Head has asked if its possible to get her a Mac for our windows network.

[TwistedHelixis]

At one of my primary schools the head has asked if we can buy her a Mac to replace her Windows laptop, and I do not know enough about Macs to give her a good answer.

 

Am I correct in thinking it would be more of a standalone system (yes it can connect to AD for sign in), but if I needed to make any changes such as changing the proxy certificates or similar, I would need to do this on her laptop rather than deploying from the schools Windows server.

 

She is only in the school for a day or so each week and never has time for me to check her Windows laptop, so needing access to her laptop even more is not going to be an option.

 

Any advice?

[synaesthesia]

If she is only there for a day a week, surely her priorities are in the wrong place. My answer would be a stout sorry, but no; having multiple systems like that without any actual need for it is causing more work than necessary, opens up to potential security issues as you may not be able to monitor that one or keep it updated etc. Shiny-shiny-no-brainy syndrome.

[3s-gtech]

In that situation it will be pretty much standalone unless you use a cloud MDM to manage it (getting a Mac Server for one device is a bit mad). Won't really make sense to join it to AD IMO as you don't want connection issues off-network. She should still be able to connect to network resources like shares etc.

[sted]

if you have an rds server just install the rdp app on the mac and its basically a windows box. Yes you can manage apple clients on a windows network but you need a mac to do it with and install the macos server app it wont take gpos but you can apply policies to a mac from that but my experience is its not as reliable about settings as ad. It would probably be better to find out why she wants a mac and address that. tbh if shes only in the building once or twice a week im not sure an ad joined laptop is the answer anyway (or more than some very basic settings) you might be better off looking at workfolders and or direct access with no domain/minimum domain policies applied

[pcstru]

At one of my primary schools the head has asked if we can buy her a Mac to replace her Windows laptop, and I do not know enough about Macs to give her a good answer.

 

Any advice?

 

They are significantly more expensive as outlay than a windows laptop, so I'd query the purchasing policy (what happens when others ask for a Mac) and I'd advise that we have a much more limited ability to offer expert support and that offering such support for one off devices is inefficient. However, given it is the Head, they are the decision maker and are responsible and accountable for all things in the school, so I'd try and offer 'wise council' (including responsibility for DP issues (encryption etc)) rather than dictate. A compromise we might be able to do here, would be to treat it essentially as BYOD.

[Joanne]

If I were in your situation I would explain to the head teacher that it would be a standalone machine and that she can connect to shares. I personally wouldn't bind it to AD if she is out of school a lot. Also explain that you aren't confident with macs and she would have to install software / manage it herself.

 

If she's fine with that, let her buy one. Macbook pro's are far superior to any laptop IMO... dat touchpad tho!!!!! At the end of the day she is in charge of the budget... I wouldn't worry about that aspect of it, because you aren't paid to!

[jthompson]

If everyone else in the organisation is using Windows, I'd say that they need to demonstrate at least some reason for wanting to go so far off-piste. What are the actual advantages that they've identified? Can they give real examples to show where it's been necessary in the past?

[LeightonJames]

I'm currently working on getting Windows 10 running on Macbook Pro's as the sole OS.

 

The staff don't know how to or have any interest in using MacOS. So instead of the machines sitting in a corner gathering dust and me having to repeat myself every week and explaining how to boot the Mac into Windows I looked into this option.

 

MacBooks use something called BIOS emulation which is what BootCamp uses when you boot into the Windows Partition. Because of this you need to force the install to run in BIOS mode and this involves removing Apple's protected EFI partition and converting the drive partition table from GPT into MBR. This forces the install to run in BIOS mode and allows you to install all the hardware.

 

You can install Windows 10 on a GPT partition table on the MacBook but you will not have any sound ecause of the BIOS Emulation issue. The Sound Card is presented as an Intel HD Audio chipset in Windows 10 GPT mode however if you booted using BootCamp it is presented as a Cirrus Logic Chipset!

 

******BACK ON TOPIC*****

 

I would avoid the use of a macbook for the Head, more problems than they are worth in the long run. Yes they look nice, however as you are not confident with the OS you will spend a lot of time fumbling round in the dark trying to resolve the issues you will undoubtedly face whilst the device is being used.

[elsiegee40]

If I were in your situation I would explain to the head teacher that it would be a standalone machine and that she can connect to shares. I personally wouldn't bind it to AD if she is out of school a lot. Also explain that you aren't confident with macs and she would have to install software / manage it herself.

 

If she's fine with that, let her buy one. Macbook pro's are far superior to any laptop IMO... dat touchpad tho!!!!! At the end of the day she is in charge of the budget... I wouldn't worry about that aspect of it, because you aren't paid to!

 

The biggest issue is backups!

 

The head has to realise that if this machine isn't managed by the school it's a risk. I wouldn't let the Head manage it themselves - the GDPR risks are huge! Lots of sensitive data on a potentially insecure, poorly maintained, not backed up machine.

 

The more I think about it - don't go there!

 

If this machine comes in and connects to the network shares then it must be secure.

 

The arguments need to be had about cost/benefit and best use of your time. The size of the GDPR fine can be used to help you

Edited December 7, 2017 by elsiegee40
Put the GDPR letters in the right order

[Joanne]

Keep forgetting about GDPR! *facepalm*

[bossman]

@TwistedHelixis

 

As @elsiegee40 has stated it is a matter of GDPR concern and you should also put this in an e-mail so you have written proof as HT seem to think they always know best in any situation and will try to brow beat any minion into submission,

 

Stick to your guns

Edited June 20, 2017 by elsiegee40
Put the GDPR letters in the right order

[strawberry]

Good points above so I'll do a brief list.

1. Conflicting settings, if they work elsewhere things like proxies become an issue

2. Data protection , is it secure?, is it backed up?

3. Cost analysis, worth asking if there is a business case for it as an alternative might be better

4. Software compatibility, will it run all the reporting software and accounting software they need

5. Software costs, you may need difference licenses.

6. Hardware compatability , will it sit on your wireless, what about printing?

7. User training, does the head know how to use a mac in a mixed environment? (Ie know not to send pages files via email)

 

Worth showing them other shiny shiny to see if they take the hint.

[Blue_Cookeh]

Look at the HP Spectre X360 models if she wants shiny shiny.

[asc]

Good points above so I'll do a brief list.

1. Conflicting settings, if they work elsewhere things like proxies become an issue

2. Data protection , is it secure?, is it backed up?

3. Cost analysis, worth asking if there is a business case for it as an alternative might be better

4. Software compatibility, will it run all the reporting software and accounting software they need

5. Software costs, you may need difference licenses.

6. Hardware compatability , will it sit on your wireless, what about printing?

7. User training, does the head know how to use a mac in a mixed environment? (Ie know not to send pages files via email)

 

Worth showing them other shiny shiny to see if they take the hint.

1. On a mac you can setup locations. So you have a school and home profile. One with the proxy enabled and one without

2. An out of the box Mac is more secure than your average PC. Since ~2015, full disk encryption (fire vault) is enabled by default when you setup the laptop. You have to actively untick it if you don't want it. The OS is inherently more secure thanks to being *nix based, most viruses are built for PC. Macs will update automatically unless you tell them not to. In my experience my mac updates are far more reliable than windows updates which sometimes hang or fail to install

3. for the ease of use, OS and security. It's worth the money in my humble personal opinion

4. If you use Office365 for email you get Office for Mac as a free download. If you're GAfE then you're probably standardised on google apps anyway so may not even need a traditional office suite.

5. no comment. All I can think of off the top of my head is something PC only like SIMS but ours is hosted in RDP anyway so it would only be a case of installing RDP client on her mac.

6. I've never heard an issue of a wireless network only 'liking' PCs and objecting to Macs. Windows print servers interface perfectly with OS X. I print to our 2008r2 print server daily via my mac.

7. She's likely asking for it because she uses a Mac at home and hence is better 'trained' in OS X than Windows.

[synaesthesia]

Still, it's money paid to educate the children being spent on shiny-shiny-no-brainy.

[jthompson]

5. no comment. All I can think of off the top of my head is something PC only like SIMS but ours is hosted in RDP anyway so it would only be a case of installing RDP client on her mac.

 

On this point specifically, bear in mind that the MS Remote Desktop app for iOS, macOS and Android will store the Windows user's credentials, so the head's access to SIMS (if the school uses that and makes it available via RDS) would be wide open to anyone sitting at her unlocked MacBook: they would not be prompted for her domain credentials. We make users read through a big fat warning in the support guides we provide for setting up the MS Remote Desktop app.

[Norphy]

I'm currently working on getting Windows 10 running on Macbook Pro's as the sole OS.

 

The staff don't know how to or have any interest in using MacOS. So instead of the machines sitting in a corner gathering dust and me having to repeat myself every week and explaining how to boot the Mac into Windows I looked into this option.

 

MacBooks use something called BIOS emulation which is what BootCamp uses when you boot into the Windows Partition. Because of this you need to force the install to run in BIOS mode and this involves removing Apple's protected EFI partition and converting the drive partition table from GPT into MBR. This forces the install to run in BIOS mode and allows you to install all the hardware.

 

You can install Windows 10 on a GPT partition table on the MacBook but you will not have any sound ecause of the BIOS Emulation issue. The Sound Card is presented as an Intel HD Audio chipset in Windows 10 GPT mode however if you booted using BootCamp it is presented as a Cirrus Logic Chipset!

 

 

That depends on the age of the Mac in question. It's certainly like that with a 2012 MacBook Pro I had. It's not like that with the 2014 Retina MacBook Pro I'm using at the moment. I installed Windows 10 in EFI mode and all of the hardware works.

 

On topic, by and large I agree with all of the posts here. Unless she has a demonstrable need for a MacBook, I would avoid getting her one. If she wants something a bit more slimline than your average Windows laptop, you could do worse than look at the Asus Zenbook line.

[Brimstone]

On this point specifically, bear in mind that the MS Remote Desktop app for iOS, macOS and Android will store the Windows user's credentials, so the head's access to SIMS (if the school uses that and makes it available via RDS) would be wide open to anyone sitting at her unlocked MacBook: they would not be prompted for her domain credentials. We make users read through a big fat warning in the support guides we provide for setting up the MS Remote Desktop app.

 

Then configure the MacBook with a time out just like a Windows PC!

[Brimstone]

The biggest issue is backups!

 

The head has to realise that if this machine isn't managed by the school it's a risk. I wouldn't let the Head manage it themselves - the GDPR risks are huge! Lots of sensitive data on a potentially insecure, poorly maintained, not backed up machine.

 

The more I think about it - don't go there!

 

If this machine comes in and connects to the network shares then it must be secure.

 

The arguments need to be had about cost/benefit and best use of your time. The size of the GDPR fine can be used to help you

 

One answer, try and google it - File Vault

Edited December 7, 2017 by elsiegee40

[jthompson]

Then configure the MacBook with a time out just like a Windows PC!

 

Whilst that would be a sensible thing to do, it wouldn't solve the problem that I described.

[Snoochieboochies]

It's difficult to justify the cost of an iShiny when it's going to be predominantly used for word processing and emails.

 

I suspect that she wants it so that she can show it off when meeting up with other headteachers.

[strawberry]

she can show it off when meeting up with other headteachers.

I'd bet a bag of cookies that they have seen another head with one and think that all heads should have one.

[witch]

All the HTs around here seem to have iPads. My own HT bought his own though

[TwistedHelixis]

All the HTs around here seem to have iPads. My own HT bought his own though

 

Not sure if that's an OK thing. We had to buy our Clark to the Governors a laptop as she had confidential info that should not be on personal devices, I assume heads are no different. What if they leave, how do you make sure no data has left the school?????

 

Have I got that wrong?

[witch]

Not sure if that's an OK thing. We had to buy our Clark to the Governors a laptop as she had confidential info that should not be on personal devices, I assume heads are no different. What if they leave, how do you make sure no data has left the school?????

 

Have I got that wrong?

 

Probably not - but the iPad isnt on my network and he doesn't access SIMS from it either so there is a limited amount of confidential stuff there. He tends to make meeting notes and transcribe it to his work laptop.

TBF we don't have any encryption and I am sure quite a few teachers work on their home laptops anyway