Policy self service visibility frequency ??

[tcandela]

I have some self service printer MAP policies, and matching 'UNMAP' policies all in Self Service.

The MAP policies are setup for smart group of 10.9/10.10 computers The UNMAP policies are setup for smart group, computers with mapped printers associated with whatever printer is mapped.

so if Computer1 has printer1 installed, the smart group 'printer1 installed' will have Computer1 in it, thus self service for Computer1 will have the 'UNMAP' 'printer1' available.

Once 'printer1' gets installed it disappears from Self Service (execution once per computer), same thing for 'unmap policy'.

these are setup as 'Once Per Computer', so if a user 'unmaps' a printer and later on wants to re-add that printer, is there a way for that printer policy to be available in Self Service without me having to Flush the policy on that computer, same thing for the unmaps policy ?

I don't want to set the policies to 'ongoing'. I only want the policies available if the printer is not installed (add printer policy) and installed (removal policy)

[stevewood · Accepted solution]

@tcandela I would try scoping the Smart Group to look for the printers installed, not just OS version. Then you should be able to set the policies to Ongoing since the machines will fall out of scope if they do not match the Smart Group.

Smart Group "Map Printer" - OS Version like 10.9. or 10.10. AND Printer XYZ not installed.

Smart Group "Unmap Printer" - Printer XYZ is installed.

The policies that do the map and unmap would need a recon on them to make sure the computers get moved into and out of Smart Groups, but that should work.

I would test it to see if that fits.

[Look]

If you are not concerned about users being able to remove every printer on the machine you could just have a single policy for removing any printer. I wrote this script to prompt the user to select from the installed printers for the one they want to remove and then remove it. I just have it as an onging Self Service policy alongside the printer install options.
Doesn't really answer your question but perhaps reduces the issue by half...

#!/bin/bash

##### SUB ROUTINES START HERE #####

Get_Printer() {
The_Printer=$(osascript <<AppleScript
set My_Printers to {$My_Printers}
set The_Printer to {choose from list My_Printers with title "AUT Printer Wizard" with prompt "Please select a printer:" OK button name "Remove Printer"}
AppleScript
)
}

Display_Cancel() {
osascript <<AppleScript
set NOTHING to the button returned of (display dialog "No printer selected, cancelling the process" with title "AUT Printer Wizard" buttons {"Exit"})
AppleScript
}

Display_Remove() {
The_Answer=$(osascript <<AppleScript
set The_Answer to the button returned of (display dialog "You have selected to remove $The_Printer" with title "AUT Printer Wizard" buttons {"Not Now","Proceed"})
AppleScript
)
}

Display_Final() {
Current_Printers=$(lpstat -a | awk '{print $1}')
osascript <<AppleScript
set NOTHING to the button returned of (display dialog "Process complete, currently installed printers:

$Current_Printers" with title "AUT Printer Wizard" buttons {"Finish"})
AppleScript
}

##### SUB ROUTINES END HERE #####


##### MAIN PROGRAM STARTS HERE #####

My_Printers=$(lpstat -a | awk '{print $1}' | tr "
" " " | sed -e 's/ $/"/g' -e 's/^/"/g' -e 's/ /","/g')
if [ "${My_Printers}" != "" ];then
Get_Printer
echo ${The_Printer}
fi

if [ "${The_Printer}" != "" ] && [ "${The_Printer}" != "false" ]; then
Display_Remove
fi

if [ "${The_Answer}" == "Proceed" ]; then
lpadmin -x ${The_Printer}
Display_Final
else
Display_Cancel
fi

##### MAIN PROGRAM ENDS, THANKS FOR PLAYING #####

[stevewood]

@tcandela I tested my idea, and it worked. I did find that the recon during Self Service did not seem to pick up the printers, but you could use a script to add/remove the printers and throw a "jamf recon" in the script.

I also found that on removal I needed to stop the cups process and restart it just to kick the change into showing up. My removal was via the FIles & Processes tab, and it just had this:

lpadmin -x <printername> | launchctl stop org.cups.cupsd | launchctl start org.cups.cupsd

[tcandela]

@stevewood prior to seeing your suggestions, while walking back from the grocery store I started to think on how to get this to work, and realized I needed to add to the smart group criteria the AND printer name not installed. (Just like you suggested). I'll test tomorrow.

The unmap policy log looks to stop/start CUPS already.

I thought Files and Processes statements get separated by colons?

So now after a self service policy runs it also supposed to kick off RECON?

[stevewood]

@tcandela the statements in the FIles And Processes tab are run just like a command from the terminal. So the same way you chain a UNIX command together is how you would from that tab. You're piping ( | ) the output of one command into the next for processing.

And in my testing, the recon did not happen as expected from Self Service. To be fair, this was a 10.10.5 VM that I was testing in.

[tcandela]

come to think of it, i really don't need the criteria to include operating system like 10.9 or 10.10 all I need is a single criteria for each smart group

Mapped Printers 'does not have' printer1 -- for add printer Mapped Printers 'does have' printer1 -- for remove printer