How do I enroll devices while "Can enable remote management" is disabled?

Question

I'm deploying a large number of iPads and Mac Minis in my environment, and I need to be able to enroll them so they can be managed by my server.

In my server "Profile Manager" there is a setting to "Can Enable Remote Management".

By enabling this, I can Enroll a device through the http://myserver/mydevices/ page

If I disable the "Can Enable Remote Management" feature, the "Enroll this mac" button disappears.

This is to be expected since once I have the remote management enabled, I don't want any other users monkeying with it, removing the trust certificate, or otherwise vandalizing my hard work.

What is the right way to mass deploy these devices to my network, ensuring they can't be changed by the users, and disabling the ability for the end user to enable/disable remote management.

Answer 1

Four years after you posted this, Apple's answer to this is Device Enrollment Program to point all the macOS and iOS hardware you buy to your MDM enrollment URL without user interaction.

That way the devices can be enrolled, supervised, managed without needing to train end users.

Answer 2

I'm too deploying Lion in masse, I was wondering the same as you and I found on Profile Manger's help (About the user portal->Providing configuration profiles for download->Enrolling devices):

If you use Profile Manager as a mobile device management server, the user portal allows users to quickly enroll their devices.

In Profile Manager, select a user or group, then click 'Can enable device management.' Provide your users with the user portal URL.

To see the URL, click View User Portal in the Profile Manager pane of the Server app. It is similar to example.com/mydevices. When users log in, they click the Enroll button to download a configuration profile that initiates the enrollment process".

As to prevent users to vandalize your settings, you can add another payload to your profiles to keep users from opening Profiles pane on System Preferences, Everyone group seems good to do this.