MCX question

Hi Folks -

While troubleshooting why some MCX I set in JSS is not getting applied, I ran `sudo jamf mcx` and noticed some errors:
Parsing MCX Data...
Creating Shadow account for ...
Applying Managed Preferences ...
Error: Import of Managed Preference Setting "Disable Airport" failed.
Error: Import of Managed Preference Setting "Require Admin for Airport Power Change" failed.
Recompositing MCX settings for localhost
Deleting shadow account for ...

Any suggestions on where to look why I am getting these errors?

Thanks!
Adil

We just started having this problem again too and we are working with JAMF support on it. If anyone has any advice, I'd love some tips. We get it on random machines at random times.

Just a thought here guys and gals...

Has anyone tried just using composer to push out MCX files to
/Library/Managed Preferences? You could capture the MCX files in
composer and then push them out to the machine via Casper policy. That
way MCX doesn't have to be applied at log in since that is how the Jamf
Framework does it (correct me if I am wrong please). I am finishing up
a 10.6.8 image for our new macs and I am looking at deploying a highly
managed local user account to every machine as a universal guest account
in case someone cannot log in to their network account for any reason. I want it to be extremely managed to encourage users to use their
network accounts instead.

I have been toying around with the dscl command and -mcxexport and
mcximport switches but I cannot seem to get it to import everything
exactly how I want it to. So I was thinking about capturing the files
and then either scripting or policy scope out the proper folders and
push those files to the machine locally via a policy. The caveat is
that machines that don't get the policy right away won't have the proper
management updates (unless I do it post image, which is my plan) but the
plus side is that it will be applied always instead of every log in. One complaint has been long log in times since the beginning so I am
trying hard to please my user base by increasing the speed of log ins.

Thoughts? Anyone done anything like this? Anyone used dscl to create
records? I used WGM to locally build all MCX policy and then exported
it to a file, that works, and if I inspect the file all settings are
there. However, when I create a test account and try to import those
settings to that account they don't quite transfer properly. If I can
get that work, that is how I will do this.

Thanks, Tom

I think I did something very similar,
we used parental controls for a local account so that it has the limited finder and very little rights to do anything except launch a web browser.
in that case the MCX settings wind up to be part of the username.plist file located in /var/db/dslocal/nodes/Default/users/username.plist and that was all we had to put on the system, needed a setup script to set the password for the account when the system is up and running, but that worked for me.

--
Todd Ness
Technology Consultant/Non-Windows Services
Americas Regional Delivery Engineering
HP Enterprise Services

OK OK

So I am apparently very daft today......the MCX import works fantastic,
however it doesn't get applied until log in/out or a reboot...so the
whole time I have been tinkering with this it has actually been working. It actually works rather nicely as well, and I can create my own
custom local groups and apply group level MCX to specific accounts and
not have to apply MCX globally. Then build a library of MCX lists and
use a shell script to import them to specific users.

This is actually awesome...Today is my Monday though so I blame this on
it being Monday, and the fact I had a few IPAs last night watching stuff
get blown up... I will eventually write up a how to on how to do this
because it is quite simple

-Tom

i've used dscl to import/export mcx reliably in the past.

for something like this, i'd probably use the luggage to package this default user including mcx, distribute it, and call it a day.

i have something like this running as a login process for a small client who needs a default managed student account. any updated mcx settings are downloaded from a web server on boot and applied.