##osx-server

morn/evening all

hi folks

here’s a brain teaser for y'all

two different Macs, both imaged with the same exact image and settings, same AD binding profile. One has the ability to create managed mobile users on login. One does not.

what could _possibly_ cause that?!

hello creops

sohailmamdani On the problem Mac put opendirectoryd into debug mode. Then reproduce the error and see if the log holds any clues. https://support.apple.com/en-us/HT202242

Has anyone seen a Mac flagged with CNC Shadowserver Botnet recently?

sohailmamdani Confirm the problem Mac is really bound to AD. maybe id username to confirm

gmarnin: doing that now. Both Macs def bound to AD

sohailmamdani Both Mac talking to the same DC?

gmarnin: yep.

Think I might’ve isolated the issue, confirming.

yo mosen

yo Dials

holy moly this MDM CSR thing is confusing

I got it enabled for our iOS dev account

three support reps later and we finally come to the conclusion that only an admin or agent on the account can submit CSRs through it

bruienne more confusing than compiling pydhcplib into a Windows binary?

bruienne: so.. not such an easy process

gmarnin: hah maybe

mosen: seems mostly because it's not well documented

bruienne: if i set up an ent account under my name, would i be able to submit a CSR

mosen: yeah if you're the one opening it and administering it

should be able to do it all yourself

cool

just took all day back and forth with Apple to figure this out

bruienne: yeah seems like they havent really put any effort into making it an automated process

that's crazy

I guess it's secured further

bruienne: doesnt look good for me if i just apply for the access under a small irrelevant company :|

I'm not quite sure how to respond to this.. https://jamfnation.jamfsoftware.com/discussion....

Simmo lol

It's just.. wat.

Simmo Students have rights. End of discussion.

Simmo: FREEDOM!

'Murrica

Simmo: As always, the key is "whose devices"?

Simmo: If they're the school's property, the school has the right (and responsibility) to say what goes.

If the iPads in question belong to the actual student, then it's a different argument, but the school still has the right to control which traffic goes across the school's network.

I think it depends what kind of agreements the students have signed and agreed to.

That too.

The argument being made by the masked gentleperson is very pro-free speech, which is awesome. It is missing the overall context of what responsibilities are assumed by the school and the students though, which makes the argument very incomplete.

rtrouton: yeah theres some actions that the student could take which would leave the school liable

Exactly.

I'm having second thoughts about trying to code in pyobjc, the necessary modules is just down right ridiculous

bbl