Issues with some managed prefs

[Kedgar]

Hello,

I'm having issues pushing some user-level managed prefs. For instance
~/Library/Preferences/com.apple.digihub.plist which controls the Disc
insertion action. First, I am unable to upload the setting in Managed
Preferences even after converting to xml. If I try to create the setting
manually, I have problems setting the domain...

This domain setting issue is wierd... If I go under Definition and select
either User Level or User Managed Level, the domain on the general tab still
shows /Library/Preferences/. If I keep clicking around, it eventually shows
~/Library/Preferences/ but not when the correct settings are selected. If I
select both User and User Managed levels, unselect them, then select
computer level and switch to the general tab it shows ~/Library/Preferences
as the domian. However if I switch tabs, it then reports the domain as
being /Library/Preferences again.

Sorry if this is confusing... it is to me too. I may just package up the
preference and push it using a seperate policy, but I'd like to use MCX as
much as possible for plist values.

Thank you,
Ken

[talkingmoose]

When creating a new setting, I've learned to simply enable all three options
On 12/1/09 10:38 AM, "ken edgar" <ken.edgar at gmail.com> wrote:
under the Definition section of a new setting. I set:

User Level: Allowed User Managed Level: Allowed Computer Level: Allowed

When I switch back to the General section, I can select any of the four
options under Apply Setting To:

User Level Enforced User Level At Every Login User Level At Next Login Only System Level Enforced

This also allows you to change any of the four User/System levels in the
General section at any later time, even when you can't go back and change
the User/Computer levels under the Definition section.

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[Kedgar]

Thanks William, I will give that a shot today!

[Kedgar]

I tried this today, however a lot of my policies are still not working. For example I'm setting mcx for com.apple.digihub.

If I execute sudo /usr/sbin/jamf mcx -verbose I see a lot of policies that show "Is not Union Policy" and "Has not ben applied to Union Policy"

I see nothing for my com.apple.digihub policies in this list. If I do a mcxquery, only a few of my policies seem to be applied.

[talkingmoose]

When I've had problems with only a few and not all MCX preferences getting
On 12/2/09 10:32 AM, "Edgar, Ken" <ken.edgar at gmail.com> wrote:
applied, the culprit has usually been a malformed setting that I've created.

I can only suggest narrowing down to the policy/policies causing the problem
by using the divide-and-conquer method. Enable half, see if those work. If
not, disable half and continue. Some require a reboot. Others don't. I
always reboot between tests, just in case.

What setting are you trying to manipulate for the com.apple.digihub? Are you
setting just one key or are you applying an array using the manual approach?

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[Kedgar]

As far as what I'm trying to do with com.apple.digihub; I'm trying to set ignore to all optical media insertion. I have one mcx setting for each key in the file. An example of the plist file should look similar to this below:

<dict> <key>com.apple.digihub.blank.cd.appeared</key> <dict> <key>action</key> <integer>1</integer> </dict> <key>com.apple.digihub.blank.dvd.appeared</key> <dict> <key>action</key> <integer>1</integer> </dict>
</dict>

So my Managed preference in Casper looks like this for com.apple.digihub.blank.cd.appeared: Apply Setting to: User Level Enforced Domain: ~/Library/Preferences/com.apple.digihub Key: com.apple.digihub.blank.cd.apeared Value (enter manually value or dictionary) <key>action</key> <integer>1</integer>

If I force the mcx to update using /usr/sbin/jamf mcx -verbose I only see these policies if I set them as System Level Enforced. They don't work though at that level.

thanks,
Ken

[talkingmoose]

Looks like you want to ignore blank CDs and DVDs. Is this the company policy
On 12/2/09 3:43 PM, "Edgar, Ken" <ken.edgar at gmail.com> wrote:
you're trying to enforce? Do you want to prevent disc burning altogether or
just prevent it in the Finder (Disk Utility burning is probably still
possible) with the above MCX setting?

To disable disc burning I use the following:

com.apple.DiscRecording

Name: Burn support Apply To: System Level Enforced Key Name: BurnSupport Type: string Value: authenticate

This prevents all but administrators from being able to burn CDs and DVDs.
You can probably use "deny" to prevent everyone from burning.

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[Kedgar]

Not looking to disable burning, just automatic opening of discs. For instance when you insert a disc... I want the computer to mount it as normal, but not do anything further than that.

[Kedgar]

Ok, it looks like the problem is with my manually set preferences. For some reason whenever I activate any of the prefs I have manually created mcx for most everything stops working. If I run "dscl . mcxread /Computers/localhost" with my manual settings applied I receive:

XML parser error: Found non-key inside <dict> at line 47
Old-style plist parser error: Malformed data byte group at line 1; invalid hex

As soon as I disable a manual setting and refresh mcx (/usr/sbin/jamf mcx -verbose) all the settings start working again and I can run that dscl mcxread command.

Back to the drawing board! Has anyone had experience with creating thier own managed preference setting on the JSS? I'd like to know what they look like.

Thank you,
Ken

[talkingmoose]

Not sure if you're still having problems with the mounting or not, but I've
On 12/3/09 12:27 PM, "Edgar, Ken" <ken.edgar at gmail.com> wrote:
been able to get this to work in my MCX setup.

Domain: com.apple.digihub Name: Insert blank CD options Apply To: User Level Enforced Key Name: com.apple.digihub.blank.cd.appeared Type: manual Value: <dict> <key>action</key> <integer>1</integer> </dict>

and

Domain: com.apple.digihub Name: Insert blank DVD options Apply To: User Level Enforced Key Name: com.apple.digihub.blank.dvd.appeared Type: manual Value: <dict> <key>action</key> <integer>1</integer> </dict>

When I go to Apple menu --> System Preferences... --> CDs & DVDs, I see
"Ignore" for both blank CDs and DVDs. If I attempt to change them to
something else, they snap back to "Ignore".

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[Kedgar]

Thanks! I will give this a shot tomorrow. I could have sworn that I tried this exact way before. It is possible that another manual setting could have munged it up. Thanks again for everyone's help!

[Kedgar]

Thank you very much... this worked! I guess the moral of the story is if your MCX setting isn't working, check all your manually created ones... it may not be caused by the one you think.