“Advanced” MCX application and priority

In my last post focusing on Munki, DeployStudio and SUS services, I had a great question from Mike Boylan on how the advanced tab of MCX knows where to apply ManagedClient settings that are from a custom defined plist. Quickly, I realized this was going to be more than 140 characters to explain, so to the blog!

When applying ManagedClient settings both in the Basic and the Details tab, these settings are cached on the local machine in /Library/Managed Preferences. (TIP: You can delete this folder or specific plists if you need to quickly gain access to an item you have Managed Off. All you need is a local admin username / password) For sake of simplicity and saving typing, we are going to call MCXROOT /Library/Managed Preferences.

The computer domain of cached preferences appear in MCXROOT. This is where ManageClient settings at the computer or computer list level appear. A level deeper, the user domain of ManagedClient, will see settings at the user and group level appear in a folder corresponding to the uid of a user.

The screenshot above shows settings applicable to the computer (and computer group) as well as those at the user domain of rsaeks.

ManagedClient merges and applys settings in the following order: Group, Computer List, Computer, User.  If there are duplicate settings, such as a manage always set on both the computer and group level, group will take priority.  (Computer List over Group, Computer over Computer List, User over Computer)

When applying settings from custom plists, the assignment location within the directory, such as computer list or group, determines where in MCXROOT the cached preferences will go and ManagedClient on the client machine itself looks at these settings for determining setting application.

As always – feel free to fire away questions if needed for some extra clarification!