Imaging Mac OS 10.13.6

[eddyc]

Hello all,

 

I'm after some help \ pointers if at all possible.

 

I have spent a couple of weeks building and perfecting our OS 10.13.6 image.

 

I have now gone to capture this on deploystudio in the usual way and cannot get it to capture.

 

I understand that the OS file format has changed. Is there any way around this?

 

Some people are saying Mac imaging is dead - Obviously visiting 200 iMacs\Macbooks to manually set them up as per this "master" isn't ideal.

 

Any pointers would be appreciated!

 

cheers, eddyc

[DalekSec]

I think (correct me if i'm wrong) the recommended practice is via an MDM and not via images now.

 

Do you use have an MDM?

[eddyc]

I think (correct me if i'm wrong) the recommended practice is via an MDM and not via images now.

 

Do you use have an MDM?

 

Yes we use Profile Manager but have found it to be limiting with regard to some of the modifications we wish to make (i.e. Custom wallpaper, suppressing Office 2016 first run, etc).

[kidpressingbuttons]

Is your mac server running high Sierra and the NetBoot set has been updated?

[eddyc]

Is your mac server running high Sierra and the NetBoot set has been updated?

 

I tried to create a new bootset on a client Mac but then couldn't move it onto the macserver as it complained about format and space issues.

 

I'm a little concerned about upgrading the server in case I am unable to image the clients. Some of the clients which are on 10.6(?) currently and broke when I upgraded the server to 10.12

 

If I can be sure that I can definitely image all of the clients to 10.13 then I will happily update the server to 10.13 too.

 

I don't want to get into a position where the server is up to date and I have a load of client machines not working.

 

Do you think that upgrading the server and boot set will work? Does it work for you?

 

Thanks, eddyc

[DalekSec]

Yes we use Profile Manager but have found it to be limiting with regard to some of the modifications we wish to make (i.e. Custom wallpaper, suppressing Office 2016 first run, etc).

 

I think that's because Apple are trying to move away from supporting an MDM and are slowly removing/hiding features.

 

Our 8 macs previously were untouched before the summer, i did a bunch of research and ended up going down the MDM route, using Mosyle and then wiping the Macs down, updating them and then applying all the restrictions. It does the things you said also like the Custom Wallpaper. In the future i would recommend going for a paid for MDM as you do get a lot more features (budget allowing of course). Definitely more so if you have a large amount of macs.

 

Even Microsoft are recommending going down the same kind of route now with Intune for windows devices. (they also support Macs but to no level of degree than the fully fledged Mac MDMs)

 

MDM is the future.

[eddyc]

I think that's because Apple are trying to move away from supporting an MDM and are slowly removing/hiding features.

 

Our 8 macs previously were untouched before the summer, i did a bunch of research and ended up going down the MDM route, using Mosyle and then wiping the Macs down, updating them and then applying all the restrictions. It does the things you said also like the Custom Wallpaper. In the future i would recommend going for a paid for MDM as you do get a lot more features (budget allowing of course). Definitely more so if you have a large amount of macs.

 

Even Microsoft are recommending going down the same kind of route now with Intune for windows devices. (they also support Macs but to no level of degree than the fully fledged Mac MDMs)

 

MDM is the future.

 

Yes that seems to be the case from what I am reading too, although I don't have the time right now to migrate the current workflow to an MDM.

 

Money is a real issue here too so I think I will have to make to with Profile Manager.

 

Does anyone have a workaround to getting this image out? I suppose I could clone to an External Hard Drive and then restore that to each machine as a dirty fix.

 

 

I did setup a spare iMac with OS 1.13.6 and Server (to use for imaging without breaking the current Mac server) but have now discovered that in a new installation NetBoot is deprecated so I cannot publish the Netboot set for the clients. arrrgh!

[kidpressingbuttons]

I had a mix of macs running el cap and Sierra but the latest iMacs are not backwards compatible. I had to upgrade to support the new ones.

 

Update the server and rebuild the NetBoot set on the server.

 

If you are on the latest server build then the recommended methods are MDM or looking at NetSUS!

[eddyc]

I had a mix of macs running el cap and Sierra but the latest iMacs are not backwards compatible. I had to upgrade to support the new ones.

 

Update the server and rebuild the NetBoot set on the server.

 

If you are on the latest server build then the recommended methods are MDM or looking at NetSUS!

 

So after you upgraded the server and rebuilt the bootset, where you able to image 10.13.6 clients (both capture and deploy).

 

I am happy to look at MDM going forward but it isn't practical for this summer to be honest. I've invested a lot of time in the new master and time is pressing on so don't think I could complete our windows 10 rollout and convert\rebuild the Mac image again before the end of the break.

 

Cheers,eddyc

[Brimstone]

If you try and stick with PM and Deploy Studio you will never get a stable image and will get countless issues.

 

This is the future of managing Macs and iOS....

 

https://www.jamf.com/blog/why-the-device-management-solution-you-choose-matters/

[kidpressingbuttons]

Hi- sorry busy day.

 

I did fail to mention that profile manager just refused to work with high Sierra. Whatever I tried. Only just came back to me.

 

Sign up for free Mosyle and get started in there. The profiles are extremely similar.

 

I was on the free version for a while and it was brilliant. Have now paid for full.

[eddyc]

Hi- sorry busy day.

 

I did fail to mention that profile manager just refused to work with high Sierra. Whatever I tried. Only just came back to me.

 

Sign up for free Mosyle and get started in there. The profiles are extremely similar.

 

I was on the free version for a while and it was brilliant. Have now paid for full.

 

Thanks for the link. I’ll have to look into the cost of JAMF for the future. I’ve started rebuilding the image back on 10.12.6 for the interim to get the summer out of the way.

[eddyc]

Hi- sorry busy day.

 

I did fail to mention that profile manager just refused to work with high Sierra. Whatever I tried. Only just came back to me.

 

Sign up for free Mosyle and get started in there. The profiles are extremely similar.

 

I was on the free version for a while and it was brilliant. Have now paid for full.

 

Thanks, I did take a look at Mosyle but didn’t actually do anything with it once I had signed up. How did that compare to JAMF? Both feature and price wise?

[eddyc]

If you try and stick with PM and Deploy Studio you will never get a stable image and will get countless issues.

 

This is the future of managing Macs and iOS....

 

https://www.jamf.com/blog/why-the-device-management-solution-you-choose-matters/

 

Thanks for the link. I’ll have to look into the cost of JAMF for the future. I’ve started rebuilding the image back on 10.12.6 for the interim to get the summer out of the way.

[kidpressingbuttons]

Don’t think the costs are much different. They all do the same thing in their own way. I love mosyle! We are an Apple school/ regional training centre so being able to manage everything centrally is a big win and staff here really see the difference between it and profile manager.

[rad]

Which MDM are most popular.

 

Background here is we have 15 or so iMacs, bought and setup in 2013 using workgroup manager / profile manager. Now we have 4 new iMacs to set up but can’t deploy the old image as above, it’s not backward compatible. I’m clueless, don’t want to break the current setup and don’t know how to set up the new one. (It was all done for us)

[Arthur]

MDM is the future.

+1. All of Apple's new Macs from the iMac Pro onwards have secure boot enabled out of the box which makes an MDM the only realistic option to manage these devices.

 

http://michaellynn.github.io/2018/07/27/booting-secure

 

Your new provisioning reality

What do the changes effectively mean to you - the person(s) responsible for Mac setup workflows?

 

Secure Boot devices with T2 chips, fresh out of the box:

 

• Are configured at Full Security mode
  
• They do not netinstall / netboot. (NetSUS, bsdpy, Server.app’s NetInstall service - none will work)
  
• You can’t use the N key at startup to boot over the network to an imaging workflow
  
• You can’t use the Option key at startup to select a network boot target
  
• They do not boot from external media (USB, Thunderbolt, etc.)
  
• You can’t use the Option key at startup to select a different attached disk to boot from
  

Unless your device provisioning/configuration workflow is based on the Device Enrollment Program (DEP), most of you with “light touch” automated provisioning workflows will find they’re now incompatible with T2 devices. (There are a few exceptions, I’ll cover them below)

 

[...]

 

Nobody but Apple knows will be next. But they do, in the meantime, provide guidance.

 

And their guidance is that you should be looking at DEP/MDM-based workflows for your provisioning. The latest operating system versions already include some features (like managing automatic kernel extension loading) that can only be done remotely and adjusted post-deployment via MDM deployed profiles. SIU had the capability to make network bootable images that ran scutil to reconfigure the trust settings, but all of that is moot now that Secure Boot devices don’t network boot at all. MDM is the only game.

 

If you or your organization feel the need to image devices, then do so.

 

Just know why you’re doing it. Simply putting files on disk isn’t a good enough reason. MDM or MDM-deployed agents can do that.

 

And be aware it is very very very likely not a long term solution.

 

You should definitely, in the meantime, be getting MDM going in your environment.

Edited August 14, 2018 by Arthur

[Stevecee]

Which MDM are most popular.

 

Background here is we have 15 or so iMacs, bought and setup in 2013 using workgroup manager / profile manager. Now we have 4 new iMacs to set up but can’t deploy the old image as above, it’s not backward compatible. I’m clueless, don’t want to break the current setup and don’t know how to set up the new one. (It was all done for us)

 

We have about 600 devices (approx 150 Mac OS), we use Zuludesk and have found it fine for High Sierra. We have just upgraded to High Sierra either bu using an in place update or by restoring and adding apps and settings bu MDM - all worked fine!

 

As the APIs are clearly controlled by Apple, I would guess they all do pretty much the same and would cost about the same in education (£5 per device), I have used JAMF in the past and although their annual costs are similar they do insist on having an onsite setup day for both IOS and Mac OS even if you have one up and running! - these cost around £1500 or more. I am happy with Zuludesk but will admit I found JAMF slightly better at keeping up to date as new features are released by Apple and also that they do have a more comprehensive feature list for Mac OS.

 

HTH

 

Steve

[kidpressingbuttons]

Just a FYI- netinstall is still available on the latest version of server- you need to re-enable it from the view menu.

Just built a new server and it is working.

 

Obviously not a long term solution but will work for the time being

Edited August 24, 2018 by kidpressingbuttons