Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm deploying a large number of iPads and Mac Minis in my environment, and I need to be able to enroll them so they can be managed by my server.

In my server "Profile Manager" there is a setting to "Can Enable Remote Management".

enter image description here

By enabling this, I can Enroll a device through the http://myserver/mydevices/ page

enter image description here

If I disable the "Can Enable Remote Management" feature, the "Enroll this mac" button disappears.

This is to be expected since once I have the remote management enabled, I don't want any other users monkeying with it, removing the trust certificate, or otherwise vandalizing my hard work.

What is the right way to mass deploy these devices to my network, ensuring they can't be changed by the users, and disabling the ability for the end user to enable/disable remote management.

share|improve this question
add comment

1 Answer 1

I'm too deploying Lion in masse, I was wondering the same as you and I found on Profile Manger's help (About the user portal->Providing configuration profiles for download->Enrolling devices):

If you use Profile Manager as a mobile device management server, the user portal allows users to quickly enroll their devices.

In Profile Manager, select a user or group, then click 'Can enable device management.' Provide your users with the user portal URL.

To see the URL, click View User Portal in the Profile Manager pane of the Server app. It is similar to example.com/mydevices. When users log in, they click the Enroll button to download a configuration profile that initiates the enrollment process".

As to prevent users to vandalize your settings, you can add another payload to your profiles to keep users from opening Profiles pane on System Preferences, Everyone group seems good to do this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.