Moving from WGM to Profile Manager

[Sheridan]

I'm just starting to look to upgrade our old 10.8 Macs to 10.12 and move from using WGM to profile Manager. I've setup up PM on the server and created some policies for users and devices, and added one device placeholder (a Mac by using serial number) into this to test - we don't have many macs so manually adding them is the easiest option.

 

However, this test mac is still pulling through the WGM settings, rather than the newer PM settings. How do I force a device to use PM instead of WGM? The devices are all added to the OD server and AD server for authentication (OD for devices, AD for users) as previously working with 10.8 but I want to make sure the PM settings work on the test mac before updating all the others.

[HodgeHi]

Remove the OD from the directory services list. It is no longer required.

[Sheridan]

I've progressed a bit now - only have the AD in the profile for authentication which seems to work. However profile manager doesn't allow us to define the layout of the dock for locally installed apps - unless they'e vpp ones.

 

With WGM you could drag apps to the dock setup so now if the app isn't in the profile manager list then you can't add it to the dock. Looks like we'll be sticking with WGM for a little longer!

 

I've also noticed it takes a stupidly long time for an AD account to login, not to mention the SMB share permissions on the Windows server get screwed up - it seems OSX 10 is not destined to play happy with Windows anymore.

[Arthur]

profile manager doesn't allow us to define the layout of the dock for locally installed apps

I use DockMaster to create (per-machine) dock profiles which can then be deployed through MDMs like Profile Manager (or even Munki).

 

The website is a bit simpler to use compared to the app since the latter uses a .plist to generate the .mobileconfig. e.g.

 

generate_dock_profiles.sh

#!/bin/bash

SERVER="/Volumes/Settings/Docks" 

/usr/local/bin/dockmaster -m -t "${SERVER}/dockmaster_art.plist" "${SERVER}/Dock (Art Dept).mobileconfig"

 

dockmaster_art.plist

display_name
Art Dept Dock
organization
School Name
description
A custom dock profile generated using DockMaster.
scope
System
contents_immutable

merge_with_existing_dock

add_network_home

tile_size
66
tile_size_immutable

magnification

magnification_immutable

magnification_size
60
magnification_size_immutable

position
bottom
position_immutable

minimize_effect
genie
minimize_effect_immutable

animate_app_launch

animate_app_launch_immutable

auto_hide

show_process_indicators

show_process_indicators_immutable

minimize_into_app

minimize_into_app_immutable

applications

	
		cfurl_string
		/Applications/Launchpad.app
	
	
		cfurl_string
		/Applications/Safari.app
	
	
		cfurl_string
		/Applications/Google Chrome.app
	
	
		cfurl_string
		/Applications/Adobe Photoshop CC 2017/Adobe Photoshop CC 2015.5.app
	
	
		cfurl_string
		/Applications/Adobe InDesign CC 2017/Adobe InDesign CC 2015.app
	
	
		cfurl_string
		/Applications/Adobe Illustrator CC 2017/Adobe Illustrator.app
	
	
		cfurl_string
		/Applications/Microsoft Word.app
	
	
		cfurl_string
		/Applications/Microsoft Excel.app
	
	
		cfurl_string
		/Applications/Microsoft PowerPoint.app
	
	
		cfurl_string
		/Applications/GarageBand.app
	
	
		cfurl_string
		/Applications/iMovie.app
	
	
		cfurl_string
		/Applications/Pages.app
	
	
		cfurl_string
		/Applications/Numbers.app
	
	
		cfurl_string
		/Applications/Keynote.app
	
	
		cfurl_string
		/Applications/System Preferences.app
	

others

	
		cfurl_string
		~/Downloads
		arrangement
		2
		show_as
		3
		display_as
		1
	
	
		cfurl_string
		/Applications
		arrangement
		1
		show_as
		3
		display_as
		1
	
	
		cfurl_string
		smb://ad.example.net/Shared
		label
		Shared Area
	

 

I've also noticed it takes a stupidly long time for an AD account to login

How long is stupidly long?

 

not to mention the SMB share permissions on the Windows server get screwed up - it seems OS X is not destined to play happy with Windows anymore.

I haven't had any permission issues on our Windows servers since switching to El Capitan.

Edited December 9, 2016 by Arthur

[Sheridan]

It seems to take 5 minutes compared to when we ran OS X 10.7.5 with ad/od and it took less than a minute (on the same hardware)

 

On the test accounts we've noticed it's put Everyone with full access at the root of the share! That's on 2012 servers hosting the shares.

 

I wouldn't mind switching to profile manager if it was as flexible as wgm!

[Arthur]

It seems to take 5 minutes compared to when we ran OS X 10.7.5 with ad/od and it took less than a minute (on the same hardware)

I had a similar issue with logins taking a very long time on our Macs running 10.11 and there were two causes in our case. The first was Impero (which has now been completely removed since it's unbelievably buggy) and the second was due to various system caches. Try the following on one of your Macs and see if it helps...

 

1. Logon as an administrator and open Terminal.
    
    
   
2. Run the following command:
    
   

   sudo for f in /var/folders/*/*/0/*.csstore; do mv $f ${f%/*}/../T/; done

   
    
   

3. Reboot the Mac.
   

[Arthur]

Some other things that can cause long login times...

 

www.jamf.com/jamf-nation/discussions/12302/active-directory-q-a

 

1. "Use UNC path from Active Directory to derive network home location" option is checked.
    
    
   
2. You have a .local Windows domain.
    
    
   
3. The DSBindTimeout is set too high. Try lowering it...
    
   

   /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow DSBindTimeout -int 10

   
   

[Sheridan]

Some other things that can cause long login times...

 

www.jamf.com/jamf-nation/discussions/12302/active-directory-q-a

 

1. "Use UNC path from Active Directory to derive network home location" option is checked.
    
    
   
2. You have a .local Windows domain.
    
    
   
3. The DSBindTimeout is set too high. Try lowering it...
    
   

   /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow DSBindTimeout -int 10

   
   

 

Thanks for the ideas - I'm going to have a plod through these and see if it helps!

[Sheridan]

Hmm, I think I must be doing something wrong still.

 

I've set up some basic policies for macs on PM, enrolled a single mac and the settings have applied correctly according to the PM activity console (basic settings include AD directory for authentication and change the login screen to show username and password boxes)

 

However, on the mac all I get is the single user (the local admin account) waiting for a password - like I would have got with WGM before I joined it to OD and AD.

 

The mac itself isn't bound to OD or AD locally - the AD details are only specified in the profile. Have I got that the right way around?

[HodgeHi]

What is Profile Manager saying? Is the task pending or has it completed? Are the ports that PM require open? They are the same as for iPad deployment (being an MDM and all). Ports opened outbound to 17.0.0.0 or apple.com are 2195, 2196, 5223

 

The dock can be managed using the client and then uploaded as a custom plist to PM. This should do the same thing.