Configuring Apple Remote Desktop at Setup Assistant


This post was originally written August 21. Then, on August 22nd, Apple broke kickstart intentionally with a Mojave beta. Many Mac Admins filed radars, and the feature seems to have made a welcome return in the release version of Mojave.

I expect the kickstart ARD setting below will be replaced soon with Configuration Profile from an MDM. Until then, you can use this, and it takes just a few minutes to set up, so it’s worth doing until Apple kills it again.

Apple’s DEP set up is fantastic, except for one small issue. Apple don’t give Sysadmins the ability to skip the first few screens of the Set Up Assistant, making “imaging” (for lack of a better word) a pain in the butt.

Apple have improved the situation recently by adding new flags to the Installer – the “–eraseinstall” flag is really handy, but still you need to have someone physically in front of a newly erased Mac to jump through those first few screens.

To get past that, Cameron Kay at UNSW created a simple workflow that adds an ARD agent to the Mac, so you can remote in and click-through those first few screens. I’ve been testing his excellent work, and will share the documentation here.

The Script

The script is a very simple bash script – just change the names and password as you wish. This script also renames the computer to “Setup – Serial Number” – I’ve kept this in mine so I can create a Jamf smart group of Macs at Setup, because our DEP enrolment scripts rename the computer anyway. The script is available here.

Packaging it for Jamf

This takes just a few seconds, using Rich Trouton’s Payload Free Packager

Upload to your server

Upload this to your management system of choice. We use Jamf, so the examples here will be Jamf. You’ll also need the latest macOS Installer as a package. Upload both, then create a policy

Create a policy

My policy is a very simple policy with two packages; the macOS installer, and the ARD at Setup Package. It is scoped to all computers, but only support staff can see it. It is available in self service or via the -eraseward trigger. All very basic, but here are the screenshots.

Important: Set the ARD at Setup Package to cache, rather than install!

The secret sauce that makes the policy work is under Files and Processes – using the –eraseinstall and –installpackages flags. 

Here, I’m searching for the process “Self Service” and killing it (so self service quits, allowing the Mac to reboot. And under Execute Command:

/Applications/Install\ macOS\ High\ --eraseinstall --newvolumename "Macintosh HD" --agreetolicense --installpackage "/Library/Application Support/JAMF/Waiting Room/ard-at-setup.pkg"

We cached the Ard at Setup package earlier, so it’s in the folder “JAMF/Waiting Room”.

Now, when you run that policy, the Mac will download the installer, then erase and install macOS, and when it reboots, you’ll be able to remote to the Mac via ARD. Simple!

Obviously you can also use this as a policy to erase a whole lab at once if you want, but start testing within Self Service.