-->

Applies to: Configuration Manager (current branch)

This article describes how to deploy and maintain the Configuration Manager client on Mac computers. To learn about what you have to configure before deploying clients to Mac computers, see Prepare to deploy client software to Macs.

Sep 26, 2013.

Because packages are simply a series of files along with instructions for their ultimate location in a Mac's file system, you can easily configure non-application packages for deploying. Configuring your Mac computer for dbRASweb. This page provides instructions on how to configure your Mac to connect to dbRASweb. Section 1: Installing Java. Part I: Create an Oracle Account. Click the link provided here: Java Downloads 2. Click View Accounts button on the top right corner of the web page. Click Create an Account.

When you install a new client for Mac computers, you might have to also install Configuration Manager updates to reflect the new client information in the Configuration Manager console.

In these procedures, you have two options for installing client certificates. Read more about client certificates for Macs in Prepare to deploy client software to Macs.

Use Configuration Manager enrollment by using the CMEnroll tool. The enrollment process doesn't support automatic certificate renewal. Re-enroll the Mac computer before the installed certificate expires.
Use a certificate request and installation method that is independent from Configuration Manager.

Important

To deploy the client to devices running macOS Sierra, correctly configure the Subject name of the management point certificate. For example, use the FQDN of the management point server.

Configure client settings

Use the default client settings to configure enrollment for Mac computers. You can't use custom client settings. To request and install the certificate, the Configuration Manager client for Mac requires the default client settings.

In the Configuration Manager console, go to the Administration workspace. Select the Client Settings node, and then select Default Client Settings.
On the Home tab of the ribbon, in the Properties group, choose Properties.
Select the Enrollment section, and then configure the following settings:
1. Allow users to enroll mobile devices and Mac computers: Yes
2. Enrollment profile: Choose Set Profile.
In the Mobile Device Enrollment Profile dialog box, choose Create.
In the Create Enrollment Profile dialog box, enter a name for this enrollment profile. Then configure the Management site code. Select the Configuration Manager primary site that contains the management points for these Mac computers.
Note
If you can't select the site, make sure that you configure at least one management point in the site to support mobile devices.
Choose Add.
In the Add Certification Authority for Mobile Devices window, select the certification authority server that issues certificates to Mac computers.
In the Create Enrollment Profile dialog box, select the Mac computer certificate template that you previously created.
Select OK to close the Enrollment Profile dialog box, and then the Default Client Settings dialog box.
Tip
If you want to change the client policy interval, use Client policy polling interval in the Client Policy client setting group.

The next time the devices download client policy, Configuration Manager applies these settings for all users. To initiate policy retrieval for a single client, see Initiate policy retrieval for a Configuration Manager client.

In addition to the enrollment client settings, make sure that you have configured the following client device settings:

Hardware inventory: Enable and configure this feature if you want to collect hardware inventory from Mac and Windows client computers. For more information, see How to extend hardware inventory.
Compliance settings: Enable and configure this feature if you want to evaluate and remediate settings on Mac and Windows client computers. For more information, see Plan for and configure compliance settings.

For more information, see How to configure client settings.

Download the client for macOS

Download the macOS client file package, Microsoft Endpoint Configuration Manager - macOS Client (64-bit). Save ConfigmgrMacClient.msi to a computer that runs Windows. This file isn't on the Configuration Manager installation media.
Run the installer on the Windows computer. Extract the Mac client package, Macclient.dmg, to a folder on the local disk. The default path is C:Program FilesMicrosoftSystem Center Configuration Manager for Mac client.
Copy the Macclient.dmg file to a folder on the Mac computer.
On the Mac computer, run Macclient.dmg to extract the files to a folder on the local disk.
In the folder, make sure that it contains the following files:
- Ccmsetup: Installs the Configuration Manager client on your Mac computers using CMClient.pkg
- CMDiagnostics: Collects diagnostic information related to the Configuration Manager client on your Mac computers
- CMUninstall: Uninstalls the client from your Mac computers
- CMAppUtil: Converts Apple application packages into a format that you can deploy as a Configuration Manager application
- CMEnroll: Requests and installs the client certificate for a Mac computer so that you can then install the Configuration Manager client

Enroll the Mac client

Enroll individual clients with the Mac computer enrollment wizard.

To automate enrollment for many clients, use the CMEnroll tool.

Enroll the client with the Mac computer enrollment wizard

After you install the client, the Computer Enrollment wizard opens. To manually start the wizard, select Enroll from the Configuration Manager preference page.
On the second page of the wizard, provide the following information:
- User name: The user name can be in the following formats:
  - domainname. For example: contosomnorth
  - user@domain. For example: [email protected]
    Important
    When you use an email address to populate the User name field, Configuration Manager automatically populates the Server name field. It uses the default name of the enrollment proxy point server and the domain name of the email address. If these names don't match the name of the enrollment proxy point server, fix the Server name during enrollment.
    The user name and corresponding password must match an Active Directory user account that has Read and Enroll permissions on the Mac client certificate template.
- Server name: The name of the enrollment proxy point server.

Client and certificate automation with CMEnroll

Use this procedure for automation of client installation and requesting and enrollment of client certificates with the CMEnroll tool. To run the tool, you must have an Active Directory user account.

On the Mac computer, navigate to the folder where you extracted the contents of the Macclient.dmg file.
Enter the following command: sudo ./ccmsetup
Wait until you see the Completed installation message. Although the installer displays a message that you must restart now, don't restart, and continue to the next step.
From the Tools folder on the Mac computer, type the following command: sudo ./CMEnroll -s <enrollment_proxy_server_name> -ignorecertchainvalidation -u '<user_name>'
After the client installs, the Mac Computer Enrollment wizard opens to help you enroll the Mac computer. For more information, see Enroll the client by using the Mac computer enrollment wizard.
Example: If the enrollment proxy point server is named server02.contoso.com, and you grant contosomnorth permissions for the Mac client certificate template, type the following command: sudo ./CMEnroll -s server02.contoso.com -ignorecertchainvalidation -u 'contosomnorth'
Note
If the user name includes any of the following characters, enrollment fails: <>'+=,. Use an out-of-band certificate with a user name that doesn't include these characters.
For a more seamless user experience, script the installation steps. Then users only have to supply their user name and password.
Type the password for the Active Directory user account. When you enter this command, it prompts for two passwords. The first password is for the super user account to run the command. The second prompt is for the Active Directory user account. The prompts look identical, so make sure that you specify them in the correct sequence.
Wait until you see the Successfully enrolled message.
To limit the enrolled certificate to Configuration Manager, on the Mac computer, open a terminal window and make the following changes:
1. Enter the command sudo /Applications/Utilities/Keychain Access.app/Contents/MacOS/Keychain Access
2. In the Keychain Access window, in the Keychains section, choose System. Then in the Category section, choose Keys.
3. Expand the keys to view the client certificates. Find the certificate with a private key that you installed, and open the key.
4. On the Access Control tab, choose Confirm before allowing access.
5. Browse to /Library/Application Support/Microsoft/CCM, select CCMClient, and then choose Add.
6. Choose Save Changes and close the Keychain Access dialog box.
Restart the Mac computer.

To verify that the client installation is successful, open the Configuration Manager item in System Preferences on the Mac computer. Also update and view the All Systems collection in the Configuration Manager console. Confirm that the Mac computer appears in this collection as a managed client.

Download minecraft on mediafire. Tip

To help troubleshoot the Mac client, use the CMDiagnostics tool included with the Mac client package. Use it to collect the following diagnostic information:

A list of running processes
The Mac OS X operating system version
Mac OS X crash reports relating to the Configuration Manager client including CCM*.crash and System Preference.crash.
The Bill of Materials (BOM) file and property list (.plist) file created by the Configuration Manager client installation.
The contents of the folder /Library/Application Support/Microsoft/CCM/Logs.

The information collected by CmDiagnostics is added to a zip file that is saved to the desktop of the computer and is named cmdiag-<hostname>-<datetime>.zip

Manage certificates external to Configuration Manager

You can use a certificate request and installation method independent from Configuration Manager. Use the same general process, but include the following additional steps:

When you install the Configuration Manager client, use the MP and SubjectName command-line options. Enter the following command: sudo ./ccmsetup -MP <management point internet FQDN> -SubjectName <certificate subject name>. The certificate subject name is case-sensitive, so type it exactly as it appears in the certificate details.
Example: The management point's internet FQDN is server03.contoso.com. The Mac client certificate has the FQDN of mac12.contoso.com as a common name in the certificate subject. Use the following command: sudo ./ccmsetup -MP server03.contoso.com -SubjectName mac12.contoso.com
If you have more than one certificate that contains the same subject value, specify the certificate serial number to use for the Configuration Manager client. Use the following command: sudo defaults write com.microsoft.ccmclient SerialNumber -data '<serial number>'.
For example: sudo defaults write com.microsoft.ccmclient SerialNumber -data '17D4391A00000003DB'

Renew the Mac client certificate

This procedure removes the SMSID. The Configuration Manager client for Mac requires a new ID to use a new or renewed certificate.

Important

After you replace the client SMSID, when you delete the old resource in the Configuration Manager console, you also delete any stored client history. For example, hardware inventory history for that client.

Create and populate a device collection for the Mac computers that must renew the computer certificates.
In the Assets and Compliance workspace, start the Create Configuration Item Wizard.
On the General page of the wizard, specify the following information:
- Name: Remove SMSID for Mac
- Type: Mac OS X
On the Supported Platforms page, select all Mac OS X versions.
On the Settings page, select New. In the Create Setting window, specify the following information:
- Name: Remove SMSID for Mac
- Setting type: Script
- Data type: String
In the Create Setting window, for Discovery script, select Add script. This action specifies a script to discover Mac computers configured with an SMSID.
In the Edit Discovery Script window, enter the following shell script:
Choose OK to close the Edit Discovery Script window.
In the Create Setting window, for Remediation script (optional), choose Add script. This action specifies a script to remove the SMSID when it's found on Mac computers.
In the Create Remediation Script window, enter the following shell script:
Choose OK to close the Create Remediation Script window.
On the Compliance Rules page, choose New. Then in the Create Rule window, specify the following information:
- Name: Remove SMSID for Mac
- Selected setting: Choose Browse and then select the discovery script that you previously specified.
- In the following values field: The domain/default pair of (com.microsoft.ccmclient, SMSID) does not exist.
- Enable the option to Run the specified remediation script when this setting is noncompliant.
Complete the wizard.
Create a configuration baseline that contains this configuration item. Deploy the baseline to the target collection.
For more information, see How to create configuration baselines.
After you install a new certificate on Mac computers that have the SMSID removed, run the following command to configure the client to use the new certificate:

There are several methods available to you for downloading software updates in Configuration Manager. When you create an automatic deployment rule (ADR) or manually deploy software updates, the software updates are downloaded to the content library on the site server. Then, the software updates are copied to the content library on the distribution points that are associated with the configured deployment package. If you want to download the software updates before you deploy them, you can use the Download Updates Wizard. Doing this will enable you to verify that the software updates are available on distribution points before you deploy the software updates to client computers.

Download Dbrasweb Mac Configuration Package Installer

Note

For information about monitoring content status, see the Content status monitoring.

Use the following procedure to download software updates by using the Download Software Updates Wizard.

To download software updates

In the Configuration Manager console, go to the Software Library workspace, and select the Software Updates node.
Choose the software update to download by using one of the following methods:
- Select one or more software update groups from the Software Update Groups node. Then click Download in the ribbon.
- Select one or more software updates from All Software Updates node. Then click Download in the ribbon.
  Note
  In the All Software Updates node, Configuration Manager displays only software updates with a Critical and Security classification that have been released in the last 30 days.
  Tip
  Click Add Criteria to filter the software updates that are displayed in the All Software Updates node. Save search criteria that you often use, and then manage saved searches on the Search tab.
On the Deployment Package page of the Download Software Updates Wizard, configure the following settings:
- Select deployment package: Choose this setting to select an existing deployment package for the software updates that are in the deployment.
  Note
  Software updates that the site has already downloaded to the selected deployment package won't be downloaded again.
- Create a new deployment package: Select this setting to create a new deployment package for the software updates in the deployment. Configure the following settings:
  - Name: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It's limited to 50 characters.
  - Description: Specify a description that provides information about the deployment package. The optional description is limited to 127 characters.
  - Package source: Specifies the location of the software update source files. Type a network path for the source location, for example, serversharenamepath, or click Browse to find the network location. Create the shared folder for the deployment package source files before you proceed to the next page.
    - You can't use the specified location as the source of another software deployment package.
    - You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. If you do, first copy the content from the original package source to the new package source location.
    - The computer account of the SMS Provider and the user that's running the wizard to download the software updates must both have Write permissions to the download location. Restrict access to the download location. This restriction reduces the risk of attackers tampering with the software update source files.
  - Enable binary differential replication: Enable this setting to minimize network traffic between sites. Binary differential replication (BDR) only updates the content that has changed in the package, instead of updating the entire package contents. For more information, see Binary differential replication.
On the Distribution Points page, specify the distribution points or distribution point groups to host the software update files. For more information about distribution points, see Distribution point configurations. This page is available only when you create a new software update deployment package.
The Distribution Settings page is available only when you create a new software update deployment package. Specify the following settings:
- Distribution priority: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: high, medium, or low. Packages with identical priorities are sent in the order in which they were created. If there's no backlog, the package processes immediately regardless of its priority. By default, the site sends packages with Medium priority.
- Enable for on-demand distribution: Use this setting to enable on-demand content distribution to distribution points configured for this feature and in the client's current boundary group. When you enable this setting, the management point creates a trigger for the distribution manager to distribute the content to all such distribution points when a client requests the content for the package and the content isn't available. For more information, see On-demand content distribution.
- Prestaged distribution point settings: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options:
  - Automatically download content when packages are assigned to distribution points: Use this setting to ignore the prestage settings and distribute content to the distribution point.
  - Download only content changes to the distribution point: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point.
  - Manually copy the content in this package to the distribution point: Use this setting to always prestage content on the distribution point. This option is the default.
  For more information about prestaging content to distribution points, see Use Prestaged content.
On the Download Location page, specify the location that Configuration Manager uses to download the software update source files. Use one of the following options:
- Download software updates from the Internet: Select this setting to download the software updates from the location on the internet. This option is the default.
- Download software updates from a location on my network: Select this setting to download the software updates from a local directory or shared folder. This setting is useful when the computer that runs the wizard doesn't have internet access. Any computer with internet access can preliminarily download the software updates. Then store them in a location on the local network that's accessible from the computer that runs the wizard.
On the Language Selection page, select the languages for which the site downloads the selected software updates. The site only downloads these updates if they're available in the selected languages. Software updates that aren't language-specific are always downloaded. By default, the wizard selects the languages that you've configured in the software update point properties. At least one language must be selected before proceeding to the next page. When you select only languages that a software update doesn't support, the download fails for the update.
On the Summary page, verify the settings that you selected in the wizard, and then click Next to download the software updates.
On the Completion page, verify that the software updates were successfully downloaded, and then click Close.

tumblr.update-tist.download

Download Dbrasweb Mac Configuration Package