How to Install Clients on Mac Computers in Configuration Manager

In the Configuration Manager console, click Administration.

In the Administration workspace, expand Site Configuration, select Servers and Site System Roles, and then select the server that holds the site system roles to configure.

In the details pane, right-click Management point, click Role Properties, and in the Management Point Properties dialog box, configure the following options, and then click OK:

1. Select HTTPS.

2. Select Allow Internet-only client connections or Allow intranet and Internet client connections. These options require that an Internet FQDN is specified in the site system properties, even if the site system server will not be accessible from the Internet.

3. Select Allow mobile devices and Mac computers to use this management point.

In the details pane, right-click Distribution point, click Role Properties, and in the Distribution Point Properties dialog box, configure the following options, and then click OK:

- Select **HTTPS**.

- Select **Allow Internet-only client connections** or **Allow intranet and Internet client connections**. These options require that an Internet FQDN is specified in the site system properties, even if the site system server will not be accessible from the Internet.

- Click **Import certificate**, browse to the exported client distribution point certificate file, and then specify the password.

Repeat steps 2 through 4 in this procedure for all management points and distribution points in primary sites that you will use with Mac computers.

In the Configuration Manager console, click Administration.

In the Administration workspace, expand Site Configuration, and click Servers and Site System Roles

On the Home tab, in the Create group, click Create Site System Server.

On the General page, specify the general settings for the site system, and then click Next.

On the System Role Selection page, select Enrollment proxy point and Enrollment point from the list of available roles, and then click Next.

On the Enrollment Proxy Point page, review the settings and make any changes that you require, and then click Next.

On the Enrollment Point Settings page, review the settings and make any changes that you require, and then click Next.

Complete the wizard.

In the Configuration Manager console, click Administration.

In the Administration workspace, expand Site Configuration, select Servers and Site System Roles, and then select the server that you want to use to support Mac computers.

On the Home tab, in the Create group, click Add Site System Roles.

On the General page, specify the general settings for the site system, and then click Next.

On the System Role Selection page, select Enrollment proxy point and Enrollment point from the list of available roles, and then click Next.

On the Enrollment Proxy Point page, review the settings and make any changes that you require, and then click Next.

On the Enrollment Point Settings page, review the settings and make any changes that you require, and then click Next.

Complete the wizard.

In the Configuration Manager console, click Administration.

In the Administration workspace, click Client Settings.

Click Default Client Settings.

On the Home tab, in the Properties group, click Properties.

Select the Enrollment section, and then configure the following user settings:

1. Allow users to enroll mobile devices and Mac computers: Yes 

2. Enrollment profile: Click Set Profile.

In the Mobile Device Enrollment Profile dialog box, click Create.

In the Create Enrollment Profile dialog box, enter a name for this enrollment profile, and then configure the Management site code. Select the Configuration Manager SP1 primary site that contains the management points that will manage the Mac computers.

Click Add.

In the Add Certification Authority for Mobile Devices dialog box, select the certification authority (CA) server that will issue certificates to Mac computers, and then click OK.

In the Create Enrollment Profile dialog box, select the Mac computer certificate template that you created in Step 3, and then click OK.

Click OK to close the Enrollment Profile dialog box, and then click OK to close the Default Client Settings dialog box.

Download the Mac OS X client file package, ConfigmgrMacClient.msi, and save it to a computer that runs Windows.

This file is not supplied on the Configuration Manager installation media. You can download this file from the Microsoft Download Center for Configuration Manager SP1, and the Microsoft Download Center for System Center 2012 R2 Configuration Manager.

On the Windows computer, run the ConfigmgrMacClient.msi file that you just downloaded to extract the Mac client package, Macclient.dmg to a folder on the local disk (by default C:\Program Files (x86)\Microsoft\System Center 2012 Configuration Manager Mac Client\).

Copy the Macclient.dmg file to a folder on the Mac computer.

On the Mac computer, run the Macclient.dmg file that you just downloaded to extract the files to a folder on the local disk.

In the folder, ensure that the files Ccmsetup and CMClient.pkg are extracted and that a folder named Tools is created that contains the CMDiagnostics, CMUninstall, CMAppUtil and CMEnroll tools.

On the Mac computer, navigate to the folder where you extracted the contents of the Macclient.dmg file that you downloaded from the Microsoft Download Center.

Enter the following command-line: sudo ./ccmsetup

Wait until you see the Completed installation message. Although the installer displays a message that you must restart now, do not restart now but continue to the next step.

From the Tools folder on the Mac computer, type the following: sudo ./CMEnroll -s <enrollment_proxy_server_name> -ignorecertchainvalidation -u <'user name'>

You are then prompted to type the password for the Active Directory user account.

The user name can be in the following formats:

- 'domain\\name’. For example: 'contoso\\mnorth'

- 'user@domain'. For example: '[email protected]'

The user name and corresponding password must match an Active Directory user account that is granted Read and Enroll permissions on the Mac client certificate template.

Example: If the enrollment proxy point server is named server02.contoso.com, and a user name of contoso\mnorth has been granted permissions for the Mac client certificate template, type the following: sudo ./CMEnroll -s server02.contoso.com –ignorecertchainvalidation -u 'contoso\mnorth'

Wait until you see the Successfully enrolled message.

For Configuration Manager SP1 only: To limit the enrolled certificate to Configuration Manager, on the Mac computer, open a terminal window and make the following changes:

1. Enter the command sudo /Applications/Utilities/Keychain\ Access.app/Contents/MacOS/Keychain\ Access

2. In the Keychain Access dialog box, in the Keychains section, click System, and then, in the Category section, click Keys.

3. Expand the keys to view the client certificates. When you have identified the certificate with a private key that you have just installed, double-click the key.

4. On the Access Control tab, select Confirm before allowing access.

5. Browse to /Library/Application Support/Microsoft/CCM, select CCMClient, and then click Add.

6. Click Save Changes and close the Keychain Access dialog box.

Restart the Mac computer.

After you have finished installing the client the Computer Enrollment wizard opens. Click Next to continue past the welcome page.

On the next page of the wizard, specify the following information:

- **User name** - The user name can be in the following formats:

    - 'domain\\name’. For example: 'contoso\\mnorth'

    - 'user@domain'. For example: '[email protected]'

      <div class="alert">


      > [!IMPORTANT]
      > <P>When you use an email address to populate the <STRONG>User name</STRONG> field, Configuration Manager automatically uses the domain name of the email address and the default name of the enrollment proxy point server to populate the <STRONG>Server name</STRONG> field. If this domain name and server name do not match the name of the enrollment proxy point server, you must advise your users of the correct name to use, so that they can enter this when enrolling their Mac computers.</P>


      </div>

  The user name and corresponding password must match an Active Directory user account that is granted Read and Enroll permissions on the Mac client certificate template.

- **Password** – Enter a corresponding password for the user name specified.

- **Server name** – Enter the name of the enrollment proxy point server.

Click Next to continue, and then complete the wizard.