MAC Hardening

[Fraserb82]

Hi all,

 

We have recently started to deploy Macs into one of our schools.

 

Unfortunately we are new to using these devices and I was hoping someone could point me in the right direction on what you all see as best practice for locking them down in a similar way we can do with Windows through Group Policy and the likes.

 

Any help would be greatly appreciated.

 

Thanks

 

Fraser

[LTurner3692]

Get yourself a Mac mini, Install the server app and use that, you can then use parts of that to lock the macs down!

[Arthur]

How many Macs do you currently have?

 

Best practice would be get an MDM. Apple's Profile Manager isn't a particularly good choice.

Edited January 7, 2019 by Arthur

[DalekSec]

Best practice like @Arthur said is an MDM, the Apple own MDM that you can get is VERY lacking in features, to the extent most people are ditching it. Depends a lot on how many Mac devices you have also.

 

We use Mosyle here, was nice and easy to setup let me know if you have any questions!

[kidpressingbuttons]

+1 for Mosyle 100+ macs here running using it .

[free780]

JAMF=Large outlay for training

Mostyle=Requires an inbound LDAP connection for ad authentication.

Profile Manager=Should work but can't deal with large ad user groups.

Intune=Very basic management.

It's so hard compared to the Windows side as a mac aimed at users who are technical and a 1:1 device.

[Arthur]

Mosyle=Requires an inbound LDAP connection for AD authentication.

Could you use the new Secure LDAP feature in G Suite to avoid having to do this?

 

• https://gsuiteupdates.googleblog.com/2018/11/secure-ldap-now-available-simplify-login.html
  
• https://cloud.google.com/blog/products/identity-security/cloud-identity-now-provides-access-to-traditional-apps-with-secure-ldap
  

[aarongulley]

You can either use an MDM or DeepFreeze which will keep a workstation in the state you created the snapshot in.. e.g If the user changes settings, once a reboot.. It will revert back.

 

https://www.faronics.com/en-uk/deep-freeze-mac_en-uk - as for an MDM.. JAMF is the way for mac management.