Login window lock, mobile account creation....looking for advice

[spowell01]

Hello JAMFNation, we are pushing ahead with our image and are looking for some advice on the best way to accomplish these tasks:

(RESOLVED via blank package)
1. We need a lock on the login window, preferably with a notification to the user. It appears to take 2-3 minutes for the policies to take effect at the login window, I don't want people (us) trying to login before the machine is properly bound. The main thing is we want to be sure that while scripts and policies that are run/installed by the custom trigger we made after a reimage will complete without interruption. Spent about half the day messing with the jamfhelper only to find out it will not work at the login window with 10.7.3. Lovely. Anyone have a simple solution to lock the loginwindow?

(RESOLVED via Jamfhelper and blank package)
2. While the screen is locked, we would like it to autologin the default admin account, and then reboot. We think we need this to apply some user profiles that we want applied to everyone created in the JSS but we're unsure if the user profiles will need to be applied to each user as they log in. This ties into the questions we have about mobile accounts when applied through profiles.

(Still looking for a resolution to this one)
3. We need a better way to apply mobile accounts. Currently we built a user profile through the JSS, as mobility settings are only available when editing user profiles. The end result is that a user logs in the first time is a standard network user. The policy is applied and then the NEXT time that user logs in, they are given a mobile account. This is again on a user basis, and we need it to be computer based, unfortunately mobility settings aren't able to be managed via computers….

We appreciate any tips or advice to help us accomplish these 3 tasks.

[nextyoyoma]

As far as 1) and 2), jamfHelper will accomplish this. You have to make a blank package, then select the "This package must be installed to the boot volume at time of imaging." If you do this, it should run jamfhelper automatically, and then reboot when it is finished running all your startup scripts. It might be helpful to write your own AD binding script, though, because if you use the built-in AD binding script, it will not bind until after restart.

How were you calling jamfhelper.app? I don't see any discussions right off the bat that say there is a problem with it and 10.7.3. It definitely works in 10.7.4. If you use the method I described, the postinstall.sh script will automatically start it up for you at the login window.

As for 3), I'm sorry I can't offer any insight into this one. I'm new to AD binding!

[nessts]

seems like 1&2 have been answered
for 3 and the mobile accounts, if you are on lion look at the configuration profiles from lion server, that can make all accounts be forced to be mobile accounts.

if you know the username and password you can run
/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -p passwd

to create a mobile account for the user. we wrote an applescript to obtain the info from the user and create the mobile acct for them because most of our users are remote and have to run a vpn client before being able to login.

hope that helps

[rtrouton]

You don't need the -p flag to have createmobileaccount create a mobile account:

/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username

The command above will create the account, home folder and cache all needed attributes except for the account's password. The password attributes will be cached once the user logs in for the first time.

[mm2270]

Its true that jamfHelper will not work when a Mac is sitting at the login screen. If you call it while ssh'd into a Mac sitting at login for example, you'll get the PID returned. Looking up that PID in ps gives you a "Stopped" message.
This may be because jamfHelper is an app executable, not an actual binary. You can't run an app at the login window as far I know.

That said, I would agree with Charlie that combining the first 2 steps to have an auto login happen, then jamfHelper locking the screen while it completes may be the way to approach this. Though I'm not sure if an empty pkg is necessary. I think just designating the scripts to "Install on the boot volume" may be enough.

[spowell01]

Thanks for the quick responses, gonna try the suggestions now!

[rtrouton]

For example, you can use a script like this to automate the creation of a mobile account from a directory service (like AD or OD) and give it admin rights.

#!/bin/sh

#################################################
##  Create localadmin user on imaged machine   ##
#################################################

/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n localadmin


#################################################
##  Give the localadmin account admin rights   ##
#################################################

dscl . -append /Groups/admin GroupMembership localadmin

[nessts]

only if you don't need the password cached right away that is true. my remote users ssl vpn dies when the firstboot user logs out so they can login, so we need it.

and for question 1
if you do
launchctl unload /System/Library/LaunchDaemons/com.apple.loginwindow.plist

that will stop the loginwindow from displaying, you can then setup your autologin info, load the launchdaemon and the start jamfHelper

[spowell01]

Here is my issue with the mobile account creation. I went to our Lion test server and built a basic configuration profile for a device group. one payload which is mobility settings to create mobile account at login. Downoad it and upload to the JSS and I get this error:
An error occured while processing HTTPRequestAction 'EditOSXConfigurationProfile': java.lang.NullPointerException

[nextyoyoma]

@mm270-

You are correct about how jamfhelper accomplishes the lockout. I had not thought that through. However, I don't see another way to force a restart. Scripts do not have the option for "Install on the boot volume" through Casper Admin. You have to assign that option to a package. For convenience, I have an empty package that gets flagged this way so that I don't have to remember which package is set up this way. If there is a better way, however, I'm all for it.

[mm2270]

Yeah, you're right. Not sure why i thought that was available for scripts. Perhaps it was discussed as a feature request at one point, but its not present as of yet.
It can obviously be done since in an imaging workflow the first run script gets assigned to run after the reboot. it just isn't available with normal scripts uploaded to Casper Admin.

[wbarnes01]

@nextyoyoma

Thanks! I'm working with spowell and the blank package is working great for launching jamfHelper while our scripts run. We were trying to call jamfHelper with a script we had running at Reboot in our configuration. But as pointed out jamfHelper doesn't launch at the login screen and we were at a loss.

So, 1 and 2 are taken care of. Thanks!

[stevewood]

I know that question 1 is already answered, but I did want to mention a second way to accomplish this. We had the same discussion on the list/site back in November:

https://jamfnation.jamfsoftware.com/discussion.html?id=24

Justin Sako gave an example of utilizing a LaunchAgent to cover the loginwindow. I tested it then on 10.6 and 10.7 and it worked fine. I just tested again on 10.7.3 and it still works.

So, you can use a LaunchAgent with jamfHelper to lock the screen with a message.

[spowell01]

Thanks for the repys. Justin was actually our jumpstart tech! His scripts look really nice, but complicated and we really don't have much experience with them. We ended up going with the blank package route and are very pleased with the resulting locked window/message.

We are still looking for a way to deploy mobility settings that will force mobile account creation at FIRST login. All we've been able to get is a profile that installs after first login, which requires a second login to get the mobile account. Maybe this is one of the only settings we will have to continue managing via MCX.

[sean]

What is the connection of your home accounts, afp, nfs or smb and how are you mounting them?
Are you bound to Directory Service and if so, which, AD, OD or OpenLDAP?