Monday 11 November 2019

macOS Catalina - How to uses imaging even though Apple don't want you to

Apple have with each new version of macOS tightened the security and in general this is clearly a good thing.

Apple have also removed a number of historically available functions - including ones used in the past by many Mac administrators. This arguably is a mixture of good and bad.

The latest casualty in macOS Catalina is the loss of the --volume option in startosinstall.

Losing the --volume option means you cannot boot from an external drive and automate the installation on to the internal drive along with (optionally) flags to erase the internal drive and install packages. Now you can only do this by booting from the internal drive itself and then running the startosinstall command which in turn means going through the Apple Setup Assistant at least once. This could be workable for wiping and reusing an existing Mac but only if you have a valid login when the Mac is returned by the previous user.

This seems an extremely petty change since the GUI macOS installer still does let you boot from an external drive, run the installer and specify a different drive to install on to. Clearly there cannot be any technical reasons for this change. 😕

Ironically the 'solution' to the loss of the --volume option is to go back in time and return to using AutoDMG and an image restoration process e.g. like DeployStudio (run locally).

It should be noted that due to the now extremely aggressive secure implementation of Security & Privacy in Catalina one can no longer run normal DeployStudio workflows to configure a Mac unless you also install DeployStudio Runtime on the target Mac, give it and Terminal/bash/scripts full disk access permission. Clearly you would not do this on a Mac you are configuring.

It is however possible to do the following.

  1. Use Mager Valp's AutoDMG (currently a beta version for Catalina compatibility) to build a Catalina image
    1. The source macOS Installer must be inside a disk image, I happen to use Greg Neagle's installinstallmacos.py script to download the macOS Installer and this automatically puts it in a disk image
    2. Make sure you have no other volumes called 'Macintosh HD' mounted as otherwise AutoDMG gets 'confused' as which to use
    3. This includes the normally invisible 'Macintosh HD - Data' now included with Catalina, I therefore have my USB boot drive named differently
  2. Use Richard Troughton's old first-boot-package tool to run scripts and installers during the first boot of the restored image
  3. Use a DeployStudio server to host the AutoDMG image
  4. Use a USB boot stick with a full install of Catalina and use Disk Utility to erase the target (internal) drive if needed
  5. Use DeployStudio Runtime to restore the AutoDMG created image
  6. On first boot the restored Mac will then run the scripts/installers provided by Richard Troughton's tool, in my case I run an installer created using Greg Neagle's pycreateuserpkg to create an initial local admin account, Mager Valp's SkipAppleSetupAssistant pkg, my own script to set initial preferences, and then Greg Neagle's munkitools installer. I also run another of my own scripts to replace the DeployStudio function to automatically name restored computers.

I could have included an installer to enrol in to our MDM e.g. a Jamf QuickAdd.pkg however I intend to use DEP for Catalina.

The above therefore pretty much restores past 'imaging' capabilities.
Posted by at

8 comments:

  1. matteo.durini@appway.com30 March 2020 at 16:39

    Hello, i'm getting crazy with this procedure :-) maybe i'm doing something wrong
    I'm using the latest version of autodmg and catalina 10.15.4 DMG file. I've downloaded the first-boot-package.pkg file, browsed the content and added the following pkgs
    - 00 -> create local admin (generated by pycreateuserpkg)
    - 01 -> SkipAppleSetupAssistant-1.0.1.pkg

    During the build, i'm getting the error code 1 popup by AutoDMG.
    What is the problem in your point of view?

    Thank you in advance

    ReplyDelete
    Replies
    1. John Lockwood30 March 2020 at 16:58

      I did get an AutoDMG approach working with Catalina but I have since moved on to a somewhat different approach. This is because I was having problems with newer T2 equipped Macs. My new approach is as follows.

      1. Boot from a USB drive containing two volumes, the first volume is a Mac installer setup created using Apple createosxmedia tool
      2. Use this installer drive to first format the target Mac as APFS
      3. The run the macOS installer
      4. This will when finished boot you to the standard Apple setup wizard, at this point reboot the Mac from the second boot volume which is a standard full blown copy of macOS Catalina
      5. From this full macOS Catalina I then run the DeployStudio Runtime program and login to my DeployStudio system
      6. I then run a standard DeployStudio workflow targeting the drive I have just installed i.e. the internal drive and this workflow names the Mac, sets regional settings, installs packages including create local admin, there is a standard workflow step to skip AppleSetup.

      I had problems adding the usual installer pkgs to AutoDmg e.g. createuser which is why I was using the firstboot one which did work. However now I am using DeployStudio to do this and this would also work with a 'blank' AutoDmg setup as well.

      There is a benefit to using the USB boot installer which is that approach always does any needed firmware updates.

      See https://support.apple.com/en-gb/HT201372

      You will need a 64GB USB drive to have enough room for both a OS X install volume and a bootable Catalina volume.

      Delete
    2. matteo.durini@appway.com31 March 2020 at 06:25

      Thank you so much for the clarification. Do you remember if you used 10.15.4 or 10.15.3 with AutoDMG? Which PKGs you added and to the first-boot-package.pkg file? In which order? Was it the "legacy" one (with the show-content menu) or the newest one generated by the app (same author, different git repo)?

      thank you so much

      Delete
    3. John Lockwood31 March 2020 at 13:00

      It would have been 10.15.1 when I used AutoDMG and first-boot, I have not used it since. It would have been the version from Ricard Trouton's repo.

      The pkgs I had were in the following order

      0 = Yoti_First_Boot (A pkg I made to set initial settings etc. including for Munki and MunkiReport)
      1 = create local admin
      2 = SkipAppleSetupAssistant
      3 = print driver
      4 = Munkitools

      Delete
    4. matteo.durini@appway.com31 March 2020 at 17:26

      Mmmmm....i really don't know what i'm doing wrong.....i tried to download catalina 10.15 and 10.15.3, both of them are failing.....do you need to sign the First-Boot-Package-Install.pkg file? is it possible to have a copy of your pkg? sorry but i'm feeling like an idiot......

      Delete
    5. John Lockwood31 March 2020 at 17:37

      I am currently working from home so don't have full access to the oriiginal setup. Also remember I don't use this approach anymore. However I can say no I did not need to sign anything.

      If you have not already done so the first thing to test is restoring an unmodified AutoDMG image, it should obviously end up at the AppleSetupAssistant.

      Also the create local admin tool needed to be updated I believe for Catalina so make sure that is sorted - trying an unmodified AutoDMG would help narrow this down. The next stage would be to try only firstboot with no payloads, then add one payload at a time.

      Delete
    6. matteo.durini@appway.com9 April 2020 at 14:57

      Hello, sorry for the late reply. no ways to get it working, at the end i gave up and switched to a different method. I'm using MDS (https://twocanoes.com/knowledge-base/mds-admin-guide/) to create a DMG with everything I need. I'm booting the machine from internet recovery and from terminal i'm mounting the DMG (from a USB drive) and executing the install. Thank you so much for the support, lot appreciated!

      Delete
  2. Chris Busillo2 August 2020 at 17:18

    Hi, you can image an existing system and deploy it with DeployStudio.

    https://logi.wiki/index.php/DeployStudio_Catalina

    ReplyDelete

Subscribe to: Post Comments (Atom)