QuickStart Guide for Mobile Device Management v8.0 - JAMF Software

QuickStart Guide
for Mobile Device Management
Version 8.0
Inventory
Configuration
Security
Management
App
Distribution

JAMF Software, LLC
© 2010 JAMF Software, LLC
All rights reserved.
Under the copyright laws, this publication may not be copied, in whole or in part, without the written consent
of JAMF Software, LLC.
Apache Tomcat and Tomcat are trademarks of the Apache Software Foundation.
Apple, Finder, iPhone, iPhone Configuration Utility, and Mac OS X Server are trademarks of Apple Inc.
App Store is a service mark of Apple Inc., registered in the U.S. and other countries.
The Casper Suite logo, the JAMF Software logo, the JAMF Software Server, JSS Setup Assistant, JSS Setup Utility,
and Self Service are trademarks of JAMF Software, LLC in the United States and other countries.
IOS is a trademark or registered trademark of Cisco in the U.S. and other countries.
Maker’s Mark is a registered trademark of Beam Global Spirits & Wine, Inc.
MySQL is a registered trademark of Sun Microsystems, Inc.
VeriSign is a registered trademark of VeriSign, Inc. and its subsidiaries.
All other product and service names mentioned are the trademarks of their respective companies.

How to Use This Guide
Mobile device management with the Casper Suite is based on four tasks—Inventory, Configuration, Security
Management, and App Distribution. This guide contains a lesson-based workflow for each task.
You can complete one or all of the workflows in any order that meets your mobile device management
needs.
After completing a workflow, use the advanced options in the “Explore More” section to further customize
your framework.
Keep in mind that you only need to complete each lesson in this guide once. If you’ve already completed a
lesson (for example, installing the JSS), skip it and move on to the next one in the workflow.
Using a Print Version of This Guide
1. Locate the task you want to complete on the Lesson Plan page.
2. Complete each lesson in the workflow.
You can find additional information about each lesson in the Casper Suite Administrator’s Guide. A list of
relevant sections and their page numbers is provided in the “Reference Pages” portion of each lesson.
3. After you complete the last lesson in a workflow, refer to the “Explore More” section of this guide for
a list of extended options and where to read more about them in the Casper Suite Administrator’s
Guide.
Using a PDF of This Guide
Use the hyperlinks in the body of the document or the Bookmarks panel to navigate each workflow.
3

QuickStart Guide
Lesson Plan
Prerequisites
Install the JAMF
Software Server (JSS)
Specify an SMTP Server
(Optional)
Add an LDAP Server
Connection (Optional)
Page 9 Page 10 Page 11 Page 12
Configure the Mobile
Device Management
Framework
Inventory
Prerequisites
Enroll Mobile Devices
with the JSS
Pages 9-13 Page 17 Page 19
View Inventory for
Mobile Devices
Configuration
Prerequisites
Enroll Mobile Devices
with the JSS
Pages 9-13 Page 17 Page 20
Create a Configuration
Profile
Security
Management
Prerequisites
Enroll Mobile Devices
with the JSS
Run a Remote
Command
Pages 9-13 Page 17 Page 21
App
Distribution
Prerequisites
Enroll Mobile Devices
with the JSS
Pages 9-13 Page 17 Page 22
Make an App Available
Through the Self
Service Web Clip
5

Prerequisites
Install the JAMF Software Server (JSS) 9
Specify an SMTP Server (Optional) 10
Add an LDAP Server Connection (Optional) 11
Configure the Mobile Device Management Framework 12
7

Install the JAMF Software Server (JSS)
The JAMF Software Server (JSS) is the administrative core of the Casper Suite. It stores inventory
information for mobile devices as well as the components you need to perform mobile device
management tasks. It also communicates with Apple Push Notification Service (APNs), which
prompts devices to check in to the JSS and perform available tasks.
The JSS Setup Utility application guides you through the process of installing the JSS and
automatically configures the components that run the server—Tomcat and MySQL.
Requirements
Computer running a clean installation of Mac OS X Server 10.5 or 10.6 with SSH (Remote Login)
enabled
JSS Setup Utility application
To install the JSS:
1 Open the JSS Setup Utility application.
2 Enter the DNS name or IP address of the server you want to use to host the JSS.
3 Specify credentials for an administrator account to the server, and then click Connect.
4 After the JSS Setup Utility is finished gathering information about the server, click the button
labeled Install JSS.
5 Select the Install the JSS without a Distribution Point option, and click the Install button.
Mobile device management functions do not utilize distribution points.
6 After the installation is complete, the JSS opens in a web browser and the JSS Setup Assistant
guides you through the rest of the setup.
Reference Pages
Casper Suite Administrator’s Guide, “Installing the JSS on Mac OS X Server” (pages 22 and 23)
Casper Suite Administrator’s Guide, “Setting Up the JSS” (pages 24-29)
9

Specify an SMTP Server (Optional)
An SMTP server must be set up in the JSS to enroll devices using OTA invitations.
Note: This guide also explains how to enroll devices by providing an enrollment URL. This method
does not require an SMTP server.
Requirements
Access to the JSS
DNS name or IP address (host name) of your SMTP server
Email address from which notifications should be sent
Credentials for the SMTP server’s administrator account (Only if the SMTP server requires
authentication)
To specify an SMTP server:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Settings tab.
4 Click the General Settings link.
5 Click the SMTP Server tab.
6 Enter information about the SMTP server.
7 Click the Save button.
Reference Pages
Casper Suite Administrator’s Guide, “Enabling Email Notifications” (pages 160 and 161)
10

Add an LDAP Server Connection (Optional)
Integrating with an LDAP directory service allows you to require users to login to enroll their
device.
Requiring login has the following advantages:
Ensures that only users with valid accounts can enroll a device
Automatically associates a device with its user(s) in the JSS
Automatically populates location information in the JSS
The “Enroll Mobile Devices with the JSS” lesson explains how to require user login.
Note: If your organization does not utilize an LDAP directory server, but you want to require user
login, you can create a JSS user account that has privileges to enroll devices. For information on
creating a JSS user account and setting privileges, see the “Managing JSS User Accounts” section of
the Casper Suite Administrator’s Guide.
Requirements
Access to the JSS
DNS name or IP address (host name) of your LDAP server
Credentials for the LDAP server’s service account
Information about two user accounts in the LDAP service for testing purposes (For example,
username, real name, email address, etc.)
Information two user groups in the LDAP service for testing purposes (For example, group
name, members, etc.)
To add an LDAP server connection:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Settings tab.
4 Click the LDAP Server Connections link.
5 Click the Add LDAP Server Connection button.
6 Choose the LDAP server you want to integrate with, and then click Continue.
7 Follow the onscreen instructions to configure the LDAP server connection.
Reference Pages
Casper Suite Administrator’s Guide, “Integrating with LDAP Servers” (pages 81-89)
11

Configure the Mobile Device Management
Framework
To enroll mobile devices with the JSS for management, you must first configure the security
components required to perform management tasks.
Public Key Infrastructure
A public key infrastructure (PKI) is the framework that generates and distributes the certificates
that ensure the security of over-the air tasks. To set up the PKI, you need:
Certificate authority (CA) enabled with Simple Certificate Enrollment Protocol (SCEP)
Root certificate from the CA
Signing certificate from the CA
If your organization uses a SCEP-enabled CA from a third-party, such as VeriSign, refer to the
“Configuring the Mobile Device Management Framework Settings” section in the Casper Suite
Administrator’s Guide for instructions on how to proceed.
If your organization does not use a third-party CA, you can use the one built in to the JSS. Using
the built-in CA obtains and stores all of the required certificates for you automatically.
The following instructions explain how use the built-in CA.
To use the built-in CA:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Settings tab.
4 Click the Mobile Device Management Framework Settings link.
5 Click PKI tab.
6 Leave the Use Built-In Certificate Authority option selected.
7 Enter the keystore password that you will use for the built-in CA, and then enter it again to
verify it.
8 Click the Save button.
Web Server Certificate
Installing a valid web server certificate on the JSS ensures that devices communicate with the JSS
and not an imposter server.
If you do not have a valid web server certificate and your are using a third-party CA, see the
following Knowledge Base article for instructions on how to create one:
http://jamfsoftware.com/kb/article.php?id=019
12

If you are using the built-in CA, you can create a valid web server certificate from the JSS Setup
Utility using the following instructions.
To create a web server certificate using the JSS Setup Utility:
1 Open the JSS Setup Utility.
2 Enter the DNS name or IP address for the JSS and specify credentials for your administrator
account.
3 Click Connect.
4 Click Web Application in the sidebar.
5 Click the Settings tab at the bottom of the pane.
6 Click the Create JSS Signed Certificate button.
7 When the JSS Setup Utility is finished creating the certificate, click OK and quit the
application.
Apple Push Notification Certificate
To perform inventory, configuration, and security management tasks on devices, the JSS must be
able to communicate with Apple Push Notification Service (APNs). Enable this communication by
obtaining a push notification certificate from Apple and uploading it to the JSS.
Push notification certificates are obtained from Apple’s iOS Provisioning Portal. To access this
portal, you must be enrolled in Apple’s iOS Developer Enterprise Program. If you are not enrolled
in this program, you can register at:
http://developer.apple.com/programs/ios/enterprise/
To upload a push notification certificate:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Settings tab.
4 Click the Mobile Device Management Framework Settings link.
5 Click the APNs tab.
6 Click the Upload link next to Push Notification Certificate.
7 Click the Choose File button.
8 Locate the push notification certificate in the Finder window, select it, and then click Choose.
9 Click the Upload Selected File button in the JSS.
10 Specify the push notification keystore password.
11 Click the Save button.
Reference Pages
Casper Suite Administrator’s Guide, “Configuring the Mobile Device Management Framework
Settings” (pages 397-403)
13

Lessons
Enroll Mobile Devices with the JSS 17
View Inventory for Mobile Devices 19
Create a Configuration Profile 20
Run a Remote Command 21
Make an App Available Through the Self Service Web Clip 22
15

Enroll Mobile Devices with the JSS
After configuring the mobile device management framework, you can enroll mobile devices with
the JSS. There are three ways to do this:
Send an OTA (Over-the-Air) invitation via email or text message (SMS)
Provide users with an enrollment URL
Install an enrollment profile using Apple’s iPhone Configuration Utility (IPCU)
This section explains how to send an OTA invitation.
Alternatively, you can direct users to the enrollment page by providing them with the enrollment
URL. The enrollment URL is the JSS URL with “/enroll/” at the end. For example:
https://jss.yourcompany.com:8443/enroll/
For more information on creating enrollment profiles, see the “Installing Enrollment Profiles Using
IPCS” section in the Casper Suite Administrator’s Guide.
Requirements
To send an email invitation, you need:
An Apple mobile device running iOS 4.0 or later with internet access
Access to the JSS
The email address(es) that you want to send the invitation to
An SMTP server set up in the JSS
LDAP server connection or JSS user account with OTA enrollment privileges (Required login
only)
To send a SMS invitation, you need:
An iPhone running iOS 4.0 or later with SMS capabilities
Access to the JSS
The phone number(s) that you want to send the invitation to
An SMTP server set up in the JSS
LDAP server connection or JSS user account with OTA enrollment privileges (Required login
only)
To send an OTA invitation:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Management tab.
4 Click the Mobile Device Enrollment link.
5 Click the Send OTA Invitations button in the toolbar.
6 Choose to send an email or SMS invitation
17

7 Enter the email address(s) or phone number(s) that you want to send the invitation to.
Use a line break or a comma to separate each entry.
8 Click Continue.
9 Customize the message, and then click Continue.
10 Set an expiration date for the invitation if desired.
11 To require user login, leave the Require login checkbox selected.
This requires users to log in by entering the username and password for an LDAP account or
a JSS user account with enrollment privileges.
12 Click the Continue button.
13 Click the Send button on the Complete pane to send the invitation.
Reference Pages
Casper Suite Administrator’s Guide, “Enrolling Mobile Devices with the JSS” (pages 404-418)
18

View Inventory Data for Mobile Devices
After enrolling devices with the JSS, you can perform a simple mobile device search to view the
following information for each device:
Device Information
Certificates
Location
Profiles
Purchasing
Provisioning Profiles
Apps
Management History
Security
Attachments
Network Information
Requirements
Access to the JSS
To view inventory data for a mobile device:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Inventory tab.
4 Click the Mobile Devices link above the search field.
5 Leave the search field blank and click the Search Mobile Devices button, or type the Enter
key.
This returns all devices in this JSS.
6 Click the Details link across from any device to view detailed inventory data.
Reference Pages
Casper Suite Administrator’s Guide, “Searching Mobile Devices” (pages 420-433)
19

Create a Configuration Profile
After enrolling mobile devices with the JSS, you can configure security, Wi-Fi, account, and other
device settings by creating a configuration profile in the JSS. When you configure these setting in a
configuration profile, the settings are called payloads.
This lesson explains how to create a configuration profile that enforces a passcode on devices.
For a detailed list of payloads, see Apple’s Enterprise Deployment Guide at:
http://manuals.info.apple.com/en_US/Enterprise_Deployment_Guide.pdf
After creating the configuration profile, you assign it to a scope for distribution. This prompts the
JSS to tell Apple Push Notification Service (APNs) to send a push notification to devices in the
scope. The devices respond by checking in to the JSS and installing the configuration profile.
Requirements
Access to the JSS
To create a configuration profile:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Management tab.
4 Click the Mobile Device Profiles link.
5 Click the Add Profile button in the toolbar.
6 Select the Create a Configuration Profile option, and then click Continue.
7 Enter a display name for the profile.
8 Enter a description if desired.
9 Choose a security option from the Security pop-up menu.
10 In the payload list on the left side of the pane, click Passcode, and then click Create.
11 Configure settings for the passcode as needed.
For more information on these settings, see Apple’s Enterprise Deployment Guide.
12 Click the Scope tab and assign devices to the scope.
To distribute the profile to all mobile devices, select the Assign to All Devices option.
To distribute the profile to specific mobile devices, select Assign to Specific Devices and
assign devices as needed.
13 Click the Save button.
Reference Pages
Casper Suite Administrator’s Guide, “Creating Configuration Profiles” (pages 442-444)
20

Run a Remote Command
After enrolling mobile devices, you can run the following commands from the JSS to manage the
security of a device:
Remote wipe. Permanently erase all data and deactivate the device
Remote lock. Lock the device
Remote clear passcode. Remove the passcode from a device
After you create a remote command, the JSS tells Apple Push Notification Service (APNs) to send a
push notification to the device. The device responds by checking in to the JSS and running the
command.
Requirements
Access to the JSS
To run a remote command:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Management tab.
4 Click the Remote Commands link.
5 Click the New Remote Command button in the toolbar.
6 Choose command you want to run, and then click Continue.
7 Follow the onscreen instructions to scope the remote command.
Reference Pages
Casper Suite Administrator’s Guide, “Running Remote Commands” (pages 450-452)
21

Make an App Available Through the Self
Service Web Clip
After enrolling mobile devices with the JSS, you can make in-house apps or App-Store apps
available for users to install through the Self Service web clip. The web clip is added to a device’s
Home screen after the enrollment process is complete.
This lesson explains how to make an App Store app available through the Self Service web clip.
Requirements
Access to the JSS
To make an App Store app available through the Self Service web clip:
1 Open the JSS in a web browser.
2 Enter credentials for the account that you created when you installed the JSS, and then click
OK.
3 Click the Management tab.
4 Click the Mobile Device App Catalog link.
5 Click the Add App button in the toolbar.
6 Select the Link to an app in the App Store option, and then click Continue.
7 Specify the name of the app and the App Store country, and then click Continue.
8 Click Add across from the app you want to add.
9 Verify that the populated information is correct.
10 Click the Scope tab and assign devices to the scope.
To make the app available on all devices, select the Assign to All Mobile Devices option.
To make the app available on specific devices, select the Assign to Specific Mobile Devices
option and assign devices as needed.
11 Click the Save button.
Reference Pages
Casper Suite Administrator’s Guide, “Linking App Store Apps” (pages 463-465)
22

Explore More...
Inventory 25
Configuration 26
Security Management 27
App Distribution 28
23

Inventory: Explore More…
“Performing an Advanced Mobile Device Search,” (Casper Suite Administrator’s Guide, pages
421-424) describes your advanced options when searching for mobile devices in the JSS.
“Viewing Mobile Device Inventory from JSS Mobile,” (Casper Suite Administrator’s Guide, pages
426-428) explains how to search and view mobile device inventory from a device using the JSS
Mobile application.
“Performing Actions on Mobile Device Search Results,” (Casper Suite Administrator’s Guide,
pages 428-433) explains how to perform management tasks on one or more mobile devices.
“Searching Mobile Device Apps,” (Casper Suite Administrator’s Guide, pages 434 -437)
explains how search mobile device apps in the JSS.
“Creating Mobile Device Groups,” (Casper Suite Administrator’s Guide, pages 438-440)
explains how to create organizational components based on a mobile device’s inventory
attributes.
25

Configuration: Explore More…
“Uploading Configuration Profiles,” (Casper Suite Administrator’s Guide, pages 445-446)
explains how to distribute configuration profiles created using Apple’s IPCU with the JSS.
“Editing Configuration Profiles,” (Casper Suite Administrator’s Guide, page 447) explains how
to distribute updated configuration profiles.
“Deleting Configuration Profiles,” (Casper Suite Administrator’s Guide, page 448) explains how
to delete configuration profiles from devices.
26

Security Management: Explore More…
“Running Remote Commands,” (Casper Suite Administrator’s Guide, pages 450-452) explains
how to run a remote command using the JSS or the JSS Mobile application.
“Viewing the Status of a Remote Command,” (Casper Suite Administrator’s Guide, page 453)
explains how to view whether a remote command has run on the device.
27

App Distribution: Explore More…
“Configuring the Mobile Device Management Framework Settings,” (Casper Suite
Administrator’s Guide, pages 397-403) explains how to add and remove the Self Service web
clip from devices.
“Managing Provisioning Profiles,” (Casper Suite Administrator’s Guide, pages 457 and458)
explains how to upload and delete provisioning profiles.
“Uploading In-House Apps,” (Casper Suite Administrator’s Guide, pages 459 and 461) explains
how to make in-house apps available through the Self Service web clip.
“Linking App Store Apps,” (Casper Suite Administrator’s Guide, pages 463-465) explains how
to make App Store apps available through the Self Service web clip.
“Installing Apps Using the Self Service Web Clip,” (Casper Suite Administrator’s Guide, pages
467-469) explains how users use the Self Service web clip to install apps and updates on their
device.
“Editing In-House Apps,” (Casper Suite Administrator’s Guide, page 461) explains how to make
updates to in-house apps available through the Self Service web clip.
“Deleting In-House Apps,” (Casper Suite Administrator’s Guide, page 462-463) explains how
to remove apps from the Self Service web clip by deleting them in the JSS.
Editing and Deleting App Store Apps,” (Casper Suite Administrator’s Guide, page 462-463)
explains how to edit App Store apps and remove them from the Self Service web clip.
28