Anyone here switch from Windows, or is doing both MacOS & Windows?

[gregom]

I manage a little over 200 Windows laptops in Microsoft Active Directory for a juvenile detention school. Due to the fact we are a detention center the juveniles must have very restricted and monitored access to computers. We only use Microsoft Office apps and a bunch of whitelisted websites, that's it. For years Windows has been great, but since 10 came out we have been unable to maintain a the level of control we need because Microsoft's group policy and Windows 10 simply doesn't have the options.

 

We have considered Chromebooks, but don't want to invest in the Google ecosystem nor do we want to switch to Google apps. We are interested in MacOS, but am curious about the level of restriction and control we can place on the system. Does anyone here have experience with switching from Windows or is also running Windows in an AD with GPO environment? I am looking for some discussion and thoughts on how MacOS would compare for use in our locked down environment.

[XiJ]

Managing macOS with a server is a bag of hurt in my opinion. And I say that as a apple fan boi. However you may have more look with a decent mdm. My experience with MDM only really goes as far as iOS but it’s possible to lock those Down to a strict level IMO.

 

It may also be worth looking at an Mdm for your windows machines - intune perhaps. IMO windows and OSX are quickly heading towards MDM control rather than group policies.

[john]

I've been quite impressed with JAMF as an MDM / Mac Management tool so would say have a look at it. But I'd be saying due to how costly macs are vs pc and badly behaved students you could be better using pcs still

[kidpressingbuttons]

We have a 90% mac evironment here. Will 100% by the end of next year. Windows is taken care of the normal ways but we run the macs and ipads on Mosyle MDM

[gshaw]

3000 Windows machines, 330 Macs here.

 

We've moved to Jamf Pro for management now everything has gone to DEP as Apple's preferred deployment method. Good product but you also need to get handy with scripts and additional utilities for some of the more finicky bits.

[gregom]

Thanks for the responses, I might research some of these products mentioned but some of it seems cloud dependent which isn't something we are interested in.

 

Is anyone locking down their Mac's the the extent we have to lock down our Windows machines to? We prevent access to pretty much everything in the OS, we've broken the Start menu and locked them out of everything so all they can do is use a few apps we provide. They can't shut down the computer (unless they hard shutdown using the power button), logoff, lock, or sign into the PC. They can't right click on anything and have limited access in File Explorer.

 

Can you prevent access to the launch pad? The Apple menu? Log off and shutdown? Terminal?

[free780]

What in Windows 10 can't you lock down? Managing Windows is far easier than macs generally speaking.

[XiJ]

Why are you not interested in ‘cloud’ services.

There are some alternatives to managing Mac profiles - but the MDM services are much easier and more comprehensive imo.

[gshaw]

FYI Jamf Pro can be ran on-prem or as a cloud deployment.

[Stevecee]

Hi we have a 100% Mac client environment, we use Zuludesk to manage our Macs, I have used JAMF but the costs were prohibitive esp for setting up. I would say that JAMF has a fuller feature map and active support network of users, whilst I think that Zuludesk is catching up and I have had really good responses from their support team.

 

HTH

 

Steve

[bronan]

Have you looked into Parental Controls for those accounts? You can specify which applications are available and filter websites by allow list. It is certainly not an AD group policy management schema, however, if you are imaging the Macs you can include the user account in the image and deploy it to all Macs that would be available to your juveniles.

[ewanc1234]

You can do everything that Jamf can do with a collection of open source tools such as Munki and Puppet (puppet isn't necessary for most people but may be in your situation) which will give you most of the benefits (you would have to pay for an MDM such as Mosyle or simpleMDM) that you can host on side