Imaging questions

[lehmanp00]

I need to make new base images for all our Macs this summer. I have a few questions I thought I'd throw out to the community to see if there were any better ideas than I have about how to go about it.

I have Macbooks from the 10.5, 10.6 and 10.7 eras to make images for AND we will be getting new Macbooks this summer (10.8 and/or 10.7 I'm sure). I would also want these images to boot on iMac's as well.

I know I will need to make a separate image for each OS level. That means at least 4 images. What about hardware? Can I put 10.6 or 10.5 on a 10.7 Macbook and have it boot all the older Macs? or won't 10.5 and 6 even install? I'm thinking I need to find the newest hardware for each OS and make the image on that. Which would be a royal pain!

1 other question:
How do we best handle the iLife suite (GB, iPhoto etc..) on a base image when it is installed thru the App Store now? Even though they are purchased with the hardware?

Thanks for any help!
Patrick

[eftech]

personally I'd start at 10.7, unless you have a 'really good reason' your making life really complex looking after that many OS versions. 10.5 (and 10.6) are basically dead.. so why support them?

I don't provide iLife unless its specifically requested as part of a config and its removed from the base build.

Sometimes I also allow them oxygen... but only if they are nice and buy me a beer!

:)

[lehmanp00]

I wish I could.

We have 7 schools that have Macbooks that date back to the original Intel hardware. Dozens of them. They only run 10.5. Same with the hundreds 10.6 Macs we have!

iLife is required on all Macs in our district.

[stevewood]

I would look at InstaDMG to create your OS images for each of the different versions you need. You should be able to use InstaDMG on your latest 10.7 machine to create the 10.5, 10.6, and 10.7 OS images that you will require.

Since InstaDMG does not boot the image, your image should work on every model for that particular OS level. So to answer your iMac question, yes, the image prepared using InstaDMG should boot it with no problem.

And since no new hardware has come out (yet) since 10.7.4 was released, if you build your base OS image for 10.7 as a 10.7.4 OS image, that too should boot all devices that will run 10.7. The only other thing to consider with 10.7 is the recovery partition. If you want the recovery partition, you may need to script the creation of this after the OS is laid down on your machines. I have not tested whether the newest InstaDMG takes care of the recovery partition or not. So if someone else knows, please speak up.

This does mean that you will need to maintain at least 3 different configurations in Casper Admin: 10.5, 10.6, and 10.7.

As for the new machines coming in, I would look at Thin Imaging the machines instead of a nuke and pave methodology. Just put the apps on the machines and leave the OS that comes from the factory in place. This should give you one more config for new 10.7 and hopefully 10.8 machines when they start rolling in.

As far as the iLife suite, if you already have licenses for the DVD version, deploy that to your older machines. Your newer machines that come pre-loaded with the MAS version, you can download updates from the MAS and package them using Composer. The MAS version of the iLife suite apps are self containing, meaning that everything is in the app bundle that lives in Applications. So just packaging the app will get you a full working version of iPhoto, for example.

HTH

Steve

[mm2270]

+1 for Steve's suggestion to use InstaDMG. You'll still have 3 (or possibly 4) different OS images to maintain, but using the InstaDMG approach you'll at least be able to only have one of each OS version that will work on any hardware you have that it can boot.
I would still look at moving as many of your Macs as possible to the latest OS they support. So, if you have MacBooks that shipped with 10.6 that can run 10.7 solidly, seriously look at moving them that direction if you have the budget for it. If budget is a roadblock, do whatever research you need to to make a case on that. Trying to support 3 OSes, one of which never even sees an update anymore from Apple is going to cause some headaches. Underlying functions can and do change with each release. You may find yourself building separate OS specific policies in the JSS.
Also consider that JAMF follows Apple's lead in only supporting the versions of OS X that Apple does, so once 10.8 ships, the Casper Suite will likely be updated to support 10.6, 10.7 and 10.8, leaving your 10.5 Macs behind. Not a definite of course, but it may happen. You can always run a "legacy" version of Casper Suite on a separate box or VM for your 10.5 systems, but that will add even more complexity to your situation.

Also the suggestion to go with thin imaging is good, provided it works for you. Some environments require a complete wipe and re-image, but hopefully you also aren't saddled with that requirement. Sounds like you already have enough variables to manage there.

[CasperSally]

I agree get as many up to latest OS as possible.

I'm sure you know, but Lion requires 2 gigs of RAM - machine will image 10.7 but not boot.

[gregneagle]

We have 7 schools that have Macbooks that date back to the original Intel hardware. Dozens of them. They only run 10.5.

I am 99.999% sure that ALL Intel Macs can run 10.6. Some early Intel Macs cannot run 10.7, but all can run 10.6.x.

-Greg

[mm2270]

I didn't think of it, but Greg is correct. Basically anything with a Core Duo processor (all early Intel Macs) can run 10.6. I just double checked against Mactracker and it shows all early Macbook models, iMacs and such as 10.6.8 being the maximum OS they can run. That is of course if they have enough RAM installed.
I'm hoping you don't have any PowerPC systems you're still supporting. If you do, I would do some praying for those things to die so you can replace them. :)

[lehmanp00]

Would making a 10.6 image on the Thunderbolt Macbooks boot the older Macs? If so, I can at least do that.

As for upgrading.......
The schools never bought upgrades or upgrade assurance for the 10.5 Macs. In fact (what I was just told), we never purchased the upgrade program for anything since AMP was discontinued. Trying to save money I guess.

InstaDMG is a beast! I think it would work if we didn't have to make so many little changes to our image. We do things like set bookmarks, turn on VNC, add alias's on the desktop and such. (Many of your schools use a generic local user account). If I can get 10.6.8 on a new Macbook and it boots on the older stuff, that would be great.

Edit:spelling

[mm2270]

I think it would work if we didn't have to make so many little changes to our image. We do things like set bookmarks, turn on VNC, add alias's on the desktop and such. (Many of your schools use a generic local user account).

There's no reason you can't do all of that post initial imaging using MCX, policies and package installs, etc. from within Casper.
For example, you can create the local account easily either with InstaDMG using the CreateUser or CreateLionUser pkgs that are add on to InstaDMG, or it could be done with a policy in Casper. Adding bookmarks and aliases on the Desktop can also be done with DMG packages in Casper and the Fill Existing Users & Fill User Template options.

Regarding upgrades, not sure what to tell you about that. Only thing I'll say is if you have an Apple SE you work with, I would check in with them to see what can be done. Its possible they can work out some kind of arrangement regarding 10.6 on those early MacBooks. Never know.

[lehmanp00]

We have just recently started really looking at managing Macs with Casper. I come from a Windows background and Mac management is different enough that I'm taking it slow. For now, I'm going to just try to get a "Golden" master ready for each. I think I have hardware lined-up to do that. This summer I will look more in-depth at InstaDMG (seems really complicated to me) and using Casper more. Thank you to everyone who has helped in this thread so far! You giving me some good concepts to think about!
Patrick

[lehmanp00]

FYI, The new Macbooks that came with 10.7 this winter DID boot into 10.6.7!
Making the new image now and everything is working fine.

[tlarkin]

Hey Everyone,

So I have about 30 minutes between conference calls and I am actually caught up with email for once...probably just jinxed myself by saying that. Anyway, I'd like to chime in here and point out a few things, and I want to be clear that some of this is opinion and not fact.

Steve Wood brought up an awesome point. InstaDMG is in fact a great tool, and it does work with Casper. I have personally used it at my previous job to create one master base image for every single Mac in my deployment, which included: Macbooks, Macbook Airs, Macbook Pros, iMacs, and Mac Minis. I just would like to point out that with 10.5 and 10.6 instaDMG is not required to make a pristine never been booted image. You can drop an image of an installer disk into Casper Admin and use the option that says this disk contains an OS X installer. It will then create a usable never been booted image to deploy. To my knowledge though, this doesn't work with 10.7. Also, you would have to apply OS updates separately, where as with InstaDMG you can slip-stream them in with the python script and the catalog files. My main point is, you don't have to learn a whole new tool if you don't want to. I am a big fan of time versus reward these days so whatever the most efficient way is for you, use it. I did post a tutorial on InstaDMG here a while ago, before I worked for JAMF.

https://jamfnation.jamfsoftware.com/discussion.html?id=3683

So really with Casper Admin it is the same process as you still import from an installer DVD with InstaDMG. I also would like to point out that if the golden master image process works for you, and takes less time because you have that work flow already built by all means use it.

The next thing Steve brought up, is Thin Imaging, which I am honestly now sort of a huge fan of. It makes complete and total sense from a new machine perspective. Once you get your OS in place everything else can be deployed via policy or managed preference (or configuration profile if applicable). You need the infrastructure in place to push out larger packages over your network of course if you are going to use wireless. This would also allow you to maintain that one base image that works on all Macs and everything else is handled via inventory scope and policy or profiles and managed preferences. So you could accomplish this with a quickadd package with a custom post flight script that calls manual trigger policies, or a post image shell script that does so, or just scope policy to have it already in place and just flush the policy logs of that computer when you image it, so all the policies it already ran get reset to run again.

Thanks,
Tom

[nkalister]

To my knowledge though, this doesn't work with 10.7. Also, you would have to apply OS updates separately

Hey Tom, this actually DOES work with 10.7- you just need to use the InstallESD.dmg file inside of the Lion Installer.app. Drop that DMG into casper admin, click the box to tell casper it's an OS installer, and you're all set.
Apple also updates that package to the latest rev of lion whenever it's updated, so your core OS updates are already slipstreamed for you.

[tlarkin]

Hey Tom, this actually DOES work with 10.7- you just need to use the InstallESD.dmg file inside of the Lion Installer.app. Drop that DMG into casper admin, click the box to tell casper it's an OS installer, and you're all set. Apple also updates that package to the latest rev of lion whenever it's updated, so your core OS updates are already slipstreamed for you.

Awesome Nick, I just haven't tried that method yet in 10.7. Thanks for letting me and the community know. I appreciate it.

I hope all is well out on the west coast, hopefully I will make it out there again very soon!

-Tom

[bentoms]

As Nick said it does work. I use it that way myself.

Also, you get the recovery partition as the InstallESD partitions the disk image that Casper admin creates for the Image.

Tbh, for all of InstaDMG's plaudits... I've never got on with it but have been happy wih this method since 10.6

[tlarkin]

Hey Nick,

Now that I think about it, I think I was using a 10.7.x DMG file that had the expired signing on the PKGs inside. I am going to use Greg Neagle's Python script to fix that and try running it again and see how it works. Since 10.7 is downloaded via App Store, you should always have the newest OS version since you can pull it down.

Thanks!
-T

[nkalister]

hi tom- yeah, we were still getting expired certs in the 10.7.3 installESD when you were out here for our jumpstart! 10.7.4's fine, though, the certs are good.