Mac Classroom

[Gongalong]

Hi folks,

 

Seemingly more for political reasons than good sense we may end up with a classroom of Macs.

 

My Mac experience is limited to setting up one or two standalone machines.

 

I've seen the pinned post, and also read about getting them to authenticate on a domain.

 

Our current Windows setup uses drive scripts and group policy. I don't suppose there's a 3rd party software solution out there that can take this and do the necessary on the Mac? Mostly the drive scripts, but I would like to lock down student accounts as much as possible.

 

Thanks

[XiJ]

The one Mac suite school we have I actually removed open directory from the Mac server and used some local scripts to mount drives. The directory service was just too flakey. Same for our experience with binding them to an active directory domain.

 

I’m a Mac fanboi but in my experience they just don’t work consistently on a domain.

 

The best way to manage them is an mdm. I recommend mosyle (premium for full experience).

[free780]

I've got Jamf and the main issue is they don't work as shared devices. If you assign them 1:1 and the user can connect to a share, add a mailbox etc they work. It's a lot harder in a lab environment particularly if you expire passwords!

[Sibrows]

We’ve got around 100 iMacs across the school in our creative subjects. My advice is to get someone in to se them up properly in the first place.

 

Our re-seller hosts the Jamf instance and manages them for us. There are issues as with any installation but we only need basic troubleshooting knowledge onsite anything else can be passed to them.

[Gongalong]

Thanks all for the replies.

 

Will jamf do things like map drives and integrate with AD?

 

What's the approximate cost for say 30 machines?

[free780]

I haven't got network connections working reliably. The pain point with jamf is the mandatory 2 training days. The minimum amount of Macs is 50. There is a ongoing annual renewal as well. It better than profile manager and doesn't require an LDAP connection over the Internet like Mostyle.

[sat_s]

I would suggest speaking to Jigsaw24. They are specialists in Apple and I have used them in the past to configure Macs to an AD

[Gongalong]

Reviews aren't great! https://uk.trustpilot.com/review/www.jigsaw24.com

[dhicks]

Will jamf do things like map drives and integrate with AD? What's the approximate cost for say 30 machines?

 

We use ZuluDesk - recently acquired by Jamf, costs around £5 per device per year, so around £150 a year in your case. Mac OS itself actually handles AD integration and mounting Windows shared drives, it's just easier to have that all configured by an MDM so setup is consistent across multiple devices.

 

What will the Macs be used for? If the plan is to use them for video / audio editing, you might want to consider how you handle user profile storage. Options under ZuluDesk seem to be all user settings local or all user settings on a network share, no mixture. iMovie, in particular, does a lot of disk I/O - I think it automatically transcodes everything you give it into its preferred format, so if you have user folders redirected to the network you'll see a lot of disk access to your user share.

 

We have a login script to handle mounting users' Google Drive on login, with the rest of the user settings being local, that seems to be a reasonable compromise.

[Gongalong]

In theory they're for Music teaching, but I can see iMovie being used.

 

You have found AD integration stable? The suggestion above is it's too unstable to use.

[LTurner3692]

Last time I did this (2 years ago), I just used the APP server and profile manager. We got it to work quite effectively, mapped Drives, locked down the machine and user profiles. the only issue we ever came up against which we could never work out was Red Dots (it was always random and the only way we could fix it was to wipe it all and start again).

 

however with how things have moved on, your better off going with an MDM Solution and having someone come in and do it. You can spend hours chasing your tail over something stupid that you didn't notice or because it has to be done in Apple's way!

[Brimstone]

I've got Jamf and the main issue is they don't work as shared devices. If you assign them 1:1 and the user can connect to a share, add a mailbox etc they work. It's a lot harder in a lab environment particularly if you expire passwords!

Incorrect....Jamf works fine with shared Mac deployments I've got a sixth form college using this for 177 x iMacs all shared between students.

 

- - - Updated - - -

 

1. Do not use Profile Manager, it's a PITA and will waste hours of your time.

2. Use a proper MDM e.g. Zuludesk or Jamf, both of these allow seemless AD and Domain integration with scriptsand works with shared users as flawlessly as other PC's.

 

These guys can manage all of this for you...

 

https://www.krcs.co.uk/managed-service

[Gongalong]

Noob question: what's meant by "shared Mac deployments"?

[dhicks]

You have found AD integration stable? The suggestion above is it's too unstable to use.

 

Yes, AD integration is generally just fine. A couple of issues we've had:

 

- Clock drift on the Macs - the time on the Macs gradually drifted more than 5 minutes off from what was set on the domain controller, at which point domain logins stopped working. Solution is, of course, to make sure the Macs are using the Domain Controllers as their source of time information.

 

- We have an older Active Directory domain that's come through being upgraded over the years from Windows 2000. As such, it's something.local domain, not domain that matches our Internet domain (myschool.com). Seemingly, .local domains confuse the Mac OS login system for some reason, so there's a 10 second so delay when the machine boots while the login screen reports "Domain logins not available!". Can be a little confusing for the user if they switch the Mac on and start trying to log in right after boot.

[Brimstone]

Seemingly, .local domains confuse the Mac OS login system for some reason, so there's a 10 second so delay when the machine boots while the login screen reports "Domain logins not available!". Can be a little confusing for the user if they switch the Mac on and start trying to log in right after boot.

 

That is because .local is reserved for Bonjour Auto Discovery and has been since for about the last 8 years....

[dhicks]

That is because .local is reserved for Bonjour Auto Discovery and has been since for about the last 8 years....

 

Thanks - I knew there was a good, technical reason, I just never got around to looking it up, so whenever anyone's asked me why there's a delay before you can log in to the Macs I've always given some rambly explanation citing "technical stuff". Now I can just say "Our Windows domain name conflicts with Bonjour Auto Discovery", which is simpler.