#profiles

Posted by Charles Edge on November 9th, 2015

Enter Apple Configurator 2, a free tool on the Mac App Store. This tool basically fixes most setup challenges for iOS, but does so over USB. This means that Apple Configurator is not  a replacement for Bushel. In fact, we get a lot of questions from experienced Apple administrators about how to use profiles that we don’t yet support. So Apple Configurator is great way to get settings on devices that you don’t need to update over the air (e.g. initial setup options). Apple Configurator 2 is a tool that can help to manage iOS devices during a mass deployment and do so in a manner that is easy enough that you don’t need a firm background in IT to manage devices on a day-to-day basis.

Here is what Apple Configurator can do:

  • Update iOS devices to the latest version of iOS.
  • Rename devices using a numbered scheme (e.g. iPad 1, iPad 2, etc).
  • Erase (wipe) iOS devices.
  • Backup and Restore iOS devices.
  • Deploy profiles/policies (e.g. no Siri for you, disable cameras, setup wireless, etc) to iOS devices.
  • Export profiles.
  • Activate devices (after all a restore of a freshly activated device is an activation).
  • Push any kind of app to devices.
  • Track Volume Purchase Program (VPP) codes used on devices.
  • Manage the wallpaper on “Supervised” devices (more on supervision later).
  • Manage the names of devices en masse.
  • Load content to apps on devices.
  • Skip initial Activation steps on devices.

Apple Configurator 2 does have some caveats, including the following:

  • In order to push apps through Apple Configurator, the system running Configurator needs access to Apple’s servers and Apple Configurator needs an AppleID associated with it that is not the VPP facilitator if you are leveraging any paid apps.
  • You can use Apple Configurator “off-line” or without an AppleID to Prepare devices with Profiles, just not to Activate devices. For the initial device activation process, Macs running Apple Configurator will need to be online. Additionally, you’ll be prompted to enter your Apple ID routinely.
  • If you push Trust and Enrollment profiles to automatically join an MDM, the device isn’t associated with a user unless the MDM has been prepped to designate each UDID or Serial Number to a given user. Bushel doesn’t yet support mass enrollment in this fashion but will.
  • If you accidentally plug in your iPhone to a machine and you’re using Apple Configurator on it and you’ve chosen to Erase in the application, then it will wipe your phone along with the 30 iPads you’re wiping. It’s awesome and scary like that (yes, I’ve accidentally wiped my phone).

I see a number of uses for Apple Configurator. Some of these use cases include:

  • Company and education labs: manage devices end-to-end (no MDM, iTunes iPhone Configuration Utility or other tools needed), managed by the lab manager.
  • One-to-One environments (schools): Manage the distribution of infrastructure settings (mail, wireless networks, etc) for devices as well as Trust Profiles to make it faster to enroll in MDM environments and Web Clips to manage the links for enrollment.
  • Device distribution: Pre-load applications (that can’t be updated unless they’re cradled again), renaming, profiles, activation, iOS software updates, etc.
  • Backup and Restore only stations where you don’t interfere with later iTunes use.

These can enhance practically every environment I’ve worked with. But unless it’s a small environment (e.g. the labs), Apple Configurator isn’t a replacement for the tools already in use in most cases, like an MDM solution. Instead, it just makes things better. Overall, Apple Configurator 2 is a welcome addition to the bat belt that we all have for iOS management and deployment. Now that we’ve looked at the when/where of using it, let’s look at the how.

At this point, we’ll explore the Profiles options in Apple Configurator 2. To create profiles, use the File menu and click on New Profile.

Screen Shot 2015-11-04 at 10.23.16 PM

At the Untitled profile name, enter a name in the Name field. This is how it will appear in the Profiles section of Apple Configurator. Because you can deploy multiple profiles, I’m just going to configure the SSID and Web Clip and call it MDM Enrollment Staging. Optionally, give it some notes, organization name, etc.

Screen Shot 2015-11-04 at 10.25.29 PM

Click on Wi-Fi and then click on the Configure button. Here, enter the SSID of the deployment network (MDMEnroll in this example). We’ll use the Hidden Network field to indicate the SSID is suppressed and we’ll use the network type of WEP and throw the password into the Password field as well. Now, before we move on, notice that there’s a plus and minus sign in the top right of the screen? You can deploy multiple of each, so if you have 10 wireless networks, 4 Email accounts, 9 VPN connections, 29 SSL Certs etc, you could deploy them all easily with multiple entries of each.

Screen Shot 2015-11-04 at 10.27.04 PM

Next, we’ll go ahead and enter a name for our Web Clip and the URL that the device will point to.

Screen Shot 2015-11-04 at 10.36.06 PM

We’ll also disable certain features of iOS. To do so, click on Restrictions, and uncheck various boxes in order to disable features you don’t wish to use.

Screen Shot 2015-11-04 at 10.39.22 PM

Go ahead and close the window and you’ll be prompted to save the profile.

Screen Shot 2015-11-04 at 10.29.55 PM

You’ll then see MDM Enrollment Staging.mobileconfig in the Finder where you selected to store it.

Conclusion

Apple Configurator 2 is really a great tool when used in the right scenarios. In learning how it works and interacts I actually learned a lot about both iOS and Mac OS X that I didn’t know before. I hope I did the tool justice with how easy it is to use. This is a fairly long article and it’s probably more complicated than it needs to be in parts, but that’s more my method of trying to figure out what it’s doing than the tool being complicated. It’s not hard to figure out at all. I am sure I could teach any non-technical iOS admin basic use of Apple Configurator 2 in less than an hour.

Overall, in Apple Configurator 2, we have a new, powerful iteration in our arsenal that makes up the iOS administration ecosystem. I also hope that no matter what, if you manage iOS devices, that you’ll take a look at it. I expect you’ll find it useful in some part of your management toolkit!

Posted by Charles Edge on June 11th, 2015

When you enroll devices into Bushel, you’ll be prompted for a name and email address. We use these two fields to setup the mail profile for users and display who has that device. You can see who a device is assigned to by clicking on the device in Bushel and checking out the Assigned To card, shown here.

Screen Shot 2015-06-11 at 9.45.41 AM

There will be times when you need to move the device to another user. To do so, you can either Unassign the device, which will blank out these settings or you can click on “Assign device” to configure a new Name and Email address for the user.

Screen Shot 2015-06-11 at 9.49.26 AM

And be careful, because when you reassign a device, the profiles will change, which at a minimum will remove and re-add mail accounts. If you do this en masse, be prepared for re-caching all the mail.

You can also use this method to deploy a generic profile to devices using a script or a tool like Apple Configurator.

Posted by Charles Edge on January 11th, 2015

You can export profiles from Apple Configurator or Profile Manager (or some of the 3rd party MDM tools). You can then install profiles by just opening them and installing. Once profiles are installed on a Mac, mdmclient, a binary located in /usr/libexec will process changes such as wiping a system that has been FileVaulted (note you need to FileVault if you want to wipe an OS X Lion client computer). /System/Library/LaunchDaemons and /System/Library/LaunchAgents has an mdmclient daemon and agent respectively that start it up automatically.

To script profile deployment, administrators can add and remove configuration profiles using the new /usr/bin/profiles command. To see all profiles, aggregated, use the profiles command with just the -P option:

/usr/bin/profiles -P

As with managed preferences (and piggy backing on managed preferences for that matter), configuration profiles can be assigned to users or computers. To see just user profiles, use the -L option:

/usr/bin/profiles -L

You can remove all profiles using -D:

/usr/bin/profiles -D

The -I option installs profiles and the -R removes profiles. Use -p to indicate the profile is from a server or -F to indicate it’s source is a file. To remove a profile:

/usr/bin/profiles -R -F /tmp/HawkeyesTrickshot.mobileconfig

To remove one from a server:

/usr/bin/profiles -R -p com.WestCoastAvengers.HawkeyesTrickshot

The following installs HawkeyesTrickshot.mobileconfig from /tmp:

/usr/bin/profiles -I -F /tmp/HawkeyesTrickshot.mobileconfig

If created in Profile Manager:

/usr/bin/profiles -I -p com.WestCoastAvengers.HawkeyesTrickshot

There is a nifty new feature in the profiles command in Yosemite where you can configure profiles to install at the next boot, rather than immediately. Use the -s to define a startup profile and take note that if it fails, the profile will attempt to install at each subsequent reboot until installed. To use the command, simply add a -s then the -F for the profile and the -f to automatically confirm, as follows (and I like to throw in a -v usually for good measure):

profiles -s -F /Profiles/SuperAwesome.mobileconfig -f -v

And that’s it. Nice and easy and you now have profiles that only activate when a computer is started up. As of OS X Yosemite, the dscl command has extensions for dealing with profiles as well. These include the available MCX Profile Extensions:

-profileimport -profiledelete -profilelist [optArgs]
-profileexport
-profilehelp

To list all profiles from an Open Directory object, use 
-profilelist. To run, follow the dscl command with -u to specify a user, -P to specify the password for the user, then the IP address of the OD server (or name of the AD object), then the profilelist verb, then the relative path. Assuming a username of diradmin for the directory, a password of moonknight and then cedge user:

dscl -u diradmin -P moonknight 192.168.210.201 profilelist /LDAPv3/127.0.0.1/Users/cedge

To delete that information for the given user, swap the profilelist extension with profiledelete:

dscl -u diradmin -P apple 192.168.210.201 profilelist /LDAPv3/127.0.0.1/Users/cedge

If you would rather export all information to a directory called ProfileExports on the root of the drive:

dscl -u diradmin -P moonknight 192.168.210.201 profileexport . all -o /ProfileExports

Note: Provisioning profiles can also be managed, frequently using the lower-case variant of installation and removal (e.g. -i to install, -r to remove, -c to list and -d to delete all provisioning profiles). Provisioning profiles can also come with a -u option to show the uuid. Finally, the -V option verifies a provisioning profile.

In Yosemite we have a few new options, such as -H which shows whether a profile was installed, -z to define a removal password and -o to output a file path for removal information. Also, in Yosemite it seems as though if a configuration profile was pushed to you from MDM, you can’t remove it (fyi, I love having the word fail as a standalone in verbose output):

bash-3.2# profiles -P
_computerlevel[1] attribute: profileIdentifier: 772BED54-5EDF-4987-94B9-654456CF0B9A
_computerlevel[2] attribute: profileIdentifier: 00000000-0000-0000-A000-4A414D460003
_computerlevel[3] attribute: profileIdentifier: C11672D9-9AE2-4F09-B789-70D5678CB397
charlesedge[4] attribute: profileIdentifier: com.krypted.office365.a5f0e328-ea86-11e3-a26c-6476bab5f328
charlesedge[5] attribute: profileIdentifier: odr.krypted.com.ADD7E5A6-8EED-4B11-8470-C56C8DC1E2E6
_computerlevel[6] attribute: profileIdentifier: EE08ABE9-5CB8-48E3-8E02-E46AD0A03783
_computerlevel[7] attribute: profileIdentifier: F3C87B6E-185C-4F28-9BA7-6E02EACA37B1
_computerlevel[8] attribute: profileIdentifier: 24DA416D-093A-4E2E-9E6A-FEAD74B8B0F0
There are 8 configuration profiles installed
bash-3.2# profiles -r 772BED54-5EDF-4987-94B9-654456CF0B9A
bash-3.2# profiles -P
_computerlevel[1] attribute: profileIdentifier: F3C87B6E-185C-4F28-9BA7-6E02EACA37B1
_computerlevel[2] attribute: profileIdentifier: EE08ABE9-5CB8-48E3-8E02-E46AD0A03783
_computerlevel[3] attribute: profileIdentifier: 24DA416D-093A-4E2E-9E6A-FEAD74B8B0F0
_computerlevel[4] attribute: profileIdentifier: 00000000-0000-0000-A000-4A414D460003
_computerlevel[5] attribute: profileIdentifier: 772BED54-5EDF-4987-94B9-654456CF0B9A
_computerlevel[6] attribute: profileIdentifier: C11672D9-9AE2-4F09-B789-70D5678CB397
charlesedge[7] attribute: profileIdentifier: odr.krypted.com.ADD7E5A6-8EED-4B11-8470-C56C8DC1E2E6
charlesedge[8] attribute: profileIdentifier: com.krypted.office365.a5f0e328-ea86-11e3-a26c-6476bab5f328

There are 8 configurations installed:

bash-3.2# profiles -rv 772BED54-5EDF-4987-94B9-654456CF0B9A
profiles: verbose mode ON
profiles: returned error: -204
fail

Posted by Charles Edge on October 6th, 2014

When you add a bunch of devices to an MDM, we call it mass enrolling. Adding iPads, iPhones and iPods to your Bushel can be done through Apple Configurator. Apple Configurator automates the enrollment process, but when working with Bushel the enrollment profile has the username and email address, if you’re using email. This means that you would only want to use a mass enrollment option with Bushel if you are not using email, if all of your users will have the same generic email address or if your users will enter their own email information.

As mentioned, an enrollment profile automatically adds your devices to your Bushel. To obtain the enrollment profile:

  • Log into your Bushel.
  • Click on Devices.
  • Click on Enroll for Enroll This Device.
  • Click on Enroll This Device.Screen Shot 2014-10-17 at 11.04.16 AM
  • Once the profile is downloaded, it will automatically attempt to enroll the computer you are downloading it from in the Profiles System Preferences pane.

Screen Shot 2014-10-17 at 11.05.41 AM

  • Click on Cancel.
  • Click on the downloads link in Safari.
  • Click on your Downloads folder.

Screen Shot 2014-10-17 at 11.08.55 AM

  • You have now downloaded the .mobileconfig file that will enroll devices into your Bushel

Add the Profile To Apple Configurator:

To deploy the profile through Apple Configurator:

  • Open Apple Configurator.
  • Click on Supervise in the row of icons along the top of the screen.
  • Drag the profile (by default currently called MDM-iOS5.mobileconfig) from the Finder into the list of Profiles.Screen Shot 2014-10-17 at 11.21.09 AM
  • The profile then appears in Apple Configurator (in this example, called jasper Bushel Profile but would be called your organization’s name followed by Bushel Profile for you).

Deploy The Bushel Enrollment Profile Through Apple Configurator

Once the profile is installed in Apple Configurator, let’s deploy it. In this example, don’t configure any other options. To deploy:

  • Open Apple Configurator.
  • Click on Prepare.
  • Click on the Install Profiles button in the Profiles section of the Settings pane.Screen Shot 2014-10-17 at 11.24.37 AM
  • Click Next.Screen Shot 2014-10-17 at 11.25.02 AM
  • Check the box for the enrollment profile.Screen Shot 2014-10-17 at 11.25.48 AM
  • Click Next.
  • Follow the prompts on the screen of the device to install the profile.

If you then wish to remove the device from your Bushel (aka unenroll), simply remove the enrollment profile by opening the Settings app, scrolling down to the Profiles section and tapping on the Remove button for the profile you just installed.