How-To With T2—Imaging Newer Mac Computers with the T2 Chip

Parallels® Mac Management for Microsoft® SCCM version 7.0 enhances the ability of the USB utility to boot a Mac to the Task Sequences and OSD images without the use of NetBoot®. Parallels Mac Management still uses NetBoot on the distribution point (DP) to handle images but not to boot. If you want to image from macOS® Mojave, you’ll need to upgrade to version 7.1 which has full support for macOS Mojave. 

Note: Apple® left macOS High Sierra 10.13 with a broken ASR process that builds images from macOS. It isn’t until macOS Mojave 10.14 that you can build images. Apple came out with T2 chips on 2017 iMac® and 2018 MacBook® Pro. Most recently, MacBook® Air and Mac mini all have T2 chips and effectively kill NetBoot. 

The latest release of Parallels Mac Management  is version 7.2. See our release notes for all the new features. The only way to image a Mac with a T2 chip set with Task Sequences and OSD images is with the Parallels Mac Management USB utility. 

If you want to deploy macOS High Sierra 10.13 you’ll need to build boot and restore images from macOS High Sierra 10.13.3 or older. You can then use WSUS to upgrade to macOS High Sierra 10.13.6, the highest patched version.

Workflow Overview:

Creating a Bootable USB Drive 

If for any reason you can’t use a network boot during OS deployment, you can create a bootable USB drive (flash drive or HDD) and boot each Mac computer from it. 

To create a bootable drive, download the Image Builder utility to the Mac: 

This utility allows you to create two kinds of bootable drives: 

To continue, open Terminal and change the directory to the PmmOsdImageBuilder.dmg image mount point (e.g. /Volumes/Parallels OSD Image Builder 7.0.xxxx.yyyyyy). To create a regular bootable drive, execute the following command in Terminal: 

$ sudo ./pmm_osd_image_builder usbboot -t /Volumes/<usb volume name>

After creating the bootable drive, leave the USB media in the USB port ready to use after you change the settings for Secure Boot–Booting a T2 Mac. Note: a NetBoot image must be captured from a T2 Mac running macOS Mojave. 

Booting a T2 Mac

Tip: Be sure you have set an Administrative local account on the Mac prior to going into Recovery Mode.

Secure Boot settings are available in the Startup Security Utility:

Boot into recovery and relax (nice way to say turn off) Secure Boot and Allow USB. If you don’t make the changes to Secure Boot and External Boot you will receive this error – 

Close the Startup Security Utility.

Close the macOS Utilities window.


Select Boot from Startup Disk.

Select the newly created USB device, Parallels Mac OSD then press Restart.

The Mac will reboot using the USB stick and after a short period present the Task Sequence Login Screen.

The actual OSD restore image building process is still the same for Mojave as outlined in the Administrators Guide. 

You have 2 options: 

    1. Use the OSD Image Builder on a Mac to build the image from Terminal commands
    2. Use a Task Sequence to capture the image.

Image Capture and Deployment for T2 Mac Computers

The actual image to be captured has to be from a non-T2 Mac due to the file encryption scheme Apple uses with the T2 chipset. We recommend that this non-T2 Mac is running macOS High Sierra 10.13.6 or later. Every file is encrypted on a T2 Mac and therefore can’t be imaged, so you have to capture a macOS Mojave image from a non-T2 Mac and deploy it to a Mac with a T2 chipset. Note that a T2 Mac won’t be installed with anything earlier than macOS High Sierra 10.13.6.