If you haven't already, I strongly suggest you read my previous blog entries on this subject. This avoids me having to re-hash what I've already said! They are:

http://www.edugeek.net/blogs/norphy/1982-adventures-macland-my-experiences-configmgr-2012-macs-part-1.html

http://www.edugeek.net/blogs/norphy/1984-adventures-macland-my-experiences-configmgr-2012-macs-part-2.html

http://www.edugeek.net/blogs/norphy/2010-adventures-macland-my-experiences-configmgr-2012-macs-conclusion.html

http://www.edugeek.net/blogs/norphy/2153-further-adventures-macland-parallels-sccm-agent-few-months-later.html

Anyway, another update to the Parallels Mac SCCM Agent (PMA) has been released. And this is a pretty big one, not that you'd guess that from their release notes. The big changes in the software are:

• Application Portal for Mac

• Report Mac warranty (AppleCare status)

• Support for FileVault 2 Personal keys

• Escrow personal FileVault 2 keys

• Support for PKI/HTTPS infrastructure

This addresses my big two complaints about the Parallels agent: It now supports HTTPS infrastructures so if you're running HTTPS on your infrastructure, you don't need to have a separate DP and MP for your Macs any more. Secondly, there is now an obvious and visual indication of the software that has been allocated to the machine. Software installs can also be delayed and restarts can be enforced (or not). The PMA will also detect whether the software is installed on the machine or not before it attempts to install it. This is a huge improvement over what they had before.

So how have they done this and what does it look like?

A previous update to the agent gave us a Preference Pane which looked like this:

To be honest, it doesn't do very much for you. It gives you a visual indicator that the client is installed and that it's getting policies but not much else. It's still there thankfully (with a useful additional button which lets you trigger a client policy update from the Mac instead of having to do it from the SCCM console) but there is now an additional application called the Parallels Application Portal. This is their equivalent of the Software Center built into the Windows SCCM client. It looks like this:

Much like Software Center, it tells you what software has been assigned to the Mac. It lets you kick off software installations manually and it tells you when the software was installed. It supports optional installs as well as enforced ones and it detects whether a piece of software is installed even if it wasn't the PMA that installed it.

To do this, Parallels have started using Applications in the same way that the native Microsoft client does. This means that you have to download the Mac ConfigMgr tools and use the CMAppUtil to repackage the software into a format that the ConfigMgr console can understand. The extension is .cmmac, it's just a refactored ZIP file with an XML file and the PKG\MPKG\.app file in it. You could probably put one together yourself if you were feeling brave enough. When you create the cmmac file the repackaging software looks at the installer and it creates some detection rules which it uses to see if the software is installed or not.

The following paragraph is all supposition on my part but it explains the facts as I see them. Parallels seem to have created an extra service for the Mac side which runs an inventory of installed software. This agent scans the /Applications and /Library folders and looks for Info.plist files. If it finds one, it scans it and adds it to a database of some description. The agent then compares what's in the detection rules in your application on the ConfigMgr server with whats in the database on the local Mac and marks applications as installed depending on whether there's a match or not. This seems to work nicely but there is a caveat.

As I said above, when you create the cmmac file there is some kind of voodoo built into the packager which scans the installer or .app file and plumbs the detection rules into the cmmac file for you. When you create the application on the ConfigMgr server they all just automatically appear. Job done, right? Possibly not. When you create a cmmac file from a pkg file, it puts in loads of detection rules and generally speaking they're all and rules. When I created an installer for the latest Office service pack, the list scrolled; there must have been at least 15 rules in there. Unfortunately the Parallels agent doesn't seem pick up all of the things that the detection rules are looking for so if you leave the detection rules as they are, the Application Portal doesn't mark the software as installed. You therefore have to go in and either trim them down or create them from scratch. (Thinking back on it, it's quite possible that the native Microsoft agent had the same problem as it had a very annoying habit of trying to reinstall software that it had already installed) I've also come across a couple of packages which either sit in a location which the PMA doesn't index (such as /opt) or that have info.plist files that the agent can't or won't index (Oracle's Java is the main one here).

Using the same format for applications as the native client does means that one of the criticisms I had for the native client now applies to the Parallels client as well, i.e. apps need repackaging. This is a bit of a shame but I think the advantages that it brings outweighs the negatives. You can still add applications as packages if you want but just like with Windows clients, if you do the client has no way to detect whether the software is already there. Anyway, it makes perfect sense for Parallels to use the mechanisms which are already in place for their agent. Why re-invent the wheel?

As for the other new features, I'm not running HTTPS on my infrastructure any more so I haven't tested the agents ability to run in HTTPS mode. I have no reason to think that it wouldn't work. You still need to have a DP which can be connected to anonymously so therefore you may need to have separate DPs for your Macs if you want your main DPs authenticated against.

The warranty status check works as described. It shows up in the system's inventory, it's a useful thing to have as you don't have to go back to the Apple website to check on a Mac's warranty. I'm not running FileVault on any of my Macs so I haven't tested the FileVault features.

So yet again, Parallels have improved their app and it keeps on getting better. The only thing that I'm really pining for now with the agent is customisable task sequences for OSD. Don't get me wrong, OSD works but it would be nice for the entire process to be automated rather than the two step process I'm having to use at the moment.

I think I need to revisit my advantage/disadvantage list from my third post too. It goes like this:

So in the blue corner, we have the Microsoft native client. Its advantages are:

Native Solution

• No additional Cost
  
• It's a native solution
  

Disadvantages are:

• Treats the Macs as mobile clients so therefore requires the use of HTTPS secured MPs and DPs
  
• Not especially stable
  
• Takes a long time to install multiple applications
  
• It took them four full months after the release of SP1 to start supporting Mountain Lion. Microsoft have apparently made a commitment to supporting new versions of OSX within six months. However, considering that OS X is on a yearly release cycle that doesn't really do anyone much good. Looking at their CU release notes, it took a fair while for Mavericks to get supported too and Yosemite isn't at the moment.
  
• No remote control client
  

In the red corner, we have Parallels. Its advantages are:

• Supported Mountain Lion and Mavericks right off the bat and according to their developers they'll attempt to get support for new versions of OS X within thirty days. Yosemite isn't "supported" as of 10/11/2014 but it works.
  
• Doesn't require HTTPS support inside your ConfigMgr infrastructure
  
• Has proven to be more stable
  
• You Don't need to repackage applications (but you probably should)
  
• Simpler to create settings to deploy to the clients by using .mobileconfig files
  
• Remote control client included
  
• Supports SCCM 2007 if you're still running that
  
• Has an equivalent to Software Center
  
• Can perform operating system deployment.
  

Disadvantages are:

• It's still VERY expensive. And you buy it on a yearly subscription too.
  
• Setting up packages is more complicated and needs more trial and error but this is negated with the advent of Applications.
  
• May need its own DP if you're not running your others in anonymous mode.
  
• You'll probably need another server to put the PMA Proxy on to. It didn't behave too well for me on the MP.
  

In terms of equivalency, they both seem to support DCM as well as each other and the inventorying is as good with either platform

In conclusion, if I were the product manager for System Center at Microsoft, I'd be going to Satya Nadella and saying "This plugin urinates all over our efforts from a great height. We need to drive a dump truck of money to Parallels HQ and acquire this product from them". It really is that good