Replicating Casper Imaging behavior RE: AD join

[nadams]

Hi All,

With the changes to MacOS and the Server App, I am working on replacing our old Casper Imaging behavior with a prestage enrollment and policies to do software installs, etc.

One sticking point is the AD join process. With Casper Imaging, it would prompt you for a computer name at the start of the process, apply it, and then join the computer to the domain with that new name.

I've read that the prestage enrollment does not set all 3 computer names correctly. In addition, the only option for automatic naming is to use the device serial number, with no option to prompt for a device name.

So that now has me looking for a policy to run that will prompt for a computer name, apply it to all 3 name fields, and then join the computer to AD using my existing AD settings in JAMF.

Any suggestions on doing this properly? I know a lot of people don't like using AD, but we're fairly reliant on using it for authentication.

[cvangorp]

Yes, I have gotten scripts from JamfNation and worked with Jamf on a solution. My process is on enrollment complete, run a script that quary's the JSS for Asset Tag field and if populated will use that name field to set the name. If field is not populated it waits for first user (501 or 502) to login then prompts user for Asset Tag.

We use Asset Tag as computer name.

Script 1

!/bin/sh

!/bin/bash

jssuser=""
jsspass=""
jssURL="https://.jamfcloud.com"

Get the Mac's UUID string

UUID=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/{print $4}')

Function to add date to log entries

log(){
NOW="$(date +"*%Y-%m-%d %H:%M:%S")"
echo "$NOW": "$1"
}

Logging for troubleshooting - view the log at /var/log/assetname.log

touch /var/log/assetname.log
exec 2>&1>/var/log/assetname.log

Disable Software Updates during imaging

softwareupdate --schedule off
log "Software Updates disabled"

log "This is the $UUID"

Pull the Asset Tag by accessing the computer records "general" subsection

ASSET_TAG=$(curl -H "Accept: text/xml" -sfku "${jssuser}:${jsspass}" "${jssURL}/JSSResource/computers/udid/${UUID}/subset/general/<asset_tag>/{print $3}")

ASSET_TAG=curl -H "Accept: text/xml" -ksu "$jssuser":"$jsspass" "$jssURL/JSSResource/computers/udid/$UUID/subset/general" | xpath //computer/general/asset_tag 2>/dev/null | sed 's/<asset_tag>//g' | sed 's/</asset_tag>//g'

log "This is the $ASSET_TAG"

if [ "$ASSET_TAG"!="<asset_tag />" ]; then

if [ "$ASSET_TAG" != "<asset_tag />" ]; then COMPUTERNAME="${ASSET_TAG}"

/usr/sbin/scutil --set ComputerName "$COMPUTERNAME" /usr/sbin/scutil --set LocalHostName "$COMPUTERNAME" /usr/sbin/scutil --set HostName "$COMPUTERNAME" dscacheutil -flushcache

log "Setting computer name to $COMPUTERNAME"

jamf policy -event 0_renamecomplete exit 0
else

# Logging for troubleshooting - view the log at /var/log/prefirstrun.log touch /var/log/prefirstrun.log exec 2>&1>/var/log/prefirstrun.log

# Get the currently logged in user loggedInUser=python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + " ");' log "Current user is $loggedInUser"

#get UID for current User currentUID=$(dscl . -list /Users UniqueID | grep $loggedInUser | awk '{print $2;}') log "$loggedInUser UID is $currentUID"

# Check and see if we're currently running as the user we want to setup - pause and wait if not while [ $currentUID -ne 502 ] && [ $currentUID -ne 501 ]; do log "Currently logged in user is NOT the 501 or 502 user. Waiting." sleep 5 loggedInUser=python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + " ");' currentUID=$(dscl . -list /Users UniqueID | grep $loggedInUser | awk '{print $2;}') log "Current user is $loggedInUser with UID $currentUID" done

# Now that we have the correct user logged in - need to wait for the login to complete so we don't start too early dockStatus=$(pgrep -x Dock) log "Waiting for Desktop" while [ "$dockStatus" == "" ]; do log "Desktop is not loaded. Waiting." sleep 5 dockStatus=$(pgrep -x Dock) done

# Start the imaging process since we're now running as the correct user. log "501 or 502 user is now logged in, continuing setup." jamf policy -event 0_renamefirstRun jamf policy -event 0_renamecomplete

exit 0
fi

Script 2

!/bin/bash

loggedInUser=$(stat -f%Su /dev/console)
loggedInUID=$(id -u $loggedInUser)

if [[ "$loggedInUser" != "root" ]] && [[ "$loggedInUser" != "_mbsetup" ]]; then ## Create local script cat << EOD > /private/tmp/computerrenamescript.sh

!/bin/bash

COUNTRY=$(/usr/bin/osascript -e 'tell application "System Events" to set COUNTRY to text returned of (display dialog "Please Input The Country - " default answer "" with icon 2)')

REGION=$(/usr/bin/osascript -e 'tell application "System Events" to set REGION to text returned of (display dialog "Please Input Region - " default answer "" with icon 2)')

MODEL=$(/usr/bin/osascript -e 'tell application "System Events" to set MODEL to text returned of (display dialog "Please Input Model - Desktop or Laptop? (ML = laptop, MD = desktop)" default answer "" with icon 2)')

TAG=$(/usr/bin/osascript -e 'tell application "System Events" to set TAG to text returned of (display dialog "Please Input The Asset Tag - " default answer "" with icon 2)')

echo "${TAG}" > /private/tmp/computerrenametext.txt

EOD

## Make script executable /bin/chmod +x /private/tmp/computerrenamescript.sh

## Run the script as logged in user /bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" "/private/tmp/computerrenamescript.sh"

## Get the new name from the local file newcomputername=$(cat /tmp/computerrenametext.txt)

if [ ! -z "$newcomputername" ]; then echo "$newcomputername" ## Rename the computer to the new name /usr/local/bin/jamf setComputerName -name "$newcomputername"

## Remove local script rm -f /private/tmp/computerrenamescript.sh

## Trigger Next Script

/usr/local/bin/jamf policy -trigger 0_renamecomplete

exit 0 else echo "No name was found to rename to"

## Remove local script rm -f /private/tmp/computerrenamescript.sh

exit 1 fi
else echo "No-one logged in. Exiting" exit 0
fi

[nadams]

Okay, so if I want to do a basic "prompt for computer name" script, I'd need to modify this part a bit to just prompt for the computer name and write it to the temporary txt file:

!/bin/bash
loggedInUser=$(stat -f%Su /dev/console)
loggedInUID=$(id -u $loggedInUser)

if [[ "$loggedInUser" != "root" ]] && [[ "$loggedInUser" != "_mbsetup" ]]; then 

## Create local script cat 
<< EOD > /private/tmp/computerrenamescript.sh

!/bin/bash
COUNTRY=$(/usr/bin/osascript -e 'tell application "System Events" to set COUNTRY to text returned of (display dialog "Please Input The Country - " default answer "" with icon 2)')
REGION=$(/usr/bin/osascript -e 'tell application "System Events" to set REGION to text returned of (display dialog "Please Input Region - " default answer "" with icon 2)')
MODEL=$(/usr/bin/osascript -e 'tell application "System Events" to set MODEL to text returned of (display dialog "Please Input Model - Desktop or Laptop? (ML = laptop, MD = desktop)" default answer "" with icon 2)')
TAG=$(/usr/bin/osascript -e 'tell application "System Events" to set TAG to text returned of (display dialog "Please Input The Asset Tag - " default answer "" with icon 2)')

echo "${TAG}" > /private/tmp/computerrenametext.txt

EOD

## Make script executable 
/bin/chmod +x /private/tmp/computerrenamescript.sh

## Run the script as logged in user 
/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" "/private/tmp/computerrenamescript.sh"

## Get the new name from the local file 
newcomputername=$(cat /tmp/computerrenametext.txt)

if [ ! -z "$newcomputername" ]; then echo "$newcomputername" 

## Rename the computer to the new name 
/usr/local/bin/jamf setComputerName -name "$newcomputername"

## Remove local script 
rm -f /private/tmp/computerrenamescript.sh

## Trigger Next Script

/usr/local/bin/jamf policy -trigger 0_renamecomplete
exit 0 else echo "No name was found to rename to"

## Remove local script 
rm -f /private/tmp/computerrenamescript.sh

exit 1 fi
else echo "No-one logged in. Exiting" exit 0
fi

[Look]

One common way of doing this is to not have AD binding in the Enrollment.
Have it done as a seperate Configuration Profile scoped by a smart group using an EA that is populated once the computer has been named via scripting.
This is certainly how we do it, my scripting probably isn't too much help though as we have an external database to pull names from based on serial number.