Publishers of technology books, eBooks, and videos for creative people

Home > Articles > Apple > Operating Systems

  • Print
  • + Share This
This chapter is from the book

Configuring Profile Manager

To allow assigning profiles, the Profile Manager service must be enabled. Using profiles is significantly different than managing clients in earlier versions of OS X Server. Note that the older method of using Workgroup Manager is still valid in Lion Server, but this book doesn’t approach it. For information on OS X Managed Client, see Chapter 9, “Managing Accounts,” in the book Apple Training Series: Mac OS X Server Essentials v10.6.

Terminology

In the context of device management, a Profile is basically a collection of settings. Configuration profiles define settings such as Wi-Fi settings, email accounts, calendar accounts, and security policies. Enrollment profiles allow the server to manage your device. A payload is what’s inside a profile.

Preparations for Profile Manager

Prior to configuring Profile Manager, you’ll need to set up a few items to make the process more streamlined.

  • Configure your server to manage network users and groups. This is also referred to as creating an Open Directory Master.
  • Obtain and install an SSL certificate. It is recommended to use one signed by a trusted certificate authority. You could use the certificate that was automatically generated when you configured your server to manage network accounts, but you first need to configure devices to trust that certificate. If you instead use your self-signed certificate, you won’t be able to enroll iOS devices.
  • Obtain an Apple ID for use when you request a push certificate from Apple through the http://appleid.apple.com website. Prior to using this ID, make sure you log in at that site under “Manage My Account” and verify the address. Otherwise, it is possible that you won’t have success requesting the push certificate.

Enabling Profile Manager

In this section, you’ll go through the steps to enable Profile Manager including the signing of a configuration profile.

  1. Open Server app and select Profile Manager in the Server app sidebar.

  2. Click Configure, next to Device Management.

  3. The service will gather some data and give a description of its capabilities. Click Next.
  4. Choose your certificate. If you use your self-signed certificate, you will not be able to enroll any iOS devices.

  5. Request an Apple Push Notification certificate using an Apple ID. If you do not have one, there’s a link to obtain one under the credential fields. Make sure to verify the address at the http://appleid.apple.com site. Click Next.

  6. A green circle will indicate that you succeeded. Click Finish.

  7. Select the checkbox labeled “Sign configuration profiles,” then choose the Code Signing certificate that was created when you created your network accounts.

    By signing the profiles with a certificate, you provide a way to validate that the profiles came from where they are supposed to be from.

  8. If you don’t have any services running, use this time to configure and activate a few services, then click the On/Off switch to turn on Profile Manager.

User Profile Portal

The User Profile Portal provides simple access for users to log in, apply profiles, and manage their devices. The portal is accessed via a web browser; by simply publishing the website, users anywhere in the world can enroll their devices–whether they be computers, iPhones or other iOS based mobile devices. It is through the portal that a user can lock or wipe their enrolled devices.

  1. Navigate to the site https://server17.pretendco.com/mydevices.
  2. Through a series of redirects the user will be prompted for her credentials to log in.
  3. The user is given tabs for Devices and Profiles. Devices is where the user can enroll the device. Profiles is where the various profiles made available to her will be displayed.

  4. Click the Install Trust Profile. The profile will be downloaded, and the Profiles preferences will appear.
  5. Click the Show Profile button to view the contents of the profile, then click Continue.

  6. In the next window click Show Details to view more information regarding the certificates involved, and then click Install. Enter an administrator’s credentials when prompted.

  7. Navigate to the Devices tab and click Enroll. You will be brought back to the Profile preferences and asked if you want to enroll. View the profile and then click Install.

  8. In the next screen, you will be asked to install Remote Management which allows the server to manage that machine. View the profile and click Continue. Enter an administrator’s credentials when prompted.

  9. Now that the profile has been installed on the computer, refresh the view in the browser and notice that the computer is now listed under the Devices tab with choices to Lock or Wipe the computer. This allows the user to utilize any modern web browser to control those aspects of the computer remotely, if the machine were to get lost or stolen.

  10. To lock the remote device, navigate to the site https://server17.pretendco.com/mydevices on a different computer and log in. Choose your test computer and lock it by clicking the Lock button and entering a 6 digit passcode. Click the Lock button again, and a confirmation box will appear. Once the confirmation has been given, the remote computer will reboot and then offer a dialog to unlock the machine via the passcode.

Managing Profiles Locally

Occasionally a profile will need to be viewed, added, or removed to make way for an updated profile or to simply stop management of the device. Managing the profiles local to a computer is done via the Profiles preference pane located in System Preferences. You added a profile to the computer in the previous exercise and now you will remove one.

To remove a profile local to an OS X computer:

  1. Open the Profiles preference pane in System Preferences. The various profiles installed on the computer are listed along with their contents and purposes.
  2. Pick the profile you wish to remove such as the remote management profile and click the Remove (-) button.
  3. A confirmation dialog box will appear. Click Remove. Enter a local administrator’s credentials, if prompted, and click OK.

To remove a profile local to an iOS device:

  1. Navigate to Settings/General/Profiles.
  2. Tap the profile to show the details.
  3. Tap the Remove button.
  4. Confirm the removal by tapping the Remove button on the confirmation box.
  5. Exit Settings.

Using Profile Manager

Once Profile Manager has been turned on, you access the actual management interface via a web application. The web application can be reached via web browser on any machine.

  1. Navigate to the site https://server17.pretendco.com/profilemanager.
  2. Log in to the Profile Manager web app with an administrator’s credentials.

  3. The layout is a column view where the selection made in the left column defines the content of the column to the right. Click on Devices under the Library and click an enrolled computer.

  4. In the computers information pane, click Profile and then click Edit under Settings.
  5. In the new window that opens, scroll down the list to the Mac OS X section, noting that there are sections for iOS and combined iOS and Mac OS X. Click Dock and then click Configure.

  6. Change the settings to place the Dock on the Left and to automatically hide and show the Dock.

  7. Scroll back to the top of the list in the left column and choose General. Under Profile Distribution Type select Manual Download. Click OK.
  8. Note that the Dock preference is indicated in the settings for the computer. Click Save.

  9. A warning that new settings might be pushed to the managed devices is presented. Click Save.

  10. Under the Settings for the computer, click the Download button. A copy of the preferences is stored in the profile that has been downloaded to the machine Profile Manager is running on. Open the profile in TextEdit.app and view the contents. The profile is simply an XML text file.
  11. Copy the file to your client computer and double-click on it to install. Choose Show Profile to view the contents of the profile.

  12. Click Install and enter the local administrators password.
  13. Log out and log back in. Notice the Dock is now hidden on the left side.
  14. Open the Profiles preference pane in System Preferences. View the new profile. Remove the profile by clicking the Remove (-) button at the bottom of the left column. Acknowledge the removal and enter a local administrator’s credentials. Upon logging out and back in, the original Dock location and behavior will be restored.

Delivering Profiles

Once created, profiles can be delivered to users and computers or iOS devices in a number of ways:

  • Via the User Portal where users log in to the portal with their account credentials and they are presented with the profiles assigned to them.
  • Emailed to users. The profile is a simple text file, so it is easily transported.
  • Web link. The profile can be published on a website for users to visit and download.
  • Automatic Push. The profile gets automatically pushed to the device with no user interaction (the device must be enrolled for this to work).

Remotely Locking or Wiping a Device

Once enrolled, a device or group of devices can be remotely locked or wiped. In this example, a remote lock will be performed. A remote wipe can be attempted, but only do it on a device you don’t mind reconfiguring. The device can be locked via Profile Manager by an administrator or via the User Portal by the users themselves.

Upon requesting a lock, a confirmation pane will appear, a passcode will be requested, and the lock command will be sent. On Lion computers, the machine is shut down and an EFI passcode is set, so it needs to be entered to use the machine again. For iOS devices, the screen is locked and the passcode enforced.

  • Profile Manager: Log into Profile Manager and select the device or group of devices to be locked. In the Action (gear) menu at the bottom of the right pane choose Lock.
  • User Portal: Once users log in, each device they enrolled will be displayed in the Devices.
  • + Share This
  • 🔖 Save To Your Account

Peachpit Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Peachpit and its family of brands. I can unsubscribe at any time.

Overview


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Peachpit products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information


To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.

Surveys

Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.

Newsletters

If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email ask@peachpit.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information


Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.

Security


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.

Children


This site is not directed to children under the age of 13.

Marketing


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information


If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.

Choice/Opt-out


Users can always make an informed choice as to whether they should proceed with certain services offered by Adobe Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.peachpit.com/u.aspx.

Sale of Personal Information


Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents


California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure


Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.

Links


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact


Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice


We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020