Urgent Help! AppleScript within a policy?

[corbinmharris]

I'm trying to add an AppleScript to a Casper Policy to allow users to save their Office files before the apps quit for the 14.3.2 update -

display dialog "All Applications will now quit for Microsoft Office Update"
set apps to {"Microsoft Excel", "Microsoft Outlook", "Microsoft PowerPoint", "Microsoft Word", "Microsoft Database Daemon"}
repeat with thisApp in apps tell application thisApp to quit
end repeat

I've tested the Script using Remote to target a test Mac and set the script to run before. However the script fails to run and all the Office apps quit without warning to the end users.

Any suggestions on making this work is appreciated.

Thanks! Corbin

[jarednichols]

You're likely hitting sandbox issues on the display dialog. You've essentially got the Casper Admin account trying to display a box to the logged in user. The security system won't allow this. You'd need to run a launchagent that calls the AppleScript instead.

[tomt]

Also make sure you don't forget the Microsoft Notifications (not 100% sure of the name) app.

[corbinmharris]

Anyway to do this with JamfHelper? The documentation on using JamfHelper is skimpy at best with this article -

https://jamfnation.jamfsoftware.com/article.html?id=107

Thanks!

[daniel_behan]

There is some good jamf helper ideas here https://jamfnation.jamfsoftware.com/discussion.html?id=3797

You could have the policy cache the update and once the user clicks ok, the trigger could be to osascript quitting the office apps and the to install all cached packages.

[mm2270]

sudo /Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -help

The above gives you a full rundown of all the options jamfHelper.app includes, although,it doesn't really provide any examples in the documentation. For that, do some searches or use the link daniel.behan provided above.

You could most definitely do this with jamfHelper, and I would even say you'd be better off doing it that way.

You could also just place your AppleScript inside a <<HEREDOC style block with osascript in a shell script. Although you might still run into issues getting the message to come up properly even in that format.

Or, just make a shell script that calls individual osascript commands to gracefully quit the applications. In fact, that's really the only piece I see that would even need any Applescript commands since there aren't really easy ways to gracefully quit open apps with straight up bash.

One last thing. you really don't need to have the Office Database Daemon quit just to install Office updates. Those updaters really only care about visible running processes, not the background stuff. The packages take care of closing the daemon down.

[tomt]

You may want to verify this but I believe some (if not all) of the Office updaters also want Safari to not be running.

[JRM]

You may be able to run your script as the user using sudo and combine that with placeing your AppleScript inside a <<HEREDOC style block

#! /bin/bash
# $3 is the logged in user - default for most policies.  
sudo -u $3 /usr/bin/osascript <<ENDofOSAscript
display dialog "All Applications will now quit for Microsoft Office Update"
set apps to {"Microsoft Excel", "Microsoft Outlook", "Microsoft PowerPoint", "Microsoft Word", "Microsoft Database Daemon","Sarafi"}
repeat with thisApp in apps
tell application thisApp to quit
end repeat
ENDofOSAscript

I haven't tested this, so it might not work as posted. I would recommend ensuring the applescript all runs as expected before adding in the sudo -u pice. Just run from the logged in users terminal and it should function.

[acdesigntech]

the super user doesn't require a password to switch user, so why not issue as 'su <current user>' then run the applescript in the <<HEREDOC style?

Should work that same as issuing a bunch of osascripts.

[BaddMann]

This may sound silly, but why not just ask the user to logout or have Casper log the user out?

It's how munki avoids a lot of its conflicting apps.
It also seems like it would avoid a lot of possible heart ache and coding mis-fires, as most programs prompt for saving and shutdown upon the log off event executing. On top of that you could use the log off hook to trigger the install!

Jamfhelper could provide useful info and ETA over the login window, while keeping any users from disrupting installation, by trying to impatiently log back in before installation is complete.

Yes it's painful, but this makes them get up and have a cup of coffee or smoke, things I'm sure they were going to do anyway.

[jarednichols]

You may want to verify this but I believe some (if not all) of the Office updaters also want Safari to not be running.

Correct. Safari (and I think browsers in general) need to be closed as it usually installs a Sharepoint internet plugin.