4

So we're setting up a subsidiary company in another country, and we will be needing a bunch of Mac Minis that some part-time (hourly) employees will use. The employees will be rotating between the Macs, but do need the ability to create their own bookmarks etc in the browser. Our main employee under this subsidiary is capable of setting up the Macs, but ideally this should only be a few steps when he receives a new Mini.

So we will need:

  • Something like an Open Directory Server for the users (is there anything online that we can use?)
  • Some easy way to have these Macs connect to this Open Directory Server (ideally) without any need to create local accounts

So what would the best approach here be? And are there any cheap and reliable Open Directory Servers online that we could use for this? I looked a bit into jamf, but that seems to be more MDM, and I'm not even sure they offer OD or AD.

Can I use Apple Configurator perhaps to create profiles? Can I load these into the Macs before the default setup screen?

EDIT: Looking more into jamf, it seems like a nice way of managing these Macs.

Improve this question
5
  • 1
    I think there's quite a lot here to unpack for it to be one question! There are hosted directory systems out there but network homes can be 'challenging' on macOS... As to profile creation do you mean a configuration profile or a user account?
    – Robin
    Commented Feb 28, 2019 at 13:20
  • 1
    One reason your question hasn't received a lot of attention (or answers) is that it is extremely broad and needs some editing. I count five questions in the text right now, hard to provide answers. Some basic topics could probably be covered by reading the appropriate documentation, some other somebody with experience can answer.
    – nohillside ♦
    Commented Feb 28, 2019 at 13:30
  • 1
    Having said that: Can you edit your question to focus more on a general solution, without already assuming which technology will solve what and which problems this will bring later on?
    – nohillside ♦
    Commented Feb 28, 2019 at 13:32
  • You mentioned OD and AD. Are you using one or the other now?
    – Allan
    Commented Feb 28, 2019 at 18:55
  • This is totally doable. The how is far, far too broad for even 3-4 smaller questions, but feel free to @ me in comments or links to follow on questions if you have some more once you dig into DEP and MDM and pushing profiles. You can avoid some cost if you assume you manually enroll in a MDM and then push over the network, but true - before you touch the Mac needs DEP and one of the better / best MDM out there today in 2019
    – bmike ♦
    Commented Mar 1, 2019 at 19:24

1 Answer 1

Reset to default
2
+50

At long last, yes you can set up management for zero touch deployment through a couple avenues.

  1. Use an Apple Service called Device Enrollment Program which is now part of the Apple Business Manager service / web app. https://business.apple.com
  2. Use a product to leverage the login process and install a tool like Jamf Connect which lets you run scripts and check in with a directory before any user logs in. https://www.jamf.com/products/jamf-connect/

You can even combine both so that when you purchase a Mac and ship it, it will be enrolled in the management framework, have certificates and helper scripts loaded so that you can leverage cloud identity providers like Okta or Azure AD or roll your own LDAP/OD as the Jamf Connect is based on an open source NoMad project which was acquired and now is enhanced and has become Jamf Connect.

The implementation of this is quite broad, but there are professional resources and communities to help. I would start with JAMF pre-sales support and consider joining the Mac Administrators Slack if you want guidance and mentoring more than a Q&A site like this (and I would recommend both, tbh)

Improve this answer
1
  • Note, these aren't the only services or way to do it, but I have personal experience with all of the above (or at least the initial version of this post) and don't have a personal stake in any other than being a customer / community member. I'd start here on setting this up.
    – bmike ♦
    Commented Mar 1, 2019 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .