FileVault2 and Login Passwords Out of Sync

After a password change on 10.12 or 10.13 Macs that are FV2 enabled, the user’s FV2 password gets out-of-sync with their Keychain password.  On restart, the user can only log into the computer using their old password.  The problem exists regardless of whether or not the machine is bound or using Enterprise Connect.

You will need to delete and re-add the account but without actually removing any data.

·      Delete the user’s existing account (Loss of user data can occur if not followed exactly)

o   Open System Preferences/Users & Groups

o   Unlock preferences by clicking on the lock icon and entering the local admin password when prompted

o   Highlight the existing user’s account and click on the minus button below “Login Options”

o   Make sure you choose the option Don’t change the home folder

Once you have confirmed, click the Delete User button

Rename user folder and apply permissions

·      Go to /Users and find the home directory of the user you deleted. It will have (Deleted) after the folder name.

·      Rename the folder to first.last (use the IPG AD account name)

·      Open Terminal

·      Type the following command to change ownership of the user’s home directory: 

sudo chown –R first.last:staff  /Users/first.last

·      Example:  sudo chown –R mark.lewis:staff  /Users/tom.jones

·      Wait until you receive the prompt again. If you see some errors, it is okay.

·      Restart and log in as the local admin

·      Open Terminal and type, “fdesetup ad -usertoadd [user name]”

·      Enter the user’s password when prompted

·      Restart

·      Log in as the user

·      You should be prompted to create a new Secure Token: make sure you do this!  If you don’t, FV2 will fail on the user’s account.

Note: I found out the hard way that the Secure Token screen vanishes after about 30 seconds.  If this happens to you, you will have to associate the Secure Token manually via Terminal.  For full details, see this page:

https://derflounder.wordpress.com/2018/01/20/secure-token-and-filevault-on-apple-file-system/

-->

Mac Server: Unable to update Server

After updating the OS on a Mac Mini to 10.12.6 and downloading Server.app 5.3.1 we encountered an error:

It turns out that not all OS/Server.app versions allow direct updates; in some cases you must do a data migration.  Apple posts an upgrade matrix here.

The quick fix, if you don't mind configuring the server again, is to simply trash the Server.app from Applications and remove the /Library/Server folder.  Once this has been done, you can re-install Server.app and it will launch the configuration manager.

If you get the "unable to update server" error and you need to keep your settings then you are in for a bumpy ride.  You have no choice but to do a data migration between two devices.  The procedure is explained in the same link as above and entails building a new system, target booting, doing a data migration and then installing Server.app.  Honestly, Apple couldn't have made it any harder if they tried.

Egnyte Desktop Sync Errors With Keynote Files

Egnyte, and indeed most non-Apple file systems, have difficulty saving Keynote files.  The structure of Keynote files are atypical and as such Egnyte tends to see a directory structure rather than a single file.

Keynote has the option of saving files either as a "Single File" or a "Package" and for the purposes of file system compatibility, we recommend using a "Package."  From within Keynote go to File/Advanced/Change File Type:

Note: As a rule-of-thumb, we recommend that any Keynote file larger than 1GB be zipped before being saved to Egnyte.

By default, Keynote saves everything as a Single File.  If you go to Terminal and look at the file attributes you will notice that it actually appears as a directory rather than a single file:

This can cause problems with both Egnyte Desktop Sync and the Web UI.  The Web UI will  show Keynote data not as a single file but as a directory.  This makes the file unreadable from the Web UI and can cause syncing issues with Desktop Sync.  In Desktop Sync, you may see an error such as this:

Simply saving the file as a "Package" from within Keynote does not always resolve the problem, it may simply return a different error:

 

If you see this error you will need to change the permissions on the Keynote file in order for it to Sync.

• Save the Keynote file as a Package
• Open Terminal
• Navigate to the folder containing the Keynote file
• Type "chmod 744 [file name]
• Example:  chmod 744 myfile.key

 If you type "ls -la" you will see that the file permissions have been set to allow the file owner (you) to Read/Write/Execute:

Normal Mac file permissions are 644 and look like this:

However, for some reason, Keynote files sometimes need the extra "execute" permission in order to get Egnyte to sync them correctly.

After changing the permissions, trigger a sync and it should complete without errors.

 

Setting the default home page in Safari with Casper

The first step is to create a .plist file:

Save the file as plain text with a name "com.apple.Safari"

Log into the JSS

• Create a new Configuration Profile
• On "General" tab set the"Level" to "Computer Level"

• Select "Custom Settings" from the left-hand column
•  Upload the .plist file you created earlier
• Ensure the "Preference Domain" is "com.apple.Safari"

• Scope it to the computers you want the preference applied to

We have had good luck with this method.

ERR_QUIC_PROTOCOL_ERROR in Chrome

Chrome users were unable to get to the Google search page and were receiving a "This web page is not available" message.  The page itself displayed an error: ERR_QUIC_PROTOCOL_ERROR

Other web pages loaded fine and Google was accessible from other browsers.

It turns out that the problem was/is an experimental feature called Quick UDP Internet Connections (QUIC) that is designed to speed up secure browsing.   Turning off this feature enabled Google to load correctly in Chrome:

1. Open Chrome
2. Open a new tab
3. Type "chrome://flags/" in the address bar
4. Find "Experimental QUIC protocol"
5. Select "disable" from the drop-down menu
6. Restart Chrome

Microsoft Lync wants to use the OC_KeyContainer_

When opening Lync 2011 I was being presented with the following error:

The fix is to close Lync, navigate to ~/Library/Keychains and remove the OC_KeyContainer file.

Where is the Outlook 2016 for Mac Database?

Outlook 2016 for Mac stores its database in:

~/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/

If the application does a database rebuild, it will make a backup copy of the database and place it into the above folder.

Despite what Microsoft says, Office 2016 is just as prone to database problems as Outlook 2011.  The difference is that in Outlook 2016 there is no manual way to do a database backup- the app does them automatically. 

We have found that many users that have been moved from Office 2011 to 2016 are prompted to repair the Outlook database.  In some cases it happened so often that we had to move them back to Office 2011.

In fact, just as I was writing this my Outlook 2016 did a rebuild.  This was after a completely fresh install two days ago.  Thankfully I kept Outlook 2011; it is solid as a rock.

Excel 2016: Spell Check Causing Applicaiton Lock

Office 2016 has been very unstable.  Microsoft is tacitly admitting as much by releasing a steady stream of updates.

One of the persistent problems has been the spell check function in Excel.  Simply put, when you attempted to spell check a worksheet, the application would lock-up.  After a failed spell check, quitting the application normally was impossible; the only way to shut Excel down was to Force Quit it.

The spell check issue persisted despite the ongoing MS updates.  I myself experienced the problem on two separate MBPs and after no less than six removals and reinstalls.  Eventually I found a procedure that seems to have resolved the spell-check nightmare:

• Drag all MS Office 2016 documents to the trash
• Go to ~/Library/Group Containers and delete the following files
• *.office
• *.ms
• *.officeosfwebhost
• Empty trash
• Restart and re-install Office 2016 (applying all updates)

 After performing the above steps Excel spell check is working.  At least until the next MS update.

Mac OS: Desktop Icons Not Appearing

We encountered a 10.9.5 Mac where the user's desktop icons were not displaying.  They showed up in their Desktop folder but not on the desktop itself.  Attempting to add a file/folder resulted in it being placed into the Desktop folder but not on the desktop.

The simple fix was to go to View/Clean Up and then all the icons appeared.

Unable to SSH into a remote Mac: ssh_exchange_identification: Connection closed by remote host

When attempting to SSH into a remote Mac running 10.10.5, Terminal returned the following error:

ssh_exchange_identification; Connection closed by remote host

On the target machine we checked the Console log and found that during each SSH login attempt an error would appear in the log:

sshd: fatal: /var/empty must be owned by root and not group or world-writable.

We changed the ownership on the /var/empty folder:

sudo chown -R root:staff /var/empty

And we were then able to SSH to the remote computer.

Yosemite Macs - Progress Bar Stops at 50% During Boot

This is a well-known problem at it has been discussed elsewhere.  However, I wanted to put the fix on our KB to avoid having to search for it in the future.

Symptom:  Upon starting up, Yosemite Macs freeze and the progress bar stops at 50%.  This seems to be an issue with FileVault2 encrypted Macs that are bound to AD.

Fix:  If the Mac is encrypted you must first decrypt it.  If it is not encrypted, skip down to "Restart the problem computer in Single User Mode" below.

For encrypted Macs:

• Target boot the problem machine to a working Mac
• You will be prompted for the FileVault password in order to mount/access the problem machine.  Make sure you have this or you are pretty much screwed
• After the target computer mounts, open Disk Utility
• Select the target computers Macintosh HD
• Go to File/Turn Off Encryption (I have also seen a report that you can select "Unlock Macintosh HD")
• The HDD will start to decrypt.  This normally takes around 45 minutes depending on the size of the drive.  You must keep the power connected to the target computer or the decrypting process will pause
• There is no progress bar so the only way to know that the decryption has finished is to exit/launch Disk Utility and see if the disk still shows "Encrypted"

Note:  When I did this I only waited about 15 minutes and then unmounted the target drive.  This seemed OK and later I checked and the decrypting process had simply paused and continued.  The main thing is that you kick-off the decrypt or unlock the drive.

• After the drive has decrypted, eject it

 Restart in Single User Mode

• Restart the problem computer in Single User Mode (Command-S after the startup chimes) 
• At the command prompt type the following:

bash-3.2# mount -uw /
bash-3.2# /usr/bin/nano /etc/rc.server

The nano editor will open; enter the following lines: 

#!/bin/sh  

/bin/echo BootCacheKludge Beta 1.0 - Chris Hotte 2015 - No rights/blame reserved. /usr/sbin/BootCacheControl jettison

Click on ctrl-x and save the file with the default name.

Look at this thread on JAMFNation for the post by Chris Hotte that describes the fix.

After you have done the above, restart the Mac and it should boot normally. 

We created a .pkg that contains the script and we push it out to all our Yosemite Macs prior to encrypting them.

Setting Apple Software Update (SUS) to get updates from Apple

Use the following command to force your Mac to use Apple for software updates:

sudo defaults delete /Library/Preferences/com.apple.SoftwareUpdate CatalogURL

Here is the article from Apple Support:

https://support.apple.com/en-us/HT202030 

Remotely Disconnect A Session From the Command Line: Windows Server

1. Go to the Command prompt
2. Type "qwinsta" for a list of logged in users
3. Locate the "ID" for the account you want to disconnect
4. Type "rwinsta [ID number]"
5. Run "qwinsta" again to ensure that the user was disconnected

Preview and Adobe CC Applications Crashing on Launch: OS 10.10 Yosemite

We received a report from an office that 9 out of 10 brand-new MBPs with default Apple Yosemite builds were experiencing crashes when attempting to open documents in Preview.  Additionally, after installing Adobe CC 2014 none of the Creative Suite apps would launch.

Looking at the console log we found that Quicklook was crashing and re-spawning several times a second:

Expanding the line item we saw that Quicklook was unable to set its current working directory:

It turns out that a symlink to /private/tmp was missing.  We navigated to the root directory and recreated it using the following command:

sudo ln -fs /private/tmp /tmp

After a restart we saw that  Quickview crashes had stopped and we were able to open both Preview and Adobe CC applications.

Items can't be copied to a Mac because there is not enough free space, even when disk information shows plenty of free space

When attempting to copy 50GB of data onto a Mac Air that was reporting 210GB of space available the copy failed on an error "not enough free space available".

The root cause was Time Machine backups utilizing the local drive.  Even though the person never used Time Machine it was still enabled and apparently backing up to the local HDD.  Turning off Time Machine freed up the space and we were able to copy the data successfully.

Looking under  System Information/System Report/Storage we saw the backups taking up a massive amount of space; only 4kb was left available.

You can also disable Time Machine from the command line:

sudo tmutil disablelocal





 

Windows clients unable to connect to secure wi-fi

Our corporate network has a global wi-fi solution that uses Cisco access points, PEEP and AD authentication.  Users can walk into any office in the world and use their AD credentials to authenticate to wi-fi.  It's a nice little set up.

We also use Symantec Endpoint Protection (SEP) for anti-virus; this will become relevant in a moment.

Some users were reporting that their Windows 7 laptops were unable to connect to our corporate WiFi.  Clicking on "connect" did nothing but pop-up a window saying "Unable to connect."

After digging through the logs we found that the user's credentials were not being passed to the access points.  We attempted to set-up the connection manually and found that the Microsoft Protected EAP (PEEP) option was missing from the "Choose a network authentication method:"

It turns out that SEP was modifying Registry keys and telling Windows the default location of the SymRasMan.dll was C:\Program Files\ Symantec\Symantec Endpoint Protection \  instead of the correct %SystemRoot%\System32\rastls.dll.

The fix we used to resolve the issue is detailed in this MS KB article.

Note: the article specifically refers to this problem occurring on computers that have had SEP removed.  However, as far as we were aware the computers that had the issue never had SEP removed, only installed.

Ports required for Apple Push Notification Service

We encountered a problem where Macs managed by Casper were unable to communicate with the JSS for Mobile Device Management (MDM).  The solution was to allow the following ports access to Apple's 17.0.0.0/8 range (complete owned by Apple):

• TCP port 5223 (used by devices to communicate to the APNs servers) 
• TCP port 2195 (used to send notifications to the APNs)
• TCP port 2196 (used by the APNs feedback service)
• TCP Port 443 (used as a fallback on Wi-fi only, when devices are unable to communicate to APNs on port 5223)

Here is a link to Apple's support page on the topic.

After migrating a Mac user's profile, Dropbox fails to open: keeps asking for permissions

After migrating a user's profile and changing ownership on their home folder the user was unable to log into Dropbox after logging in.  The users received an error:

"Dropbox needs to change permissions for the Folder: ~/Users/.dropbox  Type in your password to allow this."

Typing in the user name and password did nothing.  The user was then presented with another window that said, "Couldn't start Dropbox.  This is usually because of a permissions error.  Storing your home folder on a network share can also cause an error."

The solution that worked for us was to remove the hidden "./dropbox" folder from the root of the user's home folder.  You can do this from terminal by typing:

sudo mv ~/.dropbox ~/.Trash

Or you can do it from the GUI if you turn off hidden folders.

I have also heard that you should delete the DropboxHelperTools folder although that wasn't required in our situation.

sudo mv ~/DropboxHelperTools ~/.Trash

Not a bug, a feature: This file came from another computer and might be blocked to help protect this computer

When attempting to open a new document sent form a different computer, Office 2010 and 2013 clients would display an error that says "This file came from another computer and might be blocked to help protect this computer."

Users who saw the above error were also receiving an error in Excel:

"Microsoft Excel cannot open or save any more documents because there is not enough availiable memory or disk space."

 This error would appear even if the user had loads of free memory and disk space.

At first the two errors didn't seem related but it turned out that the same fix resolved both issues.

We found that if we right-clicked on the file and went to Properties we were able to "Unblock" the file and remove the restriction.

However, this was not a practical solution if the user had a lot of files.  The more permanent fix is to turn off Protected View in the applications themselves.

• Open Word
• Go to File/Options/Trust Centre/Trust Centre Settings
• Remove the tick from the three boxes

•  Save the changes and restart Word
• You should now be able to open the document without blocking
• Follow the same procedure for Excel documents

Device Signature Error when attempting to install packages through Casper

When attempting to install printers (and other packages) some Macs (10.9.x) would report an error "Device Signature Error-A valid device signature is required to perform the action."  The helpful folks at JAMF Nation provided the following fix:

In ARD push out the following commands:

launchctl stop com.apple.apsd
rm /Library/Keychains/apsd.keychain
launchctl start com.apple.apsd

After the commands have been applied, Recon the machine again.  You should now be able to install packages.