Mac Self-Service
Using the Self-Service
On the technical level, the Self-Service works based on the MDM agent, which is installed during the enrolment process. The MDM agent runs with local admin privileges in order to automate installations, manage software dependencies and gather information about the hardware and software, which helps the Mac Desktop Service team provide a better service. The Mac Desktop Service team is committed to ensure confidentiality of this information.
The user interacts with the management framework using the Self-Service app wich is installed in the Applications folder on the Mac:
When starting the Self-Service for the first time users should run the policy 'Trust CERN CA Certificates' to ensure that the Mac trusts the certificates issued by CERN' s Certification Authority, needed for the installation of some applications via the Self-Service.
Licensed Software
Access to licensed software is only granted to Macs that are properly registered in CERN's network database and that have reported to the MDM server while being on site recently. Even for Macs that are on site there is delay of a few minutes between the enrollment and the check for eligibility, which means that licensed software is not visible directly after the enrollment. Macs that are registered in the network database as 'visitor-xyz' are not eligible for licensed software.
About App Updates
Updates to the applications installed through the Self-Service are handled by mechanisms provided by these applications themselves - in exactly the same way as when these applications are installed outside of the Self-Service. Although technically possible, the Mac Desktop Service team does not push any updates, settings or applications to the Macs enrolled in the Self-Service.
About System Extensions and Delayed Installations
Some applications require the installation of System Extensions, this is currently the case for Parallels Desktop and ESET. To be able to silently install such an application the MDM remembers that such an app has been requested, and will attempt to re-install it when it notices that it's not installed. If you want to remove one of these apps you should use the corresponding Removal item in the Mac Self-Service. If you simply drag such an app to the bin the MDM will re-install it later.
Please 'Quit' the Self-Service app after use!
The Self-Service app goes into weird state when kept open for too long, and will probably use a large fraction of your Macs network bandwidth. To avoid that the Self-Service app wastes too many resources please quit the app when you are done.