macOS: Unable to Restrict Access to CC Desktop Application App Panel

[MattDB]

I'm trying to restrict access to the App Panel in the CC Desktop App on student lab machines, but have been unable to do so recently. The target computers are running macOS 13.6. As a test, I've created a new managed package in the Admin Console that includes just the CC Desktop App, configured with the options to hide access to the app panel. However, after the installation, the app panel remains freely accessible. I've verified that the ServiceConfig.xml file is getting installed along with the app and that it does contain the correct key values needed for restricting the App Panel. I've been able to recreate this issue on newly restored or imaged computers with nothing but just the Adobe CC Desktop app installed. Everything seems to work as expected when installing managaged packages created the same way for our Windows devices. It's as if the current version of the Adobe CC Desktop app for macOS is just ignoring the ServiceConfig.xml file altogether. Has anyone else experienced this issue?

Steps to reproduce:

Hardware: Apple Silicon based Mac running clean install of macOS 13.6

1. Create a new macOS (Universal) managed package in the Admin Console

2. Add the Creative Cloud Destkop Application (6.0.0) to the package

3. Deselect "Enable Self-Service Install" under options

4. Create package. 

5. Install package on the target computer.

6. Launch Adobe Creative Cloud Destkop Application and verify whether App Panel is restrcited.

[rpandita]

Hi MattDB

Can you please share the service config file here?

Regards

Rohit Pandita

[rstaselbeta]

I'm seeing exact same behavior. We have lab users (which are on SDL) installing 2024 apps and breaking all our attempts to keep labs standardized across campus. 

Here's our ServiceConfig.xml

<config><panel><name>AppsPanel</name><visible>false</visible></panel><panel><name>FilesPanel</name><masked>true</masked></panel><panel><name>MarketPanel</name><masked>true</masked></panel><feature><name>SelfServeInstalls</name><enabled>false</enabled></feature><feature><name>BrowserBasedAuthentication</name><enabled>false</enabled></feature><feature><name>SelfServePluginsInstall</name><enabled>false</enabled></feature><feature><name>AppsAutoUpdate</name><enabled>false</enabled></feature><feature><name>AdobeFallbackForAUSST</name><enabled>false</enabled></feature><feature><name>AppsCategories</name><enabled>false</enabled><data><categories><category>beta-apps</category></categories></data></feature></config>

[rstaselbeta]

does not appear to be hardware or OS linked. I just tested on an Intel mac running 12.6.9. Appears that CC 6.0.0 is just ignoring these settings. =/ Windows CC app seems to behave as expected and disables self service install. 

Tangential: how about the CC app just used a standard plist so we could manage these settings via a config profile instead of this pseudo XML... Why does Adobe make this so obnoxious? we end up having to write custom checks to see what these values are set to instead of just using built in OS level functionality to force it. Same with windows side... heaven forbid it was just registry settings that could be set via GPO, Intune, etc... instead we have the same crap. 

[rstaselbeta]

@rpandita please see my response. Can we please get a status update on this? This is causing significant issues in our labs from users installing 2024 apps and filling lab machine HD's and version control issues across labs.

[rpandita]

Hi rstaselbeta

The Config file looks about right.
Can you please try the steps mentioned below and let us know if that resolves the issue?

1. Uninstall the CCD application using CCD uninstaller- https://helpx.adobe.com/in/creative-cloud/help/uninstall-creative-cloud-desktop-app.html

Now recreate the package, however with 1 change.

1. Create a new macOS (Silicon) managed package in the Admin Console

2. Add the Creative Cloud Desktop Application (6.0.0) to the package

3. Deselect "Enable Self-Service Install" under options and make sure all other options are also unchecked(Screenshot attached)

4. Create and install the package, and please let me know the results.

 

Regards

Rohit Pandita

[rstaselbeta]

Just did this. No change in behavior. I can still freely install whatever apps via CC app in SDL.

Are you all not able to reproduce this in-house? This is a significant problem... 

[rpandita]

Hi rstaselbeta

Apologies for all the trouble you are facing, and No, I cannot repro this in-house.
I would request you to please open a Support case with us Via Admin Console. 

Regards
Rohit Pandita

[rstaselbeta]

No worries. I have opened a P3 case. 

[MattDB]

I wanted to provide an update on this issue. In my case we found that the Self-service polices under our Adobe CC product profile in the Admin Console had been enabled. I don't recall ever enabling this feature, but it was on. Disabling these policies resolved the issue for us. I got confirmation from Adobe support that these polices take precedence over any policies or restrictions configured at the package level, and are applied as soon as a licence user logs into any of the Creative Cloud applications.

In the Adobe Admin console, go to Products, select your Adobe CC product, drill down on it's configuration, go to the "Permissions" tab, click the edit button next to Self-service polices and make sure the option is toggled off. As soon as these policies were disabled, our managed package policies immediately began working again as expected.

[rstaselbeta]

We don't see that option for our SDL licensing "product".

Also doesn't explain why Windows version of CC App doesn't allow self service installs. 

I do see that setting for "All Apps" (not NUL/SDL specific) but that would prevent NUL based installs from installing via CC App... 

This used to work as expected... 

[MattDB]

Yeah your situation might be different as we only have NUL, no shared device licenses. Although initially I thought our issue was specific to our Apple devices, I realized it was affecting all of our Windows users as well. By any chance, on your Macs, are you using Jamf's App Installers to distrubite the applications?

[rstaselbeta]

Yeah, sorry. We do have NUL and SDL. NUL we allow self install on both windows and mac. For SDL, we want to only allow installs via Jamf or MECM software centers. We create the NUL installers with self service enabled, we create the SDL installers with it disabled (we don't want random students installing software on lab machines). 

This has traditionally worked as expected, but with version 6, it doesn't seem to (at least on macOS).

Oh, and no, not installing from Jamf App Installers. We manually build our CCAPP for both NUL and SDL, and build individual apps for all the SDL apps so we can scope and distribute as required.  

[MattDB]

Oh okay. The only reason I asked is that we do use App Installers and Jamf bundles a default non-customizable ServiceConfig.xml file along with the apps. Originally these default settings restricted self-service which worked for us, but then Jamf changed the default settings a couple months ago to allow for self-service, which really caught us by surprise. We still use the App Installers but I now have a separate policy that generates a new ServiceConfig.xml file with the restrictions to overwrite the one that Jamf bundles with their installer. If your making your custom packages and policies I imagine this wouldn't be a problem for you. Pushing the apps out via App Installer then applying the xml file just to student / lab machines is now working for us. 

Defintely a strange issue. Have you tried creating a managed package containing just the desktop app with self-service disabled and installing it manually on a clean Mac? 

[rstaselbeta]

Yup, and good to know that's how you're doing it and it works. 

And yeah, that was @rpandita 's testing request. Fresh install, after uninstall, etc. No change. tbh, I'm kind of afraid your solution is what support is going to say, but that's not really a tenable option (we have to be able to lockdown Lab machines from self service but allow Faculty/Staff to self install).