessage -message "Firefox has been updated, and needs to be restarted. Please quit and relaunch Firefox."

So you don't technically have to quit the browser to install. The adobe installer is just trash Adobe makes with a nice gui and it makes you agree to the terms and conditions before installing. Otherwise, the core components of flash are in the PKG file.

Attached is a pic of the installer location.

Hope this helps,

Tom


I got it now thanks, is it Friday yet?

Patrick Bachuwa

Client Technical Services

Sears Holdings Corporation

Michigan Campus

3000 W. 14 Mile Road

Royal Oak, MI 48073-1717

Phone: 248 637-0350

I wish it was Friday, and pay day and thanksgiving break all at once! hahaha :)

This is just a FYI, but a great free and powerful tool called Pacifist allows you to pick and pull installers, PKGs, zips, tars, etc apart and extract files/folders from them. A lot of times if I have problems with something installing or what not I will pick it apart with Pacifist and look to see how the developer organized the files. If I only need to extract some core components then I do so.

Just remember, test, test, test, test, test, test, eat lunch, test, test, test and then deploy.

link: http://www.charlessoft.com/

You cannot beat freeware :)

-Tom

Free? :)

Free with a nagging message until you register, but if you can put up with the nagging message then yes, free

What Tom does is the same thing I do. It works a treat. =)

We wanted to trigger at logout, but we couldn't get the company to agree to have users log out. So we had to trigger the push to kick in when Safari is not active, once per computer.

Don

For a browser plug-in getting installed by a snapshot, does it really
On 11/2/10 12:36 PM, "Don Montalvo" <donmontalvo at gmail.com> wrote:
matter whether or not Safari or Firefox is running? Won't the plug-in just
be inactive 'til the next launch of the browser?

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

Thanks a bunch for sharing; I just tested the Flash PKG successfully J

Patrick Bachuwa

Client Technical Services

Sears Holdings Corporation

Michigan Campus

3000 W. 14 Mile Road

Royal Oak, MI 48073-1717

Phone: 248 637-0350

I can confirm if you just pluck the PKG out of the installer and have
Casper install it, any browser can be open. The update will get applied
the next time it is quit and relaunched.

Wow, Craig and Tom, you guys never cease to amaze...thanks for the nugget (re: extracting the package). We'll follow your lead the next time we need to push out Flash Player.

On the deployment method, I've been wrapped on the knuckles in the past for overwriting resources of applications that are active. Are we sure there's no chance of any kind of issue if we push the Flash Player plug-in to Mac Users who may have Safari open? For example, if the user hasn't yet visited a site that has Flash cr at p...er...stuff...on it, and we push out the Flash Player plug-in, and the user doesn't exit/relaunch Safari, are we sure the user won't get an error when they do visit one? I did a quick test and it looks like there wasn't an issue, but I want to make sure since we are trying to make this a non-intrusive, non-disruptive deployment.

Thanks,
Don

If you want to make it non-intrusive, non-disruptive, then do it at login or
logout. Yeah, I know, you can't force people to logout or login to their
computers. Then you can't be responsible for holes in Flash either. They
can have one or the other, not both. Either you are disruptive and require
the user to shut down their browser, or you require them to logout of their
machines.

If your client will adopt the policy of requiring machines to restart at
least once a week, maybe over the weekend, you can catch these logout/login
policies at that time.

Just my 2 coins...

Steve Wood
Director of IT
swood at integer.com

The Integer Group | 1999 Bryan St. | Ste. 1700 | Dallas, TX 75201
T 214.758.6813 | F 214.758.6901 | C 940.312.2475

I've never tested this enterprise wide, only on a few select clients and it worked every time. I would say it will most likely work, but of course you'll never know until you fully push it out. The user could be doing a certain combination of things that could cause issue. If this is the case, then maybe look at start up and log out policies. Or push it out with a message.

We send them to SelfService and include a warning that all browsers will be shut down prior to install.

Nick Caro Senior Desktop Support Administrator

You could push it with a message that has background off so the policy won't continue until they click the OK button.
--
Jared F. Nichols
Desktop Engineer, Client Services
Information Services Department
MIT Lincoln Laboratory
244 Wood Street
Lexington, Massachusetts 02420
781.981.5436

Preaching to the choir. :)
Steve Wood wrote:

Don

It's hard to get a pilot group with this client, lots of layers of approval to go through. Oh well, we'll continue with our custom trigger (install if the patent application is not active) for these kinds of deployments.

Thanks,
Don

Yep, Self Service is certainly one of (if not the) most efficient way to handle these kinds of things. It was one of the first change control tickets we submitted (Brook's Law).

Don