Files become hidden on network share

Had a colleague today that had a small rsync script that synced a local folder to a network share. Since he upgraded to OS X 10.9 all the files synced to the network share got the hidden flag set, so the files became invisible. First I thought it was rsync that made some strange things to the files, but after some testing I found out that if you mapped the network share through smb1 (cifs://) and not smb2 (smb://) the sync worked as expected!

Apples implementation of smb2 seems a bit unstable. This is not the first problem we experience with smb2 on OS X 10.9.

Deploying iLife '13 and iWork '13

Just thought I would share my experiences regarding deploying the new versions of iLife and iWork that is only available through Mac App Store (MAS).

The best way to deploy iLife and iWork '13 according to me, after quite extensive testing, is to download the MAS installer packages the same way as Rich Trouton describes here: http://derflounder.wordpress.com/2013/08/22/downloading-apples-server-app-installer-package/

BUT! If you deploy these packages, GarageBand will fail to launch. It will say that the application is damaged. The solution to this is to create an empty MAS receipt file inside GarageBand.app (mkdir GarageBand.app/Contents/_MASReceipt || touch GarageBand.app/Contents/_MASReceipt/receipt).

I've just added a script in our DeployStudio workflow that creates this file, that way we keep the installer packages unmodified.

Now to the "funny" things... 

• MAS will not fully recognize the installed applications. It sees that the applications is installed, but shows there are updates to them, even if it's the same version that is installed.
• If you add a dummy receipt file inside the application, MAS will not show any updates for that application, even if there are updates. I tested this with iPhoto 9.5. The latest version at the time of writing is 9.5.1. What I did was to add this dummy receipt file inside iPhoto.app, launch MAS and checked for updates. No updates available. If I searched iPhoto in MAS, it said it would cost 109 kr (SEK). If I then deleted the receipt file, suddenly an update was available in MAS for iPhoto.
• Because of the behavior I've experienced with the dummy receipt file, MAS will most likely not show any updates for GarageBand once an update is released. And without the dummy receipt, GarageBand will fail to launch.
• If you package the applications from your own computer, they will be tied to your Apple ID and none other than you can update them on the machines you deploy them to.

So the conclusion is this:

1. Download and install the new iLife and iWork applications the same way Rich describes in the link above.
2. Create the dummy receipt file inside GarageBand.app. Up to this point, users can use the apps, but not update GarageBand.
3. To update iLife and iWork apps; go to MAS and install all the available updates, even if it's the same version as the version installed.
4. Search MAS for GarageBand (since MAS will not list any updates for GarageBand because of the empty receipt file) and install it over the old one (MAS will ask you if you want to buy it, click "Buy", it's free anyway...
5. Now the apps works as supposed and has a real receipt file, but are tied to the Apple ID that installed the updates.

This is not an acceptable method according to me, but the only I've found out working. Luckily, in our organization, there aren't many using GarageBand...

If anyone has a better solution, please share it!

Suppress iCloud dialog at first login

Greg Neagle writes about it here, using MCX. But for me this didn't work (tried it as a local MCX and a profile).
This is how I do it: The information that the iCloud panel has been shown is stored inside ~/Library/Preferences/com.apple.SetupAssistant.plist and the keys is the same as you find in Greg's article, namely:

 "DidSeeCloudSetup"
and
"LastSeenCloudProductVersion"

"DidSeeCloudSetup" should be set to "true" (boolean) and "LastSeenCloudProductVersion" to 10.8 (string). This is what I put in my firstboot.sh for this to work:

OSVERS=$(sw_vers | awk -F. '/ProductVersion/  {print $2}')

USERTEMPLATES=$(find "/System/Library/User Template" -type d -maxdepth 1)

USERHOMES=$(find "/Users" -type d -maxdepth 1 | grep -v Shared)

if [ "$OSVERS" = "8" ]; then
echo "This is OS X 10.8, running specific tasks for 10.8"
#Suppress iCloud dialog when logging in
echo "Suppressing iCloud dialog at login"
for templates in $USERTEMPLATES; do
defaults write "$templates/Library/Preferences/com.apple.SetupAssistant" DidSeeCloudSetup -bool true
defaults write "$templates/Library/Preferences/com.apple.SetupAssistant" LastSeenCloudProductVersion -string 10.8
done
for userhome in $USERHOMES; do
defaults write "$userhome/Library/Preferences/com.apple.SetupAssistant" DidSeeCloudSetup -bool true
defaults write "$userhome/Library/Preferences/com.apple.SetupAssistant" LastSeenCloudProductVersion -string 10.8
done
fi

The first for loop takes care of the user templates so any new user that is created gets this preference. The second loop writes the preference to any existing home directory. Quite ugly, but it works...

Adobe Provisioning Tool errors

My sincere belief is that Adobe can't do anything correct. To begin with, as they now released CS6 they demand that every user have to register their product with that user's AdobeID. Or else the product will not start after 7 days. As an enterprise customer you can work around this by repackaging all the CS6 products with Adobe's AAMEE tool (Adobe Application Manager Enterprise Edition). Adobe calls this a "minor impact" in their document describing this. Well, I can tell you, repackaging about 10 products in both English and Swedish on two platforms, summing up to a total of 40 products takes a few hours... And not a single word to us customers that this was going to happen! Well, enough about that... When I got to repackage Acrobat Pro X, the errors continues. For Windows there is a tool called Acrobat Customization Wizard, this is not available for Mac. We have to use a tool called Adobe Provisioning Tool. Everything is explained in Adobe's PDF for enterprise deployment. It involves creating a new package that will install a zipped copy of the Adobe Acrobat X package and adobe_provisioning_tool.app to /tmp. Then a postinstall script unzips the installer, running the installer and then runs three adobe_provisioning_tool commands to serialize, accept the EULA and suppress the AdobeID dialog. Ok, not THAT complicated. BUT the postinstall script Adobe thinks we should run contains some errors: The if statement after installation is really not after the installation takes place, no it's after the rm -rf "Installfile.pkg". And since it tests if $? equals 0, it tests the rm command, not the install command. So as long as the deletion went fine, the script reports that the installation went fine... The other is that the PDF says you should input the serial like this: "1118-xxxx-xxxx-xxxx-xxxx-xxxx". But if you run "adobe_provisioning_tool.app/Contents/MacOS/adobe_provisioning_ tool" without statements, the help text says you should pass the serial without dashes! From the help text: "adobe_provisioning_tool -C -a -s This is to validate the serial number against the application.sif file. The caller is expected to pass the clear serial number w/o any dashes ('-')." I hope I have helped someone with this complaint! And a tip: if you plan on using this method, make sure to include any Acrobat updates in the customized package and edit the postinstall script to install the update too.

Mountain Lion PreCheck for DeployStudio

A quick and dirty version that checks if the Mac you're deploying is Mountain Lion compatible.

#!/bin/bash

# Mountain Lion prereq checker

modelId=$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk -F': ' '{print $2}')
#modelId=Macmini1,1
modelName=$(echo $modelId | awk -F',' '{print $1}' | tr -d '[[:digit:]]' | tr -d ',')
modelIdMajor=$(echo $modelId | awk -F',' '{print $1}' | tr -cd '[[:digit:]]')
modelIdMinor=$(echo $modelId | awk -F',' '{print $2}')

approvedModelsMajor=( 'iMac7' 'MacBook5' 'MacBookPro3' 'MacBookAir2' 'Macmini3' )

if [ "$modelName" = "iMac" ]; then
if [ "$modelIdMajor" -ge "7" ]; then
echo "------ ML PREREQ: This $modelName can run ML"
exit 0
else
echo "------ ML PREREQ: This $modelName cannot run ML"
exit 1
fi
fi

if [ "$modelName" = "MacBook" ]; then
if [ "$modelIdMajor" -ge "5" ]; then
echo "------ ML PREREQ: This $modelName can run ML"
exit 0
else
echo "------ ML PREREQ: This $modelName cannot run ML"
exit 1
fi
fi

if [ "$modelName" = "MacBookPro" ]; then
if [ "$modelIdMajor" -ge "3" ]; then
echo "------ ML PREREQ: This $modelName can run ML"
exit 0
else
echo "------ ML PREREQ: This $modelName cannot run ML"
exit 1
fi
fi

if [ "$modelName" = "MacBookAir" ]; then
if [ "$modelIdMajor" -ge "2" ]; then
echo "------ ML PREREQ: This $modelName can run ML"
exit 0
else
echo "------ ML PREREQ: This $modelName cannot run ML"
exit 1
fi
fi

if [ "$modelName" = "Macmini" ]; then
if [ "$modelIdMajor" -ge "3" ]; then
echo "------ ML PREREQ: This $modelName can run ML"
exit 0
else
echo "------ ML PREREQ: This $modelName cannot run ML"
exit 1
fi
fi

echo "------ ML PREREQ: Model not found"

exit 1

Fix for iPhone Yellow Screen of Death (YSoD)

My iPhone 3GS on jailbroken iOS 4.3.5 just "died" and showed a yellow screen when trying to charge it or turn it on. I found some solutions on the web, but none of them worked. Here is what worked for me:

1. Connect the iPhone to your computer
2. Open iTunes
3. Put the iPhone in DFU mode (if you don't how to that, google it)
4. Let it charge for about 15 minutes
5. Go to iTunes and restore the iPhone

Done!

Hope this will help someone...

Temporary fix for SAMBA-printing in Lion

It seems like the "AuthInfoRequired" fix is working. At least were I work... Yesterday, when I went to bed, I came up with something!
What if I create a LaunchDaemon that triggers on changes to /etc/cups/printers.conf and that LaunchDaemon then runs a script that fixes the faulty settings in printers.conf?

Said and done, here are the result (sorry for the formatting, blame blogger):

The LaunchDaemon (located in /Library/LaunchDaemons)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>se.lnu.cupsfix</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Scripts/cupsfix.sh</string>
</array>
<key>WatchPaths</key>
<array>
<string>/private/etc/cups/printers.conf</string>
</array>
</dict>
</plist>

The script (/Library/Scripts/cupsfix.sh)

#!/bin/bash
# cupsfix.sh by Marcus Jaensson
# Must be run as root
### VARIABLES
PRINTERLIST=`lpstat -p | awk '{print $2}'`
LOGF="/var/log/lnu_cupsfix.log"

### FUNCTIONS
function log()
{
echo -e "[`date "+%y%m%d %H.%M.%S"`]\t$1"
echo -e "[`date "+%y%m%d %H.%M.%S"`]\t$1" >> $LOGF
}

### SCRIPT
for printer in $PRINTERLIST; do
if [[ -z `lpoptions -p $printer | grep "auth-info-required=username,password"` ]]; then
log "Printer $printer has faulty settings, will now correct this"
lpadmin -p "$printer" -o auth-info-required=username,password
else
log "Printer $printer has the correct settings, have nothing to do"
fi
done
exit 0

Provided "as is"... 

[Swedish] "Spela in" från SVT Play med rtmpdump

Länge sedan sist, har varit mitt uppe i ett projekt att införa Windows 7...

Så här kommer en liten uppdatering, har inget med deployment att göra, men jag ville ändå tipsa om det!

Om du tex vill se "Hårdrockens historia" eller "Äkta människor" på vägen till jobbet, men har taskig mottagning längs vägen, kan du i förväg "spela in" det du vill se med hjälp av "rtmpdump"!

1. Ladda ner och installera rtmpdump (för OS X 10.7) här: http://trick77.com/2011/07/30/rtmpdump-2-4-binaries-for-os-x-10-7-lion/

2. Gå till det program du vill spela in i tex Chrome.

3. Välj att visa källkoden

4. Sök efter "rtmpe"

5. Du hittar nu fyra URLer som är i princip likadana. Leta upp den bitraten du vill ladda hem. (2400 är 720p). Kopiera URLen, till och med .mp4, alltså inte med ",bitrate:2400".

6. Öppna terminalen och skriv: rtmpdump -r rtmpe://[URL] -o ~/Desktop/[OUTPUT.mp4]

7. Nu börjar den ladda hem!

8. För att kunna se den i QuickTime eller iPhone, konvertera med tex Handbrake (http://handbrake.fr/) I VLC kan du se på filen direkt.

DeployStudio rc129 and new MacBook Airs

The new Air shipped with a custom built 10.7.1, but now 10.7.2 supports these systems.
DeployStudio rc129 (latest stable) isn't capable of doing NetBoot sets from a 10.7.2 system, but the latest nightly is (111010). So how would you do to be able to NetBoot Airs with a DeployStudio NetBoot set and still use the latest stable release on the server?

Simple. Create a NetBoot set with the latest nightly on a 10.7.2 install (preferably in Fusion or Parallels). Take a copy of DeployStudio Admin (rc129) and copy into the NetBoot set and replace the one installed (111010).

Done! Now enable the NetBoot set on the server, and NetBoot the Air. Of course you have to have an 10.7.2 image to apply. Just download Lion from Mac App Store and extract the InstallESD.dmg and run InstaDMG or similar.

Apple Warranty Info script

Made a quick bash-script to check warranty information for a specific serial number.

Usage: warrantyinfo.sh OR warrantyinfo.sh

If you do not specify a serial number as an argument, the script will use the serial number from the machine that it is run on.

UPDATE: Made it compatible with iPhones. I do not own an iPad and therefor no iPad serial number, so I haven't tested it with iPads.

#!/bin/bash

# Check warranty
# Usage: $0 serialnumber OR just $0

INFOF="/tmp/warranty.info"
INFOF2="/tmp/warranty_lines.info"

if [ -z "$1" ]; then
 echo "No serial number specified, assuming it's the local machine's serial"
 SN=$(system_profiler SPHardwareDataType | grep "Serial Number" | awk -F': ' '{print $2}')
else
 SN="$1"
fi

if [ -z "$SN" ]; then
 printf "No serial number specified and no serial number automatically found\n"
 printf "Exiting\n\n"
 exit 1
fi

# Get raw info
printf "Getting warranty info from Apple"
curl --silent https://selfsolve.apple.com/warrantyChecker.do?sn=$SN -o "$INFOF"

# Checking if it's an iPhone
IPHONESTAT=$(cat "$INFOF" | awk -F'IS_IPHONE' '{print $2}' | awk -F'"' '{print $3}')

if [ "$IPHONESTAT" = "Y" ]; then
 # This is an iPhone, check iPhone-specific data
 PRODUCT=$(cat "$INFOF" | awk -F'PROD_DESCR' '{print $2}' | awk -F'"' '{print $3}')
 PARTDESCR=$(cat "$INFOF" | awk -F'PART_DESCR' '{print $2}' | awk -F'"' '{print $3}')
 ICCID=$(cat "$INFOF" | awk -F'ICCID' '{print $2}' | awk -F'"' '{print $3}')
 REGISTERED=$(cat "$INFOF" | awk -F'IS_REGISTERED' '{print $2}' | awk -F'"' '{print $3}')
 ACTIVATED=$(cat "$INFOF" | awk -F'ACTIVATION_STATUS' '{print $2}' | awk -F'"' '{print $3}')
 IMEI=$(cat "$INFOF" | awk -F'AP_IMEI_NUM' '{print $2}' | awk -F'"' '{print $3}')
 WARRANTY=$(cat "$INFOF" | awk -F'HW_COVERAGE_DESC' '{print $2}' | awk -F'"' '{print $3}')
 CARRIER=$(cat "$INFOF" | awk -F'CARRIER' '{print $2}' | awk -F'"' '{print $3}')
 PURCHDATE=$(cat "$INFOF" | awk -F'PURCHASE_DATE' '{print $2}' | awk -F'"' '{print $3}')
 
 # Make it nicer
 if [ "$REGISTERED" = "Y" ]; then
  REGISTERED=Yes
 else
  REGISTERED=No
 fi
 
 if [ "$ACTIVATED" = "Y" ]; then
  ACTIVATED=Yes
 else
  ACTIVATED=No
 fi
 
 # Display data
 clear
 printf "\033[1mWarranty Information\033[m\n\n"
 printf "Product:\t\033[1m$PRODUCT\033[m\n"
 printf "Description:\t\033[1m$PARTDESCR\033[m\n"
 printf "Serial Number:\t\033[1m$SN\033[m\n"
 printf "ICCID:\t\t\033[1m$ICCID\033[m\n"
 printf "IMEI:\t\t\033[1m$IMEI\033[m\n"
 printf "Purchase Date:\t\033[1m$PURCHDATE\033[m\n"
 printf "Warranty:\t\033[1m$WARRANTY\033[m\n"
 printf "Registered:\t\033[1m$REGISTERED\033[m\n"
 printf "Activated:\t\033[1m$ACTIVATED\033[m\n"
 printf "Carrier:\t\033[1m$CARRIER\033[m\n\n\n"
else
 # This is a Mac, check Mac data
 # Get product description first as it may contain comma (,) 
 PRODUCT=$(cat "$INFOF" | awk -F'PROD_DESCR' '{print $2}' | awk -F'"' '{print $3}')
 DAYSREM=$(cat "$INFOF" | awk -F'DAYS_REM_IN_COV' '{print $2}' | awk -F'"' '{print $3}')
 PURCHDATE=$(cat "$INFOF" | awk -F'PURCHASE_DATE' '{print $2}' | awk -F'"' '{print $3}')
 ENDDATE=$(cat "$INFOF" | awk -F'COV_END_DATE' '{print $2}' | awk -F'"' '{print $3}')

 # Display data
 clear
 printf "\033[1mWarranty Information\033[m\n\n"
 printf "Product:\t\033[1m$PRODUCT\033[m\n"
 printf "Serial Number:\t\033[1m$SN\033[m\n"
 printf "Purchase Date:\t\033[1m$PURCHDATE\033[m\n"
 printf "End Date:\t\033[1m$ENDDATE\033[m\n"
 printf "Days remaining:\t\033[1m$DAYSREM\033[m\n"

 printf "\n\n"
fi

exit 0

rpcclient is gone from Lion

Just discovered that rpcclient is gone from Lion. I guess this is because Apple got rid of SAMBA. But does anyone know if there are any other tool that does the same thing as rpcclient?

Lion PreCheck script for DeployStudio

Just wanted to share a small script that checks if the computer is 64 bit. Perfect to add to your workflow in DeployStudio as a first automated step. If the computer is 64 bit, it just continues with the workflow, if not, the workflow will get aborted.

#!/bin/bash

ARCH=$(ioreg -l -p IODeviceTree | grep firmware-abi | awk -F'"' '{print $4}')

if [ "$ARCH" = "EFI64" ]; then
echo "LION PRECHECK - This computer can run Lion"
echo "LION PRECHECK - Architecture: $ARCH"
exit 0
else
echo "LION PRECHECK - This computer CANNOT run Lion"
echo "LION PRECHECK - Architecture: $ARCH"
exit 1
fi

Windows printing via samba is broken in Lion [updated]

I just discovered that SMB-printing (Windows Printing via SAMBA) is broken in Lion. It seems like there are some kind of authentication bug between CUPS and SMB, but there is a workaround!

1. Add the printer as you always have done (DeviceURI: smb://server.company.com/printerqueue)
2. Connect to an available share on the print server
3. Print and type your credentials when asked

You must repeat step 2 each time you have logged out or restarted your computer.

Update

Another solution seems to involve editing printers.conf.
1. Stop cupsd (sudo launchctl stop org.cups.cupsd)
2. Edit the entry "AuthInfoRequired" so it says "username,password" instead of "negotiate" in /etc/cups/printers.conf
3. Start cupsd (sudo launchctl start org.cups.cupsd)

If you add a printer via the Print settings pane - Advanced, it will set up the printer with "negotiate", but if you set up the printer via the cups web interface (http://localhost:631) it will add the printer with "username,password".

I have an open bugreport on this so Apple knows about it.

Update 2
Above did not work... My hopes are now on Apple and their engineers...

Hidden accounts disappears in Lion

I have to investigate this further, but it seems like hidden user accounts is deleted/not migrated when you upgrade from 10.6 to 10.7.

Update
I have now filed a bug report to Apple.

I will do some more testing to see if it's because the account is hidden or if it's the hidden home folder.

Update 2
Did a test and created some accounts with different settings...

Works: Hidden user account with home folder in /Users
Works: Standard user account but with home folder hidden (in my case /var/.home/)
Does NOT work: Hidden user account with hidden home folder

Update 3
Apple has now recognized this as a known issue, so hopefully this will get fixed in future installers of Lion.

Add-on to copy changed images for the previous script

Integrate this into my previous script or run it standalone (I run it standalone as a separate LaunchDaemon). This compares the auto generated image with an image with the same name in DeployStudios "Masters" directory, and if checksum is different, it renames the image in the Masters directory and copies the new one. Very simple, but wanted to share it more like an idea than a script itself.

#!/bin/bash

SAVEIFS=$IFS
IFS=$(echo -en "\n\b")

DSSDIR="/Shared Items/dsrepo/Masters/HFS"
INSTADIR="/Work area/InstaDMG/10.6/OutputFiles"
DATESTAMP=$(date "+%y%m%d")
LOGF="/var/log/lnu-copyimages.log"

# Loop that searches $INSTADIR for files ending with .dmg
for i in $(find "$INSTADIR" -type f -print | egrep -i '.dmg$')
do
echo -e "Working on image: $i" >> "$LOGF"
FILENAME=$(basename $i)
if [ -f "$DSSDIR/$FILENAME" ]
then
echo -e "Found the image \"$FILENAME\" in \"$DSSDIR\"\nwith the same name as in \"$INSTADIR\"" >> "$LOGF"
echo -e "Checksumming both files and comparing them" >> "$LOGF"
DSSSHA=$(shasum "$DSSDIR/$FILENAME" | awk '{print $1}')
INSTASHA=$(shasum "$i" | awk '{print $1}')
if [ $INSTASHA = $DSSSHA ]
then
echo -e "The image \"$FILENAME\" is the same in \"$DSSDIR\"\nas in \"$INSTADIR\". Moving on." >> "$LOGF"
else
echo -e "The image \"$FILENAME\" in \"$DSSDIR\" has a different checksum.\nRenaming \"$FILENAME\" in \"$DSSDIR\"\nand copying \"$FILENAME\" from\n\"$INSTADIR\" to \"$DSSDIR\"" >> "$LOGF"
mv "$DSSDIR/$FILENAME" "$DSSDIR/$FILENAME-disabled-$DATESTAMP"
cp "$i" "$DSSDIR/"
fi
else
echo -e "Did not find an image called \"$FILENAME\" in \"$DSSDIR\"\nCopying \"$FILENAME\" to \"$DSSDIR\"" >> "$LOGF"
cp "$i" "$DSSDIR/"
fi
done

IFS=$SAVEIFS

exit 0

Can also be downloaded here: http://db.tt/Gr0qYkI

Script for automatically update InstaDMG images

Just finished this script, which has room for improvements, but it works as is. This script uses InstaUp2Date. What this script does is that it searches a given folder for catalog files and if the checksum since last run is different, it launches instaUp2Date.

Set up a LaunchDaemon and let it run every night to check if you have done any changes to any instaUp2Date catalog files, and if so, it builds the new image.

Given as is...

#!/bin/bash

# First of all, make sure this is run as root
if [[ "$(/usr/bin/whoami)" != "root" ]]; then
printf '\nMust be run as root!\n\n'
exit 1
fi

usage()
{
cat << EOF ######################################## Put this script in /AddOns/InstaUp2Date
Usage: $0
########################################
EOF
}

#if [[ -z $1 ]]
#then
# usage
# exit 1
#fi

SAVEIFS=$IFS
IFS=$(echo -en "\n\b")

SCRIPTDIR=$(dirname $0)
SHADIR="$SCRIPTDIR/shasums"
OUTPUTDIR="$SCRIPTDIR/../../OutputFiles" # Path to default InstaDMG Output path
TIMESTAMP=$(date "+%y%m%d_%H.%M.%S")
CATALOGDIR="$SCRIPTDIR/CatalogFiles"

if [ ! -d $SHADIR ];
then
mkdir "$SHADIR"
fi

for i in $(find "$CATALOGDIR" -type f -print | egrep -i '.catalog$')
do
FILENAME=$(basename "$i" .catalog)
if [ ! -f "$SHADIR/$FILENAME.sha" ];
then
echo "Old shasum for \"$i\" does not exist. Assuming it's a new catalog file. Running InstaUp2Date for \"$i\""
/usr/bin/python "$SCRIPTDIR/instaUp2Date.py" --process $FILENAME
/usr/bin/shasum "$i" | awk '{print $1}' > "$SHADIR/$FILENAME.sha"
else
echo "Old shasum for \"$i\" exists"
fi

NEWSHA=$(/usr/bin/shasum "$i" | awk '{print $1}')
OLDSHA=$(cat "$SHADIR/$FILENAME.sha")

if [ $NEWSHA = $OLDSHA ];
then
echo "No change done to the catalogfile: $i"
else
echo "Found changes in catalog file, renaming old image and running instaUp2Date for catalog file: $i"
OUTFILENAME=$(cat $i | grep "Output File Name" | awk -F" = " '{print $2}')
for image in $(find "$OUTPUTDIR" -name "$OUTFILENAME*");
do
mv $image $image-$TIMESTAMP
done
/usr/bin/python "$SCRIPTDIR/instaUp2Date.py" --process $FILENAME
echo "Checksumming: $i"
/usr/bin/shasum "$i" | awk '{print $1}' > "$SHADIR/$FILENAME.sha"
fi

done

IFS=$SAVEIFS

exit 0

Can also be downloaded here (with logging added): http://db.tt/95GzhdC

Deploy Photoshop Elements 9 Trial with SCCM

Here is just a quick instruction on how to install Photoshop Elements 9 Trial silent with SCCM. Since it's Adobe, it wasn't as easy as you would hope.

Anyway...

First, deploy Adobe Application Manager 1.5:

"Setup.exe --mode=silent"

Second, deploy Adobe Photoshop Elements 9 and Elements Organizer with a Task Sequence.

msiexec /i "Adobe Photoshop Elements 9.msi" TRANSFORMS=1033.mst ELEMENTS_EN_US=1 ORGANIZER_EN_US=1 DISABLEEMSFEATURES=1 DISABLEOLSFEATURES=1 WATCHSERVICE=0 NOT_STANDALONE=1 /qn /norestart

msiexec /i "Elements 9 Organizer.msi" TRANSFORMS=1033.mst NOT_STANDALONE=1 /qn /norestart

Why not deploy AAM in the Task Sequence? It did not work (for me anyway...), the logs said it all went fine, but it didn't. So you have to deploy AAM as a regular program separately.

Fully automated reinstall of computer lab

We have a computer room with 23 iMacs, all is dual boot Mac OS X 10.6/Windows 7 through BootCamp. Here is how I have automated the whole process.









Because there are so many applications in both OS's, we have created two master images which is deployed through DeployStudio (DSS).

DeployStudio does the following:

- Deploys the two master images
- Sets the computer name from the DSS database in both Mac OS and Windows
- Sets Mac OS as default startup disk
- Sets time server in Mac OS
- Joins Mac OS to our Active Directory
- Activates Software Update on first boot
- Activates a script on first boot that sets some energy savings settings
- Activates a script on first boot that sets the windows partition as default startup disk

So when DSS is done, rebooted and run Software Update, joined AD and run the scripts, it boots into a syspreped Windows 7 installation. The sysprep does a lot of things to the Windows installation, like: setting the computername, joining AD (through a powershell script on first automatic login), running winsat and so on...

One thing to think about is when you create the unattend.xml, you have to specify a ComputerName, otherwise, that key is not present in the xml file, and DSS does not set the ComputerName automatically.

And another thing to think about is the joining to AD. The component UnattendedJoin, did not work for us, then I discovered we were not alone. Setting the admin user to login automatically one time and setting a powershell script to run on first login did the trick.

So long fully automated, but you still have to go to every machine and netboot them, select workflow in DSS and trigger it. Here is where bless blesses us! But first we had to create a user and a group for DSS, which we named dsautodeploy and dsautodeployers. Add the group as a runtime group in DSS, create a NetBoot set in DSS with dsautodeploy enabled as autologin. Then edit the workflow in DSS so everything is automated and select a default workflow for the group of computers.
Now, all you have to do to reinstall the computers is to send this command with ARD (as root):

bless --netboot --server "bsdp://" --options "rp=nfs::/private/tftpboot/NetBoot/NetBootSP0:.nbi/DeployStudioRuntime.sparseimage"

And if the computers is booted in Windows 7, you can (as of BootCamp 3.0) run this command with psexec:

psexec \\COMPUTERNAME "C:\Program Files\Boot Camp\BootCamp.exe" -startupDisk

And then run the bless command above. The "BootCamp.exe -startupDisk" command may also be used in sysprep to boot into Mac OS after the windows setup is done when deploying. But we want windows to be the default OS on these machines...

The script I run in the workflow to make Windows the default startup disk is as simple as this:

#!/bin/sh

#Find the Windows disk and it's mountpoint
WINDOWSDISK=$(mount | grep ntfs | awk -F" " '{print $3}')

#Set $WINDOWSDISK as default boot partition
bless --mount "$WINDOWSDISK" --setBoot --legacy --verbose

exit 0

Happy deploying!

PS. Don't you just love DSS? I know I do :)

Get rid of Office 2011's First Run Wizard

I made a similar script like this for Office 2008, but Microsoft changed some things in Office 2011 and how it determines if First Run Wizard is run.
It seems like the Office apps looks at three files and certain settings in them, these files are:

~/Library/Preferences/com.microsoft.office.plist
~/Library/Preferences/com.microsoft.autoupdate2.plist
~/Library/Preferences/com.microsoft.error_reporting

The file "com.microsoft.office.plist" must contain:
- The key "14\FirstRun\SetupComplete" with value "1" (-int)

The file "com.microsoft.autoupdate2.plist" must contain:
- The key "HowToCheck" with value "Manual" (-string) (if you don't want it to check automatically)
- The key "LastUpdate" with value "2001-01-01T00:00:00Z" (-date)

The file "com.microsoft.error_reporting must contain:
- The key "SQMReportsEnabled" with value "False" (-bool)
- The key "ShipAssertEnabled" with value "False" (-bool)

And as an optional thing, in the script below, I added a function that sets the user's name in "com.microsoft.office.plist".

Pardon me for the lack of comments in the script below, but I think you understand it :)

Provided "as is"...

#!/bin/bash

# Loginhook to get rid of Office First run.
# This version is for Office 2011
# Updated 101102 by Marcus Jaensson

##### NOTES ABOUT FILE PERMISSIONS ######
# Setting rights to 777 as chown does not seem to work as expected in a loginhook
# It seems that Office sets the correct owner on the files when launching an Office-app
# Really no secrets in these files anyway...



# Install this:
# 1. Copy this to /Library/Scripts/loginhook.sh
# 2. Set owner to root and chmod 755
# 3. sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/loginhook.sh

LOGF="/tmp/loginhook.log"

OFFICEPREF="/Users/$1/Library/Preferences/com.microsoft.office.plist"
OFFICEDOMAIN="/Users/$1/Library/Preferences/com.microsoft.office"

AUPREF="/Users/$1/Library/Preferences/com.microsoft.autoupdate2.plist"
AUDOMAIN="/Users/$1/Library/Preferences/com.microsoft.autoupdate2"

ERPREF="/Users/$1/Library/Preferences/com.microsoft.error_reporting.plist"
ERDOMAIN="/Users/$1/Library/Preferences/com.microsoft.error_reporting"


echo "##### Beginning Log #####" >> $LOGF
echo `date "+%y%m%d %H.%M"` >> $LOGF
echo "User: $1" >> $LOGF


# Create files and values com.microsoft.office.plist
if [ -f "$OFFICEPREF" ]
then
echo "com.microsoft.office.plist exists." >> $LOGF
echo "Checking if 14\\FirstRun\\SetupComplete has value 1" >> $LOGF
SETUPSTATUS=$(defaults read "$OFFICEDOMAIN" "14\\FirstRun\\SetupComplete")
if [ $SETUPSTATUS = 1 ]
then
echo "SetupComplete is set to 1. Nothing to do" >> $LOGF
else
echo "Setting SetupComplete to 1" >> $LOGF
defaults write "$OFFICEDOMAIN" "14\\FirstRun\\SetupComplete" -int 1
chmod -f 777 "$OFFICEPREF"
fi
else
echo "com.microsoft.office.plist does not exist. Creating it and setting SetupComplete to 1" >> $LOGF
defaults write "$OFFICEDOMAIN" "14\\FirstRun\\SetupComplete" -int 1
chmod -f 777 "$OFFICEPREF"
fi

# Create fields and values com.microsoft.autoupdate2.plist
if [ -f "$AUPREF" ]
then
echo "com.microsoft.autoupdate2.plist exists." >> $LOGF
echo "Checking if HowToCheck has value Manual" >> $LOGF
HOWTOCHECK=$(defaults read "$AUDOMAIN" "HowToCheck")
LASTUPDATE=$(defaults read "$AUDOMAIN" "LastUpdate")
if [ $HOWTOCHECK = "Manual" ]
then
echo "HowToCheck is set to Manual. Nothing to do" >> $LOGF
else
echo "Setting HowToCheck to Manual" >> $LOGF
defaults write "$AUDOMAIN" "HowToCheck" -string "Manual"
chmod -f 777 "$AUPREF"
fi
if [ -z "$LASTUPDATE" ]
then
echo "LastUpdate is empty, populating"
defaults write "$AUDOMAIN" "LastUpdate" -date "2001-01-01T00:00:00Z"
else
echo "LastUpdate exists"
fi
else
echo "com.microsoft.autoupdate2.plist does not exist. Creating it and setting HowToCheck and LastUpdate to Manual" >> $LOGF
defaults write "$AUDOMAIN" "HowToCheck" -string "Manual"
defaults write "$AUDOMAIN" "LastUpdate" -date "2001-01-01T00:00:00Z"
chmod -f 777 "$AUPREF"
fi

# Create fields and values com.microsoft.error_reporting.plist
if [ -f "$ERPREF" ]
then
echo "com.microsoft.error_reporting.plist exists." >> $LOGF
echo "Checking if SQMReportsEnabled has value False" >> $LOGF
SQMREPORTS=$(defaults read "$ERDOMAIN" "SQMReportsEnabled")
SHIPASSERT=$(defaults read "$ERDOMAIN" "ShipAssertEnabled")
if [ $SQMREPORTS = "0" ]
then
echo "SQMReportsEnabled is set to False. Nothing to do" >> $LOGF
else
echo "Setting SQMReportsEnabled to False" >> $LOGF
defaults write "$ERDOMAIN" "SQMReportsEnabled" -bool False
chmod -f 777 "$ERPREF"
fi
if [ $SHIPASSERT = "0" ]
then
echo "ShipAssertEnabled is set to False. Nothing to do" >> $LOGF
else
echo "Setting ShipAssertEnabled to False" >> $LOGF
defaults write "$ERDOMAIN" "ShipAssertEnabled" -bool False
chmod -f 777 "$ERPREF"
fi
else
echo "com.microsoft.error_reporting.plist does not exist. Creating it and setting SQMReportsEnabled and ShipAssertEnabled to False" >> $LOGF
defaults write "$ERDOMAIN" "SQMReportsEnabled" -bool False
defaults write "$ERDOMAIN" "ShipAssertEnabled" -bool False
chmod -f 777 "$ERPREF"
fi


# Set name
REALNAME=$(dscl . -read /Users/$1 RealName | grep -v RealName | sed 's/^[ ]*//')
echo "RealName is $REALNAME" >> $LOGF
REALNAMESTATUS=$(defaults read "$OFFICEDOMAIN" "14\\UserInfo\\UserName")
echo "RealName Status is $REALNAMESTATUS" >> $LOGF
if [ -z "$REALNAMESTATUS" ]
then
echo "Setting realname" >> $LOGF
defaults write "$OFFICEDOMAIN" "14\\UserInfo\\UserName" -string "$REALNAME"
chmod -f 777 "$OFFICEPREF"
else
echo "REALNAME is already set" >> $LOGF
fi

echo -e "---------- Ending Log ----------\n" >> $LOGF

exit 0

Change default keyboard layout for loginwindow

We discovered that a system restore image we used to deploy new Macs with had the wrong keyboard layout at the loginwindow. If you change the keyboard layout in the Accounts PrefPane, it just affects the currently logged in user.
Apples solution to this is either to reinstall Mac OS X or select to show the input menu in the loginwindow, this is two solutions that I can't accept, so I started digging and found a solution!

The settings are stored in /Library/Preferences/com.apple.HIToolbox.plist and changing these solved my problem.

Here is quick and dirty script to change the default keyboard layout to Swedish:

#!/bin/bash

# This will set default keyboard language to Swedish.

# Path to plist file
PLISTDOMAIN="/Library/Preferences/com.apple.HIToolbox.plist"

# Path to PlistBuddy
PB="/usr/libexec/PlistBuddy"

"$PB" -c "set :AppleDefaultAsciiInputSource:KeyboardLayout\ ID 7" "$PLISTDOMAIN"
"$PB" -c "set :AppleDefaultAsciiInputSource:KeyboardLayout\ Name Swedish\ -\ Pro" "$PLISTDOMAIN"
"$PB" -c "set :AppleCurrentKeyboardLayoutInputSourceID com.apple.keylayout.Swedish-Pro" "$PLISTDOMAIN"
"$PB" -c "set :AppleEnabledInputSources:0:KeyboardLayout\ ID 7" "$PLISTDOMAIN"
"$PB" -c "set :AppleEnabledInputSources:0:KeyboardLayout\ Name Swedish\ -\ Pro" "$PLISTDOMAIN"

exit 0