NetInstall, Firmware Updates, and High Sierra

[dtmille2]

Hello,

Our new Macs are enrolled in DEP and I have a complete zero-touch workflow implemented where in the Macs boot up, get enrolled in Jamf Pro, and policies deploy.

However, I have some labs of older non-DEP iMacs with HDD drives that are on Sierra

I want to get these Macs on High Sierra. Typically we have used a NetInstall process with Jamf Image to re-image our Macs every semester. I was thinking that with these Macs I would create a macOS Installer DMG with AutoDMG, and then boot into the .NBI created with AutoCasperNBI and then erase and copy that macOS Installer to the Mac.

However, this wouldn't get the firmware for the Mac that now runs with the installer. I don't know if HDD Macs get firmware updates when upgrading to High Sierra, but if they do they wouldn't get it. At least, I believe this is the case.

One alternative is to simply run the installer manually on each Mac so that they are sure to get the firmware updates. Then if I want to Netboot them into the .nbi and erase them and run the installer created by AutoDMG I could.

Anyone have any other suggestions for ensuring my older Macs get the firmware updates, still allow my NetInstall process?

[m_donovan]

You can add computers as old as 2011 to DEP.

[jmahlman]

What we're doing in our labs is dropping the installer into the applications directory and then running a simple script:

#!/bin/bash
/Applications/Install macOS High Sierra.app/Contents/Resources/startosinstall --applicationpath "/Applications/Install macOS High Sierra.app" --rebootdelay 30 --nointeraction

That will run the installer without a user. The only thing to worry about is the "Completing Installation" bit that has come up since 10.13.6 (we think) that requires a user to log in to complete installation. Basically the machine will sit at a login screen after it updates and the first user to log in will have to wait another 13 minutes while installation completes.

To combat this for our environment, we drop a temporary user package that will auto-login, reboot the system (which now automatically logs in), and then run the update script. After the system reboots and finishes installation I just remove the /etc/kcpassword file and/or the user, reboot, and we're done!

A bit of a faff, but it's been working well for us so far.

[dtmille2]

Really?!? How? I thought only iOS devices had that capability.

[jmahlman]

@m.donovan, I don't think you can add computers to DEP yet. We're in a similar situation, we have a lot of machines not in DEP for whatever reason, my guess is that there were several other purchase accounts that were used a few years ago and we don't know them. I've contacted our Apple rep a few times and while she was able to help me with a few, we still have many missing.

Sometimes netboot is still the answer.

[m_donovan]

I just added 30 2011 Macbook Pro laptops to our DEP and Prestage this morning. We do purchase everything through Apple but I believe as long as it was purchased through an DEP authorized reseller you should be good.

[jmahlman]

@m.donovan Can you explain how you added them? I didn't think that was a thing yet, I know you can with iOS devices..but not macOS.

[mconners]

Hello @dtmille2 and others, here is Apple's information on how to add computers to your DEP instance.

Apple's DEP Support Page

[jmahlman]

Okay, so I am correct..you cannot manually add computers to DEP, you can only add them to your DEP account if they're already in DEP (one way or another).

We still have many machines that for some reason aren't in our DEP account (2011 and newer). I'm assuming that we'll never be able to add them like iOS devices.

[dtmille2]

@m.donovan how did you get your old Macs enrolled in DEP? Did Apple do it for you?

I AM right to be concerned that my iMacs with HDD drives running Sierra might not get firmware updates if I use the macOS installer image made with AutoDMG in a NetInstall process, correct?

[jmahlman]

@dtmille2 I'm pretty sure you're correct top be concerned. I believe the only way to get the firmware installed is to run the High Sierra installer app. I think there may be a way to pull the firmware installer out and install it before the OS, but I can't seem to find the script.

[jmahlman]

You might want to check out this post on Amsys if you want to try something else.

[m_donovan]

Perhaps we are talking in circles. My workflow is to take a list of serial numbers and using deploy.apple.com or school.apple.com currently (we switched about a month ago) I add them to our DEP instance. After adding them to DEP I can go into our computer PreStage enrollment in Jamf and check if they have automatically been assigned. I will have to manually assign to the PreStage on some but some get the automatic assignment. I have not figured out why some do and others don't. Regardless of how they were added I can then run them through Recovery, Erase HD, and Reinstall the OS and our DEP configuration picks up after the first couple of screens in the setup assistant. The only difference between a 2011 Macbook Pro and a 2017 Macbook Pro is that the 2017 is automatically add to our DEP instance when purchased.

[erowan]

@jmahlman That startosinstall script requires an SSD with APFS, right?

[jmahlman]

@erowan Thats incorrect, startosinstall works regardless of the drive. The one that requires APFS is eraseinstall.

On 10.14, eraseinstall works for all drives because all drives become APFS, even spinning!