macOS - Intune executing addAppstoDock.sh shell script as _mbsetupuser instead of logged in user

[jkerekes99]

After updating to macOS 14.4.1 Intune now runs the addAppstoDock.sh as the Setup Assistant user ( _mbsetupuser ).

This is problematic because the user doesn't get the dock changes. The script needs to be run as the current user who is logged in.

[wewenttothemoon]

137 - I'm following this thread, because I think my issue may be related to a similar issue.

How can I check within the macOS device, what user Intune is using to run the shell scripts for signed on users?

[jkerekes99]

How can I check within the macOS device, what user Intune is using to run the shell scripts for signed on users?

You need to write out a log file in the script that you are running, in the log file write out the current user. Then review the log after Intune has executed the script, it will tell you what user was used to run the script.

[wewenttothemoon]

How can I check within the macOS device, what user Intune is using to run the shell scripts for signed on users?

You need to write out a log file in the script that you are running, in the log file write out the current user. Then review the log after Intune has executed the script, it will tell you what user was used to run the script.

Got it. So, I added echo "Current user: $(whoami)" to the shell script and it returns back the correctly logged on user. However, when the script calls pluginkit it fails with "match: connection invalid". I have raised a ticket with MS about this.

[jkerekes99]

Closing as addAppstoDock script has been updated to run as root using dockutil.

[s-crypt]

The dock is not updating for me following the directions and the new script. Dockutil is installed. The apps were not cleared from the dock and the dock is still in its default state. It looks like it is still running the command as _mbsetupuser.

addAppstoDock.log

``` The script is running under the user: root The current desktop user is: _mbsetupuser The current desktop users home directory is: /var/setup Mon Jun 17 14:26:28 PDT 2024 | + Dock not running, waiting [22] seconds Mon Jun 17 14:26:50 PDT 2024 | + Dock not running, waiting [19] seconds Mon Jun 17 14:27:12 PDT 2024 | + Dock not running, waiting [34] seconds Mon Jun 17 14:27:48 PDT 2024 | + Dock not running, waiting [26] seconds Mon Jun 17 14:29:20 PDT 2024 | + Dock not running, waiting [15] seconds Mon Jun 17 14:29:35 PDT 2024 | Dock is here, lets carry on ############################################################## # Mon Jun 17 14:29:35 PDT 2024 | Starting install of Dock ############################################################ Mon Jun 17 14:29:35 PDT 2024 | Looking for required applications... Mon Jun 17 14:29:35 PDT 2024 | /System/Applications/Launchpad.app is installed Mon Jun 17 14:29:35 PDT 2024 | [8] application missing Mon Jun 17 14:29:36 PDT 2024 | Waiting for 10 seconds ... Mon Jun 17 14:49:28 PDT 2024 | /System/Applications/Launchpad.app is installed Mon Jun 17 14:49:28 PDT 2024 | /Applications/Google Chrome.app is installed Mon Jun 17 14:49:28 PDT 2024 | [7] application missing Mon Jun 17 14:49:28 PDT 2024 | Waiting for 10 seconds Mon Jun 17 14:49:38 PDT 2024 | /System/Applications/Launchpad.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Google Chrome.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft Outlook.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft Teams.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft Word.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft Excel.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft PowerPoint.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/Microsoft OneNote.app is installed Mon Jun 17 14:49:38 PDT 2024 | /Applications/OneDrive.app is installed Mon Jun 17 14:49:38 PDT 2024 | [0] application missing Mon Jun 17 14:49:38 PDT 2024 | All apps found, lets prep the dock Mon Jun 17 14:49:38 PDT 2024 | Clearing Dock Items Mon Jun 17 14:49:39 PDT 2024 | Adding Apps to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/System/Applications/Launchpad.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Google Chrome.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft Outlook.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft Teams.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft Word.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft Excel.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft PowerPoint.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/Microsoft OneNote.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | + Adding [/Applications/OneDrive.app] to Dock Mon Jun 17 14:49:39 PDT 2024 | Adding Downloads Stack Mon Jun 17 14:49:39 PDT 2024 | Adding Documents Stack Mon Jun 17 14:49:39 PDT 2024 | Setting Magnification to false sudo: unable to change directory to /var/setup: No such file or directory Mon Jun 17 14:49:39 PDT 2024 | Setting Dim Hidden Apps to true sudo: unable to change directory to /var/setup: No such file or directory Mon Jun 17 14:49:39 PDT 2024 | Setting Auto Hide Dock to false sudo: unable to change directory to /var/setup: No such file or directory Mon Jun 17 14:49:39 PDT 2024 | Setting Show Recent Items to false sudo: unable to change directory to /var/setup: No such file or directory Mon Jun 17 14:49:39 PDT 2024 | Setting Enable Minimise Icons into Dock Icons to true sudo: unable to change directory to /var/setup: No such file or directory Mon Jun 17 14:49:39 PDT 2024 | Restarting Dock Mon Jun 17 14:49:39 PDT 2024 | Writng completion lock touch: /var/setup/Library/Logs/prepareDock: No such file or directory ```

[jkerekes99]

It looks like it is still running the command as _mbsetupuser.

Have you set the script to NOT run as the user in Intune?

[s-crypt]

Yes, I followed the instructions and Run as signed in user is no. The test device I am using is an Intel Mac on MacOS 14.5.

[theneiljohnson]

Can you re-check please? The running user should root if it’s set to run as root.

From: s-crypt @.> Date: Tuesday, 18 June 2024 at 17:39 To: microsoft/shell-intune-samples @.> Cc: Subscribed @.***> Subject: Re: [microsoft/shell-intune-samples] macOS - Intune executing addAppstoDock.sh shell script as _mbsetupuser instead of logged in user (Issue #125)

Yes, I followed the instructions and Run as signed in user is no

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/shell-intune-samples/issues/125#issuecomment-2176532007 or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGOC2JMJMET3U34KO6LMPPDZIBPC7BFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVEZDONRVGE4TQNRQQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSGIZTSMZRGM4TSNFHORZGSZ3HMVZKMY3SMVQXIZI. You are receiving this email because you are subscribed to this thread.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

[s-crypt]

From the logs, it is running as root, but the desktop user it is targeting is _mbsetupuser. I tried again on a fresh device and same error occurs.

There is also the seemingly random issue with docutil failing install as an unmanaged pkg. Sometimes it will install, sometimes it will fail. I think waiting for dockutil in the loop for waiting for apps might be useful to prevent premature exits of the script.

EDIT: Well it worked... only after setup assistant randomly crashed to desktop. Not sure how I can replicate that. The logged in user and home folder were the same as the error.

EDIT 2: Cannot replicate. The script fails with the same error as before.

[jkerekes99]

@s-crypt I haven't personally had time to test the new script yet (still using Outset to run the original script), however regarding your random issue with docutil pkg, as far as I know Intune will only mark a successful installation if it can find the app bundle ID present under /Applications .

If the binary is stored anywhere else, Intune won't find it and it will show as failed (even if the app is installed successfully).

Sometimes will initially show it as successful (before it has checked to see if the app bundle ID is located in /Applications ) but later after further check ins, it will show it as failed.

[s-crypt]

In this case, dockutil is actually randomly installing or failing. I am verifying by running dockutil -h on the device, though thanks for the information! So far I am seeing more successes than failures.

[theneiljohnson]

I think I can see what’s happening. The script is first launched under setup assistant and we’re detecting the current console user as _mbsetupuser and then not updating that after the desktop appears.

Should be an easy fix, i’ll try and update later today.

From: s-crypt @.> Date: Wednesday, 19 June 2024 at 01:23 To: microsoft/shell-intune-samples @.> Cc: Subscribed @.>, Comment @.> Subject: Re: [microsoft/shell-intune-samples] macOS - Intune executing addAppstoDock.sh shell script as _mbsetupuser instead of logged in user (Issue #125)

In this case, dockutil is actually randomly installing or failing. I am verifying by running dockutil -h on the device, though thanks for the information! So far I am seeing more successes than failures.

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/shell-intune-samples/issues/125#issuecomment-2177294698 or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGOC2JNNVBIXPLTJSCVR2XLZIDFQTBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVEZDONRVGE4TQNRQQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSGIZTSMZRGM4TSNFHORZGSZ3HMVZKMY3SMVQXIZI. You are receiving this email because you commented on the thread.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

[s-crypt]

Just an additional tidbit of info if its of any use, I am able to confirm the error on both Intel and ARM macs.

[s-crypt]

@theneiljohnson have you had a chance to work on this? I have tried my own user-switching methods and have not been successful so far, probably because my bash scripting is... not great.

Something I Tried. Runs after "running as" info print, before dock check.

```sh # Find a logged-in non-system user while :; do # Get the list of logged-in users excluding those starting with an underscore loggedInUser=$(users | tr ' ' '\n' | grep -v "^_" | uniq) # If a user exists and is not _mbsetupuser if [[ "$loggedInUser" && "$loggedInUser" != "_mbsetupuser" ]]; then echo $(loggedInUser) "--------------------------------" desktopUser="$loggedInUser" break # Exit the loop if there is a non-system user fi # Sleep for a short period before checking again echo "$(date) | Waiting for a user to log in..." sleep 10 done # Lets find out who we're running as now... echo "Now running as" $(whoami) scriptRunningAs=$(whoami) # Determine the new user's home directory desktopUserHomeDirectory=$(dscl . -read "/users/$desktopUser" NFSHomeDirectory | cut -d " " -f 2) plist="${desktopUserHomeDirectory}/Library/Preferences/com.apple.dock.plist" # Now switch to the new user as the active user echo "The script is running under the user: $scriptRunningAs" echo "The current desktop user is: $desktopUser" echo "The current desktop users home directory is: $desktopUserHomeDirectory" # Check if an script has already run before if [[ -f "$desktopUserHomeDirectory/Library/Logs/prepareDock" ]]; then echo "$(date) | Script has already run, nothing to do" exit 0 fi ```

[theneiljohnson]

I keep having a look. Right now I have a script that I think is doing all of the right things but I am getting a trap error when executing dockutil via our agent.

From: s-crypt @.> Date: Friday, 28 June 2024 at 23:21 To: microsoft/shell-intune-samples @.> Cc: Subscribed @.>, Mention @.>, Comment @.***> Subject: Re: [microsoft/shell-intune-samples] macOS - Intune executing addAppstoDock.sh shell script as _mbsetupuser instead of logged in user (Issue #125)

@theneiljohnsonhttps://github.com/theneiljohnson have you had a chance to work on this? I have tried my own user-switching methods and have not been successful so far, probably because my bash scripting is... not great.

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/shell-intune-samples/issues/125#issuecomment-2197726935 or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGOC2JI7Y7JZHL5YX2UGJWDZJXOVTBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVEZDONRVGE4TQNRQQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSGIZTSMZRGM4TSNFHORZGSZ3HMVZKMY3SMVQXIZI. You are receiving this email because you were mentioned.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

[s-crypt]

Thanks for the update! I have a script that works when run locally as root, so it sounds like this may be an issue or quirk with how the intune agent executes scripts.

I can open a PR for this if you think it is appropriate. Link to modified script

[edtrax]

Any update on this? I continue to see the script being executed as _mbsetupuser.