Repackaging the Microsoft Lync 14.0.8 installer

April 10, 2014 3 comments

Microsoft has released Microsoft Lync 14.0.8, which included compatibility with Mavericks. Since we have several folks using both Lync and Mavericks, I wanted to get this into our Casper server’s Self Service as soon as possible.

To test installing it, I downloaded the installer on a disk image from Microsoft’s site, then renamed the package from Lync Installer.pkg to Lync 14.0.8 Installer.pkg. After renaming it, I set up an installation policy for Self Service, scoped the policy so that only my test machine could see it, then ran the installation.


I go check the logs and see this entry:

/usr/sbin/jamf is version 8.73
Executing Policy Microsoft Lync...
[STEP 1 of 2]
Downloading BOM for Lync 14.0.8 Installer.pkg...
This Apple Package did not have a valid file. Assuming it is a flat file package.
Downloading 14.0.8 Installer.pkg...
Error: The package could not be found on the server.
[STEP 2 of 2]
Running Recon...
Displaying message to end user...

OK, maybe I did that wrong. Deleted the package and this time uploaded the installer to my Casper server without changing the name from Lync Installer.pkg.

/usr/sbin/jamf is version 8.73
Executing Policy Microsoft Lync...
[STEP 1 of 2]
Downloading BOM for Lync Installer.pkg...
This Apple Package did not have a valid file. Assuming it is a flat file package.
Downloading Installer.pkg...
Error: The package could not be found on the server.
[STEP 2 of 2]
Running Recon...
Displaying message to end user...

Failed again. Meanwhile, /var/log/install.log on my test Mac only showed that installd was starting and then stopping. In short, Casper’s logs were right; the installation process was starting but couldn’t then find a package.

At that point, I started thinking. How would the developer have installed this package? How did Q&A likely test installing it, however minimally?

Developer – Would have double-clicked on the package to install it, followed by typing in an admin password.

Q&A – Same process as the developer, except they would have tested installing it from the mounted disk image.

Read more…

Creating an Office 2011 SP 4 14.4.1 installer

April 9, 2014 7 comments

One of the issues I worked on this week was building a new Office 2011 installer after Microsoft released the Office 2011 14.4.1 update. I have an existing process to build a combined Office 2011 installer using Packages, which I’ve used successfully for a while.

This time though, I hit a problem. When I installed the combined Office 2011 installer with DeployStudio, then logged in, I was asked to enter a product key. Since my work has a volume license, this isn’t a screen I should ever see.

Screen Shot 2014-04-09 at 5.38.23 PM

This is a problem that’s been seen with previous Microsoft Office 2011 installers and usually involves the volume license file not being applied when it should be. This behavior may be seen with the 14.4.1 update in the following cases:

1. Office 2011 is installed and then updated to 14.4.1 while nobody is logged in

2. Office 2011 is installed and then updated to 14.4.1 without any Office applications being launched between the initial installation and the update.

These two scenarios will likely apply if you’re building a new machine using an automated deployment tool, but likely will not if you’re a home user.

With luck, this will only be an issue for 14.4.1 and Microsoft will fix this issue in the next 14.4.x update. In the meantime, the easiest fix I’ve found in my testing this week is to get the necessary volume license file from a machine that has Office 14.3.x installed on it and put it back on an as-needed basis.

The needed file is /Library/Preferences/ If you have a volume-licensed version of Office 2011 installed on your Mac, you should have this file.

Screen Shot 2014-04-09 at 4.17.48 PM

To address the issue of installing 14.4.1 without losing your volume license, you can use Packages‘ ability to add resources to a Packages-built package. See below the jump for how you can use an Office 2011 SP 3 installer package, the Office 2011 14.4.1 Update, and the license file to build a unified Office 2011 SP 4 14.4.1 installer package that does not prompt for a product key.

Read more…

Using /etc/auto_home on Mavericks to mount shares under /home

April 6, 2014 2 comments

One of my users at work asked me recently about symlinking his network home folder to /home on his Mac running 10.9.2 and wanted to check to see if it was safe to do so.

In this case, the person in question works on both Fedora Linux, where his network home directory was mounted as /home/username, and on OS X. His network home directory was available via SMB on his Mac as smb://servername/home$/username. He wanted to be able to mount smb://servername/home$/username to /home/username on his Mac, so that it matched the mountpoint of his network home on his Fedora box.

At the time, here’s what I knew about /home:

1. Nothing appears to be stored in it by default

2. It’s listed in /etc/auto_master as a mountpoint

Screen Shot 2014-04-05 at 10.52.02 PM

3. Time Machine does not back it up

Read more…

Slides from the FileVault 2 Session at MacIT 2014

March 26, 2014 3 comments

For those who wanted a copy of my FileVault 2 talk at MacIT 2014, here are links to the slides in PDF and Keynote format.


Keynote slides:

Removing all recovery keys from a FileVault 2-encrypted Mavericks Mac

March 24, 2014 2 comments

One of the functions added to the fdesetup tool on 10.9 is removerecovery. This function removes the current recovery key(s) from a FileVault 2-encrypted Mac and can be used to remove with the personal and/or institutional recovery keys from a Mac.

One interesting aspect of this is that this function can be used to remove all recovery keys from a FileVault 2-encrypted Mac running Mavericks. Once the recovery keys have been removed from your Mac, only FileVault 2-enabled accounts will be able to unlock or decrypt it. For more details, see below the jump.

Read more…

Disabling FileVault 2 with fdesetup on Mountain Lion and Mavericks

March 22, 2014 Leave a comment

Recently, I was asked how to disable FileVault 2 without needing to go into System Preferences. The general idea was that an organization may want to provide their users without admin rights a way to turn off FileVault 2 on an as-needed basis.

Most of the work I’ve done has been focused around turning on FileVault 2 and managing it, rather than providing a way for users to turn it off. That said, fdesetup on both Mountain Lion and Mavericks provides a way to disable FileVault 2 with proper authorization.

To disable FileVault 2 on the Mac you’re logged into, run the following command with root privileges:

fdesetup disable

You’ll be prompted for either the password of an enabled user or a personal recovery key.

Screen Shot 2014-03-22 at 5.39.08 PM  

Screen Shot 2014-03-22 at 5.47.15 PM

Note: If a personal recovery key was not set up on a particular Mac, you’ll only be prompted for the password of an enabled user.

Screen Shot 2014-03-22 at 6.14.48 PM

Once the password or personal recovery key has been entered, the Mac will begin to decrypt.

For those who want to automate this procedure, you can do this using an expect script or other means. As an example, I’ve written an expect script which automates running the fdesetup disable process described above.

Setting Parameter Labels in Casper

March 20, 2014 3 comments

I recently learned about how to use Parameter Labels as part of a JAMF training class. I had read about them in the Casper Administrator’s Guide but managed to fundamentally misunderstand what they did and how they work.

What I thought:

Adding a Parameter Label value to a script in Casper Admin meant that the associated variable value would be pre-set for the script when I added it to a policy.

I didn’t want this behavior, as I wanted to maintain flexibility when setting policies. Consequently, I didn’t set anything in the Parameter Label value for my scripts.

How they actually work:

Setting the Parameter Label value in Casper Admin means that you’re changing the label that shows up in the script parameters in a policy. For example, changing the Parameter Label value for Parameter 4 in Casper Admin to Username means that the parameter name for the script will change from Parameter 4 to Username when you add the script to a policy.

Screen Shot 2014-03-20 at 10.29.02 AM

Screen Shot 2014-03-20 at 10.28.01 AM

Here’s how to set Parameter Labels in Casper Admin:

1. Open Casper Admin

2. Select the script you want.

3. Click the Info button.

Screen Shot 2014-03-20 at 10.30.47 AM

4. Click the Options tab.

Screen Shot 2014-03-20 at 10.32.11 AM

5. Set the parameter you want to change to the desired name.

Screen Shot 2014-03-20 at 10.26.28 AM

6. When you create a policy that uses that script, the parameter will have the name you set instead of the default parameter name.

Screen Shot 2014-03-20 at 10.28.01 AM

Categories: Bash scripting, Casper

Get every new post delivered to your Inbox.

Join 125 other followers

%d bloggers like this: