St. Ignatius College Prep Tech Blog
SI's blog about technology
If you've run into the issue of the multi-port adapter constantly prompting to install drivers even after you've already installed the drivers (particularly annoying, since it requires a reboot), apparently the solution is to plug the power cable in through the multi-port adapter (instead of through a separate port). Worked for me that way.
Hat tip to Zak Nilsson on the MacAdmins Slack for making me aware of this fix.
AutoPkg is a cool project for Mac admins (in theory, Windows admins could use it, too, and there are even a few Windows recipes). Although it's a flexible framework that can be applied in many different ways, what it's most useful for is automating the tedious process of going to a website, downloading a new version of the software, and then importing that download into whatever you're using to push updates out to your Mac clients.
For a while, I was using existing recipes (there are many, so this is a totally valid approach), but eventually there was software I didn't see recipes for, so I started writing my own recipes. At first, I just started by copying existing templates and just modifying certain parts (the download URL, or the regular expressions to search for within the search URL).
Here are some things I noticed, in case you ever want to write your own recipes and run into these issues.
I ran into this issue where I was trying to purge the destination before unarchiving a .zip file, but it didn't seem to be working. Even though the archive_path and destination_path seemed to work fine without being in the Arguments dictionary, the purge_destination key wasn't registering until I put them all into the Arguments dictionary, as I should have from the start... so, remember to always put all arguments in an actual Arguments dictionary. Example:
When you're doing code signature verification on a disk image, you don't have to explicitly use the DmgMounter processor to mount the disk image. Instead, you can just treat the .dmg as a folder that includes the bundle to be verified. Here's an example (where %pathname% refers to the downloaded .dmg):
If you're not a regex expert, some of the regular expression searches for the URLTextSearcher processor may look like gibberish to you.
A few tips to help with that, apart from (or maybe in addition to?) reading up on all the details of the Python regex documentation:
On Wednesday, May 17, we will be screening Code: Debugging the Gender Gap here at SI. Students, faculty, and staff are all welcome to come, and the event counts as a GOYB!
After the screening, we will have a discussion with guest panelists from the industry:
Lin loves building scalable growth stories at early stage B2B start ups. Today, she works with engineers and data scientists to grow paying customers at SourceClear - a software security firm. Originally a STEM nerd from NYC, she never thought she would be leading growth strategies in Silicon Valley. Other: ran growth at Spigit - innovation software firm, over caffeinated as a Deloitte Consultant doing tech systems for Google, etc. Loves yoga, D3.js, and converting websites.
Monica has been at Google for the past 4 years as a Software Engineer on a number efforts, most recently on the Search team bringing features to emerging markets. Outside of the office, Monica runs a Girls Who Code club in Mountain View and works with Google.org to help local nonprofits improve their technical infrastructure. Prior to Google, Monica was a student at Cornell University where she studied Computer Science.
Katie is a Texas native, and graduated from the University of Texas where she studied Electrical Engineering. Katie has spent time in various tech roles such as designing high availability data-centers, to working on the wifi chips in your cell phones, and now in product marketing, helping tech companies better communicate their products to the world. She loves teaching Girls Who Code and hopes to inspire lifelong learning for girls in tech.
Managing client machines while also giving your users freedom to customize their machines as they want can be a bit tricky. On the one hand, you want to automate things as much as possible so users don't have to be bothered with too many update prompts and other maintenance nuisances. On the other hand, you don't want to automate things in a way that will confuse your users.
Jamie (our Dir. of IT) and I had a discussion about moving people from Microsoft Office 2011 to Microsoft Office 2016 and what that would look like. We didn't want to just uninstall Office 2011 right away, especially since it's the only thing MathType will reliably work with (in February, 2016, Design Science announced compatibility with Office 2016 for Windows, with a note that compatibility with Office 2016 for Mac would be coming "soon"—still hasn't come over a year later, as of this writing). And, even though installing Office 2016 side by side with Office 2011 makes 2016 the default for Office files, we wanted to update the Dock icons, so people would launch Office 2016 applications instead of Office 2011 ones.
These were the situations we thought we'd encounter:
The tricky thing about changing up Office icons in the Dock is that dockutil goes by name or bundleid to add, and both the name and the bundleid is the same for Office 2011 and Office 2016 applications.
So I wrote up a script that checks based on the dockutil --list output to see if the Dock icon is for 2011 or not. It may not work exactly for your organization, but you can see the logic in there, and it's easily tweakable.
So I came across something weird that's affected only my 10.12.4 clients (none of my 10.11.6 clients seem to be affected by this). Even though I have only one Safari profile enabled, which is set-once and doesn't manage the homepage, my 10.12.4 clients are unable to change the homepage in Safari manually. Whatever the homepage was is stuck like that. If you enter a new homepage in the Safari preferences, it will just not take and revert back to the old homepage once you hit Enter or click out of the address entry field.
The only workaround I've found for this is to delete all profiles (again, even though I don't have any profiles managing the Safari homepage):
Also, after testing on a couple of other clients, there do seem to be situations in which the Safari profile was never set at all, and you still can't modify the homepage, even after deleting any other profiles and rebooting, and it's not account-specific either (freshly created account experiences it, too). It's a real head-scratcher.
Starting with version 1, AutoPkg began evaluating trust info for recipes, so you could see what changes were made to a recipe (if changes were made) and then accept the changes if you wanted to. Here is what the typical trust verification workflow looks like.
Whether running a list of recipes via script or via AutoPkgr schedule, I'd occasionally get error'ed recipes when trust was broken, have to manually run
It's still in the early testing phase, but it seems to work so far....
Just a quick observation based on testing:
If you're in Guided Access mode on an iPad running iOS 9.3.5 (say, an older model that can't install iOS 10 and above), and you do a forced reboot (hold home and power buttons until the Apple symbol appears), the device stays in Guided Access mode.
If, however, you're in Guided Access mode on an iPad running iOS 10 (and perhaps in future versions?) and do a forced reboot, the device gets out of Guided Access mode.
P.S. I was able to use this to help a student out who was stuck in Guided Access mode on an older iOS version—updated it to iOS 10, rebooted, and then the iPad was out of Guided Access mode, and a new Guided Access mode passcode could be set.
Graham Gilbert created a pretty cool project called Crypt 2, which forces client machines to enable FileVault2 encryption, and then sends the recovery key to a Crypt Server.
So far the documentation on Crypt 2 is rather sparse, so this is what I was able to piece together based on the README, some asking around, and a lot of trial and error.
The server bit was tricky for me to figure out. I happened to have a Ubuntu 16.04 LTS server I wanted to try it out on, but the Ubuntu 14.04 and Ubuntu 12.04 instructions did not work for 16.04. I got this error when trying to run the command to get the requirements:
It seems a lot of people go the Docker route. I'm not really an experienced Docker user, but most of the instructions are fairly straightforward.
After you install Docker, you just pull Crypt Server:
There are ton of ways, apparently, to get the site more secure. Since I'm most familiar with using Apache, I just put in a :443 VirtualHost entry with
Once you have that set up, go to https://SUBDOMAIN.MAINDOMAIN.COM and log in with admin and password, and then immediately change the password to a new one.
You'll then have the option to add other users with various types of permissions.
The Crypt 2 client is a standard .pkg you can deploy with whatever you're using to manage your client machines. You can configure your clients' Crypt 2 preferences before deploying the .pkg.
When the user who's okay to enable encryption (one not in the SkipUsers array) logs in, a window will pop up that says This machine must be encrypted. It will reboot shortly after clicking continue.
Crypt will write a file to /var/root/crypt_output.plist with values for EnabledDate, EnabledUser, HardwareUUID, LVGUUID, LVUUID, PVUUID, RecoveryKey, and SerialNumber.
After that, probably nothing will happen for some time. Crypt 2 runs a Launch Daemon that invokes /Library/Crypt/checkin every 900 seconds (15 minutes). After around that time, you should see the client machine show up in the web interface the admin sees.
If you click Info...
...and then Info / Request...
...and then Retrieve Key...
... you should be able to see the recovery key.
You may have to ask permission of yourself to view the recovery key (presumably if you have users with different permission levels, a user with lesser permission would ask an admin user for temporary permissions to view the recovery key).
This isn't a comprehensive list:
Update: The instructions below will be obsolete once Munki 3 is released. More details on the Munki 3 implementation can be found on the Munki wiki.
createOSXinstallPkg is a great project for making an Apple macOS installer into a .pkg you can deploy with Munki.
Apple did some things to break that process for 10.12.4. People are in the process of finding workarounds for it.
One option is to use the built-in startosinstall tool that comes with the installer bundle.
If you import the bundle into Munki, you'll want to have both a preinstall_script and a postinstall_script.
The preinstall_script checks to make sure there aren't other updates pending, since startosinstall will run its own reboot independent of Munki. The pending updates should be 1 (it's the only 1) or 0 (it was part of a set of updates that did complete and then the pending updates cleared, and you're trying again):
P.S. There is now a recommendation on the createOSXinstallPkg README to upgrade using 10.12.3 or investigate using startosinstall.
P.P.S It's possible, instead of my funky workaround with the preinstall_script, that you could use the --pidtosignal option instead with Munki. Here's an example using JAMF.
P.P.P.S. Looks as if Greg Neagle has started working on integrating startosinstall into Munki "natively"—yes!
We used to have students come in and say they'd accidentally unsubscribed from an important school mailing list and needed to be resubscribed. This confused us, because we didn't think students could unsubscribe themselves. Turns out not only can they (click on the arrow at the top of the email and then select Unsubscribe from this mailing-list), but we contacted Google directly, and they confirmed there isn't a way for Google Apps admins to prevent users from unsubscribing (and apparently this issue goes back at least as far as 2012, if not longer).
I get that people in general should be able to unsubscribe from mailing lists, but this is a controlled environment. These are email addresses provided by the institution (school, organization, company) and so the institution should be able to decide what mailing lists its own employees and students are on, right? Well, apparently not.
Fortunately, we don't have a ton of people who make it a habit of unsubscribing themselves from mailing lists. Most of the time when students do unsubscribe, they soon realize they're missing important messages, and then they ask to resubscribe.
Nevertheless, it can be handy to find which students are unsubscribed from the lists they should be subscribed to.
This is something I thought GAM should be able to handle, and I even got some suggested commands from another Mac admin. Unfortunately, I couldn't get gam to work. I followed all the instructions and still ended up with this error, no matter how much "coffee" I got and despite enabling access to the suggested scopes:
I started looking into Google Apps Script, which is pretty cool, except the documentation isn't comprehensive enough to suggest all the steps involved to find unsubscribed users.. For example, there isn't any documentation on how to construct a query that has two parts to it. Frankly, I couldn't even find official Google documentation on how to include a query—I had to find that on Stack Overflow.
In addition to missing pieces in the documentation, Google Apps Script also suffers from arbitrarily imposed limits to what you can do. For example, you can't fetch more than 500 user records at once. Also, even though there's a function to check if a user is a member of a group, if you run that in a loop over several hundred users at once, you'll get this error:
I played around with scripting putting users back into groups, but it gave uneven results (some of that was our own fault—we had a couple of users in the incorrect organizational units, but it also seemed to sometimes not actually put users in groups successfully).
So ultimately, I didn't script this in the "ideal" way (due to limitations put in place by Google), but the script basically works. For each grade level, it will find all the students who aren't suspended users, put them into an array, find all the members of the appropriate mailing list, and then take each of those members out of the original array. Anyone still left in the array is potentially unsubscribed to a list she should be subscribed to.
Finally, an email is sent to specified recipients to let them know either everything's okay or something has to be investigated. You can script this to run every day or every week and then make fixes yourself afterwards.
I also found one quirk to Google Groups. There was one student I had trouble adding back to a group. It would seem I could add the student in the admin console, but then the student still wouldn't be added (no error message). It was only when I went to Google Groups itself (not the admin console) and tried to add the student directly that I saw a message saying I couldn't add the student because the student already had an pending request that needed approval (the student had asked to re-join the mailing list). Once I approved that request, the student was back in.