Manage Macs

[minimoo]

I've been to a few of the London macadmin group meetups recently ( London Apple Admins) - in terms of the parallels / sccm stuff, observation I've made from comments seem to be the universities have stayed away from that route. There was a whole talk on some of this, and using the best product for the best job i.e. don't put your windows stuff on jamf and don't put your mac's on sccm (whilst you can, they just aren't as good for the task apparently) at the last meetup they had a few weeks ago was quite good on this topic. I'll try and find out where videos from that event are.

 

I know a reasonable about of linux, so went down the route of munki + and separate profiles/scripts for tasks I wanted to complete - has worked OK for us so far. Some of the guys behind https://datajar.co.uk/ seem to also attend the london meetups, and they offer a cloud based munki/jamf/mdm solution for management in several educational institutions

[Norphy]

in terms of the parallels / sccm stuff, observation I've made from comments seem to be the universities have stayed away from that route. There was a whole talk on some of this, and using the best product for the best job i.e. don't put your windows stuff on jamf and don't put your mac's on sccm (whilst you can, they just aren't as good for the task apparently)

 

It's a matter of perspective.

 

Possibly JAMF is a better Mac management product than the Parallels Mac Management plugin for SCCM but at the same time, it's another system to learn and to support. With SCCM, the PMM and InTune, the IT teams in my MAT and I can manage our Macs, Windows machines and mobile devices using a single pane of glass. We don't work for a university. The university I used to work for used to have a team the size of my entire MAT's IT teams just to look after its switching infrastructure. It had another team looking after its firewalls. It had separate teams looking after Windows and Unix server infrastructure. It had separate teams looking after Mac and Windows endpoint devices. And this was a relatively small university compared to some of the others in London.

 

At a school, we just don't have those kind of resources so the less products we have to learn, the better. As long as the product does the job we need it to do (and the PMM does), we're golden.

 

In my opinion.

Edited February 22, 2018 by Norphy

[Sheridan]

That's the thing, we're not talking about a lot of macs here, managing a dozen or so with WGM was simple and effective and didn't require any expense. Now we have to buy something because Apple have a) stopped supporting something that works and b) barely support something that has never worked

 

When it comes down to the crunch, I can'/won't justify the expense to manage some old Macs - they will stay on 10.9 until they die. Then they will be replaced with Windows based PCs. If PM had actually worked at all I would have updated them all and kept them for longer.

[ap_]

I've been to a few of the London macadmin group meetups recently ( London Apple Admins) - in terms of the parallels / sccm stuff, observation I've made from comments seem to be the universities have stayed away from that route. There was a whole talk on some of this, and using the best product for the best job i.e. don't put your windows stuff on jamf and don't put your mac's on sccm (whilst you can, they just aren't as good for the task apparently) at the last meetup they had a few weeks ago was quite good on this topic. I'll try and find out where videos from that event are.

 

I know a reasonable about of linux, so went down the route of munki + and separate profiles/scripts for tasks I wanted to complete - has worked OK for us so far. Some of the guys behind https://datajar.co.uk/ seem to also attend the london meetups, and they offer a cloud based munki/jamf/mdm solution for management in several educational institutions

 

Apologies for my post not being useful to the OP but for anyone else who is interested, we use dataJAR to manage our heavily used music/art/media Macs (approx 65). They provide an exceptionally good service using JamF and their own custom tools. I would also say they are the most responsive supplier I have ever worked with and are exceptionally knowledgeable.Cost-wise, their support package easily pays for itself in terms of hours we would need to spend on mac builds, packaging and support in house.

[DalekSec]

Anyone here use mosyle, currently using the trial. Can't for the life of me work out the best way of enrolling them! Keeps saying they need to be assigned to users etc. but our Macs are in a suite..... Atleast with Zuludesk it was straight forward!

[kidpressingbuttons]

create a shared mac set and add them all into there depending on room ect Edited March 8, 2018 by kidpressingbuttons

[DalekSec]

create a shared mac set and add them all into there depending on room ect

 

I've created a shared mac group, went to enroll them. I'm guessing you go to the URL https://enroll.mosyle.com/****** but it comes back saying IP can't be found

[Brimstone]

Have used similar systems but not Mosyle I would guess you have to create a personalised enrolment invite for each user, bear in mind that MDM's work on a much better level where you have devices attached to users.

 

Jamf works by creating user accounts on each Mac with a hidden admin login when you need access to remotely or locally apply updates

[DalekSec]

Have used similar systems but not Mosyle I would guess you have to create a personalised enrolment invite for each user, bear in mind that MDM's work on a much better level where you have devices attached to users.

 

Jamf works by creating user accounts on each Mac with a hidden admin login when you need access to remotely or locally apply updates

 

Did have a look at Jamf but way to expensive for what we need. We only have the 10 Macs and there is a minimum purchase of 100!

 

The trouble i'm coming across is a lot of MDMs seem to be setup for 1:1 user to device where all ours are shared. So i don't want to assign users to devices i just want different profiles/restrictions for different AD groups

[Brimstone]

Did have a look at Jamf but way to expensive for what we need. We only have the 10 Macs and there is a minimum purchase of 100!

 

The trouble i'm coming across is a lot of MDMs seem to be setup for 1:1 user to device where all ours are shared. So i don't want to assign users to devices i just want different profiles/restrictions for different AD groups

 

You can do all this with Jamf, you can link the MDM with AD...and it's a myth that MDM's require a 1:1 environment. In a shared environment you need to set up a naming convention that works for you probably the same names as you are using now to identify them. I have schools with between 250-300 x iPads and 40-50 x Macs that are shared all named by department.

 

If you only have 10 x iMacs then I would create 2 user accounts per iMac 1 x Admin/Teacher, 1 x Generic Student. Students work locally and connect to AD share via script or manual connection to copy work back to AD Home.

[DalekSec]

You can do all this with Jamf, you can link the MDM with AD...and it's a myth that MDM's require a 1:1 environment. In a shared environment you need to set up a naming convention that works for you probably the same names as you are using now to identify them. I have schools with between 250-300 x iPads and 40-50 x Macs that are shared all named by department.

 

If you only have 10 x iMacs then I would create 2 user accounts per iMac 1 x Admin/Teacher, 1 x Generic Student. Students work locally and connect to AD share via script or manual connection to copy work back to AD Home.

 

I know you can do it with Jamf but it's way to expensive for just 10 macs. I didnt say they required a 1:1 just that the MDMs i've tested so far are all trying to get me to do that.

 

Managed to fix the Mosyle problem, was their end not mine! Finally got it enrolled and now to give it a play.

[kidpressingbuttons]

sounds like a filtering issue- works fine for me. I do have to specify a proxy address as my transparent doesnt like mosyle for some reason...

[DalekSec]

Got the LDAP setup fine now, the trouble i now have is as follows!

 

Settings up the restrictions so as a test i've applied to the Student group to disable the App Store and System settings. I've applied to the Staff group to disable the App store.

 

I login as the staff test user and App store doesnt work and the System settings do, great works fine

 

Login as the student and the app store doesn't work....but the System settings do. Basiclly the student is picking up the same as the staff user!

 

Applying it by ticking 'Assign to student devices' and 'all current and future students'

[Brimstone]

It probably not forum etiquette but I haven't read the entire post, have you guys not looked at DeployStudio, its free !

 

Deploy Studio won't image Macs with APFS

[ColinP]

If your a mixed enviroment, have you looked at the latest Microsoft intune? you can manage macs, pcs and tablets in one place.

[HereIGoAgain2601]

I have been running a fully integrated Mac/Windows network using profile manager as the mdm for the past 5 years. It wasn’t the easiest thing to setup, lots of bumps with the initial config but once it was setup it’s worked pretty well. We have had the occasional problem that can take hours to fix as no documentation and very limited support online, but could never justify purchasing a mdm solution when profile manager gave us what we needed. We had everything fully locked down with network mapping the home drives from AD to the docks etc.

 

Over the years I found it easier to do the majority of the customisation in a default user template and image with deploystudio. This limited the number of settings profiles to push out with profile manager as we did struggle sometimes pushing out things like chrome settings. That being said the Apple restrictions and environment came from the profiles, I just liked to add the extra personalisation that profile manager won’t give you.

 

Using profile manager, deploy studio and Apple Remote Desktop was everything I needed to run a reliable AD integrated network. We had around 120 Macs and 300 ipads on one Mac Pro server

 

Good luck! Happy to help if I can

[deano3693]

We've just recently moved over to MACiOS cloud via Counterpoint which is an online MDM for Macs - It uses Addigy behind the scenes but all seems to be working well and they are very good especially with a Shared Mac set up with Dual Home directories etc.

[Mustang]

I would never recommend a MDM solution for 10 to 20 static Macs, it just isn't cost effective.

 

Realistically how often do the settings change? once or twice a year at most, its pretty much set and forget so why pay for a MDM?

 

Apple profiles are every bit as powerful as mcx settings were in workgroup manager, they just aren't as easy to configure.

Also a mistake I often see is that people try and configure or lock down Macs as they would with windows, once you start thinking about how Apple has designed the device to be used (1 to 1 etc) then managing them becomes a little easier.

 

 

What settings are you looking to actually configure and lockdown??

[tg12]

I have been running a fully integrated Mac/Windows network using profile manager as the mdm for the past 5 years. It wasn’t the easiest thing to setup, lots of bumps with the initial config but once it was setup it’s worked pretty well. We have had the occasional problem that can take hours to fix as no documentation and very limited support online, but could never justify purchasing a mdm solution when profile manager gave us what we needed. We had everything fully locked down with network mapping the home drives from AD to the docks etc.

 

Over the years I found it easier to do the majority of the customisation in a default user template and image with deploystudio. This limited the number of settings profiles to push out with profile manager as we did struggle sometimes pushing out things like chrome settings. That being said the Apple restrictions and environment came from the profiles, I just liked to add the extra personalisation that profile manager won’t give you.

 

Using profile manager, deploy studio and Apple Remote Desktop was everything I needed to run a reliable AD integrated network. We had around 120 Macs and 300 ipads on one Mac Pro server

 

Good luck! Happy to help if I can

 

I think this is what I've found recently. Profile Manager is great once you get it working but it does take a lot of effort to get set up and running in the first place.