Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep Calm and Upgrade Your Mac

Jamf
October 23, 2018

Keep Calm and Upgrade Your Mac

Presentation from JNUC 2018, the world's largest rally of Apple IT administrators.

Session:
Keep Calm and Upgrade Your Mac

Presented by:
Daniel Mintz, Jamf
Jonathan Yuresko, Jamf

View all session slides, recordings and more at https://www.jamf.com/events/jamf-nation-user-conference/2018/.

Jamf

October 23, 2018
Tweet

More Decks by Jamf

Other Decks in Technology

Transcript

  1. View Slide

  2. © JAMF Software, LLC
    Daniel Mintz
    Professional Services Engineer

    Jamf
    Jonathan Yuresko
    Implementation Engineer

    Jamf
    275x275

    head shot

    View Slide

  3. © JAMF Software, LLC
    Keep Calm and Update Your Mac!
    Agenda:

    In-place macOS upgrades

    Erase and Install macOS…remotely!

    Provisioning your Macs from afar

    Putting it all together for seamless provisioning

    Q/A

    View Slide

  4. © JAMF Software, LLC
    In-Place macOS Upgrades
    /Applications/Install\ macOS\ Mojave.app/Contents/Resources/startosinstall \

    --applicationpath /Applications/Install\ macOS\ mojave.app \

    - agreetolicence \

    --nointeraction

    github.com/kc9wwh/macOSUpgrade

    How?

    View Slide

  5. © JAMF Software, LLC
    Der Flounder - Building a Jamf Pro Smart Group For High Sierra Models

    goo.gl/AR5BGC
    In-Place macOS Upgrades

    View Slide

  6. © JAMF Software, LLC
    Install macOS Mojave.app
    Install macOS Mojave.app Install macOS Mojave.app

    View Slide

  7. © JAMF Software, LLC
    Mojave Installer
    Cache Mojave Installer

    View Slide

  8. © JAMF Software, LLC
    Install macOS Mojave.app

    View Slide

  9. © JAMF Software, LLC
    $4
    $5
    $6
    macOS Upgrade Script
    /Applications/Install macOS Mojave.app
    10.14
    moj

    View Slide

  10. © JAMF Software, LLC
    Upgrade to Mojave

    View Slide

  11. © JAMF Software, LLC
    Mojave

    View Slide

  12. © JAMF Software, LLC
    Installing: About 3 minutes
    remaining

    View Slide

  13. © JAMF Software, LLC
    Erasing and Installing macOS
    How?
    /Applications/Install\ macOS\ mojave.app/Contents/Resources/
    startosinstall \

    --applicationpath /Applications/Install\ macOS\ Mojave.app \

    --eraseInstall \

    - agreetolicence \

    --nointeraction

    View Slide

  14. © JAMF Software, LLC
    /Applications/Install\ macOS\ mojave.app/Contents/Resources/
    startosinstall \

    --applicationpath /Applications/Install\ macOS\ Mojave.app \

    --eraseInstall \

    - agreetolicence \

    --nointeraction \

    --installpackage
    …and enrolling remotely!
    Erasing and Installing macOS

    View Slide

  15. © JAMF Software, LLC
    End Goal: To allow an admin to assign a machine
    correctly to a user, and choose its configuration. Thus
    allowing erase and install to happen and the machine
    immediately enrolled back into management.

    Example:

    A machine is being re-provisioned for a new employee
    and the device in question is not DEP enabled.
    Erasing and Installing macOS

    View Slide

  16. © JAMF Software, LLC
    Erasing and Installing macOS

    View Slide

  17. © JAMF Software, LLC
    https://www.bluem.net/en/projects/pashua/

    View Slide

  18. © JAMF Software, LLC

    View Slide

  19. © JAMF Software, LLC
    echo "Pashua created the following variables:"

    echo " tb = $tb"

    echo " tf = $tf"

    echo " tf1 = $tf1"

    echo " tf2 = $tf2"

    echo " ob = $ob"

    echo " pop = $pop"

    echo " rb = $rb"

    echo " cb = $cb"

    echo " chk = $chk"

    echo ""

    View Slide

  20. © JAMF Software, LLC
    /usr/sbin/networksetup -setairportnetwork en0

    View Slide

  21. © JAMF Software, LLC
    /usr/bin/dscl . -create /Users/newadmin

    /usr/bin/dscl . -create /Users/newadmin UserShell /bin/bash

    /usr/bin/dscl . -create /Users/newadmin RealName "New Admin"

    /usr/bin/dscl . -create /Users/newadmin UniqueID 519

    /usr/bin/dscl . -create /Users/newadmin PrimaryGroupID 80

    /usr/bin/dscl . -create /Users/newadmin NFSHomeDirectory /Users/newadmin

    /usr/bin/dscl . -passwd /Users/newadmin password

    /usr/bin/dscl . append /Groups/admin GroupMembership newadmin

    createhomedir -c -u newadmin

    View Slide

  22. © JAMF Software, LLC
    /bin/mkdir -p /private/var/db

    /usr/bin/touch /private/var/db/.AppleSetupDone

    /bin/chmod 0400 /private/var/db/.AppleSetupDone

    /bin/mkdir -p /Library/Receipts

    /usr/bin/touch /Library/Receipts/.SetupRegComplete

    View Slide

  23. © JAMF Software, LLC
    ##Erase & Install macOS (Factory Defaults)

    ##Requires macOS Installer 10.13.4 or later

    ##Disabled by default

    ##Options: 0 = Disabled / 1 = Enabled

    ##Use Parameter 8 in the JSS.

    eraseInstall="$8"
    if [[ "${eraseInstall:=0}" != 1 ]]; then eraseInstall=0 ; fi

    #macOS Installer 10.13.3 or ealier set 0 to it.

    if [ "$versionMajor${versionMinor:=0}" -lt 134 ]; then

    eraseInstall=0



    View Slide

  24. © JAMF Software, LLC
    Installing: About 3 minutes
    Installing: 1 of 1

    View Slide

  25. © JAMF Software, LLC
    /Applications/Install\ macOS\ Mojave.app/Contents/Resources/
    startosinstall \

    --applicationpath /Applications/Install\ macOS\ Mojave.app \

    --eraseInstall \

    - agreetolicence \

    --nointeraction \

    --installpackage
    …and PROVISIONING remotely!
    Erasing and Installing macOS

    View Slide

  26. © JAMF Software, LLC
    Provisioning Macs from afar
    End Goal: Assign desired computer(s) in Jamf Pro to be
    erased, clean-OS installed, enrolled, and provisioned!

    Some Examples:

    • Repurposing a used machine, wiping and provisioning it for
    a new employee…without touching the machine

    • Updating all lab machines to the latest and greatest and
    provisioning them for the next class/semester, remotely!

    View Slide

  27. © JAMF Software, LLC
    Provisioning Macs from afar
    • Custom QuickAdd with special features*

    • Workflow to erase, install and enroll using the custom quickadd

    • Smart Groups

    • Policies with Custom Triggers

    • Provisioning workflow (script or app based, calling Custom Triggers)

    • Cleanup workflow
    Setup

    View Slide

  28. © JAMF Software, LLC
    Provisioning Macs from afar
    • Network - Wi-Fi (added via script/command) or Ethernet

    • Temporary Admin Account - To be removed via Jamf Pro later…but
    available in case of network drop

    • Bypass Setup Screens

    • Drop a dummy file/plist for an Extension Attribute - Smart Group

    • Have an auto provisioning workflow with Custom Policy Triggers

    • Cleanup!
    Custom QuickAdd

    View Slide

  29. © JAMF Software, LLC
    Provisioning Macs from afar
    /bin/mkdir /Library/Company/tmp

    /usr/bin/touch /Library/Company/tmp/provisioning.txt

    /bin/echo ‘Provisioning’ > /Library/Company/tmp/provisioning.txt

    ___________________________

    Extension Attribute Workflow:

    Smart Group “cat” value in /Library/Company/tmp/provisioning.txt

    Scope Smart Group to provisioning workflow

    Upon completion, trash /Library/Company/tmp/provisioning.txt
    Custom QuickAdd - Dummy file/plist

    View Slide

  30. © JAMF Software, LLC
    Smart Group to begin provisioning
    Erasing and Installing macOS

    View Slide

  31. © JAMF Software, LLC
    Custom Trigger Policies
    Erasing and Installing macOS

    View Slide

  32. © JAMF Software, LLC
    Provisioning Macs from afar
    /usr/local/jamf/bin/jamf policy -trigger provision_slack
    Custom Trigger Policies

    View Slide

  33. © JAMF Software, LLC
    Provisioning Macs from afar
    Auto-provisioning Workflow - Policy Structure

    View Slide

  34. © JAMF Software, LLC
    Provisioning Macs from afar
    /usr/local/jamf/bin/jamf policy -trigger provision_securityharden

    /usr/local/jamf/bin/jamf policy -trigger provision_firefox

    /usr/local/jamf/bin/jamf policy -trigger provision_googlechrome

    /usr/local/jamf/bin/jamf policy -trigger provision_photoshop

    /usr/local/jamf/bin/jamf policy -trigger provision_slack

    /usr/local/jamf/bin/jamf policy -trigger provision_spotify

    /usr/local/jamf/bin/jamf policy -trigger provision_evernote

    /usr/local/jamf/bin/jamf policy -trigger provision_browsersettings
    Auto-provisioning Workflow - Script Contents

    View Slide

  35. © JAMF Software, LLC
    Provisioning Macs from afar
    Remove Dummy Plist/File (or have script say “completed” in plist for Smart Group EA)

    Apply security mandated settings/configurations

    Enable Filevault

    Have computer reboot back to Setup Assistant

    Restart machine

    Have a popup or something letting end-user know the machine is ready to go

    Smart group looking for completed machine…

    …and a webhook sending an email to IT showing the machine is ready to go :)
    Cleanup

    View Slide

  36. © JAMF Software, LLC
    Putting it all Together
    Let’s do this…
    Prerequisites

    • Get your machines to at least 10.13.4

    • Create Provisioning Policy Structure - https://jamf.it/GcQya

    Workflow

    • Custom QuickAdd Package to enroll machine(s) and auto-configure

    • Cache macOS Installer on desired machine(s)

    • startOSInstall binary script in Jamf Pro w/ -installpackage

    • Smart/Static Group scoped policy for desired computers

    • Result: Desired machines are wiped clean, enrolled and provisioned!

    View Slide

  37. © JAMF Software, LLC
    Questions?

    View Slide

  38. © JAMF Software, LL
    THANK YOU!

    View Slide