Thursday, August 30, 2018

Mac Administration with JAMF, Part 2: Policies

The main method of administration in JAMF is the Policy. A Policy is made up of various payloads, each of which have a different effect on the computer, and can be set to run when various triggering events occur, subject to date/time restrictions if desired. For most things that you might want do with a client Mac, you can do it through a Policy.


Payloads available for use in a Policy include:

Packages
A package is a Mac OS-style .pkg or Composer-created .dmg file that installs applications, settings, or plain files to the computer. For commercial software, such as Microsoft Office or Adobe Creative Cloud, you can use the vendor-supplied .pkg installer directly here. For other software, especially those that are distributed as a .app file packaged into a .dmg, you will need to use Composer to capture the drag-and-drop installation, along with any other configuration, or create a payload-free package for this. (These techniques will be discussed in another post.)

JAMF allows you install packages directly in a Policy, or to direct the Mac to cache the package for installation later. Cached packages are useful for an organization-wide rollout where all computers need to install a package at the same time, but where the network bandwidth is not sufficient to distribute the package to all of them at once, and other such situations. For Composer-created .dmg packages that have been indexed in Casper Admin, you can also direct the policy to uninstall the package. Unfortunately, no such capability exists for .pkg installers directly, but commercial software often supplies an uninstall.pkg that can be used instead.

The Policy can also specify which distribution point (file share-based or deprecated software-based Jamf Distribution Server) from which the computer should download the package. In our environment, we have packages always downloaded from the local DP, but if for some reason a specific DP is preferred for this package - faster network link, etc. - that can be specified in the payload.

Software Updates
A Policy can direct the client Mac to install available software updates from either its default software update server, or from Apple's update servers directly. Mac OS Server provides the ability for administrators to select which updates will or will not be installed by clients, and caches those updates on the server to save traffic to and from Apple's servers.

We do not currently use this payload. While Mac OS Server allows you to control updates, it does not appear to have a way to specify where those updates should come from; if you manage updates through Mac OS Server, you must cache them on the server itself, which in our case is a several-year-old 500GB Mac Mini, so this is impractical when those Minis must also hold OS images and all other packages for the local campus. To that end, I created a custom update management system for our environment using Python, which I will discuss in another post.

Scripts
A Policy can also run any arbitrary shell or Python script, which allows most anything to be done with the client Mac. The Policy allows you to pass parameters to the script with a handy form-based interface, allowing one script to be used in multiple policies for different effects. Parameters 1 through 3 are pre-defined by JAMF, mount point, computer name, and user name respectively, while parameters 4 through 11 are available for your use.

One simple use of this in our environment is to replicate file share distribution points. We found that replicating DPs using Casper Admin works well enough to copy the files themselves, but tends not to set the correct permissions on the shared directory, requiring a manual chmod. Therefore, I created a script to manually mount and rsync the central distribution point to each local Mac Mini, which via Policy runs each night after a certain time. Our update management system is similarly implemented by a script that runs overnight on client Macs.

Printers
Mac OS printer definitions are simply URLs that indicate to which print server the computer should send jobs. A Policy can specify which printer is to be mapped or un-mapped on the Mac, as well as whether it should be set as default. Multiple printers can be mapped or unmapped at once, or any arbitrary combination of mappings/unmappings as well. (This would be useful if a printer's name changed, for example.)

Unfortunately, since printers on Mac OS are just URLs, the Printers payload does not allow you to directly install a driver if one is needed. For most models, Mac OS includes a driver that works well enough, but we have some very old HP printers that are no longer included. However, this is not such an issue, as you can have the Policy first install the driver .pkg, then map the printer.

Disk Encryption
A Policy can be used to control FileVault 2 disk encryption. You can choose to apply a Disk Encryption Configuration (a special kind of configuration profile that specifies the type of Recovery Key and FV2-enabled users), or to issue a new recovery key. You can also specify when FileVault 2 will be required to be enforced: the default is on the next login, but options are also available to allow up to six more logins before requiring encryption to be enabled. This would be useful in a situation where IT would set up a laptop, needing, say, four logins, and deliver it to the user, who on their first login would be prompted to set a FV2 password. Recovery keys are automatically synchronized with JAMF, so even if the user forgets their password, a JAMF administrator can unlock their device.

Dock Items
A Policy can add or remove application icons from the Dock for all users on a Mac. Dock items are specified by a name and a file:// URL pointing to their location, and can be added to the beginning (by the Finder) or end (by the Trash) of the Dock, or removed entirely.

Local Accounts
The Local Accounts payload, as its name indicates, allows you to work with local user accounts on a Mac via Policy. Four main operations are available: create a new account, reset an account's password, delete an account, or disable the account for FileVault 2.

Creating an account via Policy looks much like it does on a Mac in the System Preferences Accounts panel. You specify a username, the user's full name, a password (with verification), and a password hint. You can also choose the path for the user's home directory - for hidden accounts, you can choose to create the account in /private/var/username rather than /Users/username, for example - and the path to the user's account picture, which can be anywhere on the hard drive. You can choose to allow the new account to have administrator rights, and whether it should be enabled for FileVault 2.

Resetting an account password prompts for the username and new password. The old password is not required. It is important to note that this does not also update the user's FileVault 2 password, so that will need to be changed elsewhere.

Deleting an account asks for the username, as well as whether to permanently delete the home directory, or just to remove the account record. If you desire, you can also specify a location to which the account's home directory could be backed up. (This does not necessarily have to be on the local Mac! You could mount a network folder using a script, set to run before the Local Accounts payload, and then archive the directory there, ensuring that IT will have a backup of the user's data in case they need it.)

Disabling a user for FileVault 2 only requires the username. Once the Policy runs, the user will not be able to unlock the computer's FileVault 2 encryption, change its password, or otherwise work with FV2.

Management Account
The Management Account payload exposes the way that JAMF actually works, and allows you to manage the account it uses. JAMF actually performs most of its functions by SSHing into client Macs using a special management account, usually named jamfadmin, which has administrator rights. You can specify a known password for this account using the Management Account payload, or, as we have in our environment, ask JAMF to generate and store a random password for this account on each computer.

We have a Policy set up that changes the management password to random value for each Mac every day, ensuring that nobody knows one password that will allow effectively untraceable administrator access to every computer. Instead, we have a different admin account with a set password, managed as a Local Account using the payload previously described, so that if the password is leaked we can change that without needing to do anything with the special Management account.

The Management Account payload also allows you to enable or disable the management user in FileVault 2, which could be used to ensure that IT can always unlock a Mac even if the user forgets their password, but in our environment, this is not useful, and the key is recoverable through JAMF anyway.

Directory Binding
A Policy can enforce an Active Directory binding, specified in the JAMF management pages, that joins the Mac to AD using specific credentials, and can automatically put it in the correct OU. We use this with a custom trigger to allow us to easily un-bind and re-bind Macs to AD in our various campuses in the event that the binding is broken, in cases such as laptops that do not see the domain for an extended period of time.

EFI Password
You can use a Policy to set or remove the Open Firmware/EFI password on a Mac. In our environment, as many different users log in to many Macs in the course of a semester, we do not currently use this payload.

Restart Options
If anything in the Policy would require the computer to restart, you can use the Restart Options payload to specify how you would like that to happen. You can choose what action the computer should take if there are no users logged in, what it should do if there are users logged in, and how long (in minutes) it should wait before restarting.

This payload also allows you to do some useful things. You can choose to perform an authenticated restart, which allows the computer to fully reboot without requiring a user to enter the FileVault 2 password if one is set. You can also specify which disk the Mac should boot from - the default hard drive/partition, another hard drive/partition, or even a NetBoot or macOS installer image. The latter two options are useful in a lab environment where all Macs will be imaged at the same time, as it saves the tech the steps of shutting each one down, then booting them up while holding the N or Option key.

Maintenance
The Maintenance payload has a few options that can be used to ensure that Macs remain healthy, including Fix Disk Permissions (though this only works with Mac OS <= 10.11), Flush System/User Caches (including the Microsoft Office font caches), and Verify Startup Disk. However, if the Mac is in enough trouble to need these to be run, it may be doubtful whether it will actually be in a good enough state to run them via JAMF.

Two JAMF-specific options allow you to instruct the Mac to submit updated inventory information to the JSS (after software is installed, accounts are created, etc.), and to reset the local computer name to the name entered in JAMF, if for some reason a user had enough rights to change it.

Files and Processes
The Files and Processes payload allows you to perform a few routine tasks that would otherwise require the creation of a script to do, such as finding and deleting a file by path or filename, finding and deleting a process by name, or executing an arbitrary shell one-liner. For example, if you just wanted to use a policy to force a Mac to reset its time from a network time server, it would probably be easier to enter the command in the Execute Command field of the Files and Processes payload, rather than creating a whole script just for that.


Whereas Payloads are the effects that a Policy has, Triggers are the conditions that specify when it should be run. There are several available triggers, which mostly are what they sound like:
  • Startup - the policy will run when the computer starts. This means that payloads that require a user to be logged on will not work correctly with this trigger.
  • Login - the policy will run when a user logs in. 
  • Logout - the policy will run when a user logs out.
  • Network State Change - the policy will run when anything happens that might impair JAMF's ability to communicate with the Mac, including switching interfaces (Ethernet to WiFi), changing of its hostname, or changing of its IP address.
  • Enrollment Complete - the policy will run after the Mac finishes being enrolled in JAMF, or when reimaging is completed. This is useful for provisioning required software and other changes to new or freshly-imaged devices.
  • Recurring Check-in - the policy will run at the frequency set for computers to check in with JAMF. By default, this is every 15 minutes, but it can be as short as every 5 minutes, or as long as every 60 minutes.
  • Custom - You can define a custom trigger for a Policy to allow you to run it from Terminal on a Mac to create custom commands. For example, we have a custom trigger on our AD binding policies, one per campus, that all use the custom trigger "bindAD". To bind a Mac to AD, and to have it automatically drop into the correct OU, I can do sudo jamf policy -trigger bindAD without caring which campus the Mac belongs to.
In addition to these triggers, you can specify the Execution Frequency for the Policy, determining whether it will run once per computer, once per user (system-wide), once per user per computer, once a day, once a week, once a month, or ongoing. An execution frequency of Ongoing is useful with custom triggers, as well as with Recurring Check-in triggers for actions that need to happen every 15 or so minutes.

In case that's not granular enough, Policies also have two different levels of date/time filtering, allowing you to decide down to the minute when a Policy should or should not run. You can specify server-side limitations, outside of which clients will not see the Policy, as well as client-side limitations, which specify a range of times and dates that clients may see the Policy, but will not execute it. You could use this, for example, to have all Macs check for and install available updates on Monday, Wednesday, and Friday, but only between 10pm and 6am to ensure nobody is using them.

Using the above triggers, Policies can be set to run automatically, but this is not required. Policies can also be set to be available from the Self Service application that JAMF installs on client Macs. By making application-deployment Policies available in Self Service, an organization can set up its own App Store-like repository, from which users can install applications and other Policies as they need them.

For a Policy to be available to a Mac, either automatically via trigger or in the Self Service application, the Mac must be part of the Policy's Scope. A Scope is much like a Collection in SCCM; Macs can be added individually by name, or by Smart or Static Computer Group. Similarly, you can choose which users may or may not run Policies, and even combine the two to specify that a Policy should only run on certain machines for certain users.

Finally, using the User Interaction tab of the Policy editor, you can specify a message that should be displayed when the Policy runs, one that should be displayed when the Policy finishes, and one that should be displayed if the computer needs to be restarted. You can also choose to allow the user to defer the Policy until a certain date and time, after which it will run regardless of their deferment.

This concludes my exploration of Policies in JAMF. As you can see, they are the main powerhouse of the JAMF system. Next, I'll take a look at Configuration Profiles, the MDM-esque management technology provided by newer versions of Mac OS.

Tuesday, August 21, 2018

Mac Administration with JAMF, Part 1: Overview

At my current job, we have several computer labs with Mac computers used by our Visual Communications program. We now use a product called JAMF to manage the fleet statewide, but things were not always so nice - initially, each service area within our system configured and administered their Macs in their own way, so the actual images and techniques used to build them varied from campus to campus.

In our service area, we used the "golden master" image creation technique: one Mac would get a fresh-from-Apple image, requested software would be installed, necessary configurations would be made, and then a full-disk image from that Mac would be captured and deployed to Macs via DeployStudio. This was obviously labor-intensive - each time a change needed to be made to the image, or if any problems were discovered, either each Mac needed to be manually updated, or the "golden master" had to be re-built, re-captured, and re-deployed. While DeployStudio has some ability to push software to Macs, we did not have the infrastructure set up for that, so we effectively had no central management capabilities at all.

Enter JAMF. Originally called Casper Suite, JAMF provides a host of management and administration tools for Macs approaching the breadth and depth of SCCM on the Windows side of things: imaging, software deployment/removal, settings management, configuration profile deployment, inventory, reporting, etc., all things sorely needed in our statewide environment. While the basic ideas of JAMF are similar to those of SCCM and other management systems, some of the terminology may differ, so I'll try to explain what everything is and how we use it in our environment. (Since we implemented JAMF, a newer version called JAMF Pro has become available, which has slightly different names for some of its software tools; this discussion refers to JAMF/Casper Suite 9.101, which is what we currently use.) Each of these will be discussed in more detail in further posts.

Tools

JSS - The JAMF Software Server is the central management point for the JAMF system. This is a piece of server software that runs on a virtual machine in our central data center. Interestingly, even though JAMF is a management system for Macs, the JSS need not run on an Apple operating system - ours runs on Windows Server 2012R2. The JSS also provides the web interface/administration console for the system.

Casper Admin - This is a Mac OS application that provides an interface to upload and work with packages and imaging configurations (please see below). Among other things, Casper Admin allows you to index packages, which makes it possible to uninstall them from managed Macs using JAMF (though this only works with certain types of packages).

Casper Remote - A Mac OS application that replicates a lot of the capabilities of the Apple Remote Desktop application focused on the JAMF environment. Using Casper Remote, not only can you view and control managed Macs' screens, you can also deploy software, run scripts, collect inventory information, and otherwise administer the remote computer more easily than via SSH.

Casper Imaging - JAMF imaging, at least traditionally, involves the creation of a NetBootable Mac OS environment that runs the Casper Imaging application. Casper Imaging allows you to specify a name for the Mac, select which imaging configuration should be used to image it, and other related tasks.

Composer - A Mac OS application that allows you to capture and build packages that can be deployed to Macs. Packages are usually things like software installations, but can include most any file type, and using preinstall and postinstall scripts, can even be used without a payload to run an arbitrary script on a Mac. Composer can produce Apple-style .pkg packages, as well as JAMF-specific .dmg packages, which have the advantage of being indexable (using Casper Admin) and uninstallable via JAMF, but cannot be used with certain workflows (like osinstall-based imaging).

Recon - A Mac OS application that allows you to remotely enroll Macs into JAMF (import their information, and if possible, push the client binary via SSH). In our environment, the IT department enrolls Macs as we receive them, so this doesn't get much use, but this would be very handy in BYOD environments or where users at remote sites do not have the technical skills to enroll the devices themselves upon delivery directly from a retailer.

Self-Service - A Mac OS application installed by default on all JAMF-managed Macs that functions similar to the App Store. The JAMF administrator can specify a set of policies, apps, etc. that are runnable or installable by the user here, and can determine which are available to which users at what times. In our environment, we don't use this, as we centrally manage as much as possible, but in a BYOD environment or zero-touch configuration environment this would be very useful indeed.

Terminology

Policy - Policies are the main management tool in JAMF. Various "payloads" may be set for a Policy, including a set of packages to install (or uninstall), scripts to run (with various inputs that may be specified), printers to install, AD bindings to apply, etc. They can be set to run once per computer, once per user, on a recurring basis, or only between certain times or dates. Policies apply only to Macs that are within their "scope", and may be set to run automatically at the check-in interval or to be available in the Self-Service application to be run by the user.

Configuration Profile - Configuration profiles use Apple's own APNS push notification-based MDM technologies to enforce settings on managed Macs much like can be done for iOS devices. Configuration profiles are oriented more toward managing the same settings that can be found through the System Preferences application; they cannot do things like install software or run arbitrary scripts, and as they are pushed through Apple's system, it is sometimes hard to control when they do or do not get applied to client Macs.

Imaging Configuration - An imaging configuration is like a Task Sequence in SCCM - a base image is specified, along with a set of packages or scripts to run after the image is applied. This replaces the "golden master" style of imaging with one that is more configurable and updatable. Imaging configurations are applied using the Casper Imaging application.

Package - A package is either an Apple-style .pkg installer, or a JAMF-style .dmg installer, either created by Composer or downloaded directly from a vendor's website. Composer-created .dmg packages can be made uninstallable by indexing them using Casper Admin.

Script - JAMF supports shell and Python scripts, which can be run as part of a Policy or via Casper Remote. The system automatically correlates command-line parameters to GUI fields to make it easy to specify arguments to scripts.

NetBoot - Apple devices (except those that include the T2 chip, as of this writing) support booting from network-based images, similar to PCs that can start up from PXE. The JAMF system uses this to provide imaging capabilities via the Casper Imaging application. In our environment, we host NetBoot images from Mac Minis at each campus, which also serve as Distribution Points.

Distribution Point - JAMF policies pull packages from local distribution points in order to reduce the amount of bandwidth used on the statewide WAN. Distribution points, which are simple SMB or AFP file shares, can reside on any device capable of serving them; we use SMB shares on Mac Minis, which also serve as NetBoot image servers.

This concludes a brief overview of the tools and terminology of the JAMF system. In future posts, I will explore each of these in more detail.






Friday, August 10, 2018

PowerShell for Desktop Support, Part 1: Remoting, Services and Processes

In my current desktop support role, I often find that I need to remote into a computer to get information about it or make changes without interrupting whoever is currently using the machine. This means that I can't just use the Remote Desktop application, as only one desktop session can run at a time, which would require me to kick the user off. Luckily, PowerShell provides remote access capabilities much like SSH on Unix-based systems that solve this problem.

Our Windows images have PowerShell remoting enabled by default. The PS command to enable remoting on a machine is simple:
Enable-PSRemoting
Optionally, additional flags like -Confirm, -Force, and -SkipNetworkProfileCheck may be specified. The first two are what they sound like; -SkipNetworkProfileCheck allows you to enable remote access from public networks (as opposed to private or domain networks, which are enabled by default), but only within the same subnet. There are security implications for this, so make sure to run
Get-Help Enable-PSRemoting -Examples and read the explanation there.

To connect to a remote PC with an interactive command prompt, run
Enter-PSSession <computer name>
and, once the connection is complete, you will be able to run commands directly on the remote computer. This is really useful for desktop support, as it lets you do work on a computer without disturbing a busy user who may have long-running jobs (graphics/video rendering, etc.) that can't be interrupted.

One thing that we do often is to restart services running on a computer. For example, the Pharos Systems ComTaskMaster service often fails to start automatically after an update to a Pharos package, and must be started manually so that it will resume its normal functionality on further reboots.

To see a list of all of the services running on a computer, use
Get-WmiObject -Class Win32_Service

The output of that command is pretty verbose, as it's listing all of the properties of each object and their values. To get just the names of services, run
Get-WmiObject -Class Win32_Service | Select-Object Name

If you know the name of the service you want to work with, you can look at it specifically with
Get-WmiObject -Class Win32_Service | Where { $_.Name -eq "<service name>" }
and, to work with it, you can store a reference to it in a variable:
$service = Get-WmiObject -Class Win32_Service | Where { $_.Name -eq "<service name>" }

Then, you can interact with the service by piping it to various cmdlets:
$service | Restart-Service
etc. Of course, you don't necessarily need to get the service as a WmiObject if you already know its name; in that case, you can simply do
Restart-Service "<service name>"
for the same effect.

Processes can be interacted with very similarly to services. To get a list of processes running on the computer, you can run
Get-WmiObject -Class Win32_Process
And, to get just the names,
Get-WmiObject -Class Win32_Process | Select-Object Name

For example, to stop a process called "Stuck.exe", you could use
Get-WimObject -Class Win32_Process | Where { $_.Name -eq "Stuck.exe" } | Stop-Process
or, more concisely,
Stop-Process -Name "Stuck.exe"

Other cmdlets to work with processes include Start-Process, Wait-Process, and Debug-Process. Processes are not restartable in the same way that services are.

To end the remote session, simply run
Exit-PSSession .

Tableau, TabPy, and the Case of No Input Rows

 I haven't scientifically confirmed this or anything, but it sure seems like if you pass an empty dataframe to a TabPy script, then no m...