[Ebonfyre]

So, summer is here and it’s image building time. I wanted to continue this thread because it is still a pain in my side.

Based on the recommendations here I have attempted to use Local MCX at the computer/computer group level rather than at the user level in my earlier image. Following Greg’s excellent book I have successfully programmatically created the local_computer user, the mcxadmin user, changed to a different node, and added that node to the DS path. I have successfully altered the login window and the docks of each of my 3 standard users by assigning computer groups to the local_computer computer.

However, again Parental Controls is a thorn in my side. When I create a computer group in WGM dedicated to enabling Parental Controls, it only enables it on my admin account, not on any of my other accounts (which is exactly the opposite behavior I want actually). As I understand it, by doing it at the computer/computer group levels it should apply to all of my users, like it is for my dock.

Is this another incompatibility between Parental Controls and MCX?

[Ebonfyre]

Allister – Much of what I have accomplished is based on Gregs online content, though I was not aware of a full book (may be useful to seek out). My need for this level of control only happens once a year when I make the new image for the school year, so I’m not as familiar with the nuances that may be associated with it – hence this plea.

Greg – Thanks for your clarification, that is exactly what I was looking for.

[Ebonfyre]

My pkg is created by launching WGM on a newly imaged unit, making the changes I wish, and then adding the plists in /private/var/db/dslocal/nodes/Default/users for each of my users into a pkg using Composer (failed horribly using PackageMaker). This method seems to have worked perfectly for many months.

I’ve confirmed using “diff -y” on a before and after copy of a user plist that turning on Parental Controls in this case does completely destroy everything in the mcx_settings section of the plist.

This seems like a huge pitfall against this method of preference management. There are many innocent and legitimate reasons to want to turn Parental Controls on and off.

The user in question has the following preferences managed:
Dock: Dock Items: Once
Media Access: Other Media: Disc Images: Require Authentication: Always (I think this is what is causing the SystemUI Server bug)
Parental Controls: Content Filtering: Hide Profanity in Dictionary: Always
System Preferences: (uncheck show) Expose&Spaces, Sharing, Software Update, Startup Disk: Always

[Ebonfyre]

OK, lets simplify and break down my questions to increase the chance that someone has some insight.

Most importantly, should turning on or off Parental Controls wipe all of my custom local MCX records?

[Ebonfyre]

Well, I found one very helpful document which does a much better job describing the task of MCX alteration which I’m sure many of you have already read but decided I’d put here anyway:

http://images.apple.com/education/docs/Apple-ClientManagementWhitePaper.pdf

However, this focuses on using Workgroup Manager. I’m still hoping to find a command line reference.

[Ebonfyre]

Actually, I think I can help a little, as this was happening to me too using svn revision 261. That revision only looks for “com.apple.installd.plist” which I cannot find anywhere on 10.5.8. Later svn revisions look for multiple versions of that installd daemon, presumably to fix exactly this problem. The trick then becomes finding a svn that includes that change and which does not break other aspects of your 10.5 build.

Currently I am successfully using svn 318 on a 10.5.8 Intel Macbook to build my instaDMG image using a 10.5.6 install disc, the 10.5.8 updates, a package to place my 4 users’ home directories in place, and a first run launchd script to actually create those users because I can’t get the “createuser” package working reliably no matter what I do.

I love this project, but it can be frustrating 😉

[Ebonfyre]

What about all the supplemental apps that live in the less evident areas of the system, such as CoreServices? How can you possibly ensure that you have all those locations taken into consideration?

[Ebonfyre]

While it certainly “shouldn’t” be necessary, have you considered taking a snapshot of the install process and then re-creating a pkg of your own? Might be more efficient than digging around in someone else’s code.

[Ebonfyre]

So, there’s no arcane syntax that will get createhomedir to populate those directories during image creation?

[Ebonfyre]

Run Activity Monitor in the background and next time it crashes check to see if the DirectoryService process has spiked at 515 threads (if you can). We are experiencing similar problems if we launch Workgroup Manager and our server locks up every time with 515 threads displayed. Many people on the Apple Discussion boards are seeing the same thing.

[Author]

Posts