Tiny Deathstars of Foulness

In order to use the Apple Volume Purchase Program (VPP), you will need an MDM solution (Profile Manager, Casper, MobileIron, Meraki, FileWave, etc). The same program is used for device-based VPP or user-based VPP. One change since 10.11 is that there are now two programs, which is meant to simplify the experience of setting up your MDM solution and long-term maintenance. The first is the traditional VPP account, available to companies and other non-educational environments that have a DUNS number. The second is the newer Apple School Manager, for educational institutions.

Before starting to buy apps and associating those apps from an MDM solution, there are a few things you should know. The first is that your organization can have multiple VPP tokens or Apple School Manager tokens, and you can hierarchically manage apps this way. The second is that each token should only be installed on one MDM solution or server (if you have multiple instances of the same solution). Therefore, if you’re going to have multiple servers or solutions for managing apps, keep in mind to buy apps for groups based on the VPP account that will be associated with devices for each solution.

Also, note that the traditional deployment mechanism of VPP is user, or Apple ID-based VPP apps. Here, you associate an Apple ID to a VPP account from an MDM and then the administrator sends apps to devices based via the MDM solution. And this is still an option. In 10.11 and iOS 9 we got device-based VPP. Here, you can send apps to devices even if they don’t have Apple IDs associated to the device, and you can send apps automatically, meaning they will not require user interaction. This makes VPP multi-tenant and great for school labs, or shared-use Macs and iOS devices.

But this article isn’t about the fine print details of the new VPP. Instead, this article is about making Profile Manager work with your new VPP token. Before you get started, know that when you install your vpptoken, if it’s in use by another MDM, Profile Manager will unlicensed all apps with your other MDM. To get started, log into your VPP account. Once logged in, click on your account email address and then select Account Summary.


Then, click on the Download Token link and your token will be downloaded to your ~/Downloads (or wherever you download stuff).


Once you have your token, open the Server app and click on the Profile Manager service.


Click on the checkbox for Distribute apps and books from the Volume Purchase Program.


At the VPP Managed Distribution screen, drag the .vpptoken file downloaded earlier into the screen.


Click Continue. The VPP code email address will appear in the screen. Click Done.

Back at the profile manager screen, you should then see that the checkbox is filled and you can now setup Profile Manager.

The rest of the configuration of Profile Manager is covered in a previous article.

Note: The account used to configure the VPP information is not tracked in any serveradmin settings.

October 9th, 2016

Posted In: Mac OS X, Mac OS X Server

Tags: , , , ,

Apple School Manager is a portal used to create classes, import students, manage Managed Apple IDs, and link all these things together. You can use a Student Information System (SIS) to create these classes, import students, etc. But, only if you have a SIS with an API that Apple links to. If you don’t, you’ll need to import data using csv files. And you’ll need to import four csv files: Classes, Instructors, Staff, and of course Students.

Many schools will already have this data in Active Directory or another LDAP-based solution. Here, we’ll look at getting the information out of Active Directory and into csv. The LDIFDE utility exports and imports objects from and to Active Directory using the ldif format, which is kinda’ like csv when it gets really drunk and can’t stay on one line. Luckily, ldif can’t drive. Actually, each attribute/field is on a line (which allows for arrays) and an empty line starts the next record. Which can make for a pretty messy looking file the first time you look at one. The csvde command can be used to export data into the csv format instead. In it’s simplest form the ldifde command can be used to export Active Directory objects just using a -f option to specify the location (the working directory that we’re running the ldifde command from if using powershell to do so or remove .\ if using a standard command prompt):

ldifde -f .\ADExport.ldf

This exports all attributes of all objects, which overlap with many in a target Active Directory and so can’t be imported. Therefore, you have to limit the scope of what you’re exporting, which you can do in a few ways. The first is to only export a given OU (in this case called Students, but you could do one for Teachers, one for each grade, etc). To limit, you’ll define a dn with a -d flag followed by the actual dn of the OU you’re exporting and then you’d add a -p for subtree. In the following example we’ll export all of the objects from the sales OU to the StudentsOUExport.ldf file:

ldifde -d "OU=Students,DC=krypted,DC=local" -p subtree -f .\StudentsOUExport.ldf

Once you have the ldif file, you’ll want to convert it from ldif to csv. Some apps to do so:

Once you have the file in csv form, you can import it using the Apple School Manager web interface.

April 22nd, 2016

Posted In: Articles and Books, iPhone, Mac OS X, Mac OS X Server, Mac Security

Tags: , , ,

Creating a classroom is a pretty straight forward process in Profile Manager. To do so, open the Profile Manager web interface and click on Classes in the sidebar. For your first class, click Add Class (for future ones, click the plus sign (+).

Screen Shot 2016-04-14 at 9.39.39 PM

At the New Class screen, click into New Class in the title bar and provide a name for the class. Optionally, provide a description, as well. Click on the Save button to save the class.

Screen Shot 2016-04-14 at 9.40.04 PM

Then click on the Instructors tab and use the plus sign towards the bottom of the screen and then choose the user or group you’d like to add as the Instructor for the class. Click on the Students tab to add a user or group as a student.

Screen Shot 2016-04-14 at 9.40.17 PM

Next, click on the Devices tab and then click on the plus sign (+) at the bottom of the screen. Here, click on Add Device Groups to add a group of devices.

Screen Shot 2016-04-14 at 9.41.27 PM

Additionally, check the box for Shared if the iPads will be shared iPads.

Screen Shot 2016-04-14 at 9.41.18 PM

Click OK once you’ve added the appropriate Device Group, and then click on the Save button to save the class setting.

April 15th, 2016

Posted In: Mac OS X, Mac OS X Server, Mac Security

Tags: , , , , ,