Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep Calm and Upgrade Your Mac

October 23, 2018

Keep Calm and Upgrade Your Mac

Presentation from JNUC 2018, the world's largest rally of Apple IT administrators.

Keep Calm and Upgrade Your Mac

Presented by:
Daniel Mintz, Jamf
Jonathan Yuresko, Jamf

View all session slides, recordings and more at https://www.jamf.com/events/jamf-nation-user-conference/2018/.


October 23, 2018

More Decks by Jamf

Other Decks in Technology


  1. © JAMF Software, LLC Daniel Mintz Professional Services Engineer Jamf

    Jonathan Yuresko Implementation Engineer Jamf 275x275 head shot
  2. © JAMF Software, LLC Keep Calm and Update Your Mac!

    Agenda: In-place macOS upgrades Erase and Install macOS…remotely! Provisioning your Macs from afar Putting it all together for seamless provisioning Q/A
  3. © JAMF Software, LLC In-Place macOS Upgrades /Applications/Install\ macOS\ Mojave.app/Contents/Resources/startosinstall

    \ --applicationpath /Applications/Install\ macOS\ mojave.app \ - agreetolicence \ --nointeraction github.com/kc9wwh/macOSUpgrade How?
  4. © JAMF Software, LLC Der Flounder - Building a Jamf

    Pro Smart Group For High Sierra Models goo.gl/AR5BGC In-Place macOS Upgrades
  5. © JAMF Software, LLC $4 $5 $6 macOS Upgrade Script

    /Applications/Install macOS Mojave.app 10.14 moj
  6. © JAMF Software, LLC Erasing and Installing macOS How? /Applications/Install\

    macOS\ mojave.app/Contents/Resources/ startosinstall \ --applicationpath /Applications/Install\ macOS\ Mojave.app \ --eraseInstall \ - agreetolicence \ --nointeraction
  7. © JAMF Software, LLC /Applications/Install\ macOS\ mojave.app/Contents/Resources/ startosinstall \ --applicationpath

    /Applications/Install\ macOS\ Mojave.app \ --eraseInstall \ - agreetolicence \ --nointeraction \ --installpackage …and enrolling remotely! Erasing and Installing macOS
  8. © JAMF Software, LLC End Goal: To allow an admin

    to assign a machine correctly to a user, and choose its configuration. Thus allowing erase and install to happen and the machine immediately enrolled back into management. Example: A machine is being re-provisioned for a new employee and the device in question is not DEP enabled. Erasing and Installing macOS
  9. © JAMF Software, LLC echo "Pashua created the following variables:"

    echo " tb = $tb" echo " tf = $tf" echo " tf1 = $tf1" echo " tf2 = $tf2" echo " ob = $ob" echo " pop = $pop" echo " rb = $rb" echo " cb = $cb" echo " chk = $chk" echo ""
  10. © JAMF Software, LLC /usr/bin/dscl . -create /Users/newadmin /usr/bin/dscl .

    -create /Users/newadmin UserShell /bin/bash /usr/bin/dscl . -create /Users/newadmin RealName "New Admin" /usr/bin/dscl . -create /Users/newadmin UniqueID 519 /usr/bin/dscl . -create /Users/newadmin PrimaryGroupID 80 /usr/bin/dscl . -create /Users/newadmin NFSHomeDirectory /Users/newadmin /usr/bin/dscl . -passwd /Users/newadmin password /usr/bin/dscl . append /Groups/admin GroupMembership newadmin createhomedir -c -u newadmin
  11. © JAMF Software, LLC /bin/mkdir -p /private/var/db /usr/bin/touch /private/var/db/.AppleSetupDone /bin/chmod

    0400 /private/var/db/.AppleSetupDone /bin/mkdir -p /Library/Receipts /usr/bin/touch /Library/Receipts/.SetupRegComplete
  12. © JAMF Software, LLC ##Erase & Install macOS (Factory Defaults)

    ##Requires macOS Installer 10.13.4 or later ##Disabled by default ##Options: 0 = Disabled / 1 = Enabled ##Use Parameter 8 in the JSS. eraseInstall="$8" if [[ "${eraseInstall:=0}" != 1 ]]; then eraseInstall=0 ; fi #macOS Installer 10.13.3 or ealier set 0 to it. if [ "$versionMajor${versionMinor:=0}" -lt 134 ]; then eraseInstall=0 fi
  13. © JAMF Software, LLC /Applications/Install\ macOS\ Mojave.app/Contents/Resources/ startosinstall \ --applicationpath

    /Applications/Install\ macOS\ Mojave.app \ --eraseInstall \ - agreetolicence \ --nointeraction \ --installpackage …and PROVISIONING remotely! Erasing and Installing macOS
  14. © JAMF Software, LLC Provisioning Macs from afar End Goal:

    Assign desired computer(s) in Jamf Pro to be erased, clean-OS installed, enrolled, and provisioned! Some Examples: • Repurposing a used machine, wiping and provisioning it for a new employee…without touching the machine • Updating all lab machines to the latest and greatest and provisioning them for the next class/semester, remotely!
  15. © JAMF Software, LLC Provisioning Macs from afar • Custom

    QuickAdd with special features* • Workflow to erase, install and enroll using the custom quickadd • Smart Groups • Policies with Custom Triggers • Provisioning workflow (script or app based, calling Custom Triggers) • Cleanup workflow Setup
  16. © JAMF Software, LLC Provisioning Macs from afar • Network

    - Wi-Fi (added via script/command) or Ethernet • Temporary Admin Account - To be removed via Jamf Pro later…but available in case of network drop • Bypass Setup Screens • Drop a dummy file/plist for an Extension Attribute - Smart Group • Have an auto provisioning workflow with Custom Policy Triggers • Cleanup! Custom QuickAdd
  17. © JAMF Software, LLC Provisioning Macs from afar /bin/mkdir /Library/Company/tmp

    /usr/bin/touch /Library/Company/tmp/provisioning.txt /bin/echo ‘Provisioning’ > /Library/Company/tmp/provisioning.txt ___________________________ Extension Attribute Workflow: Smart Group “cat” value in /Library/Company/tmp/provisioning.txt Scope Smart Group to provisioning workflow Upon completion, trash /Library/Company/tmp/provisioning.txt Custom QuickAdd - Dummy file/plist
  18. © JAMF Software, LLC Provisioning Macs from afar /usr/local/jamf/bin/jamf policy

    -trigger provision_securityharden /usr/local/jamf/bin/jamf policy -trigger provision_firefox /usr/local/jamf/bin/jamf policy -trigger provision_googlechrome /usr/local/jamf/bin/jamf policy -trigger provision_photoshop /usr/local/jamf/bin/jamf policy -trigger provision_slack /usr/local/jamf/bin/jamf policy -trigger provision_spotify /usr/local/jamf/bin/jamf policy -trigger provision_evernote /usr/local/jamf/bin/jamf policy -trigger provision_browsersettings Auto-provisioning Workflow - Script Contents
  19. © JAMF Software, LLC Provisioning Macs from afar Remove Dummy

    Plist/File (or have script say “completed” in plist for Smart Group EA) Apply security mandated settings/configurations Enable Filevault Have computer reboot back to Setup Assistant Restart machine Have a popup or something letting end-user know the machine is ready to go Smart group looking for completed machine… …and a webhook sending an email to IT showing the machine is ready to go :) Cleanup
  20. © JAMF Software, LLC Putting it all Together Let’s do

    this… Prerequisites • Get your machines to at least 10.13.4 • Create Provisioning Policy Structure - https://jamf.it/GcQya Workflow • Custom QuickAdd Package to enroll machine(s) and auto-configure • Cache macOS Installer on desired machine(s) • startOSInstall binary script in Jamf Pro w/ -installpackage • Smart/Static Group scoped policy for desired computers • Result: Desired machines are wiped clean, enrolled and provisioned!