Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Utilities (Apple) Software

Mac Systems Management 75

Posted by kdawson from the tools-of-the-trade dept.
johannacw writes "This story has in-depth info about managing Macs using Apple's Managed Preferences architecture. It covers how to use the 14 built-in systems-management areas, how preferences interact, how to secure workstations, and how to help users access resources including applications and printers. It's a must-read for any systems admin working in a Mac or mixed environment. Written by Ryan Faas, this is a follow-up to his popular Inside Apple's Workgroup Manager."
This discussion has been archived. No new comments can be posted.

Mac Systems Management More

Mac Systems Management

Comments Filter:
  • How easily deployable are settings of this sort?

    • Re:Interesting but.... (Score:5, Informative)

      by _merlin ( 160982 ) on Monday August 06, 2007 @11:52PM (#20138245) Homepage Journal
      Just as deployable as MS AD Group Policy: you define policy for the domain, and member computers pick it up. Obviously, you need a domain master, and you need to bind the target computers to the domain. But this is no different to any other directory service.

      • Re:Interesting but.... (Score:5, Informative)

        by rizzo320 ( 911761 ) on Tuesday August 07, 2007 @01:41AM (#20138773)
        In most cases a "golden triangle" is used where the Mac is bound to both Active Directory and Open Directory. The login credentials for users are managed in Active Directory, where as the managed preferences for the workstations are managed in Open Directory. It's a pretty common setup.

        If you really need to blend in with your Active Directory environment, you can bypass workgroup manager altogether and go with ADmit Mac by Thursby Software. Though on the pricey side, it allows you to do much more from with AD than the standard features of OS X. The last time I checked, it even allowed you to apply certain types of group policies onto the managed Macs... very cool stuff.

        • Re:Interesting but.... (Score:4, Funny)

          by somersault ( 912633 ) on Tuesday August 07, 2007 @05:08AM (#20139557) Homepage Journal
          "If you really need to blend in with your Active Directory environment, you can" use a BlendTec blender!

          Couldn't resist..

        • Another alternative to a Golden Triangle is to use Centrify for the Mac [centrify.com] if you have Windows sysadmins who just won't countenance a Mac server. Centrify uses the same underlying mechanisms as Workgroup Manager but lets a directory admin on a Windows server manage the Macs as though he were applying GPO's to Windows machines. While I think a Golden Triangle is preferable, Centrify works well when you just can't install a Mac OS X Server.

          --Paul

        • I've spent the last year cleaning up the mess left behind by AdmitMac at my company. This software is awful, so bad in fact that Thursby has removed their online support forum due to the tidal wave of complaints.

          The worst bug: AdmitMac will simply refuse to allow a user, and sometimes even a local administrator from logging in! It did this from the earliest version we used in 2006 to the last version in early 2007. I would get late night and weekend calls from the CFO or the CEO that they couldn't log in an

        • Re: (Score:1)

          by nko321 ( 788903 )
          Forgive the newbiness, but how does one login on a Mac using an Active Directory account? Does this require 3rd party software? I looked into it a few months ago and gave up after a day or two.

          • Forgive the newbiness, but how does one login on a Mac using an Active Directory account? Does this require 3rd party software? I looked into it a few months ago and gave up after a day or two.

            Make sure your Mac is plugged into the network, then go to /Applications/Utilities/Directory Access.app. In the services tab, make sure "Active Directory" is checked/enabled. Then click on "Active Directory" so it's highlighted, and press "Configure". It will ask you for your domain settings. In addition, go do

            • Re: (Score:1)

              by nko321 ( 788903 )
              Thanks for the reply! I've set these settings... where do I go to login? On reboot, I've tried entering my AD username / password and DOMAIN\username / password but neither are understanding my intention. I had already binded myself to the domain, so to comply with your instructions, I first unbind-ed from the domain, then re-bind-ed. Am I bound properly?
              • It sounds like you added the computer to Active Directory correctly. Make sure the system time is correct. It needs to be within so many minutes of the domain controller, otherwise it will refuse to login. There could also be other issues going on. Check the system.log to see any error messages.
  • Why is this on Slashdot? I guess it might be of some interest to people who don't manage OS X professionally. But this is a fairly basic overview of features from an OS released over 2 years ago! I cannot imagine why anyone would spend time writing this now. It's not like the information isn't already out there... like in the product documentation. Seriously, why is this on Slashdot? Did the editor think it was about 10.5 or something?
    • I think they write it because they like ad revenue. But I could be wrong, it's bound to happen sooner or later.

    • Re: (Score:1, Funny)

      by intx13 ( 808988 )

      It's not like the information isn't already out there... like in the product documentation.

      FMs are less read than FAs!

      Did the editor think it was about 10.5 or something?

      I'm sorry, I don't understand... what is this "editor" you speak of? :)

      • I'm sorry, I don't understand... what is this "editor" you speak of? :)
        I thought it was just another name for a drinking bird.
    • Seriously, why is this on Slashdot? Did the editor think it was about 10.5 or something?

      Indeed - this so-called-article is taking up valuable iPhone fluff story screen real estate.
    • There's articles about Amiga stuff here on /. sometimes you know. :P

      • Re: (Score:2)

        by mdwh2 ( 535323 )
        Yes, very occasionally, in proportion to when anything's happened. As opposed to articles everytime someone decides to write about something minor, as seems to be the case with Apple.
  • iThey're ifree-spirited isystems ifor ifree-spirited ipeople, iremember?

    • Re: (Score:2)

      by RuBLed ( 995686 )
      Yup! Macs should be iManaged.
    • Now THAT's funny :) I love the iUniform. Standard-issue to free-thinkers everywhere.

      I'm not even sure that they were supposed to even let me in this coffeeshop with my MS-laden beast. It doesn't even have a glowing logo on the lid. I think I was grandfathered in because I'm so "old".

      iFree-spirited... hee.

  • But where are the ready-made commands to paste into terminal? The neat perl scripts? I thought the whole point of Mac was that you could use the UNIX underneath for administration? I mean if the extent of possibilities is "click here, then click here" you might as well run server 2003.

    • Re: (Score:3, Informative)

      by lakeland ( 218447 )
      You can, and it works fine. It isn't quite as easy as editing /etc/fstab (here's /etc/fstab from a computer I'm currently sshed into...

      andrea-lakelands-computer:~ corrin$ cat /etc/fstab.hd
      IGNORE THIS FILE.
      This file does nothing, contains no useful data, and might go away in
      future releases. Do not depend on this file or its contents.
      --
      As you can see, apart from the warning it now contains nothing (this is on 10.4.10). I think on 10.3 it contained the warning and mounted volumes ala /etc/mtab but that coul

      • It's the same kind of person who likes using the Windows GUI for server config. It's just they way they want to do it; it feels easier to them; companies are well within their rights to keep that market segment appeased. Now, don't let that stop your CLI/GUI holy wars [elsewhere.org][jargon file], though (see many of the comments in the recent story stating netcraft confirms IIS gaining on Apache [slashdot.org] for a decent example of these kind of people as well as a ongoing holy war fought on the shores of our own beloved /.).

        I, f

    • Re:system administration (Score:4, Informative)

      by Graff ( 532189 ) on Tuesday August 07, 2007 @02:56AM (#20139055)
      You mean like:
      Mac OS X Server Command-Line Administration PDF [apple.com]

      Here's a web page with all the manuals for Mac OS X Server, lots of good information there:
      Apple Server Documentation [apple.com]

    • But where are the ready-made commands to paste into terminal? The neat perl scripts? I thought the whole point of Mac was that you could use the UNIX underneath for administration?

      In my experience OS X administration is pretty much the same as administrating a BSD, Linux or Unix system. There are and always will be differences between them but the basic principles are the same. On OS X I very rarely go for point and click interfaces except the System Preferences and the Disk Utility and I can usually transfer what I know about Linux/BSD/Unix to OS X.

      I mean if the extent of possibilities is "click here, then click here" you might as well run server 2003.

      Contrary to what seems to be the popular opinion, Windows 2003 server has a quite powerful command-line interface. For some reason sur

      • I wasn't going to mention that but --exactly. Windows Server Administration grew up on GUI's where the command-line equivalent utilities, in some areas, were implemented as an afterthought. I think this is why it put off a lot of Unix Admins that I used to know. Things have certainly changed and 2003 is almost as scriptable from the command line as the GUI. Server 2008 takes things to the next level entirely where you can deploy truly headless servers. I haven't even mentioned the Powershell. Unfortun
    • Mac OSX is UNIX, but as a UNIX admin you would know there are virtually no pre-defined scripts for administration. There are commands that can be run from shell for administration and remote administration, but they're almost all server based, not client, and the type of server your connecting to makes a BIG difference. With this central management system on a MAC OSX Server in the network, these settings can now become host environment independent, and it really doesn't matter if the domain is a UNIX, No
      • While a Mac OS X system can authenticate against an AD setup, the subject of this document is *OD* - or Open Directory. It's very similar, but it's not the same thing. An earlier post has pointed out that it can be done via Active Directory, but it's third party software.

        At work we have both a Windows 2003 domain controller, which looks after authentication and file sharing for everybody, and a Mac OS X server, which provides the equivalent of group policies for the Apple machines used.

  • Workgroup Manager (Score:3, Interesting)

    by nevali ( 942731 ) on Tuesday August 07, 2007 @08:50AM (#20140641) Homepage
    It's worth noting that Workgroup Manager is a handy tool to run on your own Mac, even without an Open Directory domain, as it's a bit more flexible than Accounts.prefpane, especially for (for example) configuring limited accounts for family members.

    It's part in the Server Admin Tools: http://www.apple.com/support/downloads/serveradmin tools104.html [apple.com]

    I don't know if the license/installer says you have to have a Mac OS X Server installation to use them, because I haven't looked.

  • What? Mac has systems management? That's impossible, everyone knows Mac is so easy to use, and virus-free, that it's the toaster of computers.

  • Used this for a long time (Score:3, Interesting)

    by guruevi ( 827432 ) on Tuesday August 07, 2007 @02:51PM (#20145413)
    I've used this in an all-Mac environment. You can't beat it with anything. I have it for home now.

    It's kinda like Active Directory but much more simple, open and you can integrate it with other (non-Mac) systems since it's pure LDAP (over SSL) and Kerberos. There is even a feature to integrate and manage your Windows machines without using Active Directory. Combine it with Apple Remote Desktop and Apple's Software Update Service and you can deploy whatever package or update you want within seconds (it uses multicasting to save on bandwidth, eat that Microsoft)
  • The fact that this is a story show how far behind Apple is in remote management. Everything here I could do on *inx or MS computers for at least a decade, why is this news? I guess there has to be some padding between the regular blowjobs that /. likes to give Apple. oh wait, this is one of those huh. Geeze get a room.

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close