In the 10th and final part of the LANDESK Mac Management video series, I’ll show you how to add a “bare metal” record into the LANDESK console so that you can target your Provisioning Template created in the 9th video to a machine not currently being managed by LANDESK. This is a good example of what you could do when you buy a new machine and want to deploy an image to it.
In my example template, I will deploy my latest El Capitan image built with AutoDMG, I’ll deploy TextWrangler, I’ll apply a configuration profile to adjust the Doc and to bind the machine to my domain, I’ll also name the machine and enable Core Storage. All of this is done with my template, which specifies in which order they are applied.
Also, by way of note, the process to target a managed device inside of LANDESK is very similar to what is shown in this video, you simply need to drag the machine from your All Devices list as opposed to using the bare metal machine method.
In part 9 of the LANDESK Mac Management video series, we more or less get to bring together everything we’ve done up to this point, agent deployment, software deployment, configuration profile deployment which can include binding the machine to the domain , patch deployment and even FileVault deployment; all in a chained template experience when we provision a new device.
I created slides for our Interchange event explaining each step of the provisioning template build process, available here, but for many of you, the video below may be more beneficial.
In part 8 of the LANDESK Mac Management video series, we’ll download a couple of freeware utilities to assist us in creating a gold image for Provisioning. The first tool we’ll use is AutoDMG. This is an image builder tool created by Per Olofsson and can be downloaded from https://github.com/MagerValp/AutoDMG/releases. AutoDMG builds an actual image file directly from an OS X installer, precluding the need to build out an actual machine and capture the image from it. There are a lot of benefits in going with this approach and is our recommended approach at LANDESK.
Furthemore, AutoDMG, as part of the build process, allows you to bundle in deployment packages as well. While LANDESK recommends that you exclude bundling software packages directly into your image in most scenarios, there are a couple of configuration packages you may want to bundle in order to make the provisioning process more streamlined. One of those packages might be the creation of an admin account and setting it to auto-login. CreateUserPKG, again another utility written by Per Olofsson, is one I recommend. The video walks you through creating an admin account and setting it to autologin. See http://magervalp.github.io/CreateUserPkg/ for the utility download.
You may also want to track down other configuration packages to assist you as well, such as Rich Trouton’s recommendations on disabling Apple’s Diagnostics and Usage utility (https://derflounder.wordpress.com/2014/11/21/controlling-the-diagnostics-usage-report-settings-on-yosemite/) or the iCloud confirmation window (https://derflounder.wordpress.com/2014/10/16/disabling-the-icloud-and-diagnostics-pop-up-windows-in-yosemite/).
In part 7 of the LANDESK Mac Management video series, we’ll prepare for an operating system deployment by creating a NetBoot image, the equivalent of a WinPE image for the Windows world, to boot the OS X devices into a pre-boot environment. The video will demonstrate how to use Apple’s System Image Utility and LANDESK’s Startup Disk Stamper to accomplish this task.
Hopefully if you’ve arrived to this point, you’ve already built out the necessary preferred package server, built your NBI file, configured the LANDESK Core server with the NBI details, deployed the service to capture the NetBoot request, blessed your El Capitan clients, created and captured your gold image and it’s finally time to reap the benefits.
Specify the path to save your Mac and Windows image files. The path should be smb://fqdn/share/filename.dmg for an OS X image or smb://fqdn/share/filename.image for a Windows image. Just make sure your preferred server credentials have access to the shares.
Ensure the Netboot action has the Server variable set to your PXE rep or OS X server unless you’re using the USB NetBoot environment. The server URL format should be bsdp://ipaddress to ensure compatibility with El Capitan’s SIP.
If deploying a Mac and Windows image, adjust the partition sizes in the Create Partitions actions under Pre-OS Installation. You can set the sizes in percentages so the template can work on any HD size.
Set the correct partition identifier on the Deploy image action(s) under OS installation inside the Command-line parameters box. Make sure you do this for all Deploy Image actions.
For convenience, the action can be renamed in the properties panel if you have multiple images being deployed.
If deploying to an unmanaged machine(s), create a record for the new device(s) in the Network View > Configuration > Bare Metal Server tool. See the help file for more info.
In order to deploy an image with LANDESK Management Suite, at least one preferred package server must be created. The Provisioning process within LDMS uses the user account and password supplied for the preferred server to access the share and to write the image files to the shares specified in your capture and deploy templates.
Enter “Imaging” for the share alias, and navigate to the C:\Distribution\Imaging directory created in Step 1.
Enable directory browsing by selecting the ExampleShare folder in the navigation frame and then clicking the “Directory Browsing” icon and clicking “Enable” in the right-hand pane.
Navigate to the C:\Distribution\Imaging directory and right-click on the Imaging share.
Click “Permissions” and give a domain account account Full Control access to the share. This will be the account used when the provisioning process needs to access or write to the share.
Ensure that the same account is also given Full Control on the Security tab.
Enter Server Name and Credentials to the newly created Imaging share on the Preferred Server. This needs to be the same account supplied in Step 4 in the UNC Share area.
Enter the IP address ranges for the clients subnet(s) that this preferred server will serve.
Imaging a device has changed dramatically over the years. In the early 2000’s one would load everything possible on the image in effort to reduce calls the number of software requests the HelpDesk would receive post deployment.
The term bloated is often used for such corporate images. Not only did it take forever to deploy the gargantuan images, conflicts between unnecessary and unused software applications were extremely prevalent.
LANDESK recommends the complete opposite approach in 2016. When creating your corporate gold image, leave it as plain and as vanilla as possible. Build all customizations into your provisioning templates and inject those customizations during the post-provisioning process.
So doing will allow you to easily update and tweak your applications and customizations realtime, ensuring each device configured contains the latest and greatest.
Install the latest LANDESK agent (9.6 SP2 or greater). Unlike the Windows process, a LANDESK agent is required to be on the gold image.
Note: This IP address must match the exact address used to bless your El Capitan devices in order to NetBoot the device remotely. See http://appleintheenterprise.com/2016/02/09/blessing-an-el-capitan-device-for-netbooting/ for more info.
Select the Reboot/shutdown action and select OK.
In OS X 10.11 El Capitan, Apple has introduced their new System Integrity Protection feature which affects how you are able to NetBoot devices. If you think you’ll have the need to NetBoot a device anytime in the future, after it leaves your hands, you’re going to need to “bless” it with your sanctioned NetBoot servers prior to it going out the door.
Blessing a device with a NetBoot server is easy and only takes a couple of minutes per device, however, it is very hands on and will be extremely time consuming if you have a ton of devices – especially if they’re already in the field so plan accordingly prior to upgrading to El Capitan.
Press and hold the keys Command (⌘)-R immediately after you turn on your Mac and hear the startup sound. Keep holding until you see the progress bar.
When the device boots into the Recovery Mode, you should see a Mac OS X Utilities toolbar. If you end up back to your typical login screen, reboot and try hitting the Command (⌘)-R keys again.
In order to image a Mac device, you need to boot it into a pre-boot environment that is capable of making system level changes to the hard drive. To make these types of changes, the primary operating system cannot be mounted and therefore an alternative boot environment is required for the device.
The alternative boot environment for OS X is called NetBoot. While you can take a NetBoot Image file, put it on a USB stick and plug that stick directly into a Mac, such a method requires physical access to the device and is therefore not as desirable.
Alternatively, to forgo the need to have physical access to a device, you can create a service on the network that will listen for a Mac client to make a NetBoot request and then tell the client where to download the NetBoot Image file.
LANDESK has built this service into its PXE Representative technology that is also used for booting Windows devices into its equivalent pre-boot environment WinPE.
The steps below will walk you through configuring your core server with the information regarding the location of the NBI file so when the PXE representative service is established, it will be able to appropriately respond with the information the Mac will need to boot the NetBoot Image file.
Logon to the device from which you created the LANDESK NBI file outlined previously.
Supply the HTTP path to your Netboot image files and then click Browse to select your appropriate NBI.
Ensure your HTTP share has been properly enabled to support files with no extensions as outlined in the link in step 2.