-
タイトル
Macintosh energy saver desktop group policy settings not taking always setting -
説明
Even though the policy says always for energy saver settings, users can make changes on the client to this setting.
Policy Type: Macintosh Energy Saver Desktop Policy Settings
--------------------------------------------------------------------------
[ Manage Mode ] = Always
[ Profile ] = Custom
[ Put the computer to sleep after ] = 60
[ Put the display to sleep after ] = 15
[ Wake when modem detects a ring ] = False
[ Wake for Ethernet network administrator access ] = True
[ Restart automatically after a power failure ] = False
[ Put the hard disks to sleep when possible ] = True
[ Allow the power button to sleep the computer ] = True
--------------------------------------------------------------About the Always setting on the mac:
- Don’t allow the user to change the setting.
- Located under /Library/Managed Preferences and /Library/Managed Preferences/<username>
- Not all software checks this location -
原因
If the user is a local admin the always settings can be changed.
-
対策
Instead of using a local admin account you should setup the following:1. Modify the /Library/Preferences/Quest/VAS/vas.conf file and add the following section to the
QAS configuration using a text editor:
[vas_macos]
admin-users = johnd@example.com
For example, with the pico text editor, enter:
$ sudo pico /Library/Preferences/Quest/VAS/vas.conf
Note: If there is already a [vas_macos] section in the vas.conf file, just add or modify the
admin-users key following the existing section. You can also manage this option through Group
Policy.
For the value of the admin-users key, use a comma-separated list of Active Directory User Principal Names (UPN)
for QAS users with administrator rights. The Domain Users option also supports groups of users.
2. Specify the group in the form, Domain\groupname.
Note: You must specify the domain name as a DNS domain name NOT as a netbios domain. For
example, specify the group name as "EXAMPLE.COM\Administrators" NOT "EXAMPLE\Administrators".
Either step ensures that QAS processes the new configuration.
3. Verify that the configured users have administrator rights by checking their group memberships using the
following command line (the example is for a user called jdoe):
$ groups jdoe
If jdoe was correctly configured to have local administrator rights, you see the local admin, appserveradm, and
appserverusr groups listed in the output. The jdoe user is then able to use his user credentials for authorizing
administrative tasks started from the System Preferences application.
-
追加情報
Our product acts similarly to how an OSX Server would work in terms of configuring the machines. QAS applying the settings works exactly the same as OSX Server applying the settings. Therefore the settings should work the same as they do with local account on the system.