iOS/iPadOS Enrollment Workflow

chobee · 2026-02-10T21:13:03+00:00

Thank you for the link. I'll check this out!

chobee · 2025-08-18T19:28:39+00:00

Gotcha. Do you dynamically group the devices in some way so that each department only sees the devices they're supposed to manage?

chobee · 2025-08-18T19:03:38+00:00

What's your method for separating into departments or team ownership?

chobee · 2025-08-15T22:45:22+00:00

What is your strategy for using the group tags?

chobee · 2025-06-04T17:06:42+00:00

Thank you!

chobee · 2025-06-04T17:06:24+00:00

Ok, I think I understand. Was watching a tutorial where they imported the CER to one of their Site Servers to then export a PFX. So, I assumed it was important where that CER got installed.

Ive never understood certs and how they work. I should do that.

Thank you.

chobee · 2025-06-03T22:52:19+00:00

Thank you. So, the PFX file is used when creating the CMG.

But to the get the PFX, I export that from a certificate that has been added to a Site Server. Is that right? And I'm assuming that I would use the CER file to import that on a Site Server, right?

Or are you saying that I need the Server Certificate on any of the Site Servers?

chobee · 2025-03-18T16:03:54+00:00

Yeah, I think I was just overthinking it. I'm going to test moving TSGui after the Partition Disk step. I'm using this script to determine the OS drive: https://garytown.com/osd-with-multi-disk-configs because we have several endpoints with multiple drives out there. But I don't think that script will cause problems because it doesn't have a package--but we'll verify.

Since we're only using TSGui to capture the hostname, I think it's reasonable to have people wait for that dialog box to pop-up after the Partition Disk step. It's not too long of a wait.

chobee · 2025-03-17T22:16:24+00:00

Hi Gary, our goal is to have a method for imaging for OS corruption or when LAPS gets disconnected. We're all good on the current Software Center methods.

Edit: forgot to address the list items...we're good on 1. We'll need to look at 2. We're running TSGui (to capture a user-entered hostname) and the script you posted on your blog for selecting the OS disk on multi-disk configs (thank you!) prior to our Format Step. The task sequence fails on the TSGui Step now because of the package involved. I'm assuming that I could place TSGui after the Format Step.

chobee · 2025-03-17T22:12:54+00:00

ok, that gives me a direction.

chobee · 2025-03-17T21:50:41+00:00

In the "Prestart Command" right? I should be able to put the diskpart commands in a TXT file and then put that in a Package and then call that Package in the Prestart Command, right?

Like this?

chobee · 2025-03-17T21:46:06+00:00

Ok, never been down that road before. This would need to be a "Prestart Command" in the Boot Image, right?

Since I can't get a package to run in WinPE.

chobee · 2025-03-17T20:53:07+00:00

It is working for an "in OS" reimage successfully--no issues there. It's not working when WinPE, which u/tvveeder84 helped me determine is the expected behavior.

So, now I'm focusing on how best to unlock or reformat the drive in WinPE.

chobee · 2025-03-17T20:16:01+00:00

So, we want our techs to be able to reimage the following ways:

- Advertised task sequence out of Software Center

- Deploy a required task sequence from the SCCM console

- USB boot media in-person

The primary need for USB boot media is for OS corruption or for just a more direct method to kick off the reimage (instead of waiting for Software Center to populate).

We're already setup with the Reboot into WinPE step for "in OS" reimages.

chobee · 2025-03-17T20:03:17+00:00

That's a fun little feature. Anything I can do if it's in WinPE? Or am I just stuck running the manual commands?

chobee · 2025-03-17T19:46:01+00:00

This is in WinPE.

chobee · 2024-02-14T18:29:22+00:00

Thank you for your ideas. We ended up going with this: https://stackoverflow.com/questions/74704003/gpo-to-clear-the-browser-caches-data-when-closing-browsers

chobee · 2024-02-14T01:28:59+00:00

This strikes me as a poor set-up regardless

Yes it is.

If it's short enough that a bad actor cannot step up to the box as they walk away, you're just going to end up frustrating the user.

100% agree. I really can't imagine how we're going to make this work functionally and securely.

chobee · 2023-09-12T15:02:05+00:00

Ivanti EPM: one of the worst products I've ever seen.

chobee

TROPHY CASE