use SELF SERVICE for dock items setup

tcandela
Valued Contributor

I have a policy that uses the Dock Items payload to add and remove icons, but when i go into Self Service the policy never shows up.

Is this not allowed in Self Service ?

1 ACCEPTED SOLUTION

larry_barrett
Valued Contributor

It is definetly possible. Set to ongoing and make sure you fill out the Self Service tab
42d5fb429c6c475dbabb560a9a387993

f9436032265e4e63a179f0a5c2a6a56b

View solution in original post

24 REPLIES 24

larry_barrett
Valued Contributor

It is definetly possible. Set to ongoing and make sure you fill out the Self Service tab
42d5fb429c6c475dbabb560a9a387993

f9436032265e4e63a179f0a5c2a6a56b

View solution in original post

tcandela
Valued Contributor

@larry_barrett strange, i had the execution frequency to 'once per user', then 'once per user per computer' and it didn't appear until i set it to 'ongoing'.

why it only appears when using 'ongoing'?

larry_barrett
Valued Contributor

Well @tcandela if you're set to once per user or once per user per computer, you'd have to flush the entry for it to show up in Self Service again. Those frequencies only show up in self service if the policy has not been run (yet)

tcandela
Valued Contributor

@larry_barrett the policy was never run yet for any user and it didn't show up in Self Service until i set it to 'ongoing'. So there was nothing to 'flush'.

I wanted it at once per user or once per user per computer
so if Joe logs in he'll see it in self service and run it, next time he opens self service it won't be available
then if Andy logs into the same computer he should see it available for him to configure the dock.

so each user that logs into the computer should see it available, once they run it then it won't be available.

larry_barrett
Valued Contributor

@tcandela I encourage you to not "die on the hill" of once per user. In our mobile carts, we leave it in Self Service so anyone (teacher, para, kid) can reset the dock back to a default state. I understand you want it once per, but there's no benefit to doing it once. Alot of things can change your dock: unexpected containers (I'm looking at you Flash Player), random utility programs (like Disk Utility or Font book). If you don't account for those in your Dock Items, your mileage may vary... Include this bit of magic and set it to login/ongoing +available in Self Service (see attached).
f22c72ee21c94304a4ce6bb878a540f3

tcandela
Valued Contributor

@larry_barrett so the sleep 5; killall Dock just refreshes it with the changes?

so you have a separate policy that sets the Dock back to its default? (would below work in 'EXECUTE COMMAND')?

defaults delete com.apple.dock; killall Dock

so a total of 2 policies (change and reset to default).

Also, in the past i've always had issues with a policy that adds/removes Dock Items using the LOGIN as 'trigger'. It never has correctly added/removed what i had setup. Are you not having issues with LOGIN as a trigger when doing Dock policy?

larry_barrett
Valued Contributor

I only have the one policy set to login (see photo) and Ongoing. It doesn't work 100% of the time, specifically I have a hard time with webhooks on the dock. Occasionally I'll have to drag them back onto the dock from Library -> Application Support -> Configuration Profiles.

1be53d50857040dda1250235d7713255

efeac0b82b1146319fabd32002cb4983

As to your issues with the Login trigger, if you aren't running the code mentioned above ( sleep 5; killall Dock ) I wouldn't expect it to ever work. I don't know the answer to the defaults deleting bit, but you should totally share your results.

tcandela
Valued Contributor

@larry_barrett I thought this would change the Dock for that particular individual user. So if there is multiple users, running that self service policy will reset the Dock for everyone.

Do you have a policy to reset the Dock to the Apple default dock setup?

I did a new policy with execute commands = defaults delete com.apple.dock; killall Dock but it doesnt do anything. The Dock stays setup the way the previous policy set it.

I logged in as Administrator and ran defaults delete com.apple.dock; killall Dock from the terminal but it only set the Apple default Dock for this Administrator account, the user account that ran the Self Service policy still had the changed up Dock.

In a previous reply you said you had the Self Service policy stay ongoing just in case you wanted other users to set the Dock back to it's default. How are you doing it?

larry_barrett
Valued Contributor

Each users dock is independent. If you have it set to Login trigger, then yes, everyone's would be the same. If it's just in Self Service, for example, it would be up to the user if they wanted that dock or not. You'll have to be careful with your frequency if this is an "opt-in" type of setup. Again, to clarify, running the Dock Reset in Self Service only installs the dock for the logged in user, not computer-wide.

The way I'd do it is to make a separate policy and have a Dock Items entry with the default apps. To be fair, I've never tried to reset it back to the default dock. Testing on a Catalina 10.15.3 machine, defaults delete com.apple.dock; killall Dock worked for me. Make sure you capitalize Dock or it won't work.

tcandela
Valued Contributor

@larry_barrett everything you're saying is totally opposite from my results.

I have a Self Service policy basically removing all the Apple dock items and adding Office Word, Excel, PPoint, Firefox .......
so User1 runs the policy from SS and the Dock is set. When i login with User2 the Dock is set to the way the Self Service policy ran for User1. So it changes the Dock for everyone.

running the defaults delete com.apple.dock; killall Dock through 'terminal' works, but not if i use this command in the 'execute commands' section for Files and Processes payload.

where are you running defaults delete com.apple.dock; killall Dock from?

tcandela
Valued Contributor

@larry_barrett i just tested both ways 'login' and 'self service' no matter which way it changes the Dock for all users

larry_barrett
Valued Contributor

I'll post my entire policy. I can't replicate your error. Just in case, I'm on 10.15.3 with on Prem Jamf Pro.

A few things to keep in mind. Defaults is a command-line tool. For you to be able to use files and processes or a script, you will have to mimic the behavior of the Defaults program. Defaults basically lets you edit any .plist file, in my head this means you would have to nuke the plist file or something similar. com.apple.dock is in Library/Managed Preferences/User Name.

b374c6b907814046a229a8c0103eecaf

dfe5fb737d774bb6a0a6f1d99c54c76f

04b31ed47bf24ae893a87e675e3a9621

8bbaee16df6e4daf9b9872182634385d

769e0e1779264ea384cafeec71dea7f9

fb7b598681414d27a34bc29aa58417ab

ae6dfa45fb924c4fa18dfe83d7d9b25a

74da77f1acb5445c8c9648beb791a193

8eee6ae83ea3414cbb178077b18b2db4

5950be4dde084011904bccbd9838e049

5978df4528bb4cf0ac0f2dff1673ba5e

Also, if you use defaults delete com.apple.dock, the com.apple.dock file will be empty until you do one of two things: change the dock (think right click and remove from dock) or restart. Attempting to delete the file a second time will throw up an error since it's empty from your deletion.

Finally, here's screen shots of two different users on the same machine using the above policy. I don't know how you are achieving what you are achieving, but it's really interesting to me. Don't give up.

65900025f47a400d8a418ec595b779ea

655bbdb756db411680b2d543c0123345

tcandela
Valued Contributor

@larry_barrett easy to create the policy, but when run either on login or self service it changes the dock for everyone. Not sure how yours is not doing it.

User1 runs Self Service Dock policy and it changes (sleep 5; killall Dock i added). Login as User2 and it's the same Dock as user1.

I reset both user1 & user2 Docks by going to each and going to terminal (defaults delete com.apple.dock; killall Dock) and then flushing the policy and same thing. No matter what login or self service the Dock gets changed for not only the user that ran Self Service but also other user accounts.

Is your account with the default account a new account created maybe from AD login?

this are 2 local accounts already created, so they both exist at the same time.

larry_barrett
Valued Contributor

That might be it. Mine are AD accounts. I only have a hidden admin account and AD accounts, nothing local.

tcandela
Valued Contributor

@larry_barrett no doubt about it that's it. I have 2 local users that are both currently created. Once one of them runs the policy either via 'login' or 'self service' (tested both ways) it gets applied to user accounts currently existing.

larry_barrett
Valued Contributor

Well, thanks for coming to my Ted talk. Sorry we couldn't figure it out (yet).

dcae0d3bafad488f81c3482b7b7a2d81

tcandela
Valued Contributor

@larry_barrett It would be really stupid if this is how it works. And it's obvious it's how it does work.

larry_barrett
Valued Contributor

You're going to absolutely die.

e210824f8b184b55af9e4d16f87ea3ac

So, I setup two local accounts (I had to see it), set the dock via Self Service on Test1, restarted, logged into Test2 and the dock was different.

25ec5561e351417081e17ef1630a55c0

f2c1855f4b904188af9f2c1e7f4818b2

tcandela
Valued Contributor

@larry_barrett i'm not getting that result. I think i found the issue, i have the frequency set to 'once per user per computer', i'll change it to ongoing and test

tcandela
Valued Contributor

@larry_barrett no change with 'ongoing' or 'once per user per computer'. Dock changes apply to all

tested on Mojave

larry_barrett
Valued Contributor

I feel like, if you purge the policy logs and reboot you should be back to square one. Once per user per computer means everyone who logs in will get it. Try another computer? I really have no idea as I can't replicate your results. Catalina DOES change some dock items (new file paths, etc), but that's the only change I made from Mojave to Catalina.

f052fbaba64043d88df9a22729c58da8

larry_barrett
Valued Contributor

Just checked on a Mojave machine. I was able to reproduce your results. Its "fixed" in Catalina.

tcandela
Valued Contributor

@larry_barrett I just tried it on Catalina and get the same result. User1 runs policy in Self Service and gets thew new Dock configuration. I logged in with User2 and his Dock also got changed.

not sure how it's working for you.

larry_barrett
Valued Contributor

Yikes.

I'm running out of guesses over here. Can you post screenshots of your policy and the policy logs from the affected computer?

You've tried multiple computers right? Do these computer(s) have SIP enabled? Are there multiple policies modifying the dock or Managed Preferences?

My next guess? I'd flush all the policy logs, manually reset the dock to the OG dock settings, restart and try again. Unscope the policy and see if there is something else affecting the workflow.