Delete all student keychains?

[kcalderw]

I updated all student passwords this summer, and now I need to delete all their keychains rather than have them update the passwords in their current keychain. All home directories are stored on a windows server. Anyone ever have to do this? I'd rather not have to do it manually for 350 accounts.

[Carter]

You could run a command but are you looking to wipe out a particular users keychain? If it's the same user or default user profile this is very simple to send out one command to fix your issue in seconds. If you are looking to remove the keychain for multiple users then this could be time consuming unless you can create a script to look for the file/folder.

[kcalderw]

I'm looking to delete all student keychains but like you said it might be too time consuming now.

[AntonioRocco]

You could use the asterisk wildcard. Something like this:

 

sudo rm -Rf /The Volume Name/The name of the share containing all the student home folders/*/Library/Keychains/*

 

Should save you having to visit each individual folder? But before doing any of this some words of caution! The ‘rm’ command is a very dangerous command to use in the wrong hands and before using it take appropriate precautions first. Such as:

 

(1) making sure you have a fully working backup of all the data first, (by fully working I mean do a test restore)

(2) making sure you test the above on at least a handful of test accounts you don’t particularly care about

(3) so as you don’t get ‘lost’ it might be best to navigate to the desired directory first

 

For example: if the volume name is 'NAS Drive' and the share/folder name containing all the student home folders is named 'Year 12'.

 

cd /NAS\ Drive/Year\ 12

 

Followed by a carriage return followed by:

 

sudo rm -Rf /*/Library/Keychains/*

 

The first wildcard is for the student's name and the second one is for all of the contents of the Keychains folder. Obviously don’t blame me if you get this wrong! Try to have at least more than one back-up in case the first one goes bad for some inexplicable reason.

 

NB: When using the sudo command you must key in the administrator's password which you won't see being typed.

 

Antonio Rocco (ACP)

Edited September 22, 2015 by AntonioRocco

[slancaster]

we have a shell script for this, i'll ask the techy that made it for the code. We "zap" all user libraries and keychains on occasion.

 

We actually set a logout hook to delete a students keychain as this stops loads of problems with password changes.

[kcalderw]

Can you share the logout hook? I can run it in WGM.

[slancaster]

No probs, we use a symlink via custom settings in Profile Manager. Off top of my head, you need to add this to the MCX.Redirector settings in WGM.

 

Screen shot from profile manager, under the students user group, but I believe the syntax to be the same:

 

We also use symlink commands to delete certain problematic folders (such as Chrome settings) and to redirect caches and big traffic (e.g. emails).

 

[kcalderw]

I redirect caches as well but what are you deleting with Chrome? I've been noticing issues with Chrome taking forever to open with students, yet Safari pops open in a flash.

[slancaster]

Chrome had more problems closing than opening with us, I think its our SAN.

 

local redirect at login login

~/Library/Application Support/Google/Chrome/Default/

~/Library/Caches

 

we used to delete some files on logout, but I think the local redirects above seem to sort issues we had.

[kcalderw]

Does this cause any issues for staff moving from their classroom computer to a lab?

[slancaster]

Not from my experience.

Their keychain should retain passwords (we only clear student keychains), but the local redirect means they may have to sign in to Chrome and "link data" the first time they run it on a new machine. Our staff only tend to use a handful of computers, mainly just their teaching desktop. The local redirect for us prevents strange permission issues in the working folders for Chrome and the redirect makes it work great.

[kcalderw]

OK great thank you, I'm going to test that on a few machines to see how it goes. We've run into the dreaded bug with Safari of Google Drive not loading their files and Chrome taking forever to load. So right now we're in a bit of a bind as a Google school.

 

Here is my current setup for students:

 

https://drive.google.com/open?id=0B5WwyYQ7JxrsQ0dXeVhDSkFuYzA

 

Edit: Oops changed the new Keychain entry to show as /tmp/%@/Library/Keychains

Edited October 20, 2015 by kcalderw

[slancaster]

we've got the safari and drive problem too. Seems fine for Classroom, docs etc but Drive just won't load. Any thoughts on what it is?

[kcalderw]

No idea, I wish I knew. Apple and Google are both pointing fingers but this is happening all over.

 

BTW, can you post a screenshot of your redirect settings? I want to see how the Chrome path is set locally.

[slancaster]

Np, the path we redirect is ~/Library/Application Support/Google/Chrome/Default/ to a local folder called "Movies". This local folder started off as our iMovie local store but is now also used for general local redirects.

 

I created the folder originally using terminal with the below commands (this folder is on our base image):

 

Make movies folder 1

sudo mkdir /Movies

 

Make movies folder 2

sudo chown root:admin /Movies

 

Make movies folder 3

chmod 1777 /Movies

 

NOTE THAT THE SCREENSHOT BELOW DOESNT SHOW THE FULL PATH OF THE CHROME DIRECTORY. It is ~/Library/Application Support/Google/Chrome/Default/

 

[kcalderw]

But is that folder able to be browsed by anyone using that machine?

 

I just created a new folder called Local and I see a student's username/Chrome is now created. I'm just curious if we start to get a ton of students logging in, if they could then browse to that folder and mess with others' Chrome folders.

Edited October 21, 2015 by kcalderw

[kcalderw]

Do you have any logout items for Chrome as well?

[slancaster]

No, the folder that is created sets permissions to be only accessible by that user. So no risk of file browsing / messing about.

 

- - - Updated - - -

 

We used to delete files on logout for Chrome but the local redirect sorts any problems we had so we no longer need them.

[eddyc]

No probs, we use a symlink via custom settings in Profile Manager. Off top of my head, you need to add this to the MCX.Redirector settings in WGM.

 

Screen shot from profile manager, under the students user group, but I believe the syntax to be the same:

 

We also use symlink commands to delete certain problematic folders (such as Chrome settings) and to redirect caches and big traffic (e.g. emails).

 

[ATTACH=CONFIG]32782[/ATTACH]

 

Sorry to drag up an old thread but does this still work for you? We've been having lots of complaints about keychain issues - I found this post and then discovered this is already in our profile manager!

 

Cheers

[2097]

When using profile manager we used to redirect the keychain to a local "Tmp" folder so it was new at every logon, saved a lot of issues when kids changed their AD password and when they logged onto the Mac they had to renter their old password to fix the keychain.

 

Basically by placing it on the local drive it saves all keychain issues ! no prompts or anything.

[slancaster]

Sorry to drag up an old thread but does this still work for you? We've been having lots of complaints about keychain issues - I found this post and then discovered this is already in our profile manager!

 

Cheers

 

Hello,

 

we now do a nightly Keychain nuke and also set the users Keychain to delete upon password reset.

 

Our fileserver has a scheduled task to run a script which checks to see if any STAFF are exempt from Keychain nuke (some staff dont require their Keychain deleting nightly), it then deletes ALL STUDENT keychains. Script below (save as a .bat and schedule).

The script takes ownership of the Library folder so the Keychain can be deleted (perms are a pain)

 

cheers

----

 

@echo off

set b=Staff

:LOOP

for /D %%a in (\\PATH-TO-STAFF-HOME-AREA\%b%_Home\*) do (

if exist %%a\Library (

icacls %%a\Library /reset

if exist %%a\Library\Keychains if not %%a==\\PATH-TO-STAFF-HOME-AREA\UserNameOfStaffToNotDeleteKeychain if not %%a==\\PATH-TO-STAFF-HOME-AREA\AnotherUserNameOfStaffToNotDeleteKeychain (

icacls %%a\Library\Keychains /setowner "YOURDOMAIN\Domain Admins" /T /C /Q

icacls %%a\Library\Keychains /grant "Everyone":F /T /C /Q

rd /s /q %%a\Library\Keychains

)

)

)

if %b%==Student goto END

set b=Student

goto LOOP

:END

[eddyc]

When using profile manager we used to redirect the keychain to a local "Tmp" folder so it was new at every logon, saved a lot of issues when kids changed their AD password and when they logged onto the Mac they had to renter their old password to fix the keychain.

 

Basically by placing it on the local drive it saves all keychain issues ! no prompts or anything.

 

Are you doing this via Profile Manager, if so, do you mind sharing a screenshot please?

 

Thanks

[eddyc]

Hello,

 

we now do a nightly Keychain nuke and also set the users Keychain to delete upon password reset.

 

Our fileserver has a scheduled task to run a script which checks to see if any STAFF are exempt from Keychain nuke (some staff dont require their Keychain deleting nightly), it then deletes ALL STUDENT keychains. Script below (save as a .bat and schedule).

The script takes ownership of the Library folder so the Keychain can be deleted (perms are a pain)

 

cheers

----

 

@echo off

set b=Staff

:LOOP

for /D %%a in (\\PATH-TO-STAFF-HOME-AREA\%b%_Home\*) do (

if exist %%a\Library (

icacls %%a\Library /reset

if exist %%a\Library\Keychains if not %%a==\\PATH-TO-STAFF-HOME-AREA\UserNameOfStaffToNotDeleteKeychain if not %%a==\\PATH-TO-STAFF-HOME-AREA\AnotherUserNameOfStaffToNotDeleteKeychain (

icacls %%a\Library\Keychains /setowner "YOURDOMAIN\Domain Admins" /T /C /Q

icacls %%a\Library\Keychains /grant "Everyone":F /T /C /Q

rd /s /q %%a\Library\Keychains

)

)

)

if %b%==Student goto END

set b=Student

goto LOOP

:END

 

We have a similar script but don't have much joy with it - We find that as students move between music and art between mac devices keychain issues appear then too :-(

[slancaster]

Sounds like it could be a permissions problem on your File Server. We've had quirks in the past network homes on Mac. We redirect a lot of the library locally now but still keep the Keychain on the file server.

 

What is your file server running on?

[eddyc]

Sounds like it could be a permissions problem on your File Server. We've had quirks in the past network homes on Mac. We redirect a lot of the library locally now but still keep the Keychain on the file server.

 

What is your file server running on?

 

Some users are on 2012 R2 and some have been migrated to 2016. We have issues removing some keychains for some users from both servers