JAMF Nation Roadshow. Sachin Parmar End User Toolset Manager

Transcription

1 JAMF Nation Roadshow Sachin Parmar End User Toolset Manager

2 About Just Eat

3 Our vision Creating the world s greatest food community 3

4 About Me

5 About Me Sachin Parmar 7+ years professionally in the Technology industry Administrator of Microsoft System Centre Configuration Manager 2007, 2012 Administrator of JAMF Software Casper Suite for 4 years over two companies: DMGT Daily Mail and General Trust Plc Supporting over Mac s Globally JUST EAT - Supporting over 500+ Mac s Globally Blog: LinkedIn: Sachin Parmar ( sachin.parmar@just-eat.com JAMF Nation: 5

6 Our Journey

7 Our Journey Jan registered Mac s bound to the domain with Centrify June - July 2015 Gathered requirements on current processes and how technicians build Mac s, all manual process May 2015 Sachin Parmar joins Just Eat from DMGT Plc 7 July 2015 Trial Casper Suite Server requested from JAMF Software August September 2015 Submitted Business Case for JAMF Software Casper Suite for approval to the Head of Technology

8 Our Journey Jan Day OS X Jumpstart Booked with JAMF Software to come on site and configure Casper Suite Feb/March policies configurations built inside Casper Suite, to help automate imaging Mac s. March 2016 Casper Suite rolled out to 400 Mac s, and all new Mac s are imaged with Casper Suite November 2015 Business Case was approved by Head of Technology and JAMF Software Casper Suite purchased via reseller Jan/Feb 2016 OS X Jumpstart completed and implementation began March 2016 Local distribution points placed in 7 locations over 6 Countries 8

9 Our Journey March Present 2016 All Centrify Mac s Migrated to Casper Suite, Casper Suite now BAU Our Future Journey TBD 2016/2017 Casper Suite to manage a full Zero Touch Deployment of all Apple Devices to End Users Sep 2016 Day 1 deployment of macos Sierra Oct 2016 Merge our existing Apple Device Enrolment Program and Volume Purchase Program into Casper Suite Oct 2016 Implement ADFS Single Sign 2.0 with Azure Multi-Factor Authentication into Casper Suite 9

10 Why Casper Suite?

11 How Casper Suite benefits Just Eat? We can allow users to run predefined health check in a Self Service style app store which can be run with elevated permissions without the end users ever needing administrative rights to the Mac Casper Suite can execute mission-critical and highly coordinated software upgrades seamlessly Set up printers if in a new location, i.e. Travelling between locations. Easy to manage network printers and roll them out when you change suppliers/vendors or new printers Asset management of Mac s (Auditing Purpose), proactively report info to IT on battery life and if hardware has been tampered through reports. Managing the lifecycle of all MAC s easily. Which makes IT a more consistent, higher level of support to all end users 11

12 What does Just Eat use Casper Suite for?

13 Imaging Just Eat use a combination of netboot imaging (similar to PXE builds for Windows and thin client imaging A standard build installs the core components of that any mac may need, from web browsers to instant messengers to company based fonts all handled via the Casper Imaging client During the imaging process the Mac is bound to Active Directory based upon it s naming convention set within the Casper Imaging application during the imaging process An image takes approximately minutes to complete from start to finish All images are composed with a mixture of Casper Composer and AutoCasperNBI 13

14 Software Deployment Just Eat utilise Casper Suite heavily for software deployment All applications are centrally packaged and managed and made available to end users via the Self Service option Any mission critical software is deployed to the end users silently in the background whilst they are working during core business hours Composer which is a standalone product or part of the Casper Suite makes software packing tasks effortless and is a very easy to use (and I can t recommend it highly enough!) Some complex packages that Just Eat have automated include: - Adobe Creative Cloud - Microsoft Office & Updates - Virtual Machines (Windows 7, 8, 8.1, 10) - Operating System Updates 14

15 Security Just Eat have used Casper Suite to control the security of every single company owned mac with the mixed use of an Institutional Recovery Key and an Individual Recovery Key The flexibility of this option built into the Casper Suite allows our end users to not only have control of their own machine encryption but ultimately a company override standard which is used when required and sanctioned by the Information Security team 15

16 Reporting Running reports on our estate is a critical process of how we as Technology evolve in the management of our estate Using Casper we re easily able to identify Macs that are noncompliant against security policies, Macs missing key essential software, Hardware reports and many more The technology team can take pro-active steps and influence key decisions on how/and when an action should be taken on all or part of the Mac environment Reporting can be as granular or as high level you can think off! 16

17 Self Service

18 Self Service 18

19 Self Service - Printers The single most requested support ticket we received in our Tech Support team was mapping printers to Macs The team would visit the user and manually add the IP address and printer driver, over and over again! With Self Service we now have a policy which shows displays the printers available to the end user in specific location based upon the IP address of the Mac. For example, A user based in our London office would have access to the printers only located in the London building, if the same user were to go to our office in Bristol they would then see all printers available in our Bristol office By enabling this feature in Self Service, the Tech support team managed to reduce the ticket stats month on month by an average of 20% 19

20 What have Just Eat done with Casper Suite that s unique?

21 Asset Tag Policy A policy the user can run from Self Service which will execute and open a dialog which will prompt the End User to enter their machine Asset Tag The policy is only ever run once on the user s computer regardless of who ever logs in This updates our inventory and keeps us on top of any hardware auditing we have Want to use this yourself? 21

22 Custom Login Background Just Eat are very much a company that focuses on our brand whether on the street, at a supplier meeting, at a conference! or very much internally, so a nice way to identify this is we made a custom login screen background and pushed this to all of our End Users Want to use this yourself? changing-the-login-screenwallpaper-on-mac-os-x 22

23 Custom Security Acceptance Policy As well as focus on the Just Eat brand we take security and data protection very seriously and enforce a security policy on all machines whether Mac or PC Now we ve all seen your standard security acceptance policy, so what we ve decided to do is jazz it up a bit and created a policy which pushes out our on-brand policy to all of our end users before they can log in to the Mac This is a built in feature of Mac OS, more help can be found here: 23

24 Auto create and enable Local Admin for FileVault 2 A policy that runs on end user Mac s that does not currently have a local administrator account, then creates the account automatically with Admin privileges and auto enables the account once the policy has detected the Mac has been encrypted no user intervention! Want to use this yourself? 24

25 Migrating from Centrify to Casper Suite During our Centrify to Casper Suite migration we wanted an easier way for our Technicians to migrate Mac s, rather than having to carry out steps manually Myself and my colleague Lewis Lebentz wrote a script that would remove the machine from Active Directory, Uninstall Centrify and enroll the Mac into our JSS Want to use this yourself? 25

26 Deploying Windows 10 Virtual Machine A policy that installs a Parallels Desktop 11 for Mac, Windows bit Virtual Machine to a end users Mac which is available to the end users via Self Service The policy copies a captured Windows 10 x64 image to a shared location on the Mac, the end user installs Parallels Desktop for Mac then during the installation points the path to a virtual machine to the shared location. Windows 10 VM starts straight away. End User still required to contact IT to: Domain Join License Windows - IT maintains control of licensing 26

27 Help and Troubleshooting?

28 JAMF Nation JAMF Nation is a great resource for anyone that is a Mac admin and/or considering making the switch to JAMF Software Casper Suite JAMF Nation contains user guides, technical papers, scripts ready to use which have been vetted by JAMF Software and much more The discussion boards contains a wealth of knowledge and questions sharing your ideas or seeking help from others like you all over the world, chances are if you don t know something you ll find the answer here! 28

29 Mac Admins Slack Channel Another great resource for a Mac administrator is the Mac Admins slack channel, similar to JAMF Nation it shares the same ethos of mac admins from around the world asking questions to help others like you Similar to JAMF Nation, other Mac admins often share code snippets or scripts which you can use or adapt for use in your environment 29