Mac Server -- A Complete Beginner

[Ramzon]

Hi all,

 

Around 4 years ago we purchased a Mac solution from a third-party which consisted of 16 iMac clients & a Mac Mini as a Server. These were setup by the third-party and a mac-savvy colleague who no longer works at our school. The Macs were bound to our Windows Server Active Directory so that the students could log in with their normal credentials.

 

This solution has worked perfectly fine for the past 4 years up until recently – our mac server has been showing signs of dying and becoming unreliable. Our colleague who was skilled with Macs left around 2 years ago and it had been the intention of myself and our Network Manager to train ourselves to compensate for this drop in a vital skill-set, though because of time / budget / 1million other things to do, this unfortunately never happened. We currently have a support contract that is unable to help us because the Operating System that is running on the Server is too old (Mountain Lion).

 

With the summer holiday coming up, we have decided to abandon the current Mac Server which was configured by a third-party and completely re-do our Mac Network ourselves. Fortunately, we inherited a decently specced iMac that we can use as a new server. Our goal is to run a Mac solution that we fully understand and are familiar with.

 

Our goals for this project can be encapsulated by these 3 bullet points;

 

 

• Upgrade the inherited iMac to the latest Operating System, install MacOS Server and have this replace our old Mac Server. We would configure all the basics as needed then we will be primarily looking at Open Directory & Profile Manager.
  
• Create an image of a Client iMac after it’s had an Operating System upgrade as well as all the software that students require. It will also be bound to our AD Server, same as before, so that students are able to log in with their network credentials. I want to ensure that this client can be fully controlled by the Server Mac. This image will then be deployed to all the client iMacs
  
• Have a reliable backup system (most likely Time Machine)
  

 

Our skills are predominately with Windows systems though we hope that seeing this project through, with the acknowledgement it may be a bumpy journey, will be greatly rewarding.

 

I would be extremely grateful to anyone willing to help in what I would see as a “Help the noob” style thread. I will (and have already started) going through the process of setting up the Mac Server & all the clients over these next couple of weeks (over Summer) and will get stuck from time to time – when this happens I’d love for this thread to be my go-to place should a portion of googling not resolve the issue.

 

I am currently at the stage where I have upgraded the New iMac server to the latest version of Sierra and installed MacOS Server. I have set a static IP address and given it a Host Name and have tried to create a new Open Directory domain, but I am met with the following error when trying to create a Directory Administrator;

 

"This computer's host name is invalid. The host name does not resolve to any configured address of this computer. Please ensure the host name is correct."

 

Google-fu hasn't helped me with this one so far -- does anyone have any ideas for this?

 

Thanks for reading.

 

Kind regards,

 

Nick

[Oddbod]

It will be your dns records at fault here.

Window Server copes with incorrect dns records or domains set to local.school.org.uk but mac servers prefer correct AD records.

Does the new mac server have a OU entry set on your windows domain controller?

 

When you pull up a terminal window from Mac ( in Macintosh HD/Applications/Utilities/Terminal )

and type: host

 

do you see it correctly resolve to an address in your domain controller?

eg: host 192.1.1.10

$ 10.1.1.192.in-addr.arpa domain name pointer macserver.school.org.uk

 

and when you type at the terminal prompt:

host macserver.school.org.uk

 

does it correctly resolve to the static ip address set for the server?

eg: host macserver.school.org.uk

$ host macserver.school.org.uk has address 192.1.1.10

 

Until this address resolves correctly both ways, the Directory Administrator you're creating on the mac server will not be able to create an OD domain.

[AntonioRocco]

As mentioned your issue is DNS. Unless you pre-create appropriate A and PTR records for the hostname and IP address reserved for your server, nothing will work, if at all.

 

However it does not end there. You should also avoid the use of .local for the TLD of your domain. If your AD domain is built around this then you will have issues as .local is reserved for Bonjour services (multicast dns) and can't be removed or bypassed as it used to be in earlier versions of the OS. However your mileage may vary?

 

As an example if your domain is some school.local you will have problems. If it's something.someschool.local not so much, or maybe not at all? If it's not using .local then you should be OK? Just as long as the mac server and clients are referencing your DCs as their DNS and NTP servers.

 

I applaud your determination in doing this yourselves but sooner or later you will benefit from some site specific training. Attending Mac specific training courses is fine up to a point but none of them will mention the trials and pitfalls of Active Directory integration in any detail if at all.

 

Finally Open Directory is fundamental to how well Profile Manager works. The two go hand-in-hand and you can't have one without the other. Profile Manager does not work well (if at all) behind a proxy.

 

Hopefully this may help?

Antonio Rocco (ACSA)

Edited July 6, 2017 by AntonioRocco

[Brimstone]

Some pointers and guides here...

 

Despite what people will say on here Apple no longer support network based user accounts, that is users connecting to their shares via AD and working across the network. Apple's Open Directory is awfully broken so I would not go near it either.

 

You can still bind Macs to AD so users authenticate via AD but you have to use "Force local home" so that the Mac creates an empty local home directory. This means users have to go back to the same Mac everytime they use it. N.B. If you are using Google or One drive with enough bandwidth then users can log in and upload content to their own drive which gets around the problem of having to use the same Mac.

 

You would use some backup software on the Mac Server to back up users home directories to a Windows server or cloud.

 

As said about your Mac Server needs a FQDN to fully resolve itself, you should treat Profile Manager as an MDM server just to apply profile restrictions to the Macs, the guide below should help you.

 

http://help.apple.com/serverapp/mac/5.3/#/apdAC95F5C4-27AA-4378-8BB9-95A79A64AB5D

[XiJ]

I've come to the conclusion that open directory and profile manager are awful. I've mainly abandoned them in the last month. I use an AppleScript to log on, find the shares in the server to mount.

 

I've installed Munki to deploy updates - so far only flash but I'm looking to expand that.

 

Finally i strongly recommend deploystudio to deploy your master image. It will let you take an image of your master then NetBoot your clients to deploy that master. You can rename / add to the domain on the same workflow.

 

I've been using macs a while but deploystudio and munki were brand new to me but easy to understand / implement.

[AntonioRocco]

In addition to the good points made in XiJ's post it's important to make clear that DeployStudio by itself cannot NetBoot mac clients. NetBoot is a service provided by the Server.App which you will still need regardless of whether you decide to use Profile Manager or not.

 

I have to say in Profile Manager's defence that it is not all that bad once you realise its limitations. Think of it as one corner of a well rounded mac management system that includes ARD, Munki or Reposado, DeployStudio or any one of a number of MDMs available which Apple's Profile Manager is just one of. Although deprecated for a long time now even WorkGroup Manager (although clunky and unreliable on the newer OS) can still be used in a limited way.

 

Antonio Rocco (ACSA)

[XiJ]

Yes I didn't quite phrase that right. Deploystudio helps you create a net-bootable image. OS X server has a NetBoot facility.

 

I found that that profile manager was a bit flakey at delivery profiles. But to be fair we did have another Network issue causing chronicly slow network traffic.

[MatthewL]

May or may not be of use but I understood you could install Mac OS in a virtual environment now and run it as a typical mac server giving you that redundancy if you have it.

[XiJ]

May or may not be of use but I understood you could install Mac OS in a virtual environment now and run it as a typical mac server giving you that redundancy if you have it.

 

Only on Mac hardware I believe. Unless that has changed too.

[AntonioRocco]

@ XiJ

 

Yes you're correct. OS X Systems Software (server or client) is only licensed to run in a virtual environment on Apple hardware. That does not mean to say it won't run on other hardware although you do so at your own risk and you lose all support if you have a problem. In practical terms it can be difficult to do and if you managed to get installed in a VE on non-Apple hardware it's slow and unreliable. My view is why bother attempting it when any virtualised server software (Apple, Microsoft, Linux etc) runs well on Apple hardware.

[3s-gtech]

That's still the case. Not sure what Mac hardware would be suitable for virtual hosting now - I guess a Mac Pro but the drive configuration isn't ideal. A very late XServe will also run Sierra when patched, that would make a good host but they're old now.

[XiJ]

Yep I ever really saw the point to be honest - not in a school / primary environment. It would be nice for testing. I do have a OS X VM running on a win machine - buts is slow and unreliable. It wouldn't go near a school!

[Ramzon]

Thanks very much for the quick & detailed responses. You’ve all given me a lot to think about!

 

I had set the Windows Server DNS lookups for the Mac Server’s static IP address and name it should resolve to. AntonioRocco, your suggestion got me looking in the right place - turns out I had simply named the Mac Server host name as “school-mac-server.local” when it needed “school-mac-server.[windows domain name here]” – Thank you!

 

DeployStudio is what we had installed to the old Mac Server, I had only ever used it once but it seemed to work very nicely – I’ll look into this again for the new Mac Server. Failing that, I was also going to look into Clonezilla.

 

After reading all your comments I feel the combination of Profile Manager, Open Directory & binding the Mac clients to our Windows AD Servers may give me some grief – is there anything that trips people up that I should look out for? Next week, I’ll try and get to the stage where I can log into a Mac Client as a student user & have my access restricted via Profile Manager – I’ll keep this thread updated with my progress / woes!

 

Again, thanks very much for all your replies – they are much appreciated.

 

Have a great weekend,

 

Nick

[GrumbleDook]

I'd also recommend joining the MacEnterprise mailing list ... Mailing List - MacEnterprise ... as a handy resource.