If You Built It, They Will Come

Transcript

1. © JAMF Software, LLC
   If You Build it, They Will Come
   
   1:30 - 2:15 PM
   UP NEXT
   

   View Slide

2. View Slide

3. © JAMF Software, LLC
   Mark Lamont
   Professional Services Engineer
   
   Jigsaw24
   Jack Hollister
   Apple Enterprise Solutions Architect
   
   Jigsaw24
   

   View Slide

4. © JAMF Software, LLC
   If You Build it, They Will Come!
   Presentation agenda:
   Overview
   Automated Device Enrolment builds
   Automated NON Device Enrollment builds
   Policy driven reprovisioning
   

   View Slide

5. © JAMF Software, LLC
   Are you an organisation with…
   Devices of various OS levels
   Some assigned in ABM/ASM and Jamf
   Some, probably lots, not….
   Need a common build and rebuild method
   Then this talk is for you..
   

   View Slide

6. © JAMF Software, LLC
   First Up
   Out of the box DEP build….
   
   

   View Slide

7. © JAMF Software, LLC
   Automated Device Enrolment Build
   How to setup automated provisioning of a
   DEP ready Mac
   Ideal for use with Jamf Connect Login, NoMAD or AD
   Binding
   
   No end user account created during the build
   

   View Slide

8. © JAMF Software, LLC
   Automated Device Enrolment
   Firstly a custom package is needed….
   
   

   View Slide

9. © JAMF Software, LLC
   Automated DE Build - Package
   Required components
   NoMAD Login
   
   NoMAD settings profile
   
   Branding graphics
   

   View Slide

10. © JAMF Software, LLC
    Automated DE Build - Package
    Package Post Install Script
    

    View Slide

11. © JAMF Software, LLC
    Enrollment Prestage
    A prestage is needed….
    
    

    View Slide

12. © JAMF Software, LLC
    Max image dimensions
    Automated DE Build - Prestage
    Add the package to
    Enrollment packages
    

    View Slide

13. © JAMF Software, LLC
    Max image dimensions
    Automated DE Build - Prestage
    Set local User
    account creation
    to
    Skip Account Creation
    

    View Slide

14. © JAMF Software, LLC
    Post Enrollment Policy
    A build policy is needed….
    
    

    View Slide

15. © JAMF Software, LLC
    Automated DE Build - Policy
    One policy required to
    run the build
    run on Enrollment Complete
    ongoing frequency
    Runs the build script
    

    View Slide

16. © JAMF Software, LLC
    Automated DE Build - Script
    What does it do?
    waits until any required input is
    made
    Runs policies using custom
    triggers
    Displays status updates
    Sets login window type
    

    View Slide

17. © JAMF Software, LLC
    Automated DE Build - Master Script
    Let’s break it down
    

    View Slide

18. © JAMF Software, LLC
    Automated DE Build - Script
    Wait until user input completed
    

    View Slide

19. © JAMF Software, LLC
    Automated DE Build - Script
    Write to Notify screen
    

    View Slide

20. © JAMF Software, LLC
    Automated DE Build - Script
    Install an application
    

    View Slide

21. © JAMF Software, LLC
    Automated DE Build - Script
    Reset Login window
    

    View Slide

22. © JAMF Software, LLC
    Automated DE Build - Demo Time
    

    View Slide

23. © JAMF Software, LLC
    Part 2…. Non Device Enrollment Build
    Teaching (your) grandmother
    to suck eggs is an English
    language saying that refers to a
    person giving advice to another
    person in a subject with which the
    other person is already familiar
    (and probably more so than the
    first person)
    

    View Slide

24. © JAMF Software, LLC
    NON DE Build - Uses
    What’s this used for?
    For devices NOT DEP capable but you…
    
    Want a common OS level
    
    Want to erase with a common method
    
    Want to build with same build as the DEP devices
    

    View Slide

25. © JAMF Software, LLC
    NON DE Build - Overview
    Stages:
    1. Wipe and install clean macOS
    
    2. Install extra workflow packages
    
    3. Enroll in Jamf
    
    4. Apply build
    
    It’s OK, it’s mostly automated!
    

    View Slide

26. © JAMF Software, LLC
    Let’s get started
    Back to basics…..
    
    

    View Slide

27. © JAMF Software, LLC
    NON DE Build - Your starter for 10
    How do we get this process started?
    Mac Deploy Stick
    
    https://twocanoes.com/products/mac/mac-deploy-stick/
    

    View Slide

28. © JAMF Software, LLC
    The Extras
    A couple of packages…..
    
    

    View Slide

29. © JAMF Software, LLC
    NON DE Build - Package #1
    Components:
    NoMAD Login
    
    NoMAD settings profile
    
    QuickAdd.pkg
    
    Control script
    
    LaunchDaemon for script
    

    View Slide

30. © JAMF Software, LLC
    NON DE Build - Package #1
    Post install script
    LaunchDaemon has to be loaded during package install
    
    Post install script does this
    

    View Slide

31. © JAMF Software, LLC
    NON DE Build - Package #1
    QuickAdd Package
    Management user different to the DEP user
    
    Used in Smart Group later
    

    View Slide

32. © JAMF Software, LLC
    NON DE Build - Package #2
    Graphics
    Common graphics package
    

    View Slide

33. © JAMF Software, LLC
    The Extras
    The control script…..
    
    

    View Slide

34. © JAMF Software, LLC
    NON DE Build - Control Script
    Check _mbsetupuser is active
    

    View Slide

35. © JAMF Software, LLC
    NON DE Build - Control Script
    Setup NoMAD
    

    View Slide

36. © JAMF Software, LLC
    NON DE Build - Control Script
    Check Jamf contactable
    

    View Slide

37. © JAMF Software, LLC
    NON DE Build - Control Script
    Switch Login Window to NoMAD Login
    Create .AppleSetupDone
    
    Kill loginwindow
    

    View Slide

38. © JAMF Software, LLC
    NON DE Build - Control Script
    Install the QuickAdd package
    Enrolls device in Jamf
    
    Sends enrollment trigger
    
    Starts the build process
    

    View Slide

39. © JAMF Software, LLC
    User Logon post build
    It’s built, now what happens?
    User logs in using:
    Jamf Connect
    
    NoMAD
    
    AD Bound
    

    View Slide

40. © JAMF Software, LLC
    MDM Profile Approval
    MDM Profile needs approving
    Full MDM functionality not available without this
    

    View Slide

41. © JAMF Software, LLC
    MDM Profile Approval
    So how can we force approval?
    Can’t force approval but…
    
    Can guide
    
    Repeatedly until they give up…
    

    View Slide

42. © JAMF Software, LLC
    UAMDM Smart Group
    Smart Group to scope approve MDM policy
    User Approved MDM not Yes
    Managed by non-DEP management user
    

    View Slide

43. © JAMF Software, LLC
    UAMDM Policy
    Approve MDM Policy
    Scoped to the Smart Group
    
    Runs at login and checkin
    

    View Slide

44. © JAMF Software, LLC
    UAMDM Script
    What does the script do?
    Checks if the MDM profile is approved
    
    Runs the user facing approval screens
    

    View Slide

45. © JAMF Software, LLC
    UAMDM Script
    Check MDM Profile approved
    

    View Slide

46. © JAMF Software, LLC
    UAMDM Script
    Run the approval process
    If approved - do nothing
    
    If not - Start user process
    

    View Slide

47. © JAMF Software, LLC
    UAMDM Script
    The process
    Launch Jamf Helper
    
    Alternatively use DEP Notify
    
    Open Profiles pane
    
    Approve!
    

    View Slide

48. © JAMF Software, LLC
    Non DE Build - Finally its Demo time
    

    View Slide

49. © JAMF Software, LLC
    Part 3…… Rinse and Repeat
    

    View Slide

50. © JAMF Software, LLC
    That was amazing…What now?
    Now the devices are in Jamf
    Deploy policy driven erase and rebuild
    
    Self Service or remote execution policy
    
    Conditionally deploy the NON DEP workflow packages
    
    Automatically switch between Non DEP and DEP
    !50
    

    View Slide

51. © JAMF Software, LLC
    Policy Driven Device Reprovisioning
    What’s required?
    Graham Pugh’s Erase-install script
    
    https://github.com/grahampugh/erase-install
    
    A couple of Extension Attributes
    
    and of course smart groups and policies!
    

    View Slide

52. © JAMF Software, LLC
    Erase-Install script
    What does it do?
    Downloads the appropriate OS install package
    
    Can be locked to a specific version if required
    
    Will perform the erase and install
    
    Displays user messaging when starting
    
    It has other functionality but not talking about them today
    

    View Slide

53. © JAMF Software, LLC
    Required Extension Attributes
    Two extension attributes required….
    
    

    View Slide

54. © JAMF Software, LLC
    Extension Attribute #1
    Installer valid EA
    To record if OS installer is:
    
    1. Downloaded
    
    2. Valid version
    
    Equal to or higher than installed OS version
    

    View Slide

55. © JAMF Software, LLC
    Extension Attribute #2
    Is the device DEP capable?
    EA that records if device has DEP record in Apple
    
    Profiles show -type enrollment
    

    View Slide

56. © JAMF Software, LLC
    Required Package
    One package required….
    
    

    View Slide

57. © JAMF Software, LLC
    Package Required
    Deploy Extras package
    Need to deploy the non-DEP packages
    
    Deployed as a single package
    

    View Slide

58. © JAMF Software, LLC
    Required Smart Groups
    Four Smart Groups required….
    
    

    View Slide

59. © JAMF Software, LLC
    Smart Group #1
    Installer download required
    OS > 10.13.4
    
    Add APFS requirement if HFS devices in estate
    
    Installer not downloaded or not valid
    

    View Slide

60. © JAMF Software, LLC
    Smart Group #2
    Non DEP Extra packages required
    Have valid OS installer
    
    Not DEP capable
    

    View Slide

61. © JAMF Software, LLC
    Smart Group #3
    Erase Ready Groups
    Two separate groups for erase ready
    
    One for DEP devices
    
    One for Non DEP devices
    

    View Slide

62. © JAMF Software, LLC
    Smart Group #4
    One last group….
    Non-DEP to DEP
    

    View Slide

63. © JAMF Software, LLC
    Required Policies
    Four policies are required….
    
    

    View Slide

64. © JAMF Software, LLC
    Policy #1
    OS Installer download
    Downloads the OS installer
    
    Overwrites existing
    
    Scoped to download required
    
    Version options set
    
    Runs inventory when complete
    

    View Slide

65. © JAMF Software, LLC
    Policy #2
    Deploy Extras package
    Deploy the extras packages
    
    Scoped to extras required smart group
    

    View Slide

66. © JAMF Software, LLC
    Policy #3
    Remove Extras package
    
    When devices added to DEP
    
    Delete the extras package
    
    Build method will now be DEP
    

    View Slide

67. © JAMF Software, LLC
    Policy #3
    Remove Extras package
    Removes the packages
    
    Removes Jamf receipt
    

    View Slide

68. © JAMF Software, LLC
    Policy #4
    The big one!
    Erase and install
    
    Can be Self Service
    
    Can be force deployed
    
    Can be event trigger
    
    Scoped to the Erase ready groups
    

    View Slide

69. © JAMF Software, LLC
    Wrap up
    Nearly there ….
    
    

    View Slide

70. © JAMF Software, LLC
    Process Flow Diagram
    

    View Slide

71. © JAMF Software, LLC
    Before you ask..
    Does this work with 10.15?
    YES!
    

    View Slide

72. © JAMF Software, LLC
    Live uses
    Has this been deployed?
    
    Ark schools trust
    
    30 + school locations
    
    Few new DEP Macs
    
    Several hundred non DEP Macs
    
    Devices from 2012 and up
    

    View Slide

73. © JAMF Software, LLC
    And finally some links
    1. Neil Martin's MacADUK 2019 Presentation
    2. twocanoes.com mac-deploy-stick
    3. Graham Pugh's erase-install
    4. montysmacmusings blog
    

    View Slide

74. © JAMF Software, LLC
    Thank you for listening!
    Give us feedback by
    completing the 2-question
    session survey in the JNUC
    2019 app.
    UP NEXT
    Your Internal Beta Test Program
    2:45 PM
    

    View Slide