Tag Archives: Macintosh

JAMF – DEP and VPP Certificate Renewal

For the JAMF server we have yearly renewing certificates that connect our JAMF server to Apple’s servers for our hardware (DEP) and software (VPP) purchases.

Here is how I did this process in May 2017:

  • 1) Log into our JAMF server ( https://casper.williams.edu:8443 ) with a full admin account
  • 2) Navigate to Management SettingsGlobal SettingsDevice Enrollment Program
  • 3) Click on Public Key to download our JSS key to the local computer
  • 4

  • ) Sign into our Apple School Manager account at https://school.apple.com/ with our AppleID of: [email protected]
  • 5) Click on MDMUpload Key
  • 6) Once uploaded you should be able to click on Get Token to download the new token
  • 7) Go back to our JAMF ServerManagement SettingsGlobal SettingsDevice Enrollment Program
  • 8) Click on Williams JSS and then Edit
  • 9) Then Upload Server Token

Remain logged into our JAMF server to update the VPP Certificate:

  • 1) Log into the [email protected] AppleId at the website: https://volume.itunes.apple.com/
  • 2) In the upper right corner click on [email protected] for a drop down menu, select Account Summary
  • 3) In the MDM section, click on Download Token
  • 4) While still logged into our JAMF Server navigate to Management
  • SettingsGlobal SettingsVPP Accounts

  • 5) Click on Williams VPP then Edit
  • 6) Finally click on “Renew Service Token” to upload the token you just downloaded from Apple

Phew. Done.
Log out of all accounts.

Mac – Active Directory Debugging and Logs

To debug an Active Directory binding issues

First set the directory error logging to “debug” with:
sudo odutil set log debug

then try the join …

set the error logging back to “error” with:
sudo odutil set log default

You’ll find the log file in:
/var/log/opendirectoryd.log

An excellent reference article with additional tips is at:
https://derflounder.wordpress.com/2012/03/29/diagnosing-ad-binding-problems-from-the-command-line/

JAMF – Create Mac OS to deploy

To create an OS package to deploy one could:
1) download the OS installer from the App Store
2) this will put the installer in the /Applications folder
3) once the installer is completely downloaded it will start automatically so “quit” the installer from the file menu
4) Open AutoDMG and drag the installer from the /Applications folder to the AutoDMG window.
5) Add applications like GarageBand, iMovie, Keynote, Numbers, and Pages which are pre-installed on all new Macs but are left out of the Mac OS installer for some reason
6) Build the configuration to save the DMG file
7) Open Casper Admin and drag that DMG file into the window
8) Set the package priority to 1 so it installs first
9) Create a new configuration with this OS install and other things like casper enrollment

A helpful website with pictures is available at:
http://www.theinstructional.com/guides/build-deploy-os-x-images-with-autodmg

Mac – iWork – preinstalled on all new Macs

According to this link:
https://discussions.apple.com/thread/7708588?start=0&tstart=0

iWork does not come with Sierra but is preinstalled on all new Macs. Therefore, if deploying a Mac with a format and re-image process particularly with Casper imagine, one should decide wether or not to include the iWork applications (Keynote, Pages, Numbers) in the base OS image.

Mac – El Capitan – netboot servers must be trusted

The new System Integrity Protection, SIP for short, which is part of Mac OS 10.11 (El Capitan) requires you to set your netboot servers as “trusted”. For details see: https://support.apple.com/en-us/HT205054

I added a DeployStudio script to run the appropriate commands to add our netboot servers to the NVRAM whitelist (See Below). This script will need to be updated with the new IP addresses once I get those later this summer. The script should be included in workflows just after the reimage and should NOT be postponed till first boot. The csrutil executable is not available with El Capitan booted. It is only available in the pre-boot image restore environment.

#!/bin/sh

echo "SetNetBootTrusted.sh - Start - Lynna, July 5 2016 ("`date`")"

/usr/bin/csrutil netboot add 137.165.27.37
/usr/bin/csrutil netboot add 137.165.27.27

echo "SetNetBootTrusted.sh - end"

exit 0