6

As part of our standard deployment, we tend to deploy multiple OSs on Macs, from 10.7 to 10.11. However, with the new SIP (System Integrity Protection), the -bless command no longer works properly.

I need the Macs to boot to each OS during the initial configuration to properly name the OS for Active Directory binding and then do the actual binding.

I've tried to use the "csrutil disable" command recommended in some other places, but that requires booting into the Recovery OS and that change is stored in the NVRAM, so it's local to whatever machine I'm using. Meaning that it won't be part of the 10.11 image deployed.

In the end, I need to be able to script multiple -bless commands, telling the Mac to boot to different OSs on separate partitions on the internal hard drive. It's critical to the image process.

Does anyone have any idea on how to do such a thing?

Improve this question
1

I've had good luck using AutoDMG and munki's crgateosxintallpkg scripts with 10.11 in beta. I haven't done the work yet on the current build, but i think these SIP issues and bless changes were fit in by Apple before release so you shouldn't have issues using these tools.

Are you running into a specific error? What MDM or deployment framework are you using? If you have scripts, it might be easier to adopt one of the standard tools than re-working yours, but both are on github so you can see how they are handling SIP/bless if you need that level of detail.

The last link is Apple's official word on how you will need to script your client Mac to trust the netboot server and the commands needed to navigate the SIP changes for distribution of 10.11 images.

In a nutshell, you can list the "blessed" netboot servers as opposed to blessing the image itself.

csrutil netboot add 10.0.10.10
csrutil netboot list
Improve this answer
3
  • I'm using DeployStudio for deployment and image creation, which I found so much more effective than SIU. The creation and application of a single image goes without too much trouble (save for I can't remotely send a "Boot to NetBoot" command...and it looks like that will only work if I go to the Recovery partition on every one of my 160 Macs). It's trying to figure out how to have the imaging script go to the second OS partition for configuration.
    – ghostof101
    Oct 2 '15 at 16:58
  • @ghostof101 ugh - scripting that is going to be needed to avoid the pain of 160 manual touches... I'll keep my eyes open in case I catch a second tip on this...
    – bmike ♦
    Oct 2 '15 at 19:33
  • Thanks, you can see why the CMD-R isn't something I really want to implement. We have units in four different buildings...doing them by hand is not appealing.
    – ghostof101
    Oct 7 '15 at 19:16
0

Virtualization may be an easier solution for this problem. Both VMware Fusion and Parallels can virtualize Mac OS X 10.7.x - 10.11.x.

Improve this answer
1
  • I agree and we do use some virtualization in our material. However, for the specific things we're doing, we need it to be in the OS itself. Virtualization usually takes up a fair amount of system resources. (I know it definitely does on my unit). Performance is a large factor in our work and we want to make sure we're getting accurate results.
    – ghostof101
    Oct 7 '15 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .