New to Casper ( on the iOS side ), new 1:1 rollout issues

[bbelew]

Hello everyone,

I recently got to embark on a first day of school rollout, K-12 1:1 program. Elementary iPads, JH iPads and HS Macbook Air's. 930 devices total. Let's just say it was an interesting day...

That said I ran into a few nagging issues that I wanted to run by the community to see if anyone has seen this.

Issue 1.) Apps that students install via self service occasionally crash, chrome and word are the most commonly reported. I have a theory that the policy is installing over and over again, crashing the app if its open when it happens. The reason I have this theory is because it keeps popping up a notification saying its installing, even a day after it successfully installed. Usually happens every 5 to 10 minutes which probably lines up with my check in frequency.

The policies: - Have no trigger defined
- Are setup for access in Self Service
- Have an execution frequency of ongoing ( theory behind this is so they could reinstall the app )
- Scope is to all devices, no other settings

The google chrome installer isn't a package on our network, I have a script that grabs the latest version from google and installs it. So it's not a packaging issue on that app. The app runs great, then completely crashes out and closes. No error logs in the console.

Policy logs doesn't appear to show the installer running multiple times. In some cases I can see the student clicked it manually since it's at random times or failed. ( on the first day of school I forgot to add the package for office to the policy... rookie mistake.... ) yet the policy notification pops up repeatedly on many of the computers.

Has anyone seen anything like this?

Issue 2: For some reason my admin password keeps failing. For the second time in two days I had to go in and reset the management account password. JAMF keeps working, installs packages and everything just fine. It just won't let me login. Changing the password in a policy fixes it, at least temporarily. Anyone see anything like that?

Thanks! Sorry i'm new to the Mac OS side, I much prefer it to iOS but some of these problems annoy me and I need to squash them preferably by monday.

Thanks!

[adamcodega]

If a policy Execution Frequency is set to ongoing, it will continually run which means Chrome is being continually installed on the computer.

You want to use ongoing if you were instead, maybe for example, running a script which checked or enabled/disabled a system setting. Ongoing would mean it would routinely run based on it's trigger, whether that's set to startup, login, logout, at the recurring check-in, or one of the other trigger options.

You do not need an execution frequency or a trigger for an item to be in Self Service. You may want to set a trigger of "on enrollment" and "once per computer" so that Chrome gets installed on new computers enrolled in the JSS. (Make the computer do the work for you)

To fix your issue right now, simply disable all triggers and set frequency to once per computer. This will not remove the item from Self Service for people who've already installed Chrome through Self Service.

[bbelew]

But what if I don't have a trigger set? For the apps i'm having trouble with I didn't have a trigger set, and had execution frequency set to Ongoing with self service enabled. Was self service acting as the trigger and causing a loop after it is first installed?

Thanks!

[Kaltsas]

If you don't set a trigger in Options and enable self service for the policy then Self Service becomes the trigger. Even if scoped to All Computers the policy should only execute when triggered in self service, you should be able to verify this in the policy logs.

However for an Application I would probably scope a smart group to target machines that don't have App XYZ so it's not presented if they have it.

On machines having the issue is there a corresponding failed or completed policy log?

[adamcodega]

Would you be able to post what your PKG looks like in Composer or a similar app?

[bbelew]

The apps it's happening with most isn't a package but a script. It downloads the latest installer for Google Chrome and installs it.

The policy logs don't show the policy installing every 5 minutes, and they show it completed when it does. But the Apple notifications keep popping up like it's trying to install it.

I went through over the weekend and changed all of my self service policies to no trigger and once per computer on the execution frequency. I haven't seen any students yet this morning complaining of crashing so i'm not sure on if it fixed it yet.

[adamcodega]

Could we see the script?

[bbelew]

!/bin/sh

#########################################################################################

# ABOUT THIS PROGRAM

NAME

GoogleChromeInstall.sh -- Installs the latest Google Chrome version

SYNOPSIS

sudo GoogleChromeInstall.sh

########################################################################################

# HISTORY

Version: 1.0

- Joe Farage, 17.03.2015

########################################################################################

Script to download and install Google Earth.

Only works on Intel systems.

dmgfile="googlechrome.dmg"
volname="Google Chrome"
logfile="/Library/Logs/GoogleChromeInstallScript.log"

url='https://dl.google.com/chrome/mac/stable/GGRO/googlechrome.dmg'

Are we running on Intel?

if [ '/usr/bin/uname -p'="i386" -o '/usr/bin/uname -p'="x86_64" ]; then /bin/echo "--" >> ${logfile} /bin/echo "date: Downloading latest version." >> ${logfile} /usr/bin/curl -s -o /tmp/${dmgfile} ${url} /bin/echo "date: Mounting installer disk image." >> ${logfile} /usr/bin/hdiutil attach /tmp/${dmgfile} -nobrowse -quiet /bin/echo "date: Installing..." >> ${logfile} ditto -rsrc "/Volumes/${volname}/Google Chrome.app" "/Applications/Google Chrome.app" /bin/sleep 10 /bin/echo "date: Unmounting installer disk image." >> ${logfile} /usr/bin/hdiutil detach $(/bin/df | /usr/bin/grep "${volname}" | awk '{print $1}') -quiet /bin/sleep 10 /bin/echo "date: Deleting disk image." >> ${logfile} /bin/rm /tmp/"${dmgfile}"
else /bin/echo "date: ERROR: This script is for Intel Macs only." >> ${logfile}
fi

exit 0

[Kaltsas]

So even when it says the policy is completed on a target, your Start Message set in the policy is perpetually presented to the client system?