Updating Managed Settings.. window popup on Mavericks @ every login

I'm seeing this too
JSS is 9.2
retina MacBook Pro running 1st GM of Mavericks
Our JSS is not currently externally facing but managed settings popup happens off site
Does not occur when logging in without a network connection but happens if there is an active connection
Often takes over a minute to log in

log files show the following
24/10/2013 6:54:34.531 pm mdmclient[272]: [Agent:144195332] Processing pre-login MDM check for: 144195332
24/10/2013 6:55:04.588 pm mdmclient[272]: [Agent:144195332] MDM connection still active. Continuing to wait. (0->0) Last command: (null) (Completed)
24/10/2013 6:55:34.652 pm mdmclient[272]: [Agent:144195332] MDM connection still active. Continuing to wait. (0->0) Last command: (null) (Completed)
24/10/2013 6:56:04.655 pm mdmclient[272]: ** ERROR ** [Agent:144195332] Pre-login MDM check: Maximum wait time elapsed. Last command: (null) (Completed)

@marcusransom thanks for confirming.. i'm guessing this is correct then? (except the time).

It's actually handy as helps my desktop background dirty hack trick

dupe

@marcusransom do you have MCX settings scoped to your 10.9 clients?

ah.. from: https://discussions.apple.com/message/23468449#23468449

Figured it out. I had to delete all my profiles on the clients and re-download them again.

The clients i've seen this on had been updated via Self Service, looks like i might need to add a QuickAdd install post 10.9 install.. will test more & report.

Nvm the above, this seems in relation to the MCX refresh @ login.. removing the refresh did it but obviously broke MCX :(

I notice this issue too when i took my laptop off site any way around this?

@RaulSantos do you use MCX on 10.9 too?

A bit more investigation - I have tried a fresh enrolI which hasn't made any difference. It happens on a Mobile AD account but not on a local account. In our case it could be related to the MCX that the AD plugin includes when we bind machines? The MCX put there by other system preferences (com.apple.SubmitDiagInfo.plist, com.apple.systempolicy.control.plist and com.apple.systempolicy.managed.plist) don't seem to trigger the popup window. As far as I know, we aren't using MCX to manage any other preferences (at least not intentionally)

The only difference in the local and AD account is the inclusion of the loginwindow.plist from what I can see - our particular config only includes the following

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict> <key>AutoLaunchedApplicationDictionary-managed</key> <array> <dict> <key>Path</key> <string>/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXMenuExtraTool.app</string> </dict> </array>
</dict>
</plist>

Thanks @marcusransom.

The loginwindow plist is where I've been looking too.

How is that entry added into the plist in your example above? Is it MCX or a custom profile? Script?

I had a bug report with Apple in the early 10.9 betas. Then I reimaged when the next beta came out and it went away and I hadn't seen it till just last night it happened. But I've been using 13a603 since they released it to devs a week or so ago.

I think it's when the machine can't reach the JSS, but i'm just guessing.

@jwojda that's the same build number as the public release & the same I'm testing.

Are you not seeing it currently then?

I didn't see it in the last 4 or 5 beta's and then with GM 13a598. but as of yesterday night on 13a603 (public release and final GM) it's back.

Logged on bug reporter: 15319906

Ok.. well maybe not MCX... :(

With NO MCX, NO login scripts & just the MDM Enrollment profile installed i am seeing this with ONLY AD accounts.

Below are excerpts when logging in with an AD account:

25/10/2013 18:18:08.974 mdmclient[4437]: [Agent:735480991] Processing server request: ProfileList  for: <User: 735480991>
25/10/2013 18:23:24.565 mdmclient[1020]: [Agent:735480991] Processing server request: CertificateList  for: <User: 735480991>

Here is what happens when logging in with the local account:

5/10/2013 18:38:07.608 mdmclient[6721]: [Agent:501] Current user is not bound by the MDM configuration: '<Payload: MDM Enrollment (00000000-0000-0000-A000-4A414D460004) from profile: MDM Enrollment (00000000-0000-0000-A000-4A414D460003)>' because it was installed by a different user on the system.

@marcusransom AD bound clients logging in offsite?

@bentoms it seems to only be AD bound users for me. Binding to AD puts some MCX in for these users - did you remove this and it still happens?

@marcusransom Our MCX are being scoped via OS, I removed the 10.9 group so no MCX are being published.

Can you test with no config profiles on the mac? (Seeing as they leverage MCX it should be no surprise they're linked).

I just saw the window flash by briefly when I logged into a Mavericks VM with an AD user. I did not see it when I logged in with a local user.

My Casper doesn't use a loginhook (our Kace KBox's agent is occupying the loginhook slot with its script) so I am not doing any user-level MCX or profiles with Casper.

My JSS is running 8.71. If all goes well, I'll be upgrading to 8.73 next week.

@rtrouton thanks!

Is the VM enrolled into Casper?

I'm guessing with your KACE logo hook policies are not being checked @ login & neither is the JSS MCX being refreshed.

Sigh...don't you just love testing for Apple for free!

@tkimpton not sure that it's an Apple or Casper thing atm... Reached out to the MacEnterprise list to see if this issue affects those running profile manager or another management solution.

@bentoms @tkimpton @marcusransom
I'm seeing this on my machine. AD mobile accounts/10.9 installed from the app store/JSS is running 8.73 and client binary is up to date.
Haven’t seen the pop up at login since I manually removed the jamf framework (sudo jamf removeFramework) and reinstalled profiles.

@bentoms @tkimpton @marcusransom
I'm seeing this on my machine. AD mobile accounts/10.9 installed from the app store/JSS is running 8.73 and client binary is up to date.
Haven’t seen the pop up at login since I manually removed the jamf framework (sudo jamf removeFramework) and reinstalled profiles.

@bentoms,

My VM is enrolled with Casper. To verify that this was tied to Casper, I set up a VM running 10.9 and didn't include installing the Casper agent. On the machine without the Casper agent, no pop-up window was observed.