Configuring Workgroup Manager and Google Apps

[kcalderw]

'm having an issue with a permissions error on our managed Macs using Google Drive. I installed GD and added the permissions for it in Workgroup manager. The issue is the updater program 'ksadmin' gives a permission error. I haven't found a way to allow ksadmin or even to delete it. From what I saw online it says to delete the ksadmin file under ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ however this directory does not exist. I also added this folder to the WGM whitelist but still no change. Any other ideas? The permission error comes up constantly.

Reply Unsubscribe

[stevehp]

I use these two whitelist entries to allow the updater to run

 

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateAgent

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin/

 

Watch your usage of WGM it's been to the chopping block for the next OS release. If you wish to update clients or servers to this version you have no choice but to use Local MCX or an MDM solution such as Profile Manager to make the types of settings changes you're doing now in WGM.

[kcalderw]

Thanks Steve. Yep I'm aware that WGM is a dead dinosaur. However, I just started in this position two months ago and unfortunately don't have the time to make a transition to something new. I'll be working this year on getting a server up and moving over to AD. I'm coming from an almost completely PC based environment to a 98% Mac environment here. Is there a way to manually enter the folders into WGM or do I always have to browse for them?

 

Also, I'd like to deploy Chrome to all of our machines. Can I install it to all machines from within WGM or do I have to go to each machine?

[stevehp]

No you don't have to browse to them. What you have to do is ensure you are managing Applications by choosing Always and clicking Apply Now. Click done then above the preferences list you'll see two buttons one is called Overview and the other is Details, click on Details. You'll see that any preference you have enabled will have an arrow pointing slightly to the left. Look through your list and find com.apple.applicationaccess.new and double click on it. You'll see three entries called: Once, Often and Always. On Always click on the disclosure triangle to the left of the text to drop it down. The key you need to modify is called pathWhiteList-Raw. Highlight it and you'll see that New Key in the upper left hand portion of the window has been enabled. Click on New Key once to add an entry and one will populate with a 0 the type will be string and the value is empty. You need to type or paste in your path in the value field.

 

NOTE: Watch your usage of the delete key as it has a negative affect of deleting your entry instead of the text. So if you need to edit the text you're typing in the value field it's best to use your mouse to highlight the text and overwrite it with your corrections.

 

WGM doesn't really have a mechanism for software deployment. If you have a spare OSX powered machine lying around you can use something like Munki. I use it and I highly recommend it. The machine doesn't need to have osx server software on it, but for ease of configuration it might be useful. You will need to do some work in Terminal to get it working and for most administration tasks, but the prompts are mostly easy to understand. If you don't have the spare hardware and have plenty of drive space on your current server then you can use it as well.

 

munki - Managed software installation for OS X - Google Project Hosting

 

If your client numbers are small then it would probably be easiest to install it manually on each one.

 

Another option is to obtain a copy of Apple Remote Desktop. For small installations of servers and clients it will help out a great deal.

Edited August 28, 2013 by stevehp

[kcalderw]

All our machines have ARD on them. Can I deploy software using that? I couldn't find a software package for Chrome.

[Arthur]

I couldn't find a software package for Chrome.

This should help...

 

Deploying and Managing Google Chrome: The Rough Guide « Krypted

[stevehp]

All of your machines do? Or are you mistaking the ARD client for the Admin software? The client software is baked into the OS, but the actual Admin software is a 79.99 app on the Mac App store.

 

For ARD usage if you download the dmg file from Google then open it you can drag the Google Chrome.app file from that and use that with ARD.

[kcalderw]

Yes sorry, like you said all our machines have the client software. I have the ARD admin software on my machine.

[kcalderw]

I use these two whitelist entries to allow the updater to run

 

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateAgent

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin/

 

Watch your usage of WGM it's been to the chopping block for the next OS release. If you wish to update clients or servers to this version you have no choice but to use Local MCX or an MDM solution such as Profile Manager to make the types of settings changes you're doing now in WGM.

 

I tested one of our lab machines logged in as a faculty member. I added those two entries to the Lab computers and faculty workgroup, yet I'm still getting the ksadmin error.

 

 

BTW: I was able to deploy Chrome via ARD by creating a Chrome package. I followed the instructions found here: https://groups.google.com/forum/?hl=en#!topic/macenterprise/noFKRCn45-k

Edited August 29, 2013 by kcalderw

[stevehp]

Ensure you also have in your allow list:

/Library

/Applications

/System/Library

 

You can also try putting in the root of the user library folder as well, it's ~/Library .

[kcalderw]

If I add /Applications, won't that give them access to all Applications?