! ! ! ! ! ! ! Mac in the Enterprise IT Configuration Guide For Your Mac Evaluation and Deployment (Version 6.0) IT Configuration Guide—For Your Mac Evaluation and Deployment (Version 6.0) Table of Contents Introduction i 1 Packaging and Thin Imaging .................................................ii 1.1 Image Mac Computers iii 1.2 Create Packages iv 1.2.1 Create Packages Using Third-Party Utilities .............................................................v 1.3 Manage Local Images 6 1.3.1 Create Images with Disk Utility 7 1.3.2 Create a Disk Image from the Command Line ....................................................12 1.3.3 Deploy Images with Disk Utility 13 1.4 Network Images 14 1.4.1 Create a Bootable NetBoot Disk 15 1.4.2 Create NetInstall Images 19 1.4.3 Configure a NetInstall Server 22 1.4.4 Start Up to a NetInstall Image 26 1.4.5 Unicast Apple Software Restore 28 1.4.6 Multicast Apple Software Restore 29 1.4.7 Third-Party Deployment Solutions 31 1.5 Prepare Networks for Image Deployment .............................................................32 1.5.1 Set Clients to NetBoot Using the bless Command ............................................33 1.5.2 Use NetBoot DHCP Helpers 34 1.5.3 Relay bootpd 35 1.6 Minimal Touch Deployments 36 1.6.1 Streamlined Device Enrollment 37 2 Support and Maintenance 38 2.1 Use Asset Tags 39 2.2 Configure the OS X Server Caching Service .........................................................40 2.3 Configure the OS X Server Software Update Service .......................................42 2.3.1 Configure Software Update Server Clients ...........................................................44 2.3.2 Cascade Software Update Services 46 2.4 Leverage Third-Party Software Update Services .................................................48 2.5 Acquire Client Management Suites 49 3 Directory Services 50 3.1 Local Directory Services 51 3.1.1 Create Local Administrative Accounts ...................................................................53 3.1.1.1 Create Local Administrative Accounts in System Preferences ......................54 3.1.1.2 Create Local Administrative Accounts from the Command Line .................57 3.1.1.3 Change Local Administrative Accounts from the Command Line ..............59 3.1.2 Nest Network Administrators from Active Directory in a Local Administrative Group 60 3.1.3 Create Local Administrative Accounts with a Package or Script ................62 3.2 Active Directory 63 3.2.1 Bind to Active Directory 64 3.2.1.1 Bind to Active Directory Using Directory Utility .................................................65 !i IT Configuration Guide—For Your Mac Evaluation and Deployment (Version 6.0) 3.2.1.2 Bind to Active Directory with a Profile ....................................................................70 3.2.1.3 Bind to Active Directory from the Command Line ............................................76 3.2.1.4 Bind to Active Directory Using a Script .................................................................78 3.2.1.5 Bind to Active Directory Using a Post-Install Script ..........................................79 3.2.1.6 Active Directory Plug-in Troubleshooting Commands ...................................80 3.2.2 Set a User Home Directory 84 3.2.3 Namespace Support 89 3.2.4 Active Directory Packet Encryption Options ........................................................90 3.2.5 SSL Binding Instructions 91 3.2.6 Manage Certificates from the Command Line ....................................................93 3.2.7 Change Active Directory Computer Passwords ..................................................94 3.3 Third-Party Active Directory Plug-ins ......................................................................95 3.4 Kerberos 96 3.5 LDAP 97 3.6 Open Directory 98 3.7 Distributed File Sharing 99 3.7.1 Connect to DFS Shares 100 3.7.2 View DFS Shares with smbutil 101 3.7.3 Third-Party DFS Solutions 102 3.8 SMB2 Support 103 3.9 Smart Card Support 105 3.9.1 Third-Party Smart Card Service Options ..............................................................106 4 Configuration Management .............................................107 4.1 Configure a Profile Manager Server 108 4.1.1 Configure Network Settings 109 4.1.2 Configure Users 112 4.1.3 Add Groups 114 4.1.4 Review Certificates 116 4.1.5 Acquire Apple Push Notification Certificates .....................................................119 4.1.6 Enable Profile Manager 121 4.1.7 Automatic Push versus Manual Download Profiles ........................................125 4.1.8 Edit Management Profiles 126 4.1.9 Create Device Groups 130 4.1.10 Use Device Placeholders 133 4.1.11 Enroll OS X Devices 135 4.1.12 Lock a Device via the User Portal 139 4.1.13 Wipe a Device from the User Portal 141 4.1.14 Lock a Device Using Profile Manager ...................................................................143 4.1.15 Wipe a Device Using Profile Manager ..................................................................146 4.1.16 Remove a Mac from Management via the User Portal ..................................149 4.1.17 Remove Management via Profile Manager .........................................................151 4.1.18 Profile System Preferences 153 4.1.19 Non-Removable Configuration Profiles ...............................................................155 4.1.20 Restrict Access to System Preferences ..................................................................157 4.1.21 profiles Command 160 4.1.22 dscl Command 161 4.2 Manage Profiles 162 4.2.1 View the Contents of Profiles 163 4.2.2 Configure the Location of the Dock 164 4.2.3 Manage Third-Party Application Preferences .....................................................168 !ii IT Configuration Guide—For Your Mac Evaluation and Deployment (Version 6.0) 4.2.4 Manage Printers 172 4.2.5 Restrict Applications Using Profile Manager ......................................................176 4.2.6 Deploy VPN Connections Using Profile Manager .............................................181 4.2.7 Force Password Policies Using Profile Manager ................................................184 4.2.8 Configure Single Sign-On Using Profile Manager ............................................186 4.2.9 Limit Access to Sites Using Profile Manager .......................................................189 4.3 Password Policies 192 4.3.1 Audit Local Password Policies 193 4.3.2 Configure Local Password Policies 196 4.4 Use the Volume Purchase Program to Deploy Apps ......................................197 5 Security 198 5.1 Use Security Resources 199 5.2 Use Gatekeeper 200 5.2.1 Use Gatekeeper to Validate Application Downloads ......................................201 5.3 Enforce Firmware Passwords 204 5.4 Manage Remote Logins 205 5.5 Use Key-Based SSH Access 207 5.6 Use FileVault 2 209 5.6.1 Enable FileVault from the Command Line ...........................................................217 5.6.2 Use fdesetup to Validate Escrowed Recovery Keys ..........................................218 5.6.3 Enable FileVault on an External Volume ..............................................................220 5.6.4 Configure Master Passwords 222 5.6.5 Manage FileVault 2 Keys 224 5.7 Use Third-Party Full Disk Encryption .....................................................................228 5.8 Manage the Network Firewall 229 5.8.1 Use the Application-Layer Firewall 230 5.8.1.1 Configure the Application-Layer Firewall ............................................................231 5.8.1.2 Manage the Application-Layer Firewall from Terminal ..................................235 5.8.2 Use the pf Firewall 237 5.9 Manage Keychains 239 5.9.1 View Keychain Contents 241 5.9.2 Install Certificates Using Profile Manager ............................................................243 5.9.3 Enable Directory Services Searching for Certificates ......................................247 5.9.4 Enable Certificate Revocation Checking ..............................................................248 5.9.5 Import Items into a Keychain 250 5.9.6 Export Items from a Keychain 251 5.9.7 Configure iCloud Keychain 253 6 Networking/Wireless 255 6.1 Manage IPv4 Settings 256 6.2 Manage IPv6 Settings 266 6.3 Set Up Wired and Wireless Connections Using the Network Setup Assistant 269 6.4 Run Network Diagnostics 272 6.5 Configure Networking from the Command Line .............................................275 6.6 Configure VPN Settings 281 6.7 802.1x and Network Security Overview ..............................................................296 6.7.1 Configure WPA / TKIP — PSK 297 6.7.2 Configure WPA2 / AES — PSK 300 6.7.3 Create 802.1x Profiles 303 !iii IT Configuration Guide—For Your Mac Evaluation and Deployment (Version 6.0) 6.8 Import and Export 802.1x Profiles 309 6.9 Configure 802.1x to Join Corporate Networks ....................................................312 6.10 Obtain a Certificate from a Windows CA ..............................................................314 6.11 Trust Certificates from the Command Line ..........................................................317 6.12 Create Active Directory Certificates 318 7 Collaboration 322 7.1 Integrate with Microsoft Exchange 323 7.1.1 Use Mail, Contacts, and Calendar with Exchange ............................................324 7.1.2 Enable S/MIME in Mail 327 7.1.3 Enable Out-of-Office Responses in Mail ...............................................................328 7.1.4 Configure Exchange ActiveSync Certificate-Based