Shared Mac Configuration Guide for Shared Mac/Lab Administrators

This guide outlines the workflow and ongoing maintenance requirements for university-owned Macs configured for shared or multi-user environments (such as computer labs, classrooms, or department kiosks). 

Because these machines are utilized by multiple individuals, they follow a specialized deployment profile designed for high availability and dynamic user provisioning. 
 
CRITICAL – Network & Login Requirements 

Unlike 1:1 devices, shared Macs rely on Jamf Connect permanently at the login window to authenticate users against the university identity provider in real-time. 

• Network Dependency: Because Jamf Connect must validate credentials against Microsoft Azure on every login, these machines must have a persistent network connection. 

• Supported Networks: Shared Macs must be connected via Wired Ethernet or the USM Limited wireless network. 

• Eduroam Restriction: Jamf Connect does not support eduroam at the login window. If a shared device loses its connection to Ethernet or USM Limited, users will not be able to log in.  

Step 1: Initial Apple Setup Assistant – To Be Completed by Lab Admin / iTech 

1. Turn on the Mac. Choose your Language and Region. 

2. Connect to a compatible network (see requirements above). 

3. A Device/Remote Management screen will appear stating that the University of Southern Mississippi can automatically configure your computer. Click Enroll.
   
   

Step 2: Login via Jamf Connect 

1. The standard Mac account creation screen will be replaced by a university-branded Microsoft Sign-In window.
   
   

2. Log in using your primary Microsoft credentials: wID@usm.edu and your password. 
   Jamf Connect will securely authenticate your identity and automatically create your local macOS user account matching your university credentials. 

Step 3: Post-Enrollment & Asset Tracking 

Once your desktop loads, Jamf Pro will begin processing campus policies in the background. Please complete the following prompts as they appear: 

1. Asset Tag Prompt: A dialog box will appear asking for the six-digit USM asset number. IMPORTANT: Enter numbers only.  

   

2. Keychain Access Prompt: A macOS system prompt will appear asking for permission for Self Service + to access your keychain. 
   Action Required: Enter your university Microsoft password and click Always Allow. 

   
   CRITICAL: You must select Always Allow. If you select "Allow" or "Deny," this prompt will continuously reappear and interrupt your work.

Setup Workflow: Shared vs. 1:1 Configuration 

When setting up a brand-new or freshly reloaded shared Mac, you will proceed through Apple's out-of-box Setup Assistant. Here is what is identical to a 1:1 setup, and exactly where the workflow diverges: 

End-User Experience: How It Works 

1. The Login Window: Users will always be greeted by a university-branded Microsoft Sign-In window (Jamf Connect), rather than the standard macOS login screen. 

2. Account Provisioning: A user logs in using their standard university credentials: wID@usm.edu and password. 

3. On-the-Fly Profiling: Jamf Connect securely verifies the credentials and dynamically creates a local standard user profile on the Mac. When the user logs out, their profile remains cached on the machine for quick access if they return. 

Security Note: FileVault disk encryption is explicitly disabled on Shared Mac configurations to ensure seamless multi-user reboots and automated maintenance tasks. 

Maintenance & Disk Space Management (For Lab Administrators & iTech) 

Because Jamf Connect creates a new local home directory for every unique user who logs in, local profiles will accumulate over time. Over the course of a semester, a high-traffic lab computer can easily run out of disk space due to cached user data. 

To prevent performance degradation, lab environments must be cleaned up regularly using one of the two authorized methods: 

Method 1: The Self Service+ Profile Purge Tools 

An iTech-developed maintenance script is scoped directly to these machines and is available in Self Service+ upon request. 

• Who runs it: The designated Lab Administrator or an iTech technician. 

• When to run it: At the end of every semester (Fall, Spring, and Summer). 

How to execute: Open the Self Service+ application, navigate to the Tools and Utilities category, and run the two profile cleanup utilities in sequence: Unmigrate Network User Accounts, followed by Remove Network User Accounts. 

Critical Data Warning: These tools completely erase all local user profiles and cached user data to free up disk space (while leaving core system applications and university configurations untouched). Only run these utilities at the end of the semester once you are certain students and faculty no longer need access to any data locally saved on the machine. Running them mid-semester will result in permanent data loss for your users. 

Method 2: System Reload / Re-imaging 

For heavy-use environments or labs requiring a completely pristine baseline before a new academic term: 

• Submit a service request to the iTech Help Desk at the end of the semester to schedule a bulk automated wipe and reload of the lab hardware via Automated Device Enrollment (ADE).