Alan Siu's Blog

Category: Uncategorized

  • Updating MS Office dock icons from 2011 to 2016 using dockutil

    Managing client machines while also giving your users freedom to customize their machines as they want can be a bit tricky. On the one hand, you want to automate things as much as possible so users don’t have to be bothered with too many update prompts and other maintenance nuisances. On the other hand, you…

  • Can’t change Safari homepage in Sierra, even with no profiles managing homepage

    So I came across something weird that’s affected only my 10.12.4 clients (none of my 10.11.6 clients seem to be affected by this). Even though I have only one Safari profile enabled, which is set-once and doesn’t manage the homepage, my 10.12.4 clients are unable to change the homepage in Safari manually. Whatever the homepage…

  • Script AutoPkg trust verification and trust update process

    Starting with version 1, AutoPkg began evaluating trust info for recipes, so you could see what changes were made to a recipe (if changes were made) and then accept the changes if you wanted to. Here is what the typical trust verification workflow looks like. Whether running a list of recipes via script or via…

  • Guided Access mode after a reboot on iOS 9 vs. iOS 10 vs. iOS 11 vs. iOS 12

    iOS 12 Update: Just tested on iOS 12, and it gets out of guided access mode after a reboot. iOS 11 Update: Just tested on iOS 11, and it stays in guided access mode after a reboot. Same with iOS 11.1. Update: Just saw an iPad with 10.3.3 not get out of guided access mode…

  • Basics of Crypt 2 and Crypt Server

    Graham Gilbert created a pretty cool project called Crypt 2, which forces client machines to enable FileVault2 encryption, and then sends the recovery key to a Crypt Server. So far the documentation on Crypt 2 is rather sparse, so this is what I was able to piece together based on the README, some asking around,…

  • Using startosinstall to install a macOS upgrade with Munki

    Update: The instructions below will be obsolete once Munki 3 is released. More details on the Munki 3 implementation can be found on the Munki wiki. createOSXinstallPkg is a great project for making an Apple macOS installer into a .pkg you can deploy with Munki. Apple did some things to break that process for 10.12.4.…

  • Students unsubscribing from mailing lists within Google Apps for Education

    GAM solution Apparently, there is a GAM solution to this, which is gam update group nameofgroup who_can_leave_group ALL_MANAGERS_CAN_LEAVE I did a quick test, and it appears to work. Users will still see the option to “unsubscribe,” but after they do, they’ll still be subscribed anyway. Thanks to Zack McCauley for the tip. What’s the problem?…

  • Why you should use FileVault personal recovery keys instead of institutional recovery keys

    In my previous blog posts on FileVault, I talked about or showed how to use an institutional recovery key for FileVault encryption: Enabling FileVault Encryption for Client Macs Setting up deferred FileVault encryption Using a FileVault institutional recovery key to unlock an encrypted disk But in exploring FileVault further, I’ve found it’s much better to…

  • Automating an AutoPkg Munki import when vendors don’t package installers properly

    You may have, when using (or creating) a .munki AutoPkg recipe, come across a situation in which you run it: autopkg run -v NAMEOFITEM.munki and then get something back like this: Item NAMEOFITEM already exists in the munki repo as OLDNAMEOFITEM. even though you’re sure the item is newer than the one in the Munki…

  • Using an Outset boot-every script to add default applications via Munki

    In Bash script to add optional installs for Munki, I introduced a script that uses PlistBuddy to add optional install items to the client machine’s SelfServeManifest. I thought at first I could use that as a boot-once script for Outset, but it seemed the script ran too early (actual first boot) and then didn’t actually…

  • When an AutoPkg recipe fails to import a .dmg

    If you ever have an AutoPkg recipe that seems to be working fine for weeks or even months and then suddenly fails with a message like this one: Error in local.munki.FileZilla: Processor: MunkiImporter: Error: creating pkginfo for /Users/USERNAME/Library/AutoPkg/Cache/local.munki.FileZilla/FileZilla.dmg failed: Could not mount /Users/USERNAME/Library/AutoPkg/Cache/local.munki.FileZilla/FileZilla.dmg! (doesn’t have to be FileZilla—could be anything), you may not see the…

  • Using DVD Flick to create DVDs from video files

    DVD Flick is an open source Windows program that allows you to burn various video file types to DVD (as an actual DVD, not as a data file). It’s fairly simple to use, but there are a couple of weird nuances: By default, it doesn’t actually burn to disc when you create the DVD. It…

  • Hide optional installs in Managed Software Center using JavaScript

    Munki 3 brings in something called “Featured items” to Managed Software Center. You can read some munki-dev mailing list discussion about the feature before its implementation. The way it’s implemented, you add in this key <key>featured</key> <true/> to the pkginfo of the optional installs item you want to have show up in the Software tab…

  • Apple TV “the code is incorrect” error… when the code is correct!

    We ran into a weird scenario where a user could not connect to Apple TV with a passcode. We tried all the usual troubleshooting stuff: Does it work with another computer? Yes, it does. Does it work with another user on the same computer? No, it doesn’t. Toggle Bluetooth? Makes no difference. Reboot the AppleTV…

  • Script making Chrome the default browser on macOS

    You would think it would be fairly simple to script changing the default browser to Chrome in macOS. It’s not, as far as I can tell! I’d love to be corrected on this. Script that changes Launch Services I wrote up a script that changes the default browser silently, but it works well only the…