I've not found a lot of workflows to rerun through the DEP process but I've found a number of folks that seem to want to run through DEP again quickly. I'm sharing our methods for re-running DEP without re-imaging the computer completely. We've found two options that work well for DEP deployment testing: a second partition on the computer or removing some files from the device to trigger the Setup process again. Feel free to add to this if you have other solutions:
A Second Partition
This process involves making a second partition on the existing system. Prior to running through DEP, boot to the Recovery HD. Next using Disk Utility, partition Macintosh HD into two partition. Clone the existing Macintosh HD to the New Partition and name it something other than Macintosh HD or Recovery HD (I'll use PreDEP HD). Quit Disk Utility and select Macintosh HD as your startup drive then reboot.
- Pros: You can quickly reboot to the Recovery HD and clone the PreDEP HD over the Macintosh HD.
- Cons: If you accidentally modify the PreDEP HD, you have to wipe it, re-install and start again.
- Optional: Instead of cloning the entire drive to the second partition, you can simply store a disk image on the second partition of Macintosh HD. It prevents you from accidentally booting to the wrong hard drive, but it may take up to two minutes longer to restore depending on how you created the disk image.
Remove Some Special Files
Keep in mind that this is essentially performing a selective lobotomy on your computer. Be careful what you type.
Boot the computer into Single-User mode and mount Macintosh HD as writable. Next run the following commands:
rm /var/db/.AppleSetupDone
rm -rf /var/db/ConfigurationProfiles/
rm /Library/Keychains/apsd.keychain
jamf removeFramework
rm -rf <any created user accounts>
rm -rf /var/db/dslocal/nodes/Default/users/<user plist file>The last two commands require some explanation. rm -rf <any created user accounts> is used for you to remove any accounts home directories created in /Users, /var (for some hidden accounts) or other locations that your management of the system created. rm -rf /var/db/dslocal/nodes/Default/users/<user plist file> removes the actual account that is created. If the account is not removed, you will not be able to use the same short name again. If the home directory is not remove, the same short name for the account can be used, but you will see a "-1, -2" appended to your home folders.
- Pros: Faster than re-imaging or cloning an image over top of the boot drive.
- Cons: Requires messing around in terminal where typos can be very treacherous.
Sources
- DEP not forcing MDM enrollment OS X
- Corrective commentary provided by @tyler.sparr @seann & @StoneMagnet
