Some help with Macs please!!!

[mike86]

Hi all,

 

We've just bought 14 imacs for our music dept & i'm the lucky one that gets to install them. With the help of google i've managed to get them set up & on the domain, however I would like to lock them down for the student and staff users.

 

At the moment when a student logs on they can see every pc in the school in finder, remove items from the doc, change their proxy settings etc...I know this is going to be a world of pain come september, so any help would be much appreciated.

 

Just to mention we haven't got a mac server & the boss isn't too keen on running it on one of the iMacs in the music suite.

 

Thanks

Edited July 26, 2013 by mike86

[rush_tech]

I think the cheapest way to do it is to use a mac mini with mac server installed

[mike86]

Thought that might be the case,if i put os x server from the app store on one of the iMacs, would it still be usable by the students or do you need a dedicated server machine?

[APMerry]

Thought that might be the case,if i put os x server from the app store on one of the iMacs, would it still be usable by the students or do you need a dedicated server machine?

 

I wouldn't let a student login to the server. Most restrictions can be done from the server, although they are more difficult to lock down than windows PCs.

[Tricky_Dicky]

Instead of buying a Mac Mini server (which is the best way, but obviously has a cost) Have a look at Meraki as it's possible to use that to control Mac desktops as well as iPads.

[seawolf]

Implementing Macs without using Managed Preferences or Configuration Profiles is like having PCs with out GPOs to configure policies. I would suggest you buy a Mac Mini (used or new) and run Server.app on it. Don't try setting it up on me of the client Macs. And either do a training course on Mac server, buy a book on it, or hire someone to help. If you don't do it right you will suffer. Just as you would if you didn't know how to setup an AD server and GPOs to configure your PCs.

[APMerry]

Implementing Macs without using Managed Preferences or Configuration Profiles is like having PCs with out GPOs to configure policies. I would suggest you buy a Mac Mini (used or new) and run Server.app on it. Don't try setting it up on me of the client Macs. And either do a training course on Mac server, buy a book on it, or hire someone to help. If you don't do it right you will suffer. Just as you would if you didn't know how to setup an AD server and GPOs to configure your PCs.

 

Not gonna get much better advice than that.

[pantscat]

Instead of buying a Mac Mini server (which is the best way, but obviously has a cost) Have a look at Meraki as it's possible to use that to control Mac desktops as well as iPads.

 

This is good advice - and worth investigating if money is tight for a Mac mini server.

 

When I first deployed Macs here a couple of years ago I got a Mac Mini server too and used that to configure "Managed Preferences" in order to lock down the Macs.

[SovietRussia]

We use a Mac Mini server, but we opted to use Workgroup Manager which is an old technology for managing < Lion devices. But now-a-days, you are supposed to use Profile Manager to lock down clients.

[seawolf]

We use a Mac Mini server, but we opted to use Workgroup Manager which is an old technology for managing < Lion devices. But now-a-days, you are supposed to use Profile Manager to lock down clients.

 

WGM is still available for Mountain Lion (http://support.apple.com/kb/DL1567) and can be used for managing 10.8 clients instead of Profile Manager. I doubt that will continue to be an option in 10.9, but Apple will probably give us some very good reasons to finally ditch WGM in 10.9. Right now, Profiles don't quite provide all of the capabilities or reliability of the old Managed Preferences, but it looks like Profiles are about to become a bit more mature and comprehensive.

[seawolf]

One thing I left out of my first post is that I would also strongly recommend buying Apple Remote Desktop along with using a Mini server. ARD rocks and can be used with PC or Linux clients over VNC as well. You can do a tremendous amount with ARD including installing software, running scripts and UNIX commands and a lot more. I wish MS would give Remote Desktop even 1/10 of these features for PCs.

 

 

http://youtu.be/zaptMf5I1xQ

[SovietRussia]

WGM is still available for Mountain Lion (Workgroup Manager 10.8) and can be used for managing 10.8 clients instead of Profile Manager. I doubt that will continue to be an option in 10.9, but Apple will probably give us some very good reasons to finally ditch WGM in 10.9. Right now, Profiles don't quite provide all of the capabilities or reliability of the old Managed Preferences, but it looks like Profiles are about to become a bit more mature and comprehensive.

 

Yeah, we use WGM to manage our 10.8 clients, it seems to work fine except for Proxy support, which it seems to loose. Bit odd - We tried to switch to Profile Manager, and found LOTS of features missing, so we reverted back.

[mike86]

thanks guys,

 

I've put the server apps on one of the iMacs to have a "play" & booked on a course in August.

 

Had a look at the meraki seems ok for iOS but couldn't really see a way of locking down macs, unless I'm looking in the wrong place?!

[mike86]

Is there any reason (other than the obvious, its a server don't let kids near it) why not to keep this on a client machine?

[seawolf]

Is there any reason (other than the obvious, its a server don't let kids near it) why not to keep this on a client machine?

 

Can you guarantee that your chosen client (server) machine will never be turned off? Will it have UPS protection and be backed up regularly? What if you need to make client config changes while the iMac is in use, could you? Would you ever consider doing this in a Windows environment?

 

If the answer is no to ANY of these questions then there is your answer.