I'd like to start a discussion around thoughts, pros and cons of approaches. I am re-evalating my preferred method for initial deployment and would love to get some thoughts about both approaches.
Approach 1. Casper Imaging machine configuration. Pkgs, configuration scripts are deployed by Casper Imaging machine configuration... with an erase or no erase.
Approach 2. Casper Imaging OS only or Mac from the box is enrolled, machine configuration done entirely post enrolment via policies.
Both have swings and round-a-bouts.
I lean towards utilising Casper Imaging... as it's the more supported approach for initial deployment. Workflow for a new Mac being, run setup assistant, hit an internal portal to download Casper Imaging, run and choose a "no-erase" machine configuration. Software is installed, Mac is enrolled, bound, booted, patchoo bootstrap patches to latest (in case of version drift or OSX patches).
Casper Imaging:
Pros
- It's the supported workflow around intial deployment, even though a lot of people don't actually image anymore.
- Machine configurations within the Casper Imaging/Admin GUI are very visual, you can see exactly what's being deployed to a computer.
- There is a GUI whilst it's running, (although the firstboot screen is a little rough)
- You can leverage JAMF's firstboot, and Adobe install workarounds (why build this yourself?).
- You can also leverage pre-staging for large deployments.
- Completely refreshing (with an erase) is the same workflow and a vanilla unbooted OSX.dmg, and you can just make an erase / no erase a smart config under your base.
- Computers are named easily, and configurations can be stored / linked back to the JSS easily.
Cons
- It feels like it's become a little unloved. https://jamfnation.jamfsoftware.com/featureRequest.html?id=1155
- We need "application groups" and some more abilities around grouping common pkgs / etc. one level of "smart configs just isn't enough).
- Machine configurations aren't available post deployment. For me it makes sense to utilise the outside of Casper Imaging. https://jamfnation.jamfsoftware.com/featureRequest.html?id=2261
- It's called imaging, even though you don't have to image with it.
- Is it even going to hang around? It doesn't make sense to build your workflows around it, when Imaging is an old methodology and it feels like it's stagnating and might not even be around come v10.0.
JSS Policy Based
Pros
- Supports a more modern even BYOD workflow. User enrols computer, computer is configured to good state.
- You don't have to get the Casper Imaging app on to the Mac, nor Netboot (unless of course you are baremetal or in a very broken state).
- Build via smart group and all that delicious data within the JSS.
Cons
- No visual way to determine every thing in your builds (potentially having linked and chained polices could get very complicated and more difficult to debug).
- No GUI (build it yourself)
- No way to assign computer configuration / identifier (build this yourself)
- Much more admin heavy lifting, policies and scripts (again policy, smart groups...)
- No drag and drop to change computer configurations
- No computer naming during deployment (build this yourself)
- No "best practice", it feels like everyone is doing their own thing around pkg deployment and Mac identification.
- You'll still need Casper Imaging (or something) for bare metal unless you are internet recovering and manually pulling OSX from Apple.
Why do I ask all this?
I am considering working something into Patchoo to handle some of the stuff for JSS policy based deployment, but would love to know how people are taking Macs from the box and getting them into their desired state.
On the other hand, I still think we should use the tools that JAMF supply as much as possible, which is why Patchoo was built to augment the existing, group-->policy--->deploy workflow for POST deployment patching.
Thoughts?
