##osx-server

Heading out. Catch you all later.

l8er

GaToRAiD: AirWatchOut™?

GaToRAiD: ty for the help.

lol yeah i like that

layer8problem: no problem

macmule and allister: ty too, much appreciate being able to converse with people who actually use the product.

GaToRAiD: i might not have the choice either, but forewarned is forearmed and all that. at least i will know it’s “normal” for the product if/when it goes sideways (probably more when than if)

oh yes

GaToRAiD: course I'll post it.

macmule: just make sure you plug me ;)

GaToRAiD: sure will. I'll post it next to a finger of blame.

ouch

layer8problem: SEG proxies ALL EWS traffic. So OWA, Mac Outlook & RCP over HTTPS.

macmule: i’m not sure i want all my eggs in that basket, after all.

layer8problem: Exchange?

macmule: yes. 2007, moving to 2013 just before we bring in proper MDM

layer8problem: then look at the ACC & powershell.

"gneagle: so to pull out outlook and leave the rest of the suite with munki, what would you recommend?" rm -r /Applications/Microsoft Office 2011/Microsoft Outlook.app

layer8problem: http://blogs.technet.com/b/exchange/archive/201...

I wanted to try using removepackages.py, which unfortunately fails in a preinstall

layer8problem: on enrolment, a powershell command is run enabling the device to be used for ActiveSync for that user

removepackages _might_ work, but there will be a variable number of interlocking pkgs

i think macmule has that link hotkeyed

layer8problem: ACC goes down. Devices are fine, but new enrolments will not work. So not so bad. No interfering with OWA etc either, & a simple MSI

pkgutil --pkgs | grep -i outlook spits out 25 pkgs on my machine

macmule: ty for the link. i was looking at the ABQ stuff you had mentioned some time ago (i actually trolled this group’s archive looking for info before throwing myself at your mercy)

thowing yourself in is more fun

I'm just not able to debug the file not found error is what's getting to me

macmule: what if i use the proxy model, rather than the powershell model? www.air-watch.com/differentiators/enterprise-in...

layer8problem: that is what we are trying to not do

because it is flawed

GaToRAiD: i have been (justifiably) mocked in this room for not doing my research in the past…

GaToRAiD: got it. ty. upon closer inspection i wouldn’t be able to use proxy after all, as we’re dropping exchange 2007 soon.

layer8problem: that link is awesome. Still talking about EIS that has been defunct for like a year now. Now it's ACC.

anyone else hyped ? https://letsencrypt.org/

arrose: nice.

does Apple have any docs on how launchd prioritizes loading launch items

I'm assuming it's mostly async loading

arrose: that could save us £1,000's.

as long as everything releveant views it as a trusted CA, yes.

macmule: probably shouldn’t trust the vendor to keep their own site up to date… when will i learn?

bruienne: as far as i know its alphabetical

and you can do some relative prioritization as of 10.9 using the ProcessType key

but i may be wrong

swy for sure, but look who's on board already. It'd be crazy not to trust it

GaToRAiD: alpha... betical?

it's been a long day for me

GaToRAiD: that's what I was kinda seeing in my testing but I was having a hard time believing it

i can't spell right now

layer8problem: that's the sales stuff too. Documentation is much worse.

yeah, as long as they do, this is good news.

no bruienne thats it

Alphabetical... interesting choice. handy info though

bruienne: Apple's documentation says don't count on any particular ordering; there is no explicit dependency model

swy: arrose I wonder who the signing CA is. If that's one already trusted. BOOM

gneagle: yeah that is what I do remember: don't make any plans

but I was wondering if it has a load order before the don't make any plans party

or part

but party sounds more fun

gneagle: as i know this, but from testing i've seen the alphabetical being somewhat true

GaToRAiD: Well, sure, since it's reading files from a directory to create the jobs

I am ashamed to admit why this matters, but mostly because it's our security people's fault

But one should not count on com.me.a being _available_ for com.me.z at load time

macmule: much obliged for the help. you’ll probably be laughing at me in a few months while i whine about how undocumented and buggy the product is in production. it’s starting to feel like i’m tied to the train tracks…

layer8problem: Well, do the AirWatch Mobile Associate course ASAP. It'll help.

layer8problem: I did it like 18 months in. Didn't help much.

It actually matters for me too oddly enough. I'm stuck with kace k2000 for image deployment and if I want to do any firstboot scripts I have to have the script kill the loginwindow launchd to keep autologin from occuring and the k2000 from running scripts til the firstboot script is done.

macmule: will do. apart from stocking up on scotch, would anything else be good to do in advance?

layer8problem: nah, that course would've been really handy when we started. It'll help you build the instance etc correctly.

layer8problem: some type of headache meds

GaToRAiD: i prefer scotch… i use that as my headache med… unless it causes the headache, in which case i have entered a terrible loop.

now I'm having visions of some percentage of computers during deployment processing it in a different order and having the launchd's load out of order and the login taking place anyway... ohgodwhy

macmule: where's the stupid quickadd package in the jss(9)?

Allister: generate it with the recon app

Allister: ^^

meh

how does that make any sense

historical reasons

There is another on the JSS, but that's to be used when enrolling through the JSS enrolment page.

Allister: What are you trying to accomplish?

macmule Allister: the one you get from the enroll page is subtly different, I have run into trouble with that

scriptingosx: Yep. Don't deploy that one.

it's just for inventory, /enroll it is

Allister: you can use recon to scan an IP range & enrol devices that aren't in the JSS.

macmule: as long as SSH is enabled and you have the correct credentials

franton: yea.. Was gonna say that. :P

Do you want to make your own Quickadd?

Do you want to build a snowman?

or, as I saw last night, a methlab

rather clever parody

gneagle: honestly. That's how I read it.

bruienne: oddly enough, I've never wanted to fool with phosphorus, petrol, matches and lots of sudafed

franton: wuss.

gneagle not to be confused with "Let's build a snowman!" https://www.youtube.com/watch?v=JQ1ZOFNBL68

bruienne: haha.

besides, Jessie figured out a way to do it without sudafed

pshaw.

franton: you'd need a goatee too.

bruienne: there's plenty of ways to do it. none of them nice.

macmule: my chemistry days are long behind me

frogor: hey the bot thing. Don't get it. So yea do it.

I found something for macgirl84 ... if she's around?

franton: There's always the Twitters

foigus: now where's the fun in that? ;)

franton: present

macgirl84: http://www.nerdsnook.com/apparel/13-9-layer-osi... :D

franton: what happened to the normal layer 8? =(