Quickpost Last week, a set of tweets from Tyler Loch shed some light and hope on the quest to get an APFS boot volume going prior to Apple officially making it an option in a future macOS 10.12 version. After the fourth 10.12.4 beta was released I decided to try my previously failed attempts again, following Tyler’s hints to help me along. I was finally successful, so to help others wishing to…
Mac AD UK 2017 slides are available Another fantastic edition of the Mac Admins and Developers UK Conference (or MacADUK 2017 for short) has come to an end. With an improved venue and great speaker lineup I very much enjoyed meeting up with and speaking to fellow Mac admins to hear their stories and learn from them. My talk this year focused on the changed landscape in security for Mac admins. No…
Introduction Since iCloud calendar spam suddenly appears to be a thing and a bunch of folks both asked me about it and offered possible solutions I whipped up a quick infographic on how to deal with it, or at least how to make it less annoying by being able to filter it. What’s this anyway? By default iCloud automatically adds calendar invites to a user’s pending events list, generally a good…
Introduction After this past weekend’s kext-ageddon it once again became clear that Apple seems to have a problem with QA when it comes to OS X, as discussed on this week’s Accidental Tech Podcast episode. While there are many areas of OS X where poor QA will likely go unnoticed by users until a later update fixes whatever QA missed, Apple has been unfortunate as of late with the specific areas of…
Introduction A question came up in the Mac Admins Slack #general channel regarding skipping the Wifi setup pane in Setup Assistant. The user “tuxudo” wondered if any methods exist to skip the Wifi setup pane during a Setup Assistant run. The main use for suppressing the Wifi setup pane is to avoid confusion when deploying Macs that lack active wired networking and receive their Wifi configuration…
Introduction Apple has been heavily promoting the use of its Device Enrollment Program (DEP henceforth) for almost two years now since its introduction in February 2014. The promise of the program is “zero-touch” deployment of iOS and OS X devices directly to the customer, bypassing the common pitstop with an IT department for the required initial setup and preparation of the device before passing…
Just the facts? Go here! Introduction With each annual iteration of OS X Apple improves the capabilities of its tightly integrated MDM, DEP and VPP trinity which has also made it increasingly compelling for Mac admins to take a look at what these management options could mean for them. While an admin may be quite content with an all-OSS setup incorporating thin imaging and Munki, the potential of…
Introduction Based on a user request a question came up today regarding disabling the automatic Spotlight indexing of network volumes. While users can manually add local and network volumes to the Spotlight Privacy exception list this is not a very obvious process and it requires a tech to walk them through the process, usually more than once. When left unconfigured, Spotlight and its mds family…
The slides for the two talks I gave at this year’s PSU Mac Admins Conference are now available as PDFs at these links: Free your Netboot server with BSDPy Connect the dots with Docker Thanks to all attendees that showed up for either one or both of my talks, hope to see you all again next year!
Pardon the pun, but I’ve been meaning to use that Shamen reference ever since MDM became A Thing. It is not for a lack of Mobile Device Management solutions that I wanted to figure out the process of setting up my own MDM server of course. Quite the opposite as there are many vendors out [there] (https://meraki.cisco.com/solutions/mobile-device-management) offering MDM solutions with varying…
As we have been ramping up the BSDPy coverage in our environment it became clear that it was spending a lot of its time making API calls for clients that were checking in and not getting enough time to respond back to clients with boot acknowledgments. To offer some background to this problem the following are the steps that the BSDP client and server go through in the process of successfully…
With Spring on its way into Summer so does approach the conference season. The 2015 season promises to be busier than ever, so busy in fact that Mac Admins are having to make decisions on which conferences to skip this year because there’s so many to choose from. Exception to the rule is probably WWDC, for which one needs to have won the ticket lottery to attend. If you entered and won a ticket, I…
A recent update to AutoNBI , a tool I wrote to automate the creation of custom Apple NetInstall images (NBIs), expands its customization abilities. So far an admin has been able to essentially forklift a custom folder into the NBI, as explained quite nicely by Graham Gilbert in recent blog posts here and here . The immediate use for this is to replace the “Packages” folder on a standard NetInstall…
TL;DR - Update to Box Sync for Mac 4.0.6035 immediately. The app exposes several sensitive bits of data like API keys, internal user IDs, URLs and passwords. Read on for details. The trouble with Box Sync Recently I revisited the convoluted mess that is the Box Sync application for Mac. If you are a Mac Admin in charge of even a small deployment environment you probably know how tedious it is to…
Note: this post was updated with additional security concerns regarding Git and the method of installing the required tools needed for compiling the PAM module. Thanks to @marczak and @Magervalp for the feedback. Two-factor authentication (2FA) is fairly mainstream these days, which is a good thing. It would be nifty if Mac Admins could add the increased security 2FA offers to remote (SSH) logins…
I spoke at MacTech Conference 2014 about Docker earlier this week, the slides for which are now up at https://db.tt/mSWzOHnb In the talk I cover Docker and application containerization specific to Mac admins. The content is purposely not an all-encompassing dive into Docker but aims to introduce Mac admins to the concept of containerization and how it makes their lives easier deploying Mac…
Introduction With the release of Oracle’s Java 7 Update 51 came heightened security measures that affect unsigned and self-signed Java applets. At its standard “High” security setting the Java web plugin and standalone JVM will refuse to run unsigned or self-signed applets unless they have been explicitly added to a user-level whitelist which is a newly added security feature in Java 7 Update 51.…
Inspired by recent Auto - events I decided I was tired of having to manually roll hardware-specific NetBoot images, such as we’ve had to do recently for both Mountain Lion and Mavericks releases. It took me a while to spelunk into the innards of System Image Utility and its related frameworks and tools but I feel that I was able to write up something half-decent for it. With that said, please take…
Is your organization using those really shiny and fancy Konica Minolta multifunction printers? Did your users start upgrading to Mavericks only to find that none of the custom functionality menus (courtesy of KM PDE s) were available in the Print window? Try this workaround to make them show up again in the print dialogs of sandboxed apps (Preview, TextEdit). Note that the script can easily be…
Recently I’ve had to rebuild our customized NBI NetBoot images a number of times due to special OS builds (yay) and needing to test Mavericks DPs. In that process it became obvious that it’s easy to make a mistake adding certain resources, deleting others and making sure that the resulting DMG is resized afterwards. I don’t know about you, but if I have to repeatedly and manually run a bunch of…
I recently casted pod for the fine folks at AFP548 and had the privilege of talking to the esteemed Charles Edge for an hour and change. Go check it out here . Thanks to Charles and Allister for their direct involvement and the AFP548 purveyors at large for having me. It was a blast! Edit: if iTunes seems wonky, this is the direct link to the episode on SoundCloud.
First of all I want to thank all those brave souls who stuck around until this year’s conference’s bitter end to come to listen to me talk about Munki, Munkiserver, Puppet and the combination of the three. The video of mine and other speaker’s sessions can be found on the PSU Mac Admins YouTube page somewhere in the latter part of June. After some minor modifications (thanks @Allister) I have…
Update : since the details that we received did not line up with Creative Cloud Enterprise features I asked for verification from our vendor whether we were given details about the CC Enterprise product and whether it was given by an Adobe rep. Neither were the case, so I am modifying my post to instead outline the details of the Creative Cloud for Teams program for those SMB admins who are…
Brandon Penglase wrote up a very helpful wiki article on his site outlining how to configure ISC’s DHCP server to serve multiple NetBoot images as opposed to the single image, methods for which have been available for a number of years now. Noted caveats are that Startup Disk will not be able to display the available NBIs as it uses a custom port to receive the list of images back and the…
After an earlier Twitter exchange with @golby today I realized that as of the SP2 VL version of Office 2011 Microsoft has removed Communicator 13.x (also known as Communicator 2011 for Enterprise ) in favor of their current Lync for Mac 2011 application, version 14.0.2. This is an important change for those on both sides of the Lync-coin: if you didn’t upgrade to Lync from OCS yet, you will now…
With the release of the recent Microsoft Office for Mac 2011 SP2 update a new and unwelcome feature was introduced to Mac admins deploying Microsoft Office 2011 updates with patch management solutions such as Munki, Casper or Absolute Manage: zombie mode . For reasons not entirely clear to anyone (including the Microsoft MBU folks themselves) the PKG install of SP2 causes Munki’s Managed Software…
Originally posted as reply to Greg Neagle’s post regarding his very helpful tool to fix PKG installers with expired certs, this deserves some attention as it has the potential to be quite a bit faster because it doesn’t do a full unflatten/flatten run on targeted PKGs: https://github.com/etrepum/strip_pkg_signature Go check it out.
While troubleshooting some policy behavior using Centrify DirectControl 5.0.2 on a test Mac I found myself sorely missing the Centrify-native version of “gpresult” . Centrify implements “adgpupdate” which behaves much like its Windows counterpart but in order to look at applied policies one is left tool-less. Luckily all retrieved and applied policies can be found on the local filesystem, and…
Courtesy of Heig Gregorian, munkitools 0.8.2 Build 1459 (and later) now has the ability to add custom conditional item entries using your favorite scripting language (Ruby, Python, bash). It does this by executing compatible scripts in /usr/local/munki/conditions to write key/value pairs to the newly added ConditionalItems.plist which lives in the Managed Installs directory, /Library/Managed…
Nick McSpadden wrote up a helpful step-by-step guide on how to configure Firefox 10 ESR using CCK Wizard while nixing any and all user-facing notifications. The attentive reader will notice that it takes quite a few steps to get to where you want to be with Firefox. Mozilla is not doing any Enterprise/Edu admin any favors with this added complexity.
Being able to boot Mac OS X from a DMG has been possible since 10.5 but Apple has only recently started to use it with the Lion installation process where BaseSystem.dmg is used as the system boot volume. There are situations where this could come in handy, for example to create a Rescue partition-sans-partition for 10.5 or 10.6 systems, or to upgrade 10.5 users to Snow Leopard without needing…
Opinions are plentiful and often wrong, so I never blogged anything. Having enjoyed a fair amount of tech-oriented blogs over the years I’ve come to appreciate them for providing both quickly jotted down notes and elaborate technical writeups . With that purpose in mind I’m going to start writing down some of my own notes and findings, if only to save them for future reference. In the process…