Best practices for smart groups to differentiate users?

[djf3188]

Hi everyone,

We're new to Casper and are trying to figure out the best way to address a few issues.

We have a select number of machines that are "presentation laptops" that we want to loosen up energy saver settings on, but keep the majority of our machines on a normal energy saver policy. Ideally, I'm thinking of having a static group for the presentation laptops, then a smart group containing all machines less the presentation laptops static group. Unfortunately, I'm not seeing any options within smart group creation to handle this.

I was thinking we could achieve this by setting the machines to a particular building or department and going off of that, but we have some other items that may conflict with this (i.e. policies to install printers / set time zone based on the building, running other scripts based on department).

Any ideas/suggestions?

[jarednichols]

You can do this two ways, as I see it:

1. Extension Attribute. Define they system type and then scope a smart group off of that.
2. The Miles Leacy Special a.k.a. The Dummy Package. Basically, lay down a fake package in /Library/Application Support/JAMF/Receipts. When a recon grabs the contents of it, it will show up as packages installed by The Casper Suite. You can scope a smart group off of this.

For instance, as part of your imaging process, you could have a script that fires off

touch /Library/Application Support/JAMF/Receipts/Presentation Configuration 1.0.pkg

Scope your smart group off of the presence of this package receipt. Follow?

[djf3188]

Thanks Jared. Option 2 sounds like it may be our best method, as we've had to temporarily put machines into that "presentation mode" in the past.

It sounds like we'll basically need to lay down a fake package onto every machine initially (e.g. PowerSettings.pkg), then have a policy that deletes that PowerSettings.pkg and dumps a fake PresentationSettings.pkg onto the machine, then runs inventory. We can then create a smart group for each of the fake packages.

Am I understanding that correctly?

[jarednichols]

Okay, so in better understanding your needs, the "presentation mode" is more of a temporary thing? These aren't dedicated machines?

[djf3188]

Some are, some aren't. We have a small pool of laptops specifically used for presentations that have screen saver disabled and power settings basically set to everything always on. At times we may need to put another machine into this mode if a machine is being used as a temporary presentation computer.

Based on your info, I think I have a working model.

I have two smart groups setup, one for presentation, one for non-presentation; each keying off of a different package receipt.

I have a run once per computer policy in place to deploy the non-presentation package receipt to the computers, at which point they'll get the appropriate energy saver / screen saver settings based on their membership of that group.

I can then run another script against a machine that essentially deletes the "non-presentation" package receipt and adds a new package receipt, then runs inventory. The machine should then fall out of the one smart group, into the other smart group, then get its presentation mode policies.

[stevewood · Accepted solution]

Since "presentation" is the exception to your standard systems, you really don't need two sets of receipts, just the one for "presentation". And if I remember correctly, you don't actually have to install a package, you can actually just "touch" a file in that directory to cause the JSS to see it as installed by Casper:

- Create a policy that has this in the Run Command portion: ```
touch "/Library/Application Support/JAMF/Receipts/presentation.pkg"
```

- make sure that policy also does an inventory
- Create a SmartGroup that looks for the existence of that receipt.
- Apply your settings

If you need to remove a device, all you have to do is then remove that file and run inventory. No need to lay down another receipt.

You then create another SmartGroup that is scoped to everything NOT IN the presentation group.

[mm2270]

What Steve said. One receipt should take care of both groups for you. You're basically looking for the existence or non-existence of that receipt in your respective Smart Groups.
Then apply the groups as appropriate to different Managed Preference Profiles to apply settings.

[djf3188]

Thanks guys!

[mike_paul]

Another method to accomplish this would be with an extension attribute (JSS->Settings->Inventory Collection Preferences->Add Extension Attribute) with an input type of "Popup Menu" and then add a value of "Presentation". For the purposes of this we can name the extension attribute "Presentation Laptops".

Then if you go into Settings->Inventory Options->Inventory Display Options-> and choose where you like like to have Extension Attribute displayed in the computers details record, for example "Computer Information".

Then create a smart group based on having the extension attribute and click the little ellipses icon (three dots) and choose the value you defined prior.

Then you can go to your smart computer group for your energy efficiency and set it to Presentation Laptops "is" and leave the value blank. So this will look for computers that dont have a value set for that extension attribute. Now keep in mind, this group will remain empty until all your machines submit an inventory report so the JSS knows these computers have a blank value for that EA. It might seem a little odd since this value is not set by an inventory report but by a drop down option, but that is how this works.

Then search for one of your computers that you want to be a presentation laptop and go into the device record. Within there, click the ellipse in the top right and choose "Presentation" from the drop down menu. This will automatically add the computer to that smart group for Presentation Laptops. To take it out of that group click the ellipse again and just select the default option of "Choose". Then making a computer a presentation laptop just requires changing the drop down.

But I guess another question is how are you enforcing your energy settings? If its via MCX it would still require either a login or a reboot depending if its User Level or System Level. If its Configuration Profiles these should push out right awy.

Hope this helps and is not too long winded.