/
Campus Jamf UT Provisioning

Campus Jamf UT Provisioning

NOTE: This is an older version of this Campus Jamf UT Provisioning documentation
It was imported from Word and needs reformatting and updating

UT Provisioning for Central Campus Jamf





Table of Contents

overview

provisioning process for new deployments and existing in-use Macs

  1. policies to run UT Provisioning - utexas-depnotify-setup

  2. options for policies

customization options

banner/image/main text/help text/error text

registration - true/auto/false

install base software

create users and encrypt - site policy with stache, admin info required

reference

 

 

 

Overview

 

The UT Provisioning system is used in Campus Jamf to provision new or existing already-in-use Macs when they first enroll in Jamf.

 

It is a flexible process that can be customized easily for your site, including the look of the registration window and the software to be installed.

 

The process will start when a Mac is enrolled and is controlled by a set of Smart Groups to select what is done. It can also be started on demand via Self Service.

 

For New Macs, a Registration window will come up - usually this would be filled in by an IT tech but it could be done by end-users with proper instruction, for zero-touch deployment. The information entered will be used to set the computer name and optionally assign it to a user in Jamf.

 

 

For Existing Macs, usually the Registration window is not needed, and it may run silently (no window) or show just a progress window while software is installed. In some cases registration may be needed, in which the process is the same as for New Macs.

 

 

In both cases required software is installed and optionally a set of base applications that you specify.

 

When an Existing Mac runs provisioning in ‘auto’ or ‘silent’ mode, the name is checked and if it is in the format DEPT-TAG (e.g. ENGR-A45135), then the name is parsed for department code and asset tag and those values are assigned in Jamf. Having those values in place is important for inventory and for some processes (like Nessus).

 

If ‘inventory.plist’ exists on the Mac, which is created by the standard utexas-jamf-migrate scripts, values for department code, user, and asset tag from the source Jamf server may have been added and those will be used instead.

 

In ‘auto’ mode, if neither the computer name nor inventory.plist can provide department code and asset tag, or the Mac has a ‘generic’ name such as MacBook Pro or iMac or Mac Studio, the Registration window will come up prompting as with New Macs.

 

At the end of provisioning, if the Mac is assigned to a user in Jamf, you can run another process to create filevault-enabled user accounts (standard and admin, or just standard, with passwords stored in Stache), and enable filevault disk encryption. This step can also be used to install Jamf Connect for those functions.

 

 
Policies to run UT Provisioning – the utexas-depnotify-setup script

 

The main provisioning script is utexas-depnotify-setup, which uses DEPNotify to provide the registration and/or progress window.

 

At least one policy in your site is needed to run the main script. We have template policies that we will clone into your site for you to customize. You will need to enable the ones you want to use. We also recommend that you do not enable any other policies at enrollment, and policies that run at check-in should ideally run >1 day after enrollment, so they do not interfere.

 

For New Mac setup, enable:

SITE - UT Provisioning - New Mac - registration and software

 

For Existing Mac setup. enable for provisioning to run, and enable a type below:

SITE - UT Provisioning - Existing Mac - start provisioning

 

Type of Existing Mac setup (only enable one):

SITE - UT Provisioning - Existing Mac - auto registration, install software

SITE - UT Provisioning - Existing Mac - auto registration, no software

SITE - UT Provisioning - Existing Mac – progress-only registration, no software

SITE - UT Provisioning - Existing Mac – silent registration, no software

 

 

Existing Mac provisioning can be run in several different ways. We provide 4 of the most common, but you can also create your own.

 

The provisioning policies make use of several other policies for required configuration, installing base software, and optionally creating users and encrypting.

 

NOTE on Rosetta 2: because Rosetta 2 is needed by some packages used by UT Provisioning, it will be enabled by the script if the architecture is Apple Silicon.



Options for the New Mac and Existing Mac UT Provisioning policies

 

Customization Options

[Default: blank]

 

Custom Banner Title - if you want to display your department or IT org name

Default if blank:

 

UT AUSTIN | Mac Setup

 

Custom Banner Image - will display above the main text

NOTE: you must specify a full path and you may need to add a package or script to run BEFORE the utexas-depnotify-setup script

Default if blank:

 

Custom Main Window Text - if you want to change it from the default

Default if blank:

 

Thank you for registering a Mac at UT Austin. Hook 'em! Some standard applications and settings need to be configured before the new Mac can be used. Depending on the network connection, this process should take 15 to 30 minutes to complete. \n \n If additional software or help is needed, please open the $SELF_SERVICE_APP_NAME app in your Applications folder.

 

Custom Help Bubble Text - you can change it to use your IT contact info

Default if blank:

 

This tool used by UT is designed to help with new computer deployments.\n\n If you have issues, please email the UT ITS Service Desk at help@utexas.edu or call at 512-475-9400

 

Custom Error Text - you can change it to use your IT contact info

Default if blank:

 

We are sorry that you are experiencing this issue with your new Mac. \n \n Please contact the UT ITS Service Desk for assistance. \n \n Email: help@utexas.edu \n \n Phone: 512-475-9400'

 

 



Registration Mode - true, auto, silent, or false

[default: true for New Mac, auto for Existing Mac]

 

registration = true

For new systems – those that are scoped to a smart group that detects new Macs, generally prestage-enrolled

registration = auto

For most existing in-use Macs being enrolled or migrated to Jamf

registration = silent

 

registration = false

For existing Macs being enrolled/migrated but the registration window should never come up

 

option 'true' - will always prompt for:

 

  • Asset Tag

  • User EID

  • Department Code.

 

The tag and department code are used to set the computer name (using a preferred prefix instead of department code) and if eid is provided the Mac will be assigned to that user in Jamf (which is required if you want to use the create users and encrypt function)

 

Registration should always be done for new Macs, but can also be done for existing Macs, for instance if you are migrating Macs that may not be named properly.

 

option 'false' - will not prompt

 

It will check the computer name as well as inventory.plist on the Mac, and if the name has a valid department prefix and asset tag (e.g. "ENGR-A14445"), then the department code and asset tag will be set in Jamf from those. Having those set is important for inventory and compliance purposes (e.g. Nessus, Code42)

 

option 'auto' - may prompt depending on computer name and inventory.plist

It will check the computer name, and if a valid department code and asset tag cannot be derived from the name, or it has a generic name such as "MacBook Pro" then "Registration = true" is set and the prompt for tag/eid/deptcode will come up.

 

 

Install Base Software (policy trigger)

[default for New Mac and Existing Mac – install software: SITE-install-default-base-software]

[default for Existing Mac…no software: false]

 

This should be a policy trigger to run your site policy to install software. It will run after the required minimum software is installed (currently: Nessus Agent, Packet Filter Firewall).

 

The default SITE - UT Provisioning - Install Base Software uses the GLOBAL-install-base-software script:

 

This script will take parameters in the form:

"Installing app name,site-appname-install"

 

The first part is text to be displayed in the DEPNotify window, the second is a policy trigger to run.

 

The default for Install Base Software that is added to your site includes common applications such as Adobe Reader, Google Chrome, Firefox and Microsoft Office 2019.

If your standard set of apps is different, edit the policy to include yours. If you do, you may need to edit the “SITE – UT Provisioning – Existing Mac – needs software” and “SITE – UT Provisioning – Existing Mac – does not need software” groups, as well as the “setup complete” Smart groups.

You can also use a different policy altogether that does not use the GLOBAL-install-base-software script. 

 

When using GLOBAL-install-base-software, to install more than 8 applications, create a second policy using the script and daisy-chain the first to that by making the last parameter "Installing software,site-install-base-software-part2"

 

 

 

Create Users and Encrypt (policy trigger)

[default: false]

 

The Create Users and Encrypt function will use the Jamf assigned user to create user accounts and then enable filevault.

 

The default policy is SITE – UT Provisioning - Create Users and Encrypt. However it will not work without some extra configuration.

 

It requires passing an admin account username & password to the script, so that the created users will be filevault-enabled. Typically this would be used for new macs using an admin account created by the Prestage Enrollment, so they would always have the same initial password.

 

Random passwords are generated and entries created in a Stache folder. You must set up the folder and provide API info in the parameters

 

Optionally it can change the admin account password and create a separate Stache entry for that.

 

It can also create only a standard user, instead of both standard & admin (the default), and use either the email address (default) or the eid for the usernames (for admin accounts, '-admin' is added to the username)

 

To enable policy: SITE – UT Provisioning - Create Users and Encrypt

It uses:
Package: UT-Xkpasswd-Mac-1.2.pkg

Script: GLOBAL - create-users-and-enable-filevault

 

Update Parameters to script:

 

stache_apiendpoint - This will be in the Options for the stache folder (see below)

 

stache_apikey - From Options for the stache folder

 

stache_folderowner - This should be an IT admin or service eid, NOT the end-user

 

admin_user - A filevault-enabled admin username

 

admin_pw - The password for admin user, base64 encoded (or, not recommended, plain-text)

 

change_admin_pw - If 'true' will change admin account password and create stache entry, shared only the stache_folderowner

 

create_standard_only - If 'true', will only create standard user account, no admin user account. If ‘none’, no users will be created (but filevault will still be enabled)

 

eid_for_username - If 'true’ will use eid for usernames, otherwise the first part of the email address is used

 

 

Stache folder:

1. create or go to a folder in stache

2. in options, enable creating entries

3. copy the api endpoint and api key to parameters

 

documentation: https://stache.utexas.edu/docs/api/folder-create-entry

 

REFERENCE

  

Policies

GLOBAL - Install default base software (GLOBAL-install-default-base-software)

 

Scripts

utexas-depnotify-setup

GLOBAL - install-base-software

GLOBAL - create-users-and-enable-filevault

 

Packages

GLOBAL - DEPNotify-1.1.6.pkg

UT-XKPasswd-Mac-1.2.pkg

 

SITE Smart Groups

- SITE will be the Jamf site (typically a department code)

  

SITE - UT Provisioning - Existing Mac

 

SITE - UT Provisioning - Existing Mac - does not need software

- site admin should check criteria and add/modify software packages used to detect if software is needed

 

SITE - UT Provisioning - Existing Mac - needs software

- site admin should check criteria and add/modify software packages used

 

SITE - UT Provisioning - Existing Mac - setup complete

 

SITE - UT Provisioning - Name starts with department

- site admin should check & make sure needed department prefixes/codes are included

 

SITE - UT Provisioning - PreStage New Mac - registration and software

- site admin should check criteria and add/modify if needed

 

SITE - UT Provisioning - PreStage New Mac - setup complete

 

 

SITE Policies

SITE - UT Provisioning - Create Users and Encrypt

- site admin needs to add parameters for stache, admin account

- once parameters added, add SITE-create-users-and-encrypt to main policy


SITE - UT Provisioning - Existing Mac - auto registration, install software

- site admin should adjust Custom Banner, Custom Text etc. if desired

 

SITE - UT Provisioning - Existing Mac - auto registration, no software

- site admin should adjust Custom Banner, Custom Text etc. if desired

 

SITE - UT Provisioning - Existing Mac – silent registration, no software

- site admin should adjust Custom Banner, Custom Text etc. if desired

 

SITE - UT Provisioning - Existing Mac – start provisioning

- this policy will trigger at enrollment and run “jamf policy” to start the type of provisioning enabled – those policies trigger at check-in, but stop being in scope when setup is complete

 

SITE - UT Provisioning - Install Base Software

- site admin should adjust software-install parameters to script if desired

SITE - UT Provisioning - New Mac - registration and software

- triggers at enrollment for prestage-enrolled Macs that do not have filevault enabled

- can be cloned to use with other prestage enrollments (e.g Jamf Connect) but should have the smart group cloned as well

- site admin should adjust Custom Banner, Custom Text etc. if desired

 

SITE - UT Provisioning - Required Configuration

- policies required for all Macs, new or existing, whether “install software” is yes or no

- executed directly by utexas-depnotify-setup

- includes PF packet filter firewall and Nessus, may include more in the future

- site admin may want to add policies to run but should not remove the defaults