Beware: long winded tech post coming up...
Working for a company that deals in managed services makes life interesting when a new customer comes calling. Naturally, we want to do the best we can for whoever asks us for help, but that usually involves juggling multiple specialized services that all focus on specific tasks. Services such as Watchman Monitoring, Gruntwork from Mac-MSP(now part of MAX Remote Management), and MDM management from any number of companies have become indispensable, and we want to get them on every computer we can. The problem comes from how to get all of those individualized services onto a 'new' computer that has come under our purview.
For a new computer, we normally want to add (at a minimum) the following to every computer we manage:
- A local 'CR Administrator' admin account
- Access via Remote Management and SSH
- Watchman Monitoring
Optional pieces include:
- Bomgar (for secure Remote Access)
- MDM management of choice: Right now we are starting to use FileWave.
We've seen if we try to install all of this on a single computer, it can take ~5-10 minutes per computer. Then add time for making sure you have all the correct installers. Then add time to juggle kicking the user off the computer for that time. Then add time to make sure all the installers properly installed. Then multiply for all computers you need to touch.
...it adds up. All the more reason to automate this process.
We ended up going the route of using both shell scripting and then remote installation after the fact w/ FileWave. So, we scripted the installation of the cradmin account, ARD and SSH access, and the installation of the FileWave client. Afterwards, FileWave automatically installs the Watchman Monitoring agent, the Gruntwork agent, and the Bomgar agent after we move the respective computer into their assigned Client Group in FileWave.
Pre-Work: Create a public web server for hosting flat files for download
We needed a central repository to download all of these various installers, and ended up deciding on Amazon Web Services' S3 service. It is able to store all of our necessary packages and dmg's needed for install (on the cheap), so we store everything there.
Part 1: Creating the necessary 'CR Administrator' local admin account
Easily done by using CreateUserPkg, an application that will generate a pkg installer for creation of any local user account you specify. We specify admin rights, our company's logo, and a UID less than 500, to keep it hidden from the login window for most of our customers.
Part 2: Scripting installation of cradmin, access to ARD and SSH, and FileWave installation
Once the cradmin installer is generated and uploaded to your public web server, do the same for the FileWave installer. Afterwards, we wrote a script that downloads the cradmin installer to a hidden directory, installed, then removed. Once installed, some commands are run to give cradmin Apple Remote Management and SSH access. Finally, the FileWave installer (which has been customized for our specific settings) is taken care of the same way as cradmin: download the FileWave installer to a hidden directory, installed, and the remove it.