My Boss said...lets stop imaging, and start upgrading.

[Eigger]

I was tasked today to stop wiping out our student and teacher machines to lay down the new and tested OS and packages every summer to prepare them for next school year. Instead, he likes us to do in-place OS upgrade and keep our apps up to date now so we can save time by not imaging during our summer visit to our school sites. I like the idea, who wants to be the guy imaging hundreds of laptops, waiting for them to finish and put them back to the cart. However, I think it is not all good. For Teacher machines yes. Because they keep the same machine for the duration of their contract. But how about student machines? We image student machines every summer to roll out new OS and to wipe out student data to prepare them for the next student that will use it next school year. Yes, we can do the in-place OS upgrade and upgrade packages for compatibility now, but how about cleaning the student data when the school ends? We also have shared macs that have multiple users. Is there a way to delete users and their files on scheduled manner? Wipe them out clean of user files and restore settings like a freshly imaged machine without actually imaging it? Anybody out there doing this kind of system in their school district?

[VT-Vincent]

I'm considering a similar strategy in our district, it should be perfectly doable assuming your images are relatively consistent, you don't rely heavily on any local accounts other than the one which was set up when the OS was first installed and that your students/staff don't have admin access on the student machines that would allow them to change settings or add/remove software and put it in an inconsistent state with the rest of the machines.

With regard to wiping out the student data, you should be able to script the removal of any accounts with a UID higher than 501, assuming your local admin account was created during the initial setup of the machine and you don't rely on any other local accounts. If you do, you'd need to know the UIDs of any other accounts and exclude them from that process. As far as settings go, what settings are you concerned about? Assuming your students are local, they should only have set user-specific settings and those would be wiped out with their accounts/home folders.

[psliequ]

Upgrades in place are a good idea for 1 to 1 distributed machines. For everything that you're considering a 'bare metal' re-imaging approach I would adopt more of a wait and see attitude. While bare metal re-imaging will always be suitable for macOS up to Sierra (at least 10.12.4 anyway,) with the introduction of APFS much of how a machine is 'imaged' is going to change (hopefully to all of our benefit.)

[Nix4Life]

@Eigger Is your Boss trying to save time? just asking because also in K-12 and we re-image every summer. Like you mentioned Teachers are responsible for upgrading their own machine if they want to once our testing has concluded. You could automate a lot of the re -imaging if you haven't already to a one touch setup. I have been doing a "soft" rollout of Sierra for the past 3 weeks, doing OS upgrades with createosxinstallpkg set to lowest priority(20) and install at reboot, plus an app upgrade on 2013 iMacs. Including upgrading the email client and the OS, it takes about 25-30mins. A Nuke and pave 30-35 mins. both include all updates and patches @psliequ brings up a good point, but by then we may be looking at mac OS 10.13

[alexjdale]

I wouldn't ever recommend that. You don't really know the complete state of the system and could be leaving user data (which would be a major privacy issue) or existing problems in place for the next user to find. It's not fun to try to troubleshoot systems that have gone through this sort of process if a user has problems.

It's just a bad idea. Yes, it saves time, but it's not the right approach. If we did that at my company we'd be in violation of our data security policies.

[VT-Vincent]

@alexjdale Unless a user account was intentionally created below the 501 UID that contains sensitive information, that shouldn't be an issue. A strategy like that will depend entirely on the reliability of the state of the machines in question. A corporate environment is also a bit different than K-12 education.

Re-imaging is a faster process today (especially if retaining user data isn't a concern), but was previously mentioned, APFS may put an end to disk-based imaging. An upgrade could be significantly faster than a network recovery, re-enrollment, and re-download of all district software, settings, profiles, etc.

[alexjdale]

User data can exist outside of the user profile folder. Users can effect change outside of the user folder, even non-admins. Students are notorious for playing around with systems and finding ways around restrictions.

That's all, I just wouldn't feel comfortable without at least erasing the drive between deployments. I'm sure things will be fine most of the time, but it's cutting a corner.

[Eigger]

@LSinNY Yes, we are. Being here at the Northern Most City, we always need to travel by plane just to visit our village schools, 7 of them. If we can save time from not imaging, we can do a lot more IT stuff in the school during our summer visits.
@alexjdale I have the same concern as you. But I really have to make it work. When we are visited by our Apple reps. The first thing he told us is "Imaging will go away very soon". So I better start now and fix issues along the way.

[jhuls]

@alexjdale If you're going to mention data can exist outside of the user profile folder when they don't have admin privileges, it would be helpful and lend more credibility if you mentioned those locations.

[jhuls]

As for imaging or upgrading...I moved to upgrading awhile back and only re-image if I absolutely have to. As far as data we're moving to OneDrive as a storage solution so re-imaging wouldn't be the worst thing in the world once we've migrated.

[VT-Vincent]

@alexjdale I wouldn't call it cutting a corner, some might argue that imaging after 1st deployment is cutting a corner in properly maintaining software updates. Assuming that your admin passwords haven't been compromised, there are very few other locations a standard user can write to. Those locations could easily be included in a cleanup script.