Middlebury

Difference between revisions of "Advanced Mac Configuration Topics"

(Give admin (administrator) privileges to a user using the Terminal)
 
(24 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 +
 
'''NOTE: This page contains information that is only useful to Helpdesk / LIS faculty and staff. Therefore I'm considering moving this information to our Internal wiki. If you feel that this information is important to the general public and/or do NOT think that this move is appropriate, please comment on the discussion page.'''
 
'''NOTE: This page contains information that is only useful to Helpdesk / LIS faculty and staff. Therefore I'm considering moving this information to our Internal wiki. If you feel that this information is important to the general public and/or do NOT think that this move is appropriate, please comment on the discussion page.'''
  
--[[User:Christopher Hunt|Hunt, Christopher]] 14:59, 17 November 2009 (UTC)
+
--[[User:Christopher_Hunt|Hunt, Christopher]] 14:59, 17 November 2009 (UTC)
  
== Mac Deployment, Management and Packaging ==
+
== Mac Deployment, Management and Packaging ==
  
See [[Mac Deployment|Mac Deployment]] and [http://blogs.middlebury.edu/petar/2010/05/12/all-in-one-management-solution-for-pcs-dells-macs/ Mac System Management Tools]
+
See [[Mac_Deployment|Mac Deployment]] and [http://blogs.middlebury.edu/petar/2010/05/12/all-in-one-management-solution-for-pcs-dells-macs/ Mac System Management Tools]
  
=== Packaging Mac Software and Other Files ===
+
=== Packaging Mac Software and Other Files ===
  
*[http://www.afp548.com/article.php?story=20100603185608277 The Commandments of Packaging in OS X]
+
*[http://wiki.afp548.com/index.php/Guidelines_for_Mac_software_packaging The Commandments of Packaging in OS X]  
  
== System, disks, users ==
+
== System, disks, users ==
  
 
==== Mount the PC portion (ISO 9660) of a hybrid disk on a Mac ====
 
==== Mount the PC portion (ISO 9660) of a hybrid disk on a Mac ====
Line 17: Line 18:
 
This may be useful if you need to extract documentation or other files for the PC side of a hybrid disk, but all you have is a Mac.
 
This may be useful if you need to extract documentation or other files for the PC side of a hybrid disk, but all you have is a Mac.
  
#Unmount the mac cd volume via disk utility (don't eject just dismount). Find the disk ID of the CD/DVD drive by selecting the CD/DVD device in disk utility and clicking the Info icon.
+
#Unmount the mac cd volume via disk utility (don't eject just dismount). Find the disk ID of the CD/DVD drive by selecting the CD/DVD device in disk utility and clicking the Info icon.  
#Open terminal and type:<br>sudo mkdir /Volumes/myisodisk<br>sudo mount -t cd9660 /dev/diskID /Volumes/myisodisk<br>replace the diskID above with the disk ID you got in step 1.
+
#Open terminal and type:<br/> sudo mkdir /Volumes/myisodisk<br/> sudo mount -t cd9660 /dev/diskID /Volumes/myisodisk<br/> replace the diskID above with the disk ID you got in step 1.  
#That's it. Browse the cd via the Finder.
+
#That's it. Browse the cd via the Finder.  
  
==== Scripting Adding and Removing Network Interfaces<br>  ====
+
==== Scripting Adding and Removing Network Interfaces ====
  
See man networksetup <br>
+
See man networksetup
  
==== Why your Mac might not sleep ====
+
==== Why your Mac might not sleep ====
  
http://support.apple.com/kb/HT1776
+
[http://support.apple.com/kb/HT1776 http://support.apple.com/kb/HT1776]
  
Also:&nbsp;Sleep delayed if print job is in progress or printer isn't available (http://support.apple.com/kb/TS3216)
+
Also:&nbsp;Sleep delayed if print job is in progress or printer isn't available ([http://support.apple.com/kb/TS3216 http://support.apple.com/kb/TS3216])
  
==== Refresh disk arbitration ====
+
==== Refresh disk arbitration ====
  
 
Note: This may force disks that haven't mounted to mount.
 
Note: This may force disks that haven't mounted to mount.
 
<pre>disktool -r
 
<pre>disktool -r
 
</pre>
 
</pre>
==== Enable Journaling ====
+
 
 +
==== Enable Journaling ====
 
<pre>diskutil enableJournal /</pre>
 
<pre>diskutil enableJournal /</pre>
==== Matching Mac Model Name with Model Identifier, Mac OS X Build, production date, and Apple Hardware Test version  ====
 
  
#Get Model IDENTIFIER from System profiler (it will look like Model Identifier: MacBookPro2,2)
+
==== Matching Mac Model Name with Model Identifier, Mac OS X Build, production date, and Apple Hardware Test version ====
#Visit http://mactracker.dreamhosters.com/iphone/#_modelWindow and find the model with that identifier
+
 
#Done
+
#Get Model IDENTIFIER from System profiler (it will look like Model Identifier: MacBookPro2,2)  
 +
#Visit [http://mactracker.dreamhosters.com/iphone/#_modelWindow http://mactracker.dreamhosters.com/iphone/#_modelWindow] and find the model with that identifier  
 +
#Done  
  
 
More useful resources:
 
More useful resources:
  
*http://support.apple.com/kb/HT1159
+
*[http://support.apple.com/kb/HT1159 http://support.apple.com/kb/HT1159]
*http://www.chipmunk.nl/cgi-fast/applemodel.cgi
+
*[http://www.chipmunk.nl/cgi-fast/applemodel.cgi http://www.chipmunk.nl/cgi-fast/applemodel.cgi]
*http://www.apple.com/support/
+
*[http://www.apple.com/support/ http://www.apple.com/support/]
*http://www.apple.com/support/serviceassistant/
+
*[http://www.apple.com/support/serviceassistant/ http://www.apple.com/support/serviceassistant/]
*http://mactracker.dreamhosters.com/iphone/#_modelWindow
+
*[http://mactracker.dreamhosters.com/iphone/#_modelWindow http://mactracker.dreamhosters.com/iphone/#_modelWindow]
 +
*[http://www.appleserialnumberinfo.com/Desktop/index.php http://www.appleserialnumberinfo.com/Desktop/index.php]
  
==== Programatically Delete Cached User Accounts ====
+
==== Programatically Delete Cached User Accounts ====
  
From http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html
+
From [http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html]
 
<pre># Script to remove cached accounts in the local DS node
 
<pre># Script to remove cached accounts in the local DS node
 
# This should work in both Tiger and Leopard
 
# This should work in both Tiger and Leopard
Line 68: Line 72:
 
done
 
done
 
</pre>
 
</pre>
More resources: http://www.macosxhints.com/article.php?story=20080127172157404 <br> http://www.google.com/search?client=safari&amp;rls=en-us&amp;q=leopard+script+delete+user+account+dscl&amp;ie=UTF-8&amp;oe=UTF-8
 
  
==== Enabling Directory Service debug logging ====
+
More resources: [http://www.macosxhints.com/article.php?story=20080127172157404 http://www.macosxhints.com/article.php?story=20080127172157404]<br/> [http://www.google.com/search?client=safari&rls=en-us&q=leopard+script+delete+user+account+dscl&ie=UTF-8&oe=UTF-8 http://www.google.com/search?client=safari&rls=en-us&q=leopard+script+delete+user+account+dscl&ie=UTF-8&oe=UTF-8]
 +
 
 +
==== Enabling Directory Service debug logging ====
 
<pre>sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
 
<pre>sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
 
sudo sudo killall -USR1 DirectoryService
 
sudo sudo killall -USR1 DirectoryService
 
</pre>
 
</pre>
==== Disabling Directory Service debug logging ====
+
 
 +
==== Disabling Directory Service debug logging ====
 
<pre>sudo rm /Library/Preferences/DirectoryService/.DSLogDebugAtStart
 
<pre>sudo rm /Library/Preferences/DirectoryService/.DSLogDebugAtStart
 
sudo sudo killall -USR1 DirectoryService
 
sudo sudo killall -USR1 DirectoryService
 
</pre>
 
</pre>
==== Resetting Mac OS&nbsp;X Machine Account Domain Password<br>  ====
 
  
See http://www.afp548.com/article.php?story=20061217110502523<br>
+
==== Resetting Mac OS&nbsp;X Machine Account Domain Password ====
  
==== Forcefully remove a Mac from the domain ====
+
See [http://www.afp548.com/article.php?story=20061217110502523 http://www.afp548.com/article.php?story=20061217110502523]
 +
 
 +
==== Forcefully remove a Mac from the domain ====
 
<pre>sudo dsconfigad -r -f -u username -p password</pre>
 
<pre>sudo dsconfigad -r -f -u username -p password</pre>
 +
 
Where "username" is the username that was used to add the machine to the domain, and "password" is this username's password.
 
Where "username" is the username that was used to add the machine to the domain, and "password" is this username's password.
  
==== Resetting Directory Service Settings ====
+
==== Resetting Directory Service Settings ====
  
This is useful in cases where removing/adding the computer from/to the domain does not work using the standard method ([[Manually Add a Mac to the Domain|Manually Add a Mac to the Domain]]). The instructions below forcefully remove (unbind) the mac from the domain:<br>
+
This is useful in cases where removing/adding the computer from/to the domain does not work using the standard method ([[Manually_Add_a_Mac_to_the_Domain|Manually Add a Mac to the Domain]]). The instructions below forcefully remove (unbind) the mac from the domain:
  
#Login with a local account.
+
#Login with a local account.  
#Open the Terminal application
+
#Open the Terminal application  
#Enter each of the lines below, followed by pressing enter:
+
#Enter each of the lines below, followed by pressing enter:  
 
<pre>sudo rm -rdfv /Library/Preferences/DirectoryService
 
<pre>sudo rm -rdfv /Library/Preferences/DirectoryService
 
sudo rm -rdfv /var/db/dslocal/nodes/Default/config
 
sudo rm -rdfv /var/db/dslocal/nodes/Default/config
 
sudo sudo killall -USR1 DirectoryService</pre>
 
sudo sudo killall -USR1 DirectoryService</pre>
#Open Macintosh HD =&gt; Applications =&gt; Utilities =&gt; MIDD =&gt; Midd1stBootConfig.
 
#Follow the on-screen instructions. When the "Update User Template" application opens, click "Quit".
 
#Reboot and try logging in again with your domain account. If that fails [[Manually Add a Mac to the Domain]].
 
  
==== Lookup Certificates from Active Directory  ====
+
#Open Macintosh HD => Applications => Utilities => MIDD => Midd1stBootConfig.
 +
#Follow the on-screen instructions. When the "Update User Template" application opens, click "Quit".
 +
#Reboot and try logging in again with your domain account. If that fails [[Manually_Add_a_Mac_to_the_Domain|Manually Add a Mac to the Domain]].
  
http://support.apple.com/kb/HT3915
+
==== Lookup Certificates from Active Directory ====
  
==== Force the Generation or Creation of a Kerberos Ticket  ====
+
[http://support.apple.com/kb/HT3915 http://support.apple.com/kb/HT3915]
  
http://support.apple.com/kb/HT4100<br>
+
==== Force the Generation or Creation of a Kerberos Ticket ====
 +
 
 +
[http://support.apple.com/kb/HT4100 http://support.apple.com/kb/HT4100]
  
 
Summary:
 
Summary:
  
edit /etc/authorization and under &lt;key&gt;system.login.console&lt;/key&gt; add:<br>&lt;string&gt;builtin:krb5store,privileged&lt;/string&gt;
+
edit /etc/authorization and under <key>system.login.console</key> add:<br/> <string>builtin:krb5store,privileged</string>
  
==== Slow SMB Access - Possible Fix ====
+
==== Slow SMB Access - Possible Fix ====
  
 
sudo sysctl -w net.inet.tcp.delayed_ack=0
 
sudo sysctl -w net.inet.tcp.delayed_ack=0
  
==== Macs Randomly Unbinding from Domain ====
+
P.S. "CIFS" as newer revision of SMB - SMB doesn't lock files properly and results in errors saving files when the files have been opened within an application (as opposed to opening in the Finder) - not likely a speed issue, but worth noting here.
 +
 
 +
==== Macs Randomly Unbinding from Domain ====
 +
 
 +
*If the problem is that the user recently changed their password and the computer is still remembering the old one, try updating the Login keychain: [http://support.apple.com/kb/ht1631# http://support.apple.com/kb/ht1631#]
 +
*For cases where the connection to the domain has been lost entirely, stuck Macs of 10.6 and below can be reset by deleting the kerberos.mydomain.plist and restarting the DirectoryService; this is what the "Re-Bind 10.6-" policy on Casper does.
 +
*They changed how domain binding works in Lion; the "Re-Bind 10.7+" policy was designed to address this, but as of 2013.03.18 it does not work. For now:
 +
*#Go to System Preferences>Users & Groups>Login Options.
 +
*#"Network Account Server" should say MIDD; click Edit, then Open Directory Utility.
 +
*#Select Active Directory (the first option) and click the pencil below to edit.
 +
*#Click Unbind and enter domain technician credentials.
 +
*#In the "Active Directory Domain" field, type "middlebury.edu", click Bind, and enter your credentials again.
 +
*#Click Show Advanced Options and adjust some checkboxes:
 +
*#*YES, Create mobile account at login
 +
*#**NO, do not require confirmation 
 +
*#*Yes, default user shell 
 +
*#Then on the Administrative tab:
 +
*#*YES, Allow administration by:
 +
*#**Add "MIDD\Helpdesk Staff" to the list 
 +
*#*Yes, allow authentication from any domain in the forest 
 +
*#Close that window and hit Apply in the Directory Utility window if highlighted, then close it.
 +
*#Back in Users and Groups, under Login Options, confirm the following:
 +
*#*Automatic login OFF
 +
*#*Display login window as Name and Password
 +
*#*Show the Sleep, Restart, and Shut Down buttons
 +
*#*Allow network users to log in at the login window   
 +
 
 +
You can check the connection to the domain by unlocking a system preference with your credentials. It's also good to check that users who haven't logged into the computer before can login over the network.
  
*The other fix is to delete the kerberos.mydomain.plist and restarting the DirectoryService.
+
*This might be a good way to prevent the problem from happening: "change the passinterval on the clients. I ran the following script via Apple Remote Desktop as root and haven't had any problems since:<br/> dsconfigad -f -r -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword<br/> sleep 10<br/> dsconfigad -lu localadminusername -lp localadminpassword -passinterval 0<br/> sleep 10<br/> computerid=`/usr/sbin/scutil --get LocalHostName`<br/> dsconfigad -f -a $computerid -domain yourdomain -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword -ou ou=yourOU,DC=yourDC,DC=yourDC -status<br/> Source:[http://www.macwindows.com/snowleopardAD.html#051810d http://www.macwindows.com/snowleopardAD.html#051810d]
*"change the passinterval on the clients. I ran the following script via Apple Remote Desktop as root and haven't had any problems since:<br>dsconfigad -f -r -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword<br>sleep 10<br>dsconfigad -lu localadminusername -lp localadminpassword -passinterval 0<br>sleep 10<br>computerid=`/usr/sbin/scutil --get LocalHostName`<br>dsconfigad -f -a $computerid -domain yourdomain -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword -ou ou=yourOU,DC=yourDC,DC=yourDC -status<br>Source:http://www.macwindows.com/snowleopardAD.html#051810d<br>
 
  
==== Cannot Login with Domain Account ====
+
==== Cannot Login with Domain Account ====
  
*Mac is properly bound to AD
+
*Mac is properly bound to AD  
*Logging in with local account works
+
*Logging in with local account works  
*Cannot login with Domain Account
+
*Cannot login with Domain Account  
  
 
Troubleshooting:
 
Troubleshooting:
  
*UNCheck home dir setting in Directory Utility
+
*Verify connected with Ethernet, then reboot (confirms Ethernet priority over wireless, syncs system time)
*Tinker with UID settings (see&nbsp;http://www.macwindows.com/snowleopardAD.html#051810d)
+
*UNCheck home dir setting in Directory Utility  
 +
*Tinker with UID settings (see&nbsp;[http://www.macwindows.com/snowleopardAD.html#051810d http://www.macwindows.com/snowleopardAD.html#051810d])  
 +
 
 +
==== Change of Username ====
 +
 
 +
When AD account username is changed, old username will continue to be in use for logging into the Mac. This is the solution to update the account for use with the new username:
 +
 
 +
*Back up user files - just in case
 +
*Log in with an administrator account (not the one to be changed)
 +
*System Preferences > Users & Groups (may vary by OS)
 +
*Unlock, select account, click on "-" to delete account, choose "Don't change the home folder" option!!!!!
 +
*Browse in Finder to /Users/, rename the old user folder to match the new username
 +
*Log in with new username -- if prompted to use existing folder, do so
 +
*This process can be modified to work with local accounts, or changed network accounts, though this will require additional permissions work (see "chown") and work in Keychain Access (based on lack of access to these resources when first logging in)
 +
*If the computername should be changed as well, see [[Advanced_Mac_Configuration_Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X.2C_or_.2C_steps_to_fully_rename_a_Mac_--_may_be_able_to_omit_Keychain_and_Kerberos_commands.|http://mediawiki.middlebury.edu/wiki/LIS/Advanced_Mac_Configuration_Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X.2C_or_.2C_steps_to_fully_rename_a_Mac_--_may_be_able_to_omit_Keychain_and_Kerberos_commands.]]
  
==== Slow Authentication at Login Screen ====
+
==== Slow Authentication at Login Screen ====
  
As a troubleshooting step, try specifying the domain name along with the username at the login screen. Other options include editing the LDAP timeout in the Directory Service plist. Source: http://www.macwindows.com/snowleopardAD.html#051810d&nbsp;
+
As a troubleshooting step, try specifying the domain name along with the username at the login screen. Other options include editing the LDAP timeout in the Directory Service plist. Source: [http://www.macwindows.com/snowleopardAD.html#051810d http://www.macwindows.com/snowleopardAD.html#051810d]&nbsp;
  
==== GSSAPI Error - Kerberos<br>  ====
+
==== GSSAPI Error - Kerberos ====
  
http://support.apple.com/kb/TS3070
+
[http://support.apple.com/kb/TS3070 http://support.apple.com/kb/TS3070]
  
==== Reset Mac user or admin password ====
+
==== Reset Mac user or admin password ====
  
 
Can require install disks to reset if you have forgotten the old password. [http://support.apple.com/kb/HT1274 Help here]
 
Can require install disks to reset if you have forgotten the old password. [http://support.apple.com/kb/HT1274 Help here]
  
==== Give admin (administrator) privileges to a user using the Terminal ====
+
==== Give admin (administrator) privileges to a user using the Terminal ====
  
 
Open Terminal, type the line below, hit enter:
 
Open Terminal, type the line below, hit enter:
 
<pre>sudo dscl . -append /Groups/admin GroupMembership usernamegoeshere</pre>
 
<pre>sudo dscl . -append /Groups/admin GroupMembership usernamegoeshere</pre>
 +
 
The reverse step uses "-delete" in place of "-append" - use this to remove admin privileges - this can be also useful to remove account information from the 'admin' or 'staff' groups in the case of a username change (remove entries for the old username to allow login with the new username on the same account)
 
The reverse step uses "-delete" in place of "-append" - use this to remove admin privileges - this can be also useful to remove account information from the 'admin' or 'staff' groups in the case of a username change (remove entries for the old username to allow login with the new username on the same account)
 +
 
To check who's an admin currently:
 
To check who's an admin currently:
 
<pre>dscl . -read /Groups/admin | grep GroupMembership</pre>
 
<pre>dscl . -read /Groups/admin | grep GroupMembership</pre>
 +
 
The above can also be used in ARD commands or in shell scripts.
 
The above can also be used in ARD commands or in shell scripts.
  
==== Upgrade groups to the new UID format<br>  ====
+
==== Upgrade groups to the new UID format ====
  
This allows nested group (i.e. a domain group to be a member of a local group).<br>
+
This allows nested group (i.e. a domain group to be a member of a local group).
  
dseditgroup -o edit -t group -f n groupnamegoes here<br>
+
dseditgroup -o edit -t group -f n groupnamegoes here
  
<br>
+
&nbsp;
  
==== Make the admin group a member of the _lpadmin group<br>  ====
+
==== Make the admin group a member of the _lpadmin group ====
  
*'''Easy solution: '''Connect to [[Using File Servers (Macintosh)|Middfiles]] and open Software =&gt; Software Macintosh =&gt; Quick-Fixes. Double-click Add Printer - Permissions Problem Fix (lpadmin).app<br>
+
*'''Easy solution: '''Connect to [[Using_File_Servers_(Macintosh)|Middfiles]] and open Software => Software Macintosh => Quick-Fixes. Double-click Add Printer - Permissions Problem Fix (lpadmin).app  
*The harder solution (run commands below): This converts the _lpadmin and the admin group to the new format, adds the key NestedGroups to the _lpadmin group and populates it with the GUID of the admin group. Finally, the admin account is made a member of the _lpadmin group.
+
*The harder solution (run commands below): This converts the _lpadmin and the admin group to the new format, adds the key NestedGroups to the _lpadmin group and populates it with the GUID of the admin group. Finally, the admin account is made a member of the _lpadmin group.  
  
dseditgroup -o edit -t group -f n admin<br>dseditgroup -o edit -t group -f n _lpadmin<br>dseditgroup -o edit -a admin -t group _lpadmin<br>dscl localhost -create /Local/Default/Groups/_lpadmin NestedGroups ABCDEFAB-CDEF-ABCD-EFAB-CDEF-00000050<br>dseditgroup -o edit -a admin -t group _lpadmin<br>
+
dseditgroup -o edit -t group -f n admin<br/> dseditgroup -o edit -t group -f n _lpadmin<br/> dseditgroup -o edit -a admin -t group _lpadmin<br/> dscl localhost -create /Local/Default/Groups/_lpadmin NestedGroups ABCDEFAB-CDEF-ABCD-EFAB-CDEF-00000050<br/> dseditgroup -o edit -a admin -t group _lpadmin
  
==== Add an application to the dock using a script ====
+
==== Add an application to the dock using a script ====
  
*Add for current user:
+
*Add for current user:  
 
<pre>defaults write com.apple.dock persistent-apps -array-add "&lt;dict&gt;&lt;key&gt;tile-data&lt;/key&gt;&lt;dict&gt;\
 
<pre>defaults write com.apple.dock persistent-apps -array-add "&lt;dict&gt;&lt;key&gt;tile-data&lt;/key&gt;&lt;dict&gt;\
 
&lt;key&gt;file-data&lt;/key&gt;&lt;dict&gt;&lt;key&gt;_CFURLString&lt;/key&gt;&lt;string&gt;/Applications/Final Cut Express.app&lt;/string&gt;\
 
&lt;key&gt;file-data&lt;/key&gt;&lt;dict&gt;&lt;key&gt;_CFURLString&lt;/key&gt;&lt;string&gt;/Applications/Final Cut Express.app&lt;/string&gt;\
 
&lt;key&gt;_CFURLStringType&lt;/key&gt;&lt;integer&gt;0&lt;/integer&gt;&lt;/dict&gt;&lt;/dict&gt;&lt;/dict&gt;";</pre>
 
&lt;key&gt;_CFURLStringType&lt;/key&gt;&lt;integer&gt;0&lt;/integer&gt;&lt;/dict&gt;&lt;/dict&gt;&lt;/dict&gt;";</pre>
*Add for default user template:
+
 
 +
*Add for default user template:  
 
<pre>defaults write /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.dock \
 
<pre>defaults write /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.dock \
 
persistent-apps -array-add "&lt;dict&gt;&lt;key&gt;tile-data&lt;/key&gt;&lt;dict&gt;&lt;key&gt;file-data&lt;/key&gt;\
 
persistent-apps -array-add "&lt;dict&gt;&lt;key&gt;tile-data&lt;/key&gt;&lt;dict&gt;&lt;key&gt;file-data&lt;/key&gt;\
 
&lt;dict&gt;&lt;key&gt;_CFURLString&lt;/key&gt;&lt;string&gt;/Applications/Final Cut Express.app&lt;/string&gt;\
 
&lt;dict&gt;&lt;key&gt;_CFURLString&lt;/key&gt;&lt;string&gt;/Applications/Final Cut Express.app&lt;/string&gt;\
 
&lt;key&gt;_CFURLStringType&lt;/key&gt;&lt;integer&gt;0&lt;/integer&gt;&lt;/dict&gt;&lt;/dict&gt;&lt;/dict&gt;";</pre>
 
&lt;key&gt;_CFURLStringType&lt;/key&gt;&lt;integer&gt;0&lt;/integer&gt;&lt;/dict&gt;&lt;/dict&gt;&lt;/dict&gt;";</pre>
*Add for all users (current and future):
+
 
 +
*Add for all users (current and future):  
 
<pre>for folder in /Users/*
 
<pre>for folder in /Users/*
 
do
 
do
Line 189: Line 243:
 
chown $currentuser $folder/Library/Preferences/com.apple.dock.plist
 
chown $currentuser $folder/Library/Preferences/com.apple.dock.plist
 
done</pre>
 
done</pre>
==== Run a command for each user ====
+
 
 +
==== Run a command for each user ====
  
 
for folder in /Users/* echo "Doing a command for $folder" done
 
for folder in /Users/* echo "Doing a command for $folder" done
Line 199: Line 254:
 
chmod 777 $folder/.cups/lpoptions
 
chmod 777 $folder/.cups/lpoptions
 
done</pre>
 
done</pre>
<br>
 
  
==== Distribute a file to each user's home dir<br>  ====
+
&nbsp;
 +
 
 +
==== Distribute a file to each user's home dir ====
  
 
E.g. distribute custom print settings to each user
 
E.g. distribute custom print settings to each user
Line 213: Line 269:
 
done</pre>
 
done</pre>
  
== ARD techniques ==
+
== ARD techniques ==
  
 
==== Sharing ARD Preferences with other users ====
 
==== Sharing ARD Preferences with other users ====
  
See&nbsp;http://www.versiontracker.com/dyn/moreinfo/macosx/10907697 (Seize the ARD).
+
See&nbsp;[http://www.versiontracker.com/dyn/moreinfo/macosx/10907697 http://www.versiontracker.com/dyn/moreinfo/macosx/10907697] (Seize the ARD).
  
==== ARD - Limit the number of simultaneous authentication requests ====
+
==== ARD - Limit the number of simultaneous authentication requests ====
  
http://support.apple.com/kb/HT3803
+
[http://support.apple.com/kb/HT3803 http://support.apple.com/kb/HT3803]
  
==== ARD - Disable build_hd_index ====
+
==== ARD - Disable build_hd_index ====
  
http://support.apple.com/kb/HT1088<br>
+
[http://support.apple.com/kb/HT1088 http://support.apple.com/kb/HT1088]
  
==== Known ARD Issues ====
+
==== Known ARD Issues ====
  
See [[Known ARD Issues]].<br>
+
See [[Known_ARD_Issues|Known ARD Issues]].
  
==== Desirable ARD commands ====
+
==== Desirable ARD commands ====
  
*Set disk permissions. Ignore permissions.
+
*Set disk permissions. Ignore permissions.  
*Add ACLS for folders
+
*Add ACLS for folders  
*Run login permission script
+
*Run login permission script  
*unbind/rename/rebind/rescan/apply proper admin privs.
+
*unbind/rename/rebind/rescan/apply proper admin privs.  
*login items fix
+
*login items fix  
  
==== Installing (Pushing) Adobe CS via ARD ====
+
==== Installing (Pushing) Adobe CS via ARD ====
  
 
'''Note: This assumes you've created a disk image with the applications (from /Applications), and a disk image with the settings (in /Library/Application Support, as well as /Library/Preferences).'''
 
'''Note: This assumes you've created a disk image with the applications (from /Applications), and a disk image with the settings (in /Library/Application Support, as well as /Library/Preferences).'''
Line 252: Line 308:
 
rm -rdfv /settings.dmg
 
rm -rdfv /settings.dmg
 
</pre>
 
</pre>
==== Installing LabStats via ARD  ====
 
  
*Requirements: If the client computers are running Mac OS X Leopard, you need LabStats version 4.4.x (at least).
+
==== Installing LabStats via ARD ====
 +
 
 +
*Requirements: If the client computers are running Mac OS X Leopard, you need LabStats version 4.4.x (at least).  
 +
 
 +
#On your ARD computer, visit the labstats admin page and download the Mac installer.
 +
#Unzip it the package, and you will get two files (one ending in tar.gz, one ending in conf)
 +
#Unpack the tar file (double-clicking should suffice) until you see the install package (ends with pkg).
 +
#Open ARD, select the client computers (the ones that need labstats), then click "Copy"
 +
#Drag the pkg file and the conf file to the upper portion of the copy window (you can also use the + button), under "Place Item In" specify the full destination to "/tmp" (without the quotes), then click Copy.
 +
#When the copy process finishes, select the same computers again and click the Unix command button. In the window that appears, paste these lines in the upper portion: <pre>installer -package /tmp/labstats_mac_client_installer.pkg -target / </pre>
 +
<pre>rm -rdfv /tmp/labstats* </pre>
  
#On your ARD computer, visit the labstats admin page and download the Mac installer.
+
#Under "Run the command as" enter the user "root" and click "Send"  
#Unzip it the package, and you will get two files (one ending in tar.gz, one ending in conf)
 
#Unpack the tar file (double-clicking should suffice) until you see the install package (ends with pkg).
 
#Open ARD, select the client computers (the ones that need labstats), then click "Copy"
 
#Drag the pkg file and the conf file to the upper portion of the copy window (you can also use the + button), under "Place Item In" specify the full destination to "/tmp" (without the quotes), then click Copy.
 
#When the copy process finishes, select the same computers again and click the Unix command button. In the window that appears, paste these lines in the upper portion: <pre>installer -package /tmp/labstats_mac_client_installer.pkg -target / </pre> <pre>rm -rdfv /tmp/labstats* </pre>
 
#Under "Run the command as" enter the user "root" and click "Send"
 
  
==== Mute or set volume via ARD ====
+
==== Mute or set volume via ARD ====
 
<pre>osascript -e "set volume 0"
 
<pre>osascript -e "set volume 0"
 
</pre>
 
</pre>
 +
 
Change the zero to another number to set the volume to a higher value. Zero is mute. This seems to be system wide. It also mutes the startup chime. Good for classrooms. If headphones are plugged in, they have a separate volume setting.
 
Change the zero to another number to set the volume to a higher value. Zero is mute. This seems to be system wide. It also mutes the startup chime. Good for classrooms. If headphones are plugged in, they have a separate volume setting.
  
==== Make Macs Speak via ARD ====
+
==== Make Macs Speak via ARD ====
 
<pre>say "I hate Macs"
 
<pre>say "I hate Macs"
 
</pre>
 
</pre>
==== Set the Open Firmware password via ARD ====
+
 
 +
==== Set the Open Firmware password via ARD ====
  
 
'''Note: You need our Open Firmware package for this! It should be on our Mac server.'''
 
'''Note: You need our Open Firmware package for this! It should be on our Mac server.'''
 
<pre>sudo ofpassword set blahblah123</pre>
 
<pre>sudo ofpassword set blahblah123</pre>
==== Enable SSH via ARD ====
+
 
 +
==== Enable SSH via ARD ====
  
 
This seems to work:
 
This seems to work:
 
<pre>systemsetup -setremotelogin on</pre>
 
<pre>systemsetup -setremotelogin on</pre>
 +
 
If you get saclutil you can restrict ssh login to a single user or group:
 
If you get saclutil you can restrict ssh login to a single user or group:
  
Line 295: Line 358:
 
echo "AdminsPassHere" | sudo service ssh start
 
echo "AdminsPassHere" | sudo service ssh start
 
</pre>
 
</pre>
 +
 
This seems to work until reboot:
 
This seems to work until reboot:
 
<pre>/usr/sbin/sshd</pre>
 
<pre>/usr/sbin/sshd</pre>
==== Enable ARD remotely ====
+
 
 +
==== Enable ARD remotely ====
  
 
e.g. via SSH
 
e.g. via SSH
 
<pre>sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users admin -privs -all
 
<pre>sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users admin -privs -all
 
</pre>
 
</pre>
 +
 
If nothing's been enabled, the full line should look like: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu
 
If nothing's been enabled, the full line should look like: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu
  
==== Mount AFP volume via applescript via ARD ====
+
==== Mount AFP volume via applescript via ARD ====
 
<pre>osascript -e 'mount volume "afp://user:password@computername/Macintosh HD"'</pre>
 
<pre>osascript -e 'mount volume "afp://user:password@computername/Macintosh HD"'</pre>
==== Check if a process is running via ARD ====
+
 
 +
==== Check if a process is running via ARD ====
  
 
E.g. Check if AFP server is running
 
E.g. Check if AFP server is running
 
<pre>ps -axww | grep -i "AppleFileServer"</pre>
 
<pre>ps -axww | grep -i "AppleFileServer"</pre>
==== Start AFP sharing remotely  ====
 
  
#Change /etc/hostconfig so that AFPSERVER=-YES=
+
==== Start AFP sharing remotely ====
#Send unix script <pre>sudo AppleFileServer</pre> TWICE
 
  
==== Get folder size via ARD ====
+
#Change /etc/hostconfig so that AFPSERVER=-YES=
 +
#Send unix script <pre>sudo AppleFileServer</pre>
 +
TWICE
 +
 
 +
==== Get folder size via ARD ====
 
<pre>du -d 1 -h /Users/Shared/editingclass</pre>
 
<pre>du -d 1 -h /Users/Shared/editingclass</pre>
==== Set power management on Macs via ARD<br>  ====
+
 
 +
==== Set power management on Macs via ARD ====
  
 
Can be done using the pmset command. Remember to always execute this command as user "root" in ARD. Examples:
 
Can be done using the pmset command. Remember to always execute this command as user "root" in ARD. Examples:
  
*'''Instructor stations''' that need to remain awake for the duration the class: <pre>pmset -a sleep 0 disksleep 10 displaysleep 75</pre> The sleep parameter tells the computer never to sleep, disksleep makes the hard disk spin down in 10 minutes, displaysleep makes the monitor remain awake for 75 minutes.
+
*'''Instructor stations''' that need to remain awake for the duration the class: <pre>pmset -a sleep 0 disksleep 10 displaysleep 75</pre>
 +
The sleep parameter tells the computer never to sleep, disksleep makes the hard disk spin down in 10 minutes, displaysleep makes the monitor remain awake for 75 minutes.  
 
*'''Regular workstations''' that need to remain awake for management purposes can turn off the screen (e.g. after 35 mins) and spin down the hard disk to save power: <pre>pmset -a sleep 0 disksleep 10 displaysleep 35</pre>
 
*'''Regular workstations''' that need to remain awake for management purposes can turn off the screen (e.g. after 35 mins) and spin down the hard disk to save power: <pre>pmset -a sleep 0 disksleep 10 displaysleep 35</pre>
*Alternatively, the machines can be turned off / set to sleep whenever and you designate a "remote management" time period (say, every day after 3:00am). The Mac OS X power management allows you to set the computer to wake up or power on at a specific day and time. This way if a machine was turned off or set to sleep, it can become available for updates, etc. Here's an example: <pre>pmset repeat wakeorpoweron MTWRF 03:00:00</pre> This wakes the machine (if it's asleep) or powers it on (if it's turned off), every weekday at 3am.
 
  
==== Get Link Speed ====
+
*Alternatively, the machines can be turned off / set to sleep whenever and you designate a "remote management" time period (say, every day after 3:00am). The Mac OS X power management allows you to set the computer to wake up or power on at a specific day and time. This way if a machine was turned off or set to sleep, it can become available for updates, etc. Here's an example: <pre>pmset repeat wakeorpoweron MTWRF 03:00:00</pre>
 +
This wakes the machine (if it's asleep) or powers it on (if it's turned off), every weekday at 3am.
 +
 
 +
==== Get Link Speed ====
 
<pre>ioreg -l | grep "IOLinkSpeed"</pre>
 
<pre>ioreg -l | grep "IOLinkSpeed"</pre>
 +
 
Divide by 1000000 to get "human readable".
 
Divide by 1000000 to get "human readable".
  
== Application tips ==
+
== Application tips ==
  
==== Pushing LabStats via ARD<br>  ====
+
==== Pushing LabStats via ARD ====
  
Labstats can be pushed via ARD. There are two methods, both start with the same process:<br>
+
Labstats can be pushed via ARD. There are two methods, both start with the same process:
  
#On a machine with ARD, grab the Mac labstats installer from http://labserver:8080/admin
+
#On a machine with ARD, grab the Mac labstats installer from [http://labserver:8080/admin http://labserver:8080/admin]
#Unpack it, you'll get two files - a pkg package and a "conf" file. <br>
+
#Unpack it, you'll get two files - a pkg package and a "conf" file.  
  
Method 1: Copy the labstats.conf file INSIDE the installer (ctrl+click on the installer, open Contents =&gt; Resources =&gt; drag the conf file in here). Open the file named "postflight", delete everything in it and replace it with:<br>
+
Method 1: Copy the labstats.conf file INSIDE the installer (ctrl+click on the installer, open Contents => Resources => drag the conf file in here). Open the file named "postflight", delete everything in it and replace it with:
 
<pre>#!/bin/sh
 
<pre>#!/bin/sh
  
Line 345: Line 419:
 
SystemStarter start LabstatsClient
 
SystemStarter start LabstatsClient
 
</pre>
 
</pre>
Method 2: Push the default config file AFTER pushing labstats: Use the ARD "copy" button to copy the conf file to a custom destination: /etc<br>
 
  
==== Reset Spotlight ====
+
Method 2: Push the default config file AFTER pushing labstats: Use the ARD "copy" button to copy the conf file to a custom destination: /etc
 +
 
 +
==== Reset Spotlight ====
 
<pre>sudo mdutil -i off /
 
<pre>sudo mdutil -i off /
 
sudo mdutil -E /
 
sudo mdutil -E /
 
sudo mdutil -i on /
 
sudo mdutil -i on /
 
</pre>
 
</pre>
==== Update Symantec AntiVirus ====
+
 
 +
==== Update Symantec AntiVirus ====
 
<pre>LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES
 
<pre>LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES
 
</pre>
 
</pre>
 +
 
LiveUpdate tends to be in the root library support folder: /Library/Application\ Support/Norton\ Solutions\ Support/LiveUpdate/LiveUpdate.app/Contents/MacOS/LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES
 
LiveUpdate tends to be in the root library support folder: /Library/Application\ Support/Norton\ Solutions\ Support/LiveUpdate/LiveUpdate.app/Contents/MacOS/LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES
  
==== Check when an application was last opened ====
+
==== Check when an application was last opened ====
 
<pre>mdls -name kMDItemLastUsedDate /Application/Application.app</pre>
 
<pre>mdls -name kMDItemLastUsedDate /Application/Application.app</pre>
 +
 
Check an entire folder:
 
Check an entire folder:
 
<pre>mdls -name kMDItemLastUsedDate /Application/*</pre>
 
<pre>mdls -name kMDItemLastUsedDate /Application/*</pre>
 +
 
Filter applications from an entire folder:
 
Filter applications from an entire folder:
 
<pre>mdls /Applications/Adobe\ Photoshop\ CS/* | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
 
<pre>mdls /Applications/Adobe\ Photoshop\ CS/* | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
 
| egrep '(kMDItemLastUsedDate)|(app)'</pre>
 
| egrep '(kMDItemLastUsedDate)|(app)'</pre>
 +
 
Batch checking
 
Batch checking
 
<pre>mdls "/Applications/Macromedia Dreamweaver MX 2004/Dreamweaver MX 2004" \
 
<pre>mdls "/Applications/Macromedia Dreamweaver MX 2004/Dreamweaver MX 2004" \
Line 383: Line 463:
  
 
</pre>
 
</pre>
==== X11 and the PATH variable in Leopard and&nbsp;Snowleopard<br>  ====
+
 
 +
==== X11 and the PATH variable in Leopard and&nbsp;Snowleopard ====
  
 
There seems to be no way to directly set the X11 PATH variable. However, if you correctly set your PATH variable in the Terminal (check the command path_helper), you can then launch xterm (X11) from Terminal.app and it will inherit the PATH variable.
 
There seems to be no way to directly set the X11 PATH variable. However, if you correctly set your PATH variable in the Terminal (check the command path_helper), you can then launch xterm (X11) from Terminal.app and it will inherit the PATH variable.
  
A massive X11 FAQ is available here: http://forums.macosxhints.com/showthread.php?t=80171<br>
+
A massive X11 FAQ is available here: [http://forums.macosxhints.com/showthread.php?t=80171 http://forums.macosxhints.com/showthread.php?t=80171]
  
== Network &amp; Printers ==
+
== Network & Printers ==
  
==== Get MAC Address ====
+
==== Get MAC Address ====
 
<pre>/sbin/ifconfig en0 | grep ether | cut -d' ' -f 2</pre>
 
<pre>/sbin/ifconfig en0 | grep ether | cut -d' ' -f 2</pre>
==== Set computer name ====
+
 
 +
==== Set computer name ====
 
<pre>sudo scutil --set LocalHostName NEWCOMPUTERNAME
 
<pre>sudo scutil --set LocalHostName NEWCOMPUTERNAME
 
sudo scutil --set ComputerName NEWCOMPUTERNAME
 
sudo scutil --set ComputerName NEWCOMPUTERNAME
 
</pre>
 
</pre>
==== Printers: Install, delete, set as default ====
+
 
 +
==== Printers: Install, delete, set as default ====
  
 
'''List installed printers'''
 
'''List installed printers'''
 
<pre>lpstat -p
 
<pre>lpstat -p
 
</pre>
 
</pre>
 +
 
'''Install'''
 
'''Install'''
 
<pre>lpadmin -p printer_name -E -v lpd://server/printer -P path-to-ppd.gz</pre>
 
<pre>lpadmin -p printer_name -E -v lpd://server/printer -P path-to-ppd.gz</pre>
*An example with a compressed ppd:
+
 
 +
*An example with a compressed ppd:  
  
 
lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.gz
 
lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.gz
  
*Or an uncompressed ppd:
+
*Or an uncompressed ppd:  
  
 
lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.ppd
 
lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.ppd
Line 414: Line 499:
 
'''Must be followed by'''
 
'''Must be followed by'''
 
<pre>cupsenable printer_name</pre>
 
<pre>cupsenable printer_name</pre>
 +
 
'''Delete'''
 
'''Delete'''
 
<pre>lpadmin -x printer_name</pre>
 
<pre>lpadmin -x printer_name</pre>
 +
 
e.g.:
 
e.g.:
 
<pre>lpadmin -x AdobePDF7</pre>
 
<pre>lpadmin -x AdobePDF7</pre>
 +
 
'''Set as default'''
 
'''Set as default'''
 
<pre>lpadmin -d printer_name</pre>
 
<pre>lpadmin -d printer_name</pre>
 +
 
'''Install but disable sharing and add description'''
 
'''Install but disable sharing and add description'''
 
<pre>lpadmin -p printer_name -E -v lpd://server/printer -D "Room AB123" -P ppdpath -o printer-is-shared=false</pre>
 
<pre>lpadmin -p printer_name -E -v lpd://server/printer -D "Room AB123" -P ppdpath -o printer-is-shared=false</pre>
==== Enabling Duplexing ====
+
 
 +
==== Enabling Duplexing ====
  
 
On HP printers this should suffice:
 
On HP printers this should suffice:
 
<pre>lpadmin -p prntr -E -v lpd://srv/prnt -D "rmnr" -P "ppdpath" -o "HPOption_Duplexer=True" -o Duplex=DuplexNoTumble</pre>
 
<pre>lpadmin -p prntr -E -v lpd://srv/prnt -D "rmnr" -P "ppdpath" -o "HPOption_Duplexer=True" -o Duplex=DuplexNoTumble</pre>
 +
 
On other models you can try listing the available printer options, then pass the appropriate option to lpadmin using the "-o" parameter. To list all available printer options, install the printer on any one workstation and then run:
 
On other models you can try listing the available printer options, then pass the appropriate option to lpadmin using the "-o" parameter. To list all available printer options, install the printer on any one workstation and then run:
 
<pre>lpoptions -p printer_name -l</pre>
 
<pre>lpoptions -p printer_name -l</pre>
 +
 
For an HP laserjet the above command gives two options related to duplexing: '''HPOption_Duplexer''' and '''Duplex''' -- so those are the parameters passed using "-o" in the example above.
 
For an HP laserjet the above command gives two options related to duplexing: '''HPOption_Duplexer''' and '''Duplex''' -- so those are the parameters passed using "-o" in the example above.
  
<br>
+
==== Enable Printing Controls for Users ====
 +
 
 +
Situation: local printer stops while printing, and standard user cannot resume job. Or non-admin should be allowed to install a new printer queue. /private/etc/cups/cupsd.conf/ can be edited for granular permissions to functions normally reserved for members of admin & lpadmin groups, for example.
 +
 
 +
&nbsp;
  
== Misc ==
+
== Misc ==
  
==== List of Mac SMC and EFI Firmware Updates ====
+
==== List of Mac SMC and EFI Firmware Updates ====
  
http://support.apple.com/kb/HT1237
+
[http://support.apple.com/kb/HT1237 http://support.apple.com/kb/HT1237]
  
It may be possible to automate the installation of these by using the -y switch:<br>http://support.apple.com/kb/HT3962<br>sudo ./Contents/Resources/RemoteEFIUpdater -y -shutdown
+
It may be possible to automate the installation of these by using the -y switch:<br/> [http://support.apple.com/kb/HT3962 http://support.apple.com/kb/HT3962]<br/> sudo ./Contents/Resources/RemoteEFIUpdater -y -shutdown
  
==== Remedying and preventing duplicate DDNS registrations in Mac OS X ====
+
==== Remedying and preventing duplicate DDNS registrations in Mac OS X, or , steps to fully rename a Mac -- may be able to omit Keychain and Kerberos commands. ====
  
'''NOTE: You may need to combine these fixes with the suggestions outlined in the next section [[Advanced_Mac_Configuration_Topics#Macs losing AD bind connection or unable to login to a domain account on a Mac]].'''
+
'''NOTE: You may need to combine these fixes with the suggestions outlined in the next section [[Advanced_Mac_Configuration_Topics#Macs_losing_AD_bind_connection_or_unable_to_login_to_a_domain_account_on_a_Mac|Advanced_Mac_Configuration_Topics#Macs losing AD bind connection or unable to login to a domain account on a Mac]].'''
  
# remove computer from domain
+
#remove computer from domain  
# Run these commands
+
#Run these commands  
<pre>
+
<pre>sudo /usr/sbin/systemkeychain -k /Library/Keychains/System.keychain -C -f
sudo /usr/sbin/systemkeychain -k /Library/Keychains/System.keychain -C -f
 
 
sudo rm -rf /var/db/krb5kdc
 
sudo rm -rf /var/db/krb5kdc
 
sudo /usr/libexec/configureLocalKDC
 
sudo /usr/libexec/configureLocalKDC
 
(this ensures uniqueness of local kerberos db)
 
(this ensures uniqueness of local kerberos db)
 
</pre>
 
</pre>
# Optionally, if he system is having SMB authentication issues, follow these instructions: http://support.apple.com/kb/HT3169
+
 
# Rename computer as desired under System Preferences =&gt; Sharing, then run these commands:
+
#Optionally, if he system is having SMB authentication issues, follow these instructions: [http://support.apple.com/kb/HT3169 http://support.apple.com/kb/HT3169]
<pre>
+
#Rename computer as desired under System Preferences => Sharing, then run these commands:  
sudo hostname NEWCOMPUTERNAME
+
<pre>sudo hostname NEWCOMPUTERNAME
 
sudo scutil --set ComputerName NEWCOMPUTERNAME
 
sudo scutil --set ComputerName NEWCOMPUTERNAME
 
sudo scutil --set LocalHostName NEWCOMPUTERNAME
 
sudo scutil --set LocalHostName NEWCOMPUTERNAME
Line 461: Line 556:
 
(this ensures all possible host names are the same - don't ask why there are 4 different places)
 
(this ensures all possible host names are the same - don't ask why there are 4 different places)
 
</pre>
 
</pre>
# Open Directory Utility, AD plugin, rename computer as desired there, then bind to domain (adding to correct OU)
 
# If the computers are connected to an XSan, you may need to re-enter username/password in Xsan admin app. May need to remove computer from Xsan database and re-add.
 
  
==== Macs losing AD bind connection or unable to login to a domain account on a Mac  ====
+
#Open Directory Utility, AD plugin, rename computer as desired there, then bind to domain (adding to correct OU)
 +
#If the computers are connected to an XSan, you may need to re-enter username/password in Xsan admin app. May need to remove computer from Xsan database and re-add.
 +
#For a computer name change, if the username has changed in AD as well, see [[http://mediawiki.middlebury.edu/wiki/LIS/Advanced_Mac_Configuration_Topics#Change_of_Username [1]]].
  
NOTE: You may need to combine these fixes with the suggestions outlined in he previous section [[Advanced Mac Configuration Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X]]. More information here: http://www.macwindows.com/leopardAD.html (search for “losing” or look under http://www.macwindows.com/leopardAD.html#012209e)
+
==== Macs losing AD bind connection or unable to login to a domain account on a Mac ====
  
Proposed fixes: http://www.macwindows.com/Kerberos-workarounds-for-Macs-losing-AD-binding.html
+
NOTE: You may need to combine these fixes with the suggestions outlined in he previous section [[Advanced_Mac_Configuration_Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X|Advanced Mac Configuration Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X]]. More information here: [http://www.macwindows.com/leopardAD.html http://www.macwindows.com/leopardAD.html] (search for “losing” or look under [http://www.macwindows.com/leopardAD.html#012209e http://www.macwindows.com/leopardAD.html#012209e])
 +
 
 +
Proposed fixes: [http://www.macwindows.com/Kerberos-workarounds-for-Macs-losing-AD-binding.html http://www.macwindows.com/Kerberos-workarounds-for-Macs-losing-AD-binding.html]
  
 
And
 
And
  
http://www.macwindows.com/Readers-verify-modify-Kerberos-fixes-for-Mac-AD-binding.html
+
[http://www.macwindows.com/Readers-verify-modify-Kerberos-fixes-for-Mac-AD-binding.html http://www.macwindows.com/Readers-verify-modify-Kerberos-fixes-for-Mac-AD-binding.html]
  
 
Proposed cause for the issue: Then one of our staff went to an Apple Integration seminar at Cambridge (UK) where the little known fact emerged that Leopard has a persistent Kerberos certificate which can cause problems with just such things as binding to AD. This is a particular problem if using an image to build multiple machines which are then bound to AD - it is the equivalent of having identical machine accounts on windows.
 
Proposed cause for the issue: Then one of our staff went to an Apple Integration seminar at Cambridge (UK) where the little known fact emerged that Leopard has a persistent Kerberos certificate which can cause problems with just such things as binding to AD. This is a particular problem if using an image to build multiple machines which are then bound to AD - it is the equivalent of having identical machine accounts on windows.
  
Apple’s take on the issue: http://support.apple.com/kb/TS1245
+
Apple’s take on the issue: [http://support.apple.com/kb/TS1245 http://support.apple.com/kb/TS1245]
  
 
Also, verify the correct date, time, and time zone information in System Preferences.&nbsp; If system is bound to domain, also verify in Directory Utility that the Search Policy includes an entry for "/Active Directory/All Domains".
 
Also, verify the correct date, time, and time zone information in System Preferences.&nbsp; If system is bound to domain, also verify in Directory Utility that the Search Policy includes an entry for "/Active Directory/All Domains".
  
==== Connect to an AFP server from the command line ====
+
If computer is properly bound (admin can verify by attempting to unlock system preferences), but no domain account can log in, be sure the setting allowing network users to log in is checked in Users system pane (if present).
 +
 
 +
If some accounts can login, but others cannot that have been used before (most commonly due to a username change), may need to delete account, verify the username folder has been removed, and also remove from the Groups/admin and/or Groups/staff list (using "dscl" command with the "-remove" switch).
 +
 
 +
==== Connect to an AFP server from the command line ====
 
<pre>sudo mkdir /Volumes/myserver
 
<pre>sudo mkdir /Volumes/myserver
 
mount_afp afp://username:password@servername/sharename /Volumes/myserver
 
mount_afp afp://username:password@servername/sharename /Volumes/myserver
 
</pre>
 
</pre>
==== Reimage a mac from an image using the command line asr ====
+
 
 +
==== Reimage a mac from an image using the command line asr ====
 
<pre>sudo asr restore --source /Volumes/Source/Image.dmg --target /Volumes/Destination --erase --noverify</pre>
 
<pre>sudo asr restore --source /Volumes/Source/Image.dmg --target /Volumes/Destination --erase --noverify</pre>
 +
 
Note: This '''ERASES''' the destination drive. It also skips verification (which Disk Utility forces you to do, thus adding 10-15 minutes to the imaging process). Verification is GOOD, but sometimes, when you're sure that the image is healthy and your destination drive is healthy, it can be a waste of time.
 
Note: This '''ERASES''' the destination drive. It also skips verification (which Disk Utility forces you to do, thus adding 10-15 minutes to the imaging process). Verification is GOOD, but sometimes, when you're sure that the image is healthy and your destination drive is healthy, it can be a waste of time.
  
==== Manipulating and modifying ACL permissions from the command line terminal ====
+
==== Manipulating and modifying ACL permissions from the command line terminal ====
  
 
Read ACL
 
Read ACL
 
<pre>ls -le /path/to/dir</pre>
 
<pre>ls -le /path/to/dir</pre>
 +
 
Write ACL
 
Write ACL
 
<pre>chmod -R +a "group:admin allow read write delete" /path/to/dir</pre>
 
<pre>chmod -R +a "group:admin allow read write delete" /path/to/dir</pre>
 +
 
Delete ACL
 
Delete ACL
 
<pre>chmod -R -a# 0 /path/to/dir</pre>
 
<pre>chmod -R -a# 0 /path/to/dir</pre>
==== Run an ASR server ====
+
 
 +
==== Run an ASR server ====
  
 
GUI: Protonpack
 
GUI: Protonpack
 
<pre>sudo asr -source /Volumes/Images/image.dmg -server /path/to/config.plist
 
<pre>sudo asr -source /Volumes/Images/image.dmg -server /path/to/config.plist
 
</pre>
 
</pre>
==== Restore a client from an ASR server ====
+
 
 +
==== Restore a client from an ASR server ====
  
 
GUI: NetRestore
 
GUI: NetRestore
 
<pre>sudo asr -source asr://serverip -targer /Volumes/Volume -erase -noverify
 
<pre>sudo asr -source asr://serverip -targer /Volumes/Volume -erase -noverify
 
</pre>
 
</pre>
==== Set expanded windows for save and print<br>  ====
+
 
 +
==== Set expanded windows for save and print ====
  
 
defaults write -g PMPrintingExpandedStateForPrint -bool TRUE
 
defaults write -g PMPrintingExpandedStateForPrint -bool TRUE
Line 512: Line 620:
 
defaults write /Library/Preferences/.GlobalPreferences NSNavPanelExpandedStateForSaveMode -string 1
 
defaults write /Library/Preferences/.GlobalPreferences NSNavPanelExpandedStateForSaveMode -string 1
  
<br>
+
&nbsp;
  
==== Pre-populate the username field in the Connect to Server window ====
+
==== Pre-populate the username field in the Connect to Server window ====
  
http://support.apple.com/kb/HT4121?viewlocale=en_US
+
[http://support.apple.com/kb/HT4121?viewlocale=en_US http://support.apple.com/kb/HT4121?viewlocale=en_US]
  
E.g.:<br>defaults write /Library/Preferences/com.apple.NetworkAuthorization UseShortName -bool YES
+
E.g.:<br/> defaults write /Library/Preferences/com.apple.NetworkAuthorization UseShortName -bool YES
  
==== Make the help window and the add printer (addprinter.app) window act normal <br>  ====
+
==== Make the help window and the add printer (addprinter.app) window act normal ====
  
This makes the help window and addprinter.app window accessible to the Dock and command-tab.<br>
+
This makes the help window and addprinter.app window accessible to the Dock and command-tab.
  
i=/System/Library/CoreServices/AddPrinter.app/Contents/Info.plist<br>sudo defaults write "${i%.plist}" LSUIElement 0<br>sudo chmod 644 "$i"
+
i=/System/Library/CoreServices/AddPrinter.app/Contents/Info.plist<br/> sudo defaults write "${i%.plist}" LSUIElement 0<br/> sudo chmod 644 "$i"
  
<br>i=/System/Library/CoreServices/Help\ Viewer.app/Contents/Info.plist<br>sudo defaults write "${i%.plist}" LSUIElement 0<br>sudo chmod 644 "$i"<br>
+
<br/> i=/System/Library/CoreServices/Help\ Viewer.app/Contents/Info.plist<br/> sudo defaults write "${i%.plist}" LSUIElement 0<br/> sudo chmod 644 "$i"
  
 
==== Variables available to shell scripts in Installer packages ====
 
==== Variables available to shell scripts in Installer packages ====
* $1: Full path to the installation package the Installer application is processing.
 
* $2: Full path to the installation destination
 
* $3: Installation volume (or mountpoint) to receive the payload
 
* $4: The root directory for the system:
 
* $SCRIPT_NAME: Filename of the operation executable
 
* $PACKAGE_PATH: Full path to the installation package
 
* $INSTALLER_TEMP: Scratch directory used by Installer to place its temporary work files
 
* $RECEIPT_PATH: Full path to a temporary directory containing the operation executable
 
  
 +
*$1: Full path to the installation package the Installer application is processing.
 +
*$2: Full path to the installation destination
 +
*$3: Installation volume (or mountpoint) to receive the payload
 +
*$4: The root directory for the system:
 +
*$SCRIPT_NAME: Filename of the operation executable
 +
*$PACKAGE_PATH: Full path to the installation package
 +
*$INSTALLER_TEMP: Scratch directory used by Installer to place its temporary work files
 +
*$RECEIPT_PATH: Full path to a temporary directory containing the operation executable
 +
 +
&nbsp;
  
==== Slipstreaming Office 2008 for Mac ====
+
==== Slipstreaming Office 2008 for Mac ====
  
See: [[Slipstreaming Office 2008 for Mac]]
+
See: [[Slipstreaming_Office_2008_for_Mac|Slipstreaming Office 2008 for Mac]]
  
==== Apple System Image Utility Tips ====
+
==== Apple System Image Utility Tips ====
  
*When creating a workflow, "Define Image Source" needs to be on top and "Create Image" on the bottom of the workflow. The rest of the actions may have any order (or so it appears).
+
*When creating a workflow, "Define Image Source" needs to be on top and "Create Image" on the bottom of the workflow. The rest of the actions may have any order (or so it appears).  
  
==== Archiving user accounts from a previous semester ====
+
==== Archiving user accounts from a previous semester ====
 
<pre>cd /Users/
 
<pre>cd /Users/
 
mkdir zz_PreviousSememsters
 
mkdir zz_PreviousSememsters
Line 566: Line 676:
 
done
 
done
 
</pre>
 
</pre>
==== Deleting ALL cached domain user accounts ====
+
 
 +
==== Deleting ALL cached domain user accounts ====
  
 
You can also delete all accounts from the entire semester:
 
You can also delete all accounts from the entire semester:
Line 581: Line 692:
  
 
</pre>
 
</pre>
==== Deleting ALL cached domain accounts except those on a custom list ====
+
 
 +
==== Deleting ALL cached domain accounts except those on a custom list ====
 
<pre>#Set the warning flag to off (case sensitive) if you want to start the deletion of accounts.
 
<pre>#Set the warning flag to off (case sensitive) if you want to start the deletion of accounts.
 
MIDD_WARNINGFLAG=on
 
MIDD_WARNINGFLAG=on
Line 620: Line 732:
 
fi
 
fi
 
</pre>
 
</pre>
=== Erasing a volume entirely and setting permissions<br>  ===
+
 
 +
=== Erasing a volume entirely and setting permissions ===
 
<pre>#Set the warning flag to off (case sensitive) if you want to start the deletion.
 
<pre>#Set the warning flag to off (case sensitive) if you want to start the deletion.
 
MIDD_WARNINGFLAG=on
 
MIDD_WARNINGFLAG=on
Line 646: Line 759:
 
fi
 
fi
 
</pre>
 
</pre>
*Alternatively, you can replace the "diskutil eraseVolume..." lines with something like rm -rdf "/Volumes/path/to/specific folder to clear"'''=='''
+
 
 +
*Alternatively, you can replace the "diskutil eraseVolume..." lines with something like rm -rdf "/Volumes/path/to/specific folder to clear"'''=='''  
  
 
=== Moving a users folder manually to a new machine ===
 
=== Moving a users folder manually to a new machine ===
  
If you move a user's home folder to a new machine you can run this command as root (or sudo -s) to apply ownership of the folder to the user and domain users (as the group). This does not change the actual permissions, just the ownership. Launch the Terminal and do the following.
+
If you move a user's home folder to a new machine you can run this command as root (or sudo -s) to apply ownership of the folder to the user and domain users (as the group). This does not change the actual permissions, just the ownership. Launch the Terminal and do the following.
 
+
<pre>sudo -s
<pre>
 
sudo -s
 
 
cd /Users
 
cd /Users
 
chown -vR username username
 
chown -vR username username
Line 660: Line 772:
 
</pre>
 
</pre>
  
How this works... the sudo -s makes you a root user (assumig you should be) until you type exit. 'cd' is used to get to the User's folder (where you should have copied the user's homefolder named username). chown -vR un un will change ownership recursively and show you that it is working. chgrp -vr... will change the group the same way. The \\ is used to escape the \ character and the space between domain and users. The exit is to make sure you get out of being a super user. You could throw in a second 'exit' if you wanted to exit out of the terminal completely.
+
How this works... the sudo -s makes you a root user (assumig you should be) until you type exit. 'cd' is used to get to the User's folder (where you should have copied the user's homefolder named username). chown -vR un un will change ownership recursively and show you that it is working. chgrp -vr... will change the group the same way. The \\ is used to escape the \ character and the space between domain and users. The exit is to make sure you get out of being a super user. You could throw in a second 'exit' if you wanted to exit out of the terminal completely.
 +
 
 +
&nbsp;
 +
 
 +
=== Kerberos Issues ===
 +
 
 +
Kerberos KDC location specified in krb5.conf is not respected:&nbsp;[http://support.apple.com/kb/TS3265 http://support.apple.com/kb/TS3265]
 +
 
 +
=== Mac OS X v10.6 Clients bound to Active Directory may not be able to dismiss screen saver using Active Directory credentials ===
 +
 
 +
Resolution<br/> From the Go menu choose Go to Folder.<br/> Type etc , then click Go.<br/> Open the file named "authorization" in a text editor.<br/> Find the following text in the "system.login.screensaver” entry:<br/> <string>The owner or any administrator can unlock the screensaver.</string><br/> <br/> Change it to this:<br/> <string>(Use SecurityAgent.) The owner or any administrator can unlock the screensaver.</string><br/> Save the file.<br/> <br/> [http://support.apple.com/kb/TS3287 http://support.apple.com/kb/TS3287]
 +
 
 +
&nbsp;
  
 +
=== High Sierra macOS 10.13 stuff ===
  
=== Kerberos Issues  ===
+
APFS file system - encryption is native - adds Secure Token concept Secure Token is required of users to unlock an encrypted drive, and is granted by default to the first account, and subsequent local accounts, but not to mobile accounts.
  
Kerberos KDC location specified in krb5.conf is not respected:&nbsp;http://support.apple.com/kb/TS3265
+
sysadminctl command is useful for checking Secure Token status, and is the new supported tool for changing passwords and creating accounts through scripted means. dscl is NOT supported!!!
  
=== Mac OS X v10.6 Clients bound to Active Directory may not be able to dismiss screen saver using Active Directory credentials  ===
+
Check Secure Token: 'sysadminctl -secureTokenStatus usernamehere' Directory Utility also has an entry that allows lookup of one user at a time
  
Resolution<br>From the Go menu choose Go to Folder.<br>Type etc , then click Go.<br>Open the file named "authorization" in a text editor.<br>Find the following text in the "system.login.screensaver” entry:<br>&lt;string&gt;The owner or any administrator can unlock the screensaver.&lt;/string&gt;<br> <br>Change it to this:<br>&lt;string&gt;(Use SecurityAgent.) The owner or any administrator can unlock the screensaver.&lt;/string&gt;<br>Save the file.<br><br>http://support.apple.com/kb/TS3287<br>
+
Also see "FileVault"
  
== Mac OS X Server and Xserve Administration ==
+
== Mac OS X Server and Xserve Administration ==
  
=== NetBoot Across Subnets ===
+
=== NetBoot Across Subnets ===
  
http://support.apple.com/kb/HT4187
+
[http://support.apple.com/kb/HT4187 http://support.apple.com/kb/HT4187]
  
=== Configuring service principals in Active Directory when using a disjoint namespace ===
+
=== Configuring service principals in Active Directory when using a disjoint namespace ===
  
See: http://support.apple.com/kb/HT3795
+
See: [http://support.apple.com/kb/HT3795 http://support.apple.com/kb/HT3795]
  
=== AFP users unable to authenticate with Kerberos after upgrading ===
+
=== AFP users unable to authenticate with Kerberos after upgrading ===
  
sudo sso_util configure -r REALM_NAME -a diradmin afp<br>See: http://support.apple.com/kb/TS2938
+
sudo sso_util configure -r REALM_NAME -a diradmin afp<br/> See: [http://support.apple.com/kb/TS2938 http://support.apple.com/kb/TS2938]
  
=== Cannot authenticate to SMB shares when bound to Windows Server 2008 Active Directory ===
+
=== Cannot authenticate to SMB shares when bound to Windows Server 2008 Active Directory ===
  
See: http://support.apple.com/kb/TS2967
+
See: [http://support.apple.com/kb/TS2967 http://support.apple.com/kb/TS2967]
  
=== Cannot configure Lights-Out Management after installing Remote Desktop ===
+
=== Cannot configure Lights-Out Management after installing Remote Desktop ===
  
 
Reinstall the latest combo update.
 
Reinstall the latest combo update.
  
=== Slapd Daemon Crashing -&nbsp;org.openldap.slapd Throttling respawn ===
+
=== Slapd Daemon Crashing -&nbsp;org.openldap.slapd Throttling respawn ===
  
 
You may notice through system logs or crashes that the Slapd daemon (launched by launchd) is crashing. If you don't use OpenDirectory, or LDAP/OpenLDAP, or if you don't mind reverting the slapd settings to default, there are two solutions:
 
You may notice through system logs or crashes that the Slapd daemon (launched by launchd) is crashing. If you don't use OpenDirectory, or LDAP/OpenLDAP, or if you don't mind reverting the slapd settings to default, there are two solutions:
  
Solution 1 (RECOMMENDED):<br>http://support.apple.com/kb/TS3067
+
Solution 1 (RECOMMENDED):<br/> [http://support.apple.com/kb/TS3067 http://support.apple.com/kb/TS3067]
  
sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist<br>
+
sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist
  
 
Solution 2: Restore the default slapd settings:
 
Solution 2: Restore the default slapd settings:
Line 709: Line 834:
 
Solution 3 (not recommended): Disable org.openldap.slapd -- you can use Lingon for this.
 
Solution 3 (not recommended): Disable org.openldap.slapd -- you can use Lingon for this.
  
Seek out more info using this search:&nbsp;http://www.google.com/search?hl=en&amp;q=site:apple.com+org.openldap.slapd+Throttling+respawn - one of the more valuable results is a discussion post here:&nbsp;http://discussions.info.apple.com/thread.jspa?threadID=2171224
+
Seek out more info using this search:&nbsp;[http://www.google.com/search?hl=en&q=site:apple.com+org.openldap.slapd+Throttling+respawn http://www.google.com/search?hl=en&q=site:apple.com+org.openldap.slapd+Throttling+respawn] - one of the more valuable results is a discussion post here:&nbsp;[http://discussions.info.apple.com/thread.jspa?threadID=2171224 http://discussions.info.apple.com/thread.jspa?threadID=2171224]
 +
 
 +
== Managing Preferences ==
 +
 
 +
MCX - Managed Preferences - supported through 10.8
 +
 
 +
MDM - Configuration Profiles - iOS & OS 10.7+
 +
 
 +
Modify plist files - defaults write - to modify existing preference files plistbuddy - another option - may replace defaults can apply changes via command line, script, using management tools (Mavericks - cfprefsd - [https://github.com/mathiasbynens/dotfiles/issues/330 https://github.com/mathiasbynens/dotfiles/issues/330])
 +
 
 +
Modify default application - duti ([http://duti.org/index.html http://duti.org/index.html]) bundle identifier for an application: "defaults read /path/to/application/appname.app/Contents/Info CFBundleIdentifier" UTI (Uniform Type Identifiers) reference: [https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/UTIRef/Articles/System-DeclaredUniformTypeIdentifiers.html#//apple_ref/doc/uid/TP40009259-SW1 https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/UTIRef/Articles/System-DeclaredUniformTypeIdentifiers.html#//apple_ref/doc/uid/TP40009259-SW1]
 +
 
 +
== Privacy Settings ==
 +
 
 +
macOS Mojave (10.14) introduced Privacy settings (Security & Privacy system pane), including per-user and system-wide preferences to allow/deny Apple Events triggered by an application to access other applications/data/system resources. Simply put, managing these settings will help to avoid unwanted pop-ups when a new user logs into a Mac - arguably a desirable feature on shared-use computers. While on the other hand, the vendor defaults will provide a clear picture of what is going on with a user's privacy. Camera and Microphone defaults can only be set to "deny", not "allow".
 +
 
 +
Given that some settings are system-wide, and non-administrators cannot change those settings, there's a good argument to be made for pre-setting only system-wide settings for standard applications. Example - deny or allow Accessibility for Adobe Photoshop via Profile. Note: such settings applied via Profile may not be visible (let alone editable) within the System & Privacy pane!
 +
 
 +
Helpful tools to make this 'easy':
 +
 
 +
*Mobile Device Management (Jamf Pro 10.9+, or other) is a handy way to create & deliver Configuration Profiles for this purpose, assuming macOS 10.14+, User Approved MDM, & push notifications.
 +
*The BundleID is usually in the form com.vendor.Appname (ex. com.adobe.Photoshop)
 +
<pre>codesign -dr - /Applications/SampleAppName.app
 +
</pre>
 +
 
 +
capture text on line following
 +
<pre>designated =>
 +
</pre>
 +
 
 +
This is the "Code Requirement"
 +
 
 +
*Apps and/or Services must be specified, as well as whether to allow or deny this app access to those apps & services.
 +
 
 +
Some resources: Apple - [https://help.apple.com/deployment/mdm/#/mdm38df53c2a https://help.apple.com/deployment/mdm/#/mdm38df53c2a] JAMF - [https://www.jamf.com/jamf-nation/articles/553/preparing-your-organization-for-user-data-protections-on-macos-10-14 https://www.jamf.com/jamf-nation/articles/553/preparing-your-organization-for-user-data-protections-on-macos-10-14]
 +
 
 +
== FileVault Disk Encryption ==
 +
 
 +
FileVault encryption has been available for years in macOS. &nbsp;As of FileVault 2, it is 'whole disk encryption'. &nbsp;Please see Apple's documentation for details.
 +
 
 +
Command line tips:
 +
 
 +
to check encryption status<br/> "fdesetup status"<br/> "fdesetup help" for more options, though functions that can be done through System Preferences (or with the sysadminctl command) should take precedence.
 +
 
 +
to check if a user has "Secure Token" (can unlock the encrypted drive)&nbsp;<br/> "sysadminctl -secureTokenStatus username"<br/> "sysadminctl" provides many other useful options, though System Preferences is preferred where possible.
 +
 
 +
to remove Secure Token from a user (revoke their ability to unlock the drive) - this can be useful if the FileVault password gets out of sync with the login password (common for mobile accounts when the password is changed via a method other than Users & Groups in SysPrefs<br/> "sysadminctl&nbsp;-secureTokenOff <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)"
 +
 
 +
&nbsp;
 +
 
 +
A user must be an administrator AND&nbsp;have Secure Token to encrypt, decrypt, or allow others to unlock the drive (pass Secure Token to them).
 +
 
 +
A new mobile account user will have a prompt at first login that will allow an administrator with Secure Token to pass the token. &nbsp;If this opportunity is bypassed, The FileVault tab of the Security & Privacy SysPrefs is where the token can be passed, AND it will also be necessary to go to Users & Groups, and hover over the account icon to "edit" and apply an image to that account. &nbsp;(strange, but true)
 +
 
 +
&nbsp;
  
[[Category:Mac]]
+
[[Category:Mac]] [[Category:Advanced]]

Latest revision as of 15:46, 26 June 2019

NOTE: This page contains information that is only useful to Helpdesk / LIS faculty and staff. Therefore I'm considering moving this information to our Internal wiki. If you feel that this information is important to the general public and/or do NOT think that this move is appropriate, please comment on the discussion page.

--Hunt, Christopher 14:59, 17 November 2009 (UTC)

Contents

Mac Deployment, Management and Packaging

See Mac Deployment and Mac System Management Tools

Packaging Mac Software and Other Files

System, disks, users

Mount the PC portion (ISO 9660) of a hybrid disk on a Mac

This may be useful if you need to extract documentation or other files for the PC side of a hybrid disk, but all you have is a Mac.

  1. Unmount the mac cd volume via disk utility (don't eject just dismount). Find the disk ID of the CD/DVD drive by selecting the CD/DVD device in disk utility and clicking the Info icon.
  2. Open terminal and type:
    sudo mkdir /Volumes/myisodisk
    sudo mount -t cd9660 /dev/diskID /Volumes/myisodisk
    replace the diskID above with the disk ID you got in step 1.
  3. That's it. Browse the cd via the Finder.

Scripting Adding and Removing Network Interfaces

See man networksetup

Why your Mac might not sleep

http://support.apple.com/kb/HT1776

Also: Sleep delayed if print job is in progress or printer isn't available (http://support.apple.com/kb/TS3216)

Refresh disk arbitration

Note: This may force disks that haven't mounted to mount.

disktool -r

Enable Journaling

diskutil enableJournal /

Matching Mac Model Name with Model Identifier, Mac OS X Build, production date, and Apple Hardware Test version

  1. Get Model IDENTIFIER from System profiler (it will look like Model Identifier: MacBookPro2,2)
  2. Visit http://mactracker.dreamhosters.com/iphone/#_modelWindow and find the model with that identifier
  3. Done

More useful resources:

Programatically Delete Cached User Accounts

From http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html

# Script to remove cached accounts in the local DS node
# This should work in both Tiger and Leopard
# Run this script as root or with sudo
#!/bin/sh

# dscl searching only does exact matches.  So we list the records and pipe them through to grep to find the list of records we want.
# The first column will be the username and we get that using awk.
# We also remove the line endings with tr to make it one long string.

for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser                    # now we delete the record using dscl
done

More resources: http://www.macosxhints.com/article.php?story=20080127172157404
http://www.google.com/search?client=safari&rls=en-us&q=leopard+script+delete+user+account+dscl&ie=UTF-8&oe=UTF-8

Enabling Directory Service debug logging

sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Disabling Directory Service debug logging

sudo rm /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Resetting Mac OS X Machine Account Domain Password

See http://www.afp548.com/article.php?story=20061217110502523

Forcefully remove a Mac from the domain

sudo dsconfigad -r -f -u username -p password

Where "username" is the username that was used to add the machine to the domain, and "password" is this username's password.

Resetting Directory Service Settings

This is useful in cases where removing/adding the computer from/to the domain does not work using the standard method (Manually Add a Mac to the Domain). The instructions below forcefully remove (unbind) the mac from the domain:

  1. Login with a local account.
  2. Open the Terminal application
  3. Enter each of the lines below, followed by pressing enter:
sudo rm -rdfv /Library/Preferences/DirectoryService
sudo rm -rdfv /var/db/dslocal/nodes/Default/config
sudo sudo killall -USR1 DirectoryService
  1. Open Macintosh HD => Applications => Utilities => MIDD => Midd1stBootConfig.
  2. Follow the on-screen instructions. When the "Update User Template" application opens, click "Quit".
  3. Reboot and try logging in again with your domain account. If that fails Manually Add a Mac to the Domain.

Lookup Certificates from Active Directory

http://support.apple.com/kb/HT3915

Force the Generation or Creation of a Kerberos Ticket

http://support.apple.com/kb/HT4100

Summary:

edit /etc/authorization and under <key>system.login.console</key> add:
<string>builtin:krb5store,privileged</string>

Slow SMB Access - Possible Fix

sudo sysctl -w net.inet.tcp.delayed_ack=0

P.S. "CIFS" as newer revision of SMB - SMB doesn't lock files properly and results in errors saving files when the files have been opened within an application (as opposed to opening in the Finder) - not likely a speed issue, but worth noting here.

Macs Randomly Unbinding from Domain

  • If the problem is that the user recently changed their password and the computer is still remembering the old one, try updating the Login keychain: http://support.apple.com/kb/ht1631#
  • For cases where the connection to the domain has been lost entirely, stuck Macs of 10.6 and below can be reset by deleting the kerberos.mydomain.plist and restarting the DirectoryService; this is what the "Re-Bind 10.6-" policy on Casper does.
  • They changed how domain binding works in Lion; the "Re-Bind 10.7+" policy was designed to address this, but as of 2013.03.18 it does not work. For now:
    1. Go to System Preferences>Users & Groups>Login Options.
    2. "Network Account Server" should say MIDD; click Edit, then Open Directory Utility.
    3. Select Active Directory (the first option) and click the pencil below to edit.
    4. Click Unbind and enter domain technician credentials.
    5. In the "Active Directory Domain" field, type "middlebury.edu", click Bind, and enter your credentials again.
    6. Click Show Advanced Options and adjust some checkboxes:
      • YES, Create mobile account at login
        • NO, do not require confirmation
      • Yes, default user shell
    7. Then on the Administrative tab:
      • YES, Allow administration by:
        • Add "MIDD\Helpdesk Staff" to the list
      • Yes, allow authentication from any domain in the forest
    8. Close that window and hit Apply in the Directory Utility window if highlighted, then close it.
    9. Back in Users and Groups, under Login Options, confirm the following:
      • Automatic login OFF
      • Display login window as Name and Password
      • Show the Sleep, Restart, and Shut Down buttons
      • Allow network users to log in at the login window

You can check the connection to the domain by unlocking a system preference with your credentials. It's also good to check that users who haven't logged into the computer before can login over the network.

  • This might be a good way to prevent the problem from happening: "change the passinterval on the clients. I ran the following script via Apple Remote Desktop as root and haven't had any problems since:
    dsconfigad -f -r -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword
    sleep 10
    dsconfigad -lu localadminusername -lp localadminpassword -passinterval 0
    sleep 10
    computerid=`/usr/sbin/scutil --get LocalHostName`
    dsconfigad -f -a $computerid -domain yourdomain -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword -ou ou=yourOU,DC=yourDC,DC=yourDC -status
    Source:http://www.macwindows.com/snowleopardAD.html#051810d

Cannot Login with Domain Account

  • Mac is properly bound to AD
  • Logging in with local account works
  • Cannot login with Domain Account

Troubleshooting:

Change of Username

When AD account username is changed, old username will continue to be in use for logging into the Mac. This is the solution to update the account for use with the new username:

Slow Authentication at Login Screen

As a troubleshooting step, try specifying the domain name along with the username at the login screen. Other options include editing the LDAP timeout in the Directory Service plist. Source: http://www.macwindows.com/snowleopardAD.html#051810d 

GSSAPI Error - Kerberos

http://support.apple.com/kb/TS3070

Reset Mac user or admin password

Can require install disks to reset if you have forgotten the old password. Help here

Give admin (administrator) privileges to a user using the Terminal

Open Terminal, type the line below, hit enter:

sudo dscl . -append /Groups/admin GroupMembership usernamegoeshere

The reverse step uses "-delete" in place of "-append" - use this to remove admin privileges - this can be also useful to remove account information from the 'admin' or 'staff' groups in the case of a username change (remove entries for the old username to allow login with the new username on the same account)

To check who's an admin currently:

dscl . -read /Groups/admin | grep GroupMembership

The above can also be used in ARD commands or in shell scripts.

Upgrade groups to the new UID format

This allows nested group (i.e. a domain group to be a member of a local group).

dseditgroup -o edit -t group -f n groupnamegoes here

 

Make the admin group a member of the _lpadmin group

  • Easy solution: Connect to Middfiles and open Software => Software Macintosh => Quick-Fixes. Double-click Add Printer - Permissions Problem Fix (lpadmin).app
  • The harder solution (run commands below): This converts the _lpadmin and the admin group to the new format, adds the key NestedGroups to the _lpadmin group and populates it with the GUID of the admin group. Finally, the admin account is made a member of the _lpadmin group.

dseditgroup -o edit -t group -f n admin
dseditgroup -o edit -t group -f n _lpadmin
dseditgroup -o edit -a admin -t group _lpadmin
dscl localhost -create /Local/Default/Groups/_lpadmin NestedGroups ABCDEFAB-CDEF-ABCD-EFAB-CDEF-00000050
dseditgroup -o edit -a admin -t group _lpadmin

Add an application to the dock using a script

  • Add for current user:
defaults write com.apple.dock persistent-apps -array-add "<dict><key>tile-data</key><dict>\
<key>file-data</key><dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
<key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>";
  • Add for default user template:
defaults write /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.dock \
persistent-apps -array-add "<dict><key>tile-data</key><dict><key>file-data</key>\
<dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
<key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>";
  • Add for all users (current and future):
for folder in /Users/*
do
defaults write $folder/Library/Preferences/com.apple.dock persistent-apps -array-add \
"<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key>\
<string>/Applications/Final Cut Express.app</string><key>_CFURLStringType</key>\
<integer>0</integer></dict></dict></dict>";
currentuser=`basename $folder`
chown $currentuser $folder/Library/Preferences/com.apple.dock.plist
done

Run a command for each user

for folder in /Users/* echo "Doing a command for $folder" done

For example, this command sets the default printer to LIB242K:

for folder in /Users/*
do
echo Default LIB242K > $folder/.cups/lpoptions
chmod 777 $folder/.cups/lpoptions
done

 

Distribute a file to each user's home dir

E.g. distribute custom print settings to each user

for folder in /Users/*
do
ditto -V $folder/Library/Preferences/com.apple.print.custompresets.plist \
$folder/Library/Preferences/com.apple.print.custompresets.bak
ditto -V /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.print.custompresets.plist \
$folder/Library/Preferences/com.apple.print.custompresets.plist
chmod 777 $folder/Library/Preferences/com.apple.print.custompresets.plist
done

ARD techniques

Sharing ARD Preferences with other users

See http://www.versiontracker.com/dyn/moreinfo/macosx/10907697 (Seize the ARD).

ARD - Limit the number of simultaneous authentication requests

http://support.apple.com/kb/HT3803

ARD - Disable build_hd_index

http://support.apple.com/kb/HT1088

Known ARD Issues

See Known ARD Issues.

Desirable ARD commands

  • Set disk permissions. Ignore permissions.
  • Add ACLS for folders
  • Run login permission script
  • unbind/rename/rebind/rescan/apply proper admin privs.
  • login items fix

Installing (Pushing) Adobe CS via ARD

Note: This assumes you've created a disk image with the applications (from /Applications), and a disk image with the settings (in /Library/Application Support, as well as /Library/Preferences).

hdiutil attach /adobepro.dmg
ditto -V /Volumes/adobepro /Applications
hdiutil detach /Volumes/adobepro
rm -rdfv /adobepro.dmg

hdiutil attach /settings.dmg
ditto -V /Volumes/settings /Library
hdiutil detach /Volumes/settings
rm -rdfv /settings.dmg

Installing LabStats via ARD

  • Requirements: If the client computers are running Mac OS X Leopard, you need LabStats version 4.4.x (at least).
  1. On your ARD computer, visit the labstats admin page and download the Mac installer.
  2. Unzip it the package, and you will get two files (one ending in tar.gz, one ending in conf)
  3. Unpack the tar file (double-clicking should suffice) until you see the install package (ends with pkg).
  4. Open ARD, select the client computers (the ones that need labstats), then click "Copy"
  5. Drag the pkg file and the conf file to the upper portion of the copy window (you can also use the + button), under "Place Item In" specify the full destination to "/tmp" (without the quotes), then click Copy.
  6. When the copy process finishes, select the same computers again and click the Unix command button. In the window that appears, paste these lines in the upper portion:
    installer -package /tmp/labstats_mac_client_installer.pkg -target / 
rm -rdfv /tmp/labstats* 
  1. Under "Run the command as" enter the user "root" and click "Send"

Mute or set volume via ARD

osascript -e "set volume 0"

Change the zero to another number to set the volume to a higher value. Zero is mute. This seems to be system wide. It also mutes the startup chime. Good for classrooms. If headphones are plugged in, they have a separate volume setting.

Make Macs Speak via ARD

say "I hate Macs"

Set the Open Firmware password via ARD

Note: You need our Open Firmware package for this! It should be on our Mac server.

sudo ofpassword set blahblah123

Enable SSH via ARD

This seems to work:

systemsetup -setremotelogin on

If you get saclutil you can restrict ssh login to a single user or group:

saclutil -s ssh -a -u jsmith

group: saclutil -s ssh -a -g admin

To undo SACLs for ssh:

saclutil -s ssh -d

Some other ideas:

echo yes | /System/Library/CoreServices/RemoteManagment/ARDAgent.app/Contents/Support/systemsetup -setremotelogin on
/sbin/service ssh start
echo "AdminsPassHere" | sudo service ssh start

This seems to work until reboot:

/usr/sbin/sshd

Enable ARD remotely

e.g. via SSH

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users admin -privs -all

If nothing's been enabled, the full line should look like: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu

Mount AFP volume via applescript via ARD

osascript -e 'mount volume "afp://user:password@computername/Macintosh HD"'

Check if a process is running via ARD

E.g. Check if AFP server is running

ps -axww | grep -i "AppleFileServer"

Start AFP sharing remotely

  1. Change /etc/hostconfig so that AFPSERVER=-YES=
  2. Send unix script
    sudo AppleFileServer

TWICE

Get folder size via ARD

du -d 1 -h /Users/Shared/editingclass

Set power management on Macs via ARD

Can be done using the pmset command. Remember to always execute this command as user "root" in ARD. Examples:

  • Instructor stations that need to remain awake for the duration the class:
    pmset -a sleep 0 disksleep 10 displaysleep 75

The sleep parameter tells the computer never to sleep, disksleep makes the hard disk spin down in 10 minutes, displaysleep makes the monitor remain awake for 75 minutes.

  • Regular workstations that need to remain awake for management purposes can turn off the screen (e.g. after 35 mins) and spin down the hard disk to save power:
    pmset -a sleep 0 disksleep 10 displaysleep 35
  • Alternatively, the machines can be turned off / set to sleep whenever and you designate a "remote management" time period (say, every day after 3:00am). The Mac OS X power management allows you to set the computer to wake up or power on at a specific day and time. This way if a machine was turned off or set to sleep, it can become available for updates, etc. Here's an example:
    pmset repeat wakeorpoweron MTWRF 03:00:00

This wakes the machine (if it's asleep) or powers it on (if it's turned off), every weekday at 3am.

Get Link Speed

ioreg -l | grep "IOLinkSpeed"

Divide by 1000000 to get "human readable".

Application tips

Pushing LabStats via ARD

Labstats can be pushed via ARD. There are two methods, both start with the same process:

  1. On a machine with ARD, grab the Mac labstats installer from http://labserver:8080/admin
  2. Unpack it, you'll get two files - a pkg package and a "conf" file.

Method 1: Copy the labstats.conf file INSIDE the installer (ctrl+click on the installer, open Contents => Resources => drag the conf file in here). Open the file named "postflight", delete everything in it and replace it with:

#!/bin/sh

ditto "$1/Contents/Resources/labstats.conf" /private/etc/labstats.conf
chown root:wheel /private/etc/labstats.conf
SystemStarter start LabstatsClient

Method 2: Push the default config file AFTER pushing labstats: Use the ARD "copy" button to copy the conf file to a custom destination: /etc

Reset Spotlight

sudo mdutil -i off /
sudo mdutil -E /
sudo mdutil -i on /

Update Symantec AntiVirus

LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

LiveUpdate tends to be in the root library support folder: /Library/Application\ Support/Norton\ Solutions\ Support/LiveUpdate/LiveUpdate.app/Contents/MacOS/LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

Check when an application was last opened

mdls -name kMDItemLastUsedDate /Application/Application.app

Check an entire folder:

mdls -name kMDItemLastUsedDate /Application/*

Filter applications from an entire folder:

mdls /Applications/Adobe\ Photoshop\ CS/* | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemLastUsedDate)|(app)'

Batch checking

mdls "/Applications/Macromedia Dreamweaver MX 2004/Dreamweaver MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Flash MX 2004/Flash MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Fireworks MX 2004/Fireworks MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/Adobe Photoshop CS/Adobe Photoshop CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe InDesign CS/InDesign CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe Illustrator CS/Illustrator CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/GarageBand.app" | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

X11 and the PATH variable in Leopard and Snowleopard

There seems to be no way to directly set the X11 PATH variable. However, if you correctly set your PATH variable in the Terminal (check the command path_helper), you can then launch xterm (X11) from Terminal.app and it will inherit the PATH variable.

A massive X11 FAQ is available here: http://forums.macosxhints.com/showthread.php?t=80171

Network & Printers

Get MAC Address

/sbin/ifconfig en0 | grep ether | cut -d' ' -f 2

Set computer name

sudo scutil --set LocalHostName NEWCOMPUTERNAME
sudo scutil --set ComputerName NEWCOMPUTERNAME

Printers: Install, delete, set as default

List installed printers

lpstat -p

Install

lpadmin -p printer_name -E -v lpd://server/printer -P path-to-ppd.gz
  • An example with a compressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.gz

  • Or an uncompressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.ppd

Must be followed by

cupsenable printer_name

Delete

lpadmin -x printer_name

e.g.:

lpadmin -x AdobePDF7

Set as default

lpadmin -d printer_name

Install but disable sharing and add description

lpadmin -p printer_name -E -v lpd://server/printer -D "Room AB123" -P ppdpath -o printer-is-shared=false

Enabling Duplexing

On HP printers this should suffice:

lpadmin -p prntr -E -v lpd://srv/prnt -D "rmnr" -P "ppdpath" -o "HPOption_Duplexer=True" -o Duplex=DuplexNoTumble

On other models you can try listing the available printer options, then pass the appropriate option to lpadmin using the "-o" parameter. To list all available printer options, install the printer on any one workstation and then run:

lpoptions -p printer_name -l

For an HP laserjet the above command gives two options related to duplexing: HPOption_Duplexer and Duplex -- so those are the parameters passed using "-o" in the example above.

Enable Printing Controls for Users

Situation: local printer stops while printing, and standard user cannot resume job. Or non-admin should be allowed to install a new printer queue. /private/etc/cups/cupsd.conf/ can be edited for granular permissions to functions normally reserved for members of admin & lpadmin groups, for example.

 

Misc

List of Mac SMC and EFI Firmware Updates

http://support.apple.com/kb/HT1237

It may be possible to automate the installation of these by using the -y switch:
http://support.apple.com/kb/HT3962
sudo ./Contents/Resources/RemoteEFIUpdater -y -shutdown

Remedying and preventing duplicate DDNS registrations in Mac OS X, or , steps to fully rename a Mac -- may be able to omit Keychain and Kerberos commands.

NOTE: You may need to combine these fixes with the suggestions outlined in the next section Advanced_Mac_Configuration_Topics#Macs losing AD bind connection or unable to login to a domain account on a Mac.

  1. remove computer from domain
  2. Run these commands
sudo /usr/sbin/systemkeychain -k /Library/Keychains/System.keychain -C -f
sudo rm -rf /var/db/krb5kdc
sudo /usr/libexec/configureLocalKDC
(this ensures uniqueness of local kerberos db)
  1. Optionally, if he system is having SMB authentication issues, follow these instructions: http://support.apple.com/kb/HT3169
  2. Rename computer as desired under System Preferences => Sharing, then run these commands:
sudo hostname NEWCOMPUTERNAME
sudo scutil --set ComputerName NEWCOMPUTERNAME
sudo scutil --set LocalHostName NEWCOMPUTERNAME
sudo scutil --set HostName NEWCOMPUTERNAME
(this ensures all possible host names are the same - don't ask why there are 4 different places)
  1. Open Directory Utility, AD plugin, rename computer as desired there, then bind to domain (adding to correct OU)
  2. If the computers are connected to an XSan, you may need to re-enter username/password in Xsan admin app. May need to remove computer from Xsan database and re-add.
  3. For a computer name change, if the username has changed in AD as well, see [[1]].

Macs losing AD bind connection or unable to login to a domain account on a Mac

NOTE: You may need to combine these fixes with the suggestions outlined in he previous section Advanced Mac Configuration Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X. More information here: http://www.macwindows.com/leopardAD.html (search for “losing” or look under http://www.macwindows.com/leopardAD.html#012209e)

Proposed fixes: http://www.macwindows.com/Kerberos-workarounds-for-Macs-losing-AD-binding.html

And

http://www.macwindows.com/Readers-verify-modify-Kerberos-fixes-for-Mac-AD-binding.html

Proposed cause for the issue: Then one of our staff went to an Apple Integration seminar at Cambridge (UK) where the little known fact emerged that Leopard has a persistent Kerberos certificate which can cause problems with just such things as binding to AD. This is a particular problem if using an image to build multiple machines which are then bound to AD - it is the equivalent of having identical machine accounts on windows.

Apple’s take on the issue: http://support.apple.com/kb/TS1245

Also, verify the correct date, time, and time zone information in System Preferences.  If system is bound to domain, also verify in Directory Utility that the Search Policy includes an entry for "/Active Directory/All Domains".

If computer is properly bound (admin can verify by attempting to unlock system preferences), but no domain account can log in, be sure the setting allowing network users to log in is checked in Users system pane (if present).

If some accounts can login, but others cannot that have been used before (most commonly due to a username change), may need to delete account, verify the username folder has been removed, and also remove from the Groups/admin and/or Groups/staff list (using "dscl" command with the "-remove" switch).

Connect to an AFP server from the command line

sudo mkdir /Volumes/myserver
mount_afp afp://username:password@servername/sharename /Volumes/myserver

Reimage a mac from an image using the command line asr

sudo asr restore --source /Volumes/Source/Image.dmg --target /Volumes/Destination --erase --noverify

Note: This ERASES the destination drive. It also skips verification (which Disk Utility forces you to do, thus adding 10-15 minutes to the imaging process). Verification is GOOD, but sometimes, when you're sure that the image is healthy and your destination drive is healthy, it can be a waste of time.

Manipulating and modifying ACL permissions from the command line terminal

Read ACL

ls -le /path/to/dir

Write ACL

chmod -R +a "group:admin allow read write delete" /path/to/dir

Delete ACL

chmod -R -a# 0 /path/to/dir

Run an ASR server

GUI: Protonpack

sudo asr -source /Volumes/Images/image.dmg -server /path/to/config.plist

Restore a client from an ASR server

GUI: NetRestore

sudo asr -source asr://serverip -targer /Volumes/Volume -erase -noverify

Set expanded windows for save and print

defaults write -g PMPrintingExpandedStateForPrint -bool TRUE

defaults write /Library/Preferences/.GlobalPreferences NSNavPanelExpandedStateForSaveMode -string 1

 

Pre-populate the username field in the Connect to Server window

http://support.apple.com/kb/HT4121?viewlocale=en_US

E.g.:
defaults write /Library/Preferences/com.apple.NetworkAuthorization UseShortName -bool YES

Make the help window and the add printer (addprinter.app) window act normal

This makes the help window and addprinter.app window accessible to the Dock and command-tab.

i=/System/Library/CoreServices/AddPrinter.app/Contents/Info.plist
sudo defaults write "${i%.plist}" LSUIElement 0
sudo chmod 644 "$i"


i=/System/Library/CoreServices/Help\ Viewer.app/Contents/Info.plist
sudo defaults write "${i%.plist}" LSUIElement 0
sudo chmod 644 "$i"

Variables available to shell scripts in Installer packages

  • $1: Full path to the installation package the Installer application is processing.
  • $2: Full path to the installation destination
  • $3: Installation volume (or mountpoint) to receive the payload
  • $4: The root directory for the system:
  • $SCRIPT_NAME: Filename of the operation executable
  • $PACKAGE_PATH: Full path to the installation package
  • $INSTALLER_TEMP: Scratch directory used by Installer to place its temporary work files
  • $RECEIPT_PATH: Full path to a temporary directory containing the operation executable

 

Slipstreaming Office 2008 for Mac

See: Slipstreaming Office 2008 for Mac

Apple System Image Utility Tips

  • When creating a workflow, "Define Image Source" needs to be on top and "Create Image" on the bottom of the workflow. The rest of the actions may have any order (or so it appears).

Archiving user accounts from a previous semester

cd /Users/
mkdir zz_PreviousSememsters
for cfolder in /Users/*
do
echo $cfolder
echo "$cfolder" | grep -x zz_PreviousSememsters
if [[ $? > 0 ]]
then
echo "absent"
mkdir "$cfolder"
mv -f "$cfolder" "/Users/zz_PreviousSememsters/"
else
echo "present"
return 0
fi

done

Deleting ALL cached domain user accounts

You can also delete all accounts from the entire semester:

# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser
rm -rdfv /Users/$cuser
done


# Deleting the Shared files
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*

Deleting ALL cached domain accounts except those on a custom list

#Set the warning flag to off (case sensitive) if you want to start the deletion of accounts.
MIDD_WARNINGFLAG=on

#Set this flag to true if you want /Users/Shared to be deleted, as well.
MIDD_DELETESHARED=false

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
then
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
else
ls -a /Users/
#Accounts listed here will not be deleted. Local accounts are not deleted by default.
MIDD_DONTDELETE=admin,jsmith,joejohn
# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
echo $MIDD_DONTDELETE | grep -i "$cuser"
if [ $? == 1 ]
then
echo "Deleting $cuser"
dscl . -delete /Users/$cuser
rm -rdf /Users/$cuser
else
echo "$cuser in exclusions list, not deleting"
fi
done

if [[ "$MIDD_DELETESHARED" == "true" ]]
then
# Deleting the Shared files
echo Deleting "/Users/Shared"
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*
else
echo "MIDD_DELETESHARED is set to false so I'm not deleting any files in /Users/Shared"
fi
fi

Erasing a volume entirely and setting permissions

#Set the warning flag to off (case sensitive) if you want to start the deletion.
MIDD_WARNINGFLAG=on

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
then
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
else
echo Permissions status before erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"

echo Erasing Save Here volumes
diskutil eraseVolume "HFS+" "Save Here" "/Volumes/Save Here"
diskutil eraseVolume "HFS+" "Save Here" /Volumes/SaveHere

echo Ensuring proper permissions status after erasing
vsdbutil -d /Volumes/SaveHere
vsdbutil -d "/Volumes/Save Here"

echo Reporting permissions status after erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"
fi
  • Alternatively, you can replace the "diskutil eraseVolume..." lines with something like rm -rdf "/Volumes/path/to/specific folder to clear"==

Moving a users folder manually to a new machine

If you move a user's home folder to a new machine you can run this command as root (or sudo -s) to apply ownership of the folder to the user and domain users (as the group). This does not change the actual permissions, just the ownership. Launch the Terminal and do the following.

sudo -s
cd /Users
chown -vR username username
chgrp -vR midd\\domain\ users username
exit

How this works... the sudo -s makes you a root user (assumig you should be) until you type exit. 'cd' is used to get to the User's folder (where you should have copied the user's homefolder named username). chown -vR un un will change ownership recursively and show you that it is working. chgrp -vr... will change the group the same way. The \\ is used to escape the \ character and the space between domain and users. The exit is to make sure you get out of being a super user. You could throw in a second 'exit' if you wanted to exit out of the terminal completely.

 

Kerberos Issues

Kerberos KDC location specified in krb5.conf is not respected: http://support.apple.com/kb/TS3265

Mac OS X v10.6 Clients bound to Active Directory may not be able to dismiss screen saver using Active Directory credentials

Resolution
From the Go menu choose Go to Folder.
Type etc , then click Go.
Open the file named "authorization" in a text editor.
Find the following text in the "system.login.screensaver” entry:
<string>The owner or any administrator can unlock the screensaver.</string>

Change it to this:
<string>(Use SecurityAgent.) The owner or any administrator can unlock the screensaver.</string>
Save the file.

http://support.apple.com/kb/TS3287

 

High Sierra macOS 10.13 stuff

APFS file system - encryption is native - adds Secure Token concept Secure Token is required of users to unlock an encrypted drive, and is granted by default to the first account, and subsequent local accounts, but not to mobile accounts.

sysadminctl command is useful for checking Secure Token status, and is the new supported tool for changing passwords and creating accounts through scripted means. dscl is NOT supported!!!

Check Secure Token: 'sysadminctl -secureTokenStatus usernamehere' Directory Utility also has an entry that allows lookup of one user at a time

Also see "FileVault"

Mac OS X Server and Xserve Administration

NetBoot Across Subnets

http://support.apple.com/kb/HT4187

Configuring service principals in Active Directory when using a disjoint namespace

See: http://support.apple.com/kb/HT3795

AFP users unable to authenticate with Kerberos after upgrading

sudo sso_util configure -r REALM_NAME -a diradmin afp
See: http://support.apple.com/kb/TS2938

Cannot authenticate to SMB shares when bound to Windows Server 2008 Active Directory

See: http://support.apple.com/kb/TS2967

Cannot configure Lights-Out Management after installing Remote Desktop

Reinstall the latest combo update.

Slapd Daemon Crashing - org.openldap.slapd Throttling respawn

You may notice through system logs or crashes that the Slapd daemon (launched by launchd) is crashing. If you don't use OpenDirectory, or LDAP/OpenLDAP, or if you don't mind reverting the slapd settings to default, there are two solutions:

Solution 1 (RECOMMENDED):
http://support.apple.com/kb/TS3067

sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist

Solution 2: Restore the default slapd settings:

sudo mv /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak

sudo ditto /etc/openldap/slapd.conf.default /etc/openldap/slapd.conf

Solution 3 (not recommended): Disable org.openldap.slapd -- you can use Lingon for this.

Seek out more info using this search: http://www.google.com/search?hl=en&q=site:apple.com+org.openldap.slapd+Throttling+respawn - one of the more valuable results is a discussion post here: http://discussions.info.apple.com/thread.jspa?threadID=2171224

Managing Preferences

MCX - Managed Preferences - supported through 10.8

MDM - Configuration Profiles - iOS & OS 10.7+

Modify plist files - defaults write - to modify existing preference files plistbuddy - another option - may replace defaults can apply changes via command line, script, using management tools (Mavericks - cfprefsd - https://github.com/mathiasbynens/dotfiles/issues/330)

Modify default application - duti (http://duti.org/index.html) bundle identifier for an application: "defaults read /path/to/application/appname.app/Contents/Info CFBundleIdentifier" UTI (Uniform Type Identifiers) reference: https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/UTIRef/Articles/System-DeclaredUniformTypeIdentifiers.html#//apple_ref/doc/uid/TP40009259-SW1

Privacy Settings

macOS Mojave (10.14) introduced Privacy settings (Security & Privacy system pane), including per-user and system-wide preferences to allow/deny Apple Events triggered by an application to access other applications/data/system resources. Simply put, managing these settings will help to avoid unwanted pop-ups when a new user logs into a Mac - arguably a desirable feature on shared-use computers. While on the other hand, the vendor defaults will provide a clear picture of what is going on with a user's privacy. Camera and Microphone defaults can only be set to "deny", not "allow".

Given that some settings are system-wide, and non-administrators cannot change those settings, there's a good argument to be made for pre-setting only system-wide settings for standard applications. Example - deny or allow Accessibility for Adobe Photoshop via Profile. Note: such settings applied via Profile may not be visible (let alone editable) within the System & Privacy pane!

Helpful tools to make this 'easy':

  • Mobile Device Management (Jamf Pro 10.9+, or other) is a handy way to create & deliver Configuration Profiles for this purpose, assuming macOS 10.14+, User Approved MDM, & push notifications.
  • The BundleID is usually in the form com.vendor.Appname (ex. com.adobe.Photoshop)
codesign -dr - /Applications/SampleAppName.app

capture text on line following

designated => 

This is the "Code Requirement"

  • Apps and/or Services must be specified, as well as whether to allow or deny this app access to those apps & services.

Some resources: Apple - https://help.apple.com/deployment/mdm/#/mdm38df53c2a JAMF - https://www.jamf.com/jamf-nation/articles/553/preparing-your-organization-for-user-data-protections-on-macos-10-14

FileVault Disk Encryption

FileVault encryption has been available for years in macOS.  As of FileVault 2, it is 'whole disk encryption'.  Please see Apple's documentation for details.

Command line tips:

to check encryption status
"fdesetup status"
"fdesetup help" for more options, though functions that can be done through System Preferences (or with the sysadminctl command) should take precedence.

to check if a user has "Secure Token" (can unlock the encrypted drive) 
"sysadminctl -secureTokenStatus username"
"sysadminctl" provides many other useful options, though System Preferences is preferred where possible.

to remove Secure Token from a user (revoke their ability to unlock the drive) - this can be useful if the FileVault password gets out of sync with the login password (common for mobile accounts when the password is changed via a method other than Users & Groups in SysPrefs
"sysadminctl -secureTokenOff <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)"

 

A user must be an administrator AND have Secure Token to encrypt, decrypt, or allow others to unlock the drive (pass Secure Token to them).

A new mobile account user will have a prompt at first login that will allow an administrator with Secure Token to pass the token.  If this opportunity is bypassed, The FileVault tab of the Security & Privacy SysPrefs is where the token can be passed, AND it will also be necessary to go to Users & Groups, and hover over the account icon to "edit" and apply an image to that account.  (strange, but true)

 

Powered by MediaWiki