About the Authors |
|
xv | |
About the Technical Reviewer |
|
xvii | |
Preface |
|
xix | |
|
Chapter 1 The Evolution of Apple Device Management |
|
|
1 | (60) |
|
The Classic Mac Operating Systems |
|
|
3 | (1) |
|
|
4 | (3) |
|
|
7 | (3) |
|
|
10 | (3) |
|
|
13 | (4) |
|
|
17 | (7) |
|
|
24 | (2) |
|
|
26 | (2) |
|
|
28 | (2) |
|
|
30 | (3) |
|
Apple Device Management Programs |
|
|
33 | (2) |
|
|
35 | (4) |
|
|
39 | (5) |
|
|
40 | (1) |
|
|
40 | (4) |
|
|
44 | (3) |
|
Moving Away from Active Directory |
|
|
47 | (1) |
|
The Apple Admin Community |
|
|
48 | (8) |
|
|
49 | (5) |
|
|
54 | (2) |
|
|
56 | (2) |
|
|
58 | (3) |
|
Chapter 2 Agent-Based Management |
|
|
61 | (74) |
|
|
62 | (10) |
|
Use Lingon to See and Change Daemons and Agents Easily |
|
|
66 | (4) |
|
Controlling LaunchDaemons with launchctl |
|
|
70 | (2) |
|
Deeper Inspection: What Does the App Have Access To? |
|
|
72 | (1) |
|
Third-Party Management Agents |
|
|
73 | (49) |
|
|
73 | (5) |
|
|
78 | (2) |
|
The Once Mighty Fleetsmith |
|
|
80 | (4) |
|
|
84 | (5) |
|
|
89 | (18) |
|
|
107 | (9) |
|
|
116 | (3) |
|
|
119 | (2) |
|
|
121 | (1) |
|
Use Git to Manage All the Things |
|
|
122 | (5) |
|
The Impact of UAMDM and Other Rootless Changes to macOS |
|
|
127 | (2) |
|
|
129 | (1) |
|
|
129 | (2) |
|
Miscellaneous Automation Tools |
|
|
131 | (1) |
|
|
132 | (3) |
|
|
135 | (72) |
|
Manually Configure Settings on Devices |
|
|
136 | (14) |
|
Use Apple Configurator to Create a Profile |
|
|
150 | (51) |
|
View the Raw Contents of a Profile |
|
|
162 | (4) |
|
Install a Profile on macOS |
|
|
166 | (4) |
|
|
170 | (6) |
|
|
176 | (6) |
|
View a Profile from macOS |
|
|
182 | (3) |
|
|
185 | (4) |
|
|
189 | (2) |
|
Remove a Profile on macOS |
|
|
191 | (2) |
|
|
193 | (5) |
|
|
198 | (2) |
|
Effects of Profile Removal |
|
|
200 | (1) |
|
Use the Profiles Command on macOS |
|
|
201 | (5) |
|
Using the Profiles Command |
|
|
202 | (2) |
|
|
204 | (2) |
|
|
206 | (1) |
|
|
207 | (74) |
|
|
208 | (1) |
|
Apple Business Manager and Apple School Manager |
|
|
209 | (6) |
|
Buy Apps to Distribute with MDM |
|
|
215 | (4) |
|
|
219 | (2) |
|
Check-Ins: Device Enrollment |
|
|
221 | (6) |
|
|
227 | (2) |
|
|
229 | (9) |
|
Automated Enrollment, or DEP |
|
|
238 | (4) |
|
|
238 | (1) |
|
The Cloud Service DEP API |
|
|
239 | (3) |
|
|
242 | (2) |
|
|
244 | (1) |
|
|
245 | (5) |
|
|
250 | (10) |
|
|
251 | (9) |
|
Enable APNs Debug Logging |
|
|
260 | (5) |
|
|
265 | (5) |
|
|
266 | (1) |
|
|
267 | (3) |
|
|
270 | (1) |
|
Host an .ipa on a Web Server |
|
|
271 | (3) |
|
Sign and Resign macOS Applications |
|
|
274 | (4) |
|
|
275 | (3) |
|
|
278 | (3) |
|
Chapter 5 IOS Provisioning |
|
|
281 | (62) |
|
|
283 | (6) |
|
Prepare an iOS Device Using Apple Configurator |
|
|
284 | (1) |
|
Install Apple Configurator |
|
|
284 | (3) |
|
|
287 | (2) |
|
|
289 | (46) |
|
Add Certificates for 802.1x with Profiles to Blueprints |
|
|
289 | (6) |
|
Install Apps with Apple Configurator |
|
|
295 | (2) |
|
Automate Enrollment with Apple Configurator |
|
|
297 | (5) |
|
Change Device Names Using Apple Configurator |
|
|
302 | (2) |
|
Change Device Wallpaper with Apple Configurator |
|
|
304 | (3) |
|
|
307 | (6) |
|
Debugging Apple Configurator Logs |
|
|
313 | (1) |
|
Using an ipsw Operating System Bundle to Restore Devices |
|
|
314 | (2) |
|
Device Supervision Using Manual Configurations |
|
|
316 | (5) |
|
|
321 | (11) |
|
Using AEiOS to Create Workflows |
|
|
332 | (3) |
|
|
335 | (6) |
|
|
335 | (1) |
|
Caching Service Configuration |
|
|
336 | (5) |
|
|
341 | (2) |
|
Chapter 6 Mac Provisioning |
|
|
343 | (26) |
|
Macos Startup Modifier Keys |
|
|
344 | (2) |
|
Macos Provisioning with ADE |
|
|
346 | (3) |
|
|
349 | (1) |
|
|
349 | (1) |
|
Macos Provisioning Without ADE |
|
|
349 | (10) |
|
|
350 | (1) |
|
|
350 | (9) |
|
|
359 | (1) |
|
Upgrades and Installations |
|
|
359 | (9) |
|
|
362 | (5) |
|
|
367 | (1) |
|
|
368 | (1) |
|
|
368 | (1) |
|
|
368 | (1) |
|
Chapter 7 Endpoint Encryption |
|
|
369 | (66) |
|
|
369 | (4) |
|
Enabling Encryption on iOS |
|
|
373 | (3) |
|
Macos Encryption Overview |
|
|
376 | (4) |
|
|
380 | (1) |
|
|
381 | (53) |
|
Enabling Encryption on macOS |
|
|
382 | (4) |
|
|
386 | (2) |
|
FileVault 1 and the FileVaultMaster.keychain File |
|
|
388 | (2) |
|
Creating an Institutional Recovery Key |
|
|
390 | (9) |
|
Enabling FileVault 2 Encryption for One or Multiple Users |
|
|
399 | (10) |
|
Enabling FileVault 2 Encryption Using One or Multiple Recovery Keys |
|
|
409 | (4) |
|
Disabling FileVault 2 Encryption |
|
|
413 | (4) |
|
Listing Current FileVault 2 Users |
|
|
417 | (1) |
|
Managing Individual and Institutional Recovery Keys |
|
|
418 | (4) |
|
Removing Individual and Institutional Recovery Keys |
|
|
422 | (4) |
|
|
426 | (4) |
|
Reporting on FileVault 2 Encryption or Decryption Status |
|
|
430 | (4) |
|
|
434 | (1) |
|
Chapter 8 Securing Your Fleet |
|
|
435 | (78) |
|
|
435 | (2) |
|
|
437 | (9) |
|
|
437 | (1) |
|
System Integrity Protection |
|
|
438 | (3) |
|
SIP-Protected Directories |
|
|
441 | (2) |
|
View SIP Protections Interactively |
|
|
443 | (1) |
|
|
444 | (1) |
|
Kernel Extension Protections |
|
|
445 | (1) |
|
Managing System Integrity Protection |
|
|
446 | (11) |
|
Signed System Volume and csrutil |
|
|
450 | (1) |
|
Running csrutil Outside of the Recovery Environment |
|
|
451 | (2) |
|
Custom System Integrity Protection Configuration Options |
|
|
453 | (2) |
|
System Integrity Protection and Resetting NVRAM |
|
|
455 | (2) |
|
|
457 | (3) |
|
Detect Common Vulnerabilities |
|
|
460 | (2) |
|
Manage the macOS Firewall |
|
|
462 | (2) |
|
|
464 | (4) |
|
|
465 | (3) |
|
|
468 | (13) |
|
Using Isregister to Manipulate the Launch Services Database |
|
|
470 | (3) |
|
|
473 | (1) |
|
|
474 | (4) |
|
|
478 | (1) |
|
|
479 | (2) |
|
|
481 | (3) |
|
Macos Binary Whitelisting |
|
|
484 | (14) |
|
|
487 | (1) |
|
Centralized Log Capture and Analysis |
|
|
488 | (1) |
|
|
488 | (1) |
|
|
489 | (2) |
|
Organization and Classification |
|
|
491 | (1) |
|
|
492 | (2) |
|
|
494 | (4) |
|
|
498 | (5) |
|
Administrator Rights on macOS |
|
|
503 | (7) |
|
|
510 | (3) |
|
Chapter 9 A Culture of Automation and Continuous Testing |
|
|
513 | (74) |
|
From Manual to Automated Testing |
|
|
514 | (1) |
|
Scripting and the Command Line |
|
|
515 | (2) |
|
|
517 | (7) |
|
|
519 | (5) |
|
|
524 | (60) |
|
|
526 | (4) |
|
|
530 | (3) |
|
Altering Variables (Mangling) |
|
|
533 | (4) |
|
Standard Streams and Pipelines |
|
|
537 | (3) |
|
|
540 | (6) |
|
For, While, and Until Statements |
|
|
546 | (3) |
|
|
549 | (1) |
|
|
550 | (2) |
|
More Advanced Shell Script Logic |
|
|
552 | (8) |
|
|
560 | (4) |
|
|
564 | (6) |
|
Posting Issues to Ticketing Systems |
|
|
570 | (2) |
|
Simulating iOS Environments with the Xcode Simulator |
|
|
572 | (4) |
|
|
576 | (6) |
|
|
582 | (2) |
|
|
584 | (3) |
|
Chapter 10 Directory Services |
|
|
587 | (32) |
|
Manually Bind to Active Directory |
|
|
589 | (8) |
|
|
589 | (3) |
|
Bind with the Directory Utility |
|
|
592 | (5) |
|
Test Your Connection with the id Command |
|
|
597 | (2) |
|
Use dscl to Browse the Directory |
|
|
599 | (5) |
|
Programmatically Binding to Active Directory |
|
|
604 | (2) |
|
Bind to Active Directory Using a Profile |
|
|
606 | (8) |
|
|
612 | (1) |
|
All the Benefits of Binding Without the Bind |
|
|
613 | (1) |
|
|
614 | (1) |
|
Apple Kerberos SSO Extension |
|
|
614 | (4) |
|
|
618 | (1) |
|
Chapter 11 Customize the User Experience |
|
|
619 | (18) |
|
Getting iOS and iPadOS Devices in the Hands of Users |
|
|
620 | (1) |
|
|
621 | (1) |
|
Planning the macOS User Experience |
|
|
621 | (1) |
|
Transparency Consent and Control Protections on User Home Folders |
|
|
622 | (2) |
|
Using Profiles to Manage User Settings |
|
|
624 | (4) |
|
Using Scripts to Manage User Settings |
|
|
628 | (1) |
|
Modifying the macOS Default User Template |
|
|
629 | (2) |
|
|
630 | (1) |
|
Customize the User Preferences |
|
|
631 | (1) |
|
Configure the iOS Home Screen |
|
|
631 | (3) |
|
|
634 | (1) |
|
|
635 | (1) |
|
|
636 | (1) |
|
Chapter 12 Identity and Device Trust |
|
|
637 | (70) |
|
Use IdPs for User Identities |
|
|
638 | (1) |
|
REST and Web Authentication |
|
|
639 | (5) |
|
|
640 | (1) |
|
Use JWTs As Service Accounts |
|
|
641 | (2) |
|
|
643 | (1) |
|
|
644 | (4) |
|
|
648 | (1) |
|
|
649 | (4) |
|
|
650 | (3) |
|
|
653 | (1) |
|
|
654 | (10) |
|
Work with Azure Active Directory |
|
|
656 | (6) |
|
|
662 | (2) |
|
Use Jamf Connect to Authenticate to an IdP at the Login Window |
|
|
664 | (7) |
|
Configure Jamf Connect Login |
|
|
666 | (5) |
|
Alternatives to Jamf Connect |
|
|
671 | (2) |
|
Use Azure AD for Conditional Access |
|
|
673 | (1) |
|
Configure the Jamf Integration with Intune |
|
|
674 | (5) |
|
|
679 | (1) |
|
Multifactor Authentication |
|
|
679 | (1) |
|
|
680 | (14) |
|
|
681 | (1) |
|
Conditional Access for Google Workspace |
|
|
682 | (3) |
|
Enable the Necessary APIs |
|
|
685 | (2) |
|
|
687 | (2) |
|
Create Your Google Cloud Function |
|
|
689 | (5) |
|
|
694 | (1) |
|
Managed Apple IDs Continued |
|
|
695 | (1) |
|
Managed Apple IDs in Schools |
|
|
695 | (1) |
|
Managed Apple IDs for Business |
|
|
696 | (1) |
|
|
696 | (4) |
|
Working with the Keychain |
|
|
700 | (4) |
|
|
704 | (3) |
|
Chapter 13 The Future of Apple Device Management |
|
|
707 | (36) |
|
|
708 | (34) |
|
|
712 | (1) |
|
|
713 | (2) |
|
|
715 | (2) |
|
|
717 | (12) |
|
|
729 | (3) |
|
Manage Only What Is Necessary |
|
|
732 | (1) |
|
|
733 | (2) |
|
Other Impacts to Sandboxing |
|
|
735 | (1) |
|
IOS, macOS, tvOS, and watchOS Will Remain Separate Operating Systems |
|
|
736 | (1) |
|
Will iOS Become Truly Multiuser? |
|
|
737 | (1) |
|
|
738 | (2) |
|
You're Just Not an "Enterprise" Company |
|
|
740 | (1) |
|
Apple Is a Privacy Company |
|
|
741 | (1) |
|
|
742 | (1) |
Appendix A The Apple Ecosystem |
|
743 | (24) |
Appendix B Common Apple Ports |
|
767 | (16) |
Appendix C Configure macOS Lab Virtual Machines with UTM |
|
783 | (14) |
Appendix D Conferences, Helpful Mac Admins, and User Groups |
|
797 | (10) |
Appendix E Set Up a Test Okta Account |
|
807 | (8) |
Index |
|
815 | |