Fully loaded Mac – in the past

Alex Usov
Nov 1, 2018
4 min read

We covered the features Apple is giving us to manage our macs in the previous post. However, some of those features are not yet available in Israel. They will show up here eventually, possible with Apple Business Manager release in the next few months.

In the meantime let discuss how we used to deploy new Mac, what worked for us so that later we can talk about the direction we are moving in. Let me know in the comments if you have any suggestions or questions.

Administrative tips

First, we purchase our Macs through a big company that will have significant interest to be approved to be a DEP reseller once it is available in Israel. This way we will probably be able to ensure that previously purchased equipment will be added to our account.

Once the Macs arrive, I do not open them right away since Apple’s one year warranty starts at the moment you activate them (connect to the internet for the first time). I do have a few spare Macs ready to be given just in case someone forgot to let me know about a new person that has already started working … yesterday.

I consider it best practice to have the same configuration across all the fleet per job role and the same color of devices for all. All RND folks get the same machine, and all support get the same weaker configuration. It is simpler to manage, troubleshoot and does not cause people to complain about their hardware.

As soon as I find out a new person is starting, I will fire up that Mac and ….

Deployment workflow

Here is what I used to do so far, later I’ll go into what we do now. So the first thing I did was go into netboot mode on the Mac and put a primary image on the laptop. Even if there was a working version of MacOS, I would erase it. Never know who touched the Macs while in transit and also want to have a consistent setup for all of our devices.

We used Deploystudio and had an image for every computer type. This does add the task of keeping the images up to date, but it is relatively simple as you create a new image after a new deployment and an upgrade of the OS and drop it back on the deployment server. The more diversified your Mac fleet is, the more images you will need to maintain.

Part of the Deploystudio workflow is to copy files to the Mac, install packaged and other security features once the image is finished deploying. We used that to install some packages that will create the admin user and kickstart the Munki binary installation. Munki is a great open source project that is widely used and provides you with an internal “App Store” on the Mac with company approved software. We would also copy a few files over to avoid running around with a USB drive and copying the default wallpaper.

Munki opened so many options for us! We used to rely on Apple Remote Desktop to install things remotely, but this creates many checklists and was not prone to errors. With Munki you can create different lists of packages and configurations that it will apply consistently. We had separate lists for different departments too. We could also update the software for the whole company or a specific department. Running scripts is also an option so you if you want to use the defaults command to set settings or bash CLI that will work correctly.

If you are using an MDM, one more step you can do is enroll your Macs using a quick add package. I prefer doing that at the Deploystudio level (not Munki), so I can be sure that once a Mac finished without errors, it is now enrolled.

To speed things you should use a wired cable an create a separate VLAN only for the deployment purposes. It is possible to use an external drive and that might speed things up however this is a single point of failure. Also if it takes 5 min or 30, it does not make that much of a difference as long as you don’t need to be there pushing buttons and clicking things.

So now you have a Mac, with the latest OS, enrolled to your MDM, connected to Munki, pulling all the apps and setting. We put a printed page with the first-day instruction inside the laptop and back in the box it goes, waiting for the new owner to open it up.

Monitoring

You get some indication from Deploystudio that things ran successfully, but that was pretty much it so far. We needed a solution to monitor the status of the Macs and let us know if something is going wrong. After testing several options, we decided to use Watchman Monitoring. It was everything we needed for a reasonable price.