Device provisioning with manufacturer boot environment
Disclosed are various examples for persistent device provisioning. In some examples, a management agent is executed from the manufacturer boot environment. The management agent determines that a main operating system of the client device is currently unprovisioned for management by the management service. The management agent installs a management application that is executable in the main operating system. The client device boots to the main operating system and executes the management application. The management application enrolls the client device with the management service by installing an enrollment token received from the management service.
1. A system comprising:
a client device; and
a memory comprising executable instructions, wherein the instructions, when executed by a processor, cause the client device to at least:
determine, by a manufacturer boot environment, that the client device is required to be provisioned for management by a management service, wherein the manufacturer boot environment determines that the client device is required to be provisioned based on a provisioning requirement BIOS variable of the client device;
execute a management agent from the manufacturer boot environment;
determine, by the management agent, that a main operating system of the client device is currently unprovisioned for management by the management service;
install, by the management agent, a management application that is executable in the main operating system;
boot the client device to the main operating system and execute the management application; and
enroll, by the management application, the client device with the management service by installing an enrollment token received from the management service.
2. The system of claim 1 , wherein the management application enrolls the client device with the management service during an out-of-box experience of the client device.
3. The system of claim 1 , wherein the manufacturer boot environment downloads at least one of the management agent and the management component.
4. The system of claim 1 , wherein the management agent determines that the client device is currently unprovisioned based on a provisioning status BIOS variable of the client device.
5. The system of claim 1 , wherein the instructions, when executed by the processor, further cause the client device to at least:
transmit, by the management agent, provisioning telemetry to the management service, the provisioning telemetry comprising at least one of: a client device model identification, a manufacturer boot environment identification, a main operating system identification, a management application identification, a total provisioning time, and a provisioning result identification.
6. The system of claim 1 , wherein the instructions, when executed by the processor, further cause the client device to at least:
retrieve, from the management service, current version data for a current version of the management application;
determine, based on the current version data, that a local version of the management application differs from the current version of the management application;
retrieve, from the management service, the current version of the management application; and
install the current version of the management application.
7. The system of claim 6 , wherein the instructions, when executed by the processor, further cause the client device to at least:
retrieve, from the management service, local version data for the local version of the management application, wherein the local version data is compared to the current version data to determine that the local version of the management application differs from the current version of the management application.
8. A method for web application security through containerization, the method comprising:
determining, by a manufacturer boot environment, that a client device is required to be provisioned for management by a management service, wherein the manufacturer boot environment determines that the client device is required to be provisioned based on a provisioning requirement BIOS variable of the client device;
executing a management agent from the manufacturer boot environment;
determining, by the management agent, that a main operating system of the client device is currently unprovisioned for management by the management service;
installing, by the management agent, a management application that is executable in the main operating system;
booting the client device to the main operating system and execute the management application; and
enrolling, by the management application, the client device with the management service by installing an enrollment token received from the management service.
9. The method of claim 8 , wherein the management application enrolls the client device with the management service during an out-of-box experience of the client device.
10. The method of claim 8 , wherein the manufacturer boot environment downloads at least one of the management agent and the management component.
11. The method of claim 8 , wherein the management agent determines that the client device is currently unprovisioned based on a provisioning status BIOS variable of the client device.
12. The method of claim 8 , further comprising:
transmitting, by the management agent, provisioning telemetry to the management service, the provisioning telemetry comprising at least one of: a client device model identification, a manufacturer boot environment identification, a main operating system identification, a management application identification, a total provisioning time, and a provisioning result identification.
13. The method of claim 8 , further comprising:
retrieving, from the management service, current version data for a current version of the management application;
determining, based on the current version data, that a local version of the management application differs from the current version of the management application;
retrieving, from the management service, the current version of the management application; and
installing the current version of the management application.
14. The method of claim 13 , further comprising:
retrieving, from the management service, local version data for the local version of the management application, wherein the local version data is compared to the current version data to determine that the local version of the management application differs from the current version of the management application.
15. A non-transitory computer-readable medium embodying executable instructions, wherein the instructions, when executed by a processor, cause a client device to at least:
determine, by a manufacturer boot environment, that the client device is required to be provisioned for management by a management service;
execute a management agent from the manufacturer boot environment;
determine, by the management agent, that a main operating system of the client device is currently unprovisioned for management by the management service, wherein the management agent determines that the client device is currently unprovisioned based on a provisioning status BIOS variable of the client device;
install, by the management agent, a management application that is executable in the main operating system;
boot the client device to the main operating system and execute the management application; and
enroll, by the management application, the client device with the management service by installing an enrollment token received from the management service.
16. The non-transitory computer-readable medium of claim 15 , wherein the management application enrolls the client device with the management service during an out-of-box experience of the client device.
17. The non-transitory computer-readable medium of claim 15 , wherein the manufacturer boot environment determines that the client device is required to be provisioned based on a provisioning requirement BIOS variable of the client device.
18. The non-transitory computer-readable medium of claim 15 , wherein the manufacturer boot environment downloads at least one of the management agent and the management component.
19. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the processor, further cause the client device to at least:
transmit, by the management agent, provisioning telemetry to the management service, the provisioning telemetry comprising at least one of: a client device model identification, a manufacturer boot environment identification, a main operating system identification, a management application identification, a total provisioning time, and a provisioning result identification.
20. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the processor, further cause the client device to at least:
retrieve, from the management service, current version data for a current version of the management application;
determine, based on the current version data, that a local version of the management application differs from the current version of the management application;
retrieve, from the management service, the current version of the management application; and
install the current version of the management application.