Configuring a computing device using managed operating system images

Patent metadata

Field	Value
Publication number	US-11709684-B2
Application number	US-202016987876-A
Country	US
Kind code	B2
Filing date	Aug 7, 2020
Priority date	Mar 22, 2017
Publication date	Jul 25, 2023
Grant date	Jul 25, 2023

Abstract

Systems and methods are included for causing a computing device to assemble and boot from a managed operating system. When the computing device is powered on, it can execute firmware that specifies a server to contact. The server can identify an operating system (OS) to boot, and the location of a pre-enrollment installer for assembling the OS image. The pre-enrollment installer can download base OS images in one or more pieces from multiple locations determined based on ownership information of the computing device. The multiple OS images can relate to enterprise management and company-specific applications and drivers. Once the pre-enrollment installer has combined the base OS images, the computing device reboots using the combined OS image.

First claim

What is claimed is:

1. A computing device that assembles a managed operating system (OS) image during initial boot, comprising:
a non-transitory, computer-readable medium containing instructions; and
at least one processor that executes the instructions to perform stages comprising:
prior to booting an OS, executing firmware that causes the computing device to contact a status server to determine a management status of the computing device;
receiving, by a pre-enrollment installer, identification of a first OS image that includes management functionality for communicating with a management server that enforces management policies, wherein the first OS image is identified based on ownership information of the computing device;
creating a combined OS image by combining the first OS image with a second OS image; and
booting the combined OS image, wherein the management policies are enforced during boot, including:
sending compliance information to the management server for determining whether compliance rules of an enterprise mobility management (“EMM”) system are met, wherein the compliance rules control access to the computing device;
completing enrollment of the computing device in the EMM system as part of the booting; and
receiving a command to disable specific functionality of the computing device from the management server.

2. The computing device of claim 1 , the stages further comprising:
in an instance when the management status indicates the computing device is managed, downloading the pre-enrollment installer from a first address specified by the server,
wherein the pre-enrollment installer creates the combined OS image and boots the computing device.

3. The computing device of claim 1 , wherein the pre-enrollment installer sends the ownership information of the computing device to the management server, and wherein the management server uses the ownership information to identify the first OS image from among a plurality of OS images with different management functionality.

4. The computing device of claim 3 , wherein the pre-enrollment installer downloads the first OS image by contacting an address received from the management server.

5. The computing device of claim 1 , wherein the first OS image includes a management agent to enforce the management policies subsequent to booting the combined OS image and prior to a user logging into the computing device during the boot.

6. The computing device of claim 1 , the stages further comprising:
downloading the second OS image from a second address specified by the management server based on the ownership information of the computing device.

7. The computing device of claim 1 , wherein the second OS image is retrieved from a hidden partition of the computing device, and wherein the first OS image includes a management agent for enforcing the management policies.

8. A method for assembling a managed operating system (OS) image during initial boot, comprising:
prior to booting an OS, executing firmware that causes a computing device to contact a status server to determine a management status of the computing device;
receiving, by a pre-enrollment installer, identification of a first OS image that includes management functionality for communicating with a management server that enforces management policies, wherein the first OS image is identified based on ownership information of the computing device;
creating a combined OS image by combining the first OS image with a second OS image; and
booting the combined OS image, wherein the management policies are enforced during boot, including:
sending compliance information to the management server for determining whether compliance rules of an enterprise mobility management (“EMM”) system are met, wherein the compliance rules control access to the computing device;
completing device enrollment of the computing device in the EMM system as part of the booting; and
receiving a command to disable specific functionality of the computing device from the management server.

9. The method of claim 8 , further comprising:
in an instance when the management status indicates the computing device is managed, downloading the pre-enrollment installer from a first address specified by the server,
wherein the pre-enrollment installer creates the combined OS image and boots the computing device.

10. The method of claim 8 , wherein the pre-enrollment installer sends the ownership information of the computing device to the management server, and wherein the management server uses the ownership information to identify the first OS image from among a plurality of OS images with different management functionality.

11. The method of claim 10 , wherein the pre-enrollment installer downloads the first OS image by contacting an address received from the management server.

12. The method of claim 8 , wherein the first OS image includes a management agent to enforce the management policies subsequent to booting the combined OS image and prior to a user logging into the computing device during the boot.

13. The method of claim 8 , further comprising:
downloading the second OS image from a second address specified by the management server based on the ownership information of the computing device.

14. The method of claim 8 , wherein the second OS image is retrieved from a hidden partition of the computing device, and wherein the first OS image includes a management agent for enforcing the management policies.

15. A non-transitory, computer-readable medium containing instructions for assembling a managed operating system (OS) image during initial boot, the instructions being executed by a processor of a computing device to perform stages comprising:
prior to booting an OS, executing firmware that causes the computing device to contact a status server to determine a management status of the computing device;
receiving, by a pre-enrollment installer, identification of a first OS image that includes management functionality for communicating with a management server that enforces management policies, wherein the first OS image is identified based on ownership information of the computing device;
creating a combined OS image by combining the first OS image with a second OS image; and
booting the combined OS image, wherein the management policies are enforced during boot, including:
sending compliance information to the management server for determining whether compliance rules of an enterprise mobility management (“EMM”) system are met, wherein the compliance rules control access to the computing device;
completing device enrollment of the computing device in the EMM system as part of the booting; and
receiving a command to disable specific functionality of the computing device from the management server.

16. The non-transitory, computer-readable medium of claim 15 , the stages further comprising:
in an instance when the management status indicates the computing device is managed, downloading the pre-enrollment installer from a first address specified by the server,
wherein the pre-enrollment installer creates the combined OS image and boots the computing device.

17. The non-transitory, computer-readable medium of claim 15 , wherein the pre-enrollment installer sends the ownership information of the computing device to the management server, and wherein the management server uses the ownership information to identify the first OS image from among a plurality of OS images with different management functionality.

18. The non-transitory, computer-readable me

Assignees

• Vmware Inc

Inventors

• Roszak Jason
• Newell Craig
• Shantharam Shravan
• Murthy Varun
• Regula Kalyan
• Watts Blake

Classifications

• G06F9/4416 Primary

  Network booting; Remote initial program loading [RIPL] · CPC title

• G06F9/4406

  Loading of operating system · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title