Enforce Lync Client Settings

[FritzsCorner]

I have been reading through the various threads on managing Lync settings and gotten a lot of great information. I have gotten the automation piece in place using the script from @talkingmoose and that has worked out great. However, some of the settings we are trying to enforce simply aren't working. Most likely because I am doing something insanely wrong. ;)

Some of the settings we are specifically looking to enforce/disable are the Audio Call’s, Video Calls, Idle timer, and the Lync plugin setting. The goal is that once we set these, the end user will not be able to change these settings. I don't necessarily agree with some of these settings being enforced but it isn't my call. I have opened a case with MS so hopefully I will get some guidance on that front but thought I would check in here as well. I have some screenshots below on what we want to do.

[bpavlov]

Have you looked at the plist and what keys are being changed when you disable/enable certain features/preferences? If you know that then you can make a custom profile to enforce it always.

[FritzsCorner]

I have. Unfortunately I haven't been able to get consistent reliable results. When I set the idle time via script or profile the client always reverts to the setting in the GUI. The only way I have been able to somewhat get things working is to edit the .nib file for that preference, but I would prefer to not go that route.

[nessts]

Just a thought, have you checked if disabling video and audio might be able to be done on the server side? On a personal question it seems like you are taking all the best parts of lync and getting rid of it, so what is the point of it?

[jhbush]

@FritzsCorner does this help?

https://technet.microsoft.com/en-us/library/jj984149(v=office.14).aspx

It looks like you can set most things in the RegistrationDB

[FritzsCorner]

@nessts I agree with you but unfortunately I have no say in this. We use another solution for video/audio UC so they prefer to limit people to that solution. I will check with our Lync admin to see if it can be set on the server side.

@jhbush1973 I have followed that guide but for some reason any of my changes are not registering with Lync. I run opensnoop when Lync is launched and none of the preference files are even getting read. I am pretty sure I am doing something wrong here, just need to figure out where I am going wrong.

[mpermann]

@FritzsCorner are the .plist files being cached by cfprefsd by chance? I know I've seen on some other threads that people have been forced to kill cfprefsd before making changes to the .plist files for the settings to stick. I believe in some cases they have even had to restart the computer to get the settings to change. We were messing with clearing out the recent items menu under the Apple menu and were having a devil of a time getting it to work. Ultimately we took a different route to accomplish the task. Maybe @bentoms, @mm2270 or @talkingmoose might have some suggestion of things to try.

[talkingmoose · Accepted solution]

You're not going to be able to apply management to the audio/video part of Lync. Configuration Profiles are about managing plists and plists are about managing user preferences. Lync doesn't have preferences to enable/disable audio/video. You're going to need to manage that at the server level.

The other settings, though, should be manageable because they are actually user preferences. Now, you need to find the key for each preference. I do this by opening the ~/Library/Preferences/com.microsoft.Lync.plist file in BBEdit or TextWrangler, copying its contents to a new empty window, making my changes, reopening the plist file and then comparing the two windows using Search > Compare Two Front Windows.

The first preference appears to be:

    <key>UseJoinMeetingPlugin</key>
    <true/>

All I need to do to manage this is set "true" to "false". Some applications react differently to being managed and this is one of them. Although I can set it, nothing stops the user from changing it. However, it always reverts back to my setting between logins. That's probably the best you'll be able to do.

The second preference appears to be:

    <key>sip:bill(at)talkingmoose(dot)net</key>
    <dict>
        <key>IdleTime</key>
        <real>33</real>
        ...
        ...
        ...
    <dict>

That second preference is buried in a dictionary in a sub-key, but in my testing I'm able to manage it. Great! the problem, though, is the parent key will be different for each user. You can't manage this dynamically because you can't use something like a wildcard for a key name. Dammit, Microsoft!

To keep going, you want to craft a com.microsoft.Lync.plist file with just these settings. Duplicate the original plist and then edit it in your preferred text editor (which is either BBEdit or TextWrangler, right?). Remove all the other settings you aren't managing. The end result should look something like:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UseJoinMeetingPlugin</key>
    <false/>
    <key>sip:bill(at)talkingmoose(dot)net</key>
    <dict>
        <key>IdleTime</key>
        <integer>33</integer>
    </dict>
</dict>
</plist>

Upload this into your custom profile in Casper and save. Download the .mobileconfig profile and test on a Mac with Lync and see if this gets you what you're needing.

[FritzsCorner]

@talkingmoose Thank you for the awesome feedback. I was able to work with our Lync admin to disable the audio/video at the server level. We thought we had it disabled on the server before but then realized it was not set correctly.

We needed to go into the users profile and set the telephony setting to Audio/video disabled

To set this across all users you can run a powershell command on the server like the following example.

Get-CsUser -LdapFilter "Department=Finance" | Set-CsUser -EnterpriseVoiceEnabled $false

As for the Idle time and Lync Plugin settings, like an idiot I was editing the wrong keys in the plist. I am going to update my config profiles later today and give them a shot.

I really appreciate you taking the time to give such detailed response!

[FritzsCorner]

I was looking at other way's to enforce the IdleTime value using a script instead of a config profile and think I am pretty close but my bash script-fu is failing me.

Below is a script I was working on that I could run at logon to set the IdleTime Value for each user in the com.microsoft.Lync.plist file. My syntax for plist buddy is off and it can never find the <key>sip:fritz(at)my-company(dot)com</key>.

Idle time for sip:fritz(at)my-company(dot)com will be updated
Set: Entry, "sip:fritz(at)my-company(dot)com:IdleTime", Does Not Exist

I tried using the defaults write command as well but whenever I update a sub-key it seems to delete all other subkeys under the parent key and write's just the new key/value. I can see the error has the string in quotes but every time I remove the quotes or change the arguments path I just get an invalid arguments error. I have to be overlooking a simple Syntax issue here. Anyone have any idea on what I am doing wrong?

#!/bin/sh

# determine current user
USERNAME=`stat /dev/console | awk '{ print $5 }'`
echo "Current User is $USERNAME"

if [ "$USERNAME" = "adobeinstall" ] && [ "$USERNAME" = "admin" ]; then
    echo "Skipping user: ""$USERNAME"" and exiting."
    exit 0
fi  

PLIST="/Users/$USERNAME/Library/Preferences/com.microsoft.Lync.plist"

SIPUSERS=`defaults read $PLIST | grep 'sip:' | sed 's|["{ ]||g'`

arr=$(echo $SIPUSERS | tr "=" "
")

for i in $arr; do
    echo "Idle time for $i will be updated"
    /usr/libexec/plistbuddy -c "set $i:IdleTime 5" $PLIST
done


exit 0

[nessts]

Well you need to read the man page a little about PlistBuddy before trying to use it too much more. First thing I know is wrong is that your arr is equal to sip:user(dot)... and the : has special meaning with the PlistBuddy tool. Next you cannot Set something that does not exist yet, if it exists you can use set, if not you have to use add, and you have to define what type of thing you are adding. Last I am unsure why you are trying to loop on a single item. So if it were me and I was going to assume that nobody has this set I would probably make it look more like this...

#!/bin/sh

# determine current user
USERNAME=`stat /dev/console | awk '{ print $5 }'`
echo "Current User is $USERNAME"

if [ "$currentUser" = "adobeinstall" ] && [ "$currentUser" = "admin" ]; then
    echo "Skipping user: ""$USERNAME"" and exiting."
    exit 0
fi  

PLIST="/Users/$USERNAME/Library/Preferences/com.microsoft.Lync.plist"

SIPUSERS=`defaults read $PLIST | grep 'sip:' | sed 's|["{ ]||g'`

arr=$(echo $SIPUSERS | tr "=" "
")
new=$(echo $arr|awk -F: '{print $2}')

echo "Idle time for sip:$new:IdleTime integer will be updated"
/usr/libexec/plistbuddy -c "add sip:$new:IdleTime integer 5" $PLIST


exit 0

If it were really me I would probably use PlistBuddy to read the value with this command

/usr/libexec/PlistBuddy -c "print sip:$new:IdleTime"

and then I would decide to add or set based off the answer of either Print: Entry, "sip:first(dot)last(at)company(dot)com:IdleTime", Does Not Exist
or 60