Doctor Who Serial 120 – Black Orchid

Part One

I don’t understand cricket whatsoever.

This is like the episode with James Corden when the Doctor goes to play soccer.

This is such a charming episode. “What would you do with a cock tail in a bath?”

Peter Davison knows the pain of tall people, he really had to crouch to see himself in that mirror.

Nyssa’s clone just so happens to have an identical dress ready to go.

Latoni’s voice has been terribly looped.

That was quite the faint.

I’m really enjoying this two parter. It’s a good pace, and a fun story. I wish classic Doctor Who had more two-parters.

Part Two

Well, this was a predictable turn of events.

I really like that the Doctor is proving his innocence in a murder by showing his TARDIS… He could be both an alien and a murderer. Oh, the cop is smart enough to say that, too.

As for the guy they keep tied up, they really should learn how to tie people up better.

I didn’t know you could make fires that only burn doors.

Aww, they couldn’t find a way out of this story without killing the “monster.”

Doctor Who Serial 119 – The Visitation

Part One

Wow, the opening music cue really sets the tons of this Doctor Who story.

Well, the butler was the first victim, so I guess he didn’t do it.

“We’re under attack!” In walks the gayest robot, ever. I love gay robots.

Adric’s version of fighting is to crawl on the ground and be something for the person to trip on.

It’s been a long time since a companion has fallen and twisted his ankle. I like that it was a boy this time.

Is that guy carrying styrofoam take out containers?

Part Two

That wall needs a sound effect like in Quantum Leap when Al walks through something.

The gay robot has a cloak now.

The alien costume looks like a bad theme park mascot.

Part Three

Why is Nyssa redecorating her room in the TARDIS… also, that’s a weird angle to put her bed at.

I love the thespian’s voice.

The aliens on the tv screen remind me of the alien scientists from Bill & Ted’s Bogus Journey.

Tegan should listen to the Doctor more.

Part Four

That alien is seriously out of breath.

I love how empty boxes really do a number on an their attacker.

Since Part Three, I watched Bill & Ted Face The Music and I’ve gotta say that their gay android is better than this one. I like Dennis Caleb McCoy. I hope this dead gay android goes to hell and meets up with Bill and Ted. OH MY GOD! Dennis Caleb McCoy was played by NoHo Hank from Barry!

That’s not how you use a gun, Tegan!

Doctor Who Serial 118 – Kinda

Part One

Adric is a misogynist asshole.

“The primitives,” “savages,” hooray for British colonialism.

I’m not sure if I’m watching Doctor Who or the stereotype British soldier on Monty Python’s Flying Circus.

Only 8 minutes in, and another instance of Adric’s misogyny.

Oh! Kinda is pronounced like the Yiddish1 kinder (children). It’s the name of the indigenous people from this planet, not this story being kinda like something.

The man in white face reminds me of Andy Kaufman.

Thank Roddenberry for Star Trek and the depiction of human future that wasn’t just about colonization. Yes, you could make arguments for the Federation being colonial.

HAHAHAHA! He even has a pith helmet.

Part Two

Who are these ladies with voices?

Oh my! The guy in the pith helmet turned into video.

Oh now there are more pith helmets.

Part Three

I like how the lady screamed before they even opened the box, and now the guy holding them prisoner is having a freakout because he is afraid of the dark.

Oh shit, they’re all turning VHS now.

The Kinda clown they hired is terrible. Either he’s never clowned professionally, or never done it for camera.

Oh shit! Everything’s going VHS!

Part Four

I found out Mango Language has a free Yiddish course. I did the first class. I learned how to say shalom aleichem. I already knew how to say that one. However, it’s making more likely to pronounce this episode like it’s Yiddish.

Adric keeps on being an asshole in every story. Oh, this is his last season. Good.

Mara is apparently a vampire.

Oh my! That is the most hilarious puppet!

  1. I guess you could say German, too. []

Doctor Who Serial 117 – Four To Doomsday

Part One

“That’s the trouble with women, mindless, impatient and bossy.” The problem with Adric saying that is not that Adric thinks that, which he does, but I think the writers of Doctor Who believe that.

Oh yay! They all get to wear the stupid helmets, not just the Doctor.

The team have split up, so I guess Adric and Nyssa are going to get captured.

The aliens are very interested in human fashion. I really hope that they’re just editors for an intergalactic Vogue.

Well, I was wrong. Only Nyssa got captured. Well, that was fast. Is that the real Nyssa? Okay, I don’t think this any more.

However, now I’m thoroughly confused. Doctor Who has long established that everyone speaks their native language and the TARDIS translates, but here Tegan is speaking to an Australian Aborigine in his native tongue, yet no one is hearing it as English. Yet, the Athenian is speaking English.

Enlightenment and Persuasion are wearing kick ass outfits. Tegan’s a great designer, but their choice to make them all emerald green is the greatest decision.

Part Two

“3 Billion people on this one ship? It’ll never get off the ground.” It’s a spaceship, why are you assuming it needs to get off the ground? Build it in space. Shuttles or transmats.

Interesting that these cultures have not changed at all over the past millennia. Except for the guy wearing the loin cloth and running shoes.

I thought this guy looked like Herb Tarlek from WKRP, my wife thinks he looks like Bill Hader. What do you think? Now that she said that, I see it. I really see it.

Part Three

They’re all robots. That actually explains a lot.

They keep saying there are 3 billion people on Earth. This episode aired in 1982 and Earth hit 4 billion in 1974. Weird to think that we’ve nearly double the population since then.

There is way too much hypnosis in Doctor Who.

There are a lot of helmets in this story.

At least by this point in BBC history, they’re using Asian people to play Asian people.

Part Four

Wow, the Doctor is racist against robots.

The wrestlers are wearing too much clothing. This is supposed to be greco-roman wrestling! Though, it’s very obvious that Enlightenment is getting enlightened by this display, if you get what I mean.

Someone at Doctor Who really like cricket. He uses a cricket ball bouncing off of a spaceship as propulsion back to the TARDIS.

The Doctor left the door to the TARDIS open in front of Monarch… why didn’t His Majesty go in?

It really sucks that the Doctor refuses to take Tegan home.

Missing Profiles Button in System Preferences

See my previous post for a full history on this.

In it, I had migrated from WorkspaceONE to Mosyle. One some devices I needed to clear the profiles database to be able to remove WS1 and enroll with Mosyle. When you do that the Profiles button in System Preferences goes away, forever.

Well, I did that one machine running macOS 10.14 and upgraded it to 10.15. Once upgraded, the profiles button returned! HOORAY!

Doctor Who Serial 116 – Castrovalva

I guess we’re really done with Tom Baker, and it’s time for Peter Davison.

Part One

Some military police arrive and stop our heroes from rescuing the Doctor. Tegan and Nyssa steal an ambulance, drive it 3 metres to the TARDIS and leave Adric behind. Then the Master shows up, laughs, disappears, Adric is behind the Master’s TARDIS, comes into the TARDIS, they leave, the Master’s TARDIS shows up, the Master laughs, the Master’s TARDIS disappears.

That was… something.

Davison has a terrible haircut, but I enjoy him tearing apart his scarf.

“I wonder boy, what would you do if you were me,” he asks with his hands in his suspenders like William Hartnell used grip his vest’s lapels. So far I’m enjoying some Davison.

And now he’s doing a mediocre Patrick Troughton.

The Master’s moustache twirling villainry is tiring. And why does the Doctor have a Cricket locker room in the TARDIS? That’s a stupid question, the Doctor has everything. Oh, Adric is captured by the Master.

I think you mean universe when you said galaxy, Nyssa. But hey, Big Bang, sounds good. Just make sure you don’t end up on the Big Bang Theory.

Part Two

Disembodied Master head!

I love that the Doctor doesn’t have a fancy futuristic wheelchair, nope he has one from the ’80s.

Well, there’s some Pertwee nod, “reverse the polarity of the neutron flow.”

Why are Adric and the Master on the set for the music video for “The Rest Of My Life?”

Also, the Master is holding an original series tricorder.

After watching so many regeneration stories, I’m really happy that they restarted the show in 2005 without a regeneration. As much as I love Paul McGann, I didn’t need to see him to know that Eccelston was the new Doctor.

This is the problem with classic Doctor Who, so much wasted time as characters wander around.

Part Three

Very kind of the Doctor to leave a trail of blood for Tegan and Nyssa to follow.

Those Castravulvaians look like the eggmen, goo goo g’joob.

Oh! Celery! But he ate it, didn’t decorate with it.

Part Four

I enjoy the M.C. Escher building.

I feel like this story does not have much story for it. It could have easily been half the length. Maybe a quarter. It’s just a regeneration story, but usually there’s some plot outside of the Doctor’s regeneration.

The 1980s video effects are so bad.

Olive Garden’s Alfredo Sauce

Once again, the internet sucks. People remove stuff that you rely on. So first off, thank you to archive.org for the wayback machine. Here’s Olive Garden’s Alfredo Sauce.

Seeing as recipes aren’t copy protected, I’m even going to post it here, as the wayback machine is a bit slow.

85g butter
1 TBSP Garlic
2 TBSP All Purpose Flour
1 1/2 cup milk
1 1/2 cup heavy cream
1/2 cup imported Parmesan cheese, grated
1/2 cup imported Romano cheese, grated
Salt and black pepper to taste
  1. Cook the butter and garlic in a saucepan on medium heat. Cook for 1 minute, stirring occasionally.
  2. stir in the rest the remaining ingredients and stir occasionally until the sauce begins to simmer. Remove from heat.

macOS 11 Compatibily Check

Yesterday, Apple announced macOS 11. I need to know what members of my computer fleet are compatible.

William Smith, aka talkingmoose, was kind enough to post the regex for what models are compatible with macOS 11. You can find that here. I tested Smith’s regex in BBEdit and it worked as expected.

The question was, how do I get an easy list of my fleet in our MDM, Mosyle?

I sent a Custom Command to my fleet, it’s here on GitHub. I told it to run that custom command on all computers and to store the results as “Big Sur.”

model=$(sysctl hw.model)
if echo $model | grep -Ei "(MacBookAir[6-9]|MacBookPro1[0-6]|MacPro[6-7]|MacBook(10|9|8)|Macmini[7-8]|MacPro[6-7]|iMacPro1),\d|iMac1(4,4|[5-9],\d)" ; then
  echo "macOS 11 Compatible"
else
  echo "macOS 11 Incompatible"
fi

So now I needed to use that data to create a list. I created a new Device Group and said that the Custom Command Big Sur was like incompatible. It immediately showed me my Library machines, which are iMac12,1 and running their max OS, macOS 10.14.

And here’s the result!

MDM Migration for macOS

Here’s my little tale about MDMs. It’s a history, plus how we migrated from one platform to another, why we did, and the ouches along the way.

AirWatch on iPads

At my first MacAdmins at PSU, I was speaking to a fellow macadmin about the pain of managing iPads using Configurator, Apple’s in-house product to manage iPads. He said he was in a similar pain and then moved to AirWatch, a Mobile Device Management system (MDM).

AirWatch, along with Apple’s Device Enrollment Program (DEP) got me where I needed. I could wirelessly provision my iPads and install applications from Apple’s Volume Purchasing Program (VPP), which is basically the App Store for organizations.

macOS in WorkspaceONE

We eventually put our macOS devices into AirWatch, which was now retitled WorkspaceONE, with a very simple workflow. Computer would boot, DEP would tell the computer it was owned by the school and was assigned to WorkspaceONE, WorkspaceONE would install a package with Munki and run a script to rename the computer based on a Google Sheet (that script can be found here).

WorkspaceONE would also be used to install configuration profiles on the Mac for things that an MDM was needed for and couldn’t be done via Munki such as Privacy Preferences Policy Control (PPPC) which requires User Approved MDM (UAMDM) to be deployed.

iPad *headdesk*

All was good, and then stuff didn’t work as well. Apps wouldn’t push out to the devices, configuration profiles wouldn’t push out to the iPads. The Macs were depending on WorkspaceONE for so little that it didn’t really matter. I was helping my friend move away from DeployStudio for his imaging needs and move to no-imaging, I suggested he use Mosyle for his Macs. I liked what I saw and I was tempted.

Since Mosyle was free for one platform (iOS/iPadOS or macOS), in August 2019, I decided to move all my iPads over to Mosyle. It would be easy. I annually wipe all my iPads. Move them over to in Apple School Manager from WorkspaceONE to Mosyle, set up configuration settings, move my VPP licences overs, wipe the iPads and watch them all enroll. It went amazingly.

macOS *headdesk*

We mostly used WorkspaceONE on the macs just to install Munki, but there were a few things it wasn’t doing properly. We setup a firmware password to prevent students from restarting computers into Recovery and changing teacher passwords. It was only successfully installed on 10% of devices. We sent out PPPC settings for Smart Notebook and it only installed for about 80% of fleet. We sent out a kext allowlist which only worked on about 50% of the fleet.

Whenever we called VMWare support, we usually got a support agent who didn’t know the macOS platform. It would take over 24 hours before VMWare would call us. They would always call outside of our normal business hours and any resolution to our problems was in spite of their support staff, not because of them.

My plan was to move all macOS devices over to Mosyle in September 2020. It would be much harder. I can’t just wipe teacher laptops. While there’s no policy in favour of this, many teachers use their school devices as their personal devices. In addition, many don’t store all their data in Google Drive as they’ve been instructed to do for many years. As such, I also pushed back our planned roll out of Catalina until September 2020. Normally I tried to allow teachers to install a new OS via Munki as soon as possible (after testing).

The Best Plans Are Destroyed By A Pandemic

With remote learning, and a closed building, we were managing computers via Zoom. This is fine if WorkspaceONE was pushing out the PPPC policies correctly to allow for the fleet. Our users are Standard users (not Admin, aka, non-privileged users), and thus they cannot authorize the PPPC settings for Accessibility to allow remote control of their computer via Zoom.

Then Apple rolled out a security update that caused major problems in macOS 10.14.6 and Zoom. We had crashes. Terrible crashes. Many were not able to teach.

To Mosyle and Beyond!

Mosyle were kind enough to offer us free usage until the end of June if I signed the full one year contract we were planning to buy next year (July 2020-July 2021). I jumped on that.

I was testing Mosyle for macOS in September, so back then I put all policies and configuration profiles from WorkspaceONE into Mosyle. I needed to do some updating of policies that changed since September. I did that, then I tested on a couple of machines. Then I wiped them, enrolled them in WorkspaceONE and tested the migration process to Mosyle. All seemed to go well.

Then I logged into the computer lab at the school. I tested the migration process on those computers, it went simply and quickly. Then I remembered that I don’t have Remote Desktop access to the computers at teacher homes. I’m running this through Zoom and a Standard User. So with a bit of a chat with Rich Trouton of Der Flounder fame, I confirmed that his software Privileges, if deployed through Munki, would give the user elevated privileges and allow me to walk them through the final process.

The Process

  1. First day, distribute to all devices via Munki a stub installer of Catalina
    I used the stub rather than the full installer because the download from Apple’s servers would be faster than the download from the school’s server
  2. Day before, add Privileges to the computer’s manifest in Munki as a Managed Install
  3. Switch computer from WorkspaceONE to Mosyle in Apple School Manager
  4. Check on WorkspaceONE if Privileges had been installed, if so, choose “Delete Device”
  5. Connect via Zoom, and have the user share their Desktop
  6. Request control, they would get a message asking either to open System Preferences to allow or Deny
  7. Ask the user to open System Preferences
  8. Ask the user to launch Privileges from the Applications folder and request privileges
  9. Have the user allow Accessibility for Zoom in the Privacy pane of System Preferences
  10. Take control and use Privileges to revoke privileges
  11. Put the Privileges app in the Managed Uninstalls for the device’s manifest in Munki
  12. Confirm the profiles are removed from the computer and it is unenrolled from WorkspaceONE
  13. Go to enroll.mosyle.com/?account=school and download the profile to enroll in Mosyle
  14. Assign the device in Mosyle to the appropriate user (teacher-only and admin-only profiles will be pushed depending on who it is assigned to)
  15. Run Managed Software Centre to remove Privileges
  16. Run the Catalina stub and tell the device to install 10.15.4

While in my testing everything worked like a charm, that didn’t translate to the real world.

What Went Wrong

For about 75% of the computers everything went perfectly. For 5% of the computer, it could take anywhere from an hour to 24 hours to delete the device from WorkspaceONE. Sometimes a reboot triggered it, sometimes a it just happened when it felt like it.

After days of trying to get help from VMWare, I was finally told by the MacAdmins slack that Delete Device is not the best way to do this. What I wanted was Enterprise Wipe, which removes all traces of the MDM (in theory). To me using the word “wipe” had some bad connotations and scared me away from using it.

I tested the Enterprise Wipe function on the computer lab iMacs and it worked like a charm. It could still take anywhere from 1 hour to 24 hours, but at least the support agent that was assigned to help me1 gave me a bit less grief if I used Enterprise Wipe rather than Delete Device.

There was still the remaining 20% of devices. There seemed to be a theme between those 20%. They all had enrolled in WorkspaceONE in September 2019 and never communicated with the system again.

I was installing the WorkspaceONE agent, on the computer to get it to reestablish communications with the MDM, and that worked, but once you told it to perform an enterprise wipe, it wouldn’t wipe.

Days would go by and no Enterprise Wipe.

I Guess We’re Disabling SIP? (Temporarily)

In the end I was kinda forced to do this. I didn’t want to, but I kinda had to.

  1. Connect with the user over the phone (there will be numerous restarts so Zoom won’t work)
  2. Diable SIP
    1. Have them restart the computer holding down Command-R
    2. Click Utilities
    3. Click Terminal
    4. Type csrutil disable and return2
    5. Restart the computer (Apple menu, restart)
  3. Connect via Zoom, keep the mic off as you’re still on the phone with them, screen share and request control
  4. Launch the terminal
  5. su <<Admin User Name here>>
  6. sudo rm -rf /var/db/ConfigurationProfiles/
  7. sudo rm /Library/Keychains/apsd.keychain
  8. sudo reboot
  9. Connect via Zoom, keep the mic off as you’re still on the phone with them, screen share and request control
  10. Go into System Preferences and make sure there are no profiles
  11. Enable SIP (has to be done before enrolling in Mosyle, because Mosyle will actually install the firmware password profile)
    1. Have them restart the computer holding down Command-R
    2. Click Utilities
    3. Click Terminal
    4. Type csrutil enable and return3
    5. Restart the computer (Apple menu, restart)
  12. Connect via Zoom, keep the mic off as you’re still on the phone with them, screen share and request control
  13. Enroll in Mosyle
    1. Go to enroll.mosyle.com/?account=school and download the profile to enroll in Mosyle
    2. Assign the device in Mosyle to the appropriate user (teacher-only and admin-only profiles will be pushed depending on who it is assigned to)

So, that was my tale. I hope it helps someone. I hope that someone at VMWare sees this and tries to figure out why their support is so bad.

  1. I don’t want to use any verbiage to imply that she did actually help me, because she didn’t. I don’t even want to suggest she tried to help me, because she didn’t. []
  2. Text this to them, so you don’t have to spell that out over the phone. []
  3. Text this to them, so you don’t have to spell that out over the phone. []

Doctor Who Serial 034 – The Macra Terror

Part One

Well the companions are being idiots and attacking the first person they see. Sure he has a terrible hairdo, but that’s no reason.

Why have we never had a bearded Doctor?

“No one ever left alive in nineteen hundred eighty five will ever doooooo!”

Part Two

Those uniforms are amazing. The collar is so high, and the shoulder pads are good enough to be Romulan. That was the problem with Star Trek: Picard. not enough shoulder pads.

There is no macra!!!!

Those electronics are fragile, if you knock on them, you shouldn’t pop out of the wall.

Oh, there is indeed a macra, what a crabby beasty.

The controller doesn’t seem to be in control.

Part Three

Why does the music sound like a Nintendo game?

Part Four

These cheerleaders for the government are so much fun. I love this.

The Highland Fling is one of the things that makes me think Jamie is the best companion the Doctor has ever had.