For thin imaging, how to know when all the required policies have run?

[stevenjklein]

I'm the Jamf guy here, but I'm not the only person staging new (or re-purposed) Macs.

With NetRestore, it was easy, but now that we've gone to thin imaging, things aren't so simple.

My normal procedure (for myself) is this:

1. Enroll the Mac in Jamf.
2. Wait a while, then
3. Look up that Mac in the JSS, and check the policy logs to verify that all policies completed.

The procedure for my (non-JSS using) coworkers is this:

1. "Hey Steve, is this Mac done imaging yet?"

(Perhaps their method is more efficient -- it only takes one step!)

There must be a better way, and I can think of several.

But before I reinvent the wheel, how do others deal with this issue?

[Sandy]

When I image, I have many things set to install after reboot. I also have it set up so when the SSID gets added, which then connects to our wifi and bars are black, I know they are done.
Since they run in order of priority set in the package, and inside of that, alphabetically it works great. I just have the SSID policies set to higher number.
There are probably other ways, this one works well here :)

[obi-k]

Instead of waiting for a bit, how about opening Terminal and running:

sudo jamf policy
sudo jamf recon

This way you know all the polices ran, then go to step 3 if you wish.

[dpertschi]

One option would be to start your policy with a jamf helper full screen dialog that says things are installing, and then finish the policy by killing the jamf helper process and/or rebooting.

/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType fs -heading 'Heading Text' -description 'Description Text'

But, that provides no feedback. A better option might be to make your provisioning policy a self serve policy, then you’ll have more feedback in the GUI as to what is happening.

Or, if you like 'making things' check out DEPNotify
Cool little utility you can launch at the beginning of the policy and it can echo the JAMF log of what is installing and provide a progress bar.

[jhalvorson]

One of the packages I include in our thin image is of a script titled "inventory.command" that is stored in a place for our techs to launch. There's even the say command to let the tech know when to enter the admin password - I assume they love it!

#!/bin/bash
#################################################################################
# Double-click this script to run the jamf recon command to inventory the computer
#################################################################################
# MOD:  Version 2.0 
#   Dec 12, 2016,  removed the JAMF binary location.  It’s well established now /usr/local/bin/jamf
#       The location changed with the release of Casper Suite 9.8
#
# Expected to work with 10.12, 10.11, 10.10, 10.9
# Tested with jamf version 9.96
#################################################################################

echo #blank line#
echo "Policy Check and Inventory Update version 2.0"
echo #blank line#


#################################################################################
# check if jamf binary
#################################################################################
if [[ -e /usr/local/bin/jamf ]]

    then echo "JAMF binary present, continuing as planned..."

    else echo "JAMF binary is not present. Install Inventory Tool or the QuickAdd pkg."

    exit 55

fi
echo #blank line#
#################################################################################
# check for network connection to JAMF Software Server
#################################################################################

echo "---Checking for connection to JAMF Software Server---"
echo "Very long pause at this point means the computer is NOT connected"
echo "to Company's network."
echo #blank line#
echo "Escape the delay by pressing control + z.  Fix network and then try the command again."

echo #blank line#

Network2JSS=`jamf checkJSSConnection | awk -F" " '/JSS/{print $3}'`

if [[ "$Network2JSS" == "is" ]]


    then echo "JAMF Software Server connection is good, continuing as planned..."

    else 
    echo "----NETWORK CONNECTION FAILED---"
    echo "Not able to connect to the JSS sever.  Please verify network connection and run this command again."

    exit 55 
fi

echo #blank line#
echo #blank line#

echo "Please enter a Administrative password to continue with Inventory Update."
say "Please enter a password to continue with the Inventory Update." &

sudo -i jamf manage

echo #blank line#
echo #blank line#

sudo -i jamf recon

echo #blank line#
echo #blank line#

sudo -i jamf policy

echo #blank line#
echo #blank line#

sudo -i jamf recon

echo #blank line#
echo #blank line#

echo "jamf recon completed."
say "Inventory Update completed. OK to close this window." &
echo #blank line#
echo #blank line#
exit 0

.

The script is very basic, but it verifies Jam binary, checks the connection to the JSS, runs Jamf recon, then runs jamf policy and then runs recon again. It probably really should run Jamf policy a second time and then a third Jamf recon. Horrible, but was a quick solution.

[Look]

I just change the login picture to the organisational one and then restart, if the machine has the correct background it's done!

[mfcfadmin]

We raise a JAMF event to trigger the installation of packages and the first package installed
puts a perl script and csv on the machine that contains a success message, a failure message,
and a path to check, e.g.

XQuartz installed,XQuartz NOT installed,/Applications/Utilities/XQuartz.app/

The perl script surrounds the message with escape sequences which make the success messages green
and the failure messages red to highlight progress and failures.

[jkuo]

We use a modified version of this script by @adamcodega for our DEP/thin imaging workflow.

Inside the script I have whatever policies I want to run based on triggers. While each policy is running, I put in a "fake" progress dialog box that will display until the policy is complete, so that the tech at least knows that something is running.

That looks like this:

# Run policy and display progress bar, 2 arguments - (1) app to install/policy name and (2) policy trigger
runpolicy() {
    policyname=$1
    policytrigger=$2
    pipe="cd${policytrigger}pipe"

    installtext="Installing ${policyname}..."
    echo "${installtext}"

    # Remove Temp pipe file if it exists
    rm -f /tmp/${pipe}

    # Create temp pipe file
    mkfifo /tmp/${pipe}

    sleep 0.2

    # Start cocoaDialog prompt
    $coDi progressbar --indeterminate --title "${installtext}" --height "80" --width "500" --icon "installer" --icon-height "96" --icon-width "96" --float < /tmp/${pipe} &

    # Echo out to pipe to be relayed to cocoaDialog window
    exec 3<> /tmp/${pipe}

    jamf policy -trigger ${policytrigger} 2>&1 | while read line; do
        echo "10 $line" >&3
    done

    exec 3>&-

    # Remove Temp pipe file if it exists
    rm -f /tmp/${pipe}
}

Then to run the individual policies, you would do something like this:

runpolicy Chrome
runpolicy Firefox

At the very end, it pops a dialog that says All Done! with an OK button.

Hope that helps!

[robertliebsch]

tail -f /var/log/jamf.log

just follow along.