Updating Managed Settings.. window popup on Mavericks @ every login

[bentoms]

Anyone else seeing the same?

Using 8.73 & this is a Mac that has been upgraded.

[bentoms · Accepted solution]

Got a reply from the Bug Report, it's expected behaviour with 10.9+ http://macmule.com/2013/10/30/updating-managed-settings-popup-at-login-window/

[Philsto]

So here's a question, and perhaps I'm not seeing this right, but another article mentioned that this preference simply delays the Prelogcheck to next boot (when presumably it gets booted again, etc).

How does this affect user level config profiles? Does this mean that the profiles will not be applied correctly, or will this preference simply affect the login time?

I've asked JAMF this question, and was referred to Apple, but before jumping through the hoops I thought I'd check if someone here knows definitively, or has already asked Apple the question.

[Philsto]

In preliminary testing I was able to get the user level settings working with the defaults script by doing the following:

- Run the defaults script using $ defaults write /Library/Preferences/com.apple.mdmclient BypassPreLoginCheck -bool YES - Run the same script choosing " -bool NO" instead.

This populates the plist and seems to allow for the user level config profiles to populate, while still taking care of the endless login lag. Tested with OS 10.9.2 and JSS 9.24 with AD Binding.

[eleven · Accepted solution]

Hello Everyone,

This has now been removed from the Casper Suite 9.3 release notes as a Known Issue.

We found that the 'Updating managed settings...' message that had been present when logging into an MDM Managed machine when the MDM server is unreachable is no longer present as of the release of 10.9.2.

We filed a RADAR with Apple based on this behavior present in 10.9 and 10.9.1 and did receive confirmation that the behavior has been addressed with the release of 10.9.2.

If you find differently please contact your Account Manager, though we have confirmed Apple’s change as of 10.9.2 as well.

Thanks!

Eric

[bentoms]

Hi Eric,

FWIW I was still seeing the issue with 9.22 & 10.9.2+. But since moving to 9.3, we're not seeing the issue.

BUT, we also had a issue with our sites internet connection.. so that may have caused the issue.

[cstout]

@eleven, I am seeing this issue present on 10.9.2 images and using JSS 9.3. I sent an e-mail in to my account manager. My thread that was recently opened is at: https://jamfnation.jamfsoftware.com/discussion.html?id=10282

[bentoms]

@cstout, I replied in that thread. See my response that is marked as the answer & my linked blog post.

Is some situations, it's Apples new desired behaviour. Also see @rtrouton's method to bypass the prompt linked in this thread.

[cstout]

@bentoms, thank you for that response. It's at least good to know that it is "desired behavior." At this point I suppose I'm going to have to use the logging method you outline to find out why I only see it intermittently. My accounts are logging in internally, hardwired to our LAN, and there are no outstanding issues with our JSS.

[rcorbin]

Just about to do a deployment of 10.9.2 MacBook Pro's. Started seeing this issue today when testing a final build. Didn't really come up until we were testing it with a server based or Mobile account. (OD - OS X Server). We are still running Casper 9.25. I was originally holding of on 9.3 as there seemed to be a few issues out there. Then with 9.31 I was thinking of waiting till after this deployment. But maybe I'm going to 9.31 sooner than I thought. Is 9.3.x working ok for most of you ?

[Philsto]

I went throughout his with Apple.... In our case the issue was because the MDM security cert was not properly pushed to the clients. The login process was looking to run profiles and the cert didn't exist properly, therefore the timeout and the window....

9.3 fixes the issue. We have successfully pulled in 0ver 200 clients with 9.3 and the improved cert mechanism.

[rcorbin]

Thanks for the reply @Stockton Maybe I am going to 9.31.

[Kumarasinghe]

Posted 4/29/14 at 5:06 PM by Stockton I went throughout his with Apple.... In our case the issue was because the MDM security cert was not properly pushed to the clients. The login process was looking to run profiles and the cert didn't exist properly, therefore the timeout and the window.... 9.3 fixes the issue. We have successfully pulled in 0ver 200 clients with 9.3 and the improved cert mechanism.

@eleven][/url
@amanda.wulff][/url

We have seen the same issue on Casper 8.73 and 10.9.2 clients.
Is there any update coming to fix this on Casper v8 as it seems to be fixed in Casper 9.3?

[were_wulff]

Hi @Kumarasinghe,

The majority of Development’s focus is on the 9.x series; there may be functionality updates to the 8 series to account for new iOS releases, but from the looks of it, there will likely not be any major feature additions, or bug fixes as the main focus is now on the 9 series.

It’s very unlikely that any defects remaining or new defects found in the 8.x series will be addressed. If a defect or issue affects both the 8 and 9 series, it will be fixed for the 9 series, but most likely not for the 8 series.

Amanda Wulff
JAMF Software Support

[rcorbin]

We were seeing this a while back, but it seems to be showing up again with Casper 9.32 and 10.92 and 10.9.4 clients. I saw it today in a lab of newly imaged machines and it started happening again on a few machines since upgrading to Casper 9.32.

Where is see it usually happening is when logging in to OD accounts.

The solution from @rtrouton][/url to run this seems to get around it.

defaults write /Library/Preferences/com.apple.mdmclient BypassPreLoginCheck -bool YES

But is there a downside to that ?

[rtrouton]

@rcorbin

Disabling the pre-login check causes any pending profiles that contain user-level managed preferences not to be applied until the following login.

[rcorbin]

So @rtrouton you are saying when I run :

defaults write /Library/Preferences/com.apple.mdmclient BypassPreLoginCheck -bool YES

It just kicks the the can out for applying user-level profiles out till the next log in ?

So after that they still apply ? Just worried that it disables installation of those profiles entirely and permanently.

[mclinde]

I'm also concerned about the behavior of @rtrouton 's script. Logically, if you set BypassPreLoginCheck to TRUE, it's not EVER going to install user level files, because on each reboot/login this preference is read and pre-login-check is bypassed.

Unless there's something in there I just don't see...

[myronjoffe]

Ive been testing configuration profiles in a new environment.
JSS-9.51
Effecting Clients - 10.9.4 and 10.9.5 (AD managed mobile accounts)
*The below issues does not seem to occur at every login.

The message Updating managed settings appears for ~25 seconds then message appears below saying connecting to server “companyjss” followed by Processing server request “ProfileList” and then logs in…

Im also interested in a fix. @rtrouton Can you confirm the questions from @mclinde and @rcorbin ?

[rtrouton]

I'm not using user-level profiles (one reason why using this fix has worked fine for me.) Unfortunately, I can't confirm or deny whether or not those profiles apply with this fix in place.

[jwojda]

we've got this too. Was it addressed in 9.52?

[bentoms]

@jwojda if you see the answer above, Apple advised that this is not a bug & is working as expected.

[jwojda]

it's just strange that it started happening after 9.51/9.52 again, and only on the 10.9.4 and 10.9.5 clients.

[bmiller-tam]

I've noticed the same thing on AD-bound machines running 10.9.5. We don't currently use Casper. Have tried RTrouton's fix, but this doesn't seem to have any effect. Annoying.

[rcorbin]

I don't think this is anything to do with AD. We actually mainly see this in Open Directory bound machines. We have some AD as well, but I don't think I see it as much there. Where this becomes very annoying is when you have a whole lab of users (30) getting this message when they log in. Haven't really rolled out the @rtrouton fix on mass as I'm worried it is going to disable applying profiles for good.

[Johnny_Kim]

JSS 9.5 with early 2014 Macbook Air running 10.9 are seeing this issue also.

[makander]

+1, I went from 8.73 and had this issue. Then upgraded to 9.31 and it went away. Now at 9.52 and OS X 10.9.5 it's back.

[millersc]

This behavior is showing in 10.10 and 9.6.1. Just started playing with it this week and found it when off network.

[Johnny_Kim]

EDIT: That resolution was for different issue.

For the "Updating managed settings" dialog, I was able to resolve by creating a policy to re-install the quick add package.

[bentoms]

Just wanted to advise that we're seeing this on 10.10 too. But happens post login.

Pretty infrequent, but generally when logging in as a new account & it's then pulling down the user level configuration profiles.

[jillhughes]

@ Johnny.Kim response, yes this worked for us as well! Thanks so much!