macOS Startup Modifier Keys

To aid with provisioning and other functions, Apple has always allowed you to boot a computer while holding down a given keystroke in order to invoke a specific startup sequence.

With the introduction of Apple Silicon Macs in addition to Macs with Intel processors, those keystrokes (otherwise known as Startup Modifiers) are going to be different between Apple Silicon and Intel Macs.

macOS Provisioning with ADE

Once these prerequisites are fulfilled, you can use ADE to set up your Macs. In your ASM/ABM instance, you can set your registered Macs to be automatically enrolled with your MDM. This automated enrollment means that the Macs will automatically check in with your MDM when the Mac is going through the initial setup process for macOS. The MDM can in turn provide an automated setup workflow for that Mac to run through.

For the additional software and profile installation options, there are several tools available to help automate the post-Setup Assistant installation actions. One well-known free and open source solution is DEPNotify (Figure 6-1). This tool provides a user-facing interface that allows the new Mac’s user to see the following:

• The Mac is being set up.

• Provide status information about where the Mac is in the setup process.

• Provide any additional information that the system administrator may choose to provide as part of the setup process.

• The other important function provided by this tool is that they prevent the user from making any changes to the Mac before the setup workflow has completed its task of setting up the Mac with its required set of software and settings.

The window screenshot of the Mac screen reads meet your new Mac, we are setting up your Mac with a standard suite of software and security settings, including everyday apps, configuration profiles, and security policies.

A commercial tool with similar functionality is Octory from Amaris Consulting. This tool provides a user-facing interface that allows the new Mac’s user to see the following.

macOS Provisioning Without ADE

ADE is a great deployment solution, but being able to use it requires Apple School Manager (ASM) or Apple Business Manager (ABM), an MDM solution, and also having the Mac registered with the appropriate ASM or ABM instance. For some environments, one or more of those components aren’t available, but Macs still need to be set up and configured.

One solution to this problem is a tool called Mac Deploy Stick (MDS) from Twocanoes Software. MDS makes it easy to wipe and reinstall a Mac quickly the same way you can with Apple Configurator for iOS and iPadOS. The reason you need a tool like Mac Deploy Stick is that Apple gives users the ability to reinstall the operating system from the recovery partition, but that installer has to get downloaded during a very manual process. MDS creates those resources locally (e.g., on a USB stick or other external media) instead and organizes them into workflows, which can be deployed more quickly – and come with a simple setup so Macs can be set up faster. An optional Arduino can become a Mac Deploy Stick Automation, which inserts keystrokes during boot time so administrators don’t have to hold down Command-R during the boot process (see more on Startup Modifier Keys in the next section of this chapter).

Create a Workflow

MDS calls a workflow a list of automations the computer will perform during a setup. This includes an operating system installation, packages to deploy to create a workflow, packages or profiles that simply provide a description, optionally provide a description of the workflow as well, and click OK (Figure 6-2).

The screen of M D S workflow has workflow info, M A C O S, resources, user account, options, Munki, Variables, and description. The text reads provide a name and optional description for this workflow. The cancel and ok button on right bottom of the screen.

At the macOS screen, click “Install macOS” and then choose the installation media to generate the installer from (this will use installESD inside that bundle). Optionally, choose whether to erase the volume and then if you want the volume renamed. Click OK to proceed, as seen in Figure 6-3.

The screen of M D S workflow has workflow info, MAC O S, resources, user account, options, Munki, Variables, and description. The text reads install MAC O S, select an option to install MAC O S below. If install MAC O S is selected, specify the location of the MAC O S app download from the app store. The option do not install MAC O S.

At the Resources screen, add the directory that contains scripts, packages, and other resources to be deployed to the client. This is an interesting approach and doesn’t provide for manually selecting what order packages, apps, scripts, and policies get laid down on devices. I’ve had hit-or-miss luck with doing so by numbering assets in those folders. I recommend creating a directory for each type of asset in an MDS directory for that workflow prior to doing this step. Once you’ve bundled all of them up and selected the appropriate directory, click OK (Figure 6-4).

The screen of M D S workflow has workflow info, M A C O S, resources, user account, options, Munki, Variables, and description. The text reads packages, apps, scripts, and profiles. The item in the specified folder will be packaged up and installed after MAC O S. Wait for network before installing resources, reboot after installing. The cancel and ok button on right bottom of the screen.

At the User Account screen, choose if you want to create a new admin account when the system is deployed (Figure 6-5) and any metadata around that experience.

The screen of M D S workflow has create user account, text reads this user account is usually used for local administration. If hide user account is selected, other users will not see this account when logging in. Full name, short name, password, photo, S S H key, password hint, default shell, allow user to administer the computer.

At the Options screen, choose whether to automatically join a Wi-Fi network, if the computer should be renamed based on serial number, if SSH should be enabled, and if the setup assistant should be skipped. Once all options have been configured as desired, click OK as seen in Figure 6-6.

The screen of M D S workflow has workflow info, MAC O S, resources, user account, options, Munki, Variables, and description. The text reads select options to set on the target MAC, these options are enabled via a script that is included in as package installed after MAC O S. If an option is specified that skips settings normally set during MAC O setup.

MDS has multiple hooks that make Munki easier to deploy on devices. Click OK as shown in Figure 6-7.

The screen of M D S workflow has workflow info, M A C O S, resources, user account, options, Munki, Variables, and description. The text reads Munki, configure client, munki repo U R L, and trust munki T L S certificate on client in system keychain.

At the Variables screen (Figure 6-8), provide variables you can then call in shell scripts. These are similar to how we used to fill ARD fields (which is still an option). Sending a $1 from a shell script into these provides a little more flexibility around renaming scripts, binding operators, etc. Click OK (Figure 6-9).

The screen of M D S workflow has workflow info, M A C O S, resources, user account, options, Munki, Variables, and description. The text reads variables, set variables, displays variable name and prompt, it has an edit option below.

The screen of M D S workflow has workflows, preferences, deployment, services, and tools. The text reads M D S organizes and saves resources on an external drive to fully restore a MAC from the recovery partition. It can also save resources to a disk image for hosting on a web server. It has workflow option, logging and save to volume button at the bottom.

Once done, it’s time to run the workflow. To do so, boot a Mac into recovery mode, and then from Terminal, run the following command (shown in Figure 6-10)

/Volumes/mdsresources/run

The screen of bash terminal has following text bash 3 point 2 hash slash volumes slash M D S resources slash run.

The configuration you created in the previous step will then be run and the output similar to that in Figure 6-11.

The screen of bash terminal has following text terminal, shell, edit, view, window, help options on the top right corner of the window and configuration code generated.

This will set up the Mac with the applications, tools, and settings needed to operate properly at the company, school, or institution in question.

There are a lot more workflows than just this one, so to learn more about MDS, go to https://twocanoes.com/knowledge-base/mds-4-guide/.

One of the important components of MDS when used on Intel Macs is an open source project known as Imagr, developed by Graham Gilbert. Imagr is a community project that runs not only on macOS but on Linux as well. While Imagr was originally developed for use with NetInstall and a web server, Twocanoes built on the existing Imagr project to provide MDS’s ability to provision Macs.

Upgrades and Installations

You install or upgrade the macOS operating system using an installer provided by Apple. This used to be an installer which required an Apple ID to access, but beginning with macOS Sierra, Apple made operating system installer free for all Mac users and even began pushing the installer for new OS versions shortly after the new OS’s release date. The installer itself appears as an application normally stored in the Applications directory (shown in Figure 6-12).

The screen displays the MAC O S ventura installation process. Applications such as clock, contacts, dictionary, find my, font book, image capture, and install MAC O S ventura is selected. The logo of ventura application 11 point 99 gigabytes on the right panel.

Running the OS installer on an individual Mac requires administrator rights, but otherwise is an easy experience where you double-click to launch the installer application and follow the prompts.

In the preceding command, we’ve already loaded the “Install macOS Ventura.app” on a machine. While you’d guess that it would find the application path based on its own surname, we went ahead and supplied it as that seems to basically be a thing. Basically, --agreetolicense keeps us from having to run some expect scripts to accept a license agreement, --nointeraction suppresses as many of the screens as possible, and --volume allows us to install to any volume we’d like. This isn’t fully automated, but I have been able to layer in some more logic to quit apps before the script fires and then expect out other items from the script to automate a restart, watching for osinstallersetupd as a key.

One particularly useful function is the --installpackage function, which allows one or more packages stored on the Mac in question to be installed following the upgrade. Something to be aware of is that if you want to add any additional packages, they must all be signed or unsigned distribution-style flat packages. This is a requirement that Apple first introduced for the OS X Yosemite installer, and it still applies to the latest versions of macOS.

This is all a bit bulkier than just using something like createOSXinstallPkg, a tool available for building OS installers which was compatible with Mac OS X Lion through macOS Sierra, but it’s important to mention that there are a number of system components that are allowed for in SIP that use osinstallersetupd, and so this blessed mechanism is likely the future until you can trigger an OS upgrade (and update I suppose) using an MDM command.

Reprovisioning a Mac

Most organizations will take an iOS device out of service, erase the device, and hand it to the next user. Administrators of Macs have long wanted a similar feature, and it arrived as of macOS Monterey with the Erase All Content and Settings feature for Apple Silicon Macs and Intel Macs equipped with the T2 security chip.

To use the Erase All Content and Settings feature on macOS, open System Settings and then select General. From there, you will see an entry for Transfer or Reset preference pane (Figure 6-13).

The screen displays the transfer or reset preference pane in system settings has general, about, software update, storage, air drop and handoff, login items, language and region, date and time, sharing, time machine, transfer or reset, startup disk, and profiles.

Selecting the Transfer or Reset preference will provide access to the Erase All Content and Settings button.

Clicking the Erase All Content and Settings button (Figure 6-14) will prompt for administrator credentials before opening the Erase Assistant app (Figure 6-15).

The screen displays the transfer or reset preference pane in system settings has general, transfer or reset has migration assistant, open migration assistant button on top right, the text reads use migration assistant to transfer information to this MAC from another MAC, a windows P C, a time, machine backup, or disk.

The screen displays the erase assistant with administrator credentials required to open erase assistant. Text reads enter your password to allow this with text box username and password to unlock it.

The Erase Assistant will display a summary of what’s being removed, along with a Continue button (Figure 6-16).

The screen displays erase all content and settings, text reads all settings, media, and data will be erased. the following items will also be removed, apple i d, Touch i d, Find my and activation lock.

Clicking Continue will wipe the encryption keys used to protect the data on the Mac, along with all other data which is not part of the operating system. The end result will be that the Mac will be returned to a factory-default configuration with an unconfigured macOS installation.

Once the Mac is back to having only an unconfigured copy of macOS installed, it can now be set up for use with whatever provisioning tool works best for the Mac admin in question.

Summary

Imaging’s death has been widely reported, but workflows for restoring devices, provisioning, and reinstalling operating systems are all very much alive. With ADE, it’s now possible to provide a user-centric setup experience for both macOS and iOS where it’s possible that IT’s only involvement is making sure that the device was delivered to the right person. On macOS in particular, tools like DEPNotify or Octory allow IT to enable a great user experience by providing a guided setup process for a Mac.

Meanwhile, for those companies, schools, or institutions that as of yet can’t take advantage of ADE, tools like Mac Deploy Stick enable automated provisioning workflows which demand the bare minimum of IT intervention required.

In the end, Mac admins need to choose the setup and provisioning workflows which work best for them, but wise use of these tools will help conserve the most precious resource a Mac admin has: time.