Configuration Profiles (Am i missing something?)

[m_higgins]

Is there any way to get casper to push down a configuration profile to a user when they log into a managed machine, and then for that policy to be removed once they log out?

[tuinte]

Might be easier to come up with a solution if you give us an indication as to what you're trying to do.

Some ideas, though:

Presumably you don't want the profile applied to all users that might login (or you wouldn't mind the profile being set permanently). You can scope User Level profiles to groups in AD so it only applied to those users.

If it's a Restrictions payload (greying out system prefs) you're trying to avoid when logging in yourself, you can use a Login Window profile with "Computer administrators may refresh or disable management" checked that will allow you to disable those restrictions when logging in as an administrator (hold Option while logging in).

Another option is to download the profile from the JSS (there's a Download button), packaging it, and installing it via a script at login and uninstalling it at logout. Commands to install/uninstall a profile:

profiles -I -F /path/to/profile.mobileconfig

profiles -R -F /path/to/profile.mobileconfig

[m_higgins]

Wow, ok, seems like a long way around for things.

Basically we currently have our managed machines on 10.9.5 and they are all managed using Open Directory and Workgroup manager.

We are moving to AD for our authentication and upgrading to yosemite, as far as im aware, Workgroup manager is not compatible with 10.10

So we are trying to copy our setup from workgroup manager using casper, things like the dock icons, system preferences restrictions. but each year group has a different set of settings

Workgroup manager coped with it very well, cant seem to find a good way to mimic it though