macOS installation-based workflows

Perhaps you are starting to worry about the future of “imaging” as a deployment/initial configuration method for Macs.

(I’ll define “imaging” as block-copying the contents of a disk image file to a disk volume, and resulting in a bootable, fully-functional machine.)

If you are concerned about the future of imaging, you might want to start investigating macOS installation-based workflows for deployment/initial configuration.

The basic idea is this: a workflow that either installs macOS, or starts with the factory os installation. It then installs additional packages that serve to enroll the Mac in whatever your ongoing management system is (Jamf Pro, Filewave, Munki, etc). It then becomes the management system’s job to finish the initial setup of the machine.

Here are a few things you might want to look at:

NetInstall

You can use Apple’s System Image Utility (found in /System/Library/CoreServices/Applications) to generate a NetInstall boot image that installs macOS, and crucially, additional packages.

There are a few issues here, see this post for details.

Using the resulting NetInstall nbi does of course require that you can set up and use a NetBoot server in your environment. Don’t think that because you don’t have or allow Mac hardware in your data center you can’t host a NetBoot/NetInstall image. Pepijn Bruienne’s bsdpy is a tool that allows you to serve NetBoot/NetInstall images from a Linux server.

createinstallmedia

If you absolutely cannot make use of a NetBoot/NetInstall disk, you might be able to make use of createinstallmedia to make a bootable install volume. This is a command-line tool found inside the Install macOS application.

$ cd /Applications/Install\ macOS\ High\ Sierra.app/Contents/Resources/
$ ./createinstallmedia --help
Usage: createinstallmedia --volume <path to volume to convert>

Arguments
--volume, A path to a volume that can be unmounted and erased to create the install media.
--applicationpath, A path to copy of the OS installer application to create the bootable media from.
--nointeraction, Erase the disk pointed to by volume without prompting for confirmation.

Example: createinstallmedia --volume /Volumes/Untitled

This tool must be run as root.

You can use this tool to erase an external disk and turn it into a bootable disk that can install macOS. But the resulting macOS install will be generic — it won’t contain any extra packages that you might want to have installed.

createinstallmedia + System Image Utility

You can work around the generic macOS install issue by combining both createinstallmedia​ and System Image Utility. You:

1. Use createinstallmedia to create a boot drive that can install macOS.
2. Use System Image Utility to build a NetInstall nbi containing a customized macOS install.
3. Mount the NetInstall.dmg inside the NetInstall nbi folder.
4. Copy the Install macOS High Sierra.app from the mounted disk image to your external boot drive, replacing the existing  Install macOS High Sierra.app.

The result is an external bootable drive containing a customized macOS installer — one that installs macOS High Sierra and your additional extra packages. Thanks to Armin Briegel for cluing me into this trick!

Imagr

Yet another alternative is Graham Gilbert’s Imagr application.  Despite the name, Imagr can do far more than image. It runs workflows, which can install packages, run scripts, and as of the 1.4.0 release, can install macOS from an “Install macOS High Sierra” application.

See here for an Imagr workflow that can install macOS High Sierra and any number of additional packages.

Imagr is designed to be run from a NetBoot/NetImage network boot, but can be run from an external drive. To be able to use the startosinstall functionality, an external boot drive must be set up in a very specific way. You can use the included autonbi Makefile to create a NetBoot/NetInstall nbi, then use this script to convert it to a bootable external drive.

DEP + MDM + Munki/Jamf/etc

A final alternative I’ll present here is one Apple really would like organizations to move towards — using the Device Enrollment Program to automatically enroll your devices into your MDM server. That MDM server can then install further management tools, like Munki or Jamf Pro or Filewave, or whatever. Some posts on this topic:

Erik Gomez, Custom DEP series:

http://blog.eriknicolasgomez.com/2017/03/08/Custom-DEP-Part-1-An-Introduction/
http://blog.eriknicolasgomez.com/2017/03/08/Custom-DEP-Part-2-Creating-a-custom-package-and-deploying-Munki/
http://blog.eriknicolasgomez.com/2017/03/08/Custom-DEP-Part-3-Best-Practices/
http://blog.eriknicolasgomez.com/2017/03/08/Custom-DEP-Part-4-The-Future/
http://blog.eriknicolasgomez.com/2017/04/05/Custom-DEP-Part-5-Dynamic-InstallApplication/
http://blog.eriknicolasgomez.com/2017/04/27/Custom-DEP-Part-6-Vendor-Announcement-and-Presentation/
http://blog.eriknicolasgomez.com/2017/07/27/Custom-DEP-Part-7-Getting-started-with-AirWatch-9.1.3/

Victor Vranchan, Munkiing around with DEP:

https://groob.io/posts/dep-micromdm-munki/