Persistent enrollment of a computing device based on a temporary user
Systems and methods are included for causing a computing device to implement a management policy prior to a user logging into an operating system on initial boot. As part of initial boot, the computing device contacts a management server for enrollment. Installation of the operating system is paused while the management server synchronizes the software and policies on the computing device. To do this prior to login, the management server can create a temporary user account to associate with the computing device and apply a default management policy. After the installation is complete, an installed management agent can gather user inputs made during login. The management agent can send these inputs to the management server for use in creating an actual user account to associate with the computing device.
1. A method for enrolling a computing device with a management server prior to a user initially logging into the computing device, comprising:
during initial boot, executing firmware to generate an enroller, the enroller creating a temporary user account in a WINDOWS operating system, the temporary user account enabling interaction with the operating system;
blocking the operating system from allowing user login;
requesting enrollment with a management server based on the temporary user account, wherein enrollment causes the computing device to enforce management policies defined at the management server;
unblocking the operating system after the enrollment is complete; and
deleting the temporary user account.
2. The method of claim 1 , further comprising:
receiving an update to the enroller from the management server, the update altering functionality related to creation of the temporary user account.
3. The method of claim 1 , wherein creating the temporary user account includes providing account information in an XML file that WINDOWS executes during the initial boot.
4. The method of claim 1 , further comprising displaying graphics to notify a user that enrollment is occurring prior to unblocking the operating system.
5. The method of claim 1 , further comprising:
receiving login information from a user after unblocking the operating system;
deleting the enroller; and
reporting the login information to the management server.
6. The method of claim 5 , wherein the management server associates the enrolled user device with a user account based on the login information.
7. The method of claim 5 , further comprising downloading a management agent from the management server, the management agent enforcing the management policies defined at the management server, wherein the management agent reports the login information to the management server.
8. The method of claim 1 , wherein the enroller blocks login by pausing a binary that is part of a boot process for the operating system.
9. A computing device that enrolls with a management server during initial boot based on a temporary user account, comprising:
a non-transitory, computer-readable medium containing instructions;
a processor that executes the instructions to perform stages comprising:
during initial boot, executing firmware to generate an enroller, the enroller creating the temporary user account in a WINDOWS operating system, the temporary user account enabling interaction with the operating system;
blocking the operating system from allowing user login;
requesting enrollment with a management server based on the temporary user account, wherein enrollment causes the computing device to enforce management policies defined at the management server;
unblocking the operating system after the enrollment is complete; and
deleting the temporary user account.
10. The computing device of claim 9 , the stages further comprising:
receiving an update to the enroller from the management server, the update altering functionality related to creation of the temporary user account.
11. The computing device of claim 9 , wherein creating the temporary user account includes providing account information in an XML file that WINDOWS executes during the initial boot.
12. The computing device of claim 9 , the stages further comprising displaying graphics to notify a user that enrollment is occurring prior to unblocking the operating system.
13. The computing device of claim 9 , the stages further comprising:
receiving login information from a user after unblocking the operating system;
deleting the enroller; and
reporting the login information to the management server.
14. The computing device of claim 13 , wherein the management server associates the enrolled user device with a user account based on the login information.
15. The computing device of claim 13 , the stages further comprising downloading a management agent from the management server, the management agent enforcing the management policies defined at the management server, wherein the management agent reports the login information to the management server.
16. A non-transitory, computer-readable medium containing instructions for enrollment on initial boot based on a temporary user account, the instructions causing a processor to perform stages comprising:
during initial boot, executing firmware to generate an enroller, the enroller creating the temporary user account in a WINDOWS operating system, the temporary user account enabling interaction with the operating system;
blocking the operating system from allowing user login;
requesting enrollment with a management server based on the temporary user account, wherein enrollment causes the computing device to enforce management policies defined at the management server;
unblocking the operating system after the enrollment is complete; and
deleting the temporary user account.
17. The non-transitory, computer-readable medium of claim 16 , the stages further comprising:
receiving an update to the enroller from the management server, the update altering functionality related to creation of the temporary user account.
18. The non-transitory, computer-readable medium of claim 16 , wherein creating the temporary user account includes providing account information in an XML file that WINDOWS executes during the initial boot.
19. The non-transitory, computer-readable medium of claim 16 , the stages further comprising displaying graphics to notify a user that enrollment is occurring prior to unblocking the operating system.
20. The non-transitory, computer-readable medium of claim 16 , the stages further comprising:
receiving login information from a user after unblocking the operating system;
deleting the enroller; and
reporting the login information to the management server.