Casper Imaging Breadcrumbs?

DBrowning
Valued Contributor II

Is there anything that can be reported on (EA maybe?) that can easily identify if or when a machine was imaged via Casper Imaging?

1 ACCEPTED SOLUTION

kitzy
Contributor III

@ddcdennisb I actually have a blog post about setting up dummy receipts like @mm2270 mentioned to find out when a machine was imaged on my blog if you're interested in reading more about it.

View solution in original post

3 REPLIES 3

mm2270
Legendary Contributor III

I'm pretty sure there are at least 1 or 2 older threads that discussed some options in detail. I think, the only real way to accomplish this would be to drop a dummy file or receipt of some kind as part of your Casper Imaging configuration onto the Mac being re-imaged. Drop it into a well hidden directory, and something that will not normally be touched by any other normal processes. You can then build an EA script that would either pick up the creation date of the file itself or scan the file contents for information, such as the CA/CI config name and date of imaging. (assuming you are adding those values into the file programmatically)

If you don't already have something like this in place, its really not easy to know this info after the fact. You can try getting the creation date of the "Receipts" directory in /Library/Application Support/JAMF/ This folder as far as I can tell, only gets created after a Mac is enrolled and runs its first policy, or after its re-imaged and runs its first policy. Note that regular enrollments of non-imaged Macs will also have that folder, so its not going to always be an accurate picture of an "imaging" date per se.
Also, if you run a remove framework command on the Mac and then re-enroll it, that directory will get removed and recreated, so the creation date will then not reflect the imaging date. Just something to keep in mind.

kitzy
Contributor III

@ddcdennisb I actually have a blog post about setting up dummy receipts like @mm2270 mentioned to find out when a machine was imaged on my blog if you're interested in reading more about it.

DBrowning
Valued Contributor II

Thank you @kitzy I will take a look.