Meraki

PaulF · ‎Mar 4 2022

The best way would be a combined package. As the roaming client downloads as a PKG, it does make life easier: You're going to follow exactly the same instructions as above: mkdir InstallFile cd InstallFile mkdir Content mkdir scripts cd Content touch OrgInfo.plist cd ../scripts touch postinstall chmod a+x postinstall Drop the OrgInfo.plist into the Content folder ALSO drop the RoamingClient_MAC_3.0.5.pkg into the same Content folder NOTE: Watch out for the name of the roaming client changing with each new release Edit the postinstall file: #!/bin/bash mv /tmp/OrgInfo.plist /Library/Application\ Support/OpenDNS\ Roaming\ Client exit 0 But add a new line after the #!/bin/bash installer -pkg /tmp/RoamingClient_MAC_3.0.5.pkg -target / NOTE: again, make sure that, whenever creating a new package after a roaming client update, that you update the name of the package. Also note the spaces above too. You can test using the Installer command on your Mac at the command line: sudo installer -pkg RoamingClient_MAC_3.0.5.pkg -target / Password: installer: Package name is Umbrella Roaming Client installer: Installing at base path / installer: The install was successful. Just to ensure it installs with no issues, and that the relevant directories are created Now, back to Terminal. The command the build the package is identical, but I've changed the names to something a little more appropriate: sudo pkgbuild --identifier com.meraki.umbrellaroamingclient --root Content --script scripts --install-location /tmp/ umbrellaroamingclient.pkg pkgbuild: Inferring bundle components from contents of content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to umbrellaroamingclient.pkg And you're all done.

PaulF · ‎Mar 3 2022

Hi Anthony An example would be this: #!/bin/bash mv /tmp/OrgInfo.plist /Library/Application\ Support/OpenDNS\ Roaming\ Client exit 0

PaulF · ‎Mar 2 2022

Hi Anthony. App Store applications have a capability that allows for the usage of Managed App Config. However, as the AnyConnect package is a custom app, this is not available. So, there's several ways this could be achieved, but it's going to take some work... The first one is to have two apps: A generic dmg containing the AnyConnect package, but also a separate packing containing a script that will create the plist for you: https://documentation.meraki.com/SM/Apps_and_Software/Deploying_Scripts_in_Systems_Manager_using_Software_Installer Contains most of the information that you need. However, you can also use the pkgbuild application to create a script AND files: In Terminal, type the following: Navigate to somewhere where you want to store your packages mkdir InstallFile cd InstallFile mkdir Content mkdir scripts cd Content touch OrgInfo.plist cd ../scripts touch postinstall chmod a+x postinstall You can now edit the OrgInfo.plist Edit the postinstall file to copy the plist, which will be in /tmp/OrgInfo.plist to wherever you wish Now we can run the following command: sudo pkgbuild --identifier com.meraki.scriptpackage --root Content --script scripts --install-location /tmp/ packagename.pkg pkgbuild: Inferring bundle components from contents of content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to packagename.pkg You'll now have a pkg called packagename.pkg which you can deploy!

PaulF · ‎Nov 10 2021

Hi Dylan So far, Apple have only announced Declarative Management for User Enrollment, not for Apple MDM in general The SM team, however, are very interested in this, in that it allows changes to be made instantly on the device (within reason) and also allows the device to tell Systems Manager that something has changed WHEN it actually changes. I personally feel that Apple are dipping their toes in the water to see what the take up and interest will be before deploying this for all types of management. The other problem is that, Systems Manager, as well as other MDM platform, have complex business logic engines to device what should happen to devices when something is reported back or has changed. Because the devices now have the ability to have business logic applied on them, you're having to split the logic between the MDM platform and device. This isn't easy to do. And if you wish you let admins chose between SM doing the logic, the device, or a bit of both, it magnifies this complexity even further! Having had a look at Apple's documentation, there appears to be limited support for this for a user enrolled device If you could let us know what features you're interested in, that would be immensely helpful, though!

PaulF · ‎Nov 10 2021

Again, please use the "make a wish" link at the bottom of your dashboard

PaulF · ‎Nov 10 2021

This is not currently a feature. Please use the "make a wish" link at the bottom of your dashboard if you require it. Kind regards, Paul

PaulF · ‎Nov 9 2021

Understood. So, Google Play allows for multiple accounts, so you can have both a personal google play account and a work one. What may prevent this is the default behavior of a DO enrolled device to prevent modification of accounts. This can be changed in the Android Device Owner profile: In the same profile you can also disable factory reset

PaulF · ‎Nov 9 2021

The problem with this approach is that, in a world that is becoming more and more focused on privacy, the enterprise still has full visibility of the personal part of the device, something that most users would have issues with. If the requirement is to secure enterprise data whilst segmenting user data, then Work profile on a NON managed Android is a much better approach. It still allows you to wipe the enterprise data, which maintaining the personal data. Should the user wish to wipe the entire device, they can they use the various Google tools to do so. Of course, this is a personal opinion, but it does allow you to avoid the pitfalls of managing personal data.

PaulF · ‎Oct 27 2021

Thank you for checking @Shany !

PaulF · ‎Oct 21 2021

They tend to be referenced in the release notes: https://developer.apple.com/documentation/ios-ipados-release-notes/ios-ipados-15_1-release-notes However, as it's not released yet, expect this page to update

PaulF · ‎Oct 15 2021

I can confirm that Text is the only value you can use. Can you raise a case? Thanks!

PaulF · ‎Oct 8 2021

I can confirm this For some reason, this has to be enabled by support. Please raise a case and they should be able to do this for you

PaulF · ‎Oct 8 2021

So, a few things: 1. There isn't a passcode "reset" for iOS, there is only a "clear" passcode. As far as I can see, this doesn't need a supervised device, if Apple's website is to be believed, but it certainly WON'T work for a User Enrolled Device. An my colleague in support is correct: You can't systematically set a new passcode on the device remotely. That's an Apple restriction 2. It would be useful to know the connectivity of the device during the period that you needed to perform the reset: If the device was offline, no amount of coercing would achieve your requirements. Something that I've seen in the past So, what could you have done? If the requirements was to lock the user out of the device, you could have placed the device into kiosk mode with some completely unrelated application. Notes, for example. This would have prevented the user from using the device whilst keeping the device online. The other alternative would have been to have completely wiped the device (if the device was in DEP). The user would have been forced to have enrolled the device. The only downside to this is that you'd have lost visibility of the device.

PaulF · ‎Oct 6 2021

I've used the steps below with other customers to install all sorts of packages. If you use AnyConnect, Umbrella, etc, you're probably familiar with them You can place all of the files you wish into a DMG. Alternatively, a ZIP will work just as well Open Terminal Using mkdir Create a Directory. I’ve used InstallerPackage as the Example In Terminal Type cd InstallerPackage mkdir Scripts mkdir Content cd Scripts touch postinstall Copy the DMG you need into the Content Folder Using a text editor, edit the postinstall file and paste in your script (an example script is at the end of this post) that will move files in /tmp to where ever you need to chmod a+x postinstall cd .. Build the package sudo pkgbuild --identifier com.meraki.sophosinstaller --root Content --script Scripts --install-location /tmp com.meraki.sophosinstaller.pkg pkgbuild: Inferring bundle components from contents of Content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to com.meraki.sophosinstaller.pkg Double Note: ensure that there is a space between /tmp and com.meraki.sophosinstaller.pkg An example postinstall: #!/bin/bash dmgPath="/tmp/YourDMGName.dmg" mountPath="/Volumes/YourDMGMounted" currentuser="$(id -un)" usersAppDir="$(sudo -u $currentuser echo $HOME)" /usr/bin/hdiutil attach "$dmgPath" -nobrowse -quiet if [[ -e "$mountPath" ]] then cp -r "$mountPath"/"YourApp.app" /Applications/"YourAppName.app" fi umount "$mountPath" rm -rf "$dmgPath" # insert the commands that you need to # provision your application exit 0 This may take a few attempts to get right. So, I'd install the installer manually first before deploying via SM Also note: The name of the bundle ID that you use in SM when creating the custom app HAS to match the bundle ID of Sophos, else SM has no way to know that it's been installed correctly.

PaulF · ‎Jul 21 2021

Hi Hopefully the issue of not being able to see the status bar should be resolved in the next few months As for the ability to change the screen dimming: I believe that to be an android / Samsung issue. Sorry!

PaulF · ‎Jul 16 2021

Yes..... When sending a notification to an android, you can select the messaging type:

PaulF · ‎Jul 1 2021

Zach: Have you considered a white list instead? Assuming the Device is in Device Owner mode, it would make for a much smaller list that you'd have to maintain. You'd only have to specify the apps that you want, rather than those that you don't.

PaulF · ‎Jun 29 2021

Hi One of the biggest problems with Android Enterprise in this use case is actually knowing what the identifiers actually are of the preinstalled apps This can be achieved using adb and the following command: adb shell pm list packages | awk -F ":" '{print $2}' Once you've got the list of apps, you can then use the Android System Apps payload:

PaulF · ‎Jun 29 2021

Is this being pushed from SM, or are you installing this manually?

PaulF · ‎Jun 29 2021

I know that there's many of you that have workflows that involve the manual install of the SM agents on macOS, such as Silent installer for MacOS However, with the changes in the SM agent 3.1.0 and above, instead of being able to do silent installs, you know have to specify your enrollment code manually, as per Mac Enrollment - Command Line Options You can optionally specify the network enrollment code / string with the following command: sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id && sudo launchctl setenv enrollment_code <network enrollment code or enrollment string> && sudo installer -pkg <path/to/package.pkg> -target / && sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id There's two optional parameters here: <network enrollment code or enrollment string> : This is the enrollment code that's quoted in Systems Manager > Add Devices, or Network Wide > General <path/to/package.pkg> : This is the path to the SM agent installer This is, understandably, unwieldy, primarily due to not being able to pass parameters to installers in macOS. However, there is an alternative: You can actually build an installer that allows you for silent enrollments, and this is how 1. Download the Current SM Agent Installer From Systems Manager > Add devices > macOS, download the SM agent 2. Create a new folder on your Desktop: SMAgent3.1.1 (for example) 3. Open Terminal and type the following cd ~/Desktop/SMAgent3.1.1 mkdir Scripts cd Scripts touch postinstall chmod a+x postinstall cd .. mkdir Content cd Content open . This last command will open the Content directory Move the previously download SM agent into here and rename it SMAgent.3.1.1.pkg Go back to terminal and type cd .. cd Scripts open . This will open the Scripts directory in Finder. 4. Edit postinstall With a suitable text editor, open the postinstall file and type: #!/bin/bash sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id && sudo launchctl setenv enrollment_code XXXX-XXXX-XXXX && sudo installer -pkg /tmp/SMAgent-3.1.1.pkg -target / && sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id NOTE: Replace XXXX-XXXX-XXXX with the network enrollment code or string Save this file 5. Create installer Go back to Terminal and type: cd .. sudo pkgbuild --identifier com.meraki.smautoenroll --root Content --script Scripts --install-location /tmp com.meraki.SMAgent3.1.1-autoenroll.pkg This should result in: paulf@Paul-F-MBP-680 SM3.1.1pkg % sudo pkgbuild --identifier com.meraki.smautoenroll --root Content --script Scripts --install-location /tmp com.meraki.SMAgent3.1.1-autoenroll.pkg Password: pkgbuild: Inferring bundle components from contents of Content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to com.meraki.SMAgent3.1.1-autoenroll.pkg You should now have an installer that will silently install the SM agent without prompts!

PaulF · ‎Jun 23 2021

Hello all. Further to this, agent 3.1.1 has been released, as per: https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_Release_Notes Changes: macOS [Bug fix] Installing agent over MDM now automatically enrolls without needing any user intervention. [Bug fix] The agent installer will now install Rosetta 2 on Apple Silicon macOS devices, if it is not already installed. This allows Apple Silicon macOS devices to enroll in MDM and then push the agent without requiring user intervention. Windows [Bug fix] Agent only enrollments no longer have a delay in initial sync with Dashboard. [Bug fix] Incorrect LAN IP reported via agent for Windows devices with multiple NICs. [Security] Various agent file privilege fixes. [Update] Reduced usage of the shared C:\Windows\Temp directory so there are fewer audit events generated.

PaulF · ‎Jun 10 2021

Hi @JoelMiles I'll chase this up today for you...

PaulF · ‎Jun 4 2021

You'll find https://developer.cisco.com/meraki/api-v1/#!get-organization-networks a really excellent resource for prototyping

PaulF · ‎Jun 4 2021

So, the first thing you'll need is the policy ID: If you go to Systems Manager > Policies and click on the policy that you want to use as a criteria, you'll now be able to get the policy ID from the URL: https://XXXX.meraki.com/General/n/XXXXXXX/manage/configure/pcc_security_policy#security_policy=681169443639788406 So, now that we have the ID, we can go to the API call: https://api.meraki.com/api/v0/networks/{{NetworkID}}/sm/devices?fields=ip&scope=withAll,auto:security_policy_uncompliant681169443639788406 If you don't know your network (or Org) IDs, you'll need to do the following two API calls: Orgs curl --location --request GET 'https://api.meraki.com/api/v1/organizations' \ --header 'X-Cisco-Meraki-API-KEY: {{APIKEY}}' Returns: [ { "id": "2930418", "name": "My organization", "url": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview" } ] This brings back a list of your orgs. You probably only have the one. Grab the id. Then, we.... Networks curl --location -g --request GET 'https://api.meraki.com/api/v0/organizations/2930418/networks' --header 'X-Cisco-Meraki-API-KEY: {{APIKEY}}' This will bring back a list of networks. [ { "id": "L_123456", "organizationId": "2930418", "name": "Long Island Office", "timeZone": "America/Los_Angeles", "tags": [ "tag1", "tag2" ], "productTypes": [ "appliance", "switch", "wireless" ], "enrollmentString": "long-island-office", "notes": "Combined network for Long Island Office" } ] Grab your network id

PaulF · ‎May 19 2021

Only Apple will be able to tell you that.

About PaulF

PaulF

Community Record

Badges