Deploying OS X 10.8 (Mountain Lion) with Self Service

[david_yenzer]

We are attempting to create a package in Self Service to allow a user to upgrade to Mountain Lion (from Lion). I've got the script and Mtn Lion package working to the point where it works to upgrade to Mtn Lion just fine except once it's up and running I find that the machine has lost its JAMF/Self Service connection - it now requires an admin username/password to install something from Self Service. Previously any user could launch an item in Self Service without an admin UN/PW. Also, I cannot then force install a package onto a machine, which also makes me think the connection is broken. When I reboot I no longer get the "checking for updates" message either. It also appears that our hidden admin user does not exist/work on the machine.

If I then run the QuickAdd package locally, everything is fixed - however, I would prefer this be a smooth process that doesn't involve running anything after the upgrade to Mtn Lion.

Any ideas on what I'm doing wrong or what might resolve this issue? Thanks!

Note: I used the info at https://jamfnation.jamfsoftware.com/article.html?id=173 as reference, using Scenario 2.

[rtrouton · Accepted solution]

The problem you're running into is that your hidden user account is being removed as part of the upgrade. I have a post on this here:

http://derflounder.wordpress.com/2012/01/04/hidden-users-with-hidden-home-folders-not-migrated-when-...

Instead of using JAMF's method, you may want to use Greg Neagle's createOSXInstallPKG:

http://managingosx.wordpress.com/2012/07/25/son-of-installlion-pkg/

If you go that route, you can also use my First Boot Package Install.pkg to automatically re-install the QuickAdd as part of the installation:

http://derflounder.wordpress.com/2013/05/13/first-boot-package-install-pkg/

[jhbush]

+1 for Rich and Greg's method. It's much easier to automate using both of those pieces.

[johnnasset]

We've used Greg's method to successfully upgrade users from 10.6.8 with supported hardware. The self-service policy doesn't become active until the user has connected to ethernet and cached the necessary files. After that, it's about a 30 minute upgrade.

[david_yenzer]

Thanks Rich! I'm giving it a shot right now.

[dgreening]

The way I handle this is as follows:

1. Create a static group of machines to upgrade.
2. Cache the 10.8 installer package with a pop-up directing users to Self Service when the package is successfully cached targeted to the static upgrade group.
3. Have a Self Service initiated policy that elevates the UID of our two hidden admin accounts to above 500, and kicks off the 10.8 install, which the users walk through to complete.
4. Once the machine recons in as being upgraded to 10.8, a script runs to correct the elevated UIDs for our hidden admin accounts. This is based on a smart group with the following criteria: OS is 10.8, Packages Installed by Casper has "Install OS X Mountain Lion.dmg".
5. I have an additional policy which will routinely bug users who have no initiated the upgrade via a pop-up. This is based on a Smart Group with the following criteria: OS is not 10.8, Packages Installed by Casper has "Install OS X Mountain Lion.dmg".

This works like a charm for me.

UID elevation/10.8 install kickoff script:

#!/bin/sh

### Change BPS Admin accounts UID ###
dscl . -change /Users/admin UniqueID 499 504
dscl . -change /Users/helpdeskard UniqueID 498 505

### Install Mtn Lion ###
/Users/Shared/Install OS X Mountain Lion.app/Contents/MacOS/Install OS X Mountain Lion&

UID fix script:

#!/bin/sh

### Change BPS Admin accounts UID ###
dscl . -change /Users/admin UniqueID 504 499
dscl . -change /Users/helpdeskard UniqueID 505 498

[david_yenzer]

I procrastinated because at first glance this looked extremely complicated. For anyone that feels the same way, just sit down and start reading - I spent more time overviewing the whole thing than about the 10 minutes it took to actually do it.

I first attempted to use Greg Neagle's createOSXInstallPKG instructions along with his instructions to combine the QuickAdd package and that failed (it succeeded to create the package and did update it to Mtn Lion, but did not fix the broken Self Svc/AdminAccount issue). However, once I used Rich's instructions with the First Boot Package Install.pkg to include the QuickAdd package and then did that piece in Greg's instructions to combine the package, it worked as expected to upgrade Mtn Lion and allow Self Service/AdminAccount to work. I will test some more but am now hopeful that this issue is resolved.

Thanks again Rich!

[ImAMacGuy]

this is something I tried in the past, but found it only worked about 10% of the time. The remainder of the systems would do the multi-language screen of death. But for some reason, I could never reproduce the error in the lab, only when the end users initiated it.

With the imminent release of 10.9 I'm going to need to look into this more.

I'm curious, what apps y'all are putting into the firstboot package from Rich. The quickadd packages don't work like they used to, they are more of an enrollment type thing. I had to use the CreateUserPkg from the AppStore/InstaDMG to create local accounts.

[rtrouton]

@jwojda,

If you create your QuickAdd with Recon, it should add your hidden user back if needed. I've noticed that the QuickAdd generated by the JSS's enrollment page doesn't add back the hidden user.

[david_yenzer]

I've only had time for one test so far (the process to create the package is quick but the process to update to Mtn Lion takes at least an hour). I will test some more before I call this a full success, but I'm hoping this is our solution.

[ImAMacGuy]

I was having trouble with installing it, it would always say complete, but the OS was untouched. I found another post talking about to use Current Startup Disk (no bless) and when I set that, I get the following..

Sending Wake On LAN command... Opening SSH Connection to 10.26.113.205... Authenticating... Successfully authenticated. Verifying Computer's Identity... The MAC Address has been verified. Checking Operating System Version... Running Mac OS X 10.7.4 (11E53) Verifying /usr/sbin/jamf... /usr/sbin/jamf is current (8.71) Verifying /usr/sbin/jamfvnc... /usr/sbin/jamfvnc does not exist. Verifying /Library/Preferences/com.jamfsoftware.jamf.plist... Preparing Policy... Executing Policy 2013-08-01 at 11:24 AM | jwojda | 1 Computer... Mounting afp://<server>/CasperShare to /Volumes/CasperShare... Copying InstallOSX_10.8.4_12E55_custom.pkg... Installing InstallOSX_10.8.4_12E55_custom.pkg... Installing InstallOSX_10.8.4_12E55_custom.pkg... Installing InstallOSX_10.8.4_12E55_custom.pkg... Installation failed. The installer reported: installer: Package name is OS X installer: Upgrading at base path / installer:PHASE:Preparing for installation… installer:PHASE:Preparing the disk… installer:PHASE:Preparing OS X… installer:PHASE:Waiting for other installations to complete… installer:PHASE:Configuring the installation… installer:STATUS: installer:%97.750000 installer: The upgrade failed (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.) Unmounting file server... Creating Reboot Script... Submitting log to https://<server>//... Finished.

<Edit: Fixed spelling errors>

[rtrouton]

@jwojda,

Have you tried running the package outside of Casper? You should be able to take it to a Mac and run the installer directly by double-cllcking on it.

If it still fails then, I'd re-make the installer package.

[shakim]

Hey jwojda, I was having the same issue as you. However, 1. My package worked when manually installing it.
2. It did not work from SelfService. But I had the "Reboot Immediately" option set to "Reboot to "Current Startup Disk"
2a. Changing the "Reboot To: Currently Selected Startup Disk -no bless" Resolved my issue.

[ImAMacGuy]

It seems to be working more or less, had to redo the firstboot package a couple times with some tweaks. The only thing I can't seem to get working is to enable the screensaver password. I'm trying to avoid doing an MCX because occasionally there is a need to disable it (presentations).

[shakim]

I'm currently experiencing one issue and that is my "QuickAdd" package keeps on failing. I tried re-creating another QuickAdd package and it still fails. Any ideas ??

[shakim]

Here is the installer log entry:
13]: Notifying system of updated components
Aug 6 12:43:07 localhost OSInstaller[313]: Set authorization level to root for session
Aug 6 12:43:07 localhost OSInstaller[313]: Package file://localhost/Volumes/Mac%20OS%20X%20Install%20DVD/Packages/QuickAdd_AMER8.6.pkg not supported by PK
Aug 6 12:43:07 localhost OSInstaller[313]: Will use IF session
Aug 6 12:43:07 localhost Unknown[293]: 2013-08-06 12:43:07.290 OS X Installer[313:b403] Package /Volumes/Mac OS X Install DVD/Packages/QuickAdd_8.6.pkg uses a deprecated pre-10.2 format (or uses a newer format but is invalid).
Aug 6 12:43:07 localhost OSInstaller[313]: Starting installation:
Aug 6 12:43:07 localhost OSInstaller[313]: Configuring volume "Macintosh HD"
Aug 6 12:43:07 localhost OSInstaller[313]: Preparing disk for local booted OS Install.
Aug 6 12:43:07 localhost OSInstaller[313]: Preparing disk for local booted install.
Aug 6 12:43:07 localhost OSInstaller[313]: Free space on "Macintosh HD": 49.58 GB (49579495424 bytes).
Aug 6 12:43:07 localhost OSInstaller[313]: Create temporary directory "/Volumes/Image Volume/Install.313rVZbn0"
Aug 6 12:43:07 localhost OSInstaller[313]: Processing QuickAdd_8.6:
Aug 6 12:43:07 localhost OSInstaller[313]: Determining files to install
Aug 6 12:43:07 localhost OSInstaller[313]: It took 0.00 seconds to create the install plan for QuickAdd_8.6.
Aug 6 12:43:07 localhost OSInstaller[313]: Configuring deferred files
Aug 6 12:43:07 localhost OSInstaller[313]: Assembling temporary receipt
Aug 6 12:43:07 localhost OSInstaller[313]: Performing pre-extraction actions
Aug 6 12:43:07 localhost OSInstaller[313]: Creating destination path
Aug 6 12:43:07 localhost OSInstaller[313]: Validating package payload
Aug 6 12:43:07 localhost OSInstaller[313]: Starting file extraction
Aug 6 12:43:07 localhost pkgExtractor[2421]: Extracting...
Aug 6 12:43:07 localhost pkgExtractor[2421]: BomFatalError - cpio read error: bad file format
Aug 6 12:43:07 localhost pkgExtractor[2421]: Package Authoring Error: Package "QuickAdd_8.6.pkg" is using a deprecated archive format. Running in compatibility mode.
Aug 6 12:43:07 localhost runner[317]: pkgExtractor[2421]: pax: could not exec gzip: No such file or directory
Aug 6 12:43:07 localhost runner[317]: pkgExtractor[2421]: pax: End of archive volume 1 reached
Aug 6 12:43:07 localhost runner[317]: pkgExtractor[2421]: pax: Sorry, unable to determine archive format.
Aug 6 12:43:08 localhost pkgExtractor[2421]: 0 of 0 files written in 0.14 seconds.
Aug 6 12:43:08 localhost pkgExtractor[2421]: 0 kilobytes installed at 0.0 MB/s.