School District of Milton of Milton

Transcription

1 School District of Milton of Milton Utilizing JAMF s Casper Suite - A comprehensive look at 1:1 Utilizing JAMF s Casper Suite - A Comprehensive Look at 1:1

2 Karl Senger Matthew Ward JAMF Certifications: CCA Certified Casper Administrator CCE Certified Casper Expert

3 School District of Milton - Our JSS One to Everyone Managed Computers = 1750 Managed Mobile Devices = 2650 Students: ipad or Macbook Air 11 Staff: Macbook Air 13 Teaching staff also have an ipad

4 School District of Milton - Our JSS One to Everyone 4 Elementary Schools (PK-3) Model = ipad 2 Kdg thru 2nd grade Model = Pad Air (Wi-Fi) 3rd grade *PK will receive 6 devices next year. JDS Instances One for each school Network Segment DP OS X Caching Server Devices stay at school Charging carts at night Otterbox Defender & MAX cases

5 School District of Milton - Our JSS Managed Computers = 1750 Managed Mobile Devices = 2650 Intermediate/Middle Schools (4-8) Model = ipad Air (Wi-Fi) 4th grade charging carts at night 5th - 8th grade take them home each night VPP App Store Managed Distribution Otterbox Defender for traveling ipads MAX cases JDS Instances One at each school Network Segment DP OS X Caching Server

6 School District of Milton - Our JSS Managed Computers = 1750 Managed Mobile Devices = 2650 Milton High School (9-12) Model = Macbook Air 11 Standard Accounts EFI Password Self Service / App Store Brenthaven Trek Cases Supplied JDS Instances One for each school Network Segment DP OS X Caching Server

7 User & App Management

8 LDAP - Student Grad Year OU is the Key Connection Tab Use Wildcards When Searching Allow partial matches to be returned when searching the LDAP directory Mapping Tab User Mappings Department = department Building = physicaldeliverofficename Phone=telephoneNumber * Position = title Microsoft User Object User Interface Mapping

9 Active Directory Position AD User > Properties > Organization Tab > Job Title Attribute MAPPED IN JSS JSS > LDAP > Mappings > Position > title

10 Smart User Groups = Automatic VPP Invitation

11 VPP and DEP SDM App Process: Idea to Device Step 1 - SDM App Request Form When staff wants like to request a new App to be installed on student devices, they use our Google Drive- App Request Form.

12 VPP and DEP SDM App Process: Idea to Device Step 2 - SDM ipad Apps Sheet Milton tracks which app is installed on which device using the SDM ipad Apps Google Spreadsheet Limited editing privileges This is our Master List of who gets which app

13 VPP and DEP Step 2 - SDM ipad Apps Sheet

14 OS X Device Management

15 Maintenance & Imaging Device Imaging Workflows: This is how we do it. Started with NetSUS - Did not work for our environment TB Imaging Drives - Fast speeds but difficult to maintain OS X Server Netinstall Sets - One for each building MBAir Imaging Stations - Target Mode Imaging > Name Prompt Partitioned Drive (Macintosh HD / Casper DP) Fast and Repetitive

16

17

18 OS X Student Laptop Security EFI Passwords New Computer Policy Policy with 2 packages EFI Package Receipt (Which pwd is on this one?) SetRegProtocol EFI Password Configured Security Level = Command Password to set Complex Password

19 OS X Student Laptop Security EFI Passwords Package Receipt Location Package does not contain the password. It is simply a marker for which password is on this device in case the device has not checked in and received the new password.

20 OS X Student Laptop Security EFI Passwords - How this actually works Now we have three policies to combat this. 1. Set the EFI password and leave a package receipt to determine the device password 2. Change the password without a clear We found you need to clone the original package to make this work. 3. EFI clear When turning in our fleet for residual value.

21 OS X Student Laptop Security Local Standard Accounts Our devices are not bound to Active Directory - Who binds here? It just works for our District Wi-Fi Configuration Profiles These have changed during the course of our 1:1 experience. PSK RAD1 Cert SDM-Data SDM-Device with Kerberos Proxy Smoothwall Man-in-the-Middle Cert

22 OS X Student Laptop Security Wi-Fi Configuration Profiles PSK RAD1 Certificate SDM-Data SDM-Data WiFi SDM-Device w/ Kerberos Proxy Smoothwall MITM Cert

23 JSS Scripting

24 JSS Scripting Scripting JSS Username ComputerName = 1111-MHS-2019-userID (Student) 1111-MHS-134-userID (Teacher) Extracts the 4th segment of a computer's ComputerName and applies it to the Username field of the JSS record for the computer. Script username=$(scutil --get ComputerName cut -d '-' -f4) sudo jamf recon -endusername $username

25 JSS Scripting Scripting JSS Asset Tag ComputerName = 1111-MHS-2019-userID (Student) 1111-MHS-134-userID (Teacher) Extracts the 1st segment of a computer's ComputerName and applies it to the Asset Tag field of the JSS record for the computer. Script assettag=$(scutil --get ComputerName cut -d '-' -f1) sudo jamf recon -assettag $assettag

26 JSS Scripting Scripting FileVault 2 Enabled Users are instructed not to enable FileVault2 during the Yosemite upgrade

27 JSS Scripting Scripting Lock/Unlock laptop screen Lost Computers / Coax Student to Office

28 JSS Scripting Scripting icloud: Find My Mac - Standard User Standard users cannot enable Find My Mac without Admin Privileges Script security authorizationdb write com.apple.aosnotification.findmymac.modify allowtag

29 JSS Scripting Scripting Reset Printing System Milton wanted to remove all printers from student devices Extension Attribute Show if they are getting past our configuration.

30 JSS Basics

31 JSS Basics Network Segments Milton relies heavily on Network Segments Default Distribution Point > Specific JDS Instance > Default Netboot Server How we leverage Network Segments Default Distribution Point > Specific JDS Instance for each caching server Override the Building in Inventory = Used to display printers in Self Service. Printers are Scoped to a Building Files and Process: lpstat -p grep printer awk '{print $2}' xargs -I{} lpadmin -p {} -o printer-is-shared=false

32 JSS Basics Smart Computer Groups Milton has 140. We try to keep a Smart groups attached to a known policy Difference between Search Inventory Smart Group Smart groups are Always calculating Kinds 1. General Smart Groups 2. Updater - Groups 3. TECH = Groups

33 JSS Basics ios Restriction Profiles Milton uses a standard set of Configuration Profiles to restrict students ipad use.

34 JSS Basics ios PreStage Enrollment One Enrollment for each device type Procedure to wipe/setup a device 1. Device Wipe command sent from JSS Clear activation Lock is checked 2. Set the language & Wi-Fi 3. Authenticate (Sets the User & Location Field) 4. Restore if using an icloud backup 5. Device is ready to sign into itunes and icloud if you did not use a backup

35 Karl Senger Matthew Ward JAMF Certifications: CCA Certified Casper Administrator CCE Certified Casper Expert

36 Thank You for supporting K-20 Education! What else would you like to know?