mdmctl Command Reference - micromdm/micromdm GitHub Wiki

mdmctl Command Reference

sub-command description
get Display one or many resources
apply Apply a resource
config Display or set configuration
remove Remove a resource
mdmcert Create new MDM Push Certificate
mdmcert.download Request new MDM Push Certificate from https://mdmcert.download
version Display mdmctl version

get

Display one or many resources


Valid resource types:

devices
USAGE
  mdmctl get devices [flags]

FLAGS
  -serials   comma seperated list of serials to search

blueprints
USAGE
  mdmctl get blueprints [flags]

FLAGS
  -f -    filename of JSON to save to
  -name   name of blueprint

dep-tokens
USAGE
  mdmctl get dep-tokens [flags]

FLAGS
  -export-public-key mdm-files/DEPPublicKey   Filename of public key to write (to be uploaded to deploy.apple.com)
  -export-token mdm-files/DEPOAuthToken.json  Filename to save decrypted oauth token (JSON)
  -v false                                    Display full ConsumerKey in summary list

dep-devices
USAGE
  mdmctl get dep-devices [flags]

FLAGS
  -serials   comma separated list of device serials

dep-account
USAGE
  mdmctl get dep-account [flags]

FLAGS

dep-profiles
USAGE
  mdmctl get dep-profiles [flags]

FLAGS
  -f      filename of DEP profile to apply
  -uuid   DEP Profile UUID(required)

dep-autoassigner
USAGE
  mdmctl get dep-autoassigner [flags]

FLAGS

users
USAGE
  mdmctl get users [flags]

FLAGS

profiles
USAGE
  mdmctl get blueprints [flags]

FLAGS
  -f -  filename of profile to write
  -id   profile Identifier

apps
USAGE
  mdmctl get apps [flags]

FLAGS
  -f -    path to save file to. defaults to stdout.
  -name   specify the name of the app to get full details

apply

Apply a resource


Valid resource types:

blueprints
USAGE
  mdmctl apply blueprints [flags]

FLAGS
  -f               filename of blueprint JSON to apply
  -template false  print a new blueprint template

profiles
USAGE
  mdmctl apply profiles [flags]

FLAGS
  -f   filename of profile to apply

users
USAGE
  mdmctl apply users [flags]

FLAGS
  -f               Path to user manifest
  -password        Password of the user. Only required when creating a new user.
  -template false  Print a JSON example of a user manifest.

dep-tokens
USAGE
  mdmctl apply dep-tokens [flags]

FLAGS
  -import mdm-files/DEPOAuthToken.json  Filename of p7m encrypted token file (downloaded from DEP portal)

dep-profiles
USAGE
  mdmctl apply dep-profiles [flags]

FLAGS
  -anchor                 filename of PEM cert(s) to add to anchor certs in template
  -f                      filename of DEP profile to apply
  -filter                 set the auto-assign filter to for the defined profile
  -template false         print a JSON example of a DEP profile
  -use-server-cert false  use the server cert(s) to add to anchor certs in template

dep-autoassigner
USAGE
  mdmctl apply dep-autoassigner [flags]

FLAGS
  -filter *  filter string (only '*' supported right now)
  -uuid      DEP profile UUID to set

app
USAGE
  mdmctl apply app [flags]

FLAGS
  -manifest -        path to an app manifest. optional,
                     will be created if file does not exist.
  -md5size 10485760  md5 hash size in bytes (optional)
  -pkg               path to a distribution pkg.
  -pkg-url           use custom pkg url
  -sign              sign package before importing, requires specifying a product ID (optional)
  -upload false      upload package and/or manifest to micromdm repository.

block
USAGE
  mdmctl apply block [flags]

FLAGS
  -udid   UDID of a device to block.

config

Display or set configuration


Valid switches:

print

Display current configuration

USAGE
  mdmctl config print

set
USAGE
  mdmctl config set [flags]

FLAGS
  -api-token          api token to connect to micromdm server
  -name               name of the server
  -server-url         server url of micromdm server
  -skip-verify false  skip verification of server certificate (insecure)

switch
USAGE
  mdmctl config switch [flags]

FLAGS
  -name   name of the server to switch to

remove

Remove a resource


Valid resource types:

blueprints
USAGE
  mdmctl remove blueprints [flags]

FLAGS
  -name   name of blueprint, optionally comma separated

devices
USAGE
  mdmctl remove devices [flags]

FLAGS
  -udid   device UDID, optionally comma separated

profiles
USAGE
  mdmctl remove profiles [flags]

FLAGS
  -id   profile Identifier, optionally comma separated

block
USAGE
  mdmctl remove block [flags]

FLAGS
  -udid   UDID of device to unblock

dep-autoassigner
USAGE
  mdmctl remove dep-autoassigner [flags]

FLAGS
  -filter *  filter string (only '*' supported right now)

mdmcert

Create new MDM Push Certificate


This utility helps obtain a MDM Push Certificate using the Apple Developer MDM CSR option in the enterprise developer portal.

Valid switches:

vendor
USAGE
    mdmctl mdmcert vendor [flags]

FLAGS
    -cert mdm-certificates/mdm.cer                         Path to the MDM Vendor certificate from dev portal.
    -cn micromdm-vendor                                    CommonName for the CSR Subject.
    -country US                                            Two letter country code for the CSR Subject(example: US).
    -email                                                 Email address to use in CSR Subject.
    -out mdm-certificates/VendorCertificateRequest.csr     Path to save the MDM Vendor CSR.
    -password                                              Password to encrypt/read the RSA key.
    -private-key mdm-certificates/VendorPrivateKey.key     Path to the vendor private key. A new RSA key will be created at this path.
    -push-csr mdm-certificates/PushCertificateRequest.csr  Path to the user CSR(required for the -sign step).
    -sign false                                            Signs a user CSR with the MDM vendor certificate.

push
USAGE
    mdmctl mdmcert push [flags]

FLAGS
    -cn micromdm-user                                            CommonName for the CSR Subject.
    -country US                                                  Two letter country code for the CSR Subject(Example: US).
    -email                                                       Email address to use in CSR Subject.
    -out mdm-certificates/PushCertificateRequest.csr             Path to save the MDM Push Certificate request.
    -password                                                    Password to encrypt/read the RSA key.
    -private-key mdm-certificates/PushCertificatePrivateKey.key  Path to the push certificate private key. A new RSA key will be created at this path.

upload
USAGE
    mdmctl mdmcert upload [flags]

FLAGS
    -cert                                                        Path to the MDM Push Certificate.
    -password                                                    Password to encrypt/read the RSA key.
    -private-key mdm-certificates/PushCertificatePrivateKey.key  Path to the push certificate private key.

First you must create a vendor CSR which you will upload to the enterprise developer portal and get a signed MDM Vendor certificate. Use the MDM-CSR option in the dev portal when creating the certificate. The MDM Vendor certificate is required in order to obtain the MDM push certificate. After you complete the MDM-CSR step, copy the downloaded file to the same folder as the private key. By default this will be mdm-certificates

mdmctl mdmcert vendor -password=secret -country=US [email protected]

Next, create a push CSR. This step generates a CSR required to get a signed a push certificate.

mdmctl mdmcert push -password=secret -country=US [email protected]

Once you created the push CSR, you mush sign the push CSR with the MDM Vendor Certificate, and get a push certificate request file.

mdmctl mdmcert vendor -sign -cert=./mdm-certificates/mdm.cer -password=secret

Once generated, upload the PushCertificateRequest.plist file to https://identity.apple.com to obtain your MDM Push Certificate. Use the push private key and the push cert you got from identity.apple.com in your MDM server.

mdmcert.download

Request new MDM Push Certificate from https://mdmcert.download

USAGE
  mdmctl mdmcert.download [flags]

FLAGS
  -cn mdm-push                                 CommonName for the CSR Subject.
  -country US                                  Two letter country code for the CSR Subject (example: US).
  -decrypt                                     Decrypts and mdmcert.download push certificate request
  -email                                       Email address to use in mdmcert request & CSR Subject
  -new false                                   Generates a new privkey and uploads new MDM request
  -pki-cert mdmcert.download.pki.crt           Path for generated MDMCert pki exchange certificate
  -pki-password                                Password to encrypt/read the RSA key.
  -pki-private-key mdmcert.download.pki.key    Path for generated MDMCert pki exchange private key
  -push-csr mdmcert.download.push.csr          Path for generated Push Certificate CSR
  -push-password                               Password to encrypt/read the push RSA key.
  -push-private-key mdmcert.download.push.key  Path to the generated Push Cert private key
  -push-req mdmcert.download.push.req          Path for generated Push Certificate Request

version

Display mdmctl version

USAGE
  mdmctl version
Add a custom footer
⚠️ **GitHub.com Fallback** ⚠️