Jamf Nation Community

rcs336 · ‎11-20-2017

Hi Everyone,

Just did a fresh image on a brand new MacBook Pro with 10.13. I dont think I've had this issue in the past but the computer is asking for a password for the Temporary Adobe Install Account. Normally the computer will automatically log into the account and installs the applications. Any help would be appreciated.

-Ryan

kstrick · ‎11-20-2017

It's a known thing with 10.13... I think it's one of the reasons JAMF has recommending not using Casper Imaging for 10.13...
I'm pretty sure that 10.13 breaks legacy technics to automatically create auto-login accounts, due to certain changes in security.

rcs336 · ‎11-20-2017

Yikes. :( What is the best way to install multiple applications?

mike_paul · ‎11-21-2017

The computer should still be installing the software in the background at this stage and automatically reboot when its done with that. What happens if you just let the computer sit for a while during this? Its unfortunate that you do not have the visual prompts to know when its doing the install but it should still technically work. Let us know what happens when you just let it be for a while.

Chris_Hafner · ‎11-21-2017

I can verify that jamfPRO v10 will complete the install behind the scenes and reboot (At least in my test environment). I have to add my $0.02 here regarding Jamf Imaging...

Really? Now, no one from JAMF has asked me to stop using Jamf Imaging (Casper Imaging) though they have repeatedly tried telling me that imaging is going to be dead. That said, imaging is still critically necessary and jamf still offers a product which purports to manage it. Either the product is released and it should work as intended or it should not be released at all. Since they released it, with 10.13 support I'd hope that is not the case.

Until there's a way to completely reprovision machines (With guaranteed security) imaging will exist.

mike_paul · ‎11-27-2017

@Chris_Hafner Could you elaborate on your second paragraph because I'm not sure I am following?

Jamf Pro 10.0.0 does work at imaging 10.13 computers, albeit with the caveats that Apple has put in place (firmware and forked builds) and this known issue with the temp user not logging in. But the actual purpose of that temp user functionality is be able to install applications and scripts while booted to the target OS, which is still successful even without logging in.

alexjdale · ‎11-27-2017

Yep, I can confirm that the background operations still work as normal with 9.101. The packages and scripts will still install/run and the system will eventually reboot and everything will be fine.

Kumarasinghe · ‎11-27-2017

I hope JAMF is working on this. They need to update the adobeinstall password from SHA1.
Use this Script with Priority set to After at Imaging to get the account logged in as before.

#!/bin/sh

# With God everything is possible! Thank You Jesus!

#
# Created by Thusitha Kumarasinghe
# 09/11/2017
# v1.00
#

###########################################
/bin/cat << 'EOF' > "/private/tmp/adobeinstall.plist"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>HeimdalSRPKey</key>
    <array>
        <data>
        MIICK6CCAgQEggIAF7Lpzg/6wV++CLY6F+LeEsn2KCQdLoWBQ+Bgjw1hjLc1
        Po4mscCkNpXJYv2Juoo7OwaSw/BDhwUB+bq5RNZO4VxxosqbVFd4BJ0j++uU
        cw5s7J8FU6JMJ5PqYvbaf+R90TjFKAxhmKogRMUn4+3OlvC4LFwTGNqfYfFA
        GtkyttuASBufWfpttML9+aLds6jXhB/VBda2Nt/+GO9LztlC9pIaZcQidz9f
        VmgojQqrJpd/4m7LJRxvzKFtutW2qUP673/fMqOYlarDxoqd1gWxgR9GQ+DD
        axr9Zx7Prx4TKFPjpZBxnOurkESGC4T51fcm7gThE2z68cjdvybMNcapPba0
        ThGcBug5MeK3kCGSbJLoAwR3azEEqeFxbIKCK9BHrvo2Pa6p/6ybDFx4RYC6
        BPp0AUuLSa5R2qLIn4qFv51O196EqcjnQWjwgS9s9bzJPrFxdeuKMQ60zh/S
        tJxFy8K6PMGql/XN284oSXgkf/Zr3HRoh2AS+RKtrdwMv7JSSanNJf7deArW
        Vgan/aWa98d8c/SXJ+kN6WB3WKDETdpbdSUACgnQAzpFckRL85fSEbV5zUsK
        QLGIf/A/ExQLvWM8p1WAdil6gTmDM97vVwssVSRg2J0YPfshvhDPOlmoKTUg
        O672Auz+iWQOTxmnFQ/wpf4CbFXJTE899WbOSfKhITAfoAMCAQGhEgQQQIw0
        90iUzwKg928/95Yw8KIEAgIPoA==
        </data>
    </array>
    <key>KerberosKeys</key>
    <array>
        <data>
        MIIBY6EDAgEDoIIBWjCCAVYweKErMCmgAwIBEqEiBCDqugcSp/La/7t8itje
        nfUxkT7ADCPIyVB5YV0RF/DGeKJJMEegAwIBA6FABD5MS0RDOlNIQTEuNEYw
        QjUzQTYzMURCNkE5NUJDQjc0MkY5QTUzOEE4NDA3RjA5MjQyQ2Fkb2JlaW5z
        dGFsbDBooRswGaADAgERoRIEEEHp+8yM2d3eT54XGe9g8/CiSTBHoAMCAQOh
        QAQ+TEtEQzpTSEExLjRGMEI1M0E2MzFEQjZBOTVCQ0I3NDJGOUE1MzhBODQw
        N0YwOTI0MkNhZG9iZWluc3RhbGwwcKEjMCGgAwIBEKEaBBhSXSxbL1fTMdbs
        5hyoTKiiGRo4kbl5hkOiSTBHoAMCAQOhQAQ+TEtEQzpTSEExLjRGMEI1M0E2
        MzFEQjZBOTVCQ0I3NDJGOUE1MzhBODQwN0YwOTI0MkNhZG9iZWluc3RhbGw=
        </data>
    </array>
    <key>ShadowHashData</key>
    <array>
        <data>
        YnBsaXN0MDDSAQIDCl8QHlNSUC1SRkM1MDU0LTQwOTYtU0hBNTEyLVBCS0RG
        Ml8QFFNBTFRFRC1TSEE1MTItUEJLREYy0wQFBgcICVh2ZXJpZmllclRzYWx0
        Wml0ZXJhdGlvbnNPEQIA10wmCjGBVXe8uEZlGr4Gd7CkoVy4B3DMJsUwkycB
        5D/epGvVPSQ9wycJY5y45b4Xwlvni4s+c3n299kvYt9GQIP3GkwSX9pfaFc/
        6tHD6XJOXDkKdjgBOYSK/X7MPJKAKA+YUXJnBG4ivtMGjX3OIMrKdc0Dy/OQ
        wRibKFF7tRC7lrkTwqXNHr5WQgEecDa85Lskpbeimq1i6d3z8Q7WI/nXtn9Q
        Svh2bzItR7LtXfk7nbD/UeiSIpEYEjCYzXMfCjIhOuvpOG3ABkmE1PRjXpoV
        0iXg1PL8R1mfvrNayxas13l7eMeos0rjYRzAENC3vUO7sK1QA5veYRLsPdQ6
        70yrYxx49gMTt7E6EdqGkc7crxPjezw92WSw2K8s+PGDRdF1SecTGK22iLYH
        x6g9t3EisLE6bBS3kE/RXY1UZeTU0KHWxV+Wvdber2weksA3bS3QbKlJ+hLS
        RnOmXjwJYroXGC1p+ai7yJK8i5v/9z2Tgqqt9o7K+kmdnBLW+KIYrJyWtCuh
        2paf8EMKFhBV1Ofc2EUvRuEXJMamC7Jc/cMDSMlj8/fCpXM8bWdrSD3BnJcJ
        4+Umbn3kJ+UR8Zc6gCsyrBfzlDbtBKb3keJCK3kOPgZQUtsCVAjPrGXXslvy
        YqevSb1+nwDQ/WM0IUCqPyRj/DK/1qkysiKKOnLfbH9PECADVTQ2VTKoziUC
        9uKqHXoZ4aH4oiesQCTHbf6HA0SK5xHxINMLBQYMDQ5XZW50cm9weU8QgHNM
        ijFJytJE0ZgdU1K3jxWdB/YLrdPIpPuBQWg7t0Mu8j7CVX1AMrZvMf9ZzeLz
        1xGcroKXRuEofg8KXkXkaZ/VVhxNoSWu2RC5YQFaTun5LoXXD5PVXyGZUaha
        bcVVhNvytVwoh53iEwe4jgCFk+NHTILiL2JXuSkcIZtzAs3pTxAgWT1JydOV
        Iedl3uoqDYRkcEug4Pjmc2j0ec6ORmKTOZER9a0ACAANAC4ARQBMAFUAWgBl
        AmkCjAKPApYCngMhA0QAAAAAAAACAQAAAAAAAAAPAAAAAAAAAAAAAAAAAAAD
        Rw==
        </data>
    </array>
    <key>_writers_passwd</key>
    <array>
        <string>adobeinstall</string>
    </array>
    <key>accountPolicyData</key>
    <array>
        <data>
        PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NU
        WVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VO
        IiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4w
        LmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+Y3Jl
        YXRpb25UaW1lPC9rZXk+Cgk8cmVhbD4xNTEwNTM3NzAwLjI0NDIwNTwvcmVh
        bD4KCTxrZXk+ZmFpbGVkTG9naW5Db3VudDwva2V5PgoJPGludGVnZXI+MDwv
        aW50ZWdlcj4KCTxrZXk+ZmFpbGVkTG9naW5UaW1lc3RhbXA8L2tleT4KCTxp
        bnRlZ2VyPjA8L2ludGVnZXI+Cgk8a2V5PnBhc3N3b3JkTGFzdFNldFRpbWU8
        L2tleT4KCTxyZWFsPjE1MTA1Mzc3NjQuNzgzNzU1MTwvcmVhbD4KPC9kaWN0
        Pgo8L3BsaXN0Pgo=
        </data>
    </array>
    <key>authentication_authority</key>
    <array>
        <string>;ShadowHash;HASHLIST:&lt;SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2&gt;</string>
        <string>;Kerberosv5;;adobeinstall@LKDC:SHA1.4F0B53A631DB6A95BCB742F9A538A8407F09242C;LKDC:SHA1.4F0B53A631DB6A95BCB742F9A538A8407F09242C;</string>
    </array>
    <key>generateduid</key>
    <array>
        <string>D60B13AC-EB4F-4AC8-A3AF-64308D6B8798</string>
    </array>
    <key>gid</key>
    <array>
        <string>20</string>
    </array>
    <key>home</key>
    <array>
        <string>/private/var/adobeinstall</string>
    </array>
    <key>name</key>
    <array>
        <string>adobeinstall</string>
    </array>
    <key>realname</key>
    <array>
        <string>Temporary Adobe Install Account</string>
    </array>
    <key>record_daemon_version</key>
    <array>
        <string>4850000</string>
    </array>
    <key>shell</key>
    <array>
        <string>/sbin/nologin</string>
    </array>
    <key>uid</key>
    <array>
        <string>101</string>
    </array>
</dict>
</plist>
EOF
###########################################

#############################
/bin/cat << 'EOF' > "/private/tmp/kcpassword"
4Á!W≥–±ß¬Àk�Áe�‚’›çe–l,v
EOF
#############################



#############################################################
/bin/cat << 'EOF' > "/tmp/run_1013_fix_for_CasperImaging9.sh"
#!/bin/sh

tail -fn0 /private/tmp/CasperImagingTemporaryLog.txt | 
while read line ; do
        echo "$line" | grep "ByHost"
        if [ $? = 0 ]
        then
            # Copy the files to correct location
            cp "/private/tmp/adobeinstall.plist" "/Volumes/Macintosh HD/private/var/db/dslocal/nodes/Default/users/"
            cp "/private/tmp/kcpassword" "/Volumes/Macintosh HD/private/etc/"

            # Set the correct permissions
            /usr/sbin/chown root:wheel "/Volumes/Macintosh HD/private/var/db/dslocal/nodes/Default/users/adobeinstall.plist"
            /bin/chmod 600 "/Volumes/Macintosh HD/private/var/db/dslocal/nodes/Default/users/adobeinstall.plist"

            /usr/sbin/chown root:wheel "/Volumes/Macintosh HD/private/etc/kcpassword"
            /bin/chmod 600 "/Volumes/Macintosh HD/private/etc/kcpassword"
        fi
done
exit 0
EOF
#############################################################

/bin/chmod a+x "/private/tmp/run_1013_fix_for_CasperImaging9.sh"

/private/tmp/run_1013_fix_for_CasperImaging9.sh &

exit 0

Chris_Hafner · ‎11-28-2017

@mike.paul I had to re-read the whole post to make sure I didn't miss anything. I must have posted this before coffee and after a few heated imaging discussions. Additionally, I sounded like a huge jerk as well (possibly true anyways). JAMF Imaging does, in fact, work with 10.13 of course and yes, there are a number of Apple imposed limitations as you mention. Further, I love JAMF and everything I can do with this management suite. I'd hate to have anything here imply otherwise.

However, for clarification sake, both Apple and JAMF regularly seem to try guiding 'us' away from re-imaging machines in a process that's currently critical to how a number of institutions handle re-provisioning of devices. This issue with the Adobe temporary install user isn't listed in the known issues (http://docs.jamf.com/10.0.0/jamf-pro/release-notes/Known_Issues.html) which led me to a rather rude statement about not releasing software until it's ready as I had assumed that this was a tested feature. Obviously, it's a known issue in these forums and I do apologize for any who took away the connotation that imaging itself was broken and unsupported. To this end, I endeavor to think a little bit more before posting.

With all the extra time jamfPRO 10 took to develop (for good reason), it feels like there was a huge opportunity to work on the imaging process/application and I admit that I was a bit bummed that I didn't see much (on the outside) go into that application and process. Rather, it feels like "imaging' is lower on the radar than I'd like it to be and each new imaging 'issue' feels like a reinforcement of that.

What I'd love to see is JAMF Imaging develop to a point where no one has a reason to use other imaging utilities (NetRestore, etc)!

jmahlman · ‎11-28-2017

I'm glad someone else is as frustrated with the "end of imaging" as I am. I manage over 400 machines in a university (many of those aren't in DEP for various reasons) and they are all expected to have the same software and configurations. Right now, there is no real substitution for a good ol' image process to do that in a speedy method.

I'm fine moving away from imaging if there is a comparable method..but right now it's just not possible.

jmahlman · ‎11-28-2017

FYI, the script posted above by @Kumarasinghe works for me!

Thank you very much!

jmahlman · ‎12-15-2017

The jamf pro 10.1.0 documentation states that this issue was resolved ([PI-004383] Fixed an issued that caused the Adobe Temporary Install Account to not login automatically during the post-imaging process.)

Unfortunately, I'm still having the issue. I'm going to try to update my netboot set to see if that solves it.

Caleb_Anderson · ‎02-25-2018

Just came to add my experience - We do not install any adobe products during the imaging process, we have them all on Self Service. This happened to a student this morning, and I suspect the problem is when they are trying to install an adobe product from Self Service but the computer restarts part way through.

We are on 10.1.1 across all Jamf apps.

Kumarasinghe · ‎02-25-2018

@kingscollege This happens if you have packages marked for "Install on boot drive after imaging".
The Imaging process has a user called "adobeinstall" which logs in to macOS to finish installing those packages.

Installing packages through Self Service wouldn't trigger this.

Thanks

Jamf Nation Community

Computer doesnt Autologin to Temporary Adobe Install Account