Where do I place a script that runs after imaging?

[mpittcasd]

We have a script setup that prompts to enter a new computer name. It runs after login after imaging, and the account logged in is the local admin group that is setup somewhere in the process. I am trying to make a newer image that functions the same way as the existing one, but I'm not sure where to place this script. It is placed in Applications/Utilities after image and I believe is removed after it runs.

Sorry if this is a basic question. I have tried reading the documentation and doing some searches but I am having trouble understanding the way imaging for the Macs works and unfortunately no one else here knows.

[hkim · Accepted solution]

You maybe able to run the script using Casper Imaging and using the "at reboot" option but depending on what your script is trying to accomplish, you may just need to tweak the script. Computer names are can be set using Casper Imaging itself.

Larger discussion, what is the purpose of the script, how does it work, and why is it needed?

[hkim · Accepted solution]

Sounds like a bigger problem than simply trying to get a first boot script to self destruct. You may want to reach out to the person who did the work and strangle him or her for lack of documentation / training. If that fails, JAMF does offer professional services exactly for this kind of thing.

http://www.jamfsoftware.com/services/

[Hobbs155 · Accepted solution]

Adam why not start with a new configuration in Casper Admin and add things they way you want them and start from a clean configuration, that way as you add and get the configuration right you know exactly what is going on and where.
I would let CasperImaging do the computer naming.
As a starting point i would follow the knowledge base article to create a new clean base image. https://jamfnation.jamfsoftware.com/article.html?id=313.
Create a new configuration and add your clean base image.
* Create a smart configuration based on your new configuration and add install software packages.

We recon all new macs and then assign them a configuration, Capser Imaging will name the computer everytime its imaged so when it boots up its all done for you.

[talkingmoose · Accepted solution]

Renaming a Mac after it's been imaged is an odd thing to do considering it can be named during the imaging process. If the script only renames the computer I suggest scrapping it and letting Casper handle the naming. If you're not sure what else the script does then maybe you could post it and someone here could help interpret it.

Inheriting someone else's environment is not easy.

[blackholemac · Accepted solution]

agreed on inheriting someone else's environment. I'll confess I'm a control freak and that I have had the luxury of designing ours mostly from the ground up on the Mac and Casper side (not so much on the AD side).

Anyway, I may have a simple idea for you to run that script. I have what I call my "payload-free environment package" that runs at the very end of first boot imaging that sets all of my System Prefs on the unit the way that I want them. What I might suggest if you want to "just run the doggone thing as is" is to use either Package Maker or Composer to create a payload free PKG package, write a postinstall script for the package (You could copy the syntax of your existing script verbatim if you need to into the postinstall script.) that does everything you need it to do and string the resulting package to the end of your Casper configuration as a first boot package.

But that being said, I'll agree with the folks though on stepping back and looking at the bigger picture...no one likes running a script that they aren't quite sure if it's needed or know what it does. Before trying this consider everyone's advice on here along with your own gut, or if you are unsure, consider hkim's suggestion of contacting Casper for some consulting. I'll let you know that everyone I've talked to at Casper knows their stuff and its probably worth it.

[mm2270 · Accepted solution]

Looks to me like this whole thing was designed to set auto login and the app would load up, seeing that the computer name wasn't set and asking for a name, then installing the Casper QuickAdd.pkg (which seems to be embedded inside the AppleScript app itself) to enroll the Mac into Casper and finally cleaning itself up and also writing an entry into a plist file indicating the Mac had been successfully named.
I suspect there is/was some other piece to this setup that would read that plist setting at some point and either set the auto-login and app to run at login or something to that effect.

Its a little risky to state, but from everything you've shown us, it sounds like this entire thing can be replaced directly within Casper Imaging. The only thing I'm unclear about it is, is there a certain need to have the Macs imaged with no name and a name get assigned once it reaches an end user? Perhaps, but personally I wouldn't feel too comfortable with having end users or even technicians for that matter naming the Macs manually. Unless you're OK with Macs named wrong or inconsistently, it doesn't sound like a grand idea to me.

[donmontalvo]

One time launch daemon to kick off a self imploding script (unload launch daemon, then delete itself)? :)

Don

[mpittcasd]

Would a plist like this work to start it?

<dict>

    <key>Label</key>

    <string>com.example.rename</string>

    <key>ProgramArguments</key>

    <dict>

        <key>com.example.rename</key>

        <true/>

    </dict>

    <key>Program</key>

    <string>/Applications/Utilities/Rename Workstation</string>

    <key>RunAtLoad</key>

    <true/>

</dict>

[hkim · Accepted solution]

You maybe able to run the script using Casper Imaging and using the "at reboot" option but depending on what your script is trying to accomplish, you may just need to tweak the script. Computer names are can be set using Casper Imaging itself.

Larger discussion, what is the purpose of the script, how does it work, and why is it needed?

[mpittcasd]

All this script does it rename the computer as far as I can tell.

When I was shown how to image it was only the easy install option and I was told to leave the computer name empty. I'm not sure if it has anything to do with other policies that run. Would it be easier to name the computer and set any applications that need installed in Casper Imaging as opposed to doing the easy install option and installing the software after with JSS policies?

The JSS was set up right before I started and from what I was told the person that came to set it up for us created the image and didn't really explain how to make a new one or what they did to make the one I have. So now I'm left to find out myself without any idea of where to start.

[hkim · Accepted solution]

Sounds like a bigger problem than simply trying to get a first boot script to self destruct. You may want to reach out to the person who did the work and strangle him or her for lack of documentation / training. If that fails, JAMF does offer professional services exactly for this kind of thing.

http://www.jamfsoftware.com/services/

[Hobbs155 · Accepted solution]

Adam why not start with a new configuration in Casper Admin and add things they way you want them and start from a clean configuration, that way as you add and get the configuration right you know exactly what is going on and where.
I would let CasperImaging do the computer naming.
As a starting point i would follow the knowledge base article to create a new clean base image. https://jamfnation.jamfsoftware.com/article.html?id=313.
Create a new configuration and add your clean base image.
* Create a smart configuration based on your new configuration and add install software packages.

We recon all new macs and then assign them a configuration, Capser Imaging will name the computer everytime its imaged so when it boots up its all done for you.

[talkingmoose · Accepted solution]

Renaming a Mac after it's been imaged is an odd thing to do considering it can be named during the imaging process. If the script only renames the computer I suggest scrapping it and letting Casper handle the naming. If you're not sure what else the script does then maybe you could post it and someone here could help interpret it.

Inheriting someone else's environment is not easy.

[blackholemac · Accepted solution]

agreed on inheriting someone else's environment. I'll confess I'm a control freak and that I have had the luxury of designing ours mostly from the ground up on the Mac and Casper side (not so much on the AD side).

Anyway, I may have a simple idea for you to run that script. I have what I call my "payload-free environment package" that runs at the very end of first boot imaging that sets all of my System Prefs on the unit the way that I want them. What I might suggest if you want to "just run the doggone thing as is" is to use either Package Maker or Composer to create a payload free PKG package, write a postinstall script for the package (You could copy the syntax of your existing script verbatim if you need to into the postinstall script.) that does everything you need it to do and string the resulting package to the end of your Casper configuration as a first boot package.

But that being said, I'll agree with the folks though on stepping back and looking at the bigger picture...no one likes running a script that they aren't quite sure if it's needed or know what it does. Before trying this consider everyone's advice on here along with your own gut, or if you are unsure, consider hkim's suggestion of contacting Casper for some consulting. I'll let you know that everyone I've talked to at Casper knows their stuff and its probably worth it.

[mpittcasd]

Thanks for the input everyone.

I have looked at creating a base image KB, and have got that part down, as well as getting the configuration setup within Casper Admin.

I was examining the script more closely yesterday, I guess it is an application that was made in AppleScript Editor. It's purpose appears to be to name the computer and change the login options so that the admin account doesn't automatically log in. I'll post it below. I'm not sure if it has anything to do with the AD binding or not, since I don't think the recent imaging I've done with my new image has shown the computers in Active Directory, but they are bound so that I can log in to them with my network accounts at least.

Right now I am trying to find out who to contact. The person I inherited this from is trying to find the emails from who set up the JSS and images for us, or deciding if I should contact the Apple engineer we've worked with before who has also helped but I'm not sure in what capacity.

set myFullPath to (path to me) as string
set myFullPath to POSIX path of file myFullPath
--display dialog myFullPath
set ComputerName to ""
repeat until ComputerName is not "" and (count of ComputerName) is not greater than 15
set ComputerName to do shell script "scutil --get ComputerName"
display dialog "Please enter a computer name up to 15 characters:" default answer ComputerName
set dialogResult to result
set selectedButton to button returned of dialogResult
get selectedButton
set ComputerName to text returned of dialogResult
if ComputerName is "" then
display alert "This value cannot be empty"
end if
if (count of ComputerName) is greater than 15 then
display alert "The name cannot be greater than 15 characters"
end if
end repeat

if selectedButton is "OK" then
do shell script "scutil --set ComputerName " & ComputerName with administrator privileges
do shell script "scutil --set LocalHostName " & ComputerName with administrator privileges
do shell script "scutil --set HostName " & ComputerName with administrator privileges

-- delete an existing rename plist
try
do shell script "rm -Rf /Library/Preferences/com.apple.eduaps.rename.plist" with administrator privileges
end try

--write the plist file
do shell script "defaults write /Library/Preferences/com.apple.eduaps.rename MachineRenamed -bool TRUE" with administrator privileges

-- cleanup autologin if configured
try
do shell script "defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser" with administrator privileges
end try
try
do shell script "defaults write /Library/Preferences/.GlobalPreferences com.apple.userspref.DisableAutoLogin -bool TRUE" with administrator privileges
end try
try
do shell script "installer -pkg " & quoted form of myFullPath & "Contents/Resources/QuickAdd.pkg -target /" with administrator privileges
end try
try
do shell script "rm -Rf " & quoted form of myFullPath with administrator privileges
end try
try
do shell script "rm -Rf /etc/kcpassword" with administrator privileges
end try
tell application "System Events" to restart
end if

[mm2270 · Accepted solution]

Looks to me like this whole thing was designed to set auto login and the app would load up, seeing that the computer name wasn't set and asking for a name, then installing the Casper QuickAdd.pkg (which seems to be embedded inside the AppleScript app itself) to enroll the Mac into Casper and finally cleaning itself up and also writing an entry into a plist file indicating the Mac had been successfully named.
I suspect there is/was some other piece to this setup that would read that plist setting at some point and either set the auto-login and app to run at login or something to that effect.

Its a little risky to state, but from everything you've shown us, it sounds like this entire thing can be replaced directly within Casper Imaging. The only thing I'm unclear about it is, is there a certain need to have the Macs imaged with no name and a name get assigned once it reaches an end user? Perhaps, but personally I wouldn't feel too comfortable with having end users or even technicians for that matter naming the Macs manually. Unless you're OK with Macs named wrong or inconsistently, it doesn't sound like a grand idea to me.

[mpittcasd]

As far as I know, all of it was created to be used along with Casper Imaging. The more I look into it, the more it seems that I can take care of it all during the imaging process. I know of no reason for them being imaged with no name other than that is what I was told to do; I would just like to test some more to make sure everything shows up in and binds to Active Directory without issues. We have a standard naming scheme but I'm also the only person responsible for the Macs right now, so the names should be consistent if nothing else.

Is there a way to mark more than one reply as an answer? Everyone has been so helpful.

[mm2270 · Accepted solution]

You can mark as many replies as you want as the "answer" There is no limit as far as I know.

[jimlee]

NM just saw your script posted.