Ahem, sorry.

I've owned an AppleTV since just after Apple released the second generation iOS version so probably for two and a half years. It's been sitting underneath my TV ever since doing stirling service streaming from Netflix and playing content streamed from my iPhone. Google announced general availability of the Chromecast in the UK last week for the princely sum of £30 so I thought "What the hey" and ordered one from Amazon. I took delivery of it on Thursday and have been playing with it a little since then. I thought I'd write a little about how the two compare.

I have to say right from the beginning that this isn't really a fair comparison. The two products are similar in one regard (i.e. they both connect to an HDMI port and can stream video from the internet to your telly) but at best the Chromecast has a small subset of the features that an Apple TV. It also only costs one third of what the Apple TV costs so maybe that subset is enough for you? Who knows?

So what can the two devices do? Well, the AppleTV is in theory a standalone device. It has a series of apps built into it which can log onto various on-line services and stream content from them. Services available in this country include the iTunes store (of course), Netflix, YouTube and others. It can connect to a lot of on-line radio stations. When there isn't a built-in app available, it can play video and audio streams from apps on your iOS devices (an iPad, iPhone, iPod Touch). If your iOS device is new enough, it can wirelessly mirror the screen from iOS devices (You need an iPhone 4S or an iPad 2 or newer). The AppleTV can also be mirrored to from a Sandy Bridge or newer based Mac. There are also third party applications available to stream content from Android and Windows devices and from older Macs. The Apple TV comes with a power cable and a remote control. It can be connected to an amplifier using an optical S/PDIF cable.

With an AppleTV, you don't need an iPhone or an iPad to use it but is undeniably a lot more useful with one. The Chromecast is different. Without a smartphone, tablet or computer to stream from it's completely useless. The Chromecast is compatible with iOS devices running iOS 6 and later and Android devices running Gingerbread. You can also install an extension for Chrome which lets you stream a tab from Chrome to your TV. This is compatible with OS X Lion or newer, ChromeOS on a limited number of devices and Windows 7 or newer. With the Chrome extension there is an "experimental" feature that lets you cast your entire screen as well. However, there is an issue with that. You can only cast a 720p image to the Chromecast. Anything bigger will be cropped rather than resized. See the attached picture:

Please forgive the fuzziness but these things are hard to capture! The resolution on my Macbook is 1280x800, the traditional resolution for 13" laptop displays before 16:9 screens became common. The very top and very bottom of the picture has been chopped off, you can see that there is only half a menu bar at the top and the status lights of the apps have been cropped at the bottom. A little less visible are the thick black bars on both sides of the screen at 1280 pixels, the picture is narrower than the 1368 pixels the Chromecast displays at.

I don't have a Mac new enough to send a desktop to an AppleTV over Airplay but with iOS devices, it keeps the aspect ratio but resizes the picture to fit.

So, streaming videos.

With the AppleTV, unless the app specifically disables (Channel 4, I'm looking in your direction here. And I'm giving you the stink eye too) it you should be able to get your video onto the big screen by using either AirPlay or AirPlay mirroring. With AirPlay, you send the video stream directly to the AppleTV. With AirPlay Mirroring, it just mirrors what the device is showing. My point is, the majority of the time your app should not need to have specific support for AirPlay to work with the AppleTV.

In contrast, the ChromeCast does need explicit app support. At the moment, the range of apps that support it is very small. And don't think what I thought and try to stream a video in a tab in Chrome. Playback is very jerky and the lag is ridiculous.

Below is a screenshot from the iPhone YouTube app playing a video:

There are two icons which I want to point out to you here. One is the ChromeCast icon, it's on the top of the screenshot directly to the right of the title. The other is the AirPlay icon, it's on the bottom of the screenshot to the right of the timeline. Both work in exactly the same way, you press it and it brings up a list of detected devices. Click on the device you want to stream to and press play. Your TV will now be playing your video

Anyway, how well they both work?

The AppleTV is typically Apple. It works well as long as you work within its confines. The builtin apps do exactly what they're supposed to do. Assuming your connection is up to the job and that the stream is good, video quality is very good from all of the built in apps.

The same can be said about the Chromecast. Don't expect miracles from it and you'll be fine.

I have observed something that is quite interesting though. On my phone, I have four apps which support both AirPlay and ChromeCast natively: YouTube, Plex, iPlayer and Netflix. The video quality from YouTube and Plex to the AppleTV and Chromecast is identical, i.e. it's as good as the source.

With iPlayer and Netflix, it is significantly better on the Chromecast and my theory as to why goes like this. I think that when you send a video to the AppleTV via AirPlay, these two apps send the AppleTV the same video stream as they'd send to the iPhone, i.e. one optimised for a tiny screen on a potentially poor connection. The images they send are blocky, pixellated and have awful compression effects. The picture is worse than what you get from a low rent Freeview channel. When you send the video to a Chromecast, you seem to be getting a Chromecast specific stream. I don't think that there is anything inherently wrong with the AppleTV here, I think it's laziness on the part of the BBC and Netflix teams. The difference on Netflix is especially striking but I guess that the use case for using Airplay to stream to an AppleTV is pretty small considering that the AppleTV has native support for Netflix.

So to come back to the original question, which is better? There isn't a definitive answer to this. Both have their use cases and both have their places in their respective HDMI ports as far as I'm concerned. The AppleTV has the advantage of being a standalone device on which you can rent and buy films and music, watch Netflix and YouTube and listen to the radio on. It's also better at device mirroring. The Chromecast seems to get much better quality video streams from internet streaming sites.

I'm sure some of you are wondering which is better for use in a school. The answer to this is the AppleTV without a shadow of a doubt. It has officially supported mirroring from Macs and iOS devices, unofficially support mirroring from Android and Windows computers using third party apps and most importantly can be connected to enterprise wireless networks. The Chromecast can't.

Assuming that you're interested in this, I would suggest that you read my previous three blog posts first. This will put this new post into some context and it saves me having to write it all again! Links to the previous posts:

http://www.edugeek.net/blogs/norphy/1982-adventures-macland-my-experiences-configmgr-2012-macs-part-1.html

http://www.edugeek.net/blogs/norphy/1984-adventures-macland-my-experiences-configmgr-2012-macs-part-2.html

http://www.edugeek.net/blogs/norphy/2010-adventures-macland-my-experiences-configmgr-2012-macs-conclusion.html

My previous blog posts on this subject generated quite a lot of attention, not least from Parallels themselves. I have been in regular contact with the lead developer of this product who has given me the opportunity to provide feedback and a few bug reports too!

Anyway, in brief, last year I evaluated options to manage our Macs using System Center Configuration Manager 2012 SP1. We were using a mixture of DeployStudio and shoe leather to manage our Macs before and considering we have the better part of eighty of them on site, this was getting unmanageable. I evaluated both the built-in Mac agent in SCCM and a third party management plugin for SCCM made by Parallels. Even at the time, the Parallels agent seemed like the better option so we plumped for that one. This blog post is going to be about the improvements that Parallels has made to their product and how well it has worked since we started using it in anger back in September.

Parallels haven't sat still since March last year which was when we first looked at the product, they have made some improvements and added some major new features too. As well as fixing bugs, they have added three large and visible features. These are:

Built-in Profile Generator

In v1.5, Parallels put in a profile generator into their product. Instead of having to have a copy of OS X Server and use Profile Manager to generate .mobileconfig files, you can use theirs instead. This simplifies matters a little in theory, it means that config files can be generated directly from the ConfigMgr console.

This is a nice feature to have but it's very much a "Version 1" product if you understand my meaning. It has some of the main options available to you but nowhere near all of them. If you want to do more advanced stuff, you still need a copy of Profile Manager on OS X Server running. This is very much a work in progress though and Parallels tell me that this is being improved continually.

Operating System Deployment

Parallels introduced and OSD component for Macs in v2.0 of their agent. They have actually managed to shoe-horn an OS X Image into a WIM file and deploy it to Macs over the network.

The way they've done this is simple but effective. They have written a Netboot server which runs on Windows. You need to install this on a PXE enabled distribution point. Parallels say that it also needs to be installed on a DHCP server but I've found that this isn't the case. As long as there is an IP helper point at the server that's hosting the thing, you're golden. When you install the Parallels agent on the server, the NetBoot agent is now an option. In that wizard is an option to enable support for unknown Macs.

To create the image, you need a master Mac. You need to install two copies of OS X onto that Mac on two partitions (Master copy and Slave copy). It doesn't matter if one is on an external hard disk but for simplicity's sake, I did two partitions on the same disk. You boot the Mac up using the Master partition first and install all of your programs and updates. Once you've finished, you boot the Mac up using the Slave copy of OS X and open /System/Library/CoreServices/System Image Utility. You create a NetRestore image (NOT NetBoot as I did the first time!). Once the image process is finished, you copy the resulting NBI file onto the server hosting the Parallels agent.

You then need to open the ConfigMgr console on that server, go to the Software Library workspace and go to Operating System Deployment. Go to Operating Systems, right click on Operating System Images and choose "Add Mac OS X Operating System Image". A wizard appears which asks you to point at the NBI file you generated and then to a network share where it creates a WIM file for ConfigMgr. Once that has been generated, it adds it to the console by itself but one quirk I have noticed is that if you try to create it in a folder, it doesn't go in there right away. It will instead put it in the root. You have to move it manually afterwards.

The next step is to create a task sequence. Go to Task Sequences, right click and choose "Create Task Sequence for Macs". A wizard appears which lets you choose which image you want to deploy. Enter a name for the task sequence, choose your image, press OK and the task sequence is generated

From herein, it's pretty much standard ConfigMgr faire. You need to distribute the image to the DP that's on your Parallels server and deploy the task sequence it to a collection. As of v2.1, you can deploy it to Unknown Computers and build new Macs from it. When you boot your Mac next, hold down the Option(alt) key and you should see a Netboot image appear in the bootable volumes list with the name that you gave your task sequence. You should also see it if you go to System Preferences then Startup Disk.

When you boot the Mac from the Netboot image, you just get a standard NetRestore instance. It will ask you where you want to restore your image to and do it for you. No muss, no fuss.

What it doesn't do at the moment is any kind of customisation of the image for you post deployment. You will need to name the freshly deployed Mac and install the Parallels SCCM agent by hand once it's finished. However, this is all scriptable and I have written a script to do this plus a few extra bits. Parallels tell me that this will be improved in future versions.

Client Side GUI

One of my biggest criticisms of the Parallels agent when I first looked at it was that there was no client-side GUI. Although the agent was installed on the Mac, you didn't have any kind of visible sign that anything was there. In day to day usage this wasn't much of a problem but it made troubleshooting the product a little tricky and sometimes it's nice just to know that the thing is there!

With v1.5 they put in a System Preferences pane which gives you basic information about the client and tells you that it is working.

In v2.5, the most current version, they have introduced visible adverts for software as well. If you set a package as visible, it pops up a window saying that a package is ready to install and will let you install it now or postpone the installation for a set amount of time. They have also put in an option to reboot the Mac after software deployment and to make this optional.

These are all big, big improvements. Macs aren't quite first class clients in ConfigMgr when you compare them to Windows clients but the gap is closing. The agent has come on in leaps and bounds since last year and frankly they have more than validated our choice to use the Parallels agent over the Microsoft one. When you consider that the only improvement that Microsoft put in for their Mac agent in ConfigMgr 2012 R2 is that they've put a GUI Installer in for their client, this makes it all the more impressive.

How has the Parallels Agent performed?

Very well indeed. Honestly, I couldn't be more pleased with it. We have used it to push out software that we missed from our main image. We have pushed out OS updates, updates for Flash and Java, updates for Office and one time, a critical update for Adobe Prelude where it wouldn't launch under OS X 10.9.

We've also used it to push out profiles which has greatly simplified processes like joining our Macs to the AD domain, sending out wireless profiles to them, setting desktop settings, putting shortcuts onto the Dock and suchlike. Admittedly, you can do all that using Profile Manager but pushing them out using this way means that you don't need to have them joined to Open Directory and have a Magic Triangle in place. As I'm sure you can imagine, this simplifies the structure of your network significantly. The only reason we have an OS X Server in place now is to generate profiles.

I've also just started building the Macs using the thing and all of this means that building and configuring them is a three step process:

1) Deploy image

2) Give the Mac a name

3) Install the Parallels client

It has performed its function reliably and consistently. I haven't had to sit down and try and troubleshoot esoteric and bizarre errors and the few times I have needed to contact Parallels for a little help I've had an excellent response and had my questions answered and issues resolved quickly and efficiently.

There are still some rough edges but these are getting smoothed. Parallels are working hard on new features and the product is only going to get better. If you have Macs and you have ConfigMgr, get this product. You will be glad that you did.

So in the blue corner, we have the Microsoft native client. Its advantages are:

1. Native Solution
   
2. On the whole, easier to create and add applications to the ConfigMgr console
   
3. A Client side GUI
   

Disadvantages are:

1. Treats the Macs as mobile clients so therefore requires the use of HTTPS secured MPs and DPs
   
2. Not especially stable
   
3. Awkward to install the Mac-side client
   
4. Takes a long time to install multiple applications
   
5. It took them four full months after the release of SP1 to start supporting Mountain Lion, an operating system which has been available since July last year. Microsoft have apparently made a commitment to supporting new versions of OSX within six months. However, considering that OS X is on a yearly release cycle that doesn't really do anyone much good.
   
6. No remote control client
   
7. You need to repackage applications for them to be deployed
   

In the red corner, we have Parallels. Its advantages are:

1. Supported Mountain Lion right off the bat and according to their developers they'll attempt to get support for new versions of OS X within thirty days
   
2. Doesn't require HTTPS support inside your ConfigMgr infrastructure
   
3. Easier to install the Mac-side client
   
4. Has proven to be more stable
   
5. Don't need to repackage applications
   
6. Simpler to create settings to deploy to the clients
   
7. Remote control client included
   

Disadvantages are:

1. It's VERY expensive. And you buy it on a yearly subscription too.
   
2. No client-side GUI. You have no idea of what's going on unless you delve into the logs. This includes whether deployments have succeeded or not.
   
3. Setting up packages is more complicated and needs more trial and error.
   
4. It uses legacy Packages to deploy software to the Macs rather than the new style Applications. It's possible that these won't survive into the next major ConfigMgr release.
   
5. Needs its own DP and MP if you're running HTTPS
   
6. Even if you're only running HTTP, you'll probably need another server to put the PMA Proxy on to.
   

There is one thing which the Parallels agent does which Microsoft doesn't do even for Windows clients and that is triggering a Machine Policy and Evaluation Cycle from the ConfigMgr console. Which is nice considering you can't from the client

There are certain things which both agents do as well as one another, namely inventory and operating system updates.

Neither product supports the deployment of the operating system at the moment. Maybe that will come later, who knows?

On the whole, I think that the Parallels product is better, if only because deploying software is that little bit more reliable. We made the decision to buy it (just before MS released SP1 CU1 to include ML support. Dang!) and I don't regret it. Hopefully I'll be saying the same in a years time.

Introduction

In Part One of this blog, I talked about the new Mac client for Microsoft System Center 2012 Configuration Manager SP1 (God, that's a mouthful!). I talked about my impressions of it and how well it's been working so far. I also mentioned that Parallels have been in contact with us and hooked us up with an evaluation version of their own Mac plugin for ConfigMgr called the Parallels Management Agent (hereafter referred to as the PMA). I'm now going to ramble on about that plugin and tell you how it works and how well I've found it to work.

First of all, the product is described on the Parallels website here: Parallels Management-Mac for Microsoft SCCM - Parallels

Like the Microsoft product, this agent can deploy software, configurations and operating system updates. It inventories machines, again just like the MS product. In addition to that, it also has a remote control component and it works with Mountain Lion. Parallels have also made a version which works with ConfigMgr 2007 (requires SP2 or higher) but I'm not going to focus on that as we're no longer using it. It seems to work in much the same way anyway.

So how does it work? This graphic on the Parallels website describes it quite succinctly:

http://www.parallels.com/typo3temp/pics/SCCM_component_chart_v1_d7c09284e5.png

The Parallels product installs a custom ISV proxy which acts as the proxy between the Mac clients and ConfigMgr. The Parallels client on the Macs talk to the ISV proxy which in turn talks to the ConfigMgr management point. Parallels say that it works with both Mixed and Native modes on 2007 and with HTTP and HTTPS enabled sites in 2012.

Installation

Installing the product is relatively straightforward. You need to have a server running Windows 2008 SP2 or higher. It can (in theory anyway, I'll come back to this later on) be installed either on an existing server in your ConfigMgr infrastructure or on a completely separate server. You run the installation wizard and it installs the server component plus a plugin for the ConfigMgr console and a little application which sits in your system notification area and reports on the health of the server component. The installer creates a collection inside ConfigMgr for clients that it manages, it adds an additional discovery method to discover Macs on your network and it adds some extra options to the installed ConfigMgr client on the server that you're installing it on.

You also need a client on the Mac itself. The official method of installing it is to download an installer using a web browser of your choice from an HTTP link on the server where the ISV proxy is installed and run it. Unlike the Microsoft product, this has been wrapped up in a proper PKG style installer and doesn't need to be run from an elevated command line. Naturally it will ask you for a admin user name and password when being run but that's standard OS X practice.

So what can it do?

Software Installation

Well, as you would hope it installs software. Obviously you need to add the software to the ConfigMgr repository just like you would with a Windows piece of software. Rather than using Applications to install the software, it uses legacy packages. You don't need to repackage software like you do with the Microsoft client but working out how to get it to deploy from the PMA is a little more complicated. I'll try to explain.

Usually there are three ways you can get a piece of software for the Mac, not counting the App Store:

1. You can download the app inside a in a DMG file and copy it from the DMG to the computer's /Applications folder.
   
2. You can download a DMG containing a PKG file to be executed.
   
3. You can download an installer (usually a PKG) to be executed directly.
   

The PMA supports all three of these deployment methods. So when you create a program for your package inside ConfigMgr, the command line for installation will look something like this:

1. :Firefox 19.0.2.dmg/Firefox.app:/Applications:
   
2. :iTunes11.0.2.dmg/Install iTunes.pkg::
   
3. install.pkg
   

The first one mounts the DMG and copys the Firefox.app to /Applications. The second mounts the DMG and executes the Install iTunes.pkg inside the DMG. The third just runs an arbitrary command.

You can deploy operating system updates via this mechanism too.

Once you've created the package and program, you deploy it to a collection in the usual method.

System Inventories

Secondly, it inventories the Mac for you. It can detect what hardware and software is inside the machine and puts that all into the ConfigMgr database. You can then create collections and queries from this information like you would do with a Windows machine. See the screenshot below:

If you think that looks like a standard ConfigMgr inventory, you'd be right. There's not an awful lot more to be said about this.

Remote Control

It has a remote control client. Parallels have baked a VNC client and Putty into their ConfigMgr console plugin. You access it by right clicking on a Mac client inside the console, going to Parallels Management Tools then Connect via VNC or Connect via SSH.

This works in a similar manner to the Microsoft remote tools for the Windows clients. On the Mac side, you will need to assign a VNC password to it for screen sharing to work and you'll need to enable Remote Logon for the SSH client to work.

Again, there's not an awful lot more to be said about this. It works and it's useful.

Mac Configuration

The final thing that you're going to want to use it for is to configure your Macs. The way that Parallels achieves this is quite interesting and for some things, somewhat more friendly than the Microsoft method. You need a copy of OS X Server to achieve this but considering that it's only £14 these days that's not a big barrier.

You create a profile inside Profile Manager but don't deploy it to any groups. When you've created the profile, download its .mobileconfig file to your computer. Open the ConfigMgr console and go to the Assets and Compliance workspace. Go to Compliance Settings and right click on Configuration Items. Go to Create Parallels Configuration Item then to Mac OS X Configuration Profile:

You can then point it at your .mobileconfig file and say whether it's a system or user setting:

You then create a configuration baseline and assign it to a collection just like you would with a PC.

Other Features

The last feature that should be mentioned is that this plugin for ConfigMgr has the ability to manage the installed version of Parallels desktop on your client Macs. However, this is not functionality that I've delved into because we're not using our Macs to run Windows so we don't have it.

So all of this describes how it works which is all great in theory but the question you're probably asking me by now is: "How well does it work?"

Well, lets start with the installation. It perhaps didn't go as smoothly as it could have done. First of all, I attempted to install the plugin on the same server as my management point. The installer seemed to run through properly and it installed the plugin in the console, the ISV certificate and the relevant Parallels collections. However, the PMA monitoring tool reported that the proxy hadn't started and I could not get it going. After that, I tried to install it on another ConfigMgr site server (In this case my SUP). First of all the install failed because there was already a pre-existing ISV certificate for Parallels. It couldn't or wouldn't overwrite it and it wouldn't use it either so I had to go to the Googles and find out how to remove ISV certificates by hand. Merely disabling the certificate wasn't enough, it had to go entirely. This isn't a pretty process but I couldn't see another way around it! See this blog entry on how to do it: SCCM 2012: How to delete an ISV Proxy Certificate

Once the ISV cert was removed, I tried to install the proxy again but I ended up with the same issue. In the end, I gave up and created an entirely new VM, installed the ConfigMgr client on it, deleted the ISV certificate again then installed the Mac proxy on this clean machine. After that it worked perfectly.

The other issue that I ran into was a good one. Despite saying that it works with an HTTPS enabled ConfigMgr site, it kind of doesn't really. For the PMA to talk to ConfigMgr, you need to have a management point and a distribution point that both talk HTTP. The Distribution Point also needs to have anonymous access enabled. This meant that I had to set up a new DP for the Mac content and switch my MP to HTTP.

Once all of these niggles are worked out, the agent works remarkably well. Like the Microsoft client there are rough edges. For example, there is no client-side GUI for this plugin so there is no way of telling if the plugin is working or if software is being installed or not without going into the log files and watching them process. Additionally, if a piece of software requires a reboot the PMA doesn't ask to reboot the machine. On the upside, it doesn't arbitrarily reboot it either so at least your user isn't interrupted. Software distribution worked very well. There were a couple of pieces of software I couldn't persuade it to deploy (Flash Player, Office) but these use non-standard installers and to be fair, I couldn't get the MS client to deploy those either.

Parallels tell me that a client-side GUI is going to be included in the next version of the agent so hopefully most of those issues will go away.

DCM works well, you just need to know which settings are user settings and which are system wide. It isn't always obvious and if you get it wrong the rest of the policy seems to fail.

Remote control works as said before, as does the inventory.

So which is better, the Microsoft or the Parallels client? I'm going to put that into Part 3 of this blog because this is already an awful wall of text and hopefully that should help break it up a little! Stay tuned!

During the planning stages, we have been evaluating the Mac component of the product. My colleague @Roberto has written a little about it on his blog at It's Always My Problem. You should go read it. Go ahead, I'll wait.

Have you read it yet?

Really?

OK, I'll continue.

As Rob said in his blog, we have around 1500 Windows clients and 70-odd Macs. At the moment, they're essentially unmanaged. We can't easily push software, patches or policies to them. The Apple management components suck more than a super-Dyson and are essentially useless. At one point, we were looking at Dell KACE to manage our network which includes a very nice Mac management component but considering what it cost and that we get ConfigMgr virtually for free it didn't seem economical. So we went with ConfigMgr and waited for Microsoft to start supporting Macs.

Joy of joys, ConfigMgr 2012 SP1 introduced the Mac client. Over the last half term break, I decided to take a look at it and to attempt to get it working. This is what I found.

Microsoft are essentially treating non-Windows clients as mobile devices. This means that your ConfigMgr infrastructure has to support HTTPS across the board. Your management point needs a certificate, your DPs need a certificate, the ConfigMgr IIS site needs certificates and for OSD to use your newly certified MPs and DPs, your PXE points and task sequence media need certificates too.

To register the Macs with ConfigMgr, you need an MSI from Microsoft and install it on your PC. Inside that MSI there is a DMG which contains the client, the enrolment component and an application repackager. Copy that DMG to your Mac and mount it. You then have to install the client using the installer (ccmsetup) in an elevated (sudo) terminal session then enrol the mac using the enrolment component (CMEnrol), again using an elevated command prompt. Assuming you've configured your ConfigMgr correctly and allowed your Active Directory user to enrol mobile devices, it'll download a certificate and enrol your Mac in ConfigMgr. See this rather good blog post here for specifics

Once your Mac is enrolled, ConfigMgr will start inventorying it immediately. You'll then probably want to start doing something useful with it. At the moment, the Mac ConfigMgr client can deploy software, updates and settings.

Deploying a Mac app using ConfigMgr 2012 is much like deploying a Windows app. You have to use the new Application format to add it to ConfigMgr, not a old fashioned Package. You have to create the Application, create a deployment type, copy it to a DP and deploy the application to a collection.

The first complication that you'll come across is that you can't add standard DMG, APP or PKG to ConfigMgr. Instead you have repackage the app to Microsoft's own CMMAC format and use that to create the Application with. Doing this is simple enough, you need to use the repackaging application in the DMG file (called CMAppUtil) to do this. Once again, you need to use an elevated terminal session to do this although the reasons why elude me. See another rather good blog post here for more specific instructions.

To deploy settings is a little more complicated. The way that ConfigMgr does it is to modify PLIST files. The mechanism that it uses to deploy the settings is DCM. The procedure to do this is as follows:

Open the ConfigMgr client and go to Assets and Compliance, Overview, Compliance Settings, Configuration Items. Press Create Configuration Item.

Give it a name and description if you wish and change the configuration type to Mac OS X. Assign it some categories to keep your sanity intact later on. Press Next.

If you're using more than one version of OS X, choose the version that you want it to apply to. At the moment, your choices are Snow Leopard and Lion

You now need to add a preference. Press the New button. Give it a name and description. Change the setting type to Mac OS X Preferences (A script is an option too)

In Application ID, type in the path and name of the PLIST file omitting the extension

In the data type box, put in whether the setting is a string, a number, true/false etc.

In the Key field, type in the name of the key. This is case sensitive. You'll need to research where the PLIST file and what the setting is yourself.

Change to the Compliance Rules tab. Press the New button. Fill out the name and description. Put the value of what the setting needs to be in the value box. Make sure that the Remediate box is ticked and check the report box if you want to and press OK. Finish the wizard.

You then set a baseline (this is the same as doing it for a Windows machine; create it, choose which setting you want to deploy) and deploy it to a collection.

So how well does this all work? All things considered, it doesn't work badly at all. It's (mostly) functional at least. There are, however, some very rough edges. You can only deploy to machines, not to users. Installations have to be 'Required', optional installs won't work. There is no Mac equivalent to the Software Centre so you can't see what software needs to be installed. When the Mac agent detects a software deployment, it comes up with a countdown. The length of that countdown can't be changed and if the software requires a reboot, it can't be postponed. The most annoying thing that I've found with it is that when there are (say) five deployments for the thing to run and there's someone logged onto the machine, the machine will notify the user that there's an installation to be run, wait for an hour if there's no response, install the software, run the next advert, wait for another hour, install the software, wait for another hour etc, etc, etc. You get the idea. The example of five deployments above could take FIVE hours PLUS the amount of time required to install the software.

I have had problems with the deployments too. Sometimes the machine will kick off an installation and the progress bar will not move. The actual installation is taking place in the background and has frequently finished, there's just no indication of this. Eventually the installer times out and marks the deployment as failed despite actually succeeding. Then when the client calls back to the server and asks for a policy update, the server tells the client that it needs to install the software again and then it fails because its already there. This tends to happen most with larger PKG based installers, .APP files are generally OK.

Although deploying configuration items is relatively straight forward, it can be a bugger to find the appropriate PLIST file to change the setting that you want and if it's in a different location on different machines, it's nigh on impossible. It would be nice if Microsoft could work out a simpler method of doing this although quite how they'd do that eludes me. That all said, assuming that I've got the baseline right, a setting has never failed to deploy for me so it at least works well.

It's also a shame that Microsoft haven't included a remote control component with this either. Considering that a VNC daemon is baked into OS X, it would be trivial to implement.

The most glaring omission is that the client doesn't work with Mountain Lion. This isn't a "oh, it's not supported but it might work; try it at your own risk' situation, it just plain doesn't bloody work. The client installs but the enrolment fails. This is a real clanger. Mountain Lion was released in July. Even pretending for a second that Microsoft wouldn't have had access to pre-release code before then, System Center SP1 got released in December. Microsoft would have had four full months to add Mountain Lion support to the client before they released it. I'd truly love to know why they didn't.

So the Microsoft client is all well and good but considering we're not going to be using anything less than Mountain Lion next year it's useless to us. Microsoft have so far been completely silent on whether they're going to be supporting Mountain Lion in a forthcoming update so we're going to have to assume that they're not.

Enter Parallels, the very nice people who make the famous desktop virtualisation package for the Mac. An employee of theirs posted on @Roberto 's blog telling us that they have their own SCCM management agent for the Mac and offered to hook us up with an evaluation version. They told us it works with Mountain Lion. They told us it has a remote control component. They haven't told us how much it costs. We've taken them up on their offer and installed it. Is it any good? Find out in Part Two...

SORTED - Food, Recipes, Videos and banter

Lets go through it:

1 small onion

OK

2 cloves of garlic

Fine

knob of butter

OK

cup of risotto rice

cup of white wine

Considering the site and videos appear to be British, measuring in cups is odd. Seems like they're pandering to Americans but OK. However, assuming a serving of 75g rice per person, a 250ml cup of risotto rice is far too much! 3/4 is more like it.

warm vegetable stock (or cube and boiling water)

jar of roasted red peppers

handful of fresh rocket, washed

wedge of goat’s cheese

chunk of Parmesan, grated

splash of cream

Now it's starting to get annoying. How big a jar of roasted peppers? How much stock? How big is a wedge of goat's cheese and a chunk of Parmesan?

Having now tried the recipe, a 1lb jar of peppers seems to me to be too much unless you use virtually no stock but then how is the rice going to get cooked?

When I've purchased music, I've generally got it from iTunes. I know the arguments against it, mostly due to sound quality but when I realised that I mostly listen to my music in my car, on my computer and on a cheapish iPod dock I realised that I honestly couldn't tell the difference between a CD and an encoded iTunes file any more. My recent issues with my ears haven't helped in that regard either. Anyway, I digress. When Apple announced iTunes Match, it seemed like a fantastic idea. Unlimited access to your music collection from the cloud? Streamed directly from Apple's servers? £21 a year? Fantastic! Perhaps even too good to be true. When they eventually got the licensing in this country sorted out and made the service available here I waited about a month then signed up. This was February I think. I thought I'd write about how I've got on.

When you first sign up, iTunes analyses your music collection and attempts to match it against music in the iTunes database. If it can't find it, it uploads a copy to their servers, presumably converted to AAC. Out of my ~9000 track music collection, it recognised about 7000 tracks and uploaded the rest which took about a night. This seemed to work smoothly.

The first test was from my Apple TV. I signed into the service and played music from my library without my computer having to be on. Jolly good, so far so good. Access to music was fast enough and my internet connection was more than able to cope.

The next test was with my iPhone 3GS. Here I hit a bit of a snag. Being the Apple tart that I am, I was subscribed to MobileMe. I got my email through there and all the other services so my MobileMe account was the AppleID that was signed into my phone. Of course, my main iTunes account predates MobileMe and this was the AppleID that I had bought my iTunes Match subscription with. After a bit of head scratching trying to work out why I couldn't see my ITM subscription on my phone, I worked this out and signed in with my older AppleID and manually set up my email and calendar sync on my phone. Bit of a faff but not too bad I suppose.

Anyway, when you first sign into ITM on an iPhone, you get a warning message telling you that iTunes Match will take over the music library on the phone and that all stored music will be removed. OK, fine. I chose a playlist and went for an hours walk around New Barnet, Hadley Common and Chipping Barnet to see how well it performed.

On the iPhone, I would say that it's OK at best. The main issue as far as I can see is that on the iPhone, it doesn't actually stream. It downloads the song to the device and plays it from the local memory. However, it only seems to download the song that you're playing and the next song on the list. This is fine when you've got a stable signal (and unlimited cellular data!) but not so good when you don't. I was walking for about 15 minutes before the signal degraded to the point where it wasn't able to download the music quicky enough and playback stopped.

It also downloads-and-plays when the thing is on WiFi too and even on WiFi this seems to be a pretty poor experience. I have an iPod dock in my kitchen which I use for playing music or internet radio when I'm cooking. Sometimes it manages to download songs, sometimes it doesn't. It's quite frustrating to be listening to an album and have it cut out half way when you're enjoying it! I've found it better to use the shared iTunes library feature and connect to the iTunes library on my Mac which is a bit of a shame because you can't use Genius on a shared library.

The final test was at work, iTunes Match seems made for the job here! At work we have virtually no cellular signal and I didn't want to be killing my phone's battery at work downloading and playing music. I decided to install iTunes on my work PC (running Windows 7) and give it a go.

iTunes on Windows has always been pretty bad but I didn't realise how bad until now. There are two problems:

1. It plain does not like folder redirection onto networked drives. Running iTunes with my network account made it unstable, it was constantly forgetting its settings and it frequently wouldn't connect to the iTunes store
   
2. It doesn't support transparent NTLM authentication on proxies so it's constantly asking for authentication on the proxy. And i mean constantly. Mozilla and Google can get transparent authentication working with their browsers but you can't Apple. Why is this?
   

Problem 1 was solved by creating a local account on the PC and running iTunes from that using the RunAs command. Problem 2 was solved Cntlm, a rather handy piece of software which as a authentication proxy to your proxy. Cntlm handles the NTLM authentication for your proxy by acting as a proxy on your local machine and forwarding the traffic with the appropriate authentication headers to your main proxy. The local account IE proxy settings were set to localhost:3128 and proxy authentication issues were vanquished! Once these issues were solved, iTunes match worked brilliantly. I had almost instant access to my music collection, no pauses or stutters and it actually streamed instead of downloaded the music so nothing was stored on my local PC apart from the album art cache. I can't really lay the blame for the problems I had at work on the service but the software is pretty shoddy.

So in conclusion, the service is good but it needs work. On the AppleTV and on a standalone PC or Mac with a direct connection to the internet, it works very well. It could work better on the iPhone. On a networked PC with a managed internet connection it required a bit of messing about but I got there eventually. Yay!