Staging Casper policies with an Opt-In Early Access group

Being able to test policies and updates on a smaller group of computers can be quite useful to identify potential problems before all hell breaks loose.
That’s why a lot of folks have adopted a Dev-Test-Release strategy when it comes to deployments.
While Dev is IT-internal only, our Test users are some (more or less) tech-savvy powerusers.
Here’s a way to allow users to Opt-In to (und out of) the testing stage of this process through Self Service.

All we need are two Self Service policies, two Smart Groups and an Extension Attribute.

To determine if a computer is opted in to our “Early Access Program”
(you need to sell that stuff!!), we’ll use an EA:
/Library/Application Support/MyCompany/ is where i store all my helper-tool cruft,
adapt the path as you wish but make sure the directory exists.
We’ll create the com.mycompany.earlyaccess.plist later on.

Next up are our Smart Groups which determine if a client is a member of our testgroup:
Smart Group NO
Smart Group YES
You can enable “Send email notification on membership change” if you wish to be notified when someone joins your testgroup.

And finally the two Self Service policies to modify our com.mycompany.earlyaccess.plist

The first one is to opt in, it is scoped to the “Early Access Opt-in NO” Smart Group:
Opt-In General
Opt-In Processes
Opt-In Self Service

Under “Files and Processes”, enter this in the “Execute Command” field:

defaults write "/Library/Application Support/MyCompany/com.mycompany.earlyaccess.plist" OptIn YES; jamf recon

I’ve added a recon to the command rather than checking the “Update Inventory” box in the policy because Casper delays the Inventory run until after the policy has finished.
In this case i want it to update immediately so the change is immediately reflected in the Self Service app.

The opt-out policy is pretty much the same, except our command is now

defaults write "/Library/Application Support/MyCompany/com.mycompany.earlyaccess.plist" OptIn NO; jamf recon

Scope it to the the “Early Access Opt-in YES” Smart Group.
Opt-Out GeneralOpt-Out Processes
Opt-Out Self Service

And that’s it!
Your users can now Opt-In or Out of your testgroup.

Self Service Icon Self Service Info
To scope a test-policy to your testgroup, simply add the Opt-In status as a criteria to the Smart Group that you scope your test-policy to:

Early Access Smart GroupAnother great use-case for this is if you have Reposado (or NetSUS) set up with Dev-, Test- and Release-Branches.

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload the CAPTCHA.