Self Service requesting admin password when installing software

[llitz123]

I don't know what else to title this...
We had a member of our IT Team leave and I'm in the process of changing the admin password on 50+ machines...
What's the best practice for doing for making sure the Self Service app doesn't request password for admin account changes?
Thanks.

[mm2270]

@ Leverett, I'm a little unclear about what you're asking here. Are you seeing instances of Self Service asking for admin credentials when policies are run by end users, or is it just a concern it could happen?
As for changing the admin password, do you mean the one Casper uses as well, or are we talking about just a local admin account on the Macs? If its the former, as long as you use the proper procedure from the JSS in a policy or via Casper Remote, you shouldn't have any issues. If you were going to change the account password some other way outside of Casper knowing it, it would cause all sorts of issues for you though.

OTOH, if you're changing a password to some other account, I don't see how it would affect anything in Self Service.

[llitz123]

Our self service account is tied to an non-hidden, non Casper created admin account on our systems.
When I change the admin password on the client systems (because coworker left/security), non admin users are asked for credentials when accessing Self Service.

Whats the best way to change the admin password on 50+ systems so users can continue to access Self Service?

Thanks.

[mm2270]

You'll want to change that from within Casper then, in a policy or from Casper Remote. If the account you're changing is your management account as you say, use the option under the Accounts tab labeled Change Management Account Password Just enter the new password in the Change to: fields there and apply it to all Macs. Well, apply it to a few at first to ensure its working, but that should do it As I mentioned, if you change that password outside of a Casper Suite process, it will get out of sync on the JSS and when policies run it can no longer authenticate since it has an old password stored for it, so users get prompted to enter it at that time instead.

[llitz123]

Nice. I'll test it.
Thanks.

[donmontalvo]

We have Management Framework Settings configured so users don't get prompted at all, since what we're providing is free (etc.):

external image link

The Casper management account is hidden on our Macs, and I confirmed password is correct on a 10.8.4 Macs that is having this problem.

I don't remember seeing Self Service.app ever asking a user to provide local admin credentials, so I'm worried something broke.

Don

[mm2270]

@Don, when you say "I confirmed password is correct on a 10.8.4 Mac that is having this problem" that doesn't necessarily mean the JSS has the same password stored for it. In other words, the password for the account ON the Mac may be what you expect, but is it the same in the JSS? Have you confirmed that, or set it to what it should be there as well?

Unfortunately there is actually no way to read that password in the JSS, but you can set it for that Mac's record to what you believe it should be. I would try that next if you haven't done so already.

[ctangora]

I would suggest re-enrolling the machines so they use a new admin user and have the passwords synced with the JSS.

The bonus is that your next employee won't have to come by when you leave and do this all again.

-c

[donmontalvo]

@mm270 and @ctangora, the test Macs have been re-enrolled, so the account is present and credentials are correct. When a user launches Self Service.app and tries to run an install, they are prompted for local admin rights by OS X.

Don

[mm2270]

Hmm, not sure what to tell you about that then. I guess if you're not opposed to it, you could try deleting the computer record in your JSS and re-enrolling it again. If you still have the same issue with a brand new record, then something may indeed be broken.
Just curious though, you only see this on some Macs, but not others?

[donmontalvo]

Sorry for the late response, was transitioning between gigs. :) You guys were right, the Mac was enrolled using my domain account. Once I re-enrolled using our management account credentials, Self Service launched and worked fine.