Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

1 points

Apple Configurator 2 and restoring backups

Hi. Like everyone else I have been forced to Apple Configurator 2 through no choice of my own and now I am about ready to burst with frustration! Ok thats my vent..now onto my problem. 🙂

My previous workflow involved supervising a master iPad, installing apps and profiles, rearranging all the apps into various groups and folders etc then backing up the master iPad and restoring that backup to all other supervised devices. This worked just fine in Apple Configurator v1.x. Sadly I have not been able to do this with v2. I really need to know whetherv2 has this functionality or no. It would seem that I can prepare an iPad either manually or via a blueprint but as soon as I restore from backup the device is no longer supervised! If you know of a way to make this work I will be most appreciative of your input. If you know for a fact its not possible any more I would also appreciate you telling me that bad news as well so I can stop hitting my head up against this computer screen...please be kind...I'm a bit fragile atm. 😕

iPad Mini, iOS 9.1, Apple Configurator 2

Posted on Oct 24, 2015 10:02 PM

Best reply

Andreas Schenk

Level 1

5 points

Posted on Jan 4, 2016 7:55 AM

I have followed the various steps as zoranp3 and I came to a different conclusion. What zoranp3 describes, does indeed work, if you restore onto the same iPad that you used to create the backup. It does not work on any other iPad.

I just tried it out myself with 2 iPads.

I supervised my Master iPad, installed Apps, created Folders and (the thing I always do in such tests) created a note in the Notes.app.

I created the backup of my Master iPad.

Also the new Blueprint. I added Apps, Profiles etc to the blueprint. Also the restore of my Master iPad Backup.

Now I reset both my iPads to factory settings, to have a clean start.

When I apply my blueprint to both iPads, I get the following result:

1) The first iPad (which was physically my master) restores and works flawlessly. It comes up supervised. The iPad is ready to use as expected, showing the lock screen.

2) The second iPad restores but throws an error, that installing the WiFi-Profile requires User interaction as its not supervised (error can be skipped). AC shows that this iPad is not supervised. It shows the Setup-Assistant. Apps are installed, but no Profiles.

What I can do, is now select the second iPad in Apple Configurator and supervise it using the Prepare button. This will NOT wipe the device, as it has not yet been used (Setup Assistant not done). I can then see, that my WiFi Profile did indeed not install (as it was skipped before - now it would install flawlessly, as the iPad is now supervised).

The summary is:

- The goal of restoring data (App placement in folders, also App Data) to many supervised iPads can be achieved, but not in one step

- It does matter, if you restore on the same iPad or on a different one (as a side note: if an iPad is MDM enrolled, the MDM enrollment works if restored to the same iPad while it breaks when being restored to a different iPad). Reading Apples Security Whitepaper on iOS might help understand the background. (Keybags, Backup etc.) Read here:

https://www.apple.com/euro/privacy/d/generic/docs/iOS_Security_Guide.pdf

The way to do it is to restore the backup, then supervise. As long as you do not touch the Setup Assistant, supervision wont wipe the iPad.

View in context

100 replies

Mar 7, 2016 4:06 PM in response to njstone19

Well I will try to answer your questions as best as I can -

For #1 - I'm not sure what you can do to prevent a mail app from caching data from one user to the next. Have you considered having them use a web interface for email (web link on the iPads) instead? Most all web interfaces for mail clear out credentials/data once closed unless the user explicitly told the web browser to save the credentials, but I think that can be turned off in a restrictions profile.

For #2 - the "attempt to manage unmanaged apps" is actually a 2-stage process. I'm sorry I didn't realize this before. You must first check the "Attempt to manage unmanged" check box for an app, save the new settings, and then a link will appear under Status that says "Change to managed". Once you click on that and wait a minute for the devices to update, Meraki should take over management for that app.

For #3 - the Meraki Profile password seems to work okay on my end. When I go into Settings -> General -> Device Management and attempt to Remove Management it prompts for the profile passcode. Or are you talking about the Meraki app? If it's ever deleted you can just re-push the app from the client dashboard. The device remains managed by Meraki even if the app is removed.

The only thing DEP really does for you is automate enrollment/re-enrollment. Since automated re-enrollment prevents you from installing whatever specialized blueprint you've created, there's no point in using DEP at all. It's just going to dump a profile onto your device that you don't want in the first place. We just leave it off for our environment and use the QR Code for manual enrollment per device. As far as I can tell there is no 'reversion' solution no matter how you slice it. You'll always have to restore devices from a cart or direct iPad-to-Mac connection to get it back to the original state you want it in. Yes - this totally ***** for what you, me and many others who want better device management. Makes me wish for an iPad equivalent of Deep Freeze.

samachee

Level 1

9 points

Mar 14, 2016 7:12 AM in response to ccsdtech

Can i create a "restore" blueprint for the teachers ipads using the same macbook or will that mess up the blueprints and profiles.

ccsdtech

Level 1

5 points

Mar 14, 2016 7:19 AM in response to samachee

You should be able to make as many different restore blueprints as necessary on the same Macbook without running into any issues... student, teacher, or otherwise.

samachee

Level 1

9 points

Mar 14, 2016 7:19 AM in response to TrevorWWW

So If i have a backup for students and a backup for teachers...i would need two different macbooks?

ccsdtech

Level 1

5 points

Mar 14, 2016 7:23 AM in response to samachee

No, you can create multiple backups using the same Macbook. You would then create several different restore blueprints and each of those blueprints would apply a different backup. Basically, you would repeat my step 8 as many times as needed for as many different backups as you have. Hope this helps.

samachee

Level 1

9 points

Mar 14, 2016 7:38 AM in response to ccsdtech

thanks for the help...when AC2 is done, is it ok to disconnect the usb cable even though the loading symbol is there?

ccsdtech

Level 1

5 points

Mar 14, 2016 8:11 AM in response to samachee

It's probably okay, but I usually let it go until those are all complete just to play it safe. I think that's just indicating that it's still refreshing the data from those iPads to determine their status.

Mar 14, 2016 9:18 AM in response to samachee

Speaking from experience, just be sure to create your multiple backups from different iPads. Don't try to use the same device to create different backups. A second backup of the same device will overwrite the first one.

iyoda

Level 1

0 points

Mar 15, 2016 6:37 AM in response to TrevorWWW

My question is, why i 'm losing my iPads names when i restore them? I try different setting but my 20 iPad finish with the same name: iPad.

ccsdtech

Level 1

5 points

Mar 15, 2016 7:08 AM in response to iyoda

It seems all of the iPads are renamed to the name the backed-up iPad had, unfortunately. I do wish there was a way to maintain the device names the way Apple Configurator 1 worked!

Mar 27, 2016 4:58 AM in response to weinsteinbevit

Thanks so much for the detailed post, has been extremely beneficial!

One note around DEP, I work in a school where we have school owned iPads and the advantage of DEP is that it prevents the MDM profile from being deleted. That said, I followed these steps but skipped steps 3 and 4 in the deployment step and it did work for a DEP enabled device. Now all of our iPads actually have DEP, and I'm not sure if this made a difference, but the Master Backup was actually from an iPad without DEP.

We're also using Meraki but the legacy version which is free for unlimited users but also lacks some of the new features, such as device based app distribution, which would greatly help us avoid using Apple IDs for these shared iPads. That's another topic I guess to explore.

Thanks again

Mar 31, 2016 6:43 PM in response to wheelspinning

@wheelspinning

That's potentially very interesting! So are you saying you've enrolled the iPads with Meraki and got them supervised and on the DEP so the Meraki profile can't be removed?

Or are they just unsupervised?

Apr 1, 2016 7:59 AM in response to wheelspinning

@wheelspinning

Assigning a passcode to the Meraki profile prevents it from being deleted (at least that's worked for us but it may be a feature in the newer version of Meraki). I will have to test your method to see how it works - I have a new set of iPads to run through it anyway and will give it a go.

Good info!