3s-gtech Posted August 30, 2023 Posted August 30, 2023 We currently have 50 or so Macs, bound tom AD and managed with Profile Manager. This solution is end of life. I'd like to use a similar but more modern approach to managing our Macs - user logs in at logon screen with their details (local AD, Azure, whatever) and gets settings issued by Jamf School. A lot of the Jamf documentation revolves around assigning the device to the user - that won't be happening. I just want them to log on. I have Azure linked to Apple School Manager. I have ASM linked to Jamf School (in some order). How do I fairly simply achieve what I need? Is it a case of using the LDAP setup with Jamf School, and if so how does it link user profile settings (like restrictions etc) to that LDAP user? I have looked at the documentation, but hoping someone has done the same things and can guide me a bit as I'm going in circles with what is currently rather a complex interconnected mess!
3s-gtech Posted August 31, 2023 Author Posted August 31, 2023 No one using Jamf School with shared Macs?
Brimstone Posted August 31, 2023 Posted August 31, 2023 If you are going to use Jamf School to do this just bear in mind that Jamf School only has basic controls for Managing macOS so complex printer scripts, login hooks etc may not work. To reach a Supervised state every Mac will need to be reset and wiped and enrolled into Apple School Manager for Auto Enrolment, you create the enrolment profile and assign this using Jamf School. https://learn.jamf.com/bundle/jamf-school-documentation/page/Automated_Device_Enrollment.html Whilst Jamf School supports Google and Azure AD this is at the enrolment stage where a device is assigned to a user. Users can be enabled to login to a Mac with their existing AD Credentials to create a local account, but users can not use Azure AD as this is not supported in macOS as yet, to use Azure AD to login, you will need to buy Jamf Connect licences. https://learn.jamf.com/bundle/jamf-school-documentation/page/LDAP_Authentication_Setup.html 1
3s-gtech Posted August 31, 2023 Author Posted August 31, 2023 (edited) At present, I've sacked off user based profiles and I've just enrolled the device, then logging in with an AD bound account. Jamf is then (just about) managing the settings from there. Not great, but 1000% better than broken Profile Manager so far! I saw about the enrollment stage and have adjusted my expectations accordingly. Edited August 31, 2023 by 3s-gtech
Tom_M Posted August 31, 2023 Posted August 31, 2023 At present, I've sacked off user based profiles and I've just enrolled the device, then logging in with an AD bound account. Jamf is then (just about) managing the settings from there. Not great, but 1000% better than broekn Profile Manager so far! I saw about the enrollment stage and have adjusted my expectations accordingly. Profile Manager isn't really fit for deployment - macOS Server is dead etc; so treat PM as purely (for lack of a better description) - a 'Proof of Concept' sort of thing. Purely a stepping stone to the likes of Jamf, etc (although Apple (likely!) will never admit this)!
3s-gtech Posted August 31, 2023 Author Posted August 31, 2023 That I realise - PM simply doesn't work with MacOS 10.15 or later IME, nor with iPads newer than iOS 10. As I'm pushing to MacOS 12 and beyond I need Jamf or similar which I'm trialling.
Brimstone Posted August 31, 2023 Posted August 31, 2023 At present, I've sacked off user based profiles and I've just enrolled the device, then logging in with an AD bound account. Jamf is then (just about) managing the settings from there. Not great, but 1000% better than broken Profile Manager so far! I saw about the enrollment stage and have adjusted my expectations accordingly. I would strongly recommend creating an account in Jamf's Learning Hub area, there are tons of great guides which can get you out of a hole and free training vids and technical guides. https://learn.jamf.com/
highsky Posted September 1, 2023 Posted September 1, 2023 Intune and meraki have the option to import the custom PM profiles. There are free tools to edit the profiles when needed. In our case we use Intune to enroll and manage the MacOS devices under corporate ownership, if not onboard via Apple school manager. Works with existing too, manual onboarding with the company portal. We also use munki and munki reports.
3s-gtech Posted September 1, 2023 Author Posted September 1, 2023 Feedback I read on using Intune with Macs was appalling, which stopped me in my tracks on that one. My experience with Jamf School so far is good - it is insanely fast updating the profile, it just can't seem to mount network shares which is a shame.
Brimstone Posted September 1, 2023 Posted September 1, 2023 Intune and meraki have the option to import the custom PM profiles. There are free tools to edit the profiles when needed. In our case we use Intune to enroll and manage the MacOS devices under corporate ownership, if not onboard via Apple school manager. Works with existing too, manual onboarding with the company portal. We also use munki and munki reports. Using 2 x MDM's to manage macOS what a PITTA....
highsky Posted September 1, 2023 Posted September 1, 2023 Yes, Intune seems slower than meraki when updating profiles. But then how often do you have to make changes?
BKGarry Posted September 1, 2023 Posted September 1, 2023 (edited) Sorry missed this, We use Jamf School to manage our macs and they are fully shared, enrolled in AD, provisioned to Jamf through DEP, all apps are deployed through being purchased through apple school manager and then are sent by device not user at all. Work well with our music and media suites and our staff MacBook pros. The only annoying thing was if you rebuild a machine or get a new one and install Logic/GarageBand you do have to tell it to download the loops afterwards and we do mount the home share through it, not any shared folders though. For shared folders, check under Login Items, there seems to be a section to add Authenticated Network Mounts, which should do it, I think Edited September 1, 2023 by BKGarry 1
3s-gtech Posted September 1, 2023 Author Posted September 1, 2023 I’ve got somewhere with network share mounting - the Network Share Mount app works, and I’ve used a IMaginary profile to configure it. Been a right pain to get it autostarting (needs to be *insisted*!) and still have a bug. Currently had to rename the app to remove spaces in its name [emoji28] Provisioning apps, DEP, ASM integration etc will all have to come later - I manually built my test Mac here (I miss DeployStudio!)
BKGarry Posted September 1, 2023 Posted September 1, 2023 Totally miss deploystudio so much, was a great tool in the arsenal for macs. ASM for Apps was really easy to do, even I could do it by myself. Also if you put a device in trash it removes it's license for the app so you can reuse it on a newer one.
highsky Posted September 1, 2023 Posted September 1, 2023 Using 2 x MDM's to manage macOS what a PITTA.... What is your current solution? Munki recipes is set and forget solution for quite a few apps and their updates. Does anyone uses any cloud mdm to push Adobe packages or music apps and their libraries? Can someone give some figures for Jamf School?
Brimstone Posted September 4, 2023 Posted September 4, 2023 What is your current solution? Munki recipes is set and forget solution for quite a few apps and their updates. Does anyone uses any cloud mdm to push Adobe packages or music apps and their libraries? Can someone give some figures for Jamf School? Neither Jamf School or Jamf Pro have to distribute big software packages via the cloud, you can use an SMB share point on your network to do this if you need to. Unlike InTune with it's paltry 8GB file limit for cloud files Jamf can cope with very large .pkg's and DMG's of 80GB or more
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now