Leveraging DEPNotify and Jamf Pro for Device Deployment

Presentation from JNUC 2018, the world's largest rally of Apple IT administrators.

Session:
Leveraging DEPNotify and Jamf Pro for Device Deployment

Presented by:
John Mahlman, The University of the Arts

View all session slides, recordings and more at https://www.jamf.com/events/jamf-nation-user-conference/2018/.

Transcript

2. © JAMF Software, LLC John Mahlman Network Systems Administrator The University of the Arts, Philadelphia • Over 10 years in Mac IT • Write bad code • Brew good beer • Play Tabletop Games • Love Philly sports teams Find me: @jmahlman (slack, git, jamfnation) Website: https://yearofthegeek.net
3. © JAMF Software, LLC LDEPNAJPFDD Presentation agenda: • The recent past (Imaging) • What happened? It happened… • Options we considered • Find the process • What we built • What’s next?
4. © JAMF Software, LLC UArts at a Glance • Approximately 1,800 students • 6 Academic buildings • Over 200 “student-facing” public Macs • Offices, faculty/staff, Students (BYOD) — 97% Macs • Computers range from 2009-2018 models • On-Prem Jamf Pro since 2012 • Over 1,700 managed systems
5. © JAMF Software, LLC Where did we start? Let’s go back in time a few years..er..months…weeks?
6. © JAMF Software, LLC Imaging… (not too long ago) ~$ sudo bless --netboot --nextonly --server bsdp://<server> ~$ sudo shutdown -r now
7. © JAMF Software, LLC Imaging… (not too long ago) Send command or set policy… Go home… Have beverage!
8. © JAMF Software, LLC Imaging… (not too long ago) Send command or Set policy…. Go home… Have beverage!
9. © JAMF Software, LLC And then it happened… You all know what I’m talking about…
10. © JAMF Software, LLC It happened “Apple doesn't recommend or support monolithic system imaging as an installation method, because the system image might not include model-specific information such as firmware updates.” Apple, https://support.apple.com/en-us/HT208020 (Obtained 8/7/18)
11. © JAMF Software, LLC User-Approved Kernel Extension Loading (UAKEL, Ukulele)
12. © JAMF Software, LLC User-Approved MDM (UAMDM)
13. © JAMF Software, LLC Apple T2 chip/Secure Boot “Secure Boot offers three settings to make sure that your Mac always starts up from a legitimate, trusted Mac operating system…Full Security is the default Secure Boot setting…” Apple, https://support.apple.com/en-us/HT208330 (Obtained 8/7/18)
14. © JAMF Software, LLC Is imaging dead? Let’s google!
15. © JAMF Software, LLC
16. © JAMF Software, LLC
17. © JAMF Software, LLC
18. © JAMF Software, LLC
19. © JAMF Software, LLC ^ MOSTLY TM
20. © JAMF Software, LLC So, what are we going to do? -Me, 2017
21. © JAMF Software, LLC Option 1: Stay on 10.12 + Most of our software works fine on 10.12 + Our current workflow works fine - Security Updates will eventually stop - New Machines will come with 10.13 - Some Apple software already updated to 10.13 only Option 2: In-Place Upgrade + Quick process + No more imaging at all on public systems - Computers will have leftover bits from software - A lot more manual work than desired
22. © JAMF Software, LLC Option 3: In-place Upgrade then image in future + Firmware is installed at upgrade + Workflows are already good + Same issues as Option 2 (leftovers, more work) - UAMDM will not automatically work - UAKEL will not work until we manually allow MDM (AV software, sound drivers, etc.)
23. © JAMF Software, LLC Really, what are we going to do? -Also me, 2018
24. © JAMF Software, LLC Apple School Manager Jamf Pro = Device Enrollment + Device Enrollment The Tools
25. © JAMF Software, LLC SplashBuddy DEPNotify + Beautiful/Informative UI + Lots of functionality + Allowed User Input - More setup required - More info than we need + Highly-Customizable UI + Really Simple Setup - No User Input And then came Frederico Deis (@fgd) + User Input!
26. © JAMF Software, LLC • Reads input echoed into log file • Input sets up UI and controls flow • All UI aspects are controllable echo "Command: MainTitle: New Mac Setup" >> $DNLOG echo "Command: Image: /var/tmp/your-logo.png” >> $DNLOG echo "Command: WindowStyle: NotMovable" >> $DNLOG echo "Command: ContinueButtonRegister: Begin" >> $DNLOG echo "Status: Please click the button below..." >> $DNLOG DEPNotify
27. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deployment • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) Assignment • Rename machine and assign to user • Enter Asset Tag • Give to user • Enjoy a drink
28. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deployment • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) Assignment • Rename machine and assign to user • Enter Asset Tag • Give to user • Enjoy a drink
29. © JAMF Software, LLC Preparation… New Machines • Assign to MDM • Setup Prestage • Assign Devices
 to Prestage
30. © JAMF Software, LLC Preparation… New Machines • Assign to MDM • Setup Prestage • Assign Devices
 to Prestage
31. © JAMF Software, LLC Preparation… Existing Machines (APFS) • Package Installer • Script with ‘eraseinstall’ and ‘nointeraction’ flags • Make Policy #!/bin/bash /Applications/Install\ macOS\ High\ Sierra.app/Contents/Resources/ startosinstall --applicationpath "/Applications/Install macOS High Sierra.app" --rebootdelay 30 --nointeraction $4 <—For additional flags!
32. © JAMF Software, LLC Preparation… Existing Machines (HFS) • Internet Recovery!
33. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deployment • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) Assignment • Rename machine and assign to user • Enter Asset Tag • Give to user • Enjoy a drink
34. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deployment • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) Assignment • Rename machine and assign to user • Enter Asset Tag • Give to user • Enjoy a drink
35. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deployment • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) Assignment • Rename machine and assign to user • Enter Asset Tag • Give to user • Enjoy a drink
36. © JAMF Software, LLC The Process… Preparation • New machines get added to DEP then assigned to jamf • Old machines get wiped via internet recovery or policy Deploy and Assign • Boot machines to Setup Assistant • Install Mobile Config • Install software based on cohort (machine type) • Rename machine and assign to user • Enter Asset Tag
37. © JAMF Software, LLC The Process… Enrollment Trigger • Install DEPNotify • App Package • Logo • Provisioning Script Run Script to do things! • Install Software • Assign computer to user in Jamf Pro • Crete local account • Rename computer • Install updates
38. © JAMF Software, LLC But…we ran into issues… • Ran behind the login window • Added a “wait for dock” loop • Ran before user was completely logged in • Added timer • Still was not running every time… • Launch Daemon!
39. © JAMF Software, LLC The Process… Enrollment Trigger • Install DEPNotify • App Package • Logo • Launch Daemon • Deployment Script Launch Daemon runs Script • Install Software • Assign computer to user in Jamf • Crete local account • Rename computer • Install updates
40. © JAMF Software, LLC DEPNotify Package
41. © JAMF Software, LLC
42. © JAMF Software, LLC DEPNotify Package
43. © JAMF Software, LLC
44. © JAMF Software, LLC Enrollment Policy
45. © JAMF Software, LLC Enrollment Policy
46. © JAMF Software, LLC The Process… Enrollment Trigger • Install DEPNotify • App Package • Logo • Launch Daemon • Deployment Script Launch Daemon runs Script • Install Software • Assign computer to user in Jamf • Crete local account • Rename computer • Install updates
47. © JAMF Software, LLC
48. © JAMF Software, LLC
49. © JAMF Software, LLC
50. © JAMF Software, LLC
51. © JAMF Software, LLC
52. © JAMF Software, LLC
53. © JAMF Software, LLC
54. © JAMF Software, LLC
55. © JAMF Software, LLC
56. © JAMF Software, LLC
57. © JAMF Software, LLC
58. © JAMF Software, LLC
59. © JAMF Software, LLC
60. © JAMF Software, LLC
61. © JAMF Software, LLC
62. © JAMF Software, LLC Can I automate this for labs, etc..? -Also also me, 2018
63. © JAMF Software, LLC HECK YEAH! -Me, 3 months ago Neil Martin’s JNRS presentation: https://github.com/neilmartin83/Jamf-Nation-Roadshow-London-2018
64. © JAMF Software, LLC Automate it, yo! Extension Attribute Auto-Login User Is this a known machine? Public Office/Checkout Find machine type Ask for Input Yes No Do the things!
65. © JAMF Software, LLC DEPNotify Package - Automated
66. © JAMF Software, LLC
67. © JAMF Software, LLC
68. © JAMF Software, LLC DEPNotify Package - Automated Thanks, MacUserGenerator! (https://github.com/ninxsoft/MacUserGenerator)
69. © JAMF Software, LLC
70. © JAMF Software, LLC
71. © JAMF Software, LLC
72. © JAMF Software, LLC
73. © JAMF Software, LLC
74. © JAMF Software, LLC
75. © JAMF Software, LLC
76. © JAMF Software, LLC
77. © JAMF Software, LLC
78. © JAMF Software, LLC
79. © JAMF Software, LLC
80. © JAMF Software, LLC
81. © JAMF Software, LLC Why are there two processes?? -You, right now
82. © JAMF Software, LLC
83. © JAMF Software, LLC No… And that’s okay..right?
84. © JAMF Software, LLC I’m not into scripting…any ideas? -You, right now…maybe?
85. © JAMF Software, LLC https://github.com/jamfprofessionalservices/DEP-Notify
86. © JAMF Software, LLC
87. © JAMF Software, LLC The hopeful future! • Hope that Apple gives us a way to have 100% zero-touch • --eraseinstall flag • Skip Setup Assistant? • Better use of snapshots? • DEPNotify at login window • See what Jamf comes up with
88. © JAMF Software, LLC Resources • My GitHub • https://github.com/jmahlman/uarts-scripts/tree/master/DEP%20Scripts • Updated process: https://github.com/jmahlman/DEPNotify-automated • DEPNotify • https://gitlab.com/Mactroll/DEPNotify • Neil Martin’s Presentation/Code from JNRS • https://github.com/neilmartin83/Jamf-Nation-Roadshow-London-2018 • Jamf Professional Services DEPNotify repo • https://github.com/jamfprofessionalservices/DEP-Notify
89. © JAMF Software, LL THANK YOU!