Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Off-boarding in a Modern Deployment

Jamf
November 13, 2019
510

Off-boarding in a Modern Deployment

Jamf

November 13, 2019
Tweet

Transcript

  1. © JAMF Software, LLC Deployment: User Perspective 1. Open box

    2. Power on MacBook 3. There is no step 3 ❤IT
  2. © JAMF Software, LLC Deployment: Admin Perspective Zero-touch effort for

    IT Streamline setup assistant for users Automatically enroll Deliver important apps and policies 
 during and after enrollment
  3. © JAMF Software, LLC Keep applications up to date Address

    emerging security concerns Support multiple generations of hardware Prompt to download and 
 install updates through MDM Ongoing Maintenance
  4. © JAMF Software, LLC Off-boarding Reset to factory defaults Remove

    MDM Framework/License Securely Wipe User Data
  5. © JAMF Software, LLC Off-boarding: User Data Securely Wipe User

    Data General Data Protection Regulation (GDPR) Responsibility: User or IT??
  6. © JAMF Software, LLC Quickly erase device from Settings All

    user data is securely removed Option can be restricted on 
 supervised devices Remote wipe MDM command User Driven Erase All Contents and Settings
  7. © JAMF Software, LLC macOS Recovery Option-⌘-R Upgrade to the

    latest macOS that is compatible with your Mac. Shift-Option-⌘-R Install the macOS that came with your Mac, or the closest version still available. Command (⌘)-R Install the latest macOS that was installed on your Mac. Internet Recovery
  8. © JAMF Software, LLC Installer App Manual Upgrade Create External

    Install Media Command Line Tool 
 /Applications/Install macOS Catalina.app/Contents/Resources/startosinstall
  9. © JAMF Software, LLC Automated upgrade Automate with 
 startosinstall

    Requires Mac that supports Catalina 
 and is running at least OS X 10.9
  10. © JAMF Software, LLC Automated Erase and Install Automate with

    
 startosinstall --eraseinstall Requires APFS and installer 10.13.4+ No built-in UI option
  11. © JAMF Software, LLC Erase All Contents and Settings Quickly

    erase device from 
 System Preferences All user data is securely removed Option can be restricted on 
 supervised devices Remote wipe MDM command User Driven Erase All Content and Settings This doesn’t exist..YET!! ??????????
  12. © JAMF Software, LLC Reality — What we see in

    practice Your return to service workflows
  13. © JAMF Software, LLC What do we want to achieve?

    We want to provide a user driven off-boarding which is supported by Apple.
  14. © JAMF Software, LLC Graham Pugh
 grahampugh Blogpost: https://grahamrpugh.com/ 2018/03/26/reinstall-macos-from-system-

    volume.html Github: https://github.com/grahampugh/ erase-install Erase and reinstall macOS
  15. © JAMF Software, LLC Based on startosinstall --eraseinstall Logging Bring

    your own Installer Add packages to install pre-erase hooks Error Handling Validation checks • Installer app in any location • Find My • Internet connection Administrator
  16. © JAMF Software, LLC Start APFS & OS Version? No

    Minimum OS 10.13 Quit App No Yes Yes Application flow © JAMF Software, LLC
  17. © JAMF Software, LLC startosinstall --usage --license
 prints the user

    license agreement only. --agreetolicense
 agree to the license you printed with --license. --rebootdelay
 how long to delay the reboot at the end of preparing. This delay is in seconds and has a maximum of 300 (5 minutes). --pidtosignal
 Specify a PID to which to send SIGUSR1 upon completion of the prepare phase. To bypass "rebootdelay" send SIGUSR1 back to startosinstall. --installpackage
 the path of a package (built with productbuild(1)) to install after the OS installation is complete; this option can be specified multiple times. --eraseinstall 
 (Requires APFS) Erase all volumes and install to a new one. Optionally specify the name of the new volume with --newvolumename. --newvolumename
 the name of the volume to be created with -- eraseinstall. --preservecontainer
 preserves other volumes in your APFS container when using --eraseinstall. --forcequitapps
 on restart applications are forcefully quit. 
 This is the default if no users are logged in. --usage
 prints this message. --agreetolicense
 agree to the license you printed with --license. --eraseinstall 
 (Requires APFS) Erase all volumes and install to a new one. Optionally specify the name of the new volume with --newvolumename. --installpackage
 the path of a package (built with productbuild(1)) to install after the OS installation is complete; this option can be specified multiple times.
  18. © JAMF Software, LLC Add packages to install --installpackage
 the

    path of a package (built with productbuild(1)) to install after the OS installation is complete; this option can be specified multiple times. productbuild --identifier com.myorg.uniqueid --version 1.0 \
 --package input_component.pkg output_distribution.pkg https://scriptingosx.com/2019/04/eraseinstall-update-version-1-2/
  19. © JAMF Software, LLC EraseInstall application will look for package

    installers (pkg) files /Library/Application Support/EraseInstall/Packages/
  20. © JAMF Software, LLC Deploy Installer App VPP PKG with

    management system External Drive 
 softwareupdate --fetch-full-installer --full-installer-version 10.15 Available in macOS 10.15 Catalina
  21. © JAMF Software, LLC Future plans Pre-erase hooks Manage EraseInstall

    workflow with profile Localization: ✓English ✓Dutch • ……we need help VERSION 2.0
  22. © JAMF Software, LLC Mischa van der Bent Chief Technical

    Officer 275x275 head shot mvdbent scriptingosx.com/offboarding
  23. © JAMF Software, LLC Thank you for listening! Give us

    feedback by completing the 2-question session survey in the JNUC 2019 app.