We have a kinda cool solution here right after corona lockdowns started.
At first you need to define a Extension Attribute "Has Directory User" (you may need to adjust this, we have no local users with uid > 1000)
#!/bin/bash
potUsers=$(dscl /Local/Default -list /Users uid | awk '$2 >= 1000 && $0 !~ /^_/ { print $1 }')
if [ "${potUsers}" == "" ]
then
echo "<result>no</result>"
else
echo "<result>yes</result>"
fi
After that we created a SMART Group containing all Computers which had "Has Directory User: No".
After that we created a Configuration Profile with pre-filled VPN Information (an ipsec tunnel in our case, may differ in your Organisation, It's called 'Bootstrap VPN') which scoped to that SMART Group.
After that we created a Policy which triggers on "enrollment", which instantly uploads the Inventory of the machine -> Configuration Profile will be applied directly afterwards
After that we created a Policy which triggers on "network state change" and "startup" which just calls
networksetup -connectpppoeservice "Bootstrap VPN"
-> (re-)Enables tunnel after startup/network changes
This all integrates in our Process which
a) automatically resolves the Computername by querying the a gitlab repository or a CMDB (which may already know the correct Computername based on the Serialnumber) reboot
b) automatically join the active directory
c) first logon of the user caching the credentials
And Bonus:
After the First Directory user logged in, the Extensionattribute switches to "yes" and the Profile + VPN Access gets removed again.
Hopefully this helps some of you guys ;-)
