PCI - Mac Imaging and Deployment

Predeployment

• Assign device to PCI MDM in ASM
  
• Boot device and enroll in WS1
  
• Log in with "localadmin"
  
• Connect to adminvpn
  
• Run BigFix baseline
  
• Run certificate enrollment
  
  • In a non-Safari browser sign in using AD credentials:  https://pci-one-ca-01.pci.wisc.edu/certsrv
    
    • Request a certificate, advanced certificate request
      
    • Open Keychain, select Keychain Access in the top menu, select Certificate Assistant, and then Request a Certificate From a Certificate Authority
      
    • In the menu enter the following
      
    • Email:  pci-wiscit@doit.wisc.edu
      
  • Common Name:  WPT-SERIAL aka the computer name
    
  • Save to disk
    
  • Check the box for "Let me specify key pair information" (accepting defaults on that screen is fine)
  • Open the CSR in a text editor and copy/paste into the Saved Request box in your web browser
    
  • From the dropdown select DS - Mac Computer
    
  • Submit
• Select DER encoded and Download certificate chain
  
• Add the full cert chain to Keychain by double-clicking on it but make sure to select the System Keychain
  
• Due to this being a user driven process the machine cert with private key will end up in the "Login" keychain; you will have to copy it to the System/Certificates Keychain
• Open the private key and go to Access Control and make sure it's set to "Allow all applications to access this item"
• Very Important!  When you first try to connect to remotepcs.pci.wisc.edu you will get a permissions popup that GP is trying to access the cert; make sure you select "Always Allow"

Deployment

• Create an AD account for the end user and add them to the VPN group
• Log in as localadmin, connect to remotepcs.pci.wisc.edu, and sign out
• Have the end user sign in with their AD credentials
• Make sure they are connected to VPN (they'll need DUO set up at this point)
• Make sure they can unlock FileVault
• Reboot the laptop completely and have them log in
• Throw the laptop like a frisbee into Lake Mendota