Building NetRestore Images

Last updated 2016/03/22

Return to the Suffield Academy Network Documentation Homepage

A printable version of this document is also available.


We repair and set up hundreds of machines each year at Suffield Academy. To help us with this process, we have set up several pre-made system images that we use to reformat computers. Each image contains an operating system and common applications.

This document describes how to build a new image for computers running Mac OS X. It is intended for someone who has experience installing applications on Macs, and who has a general familiarity with the applications used at Suffield. No system administration experience is necessary.

Note: this document describes how to create images that will be installed on user machines (erasing and replacing whatever is there). We also use a special rescue image for booting machines and running diagnostics. If you need to know how to create a rescue image, please see our NetBoot documentation on rescue image creation.


When building an image, always start with a clean machine. If possible, restore the computer using the restore CDs (or DVD) that came with it. Otherwise, erase the hard drive and perform a full install of the operating system from installation media.

Use the newest model of computer available when you build your image. Try to find one with as many "extra" features in it (such as DVD burners, large screens, etc). Images built on the best machines tend to work well on all other machines. Images built on "average" machines, however, do not tend to work well on better machines.

Preparing the Operating System

Initial Setup

We're assuming that you're starting with a machine that has a fresh install of the OS on it. The Apple Registration program should launch on start, and ask you the basic configuration questions.

Register the computer to Suffield Academy, and provide the school's address and phone number for the registration form.

When asked to create a user account, use Suffield Academy as the name, and suffieldacademy as the short name. Use the proper master password for shared machines. If you do not know which password to use, consult the Network Administrator.

Continue through the rest of the setup program, setting up the network, date and time, and other settings.

When you're done with the registration program, the computer should boot to a default desktop, and be ready to use.

Boot Images

Suffield uses a custom background picture so we can tell which computers have been restored with our system image. These images reside on our file server. To get them, connect to the fileserver and mount the Installers partition. Then, open the Fun, Screen Backgrounds, and Suffield folders, which will get you to the pictures we need.

The folder contains a series of background images for use on the machines. Choose the one for the type of machine you're setting up. In general, Laptop Aqua Blue.jpg is the one we use. Copy it to your desktop.

This copies the default background. Open Terminal and type the following commands (when prompted, enter your administrative password):

cd /System/Library/CoreServices/
sudo cp -p DefaultDesktop.jpg DefaultDesktop_original.jpg
sudo cp ~/Desktop/Laptop\ Aqua\ Blue.jpg DefaultDesktop.jpg

When you're done, you may quit and remove the images from your desktop.

Software Updates

Run Software Updates on the computer until there are no updates left to run. This may require multiple installations and reboots.

Certificate Trust

Connect to the Installers and move into the Suffield Installers folder. Double-click the Suffield Academy Network Certificates file. Enter your administrator password if prompted.

Installing Applications

Suffield has licenses for several commonly-used applications, which we now distribute using Munki. The easiest thing is to install our custom Munki package on the image, and then let it install all the necessary software after the machine reboots.

You can mount our Munki package by running the following in the terminal:

hdiutil attach

You can install the software from there.

Final Preparations

Before building an image out of this computer, we need to make sure and "tidy up" any other aspects of the system.

Customize the Dock

Make sure the dock has all of our standard applications on it. You may wish to remove unused applications (such as Mail and Address Book) to create more space.

Hard Drive Cleanup

Look at the root level of the hard drive and delete any temporarly log files left over from the installation of software.

Reset Safari

Open Safari and choose Reset Safari... from the Safari menu. Check all the boxes and reset, then quit.

Building the Image

Netboot the master machine.

Start DeployStudio.

Choose the "Create master from hard drive" option.

If you've changed the image that is used automatically by our Workstation and Loaner workflows, edit those workflows to reference the new image.


We use DeployStudio to restore our images onto client computers. DS has many powerful features, including an easy workflow tool that allows you to create different client configurations from the same basic parts.

We set up several workflows, but they all follow the same basic recipe:

  1. Run our sa_ds_master script with bootstrap as its parameter, to initialize any custom variables for the rest of the workflow.

  2. Run a sub-workflow to image the machine. For workstation and loaner workflows, the sub-workflow should choose a default image without user interaction. For the unregistered workflow, the user should choose which base image to build from.

  3. Install any post-installation packages. For faculty images, this includes FileMaker (we have a custom package that rolls up the FileMaker installation and any patches).

  4. Bind to OpenDirectory. For workstation machines, we set a post-boot bind to our OpenDirectory server.

  5. Run Software Update, post-boot.

  6. Run /tmp/sa_ds_master, which is the serialized version of the script set up in step 1, with an argument of postinstall. This should be set for postponed execution so it runs on the client machine. See below for details on this script.

  7. Run /tmp/sa_ds_master, with an argument of reboot. The script looks at the workflow name and automatically reboots after install if the workflow contains the keyword "Auto".

sa_ds_master Script

The sa_ds_master script contains all the post-restore steps to set the machine up for different client types. We have different builds (loaners, workstations, unregistered), but they only differ in their settings, not in the software installed on them. The script does the work of removing admin accounts, changing passwords, disabling autologin, etc. so the machine is in the correct state.

You can find a copy of the script here: sa_ds_master


DeployStudio is the program we use to create master images, and to pave them back out on the machines.

The DeployStudio Wiki is also helpful for finding tips and sample scripts.