First user login...doesn't use "user template"

[ooshnoo]

Hey fellas...

As part of our DEP enrollment process, I have a DMG restore a the System/User Template directory during the policy that runs when JSS enrollment is complete.

The issue we're having is that every time the first user to log into the comptuer doesn't "see" or utilize the custom User Template we install. It just comes up with the default dock, desktop pictures, finder prefs, etc...

However each subsequent user that logs into the computer, everything works and looks fine. I can even delete the first user, log in again as that user and that works as it should as well.

Anyone ever seen this?

[ooshnoo]

Somebody!!!! Anybody!!!!

[stevewood]

@ooshnoo the first question I'd have is, why are you messing with the User Template folder under /System? Most admins will tell you to stay away from messing with that folder for two reasons: one you never know when Apple will update that folder, and two, you're asking for trouble. I know that was the method a few versions of OS ago for setting stuff as default, but it's no longer the preferred method.

Instead, I would look at what you are doing there and use Configuration Profiles or scripts to get the environment correct for your end users.

As for why you are seeing the behavior you explain, I would venture to guess that the preferences are being cached, as is the nature now since 10.10 (I believe). You could try a LaunchAgent that simply ran a script that killed cfprefsd so that it would restart and possibly give you the results you're looking for.

[ooshnoo]

Thanks for responding.

Just been doing it that way for years, and have never had a problem until now. Didn't really feel like reinventing the wheel if I didn't have to.

[stevewood]

@ooshnoo totally get that. I think all of us have things we've done forever and just don't want to change it. If it ain't broke...

With SIP and everything else Apple is doing, it's getting more difficult to not do things the Apple Approved Way. So, I'd look at reinventing the wheel, unfortunately.

[mbezzo]

FWIW, I do mess with it (and am willing to make changes if/when Apple does change things - it's been YEARS so I'm not too worried). I have a simple package for each of my customizations that just creates a plist (or whatever else) with the correct permissions instead of replacing the whole thing. Maybe that might work better than replacing the whole entire User Template folder?

I've been using the packages for years without issue.

Thanks,
Matt

[ooshnoo]

Thanks fellas...

a couple things...

1. I just tried a test config profile, and while it does work it doesn't seem to allowthe user to make changes to the Dock when applied as a computer profile. we don't like to use user profiles, but may have to at this point. will keep digging.

2. I've tried the package and DMG route as well when trying to iron this out lately, and it's all to no avail...nothing works for the very first user...only subsequent users. The ultimate problem with this is the fact that there is only one user per computer, so there will never be a second or third user that would ever log in.

[bentoms]

@ooshnoo Why not have Self Service open post DEP with a policy to set things or a post enrolment policy that sets things then prompts the user to logout?