0

We have 10 M1 Macs here and counting. (6 Studios, 4 Minis.) I've got several of those new Studio's to provision.

With our fleet of 2013 Trashcans, having a master image worked great. It'd be extremely tedious and impractical to configure each system. We also have rental customers, so wiping and re-imaging after a rental wraps is safe and effective.

Our procedure used to be:

  1. Boot from the master image's SSD
  2. Wipe and clone it into the boot drive (we liked SuperDuper)

With few tweaks, this has worked great. But with the M1 and T2 security models, imaging has become so unreliable it's impractical. A few of the problems:

  • First boot from the SSD takes a long time, the Mac is running some kind of mystery update for 7 minutes. (Maybe 12.5 causes LLB to update system-paired firmware?)
  • Then (sometimes) the Mac has to "phone home" for a few more minutes to reactivate.
  • Most crucially though, the clone (usually) breaks the administrator account. So when we go to RecoveryOS to update the Security Policy (our main SAN needs kexts to load), we get a "No administrator was found" error. (Both the clone source and target have admin accounts, Secure Token is enabled for them, and they're the same account name and password. updatePreboot didn't help either.)

So then we're off to SC2/DFU, internet recovery, rm .AppleSetupDone to make a 2nd admin account w/ Setup Assistant, etc… and by then the whole process is not worth the effort.

TL;DR I know that ultimately, the proper solution will be to enroll in Apple Business Manager and deploy MDM in our company. It's in the works. But until then, what's the best solution to all this? I'm open to tackling the specific technical hurdles I brought up, or other methods to sidestep them.

Improve this question
2
  • You don't need to wipe/clone the whole disk: just the "Data" volume. If you wipe/clone the whole disk, you'll compromise the SecureToken stuff, as you've discovered, leaving Recovery without authorisation. Technically the user/password data in Recovery is entirely separate from the admin account; it just happens to be duped when macOS makes the admin account.
    – benwiggy
    Aug 10, 2022 at 8:49
  • It is impossible to clone just the "Data volume". SuperDuper/CCC now have to rely on the "ASR" command, which requires cloning the whole disk. However, it seems that choosing the freshly cloned target in Sys Prefs > Startup Disk does allow registering the target's admin account with the firmware.
    – Drew
    Aug 13, 2022 at 2:40

1 Answer 1

Reset to default
1

Considering the total lack of answers, here are the best 3 answers I've found:

  1. Use the clone utilities, and boot to the freshly cloned target (new Mac's boot disk) from System Preferences > Startup Disk. This brings up dialogues warning that the disk has no authorized admin user(s), and allows fixing it, which registers them onto the firmware.

  2. Use Migration Assistant as a clone restore utility. Contrary to what I read, it seems to work alright even if you re-run it on a deployed system (and not only in its initial run on a "virgin" deployment).

  3. Establish MDM in your organization.

Once you add the steps to reduce the 1TR Security Policy and reapprove kexts, #1 and #2 still require about 13 steps to complete…

Basically, I'd love to hear of a better way to do it. Until then, this is the best answer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .