Munki-Enroll is a useful tool to use when installing the Munki tools on Mac clients. It enables the automated creation of unique client manifests, which makes it easy to change the group manifests of a client remotely at any time using tools like manifestutil, MunkiAdmin or MunkiWebAdmin, utilising the included_manifest key in Munki manifests.
I have tweaked Munki-Enroll in order to leverage a feature of DeployStudio called Computer Information fields. These are four text fields available in the Hostname workflow page.
The contents of these fields are actually written to a preference file on the host computer at /Library/Preferences/com.apple.RemoteDesktop, with key names Text1, Text2, Text3, Text4. If you are using Imagr instead of DeployStudio, you could easily script the use of these fields with commands such as:
I use these fields to determine manifest enrolment using Munki-Enroll. This allows me to have only two DeployStudio workflows for all computers: one for new, out-of-box Macs which don’t require a rebuild, and one for rebuilding Macs. All other imaging variations are determined by Munki manifests. My DeployStudio workflows include installing the MunkiTools package, and then a munki-enroll.sh script which reads the contents of the Computer Information fields and posts them to Munki-Enroll using curl:
One could just write the manifest names one wished to include in the client manifest directly into these fields, and pass them to munki-enroll. In my case, I wished to use shortcuts to make inputting quicker, so I added some processing to the script so interpret shortcuts (COMPFIELD1-COMPFIELD4) and output manifest names (IDENTIFIER1-IDENTIFIER4):
Default package set for Regular Users
ZA - ZF
_cg_za - _cg_zf
Zone (area) specific packages, including local admin user creation
Zone D Student Laptop build (Open Access)
Default package set (if #1 is set to ZA-ZF)
Join to Active Directory (desktop build)
Join to Active Directory and add managed wifi profile (laptop build)
“Light touch” all-optional build
Do not encrypt
Encrypt the Mac using Crypt
I’m not using the fourth Computer Information field at this time. Of course, your organisation’s manifests are very unlikely to be the same, but I hope this gives you an idea of the flexibility that can be gained using the Computer Information fields with Munki-Enroll. I also use the contents of Computer Information field 1 in my Munki AD-binding package to determine the Active Directory Organisational Unit.
The manifests are then passed to the Munki-Enroll web page using a curl command:
Note that this is a POST command - a change from the default munki-enroll which uses the less-secure GET method.
The Munki-Enroll script (enroll.php) has been tweaked to accept each identifier and add them as included_manifests to the client manifest:
Take a look at my tweaked version of Munki-Enroll here.