Imaging randomly skips first-run and goes to iCloud until reboot

[jmahlman]

Okay, this has been frustrating us for the last few weeks and we're completely perplexed by this.

Imaging hundreds of macs around campus (mainly iMacs, but some Mac Pros and now some MacBook Pros..all of various ages). We've been testing our 10.11.x configurations for months and didn't experience this in testing at all:

• Boot machines to netboot server (either manually or via policy, the issues has happened both times now)
• Machines typically have autorun info set to wipe drives and lay fresh data down (we have found this to happen without autorun set)
• Machines begin imaging and go to reboot to complete package installations
• Most machines reboot fine into the first-run dialog but a good deal of machines reboot to iCloud login prompt with the user '_mbsetup' logged in
  • This happens randomly, it seems age and type of machine doesn't matter (it's happened on 2009 and 2013 iMacs and 2012 Macbooks)
  • So far we've only seen it with 2 of our configs, the ones with the most packages installing at first-run
  • Rebooting the system once will cause the first-run dialog to come up and it will continue

Even though we were not seeing this occur on test machines over the summer I was finally able to get one of my test systems to do it after I imaged it over and over again. Yet again, it seems completely random..I've imaged the same system 10 times in two days and it's only happened twice. Logs do not show anything odd as far as I can see (I'll try to pull a log when it does it again).

Anyone else seeing this issue or experienced it before? If so, have you figured out how to solve it? This is driving us crazy.

[davidacland · Accepted solution]

It's a bit basic as it's hardcoded to "Macintosh HD" and 10.11.6, but can of course be adapted if necessary:

#!/bin/sh

# Disable iCloud for logging in users
sw_vers="10.11.6"
sw_build="15G31"

for USER_TEMPLATE in "/Volumes/Macintosh HD/System/Library/User Template"/*
    do
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudSetup -bool TRUE
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant GestureMovieSeen none
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenCloudProductVersion "${sw_vers}"
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenBuddyBuildVersion "${sw_build}"
    done

exit 0

[davidacland]

We've had that a few times on a 10.11.6 deployment recently. It seemed, given enough time, the Macs rebooted and finished the image workflow.

We normally use a first boot script or custom config profile to stop the iCloud setup screen, but it's probably not applying quickly enough in every case.

We tried the new 9.93 config profile option to block the iCloud setup screen but it was the same.

In the end, we put the iCloud setup block code into a script to run while still net booted, hardcoded to write to the correct location in the target drive. That meant the necessary setting was there straight after the OS image and before it rebooted.

[jmahlman]

Our machines never rebooted (some sat for days) so we manually had to do it because ARD and SSH are not active in that state :(

Would you be able to share how you implemented your fix?

[davidacland · Accepted solution]

It's a bit basic as it's hardcoded to "Macintosh HD" and 10.11.6, but can of course be adapted if necessary:

#!/bin/sh

# Disable iCloud for logging in users
sw_vers="10.11.6"
sw_build="15G31"

for USER_TEMPLATE in "/Volumes/Macintosh HD/System/Library/User Template"/*
    do
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudSetup -bool TRUE
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant GestureMovieSeen none
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenCloudProductVersion "${sw_vers}"
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenBuddyBuildVersion "${sw_build}"
    done

exit 0

[jmahlman]

I forgot to mention that we use AutoDMG to make our base image..so not sure if I can use this script unless I go back to making images from scratch...

[davidacland]

We use autoDMG as well. The script is run by Casper Imaging just after the image has been laid down, but before the first reboot so would be ok.

[rtrouton]

I've got a script similar to @davidacland for suppressing iCloud. I have a post on how I used it to set up a Casper policy to suppress the iCloud pop-up window from appearing:

https://derflounder.wordpress.com/2014/11/18/automatically-suppressing-the-icloud-and-diagnostics-po...

[jmahlman]

Thanks for sharing these. @rtrouton, does this work with 10.11? The comments on your post claim it may not?

[mpermann]

@jmahlman I've run into this problem sporadically over many different versions of Casper. I've reported it to my TAM and they ultimately filed a product issue (PI-000081) for it. You might talk with your TAM and reference that product issue to see if your case is the same as mine. The problem ultimately has to do with the JAMF helper window not appearing when the computer is booted into the temporary adobeinstall account while it is finishing the imaging process. If you have packages set for "Install on boot drive after imaging" set on the package options in Casper Admin you may run into this problem. Sometimes, but not always, if I leave the systems alone they will complete imaging and reboot properly. There are times though where the systems have never finished and I just had to re-image the systems.

[jmahlman]

That sounds very much like the issue we're having, but I'm wondering if it's because the iCloud prompt is coming before jamfhelper.

Also, since these are just plist files being edited, can I pull them from a system that's already done and just package them up into a DMG and FUT and FEU?

[mpermann]

If I remember correctly, there may have been a launch agent/daemon that wasn't loading correctly when I ran into this. I think if you look in the log files you might see something similar. The problem is we could never figure out whey they weren't loading properly and putting up the JAMF Helper window. If you click your way past the setup assistant and get to the desktop what user does it show you are logged in as and if you open the Console application and watch the jamf.log file do you see it processing any of your first run stuff?

[jmahlman]

The jamf.log doesn't show any anomalies...I'll have to find one to grab when imaging fails again :D

Whenever we click through the process it's logged in as _mbsetupuser.

[mpermann]

I haven't had this happen in a while so I can't remember if the username for the account I dropped into was _mbsetupuser or not. It's possible we might not be seeing the same issue.

[jmahlman]

Okay, got it to happen again. I added @rtrouton's script to my config (running "after" not "at-reboot") and it just booted to the icloud screen. I skipped adding the account and i'm now logged in as the temp adobe user.

Looking at the jamf.log, the first-run script is indeed going (software is installing) but the jamfhelper did not pop-up.

So frustrating.

[mpermann]

That is more like what I've seen happen to me. I have Rich's script in my configuration but it's set for at reboot. Likely if you would have left that computer sit at the iCloud screen it would have finished the first boot imaging and eventually rebooted to a login window. The other other instance where the _mbsetupuser account is the one running may be the one that would never complete. I'm not sure what is causing the _mbsetupuser to interfere with the imaging process.

[davidacland]

Rich's script runs on the boot drive so needs to be set at reboot. The issue is there are times when the imaging process doesn't run the script soon enough, and the iCloud screen appears.

That's the main reason we carved that bit out, hard coded it to /Volumes/Macintosh HD and set it to run "after" so it is while it is still netbooted.

[jmahlman]

Ah ok, makes sense.

I just grabbed the plist and dropped it into a DMG and i'm trying that method right now.

[jmahlman · Accepted solution]

Dropping ~/Library/Preferences/com.apple.SetupAssistant in a DMG and setting FUT and FEU (basically the same as @davidacland's method but not scripted, seems to be working so far.

Hopefully it works for good! Now to tackle the next problem!

Thanks for all of the help, gang.