KACE Systems Management Appliance 12.1 Common Documents - KACE Service Desk Administrator Guide

You can add Mac system profiles to the appliance using the Administrator Console. System profiles contain configuration settings that apply to devices, such as passcode requirements. System profiles that have been added to the appliance can be deployed to Agent-managed Mac OS X devices. For the list of supported Mac OS X versions, see the Technical Specifications available on the product documentation page: https://support.quest.com/kace-systems-management-appliance/technical-documents.

You have established policies for accessing apps and setting passcodes.

NOTE: You can edit the payloads of system profiles you have configured in the Administrator Console. However, you cannot view or edit the payloads of profiles that have been uploaded to the Administrator Console.

Go to the Mac Profile Detail page:

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Scripting, then click Mac Profiles.

Do one of the following:

▪

Click the name of a profile.

▪

Click Choose Action > New System Profile.

In the General Options section, provide the following information:

Option

Description

Profile Name

The name to be displayed on the Mac Profiles list. This name does not need to be unique, but it should be descriptive enough for you to identify the profile in a list.

NOTE: You can change the name of a profile any time. However, if you change the name of a profile after it has been installed on a device, the profile name is not updated on the device. The profile continues to be identified by the name it had when it was installed

Description

Additional information about the profile, such as its configuration settings or its intended use.

User ability to remove profile

Whether users can remove the profile from their devices. Options include:

•

Never: Users are not allowed to remove the profile.

•

Always: Users are allowed to remove the profile any time without entering a password.

•

With Password: Users are allowed to remove the profile provided that they enter the password associated with the profile.

Automatically remove profile

Whether the profile will be removed automatically after a specified amount of time. This is useful when you are configuring devices that need to have different profiles after a specific date, such as the end of a school semester. Options include:

•

Never: The profile is not scheduled to be removed automatically.

•

On Date: The profile is scheduled to be removed automatically on the specified date. Dates must be specified in mm/dd/yyyy format.

•

After: The profile is scheduled to be removed after the specified amount of time has passed. Time can be specified in days or hours.

In the Payloads section, add or edit Gatekeeper configuration information.

Option

Description

Allow Apps Downloaded From

Whether users are allowed to download apps from:

•

Mac App Store: Users can download apps only from the Mac App Store.

•

Mac App Store and Identified Developers: Users can download apps from the Mac App Store and from developers who have digitally signed their apps with a unique Developer ID from Apple.

•

Anywhere: Users can download apps from anywhere without restriction.

Don't allow user to override Gatekeeper setting

Whether users are allowed to modify the app download settings.

Add or edit Passcode configuration information.

NOTE: In this section, the term passcode is synonymous with the term password.

Option	Description
Allow simple value	Allow users to select passcodes with character sequences that are repeating, ascending, and descending.
Require alphanumeric value	Require users to select passcodes that contain at least one letter and one number.
Minimum passcode length	The smallest number of characters allowed in passcodes.
Minimum number of complex characters	The smallest number non-alphanumeric characters, such as *or ! allowed in passcodes.
Maximum number of failed attempts	The number of times users can enter incorrect passcodes to unlock devices before being locked out of their accounts.
Maximum grace period for device lock	When system settings specify that devices should be locked after a period of inactivity, this setting provides a window of time during which users can unlock their devices without entering their passcodes. After the grace period expires, users must enter their passcodes to unlock devices.
Maximum passcode age in days	The number of days after which passcodes must be changed.
Passcode history	The number of passcodes that must be unique before a passcode can be reused.
Delay after failed login attempts in minutes	The number of minutes that must pass before users can attempt to log in after reaching the maximum number of failed login attempts.

In the Deploy section, select the target devices for the profile:

Option

Description

All Devices

Distribute the profile to all KACE Agent-managed devices running a supported version of Mac OS X (version 10.8, 10.9, or 10.10). If the Organization component is enabled on your appliance, this includes all supported Mac devices in the selected organization.

Labels

Distribute the profile only to the devices in the labels that you select. Limiting the distribution to labels, especially Smart Labels, helps to ensure that profiles are applied appropriately.

To use this option, you must already have created labels or Smart Labels. See Adding Smart Labels for devices.

Devices

Distribute the profile to the supported Mac OS X devices that you select (version 10.8, 10.9, or 10.10). To search for devices, begin typing in the field.

Operating Systems

The operating systems on which the application runs. Applications are deployed only to devices with the selected operating systems.

Click Manage Operating Systems.

In the Operating Systems dialog box that appears, select the OS versions in the navigation tree, as applicable.

You have an option to select OS versions by their family, product, architecture, or build version. You can choose a specific build versions, or a parent node, as needed. Selecting a parent node in the tree automatically selects the associated child nodes. This behavior allows you to select any future OS versions, as devices are added or upgraded in your managed environment. For example, to select all build current and future versions associated with a Mac 10.11 El Capitan x86 architecture, under Mac > 10.11 El Capitan, select x86.

Remove All

Remove all devices from the Devices list in this section.

In the Schedule section, select the options for distributing the profile to target devices:

Option

Description

None

Do not distribute the profile on a schedule. Profiles that have their schedules set to None have a status of Disabled on the Mac Profiles list. However, profiles whose schedule is set to None can still be deployed if you select Run Now at the bottom of the page.

Every n minutes/hours

Run at a specified interval.

Every day/specific day at HH:MM

Run daily at a specified time, or run on a designated day of the week at a specified time.

Run on the nth of every month/specific month at HH:MM

Run on the same day every month, or a specific month, at the specified time.

Custom

Run according to a custom schedule.

Use standard 5-field cron format (extended cron format is not supported):

Use the following when specifying values:

•

Spaces ( ): Separate each field with a space.

•

Asterisks (*): Include the entire range of values in a field with an asterisk. For example, an asterisk in the hour field indicates every hour.

•

Commas (,): Separate multiple values in a field with a comma. For example, 0,6 in the day of the week field indicates Sunday and Saturday.

•

Hyphens (-): Indicate a range of values in a field with a hyphen. For example, 1-5 in the day of the week field is equivalent to 1,2,3,4,5, which indicates Monday through Friday.

•

Slashes (/): Specify the intervals at which to repeat an action with a slash. For example, */3 in the hour field is equivalent to 0,3,6,9,12,15,18,21. The asterisk (*) specifies every hour, but /3 restricts this to hours divisible by 3.

Examples:

•

15 * * * * Run 15 minutes after every hour every day

•

0 22 * * * Run at 22:00 every day

•

0 0 1 1,6 * Run at 00:00 on January 1 and June 1

•

30 8,12 * * 1-5 Run weekdays at 08:30 and 12:30

•

0 2 */2 * * Run every other day at 02:00

At the bottom of the page, select one of the following actions:

Option	Description
Save	Save the profile and return to the Mac Profiles list.
Run Now	On target devices that have an active Agent connection to the appliance, install the profile now according to the selected deployment options. See Using the Run and Run Now commands.
Duplicate	Create a copy of the profile with Copy of prepended to the profile name. This option is not available for new profiles that have not yet been saved. See Add Mac profiles using existing profiles as templates.
Remove	Create a profile that can be used to remove the profile from target devices. This option is not available for new profiles that have not yet been saved. See Remove Mac profiles from managed devices.
Delete	Remove the profile from the appliance. This does not remove the profile from devices on which it is installed, and this option is not available for new profiles that have not yet been saved. See Delete Mac profiles from the appliance.
Cancel	Discard changes and return to the Mac Profiles list.

Add Mac profiles using existing profiles as templates

You can add Mac profiles by duplicating existing profiles. This is useful if you want to install an existing profile on different sets of devices, or schedule profile installations to occur at different times. You can duplicate profiles, and change the target devices or schedules as needed.

You have added a user or system profile to the appliance.

Profiles that have been imported cannot be duplicated.

Go to the Mac Profiles page:

On the left navigation bar, click Scripting, then click Mac Profiles.

Click the name of a profile to display the Mac Profile Detail page.

At the bottom of the page, click Duplicate.

The profile is duplicated, and it appears on the Mac Profile list with Copy of prepended to the profile name. Duplicated profiles have the same properties and identification numbers as the original profiles, but their schedules are automatically set to None to prevent duplicated actions from being performed on the same sets of devices

Upload Mac profiles to the appliance

The appliance enables you to upload MOBILECONFIG files that contain the configuration settings required to create Mac profiles.

You have obtained a file that contains the configuration settings, or payloads, required for the profile, and that file uses the filename extension MOBILECONFIG. For example, mail.mobileconfig. For information about creating Mac profiles and downloading them from the Mac OS X Server, go to http://help.apple.com/profilemanager/mac/4.0.

NOTE: You cannot view or edit the payloads of profiles that have been uploaded to the Administrator Console. However, you can modify the payloads in the MOBILECONFIG file outside the Administrator Console, then upload the edited file as a new profile.

Go to the Mac Profiles list page: