JAMF Software’s Casper Suite has the ability to use Configuration Profiles (Apple’s preferred method for managing OSX and iOS) since version 8.0, and introduced Apple Push Notification Service (APNS) support since Casper Suite 8.4. The combination of using Configurations Profiles with APNS allows administrators the ability to push management settings, which will be installed immediately and securely on their client machines. However, Apple has been slow to provide Configuration Profiles a 1:1 feature parity that Mac Administrators were used to be able to configure through MCX via Workgroup Manager (RIP). There is a need to extract legacy MCX Settings and convert them into a working Configuration Profiles to manage options in a meticulous fashion: thus mcxToProfile.
Tim Sutton (@tvsutton) created mcxToProfile to solve this problem, and this utility is not new. The initial commit to the GitHub repo was on June 20th 2012 and the latest update was October 11th 2013! However, I feel that too many Casper administrators believe if there is not a Configuration Profile checkbox available from the JSS then they should figure out an alternative method which doesn’t include a profile. This is not true, have options! For example…
VPN Settings (Advanced)
When you configure VPN Settings (VPN Server, Authentication type, parameters, etc) via the JSS, the configuration part is easy and it works! However, there are a few items that we could do that would really help the end user experience.
- Enable the VPN Menu Item at the top
- Enable the “Show Time Connected” setting so people can see that their VPN session is established
These two items are not available by a single checkbox within the JSS, however, we can find the proper plist files that have these settings and use mcxToProfile to create a custom plist.
Find the plists
There are actually two different plist files that we need to review; one for the Menu Items and the second for the VPN Menu Item settings 1. The first one for the VPN Menu item itself is found in ~/Library/Preferences/com.apple.systemuiserver.plist. In a freshly installed system the file is relatively blank except for two lines, but if we manually create a VPN connection in System Preferences => Network and enable the “Show VPN status in menu bar” we can see:
There is some extra stuff with the file, but we’ll clean it out a little later.
Next let’s take a look at ~/Preferences/com.apple.networkConnect.plist. Again, default in a freshly installed system this file does not exist. However, when we start toggling the VPN display options from the VPN Menu Item the file gets written with the needed key/pair attributes:
I Love it when a Plan Comes Together
First let’s get the mcxToProfile python script downloaded onto our machine. We can do this by opening Terminal and doing a
git clone command which pulls down the script plus the README.md file with examples.
With mcxToProfile we can identify multiple plist files that can be merged into one file to be imported into the JSS. This is clearly demonstrated in one of mcxToProfile examples available at https://github.com/timsutton/mcxToProfile#example-usage. Since my desire to display the VPN Menu Item and show the connection status are my personal suggestions to end users, I’m also applying the
--manage Once option so changes can be made by the user later. To generate our one plist file that we will import into the JSS, perform the following command:
This results in a nicely contained com.local.vpnSetup.mobileconfig file that has imported all of our settings from our two source plist files. However, remember when reviewing the com.apple.systemuiserver.plist there was some extra stuff that we needed to remove; “Display.menu” and “Clock.menu” shouldn’t be a part of our VPN configuration. Open the com.local.vpnSetup.mobileconfig file in your favorite text editor and remove the lines for these two menu items. You may also want to change the “PayloadDisplayName” value from “MCXToProfile: com.apple.networkConnect” to something more meaningful for your end users in case they review what has been installed in System Preferences => Profiles.2 3 The resulting file should look like this:
Once you create a new Configuration Profile in the JSS by uploading our new combined plist file, we can then deploy to our test environment as demonstrated in this short video:
- Casper Suite Series Evolution
I found these plist files by doing a little Google searching. However, Casper Admins could also use Composer with the “New and Modified Snapshot” method to discover what files are changing when you “check a box”. ↩
The keys “__NSEnableTSMDocumentWindowLevel” and “last-messagetrace-stamp” may be able to be removed along with the other menu items. I did not remove these keys during my testing and the VPN Menu item and it’s settings worked as desired. ↩
This step is not required for JSS Admins as you will have the chance to rename it once you import the plist into your new Configuration Policy. ↩
Comments are closed. If you have a question concerning the content of this page, please feel free to contact me.
I still think this is a better payload for the menu item, as it uses Apple’s specific functionality for managing Menu items:
Thanks Greg! Always appreciate getting comments from you.
I was surprised when changing Menu Items manually that com.apple.mcxMenuExtras was not being utilized as I remember that file from using Workgroup Manager. With that file not being created, I had concerns about future proofing this article. With that said, I may also not be backwards compatible with older OSs. People will have to test and verify, but my primary goal was to get Casper Admins acquainted with mcxToProfile for more options outside of the default API presentation that JAMF provides in the JSS.
I’m using the mcx_preferences to set language settings (input source, region etc.). It’s working but afterwards some user want to change their settings. Is it possible to remove the “management frequency” (I was using –manage Once). They can remove the configuration profile but after a relogin/restart it will be back. The second question is: How does the mcx_data_timestamp work? Is it the time range how long the user can change his settings and save them or will the profile be reverted when the date is passed without saving any new settings made by the user?
Thanks for sharing your information!
It has been several years since I have played with this and at this point would not feel like I could provide good advice as I’m out of the Mac Admin world. I would recommend looking into some of the other MacAdmin channels/pages to see if things have changed.
Sorry I’m not more helpful.
ich habe ein Problem mit diese