joshua-d-miller / macOSLAPS

Swift binary that will change a local administrator password to a random generated password. Similar behavior to LAPS for Windows
MIT License
384 stars 58 forks source link

plist file deleted #39

Closed eximo84 closed 4 years ago

eximo84 commented 5 years ago

Mac Version: 10.13.6 (High Sierra) MacOSLaps Version: 1.1.4

I created the plist file through my MDM, this has worked previously and i can confirm the contents of the file and its existance in the /Library/Preferences folder.

Upon running macOSLaps i get the generic error that the password cannot be changed, AD account is updated with the NOTAPASSWORD so i know that part works. However i have also noticed the plist file is deleted after i run macOSLaps for the first time on this mac.

joshua-d-miller commented 5 years ago

@eximo84 If you are using MDM to deploy the preferences then the preferences file would be stored in /Library/Managed Preferences. Can you verify that this is currently the case?

eximo84 commented 5 years ago

So I use a custom touch command and a bash script that creates the plist file. It is created in /Library/Preferences

I can confirm it exists once I excite the MDM to push the command. But once I run macoslaps the file disappears. I’ve deployed this to 6 other Macs without problems.

Unfortunately the user has the Mac now so I can’t retest at the moment.

joshua-d-miller commented 5 years ago

@eximo84 If you have a PLIST file in /Library/Managed Preferences, then a PLIST file in /Library/Preferences is not needed as the first one takes precedence. The only time you want to configure a PLIST file in /Library/Preferences is if you are NOT using an MDM.

eximo84 commented 4 years ago

Hi @joshua-d-miller - i am using a script to create the file directly into the /Library/Preferences folder.

joshua-d-miller commented 4 years ago

@eximo84 would you be able to post some of the script? I wonder if it is a malformed plist file.

joshua-d-miller commented 4 years ago

@eximo84,

How are you writing the preferences to the /Library/Preferences folder? Are you using defaults?

Thanks!

howlerwolf1313 commented 4 years ago

I've recently started having this issue too. I've got sentinel one running on the system but it sounds like something else could be causing it. I'm not using an MDM to manage, using the /Library/Preferences folder. I've been using the same BigFix workflow to deploy the configuration but lately when I run the binary to swap the admin password it deletes the plist file... Any help would be great! Thanks

I'm using version 1.1.16

howlerwolf1313 commented 4 years ago

I was having a similar issue to eximo. I was able to resolve it by generating the plist file via the defaults command like Josh mentioned previously. Previously I was writing the file via BigFix and it worked for a period of time but then started causing issues.

Example commands that add entries to the file - /Library/Preferences/edu.psu.macoslaps.plist: defaults write /Library/Preferences/edu.psu.macoslaps.plist LocalAdminAccount -string user_account defaults write /Library/Preferences/edu.psu.macoslaps.plist DaysTillExpiration -int 30 defaults write /Library/Preferences/edu.psu.macoslaps.plist PasswordLength -int 12 defaults write /Library/Preferences/edu.psu.macoslaps.plist RemoveKeyChain -bool TRUE defaults write /Library/Preferences/edu.psu.macoslaps.plist RemovePassChars -string '{}[]|'

joshua-d-miller commented 4 years ago

So I believe in order for this to work you need to use a binary plist which will need done either by using the defaults command or by running the plutil command to convert the plist to binary after creating it using another tool.