Ipad Woes

[pixellip]

Hi there

I've read quite a few threads on Ipads here on Edugeek........and I recognised some of the headaches we are all having in mass deploying Ipads We use Meraki here which is ok but I still can't understand ( and it's not Meraki's fault) why is it when you push an app out you have to put in a password physically on each Ipad....is this still the case? I am a bit lost with it all as someone else set them up. I heard IOS 7 ( the new update) get's rid of these issues. Can anyone chime in here please?

 

We had a problem here recently where the Ipads wouldn't go on the internet....quite a few suddenly stopped working. We locked down the Ipads by setting a proxy (pointing to a a .pac file ) ....which is fine, but when something goes wrong ( and I still can't workout what exactly) you find you are stuffed because you can't get to the network settings ( as they are locked down!). It would seem the only way of solving this is to put them through the Apple Configurator again ( but doing this you end up wiping them as they are supervised! I made that discovery one day to my disbelief when I suddenly blanked one).

 

 

Sorry this is a general post - just wanted to see what others do nowadays.......are you still using Meraki or are you deploying apps now via your Apple Server? We've bought loads of apps with redeemable codes so I'm not sure what we do if we decided to go down another path......if there is a better solution for these things...do you lock down your network settings and .pac file it in Apple Configurator?

Edited April 7, 2014 by pixellip

[SYNACK]

Starting deployment with OSX server and seem to have made it work silently but how well it persists is another story. I am hopeful but it is early days. You can apparently convert the code based licences to token ones but I am not certain. @seawolf may be able to provide a more informative answer.

[abillybob]

I just use Apple Configurator nowadays, I've been through them all Meraki, Profile Manager and another one that I forget the name of. Point being yes they all ask for passwords. iPads don't like proxy's and you will find some apps that just won't use the proxy setting so the best way is to set up a transparent proxy. I had headaches with all of them in the end and MDM's normally work better in a 1:1 environment with separate ID's per pupil, this isn't the case in most schools. Always remember anything Apple update-wise is a rumor, it's very rare Apple tell people about new features etc... So that no password prompt your asking about seems to be another rumor. I know some people that have some how got it setup but don't count on it as the people that have somehow stopped the password prompt can't remember how they have done it and cant tell you how to do it either.

 

Even Apple Configurator has it's issues but that seems the most robust option in my opinion and you may also find that now you have uploaded your codes to Meraki Apple configurator will say you have used most of those codes and you will have lost them. Oh the joys....

[pixellip]

Thanks Synack......so it's still work in progress.....hmmmmm interesting...did I read Profile Manager was a bit flaky ...( I think my colleague tried it but went back to Workgroup Manager but don't have the specifics).....

[pixellip]

Thanks abillybob.....it's a real pain here when the teachers all say 'Can I have this science app for this afternoon' and you have to go around to every Ipad ( which is bad enough ) and type the dastardly password into each one.....

 

I am scared of Apple Configurator as I wiped an Ipad last time with someone's work on it ( ok you can back it up in Itunes but when you have loads of Ipads it becomes a nightmare ).

 

The trouble with using Apple Configurator is that our Ipads all have different Apps on them.........depending on where they are........we could do a base image I suppose but it does vary ....not to mention the fact everyone seems to store all their work on them without backing them up. I am very nervous about messing with the Ipads with Apple Configurator!

Edited April 7, 2014 by pixellip

[SYNACK]

I know some people that have some how got it setup but don't count on it as the people that have somehow stopped the password prompt can't remember how they have done it and cant tell you how to do it either.

Or don't know which of the massive amounts of tweaks actually worked. I used Configurator to supervise it and then profile manager MDM with a lot of time and frustration that eventually seemed to work. I am hoping that it replicates out reliably to all the iPads when I finally get a hold of all of them.

[pixellip]

I am wondering is it better practice to set up every Ipad with it's own account? From a managerial point of view that's a nightmare but someone here in the office suggested this as well........(Icloud and security being one advantage)....anyway sorry more questions/off topic..............I was also debating whether it was better to set proxy stuff up in Meraki or to force it with Apple Configurator.

 

I don't know.... the words Meraki and Apple Configurator bring shivers to my spine.....it's not a science exactly is it....

Edited April 7, 2014 by pixellip

[SYNACK]

I am wondering is it better practice to set up every Ipad with it's own account? From a managerial point of view that's a nightmare but someone here in the office suggested this as well........(Icould and security being one advantage)....anyway sorry more questions/off topic..............I was al;so debating whether it was better to set proxy stuff up in Meraki or to force it with Apple Configurator.

 

I don't know.... the words Meraki and Apple Configurator bring shivers to my spine.....it's not a science exactly is it....

 

That's what they suggest, it is a nightmare but may work better especially if you need specific apps on specific gear.

[pixellip]

Ok thanks everyone........I suppose you are all just as much in the dark as I am ....it's trial and error isn't it....

[SovietRussia]

Profile Manager App Push does not require a user-end password as long as the device is supervised and enrolled successfully. iOS 7 brought with it new silent MDM features for 3rd parties like Meraki, but your devices MUST be supervised. The only way to supervise a device is you guessed it, using Apple Configurator.

 

I would not setup each iPad with its own account, use one single Apple ID (Works for us here, but everyones deployment scenario is different).

 

We have around 54 iPads here and before doing anything, I sat down with all the guides from Apple, Meraki etc and read about it. I learned how it worked, I learned how to tweak and fiddle until we have a perfect setup. It is a lengthy setup time but once you get them enrolled and out there, its easy.

 

Configurator to Supervise them, Profile Manager to manage them - and with the new VPP features from Apple, VPP purchases now automatically show up in my Profile Manager Apps menu ready to push to what group, device or user I wish.

 

(And you have to get your head around the fact that - yes, most features are not supported by Apple and manual work is required)

[SYNACK]

Profile Manager App Push does not require a user-end password as long as the device is supervised and enrolled successfully. iOS 7 brought with it new silent MDM features for 3rd parties like Meraki, but your devices MUST be supervised. The only way to supervise a device is you guessed it, using Apple Configurator.

 

I would not setup each iPad with its own account, use one single Apple ID (Works for us here, but everyones deployment scenario is different).

 

We have around 54 iPads here and before doing anything, I sat down with all the guides from Apple, Meraki etc and read about it. I learned how it worked, I learned how to tweak and fiddle until we have a perfect setup. It is a lengthy setup time but once you get them enrolled and out there, its easy.

 

Configurator to Supervise them, Profile Manager to manage them - and with the new VPP features from Apple, VPP purchases now automatically show up in my Profile Manager Apps menu ready to push to what group, device or user I wish.

 

(And you have to get your head around the fact that - yes, most features are not supported by Apple and manual work is required)

 

You can push to groups too but that increases the workload and none of the steps are really that evident in the non-existent documentation from Apple, they like to keep everything a secret it seems.

[Brimstone]

You can push to groups too but that increases the workload and none of the steps are really that evident in the non-existent documentation from Apple, they like to keep everything a secret it seems.

 

Non existent documentation?

as in here>

http://help.apple.com/profilemanager/mac/3.0/#apd05B9B761-D390-4A75-9251-E9AD29A61D0C

 

or here>

Unable to use Apple Push Notification service (APNs)

 

or here>

Unable to use Apple Push Notification service (APNs)

[seawolf]

Starting deployment with OSX server and seem to have made it work silently but how well it persists is another story. I am hopeful but it is early days. You can apparently convert the code based licences to token ones but I am not certain. @seawolf may be able to provide a more informative answer.

 

Here's the info on migrating redemption codes (which can be used both in Configurator and most MDMs, but require "gifting" of the license to the Apple ID it's redeemed on) and managed distribution (which can't be used with Configurator, but allow you to reclaim app licenses and to easily do OTA silent installs).

 

Volume Purchase Program: Migrating from redemption codes to managed distribution

[seawolf]

Profile Manager App Push does not require a user-end password as long as the device is supervised and enrolled successfully. iOS 7 brought with it new silent MDM features for 3rd parties like Meraki, but your devices MUST be supervised. The only way to supervise a device is you guessed it, using Apple Configurator.

 

I would not setup each iPad with its own account, use one single Apple ID (Works for us here, but everyones deployment scenario is different).

 

We have around 54 iPads here and before doing anything, I sat down with all the guides from Apple, Meraki etc and read about it. I learned how it worked, I learned how to tweak and fiddle until we have a perfect setup. It is a lengthy setup time but once you get them enrolled and out there, its easy.

 

Configurator to Supervise them, Profile Manager to manage them - and with the new VPP features from Apple, VPP purchases now automatically show up in my Profile Manager Apps menu ready to push to what group, device or user I wish.

 

(And you have to get your head around the fact that - yes, most features are not supported by Apple and manual work is required)

 

+1 on this.

 

There is an article on using AirWatch for silently pushing apps (free and paid), but these steps apply to any MDM that supports OTA. One thing to note is that it is not necessary to actually assign the user in MDM to every iPad you want to push apps to, but you can just have them signed into the same Apple ID and have the automatic install of apps turned on for all of the iPads. Accepting the invitation on the single iPad associated with the user in the MDM and installing an App will install it on all of them. Either way works though.

 

How to silently push free apps using VPP, Managed Distribution, Supervision and AirWatch | Enterprise iOS

[seawolf]

I am wondering is it better practice to set up every Ipad with it's own account? From a managerial point of view that's a nightmare but someone here in the office suggested this as well........(Icloud and security being one advantage)....anyway sorry more questions/off topic..............I was also debating whether it was better to set proxy stuff up in Meraki or to force it with Apple Configurator.

 

I don't know.... the words Meraki and Apple Configurator bring shivers to my spine.....it's not a science exactly is it....

 

I would NOT setup every iPad with its own Apple ID, not for iPads you are managing in trolley/class set that is. It will cause you headaches. I would recommend having one Apple ID per trolley/class set though as this allows you to push different apps to different sets of iPads depending on need.

 

If you're talking 1:1 iPads, then they need to have individual Apple IDs and each user will need to accept the MDM invite before apps can be pushed OTA.

[Brimstone]

+1 on this.

 

There is an article on using AirWatch for silently pushing apps (free and paid), but these steps apply to any MDM that supports OTA. One thing to note is that it is not necessary to actually assign the user in MDM to every iPad you want to push apps to, but you can just have them signed into the same Apple ID and have the automatic install of apps turned on for all of the iPads. Accepting the invitation on the single iPad associated with the user in the MDM and installing an App will install it on all of them. Either way works though.

 

How to silently push free apps using VPP, Managed Distribution, Supervision and AirWatch | Enterprise iOS

 

So you turn on automatic install on each iPad, you have lets say 100 iPads and you push out 3 apps to all the iPads. Pages,Keynote and Numbers for example.....You now have 300 apps all trying to download at the same time, which will in many schools completely cripple the wifi and internet access

[seawolf]

So you turn on automatic install on each iPad, you have lets say 100 iPads and you push out 3 apps to all the iPads. Pages,Keynote and Numbers for example.....You now have 300 apps all trying to download at the same time, which will in many schools completely cripple the wifi and internet access

 

Only if someone were silly enough to either place 100 iPads onto a single Apple ID (we limit it to 32, or 1 full trolley) AND they didn't use QoS/Bandwidth Shaping on App Store downloads to prevent this very thing from occurring (which we do).

[abillybob]

I did get Profile Manager to silently install apps though it has it's problems. All our iPads were fully supervised and all setup in the exact same way I had around 40 iPads that would sucessfully silently install apps and I have other that wouldn't, they where all the same and after months with Apple Support they couldn't even figure out what was wrong and told me to go back to configurator as profile manager has known bugs such as these. We also had a problem where apps would download and install on 1 iPad but wouldn't install on the next and became a greyed out app on the home screen, again Apple, LEA and Smoothwall couldn't understand why it was working on some but not others.

 

I would suggest you trial it on a few iPads before doing the lot, I would have to say Profile Manager seems the best bet, although from my personal experience I think it's a pile of cr*p. You may also want to call your LEA and make sure that downloads work as there maybe a caching server on your LEA's network which will cause soooooooooo many problems if you share the same public IP with everyone else.

 

I'd take what some people say on here with a pinch of salt, I find there's normally a big argument regarding the whole Apple and Microsoft and Linux thing... it's all about finding what works best for your school I can only advise you on my personal experience and hope it helps. Some people will say "I was wrong" or "I didn't do it properly" blah blah that's fine. I've spent over 8 months and had formal training with these iPads and sometimes it's fact they just don't work properly it's a shame because they have the potential to be such nice and cool devices to be used in a school though all they seem to bring with them is frustration in my opinion.

 

Hope this helps buddy and good luck!

[Brimstone]

Only if someone were silly enough to either place 100 iPads onto a single Apple ID (we limit it to 32, or 1 full trolley) AND they didn't use QoS/Bandwidth Shaping on App Store downloads to prevent this very thing from occurring (which we do).

 

Whilst I'm sure you are managing this process and understand the limits on using Automatic downloads, just thought it was worth pointing out that this deployment scenario doesn't scale well. Without those limits being pointed out other people reading this would just assume you can do the same with every iPad.

 

No criticism was intended....

[seawolf]

Whilst I'm sure you are managing this process and understand the limits on using Automatic downloads, just thought it was worth pointing out that this deployment scenario doesn't scale well. Without those limits being pointed out other people reading this would just assume you can do the same with every iPad.

 

No criticism was intended....

 

No, It was a point worth pointing out, and no criticism taken. I've recommended having one Apple ID per trolley on this thread and others, which I think is a good way to do it (for most situations anyway). It's also good to spread out the apps a bit when pushing them out and use QoS as well. I shouldn't assume people will realise they need to do these things as standard practice.

[seawolf]

We also had a problem where apps would download and install on 1 iPad but wouldn't install on the next and became a greyed out app on the home screen, again Apple, LEA and Smoothwall couldn't understand why it was working on some but not others.

 

I could be wrong, but I do suspect that this has something to do with the LEA (shared WAN IP) or some other aspect of this arrangement. Network or DNS issues will definitely cause problems with APN, OTA app installs, etc. Many of the people with these sorts of issues I see appear to be using shared WAN services.

 

I would suggest you trial it on a few iPads before doing the lot...

 

Good advice this part.

 

You may also want to call your LEA and make sure that downloads work as there maybe a caching server on your LEA's network which will cause soooooooooo many problems if you share the same public IP with everyone else.

 

Yes, that's advisable. These sort of network setups could definitely cause problem when you don't truly control your own network.

 

... it's all about finding what works best for your school

 

Absolutely.

[abillybob]

I could be wrong, but I do suspect that this has something to do with the LEA (shared WAN IP) or some other aspect of this arrangement. Network or DNS issues will definitely cause problems with APN, OTA app installs, etc. Many of the people with these sorts of issues I see appear to be using shared WAN services.

 

Yeah mate our LEA provide a shared WAN this could be part and parcel of the problem.

[pixellip]

This thread is proving very informative thanks everyone.....it's interesting to hear your experiences. Sometimes with Meraki ( and this is not singling them out ) the apps just don't get pushed out to Ipads even thought you tell it to do so - sounds like a similar issue abillybob has with his silent installs.....I am going to have to have a think about all your comments as we have redeemed all our codes ( so if we move over to server based App installation with Profile Manager then as I understand we can't move them over) - I'll have to have a read about it from the links you have sent..

It would be nice to be able to use Apple Configurator and have the same Apps on every Ipad ( like you would image a pc ) but in the real world this isn't going to happen and people ask for odd extra apps from time to time...so the Ipads are different....

[abillybob]

This thread is proving very informative thanks everyone.....it's interesting to hear your experiences. Sometimes with Meraki ( and this is not singling them out ) the apps just don't get pushed out to Ipads even thought you tell it to do so - sounds like a similar issue abillybob has with his silent installs.....I am going to have to have a think about all your comments as we have redeemed all our codes ( so if we move over to server based App installation with Profile Manager then as I understand we can't move them over) - I'll have to have a read about it from the links you have sent..

It would be nice to be able to use Apple Configurator and have the same Apps on every Ipad ( like you would image a pc ) but in the real world this isn't going to happen and people ask for odd extra apps from time to time...so the Ipads are different....

 

If you're planning on moving to Profile Manager you need to get your codes converted to licenses which is perfectly fine by calling Apple's VPP team although be warned once codes are converted to licenses they can't be converted back to codes again! Don't disregard Apple Configurator so strongly it's about managing the time frame your have to do them so for example explaining in a staff meeting you will only update the iPads once every half term and you can't just do the odd one here and there. Regarding Meraki not pushing out apps it's exactly what it did to me it wouldn't push them out properly or it would to some not to others, my OCD was going mental!!!

 

Anywhoo wish you all the best if you're stuck on anything don't hesitate to PM me!

[sallys1305]

Hi - we use meraki - annoying as hell we trialled it with our 24 iPads but didn't realise that we now cannot move the £900 of apps over to apple configurator without repurchasing !! So I am talking to meraki atm to see if we can streamline / understand why the management console/mdm on iPads and what is actually downloaded don't all appear the same and why apps download fine on 15 iPads in a group but not on the last one ..... concerned that configurator seems to be problematic as well was hoping for a solution !! Meraki was chosen because was hoping to use it for androids/chrome books and iPads ...... hoping