code signing for enterprise mac app deployment

Code Signing For Enterprise App Deployment Update Publishing That

These sites typically require an enterprise subscription to Apples iOS Developer Program.

This may be done with either the iPhone Configuration Utility or with most Mobile Device Management systems.

So here is what will happen: MDM will install both profile and app, but then the app will seem to disappear.

The system is simply hiding the app because it is not aware of the provisioning profile.

Script Execution returned error message:: AuthorizationManager check failed.

The most common reason applications may fail during a task sequence is the code-signing certificate isnt properly deployed ahead of the Install Applications task sequence step.

Topics covered in this article: A Little Background Our Applications and PowerShell Detection Method Determine if You are Affected The Resolution Install WSUS Signing Certificate as a Task Sequence Step A Little Background Our Applications and PowerShell Detection Method When our service creates applications in SCCM, we use a Powershell script for the detection method of the deployment type, as shown below.

Determine if You are Affected When the device gets to the install application step, the device may fail to execute the detection method script if you are using a self-signed WSUS Signing certificate and the Powershell execution policy is not ByPass.

If the detection method script fails, its because the WSUS Signing certificate used to code-sign it isnt trusted during the operating system deployment on the client-side.

This trust failure is due to the fact that the device wouldnt have received group policy or the client policy if you are deploying the certificate using SCCM to add the certificate to the Trusted Root and Trusted Publishers certificate stores.

In the C:WindowsCCMLogs AppDiscovery.log, you will also be able to see the failure when the SCCM agent tries to call the detection method script.

The Resolution Install WSUS Signing Certificate as a Task Sequence Step Now that we see the cause, the resolution is pretty straight forward.

Code Signing For Enterprise App Deployment Update Publishing That

You need to ensure the WSUS Signing Certificate you are using for third-party update publishing that is also used for signing the scripts is trusted before the install application step in SCCM.

The first thing to do is export your WSUS Signing Certificate from the publishing service.

In our example, we saved the file as WSUSSigningCertificate.cer Now that you have the certificate used for signing the detection method scripts, we need to import it on the client-side during the task sequence before the install applications step.

First, you can download our script Import-Certificates.cmd that can be used for importing (.CER) files into the Trusted Root and Trusted Publishers.

You will want to save the Import-Certificates.cmd file in the same UNC folder as the exported (.CER) file.

It will import all (.CER) certificates that are in the same folder as the script to the Trusted Root and Trusted Publishers certificate store.

The REG ADD command on line 5 is optional, but it can be helpful if you want to also install third-party software updates using the Install Software Updates step in the same task sequence.

Next, you need to create a legacy package in SCCM (No programs required if you only want to install the certificates via task sequence).

If youre going to deploy this using software distribution to existing clients outside a task sequence, you can create a new program for the package the runs Import-Certificates.cmd as the command line.

When creating the package, use the UNC path that you saved your (.CER) certificate to as well as the Import-Certificates.cmd.

In our example, we used the path mentioned above.

This package is used for accessing the content in the task sequence.

Within this step, be sure to set the command line to Import-Certificates.cmd and enable the Package option and reference the package you created in the previous step.

Thats it Now that the certificate chain is trusted before the Install Applications step, you shouldnt receive the trust error when the detection method script is executed.

Note: This process can also resolve the error 0x800b0109 during the Install Software Updates step of a task sequence because the default certificate deployment options such as group policy or ConfigMgr client settings wont apply until after the task sequence is completed.

Search Terms: In-line script returned error output:: AuthorizationManager check failed.

Code Signing For Enterprise Mac App Deployment