Image Creation

[SeanRussell]

For years the way to image was through a "thick image", where you load a system up with the OS, put all the settings you want into it, and capture it.

Now, it appears the "thin" approach is the way. That's fine, but I have some questions.

I have used AutoDMG, and it's great. I create the DMG and load it up, then image fine, adding any packages I need during the Casper Imaging process.

I can even lock it down fairly well using Configuration Profiles. However, I need to lock it down more. We work for a place that LOVES locking everything down.

How are you all handling this that work for places like this? Do you just upload a bunch of scripts?

Examples include disabling sharing options (Internet sharing, File sharing, etc), enabling secure keyboard entry in terminal, changing system.log retainage timeframe, and disabling bonjour service advertising. These are just a few.

This is all new to me, so just trying to get a grasp with some ideas.

[thoule]

I do that lockdown with scripts applied during imaging process. I also have some extension attributes that looks for things like Printer sharing turned on, then a smart group based on that, and of course a policy to disable printer sharing (for example). This way, if a machine falls out of compliance, it is automatically fixed at next checkin.

I have mounted the AutoDMG output in RW format and made some edits that SIP prevents, but that's not really a good solution as Apple can put those things back later...