[OT] Need help with removing MCXs installed by Munki.

[rseide]

Hi,

I just started a new job about a month ago and the previous tech had a handful of Macs managed by Munki. I have no experience with Munki at all, so forgive my ignorance. Unfortunately, he did not leave any documentation behind.

The problem I am having is that these Macs that have been managed by Munki have a bunch of preference panes in System Preferences grayed out. I cannot seem to undo this permanently.

Here's what I've tried that has not worked:
- following the steps here to uninstall Munki: https://code.google.com/p/munki/wiki/RemovingMunki
- how to flush MXC cache settings (but the Macs I manage run 10.8 or 10.9 however I still tried this with no luck) - http://support.apple.com/kb/HT3540

The closest I've gotten to removing these MCXs was deleting the /Library/Managed Preferences folder. That worked until I rebooted than all those settings came back.

If I remember correctly, Munki doesn't manage Macs like Casper meaning I don't think there's a server somewhere that is pushing these down. Am I correct?

Thanks in advance.

[mm2270]

I don't have much experience with Munki myself, but you can try the following steps. It may work to permanently clear those out.

sudo rm -Rfd /Library/Managed Preferences
sudo dscl . -mcxdelete /Computers/localhost
sudo dscl . -mcxdelete /Users/root
sudo dscl . -mcxdelete /Users/<other user account>

For the last one, run it against any local or cached directory based accounts on the Mac. You could script that to cycle through local UID 501 and higher accounts if you need to do this for a number of systems and they all have different accounts on them.

But I would first try those steps and see if it works.
You may also want to just run killall cfprefsd, especially if on Mavericks, to make the Mac recognize the now removed settings.
I don't know where Munki actually stores the settings to re-apply at reboot though, so hopefully the above will work to completely remove them.

[rseide]

Thanks for your suggestion, @mm2270 - unfortunately, the settings came back after a reboot.

Before I did a reboot, I ran killall cfprefsd and it said there were no processes found.

I'm stumped on this.

[gregneagle]

Munki just installs things.

So you need to figure out where the MCX is coming from. If it was installed by Munki, that would typically mean either LocalMCX or Configuration Profiles. System Profiler can give you some of that information under Managed Client and Profiles.

Configuration Profiles can be removed, either using the Profiles preferences pane, or via /usr/bin/profiles.

LocalMCX is stored in a local DirectoryServices node. The default node is a /private/var/db/dslocal/nodes/Default; some implementations use a special node at /private/var/db/dslocal/nodes/MCX; but there's nothing stopping people from naming alternate nodes anything they wish.

Within the nodes, MCX could be attached to objects in users, groups, computers, or computer groups, though the most common approach is computer groups. /usr/bin/mcxquery or System Profiler can help you find where the MCX data is coming from.

[bentoms]

@rseide, so what is your JSS managing?

Perhaps it's a profile or MCX setting from the JSS?

[gregneagle]

Background and theory about Managed Preferences in general, including LocalMCX, here:
http://www.amazon.com/Enterprise-Managed-Preferences-Edward-Marczak/dp/1430229373/

(That predates Configuration Profiles, so you'll need to look elsewhere for information about those.)

[rseide · Accepted solution]

@gregneagle - It's definitely not Configuration Profiles. Looking at System Profiler/Managed Client, there is a Source: creative_policy (Computer Group).

The locations of the where the local MCXs are stored that you listed helped push me in the right direction.

I got this to work. Here's what I did:
- going by what System Profiler indicated as the source of the MCXs, I did a sudo ls -lah /private/var/db/dslocal/nodes/MCX and saw ComputerGroups in there. - I then did sudo ls -lah /private/var/db/dslocal/nodes/MCX/ComputerGroups and saw several plist files. One of them was creative_policy.plist
- I removed the plist file
- I removed /Library/Managed Preferences
- Rebooted the computer and the changes stuck!

Thanks for your info. It helped me, as you can see.

@bentoms - these Macs are not being managed by Casper yet. We're about to enroll all of our Macs in the next week or so but I wanted to remove Munki completely on those Macs that have it before we roll out Casper.