iPad Disaster Recovery in Institutional Model Deployments

I've been working intensely on the deployment models for our iPad refresh in August. Our current deployment model dates back to 2010 and a time before Apple Configurator, Volume Purchase and MDM. Back then, we had to make do with iTunes and iPhone Configuration Utility and we liked it!

One of the things I've been trying to understand is how to handle disaster-recovery procedures in cases where a device has to be replaced. I cannot overstate how important this is in a 1:1 scenario. When constant iPad use becomes embedded in the culture of your school, as it has in ours, the problem of not having access to your device takes on a much greater significance.

Apple defines three models of iOS deployment: Personal, Institutional and Layered. For more on these models, see Apple's "iOS Deployment Model" videos. I want talk here about disaster recovery procedures for Institutional Model iPads.

Apple Configurator in Institutional Model Deployments

In an Institutional deployment, you use Apple Configurator as a complete replacement - in principle, at least - for both iTunes and iPhone Configuration Utility. Configurator is used to activate the device, install Configuration Profiles and install apps. Configurator can also back up a device. Typically, in Institutional deployments, devices will be put into Supervised mode such that they cannot sync with another computer.

The Problem of Backup with Apple Configurator

Apple Configurator's backup function is different to doing device backups in iTunes. iTunes maintains one backup per device, incrementally updating and overwriting the previous backup at each sync.

Apple Configurator's approach to backup is not "incrementally update this backup set" but rather "make a complete clone of this device". Both approaches have their uses.

The problem with making routine backups in Apple Configurator is two-fold:

  • It clutters up the backup list in Apple Configurator since every backup is distinct from every other backup. You have to version them by hand; perhaps by prepending the date to the device name.
  • It eats disk space on your Configurator machine every time you back up.

This is fine if the device you're dealing with is broken but operational. It's not so good for quickly taking routine backups as part of ongoing device maintenance. As best as I can tell, Configurator will at least duplicate the last backup and incrementally update that backup set, so it's not quite as slow as you might imagine but still not that great.

The key insight here is that, although a supervised iOS device cannot sync with iTunes on another computer, it can sync with iTunes on the supervising computer.

Here is my approach to ongoing backup maintenance of Institutional iOS devices.

Routine Backups

In an Instututional Model using Apple Configurator, devices are typically periodically returned to base for app updates, new apps and Configuration Profile adjustments.

As part of routine maintenance, a backup should be taken in iTunes and periodically incrementally updated. This ensures that you have a recent device backup in case of disaster involving device loss or damage that renders the device inoperable.

To do this, make sure Apple Configurator is not running, then connect the device, right-click on it in the iTunes source list and choose "Back Up...".

This will create a backup of the device that you can fall back on if the worst happens: a device is lost, stolen or damaged beyond usability.

Disaster Recovery Procedure for Institutional Devices

Assuming regular backups have been taken in iTunes, the following steps can be followed to restore a user's data to another institutionally-managed device.

  • If the damaged device is bootable, connect it to iTunes and update your last backup, then quit iTunes
  • If the damaged device is not bootable, fall back on your last backup of the device.
  • Connect new device to Apple Configurator
  • Supervise and name the device
  • Select "Don't Restore Backup" from the "Restore" popup
  • Install apps and configuration profiles
  • Quit Apple Configurator
  • Launch iTunes
  • In iTunes, restore the device from the last backup of the broken device

That last step is the only thing you should do with iTunes to restore. Don't turn on app sync or any other sync configuration from iTunes - leave all of that to Apple Configurator.

Once the new device has been restored and verified, you should:

  • Reconnect the broken device to Configurator
  • Unsupervise the device to recover your VPP licenses and erase all data from the device

Note that, in following this procedure, you'll need an extra VPP license for each app. If you only have N licenses, where N is the number of devices you've deployed, you'll need to unsupervise the broken device before supervising the replacement. I would be cautious about that since you'll also be destroying the data on the damaged device before you've restored and verified that your last backup was good.

Another reason why it's good to own a few extra licenses for your apps is that, in situations where Apple Configurator cannot un-install the apps from the device, you will not be able to recover your license. You will also have to forcibly remove the device record from Apple Configurator by holding down Option while choosing Devices > Unsupervise... (which becomes "Remove" when Option is held down).

Remember that the procedures detailed here are for Institutional Model deployments. The procedure for Personal Model deployments is different.