Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Leveraging DEPNotify and Jamf Pro for Device Deployment

Jamf
October 25, 2018

Leveraging DEPNotify and Jamf Pro for Device Deployment

Presentation from JNUC 2018, the world's largest rally of Apple IT administrators.

Session:
Leveraging DEPNotify and Jamf Pro for Device Deployment

Presented by:
John Mahlman, The University of the Arts

View all session slides, recordings and more at https://www.jamf.com/events/jamf-nation-user-conference/2018/.

Jamf

October 25, 2018
Tweet

More Decks by Jamf

Other Decks in Technology

Transcript

  1. © JAMF Software, LLC
    John Mahlman
    Network Systems Administrator

    The University of the Arts, Philadelphia
    • Over 10 years in Mac IT

    • Write bad code

    • Brew good beer

    • Play Tabletop Games

    • Love Philly sports teams

    Find me: @jmahlman (slack, git, jamfnation)
    Website: https://yearofthegeek.net

    View full-size slide

  2. © JAMF Software, LLC
    LDEPNAJPFDD
    Presentation agenda:

    • The recent past (Imaging)

    • What happened? It happened…

    • Options we considered

    • Find the process

    • What we built

    • What’s next?

    View full-size slide

  3. © JAMF Software, LLC
    UArts at a Glance
    • Approximately 1,800 students

    • 6 Academic buildings

    • Over 200 “student-facing” public Macs

    • Offices, faculty/staff, Students (BYOD) — 97% Macs

    • Computers range from 2009-2018 models

    • On-Prem Jamf Pro since 2012

    • Over 1,700 managed systems

    View full-size slide

  4. © JAMF Software, LLC
    Where did we start?
    Let’s go back in time a few years..er..months…weeks?

    View full-size slide

  5. © JAMF Software, LLC
    Imaging… (not too long ago)
    ~$ sudo bless --netboot --nextonly --server bsdp://

    ~$ sudo shutdown -r now

    View full-size slide

  6. © JAMF Software, LLC
    Imaging… (not too long ago)
    Send command

    or set policy…

    Go home…

    Have beverage!

    View full-size slide

  7. © JAMF Software, LLC
    Imaging… (not too long ago)
    Send command or

    Set policy….

    Go home…

    Have beverage!

    View full-size slide

  8. © JAMF Software, LLC
    And then it happened…
    You all know what I’m talking about…

    View full-size slide

  9. © JAMF Software, LLC
    It happened
    “Apple doesn't recommend or support monolithic
    system imaging as an installation method,
    because the system image might not include
    model-specific information such as firmware
    updates.”

    Apple, https://support.apple.com/en-us/HT208020
    (Obtained 8/7/18)

    View full-size slide

  10. © JAMF Software, LLC
    User-Approved Kernel Extension
    Loading (UAKEL, Ukulele)

    View full-size slide

  11. © JAMF Software, LLC
    User-Approved MDM (UAMDM)

    View full-size slide

  12. © JAMF Software, LLC
    Apple T2 chip/Secure Boot
    “Secure Boot offers three settings to make sure
    that your Mac always starts up from a legitimate,
    trusted Mac operating system…Full Security is the
    default Secure Boot setting…”

    Apple, https://support.apple.com/en-us/HT208330
    (Obtained 8/7/18)

    View full-size slide

  13. © JAMF Software, LLC
    Is imaging dead?
    Let’s google!

    View full-size slide

  14. © JAMF Software, LLC

    View full-size slide

  15. © JAMF Software, LLC

    View full-size slide

  16. © JAMF Software, LLC

    View full-size slide

  17. © JAMF Software, LLC

    View full-size slide

  18. © JAMF Software, LLC
    ^
    MOSTLY
    TM

    View full-size slide

  19. © JAMF Software, LLC
    So, what are we going to do?
    -Me, 2017

    View full-size slide

  20. © JAMF Software, LLC
    Option 1: Stay on 10.12

    + Most of our software works fine on 10.12

    + Our current workflow works fine

    - Security Updates will eventually stop

    - New Machines will come with 10.13

    - Some Apple software already updated to 10.13 only

    Option 2: In-Place Upgrade

    + Quick process

    + No more imaging at all on public systems

    - Computers will have leftover bits from software

    - A lot more manual work than desired

    View full-size slide

  21. © JAMF Software, LLC
    Option 3: In-place Upgrade then image in future

    + Firmware is installed at upgrade

    + Workflows are already good

    + Same issues as Option 2 (leftovers, more work)

    - UAMDM will not automatically work

    - UAKEL will not work until we manually allow MDM

    (AV software, sound drivers, etc.)

    View full-size slide

  22. © JAMF Software, LLC
    Really, what are we going to do?
    -Also me, 2018

    View full-size slide

  23. © JAMF Software, LLC
    Apple School

    Manager
    Jamf Pro
    =

    Device Enrollment
    +

    Device Enrollment
    The Tools

    View full-size slide

  24. © JAMF Software, LLC
    SplashBuddy DEPNotify
    + Beautiful/Informative UI

    + Lots of functionality

    + Allowed User Input

    - More setup required

    - More info than we need
    + Highly-Customizable UI

    + Really Simple Setup

    - No User Input
    And then came Frederico Deis (@fgd)
    + User Input!

    View full-size slide

  25. © JAMF Software, LLC
    • Reads input echoed into log file

    • Input sets up UI and controls flow

    • All UI aspects are controllable
    echo "Command: MainTitle: New Mac Setup" >> $DNLOG
    echo "Command: Image: /var/tmp/your-logo.png” >> $DNLOG
    echo "Command: WindowStyle: NotMovable" >> $DNLOG
    echo "Command: ContinueButtonRegister: Begin" >> $DNLOG
    echo "Status: Please click the button below..." >> $DNLOG
    DEPNotify

    View full-size slide

  26. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get
    added to DEP then
    assigned to jamf
    • Old machines get
    wiped via internet
    recovery or policy
    Deployment
    • Boot machines to
    Setup Assistant
    • Install Mobile Config
    • Install software
    based on cohort
    (machine type)
    Assignment
    • Rename machine
    and assign to user
    • Enter Asset Tag
    • Give to user
    • Enjoy a drink

    View full-size slide

  27. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get
    added to DEP then
    assigned to jamf
    • Old machines get
    wiped via internet
    recovery or policy
    Deployment
    • Boot machines to
    Setup Assistant
    • Install Mobile Config
    • Install software
    based on cohort
    (machine type)
    Assignment
    • Rename machine
    and assign to user
    • Enter Asset Tag
    • Give to user
    • Enjoy a drink

    View full-size slide

  28. © JAMF Software, LLC
    Preparation…
    New Machines

    • Assign to MDM

    • Setup Prestage

    • Assign Devices

    to Prestage

    View full-size slide

  29. © JAMF Software, LLC
    Preparation…
    New Machines

    • Assign to MDM

    • Setup Prestage

    • Assign Devices

    to Prestage

    View full-size slide

  30. © JAMF Software, LLC
    Preparation…
    Existing Machines (APFS)

    • Package Installer

    • Script with
    ‘eraseinstall’ and
    ‘nointeraction’ flags

    • Make Policy
    #!/bin/bash
    /Applications/Install\ macOS\ High\ Sierra.app/Contents/Resources/
    startosinstall --applicationpath "/Applications/Install macOS High Sierra.app"
    --rebootdelay 30 --nointeraction $4 <—For additional flags!

    View full-size slide

  31. © JAMF Software, LLC
    Preparation…
    Existing Machines (HFS)

    • Internet Recovery!

    View full-size slide

  32. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get
    added to DEP then
    assigned to jamf
    • Old machines get
    wiped via internet
    recovery or policy
    Deployment
    • Boot machines to
    Setup Assistant
    • Install Mobile Config
    • Install software
    based on cohort
    (machine type)
    Assignment
    • Rename machine
    and assign to user
    • Enter Asset Tag
    • Give to user
    • Enjoy a drink

    View full-size slide

  33. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get
    added to DEP then
    assigned to jamf
    • Old machines get
    wiped via internet
    recovery or policy
    Deployment
    • Boot machines to
    Setup Assistant
    • Install Mobile Config
    • Install software
    based on cohort
    (machine type)
    Assignment
    • Rename machine
    and assign to user
    • Enter Asset Tag
    • Give to user
    • Enjoy a drink

    View full-size slide

  34. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get
    added to DEP then
    assigned to jamf
    • Old machines get
    wiped via internet
    recovery or policy
    Deployment
    • Boot machines to
    Setup Assistant
    • Install Mobile Config
    • Install software
    based on cohort
    (machine type)
    Assignment
    • Rename machine
    and assign to user
    • Enter Asset Tag
    • Give to user
    • Enjoy a drink

    View full-size slide

  35. © JAMF Software, LLC
    The Process…
    Preparation
    • New machines get added to DEP
    then assigned to jamf
    • Old machines get wiped via internet
    recovery or policy
    Deploy and Assign
    • Boot machines to Setup Assistant
    • Install Mobile Config
    • Install software based on cohort
    (machine type)
    • Rename machine and assign to user
    • Enter Asset Tag

    View full-size slide

  36. © JAMF Software, LLC
    The Process…
    Enrollment Trigger
    • Install DEPNotify
    • App Package
    • Logo
    • Provisioning Script
    Run Script to do things!
    • Install Software
    • Assign computer to
    user in Jamf Pro
    • Crete local account
    • Rename computer
    • Install updates

    View full-size slide

  37. © JAMF Software, LLC
    But…we ran into issues…
    • Ran behind the login window
    • Added a “wait for dock” loop
    • Ran before user was completely
    logged in
    • Added timer
    • Still was not running every time…
    • Launch Daemon!

    View full-size slide

  38. © JAMF Software, LLC
    The Process…
    Enrollment Trigger
    • Install DEPNotify
    • App Package
    • Logo
    • Launch Daemon
    • Deployment Script
    Launch Daemon runs Script
    • Install Software
    • Assign computer to user
    in Jamf
    • Crete local account
    • Rename computer
    • Install updates

    View full-size slide

  39. © JAMF Software, LLC
    DEPNotify Package

    View full-size slide

  40. © JAMF Software, LLC

    View full-size slide

  41. © JAMF Software, LLC
    DEPNotify Package

    View full-size slide

  42. © JAMF Software, LLC

    View full-size slide

  43. © JAMF Software, LLC
    Enrollment Policy

    View full-size slide

  44. © JAMF Software, LLC
    Enrollment Policy

    View full-size slide

  45. © JAMF Software, LLC
    The Process…
    Enrollment Trigger
    • Install DEPNotify
    • App Package
    • Logo
    • Launch Daemon
    • Deployment Script
    Launch Daemon runs Script
    • Install Software
    • Assign computer to user
    in Jamf
    • Crete local account
    • Rename computer
    • Install updates

    View full-size slide

  46. © JAMF Software, LLC

    View full-size slide

  47. © JAMF Software, LLC

    View full-size slide

  48. © JAMF Software, LLC

    View full-size slide

  49. © JAMF Software, LLC

    View full-size slide

  50. © JAMF Software, LLC

    View full-size slide

  51. © JAMF Software, LLC

    View full-size slide

  52. © JAMF Software, LLC

    View full-size slide

  53. © JAMF Software, LLC

    View full-size slide

  54. © JAMF Software, LLC

    View full-size slide

  55. © JAMF Software, LLC

    View full-size slide

  56. © JAMF Software, LLC

    View full-size slide

  57. © JAMF Software, LLC

    View full-size slide

  58. © JAMF Software, LLC

    View full-size slide

  59. © JAMF Software, LLC

    View full-size slide

  60. © JAMF Software, LLC

    View full-size slide

  61. © JAMF Software, LLC
    Can I automate this for labs, etc..?
    -Also also me, 2018

    View full-size slide

  62. © JAMF Software, LLC
    HECK YEAH!
    -Me, 3 months ago

    Neil Martin’s JNRS presentation:

    https://github.com/neilmartin83/Jamf-Nation-Roadshow-London-2018

    View full-size slide

  63. © JAMF Software, LLC
    Automate it, yo!
    Extension Attribute
    Auto-Login User
    Is this a known machine?
    Public
    Office/Checkout
    Find machine type
    Ask for Input
    Yes
    No
    Do the things!

    View full-size slide

  64. © JAMF Software, LLC
    DEPNotify Package - Automated

    View full-size slide

  65. © JAMF Software, LLC

    View full-size slide

  66. © JAMF Software, LLC

    View full-size slide

  67. © JAMF Software, LLC
    DEPNotify Package - Automated
    Thanks, MacUserGenerator! (https://github.com/ninxsoft/MacUserGenerator)

    View full-size slide

  68. © JAMF Software, LLC

    View full-size slide

  69. © JAMF Software, LLC

    View full-size slide

  70. © JAMF Software, LLC

    View full-size slide

  71. © JAMF Software, LLC

    View full-size slide

  72. © JAMF Software, LLC

    View full-size slide

  73. © JAMF Software, LLC

    View full-size slide

  74. © JAMF Software, LLC

    View full-size slide

  75. © JAMF Software, LLC

    View full-size slide

  76. © JAMF Software, LLC

    View full-size slide

  77. © JAMF Software, LLC

    View full-size slide

  78. © JAMF Software, LLC

    View full-size slide

  79. © JAMF Software, LLC

    View full-size slide

  80. © JAMF Software, LLC
    Why are there two processes??
    -You, right now

    View full-size slide

  81. © JAMF Software, LLC

    View full-size slide

  82. © JAMF Software, LLC
    No…
    And that’s okay..right?

    View full-size slide

  83. © JAMF Software, LLC
    I’m not into scripting…any ideas?
    -You, right now…maybe?

    View full-size slide

  84. © JAMF Software, LLC
    https://github.com/jamfprofessionalservices/DEP-Notify

    View full-size slide

  85. © JAMF Software, LLC

    View full-size slide

  86. © JAMF Software, LLC
    The hopeful future!
    • Hope that Apple gives us a way to have 100% zero-touch

    • --eraseinstall flag

    • Skip Setup Assistant?

    • Better use of snapshots?

    • DEPNotify at login window

    • See what Jamf comes up with

    View full-size slide

  87. © JAMF Software, LLC
    Resources
    • My GitHub

    • https://github.com/jmahlman/uarts-scripts/tree/master/DEP%20Scripts

    • Updated process: https://github.com/jmahlman/DEPNotify-automated

    • DEPNotify

    • https://gitlab.com/Mactroll/DEPNotify

    • Neil Martin’s Presentation/Code from JNRS

    • https://github.com/neilmartin83/Jamf-Nation-Roadshow-London-2018

    • Jamf Professional Services DEPNotify repo

    • https://github.com/jamfprofessionalservices/DEP-Notify

    View full-size slide

  88. © JAMF Software, LL
    THANK YOU!

    View full-size slide