Casper Suite 9.72

[jake]

Hi Everyone -

We have released 9.72 to address the issue with deploying packages with spaces in the name. You can download the latest version from your assets in JAMF Nation.

Thank you for your patience and please post to this thread or reach out to your TAM with any questions you may have.

[bentoms]

@jake thanks for the update & to the JAMFs that worked on it.

[davidacland]

That was quick! Thanks.

[RobertHammen]

Fingers crossed that this version fixes most of the known defects with 9.65/9.7/9.71 and doesn't add any showstopper defects of its own.

[cjatsbm]

Does this resolve the 9.7 issue imaging 10.10.3 machines with Core Storage?

[RobertHammen]

Test and we'll find out ;-)

[kstrick]

hoping it fixes the defect with imaging in 10.10.2+ and user passwords containing special characters

[LRZ_Jamf]

Wondering if there is 9.66 coming, since it's mentioned in the "Functionality Changes and Other Considerations" part of the Release Notes?
Aswell as I already told my Account Manager that the Change for 9.7 mentioned there now also applies for smart groups.

[rcorbin]

It would be interesting to hear how 9.72 is working for those that have upgraded. I'm still at 9.63.

[mm2270]

Same here, still on 9.63 and waiting to hear about experiences. So far the little I've seen on it is promising, in that its resolved several issues as well as no news is good news as far as new issues. But I'd like to hear about more positive experiences.
As with so many things on the internet, you often don't hear about everything just working, only when there are problems. :)

[dwenger]

Recently upgraded from 9.65 to 9.72 and haven't encountered any new issues so far.

[RobertHammen]

Updated to 9.72 and so far it's solid.
Did an imaging test - worked - but realized I forgot to update the Casper tools on my NBI to 9.72. Also, base OS in my test environment was 10.10.2 - so have updated both and just starting testing Imaging 10.10.3 with 9.72...

[rcorbin]

I have taken the plunge and upated to 9.72 from 9.63. All seems ok so far and the upgrade went well.

[RobertHammen]

Tested imaging a couple of machines:

Good news: 9.72 properly laid down the base OS and Recovery partition of an AutoDMG-created base OS.
Bad news: both systems I tested (old HD-based 13" MacBook Pro's) failed to fully enroll in the JSS - "Device Signature Errors" in the jamf.log, no config profiles on the Mac. Only thing which worked was the old "sudo jamf enroll -prompt". A QuickAdd that's part of the imaging workflow may be required to work around this. Not necessarily a new problem, I think @CasperSally saw this with her recent move to 9.65. Again, can probably work around this, but would really like to have an idea why this is happening...

Upgrading a client tomorrow (from 9.51), have trial-run the upgrade in a VM, so, will keep my fingers crossed.

--Robert

[CasperSally]

@RobertHammen We have to run a quick add (in combination with a enable ethernet adapter script and a 'wait for enrollment to complete' script) for enrollment to work with imaging with autorun data. No timeframe was given for a fix.

I've had various cert/enrollment type issues ever since enabling cert based communication to get config profiles working. I dread testing JSS updates to see what workarounds I'll have to do.

[RobertHammen]

Familiar with the script (networksetup -detectnewhardware) to enable USB and Thunderbolt Ethernet adapters. My test machines were the old-school 13" MBP's with integrated Ethernet, so I don't think that was the issue in my case. I've had to do the same with QuickAdds before to ensure profiles come down. Agree that this has been terribly inconsistent/flaky in the 9.6x and later versions. At least the QuickAdd workaround isn't painful....

[Josh_Smith]

Just a quick share about 9.72: There is a defect (D-008898) that can prevent SMB shares from mounting properly when using an AD service account to mount the share:

Symptom: The Mac client can mount the SMB DP successfully once per boot, but any subsequent mount attempts fail until after a reboot. This began after upgrading the JSS to 9.72 from 9.63. I didn't have any mounting issues with 9.63. Further testing indicated this is caused by a Kerberos Ticket, deleting the Kerberos ticket allowed the next policy to mount the share successfully. To delete all Kerberos tickets

kdestroy -a

Example: I boot the computer and run a simple Chrome installation policy from Self Service (or any trigger). The package installs successfully. If I try to run the Firefox policy or the Chrome policy again (or anything that requires mounting the SMB DP) the policy fails to mount the share and errors out.

I am using kdestroy to destroy the particular ticket by name, which seems to be working well for me:

kdestroy --credential=krbtgt/YOUR.DOMAIN.COM@YOUR.DOMAIN.COM

JAMF Support provided the below script/info, please note I haven't tested these commands. I haven't needed to manually unmount the share and I'm not interested in the MySQL commands to modify all of my policies so they delete all Kerberos tickets....that's not ideal since we are actually using Kerberos a bit.

If you need this workaround, you will need to run the Kerberos ticket script at the end of every policy that mounts a distribution point. Fortunately this is only in our stage environment....I'll wait until this is fixed to upgrade production!

1) Script to remove Kerberos ticket (only deletes tickets associated with your Casper Read account): (Replace "CasperRead" with whatever the read-only account for the share is.)

#!/bin/bash 

user="CasperRead" 

userKRBticket=`klist | grep $user | awk -F" " '{print $2}’` 

if [ ! -z $userKRBticket ]; then 
kdestroy -p $userKRBticket 
fi

2) Remove any mounts that are hanging on the client computer, after every policy is run:

sudo umount /Volumes/CasperShare*

3) Another option is to set the Files and Processes >> Execute Command on every policy to:

UPDATE policies SET run_command=“kdestroy -a; umount /Volumes/Caspershare*; sleep 60” WHERE policy_id IN (SELECT DISTINCT policy_id FROM policy_packages);

**This is how to unset it:

UPDATE policies SET run_command=“ ” WHERE policy_id IN (SELECT DISTINCT policy_id FROM policy_packages);

[andysemak]

JAMF just confirmed to me that D-008898 has been closed and verified on their system and will be implemented in the next release.

[Josh_Smith]

Awesome thanks @andysemak

[ocla__09]

I am now finding after the upgrade to 9.73 that I am unable to mount SMB distribution points with Casper Admin in order to sync them. We are using a directory service account to mount the shares.

running kdestroy -a does not seem to make a difference.

Could this also be related to the above defect? Are there any suggestions for getting around this?

[smcadmin]

Version 9.73 also having problems mounting SMB distribution points. Policy installs fail on 50% of the machines with inability to mount distribution point. Flush and re-trigger and they eventually all install.

Was trying to set up a second distribution point and cannot replicate in Casper Admin. Backup distribution point cannot be mounted.

In all cases I can mount them in the OS.

[smcadmin]

Duplicate