Calling Mac sysadmins ….are things going downhill?

[iSteve]

Hi all,

 

We have had Macs at our site since 1996, and I have been administering them from OS 8.1, through to the present day. However lately we are finding more and more niggles with integrating macOS and iOS in to our Windows based systems.

 

We have looked after the systems in-house and not sought any assistance from solutions providers, or have any support contracts in place for this sort of thing - typically using the Internet for guidance and/or trial and error, and therefore with this post I would be delighted to hear your experiences and share good practice.

 

We were long time users of Workgroup Manager. We carried on using it with OS X Mavericks (10.9) Server to manage El Capitan (10.11) clients. This summer we bit the bullet and began moving our machines to Profile Manager on Mojave (10.14) server - why? - we wanted to attempt to keep up with a more contemporary OS and method of management. The way of managing macOS and iOS devices form the same interface was also appealing. Initial testing went well, but after the first 7 weeks of term we have some reservations about our move and are considering a return to Workgroup Manager. So what’s wrong……

 

1) Network Shares It seems that telling a user group to mount a shared drive just doesn’t work. We have a network drive on a Windows server, which we wish all staff to mount on their computer. It will not work / apply when the setting is set for a group. It will work if we set it for specific users - which is not manageable, or machine, but not for group. The share is manually mountable, but it will not do it when set through Profile Manager at Group level, with no obvious reason. We have 10.11 and 10.13 clients and the failure is universal. We can’t upgrade these clients due to their age. This worked fine in Workgroup Manager, so we are considering going back for this reason alone.

 

2) Multiple platform management - we were of the belief that we could manage iPads from Profile Manager with consistent settings to macOS. It seems that once an iPad is enrolled in Profile Manager, the user can navigate to Settings and remove the device profile, making ‘management’ useless. I understand that the only way to prevent profile removal is to have the iPads enrolled with the Device Enrolment Program (DEP) at time of purchase. Is this true? We couldn’t predict this use at time or purchase, but now it seems we ‘can’t do it’. Some have suggested we have to manage the devices using Apple Configurator 2, before putting them in to Profile Manager - why do we need two products for this?

 

If iOS devices can’t be effectively managed by Profile Manager, then should we go back to Workgroup Manger for our desktop Macs, and leave our tablets unmanaged?

 

3) Preference Management - Workgroup Manager had lots of existing preference manifests, for example, for Folder Redirection. It seems that Profile Manager does support adding manual preferences, but these all have to be written from scratch, or do not apply in the same way that they did in Workgroup Manager. For example, we used the MCX Redirector to redirect our users’ ~/Library/Caches folder. When replicating this functionality through Profile Manager, we attempted to redirect the whole ~/Library folder so that it was not the local machine in order to speed up logins and general use. This worked fine for a few weeks, then all clients had a melt down, becoming glacially slow on login for no reason at all. We then had to abandon using folder redirection from the server, and use a script (sourced from these forums). Our users now have a local home folder, with the folders symlinked to their network space. This is simple functionality (redirecting a folder) which we are having to jump through hoops to achieve. We got there, however now all users’ sidebar shortcuts are broken. There seems to be no way to manage this at all. The result is a rubbish user experience - a user will click “Documents” in the sidebar, to be met with a warning that the path doesn’t exist. They then believe that their files are not accessible.

 

If we go back to using fully network based home folders, the machines are too slow to use with constant bechballing. Forward and reverse DNS is working correctly.

 

4) Mobile users - We had used Mobile Accounts for our laptop users, replicating the offline files approach that Windows OS uses. This lead to data loss with whole directory structures disappearing for users. We had to set our staff laptops to use local home folders, then backup their data using Retrospect.

 

We are feeling that as years go on, the ability to integrate macOS devices in to the enterprise is leading to a poorer and poorer experience for users and administrators. Tasks that should be simple, like reliable folder redirection, or mounting a share on login, are not working with many users online simply saying “yeah, it’s a bug” or “upgrade”.

 

What are you doing to manage your Macs on your networks? Are you finding that you have gone from years of stable and transparent Mac/Win integration to a system which is glitchy and a pain? Is it worth engaging a support company on this?

 

Your thoughts and advice, as always, very welcome

[free780]

I only started administering macs from 10.6 onwards using Profile Manager. This was painful any settings per device seemed to work. However trying to target per user group never seemed to work. Since then we've moved to mojave and user settings work but network drives don't mount. Also Fill User Directories is broken meaning you have to use a . config file for things like Chrome policy. The privacy co trol panel for things like Microphone are also very annoying. Compared to managing Windows Systems, Mac administration is hard work and usually involves custom scripts and bodges. If your macs are 1:1 devices there seem to be less issues.

[3s-gtech]

While our Macs do cause me constant stress (newest thing, disk drives filled up with unknown files of colossal size *somewhere*) I’ve found group based network drive mapping through PM to work reliably. Not sure what I’ve done differently, but it does work fine. No hacks or scripts. Users do need to have read privileges to the root of the drive though - IME.

[XiJ]

I too started with 10.6 and a Mac Pro server. I’ve found that the only consistent thing is the inconsistency. Each new os bring depreciated software, intermittent bugs, broken features and unreliability. That was in an all Mac setup. To the point I removed domain login and used local scripts to mount user drives.

 

In a mixed environment (Windows server) it was even worse.

 

I’m now onto mosyle mdm for whatever I can. The good thing now is the school In question has fairly minimal requirements and things work with minimal intervention. Staff are moving towards cloud drives and sharing.

 

I’ve come to the conclusion that macs aren’t designed for a domain networked environment. And Apple don’t really care.

And I’m a Mac fan boi

Edited October 21, 2019 by XiJ

[iSteve]

While our Macs do cause me constant stress (newest thing, disk drives filled up with unknown files of colossal size *somewhere*) .

Check out /private/var/folders

We had an issue under 10.9 where temporary items in this path were not being cleared, and HDDs would fill up. Delete all the trash in here.

[TomPearceGeek]

Hi Steve,

Here's my thoughts

1. Take a look at NoMAD (Specifically NoMAD Shares)
   
2. If you are education based, you can get Apple School Manager(ASM) for free. If you have ASM you have DEP which you can link Profile Manager to for automatic supervision / enrollment into PM. If you have purchased your iPads from an Education Reseller, you can give them your DEP ID and they can grandfather your devices into your DEP from the past more often than not. If the iPads aren't purchased through Education, of a certain age you can plug them into Apple Configurator and enroll them into DEP yourself. If you aren't able to enroll them into DEP yourself, but they appear in Configurator, you can 'Supervise' them from Apple Configurator.
   
3. Profile manager isn't the problem I am afraid. Most MDMs wont support these features as Apple don't support them anymore. As frustating as it is, it's what we now have to work with. We use Windows / AD accounts here with network homes with no issues, so perhaps there's something else afoot... (Also, check out MySides)
   
4. Tell me about it. I've thought about whether we do something with rsync but again it's hacky. We don't have enough laptop users to properly require the R&D on this yet, but it's something in the back of my mind.
   

 

5 Years of Macs has tought me that they are a pain in the rear... I do feel for your 1996 legacy.

[RLR]

We have a few macs that we manage. They are a pain as there's so little of them that it's not something we spend much time on. Once they are setup and running they kind of get left for the year. We usually keep them up-to-date when possible.

 

I do find having an MDM makes it much easier better. We use Jamf Pro so we can install and run commands from there.

 

I find IOS devices easier to administer but still a pain to look after as we have so many.

[Brimstone]

Every single issue mentioned above can be rectified by doing the following;

 

1. Do not use Profile Manager Apple's own words are "Profile Manager is proof of concept MDM"

2. Use Apple School Manager for DEP Enrolment

2. By into an MDM that can properly support macOS e.g. Zuludesk/Jamf

[TomPearceGeek]

In the instance above, none of the issues are really relating to Profile Manager, although it's not helped by it. All of the questions above would be similar with any MDM. Although, as a Jamf Pro user and an ex PM admin, I agree don't use PM for the love of all that is holy, but it's the only option for some and it's just one of those things that you CAN make "Work" how you need it to. Edited October 21, 2019 by TomPearceGeek
Who is holly? OH HOLY!

[Brimstone]

In the instance above, none of the issues are really relating to Profile Manager, although it's not helped by it. All of the questions above would be similar with any MDM. Although, as a Jamf Pro user and an ex PM admin, I agree don't use PM for the love of all that is holy, but it's the only option for some and it's just one of those things that you CAN make "Work" how you need it to.

I completely dissagree, most of the profile payloads that you find in Profile Manager simply do not work, AD binding using Profile Manager fails if any slight changes are made, and as for applying any macOS patch upgrades and expecting to be able to still configure the Mac via PM.....forget it.

 

I stopped recommending PM about 5 years ago, when a brand new Mac Mini I was configuring with PM for the very first time fell over and crashed, I had to build it twice in the end.

[3s-gtech]

...PM does work for me. Not sure what I’ve done differently! We only have 35 or so Macs and less than 100 iPads though. In terms of expense, I have other things that I’ll need to spend on before getting a paid MDM - like newer Macs!

[Brimstone]

...PM does work for me. Not sure what I’ve done differently! We only have 35 or so Macs and less than 100 iPads though. In terms of expense, I have other things that I’ll need to spend on before getting a paid MDM - like newer Macs!

 

Good for you...Are the Macs up to date or running a 5 year old OS...?

[3s-gtech]

Haha, yup of course they’re running a five year old version of OS X.

 

I fully agree that for larger deployments, a proper MDM is a much better or even essential tool. Just that PM can work in small environments. It does feel fragile though - this is our second install of it after the first fell over!

[mitchell1981]

We have a suite of 20 macs and managing them has always been tricky, but at least it was possible. Apple seem to be doing everything they can to make

 

We used DeployStudio to deploy with MacOS and Bootcamp for Windows 10. We used Profile manager to handle network shares. It's a long time since I've looked at it but I think there was a issue where you could only deploy shares to computer groups rather than user groups, or maybe it was the other way around. It was broken in some way, but we worked around it.

 

It seems to have recently got a lot worse. Apple have now done everything they can to prevent imaging completely and are saying that DEP and MDM are the only way forward. Catalina, and the latest version of the server remove a lot of the useful features.

 

I just don't really get it as MDM controls are so limited regardless of which one you buy into.

 

How do I install Adobe CC or Office, or any other non-store app?

How do I install our pack of fonts we deploy?

How do I configure the default profile or tweak any settings that aren't in the MDM (a lot of them!)

How do I configure bootcamp and a Windows partition without imaging?

 

We only have 20 Macs so purchasing a expensive deployment system is just a waste.

 

I think the Macs will be going on eBay soon as they are no longer fit for purpose in a network environment. I think in a one to one scenario you could get away with it, but a small suite is just impossible to manage.

[DalekSec]

I'm quite lucky I've only got into mac admin in the last year and a half. Never had to use PM!

 

So i'm unable to say if the management of Macs in general has gone down as i've not been using it that long, but i'd say that i haven't had any glaring issues with management, our MDM (Mosyle) does everything i need it to plus more! We only have 11 macs though also and not overly complicated needs for them, can it run Logic? Yes, Can students login with AD creds and access file shares and One Drive? Yes and is it locked down to a good standard? Also yes.

[Shadow_Walker]

Every single issue mentioned above can be rectified by doing the following;

 

1. Do not use Profile Manager Apple's own words are "Profile Manager is proof of concept MDM"

2. Use Apple School Manager for DEP Enrolment

2. By into an MDM that can properly support macOS e.g. Zuludesk/Jamf

 

Which one fixes drives filling up?

[iSteve]

 

How do I install Adobe CC or Office, or any other non-store app?

How do I install our pack of fonts we deploy?

How do I configure the default profile or tweak any settings that aren't in the MDM (a lot of them!)

How do I configure bootcamp and a Windows partition without imaging?

 

We only have 20 Macs so purchasing a expensive deployment system is just a waste.

 

I think the Macs will be going on eBay soon as they are no longer fit for purpose in a network environment. I think in a one to one scenario you could get away with it, but a small suite is just impossible to manage.

 

We use DepolyStudio to create an image of the machine and then netboot / delay it over DeployStudio.

We install 3rd party software using Apple Remote Desktop to install the package, or add it to the image and image the machine when we update things periodically

Default Profile would have to be tinkered with on the machine / scripted

[GrumbleDook]

I cringe when I take a peek at what you Mac Admins have to do now to make things work. I started on 7.5.5 back on '96 and made good use of MacAdministrator ... and then when it the wall around 10.2 days we fiddled with Server and Login hooks.

Whilst at the LA I blogged about how Apple's work on management was woeful (getting blacklisted from some events as a result) and then working for an MDM provider showed that things had gone from bad to worse.

The advice from @TomPearceGeek is probably the best but I think anyone who has spent time working on Macs will admit that there are times when something just does not work in your own set up ... that works perfectly for someone else ... and there is no clear reason why.

Short of starting from scratch, it can be hard to pin down.

Best of look with it.

[Brimstone]

It seems to have recently got a lot worse. Apple have now done everything they can to prevent imaging completely and are saying that DEP and MDM are the only way forward. Catalina, and the latest version of the server remove a lot of the useful features.

 

Imaging Macs is (and this is about the 8th time I've said this on here) dead. Apple are doing everything to prevent imaging because it's dead, accept it and move on to something that works properly.

 

https://isimagingdead.com

 

I just don't really get it as MDM controls are so limited regardless of which one you buy into.

 

This is complete rubbish, there are at least 8 MDM EDU solutions out in there at present that do actually so much MORE than PM when it comes to profile management, payloads that work, security, patch updates, scripting, Identity management...I could go on.

How do I install Adobe CC or Office, or any other non-store app?.

 

You use a proper MDM solution that can create .pkg's or .dmg's installers, with any good MDM solutions these sit on an SMB share on the network

How do I install our pack of fonts we deploy?

See above answer.

How do I configure the default profile or tweak any settings that aren't in the MDM (a lot of them!)

See 3 answers above, there are payloads in Profile Manager that simply do not work, good enterprise MDM's like Jamf have payloads that go far further to tweak a profile and hundreds of scripts to download tweak and use. I rest my case.

How do I configure bootcamp and a Windows partition without imaging?

 

There are lots of ways to do this, create a pkg. of the Win10 installer and deploy via the MDM, or use WinClone, here's a Jamf video to show you

 

https://www.jamf.com/resources/videos/leveraging-jamf-pro-winclone-and-ivanti-to-automate-and-manage-your-dual-boot-bootcamp-instances/

 

If you don't want to accept that you should not be using Profile Manager to manage them and refuse to accept that imaging Macs is dead you are best getting rid of the Macs and let a school IT admin whose using these tools gladly buy them from you.

[Brimstone]

Which one fixes drives filling up?

Use a proper MDM that can bind to AD with Authentication to then back up the work to either Cloud or local storage, easy

[DalekSec]

We use DepolyStudio to create an image of the machine and then netboot / delay it over DeployStudio.

We install 3rd party software using Apple Remote Desktop to install the package, or add it to the image and image the machine when we update things periodically

Default Profile would have to be tinkered with on the machine / scripted

 

Heads up, taken from twitter https://twitter.com/scriptingosx/status/1183992083004252165?s=20

 

System Image Utility is gone from macOS Catalina.It is not possible to build a NetBoot or NetInstall nbi based on Catalina. (You _can_ probably hack one together, this is not meant as a challenge.)No currently sold Mac model is able to NetBoot.NetBoot is dead.

Edited October 23, 2019 by DalekSec

[Shadow_Walker]

Use a proper MDM that can bind to AD with Authentication to then back up the work to either Cloud or local storage, easy

 

Yep did this before using a pegasus box and carbon copy cloner, still doesn't answer the question of how that would fix the problem.

[TomPearceGeek]

Back to the original thread. You CAN use PM if you need to, but it's not recommended. Imaging is indeed dead as reminded by @Brimstone multiple times like a stuck record.

Here's my final thoughts on this. And recommendations if you simply cannot AT THIS TIME change away from profile manager.

• Nomad Shares - Fixes Network Shares issue. Removes reliability on PM working properly
  
• Munki and Munki Admin - Deploy Packages automagically like with SCCM. When we used PM this was my absolute saving grace. OS Updates, PKGs, Scripts, Profiles, you name it! There's even self service / Software Center
  
• GET APPLE SCHOOL MANAGER - It will make life easier now, and if you change to another MDM at a later date.
  
• Fix your Sidebars using MySides
  
• Run login scripts using Outset
  

By using the above packages, the only thing PM was really being used for was binding to AD which for me was faultless, Deploying Custom Configurations (plists) for things like Munki to put it in the right room and setting the login screen options. Nothing complicated. It's not the IT admin's dream, but if that's all you need, then it works well.

Beside this, I would honestly consider moving away from PM if your Mac demand increases. Have a look at Mosyle, Jamf and Zuludesk (Now Jamf School) as the top education runners. Eventually, Apple is probably going to pull the plug on PM, and alot of people won't be sad about it. But until then, it's not 100% terrible. Even for running a 100+ Mac estate at a public school for 5+years! (us).

Edited October 24, 2019 by TomPearceGeek

[RLR]

We installed bootcamp on our macs using winclone to create a bootimage to boot into MDT and imaged the MACS like they're windows machines.

[_techie_]

I've been following this thread with interest since we now have an updated version of Adobe Photoshop CC rather than the ageing CS5.5.

Deploying Catalina does seem to have been made more difficult with my existing DeployStudio runtime refusing to work on 10.15.1 (DS on latest available download).

 

Last time I did this (DS) was with Sierra and Apple Profile Manager (a far from perfect solution IMO). However okay on the 30 Mac's we had at the time. With another 20 Mac's coming in next year, these tools are feeling the strain.

 

I had issues with a security update for high Sierra that broke the home directory mounting mechanism for AD.

 

For simple tasks we did use Apple Remote Desktop to run some basic Unix commands and file copies etc.

 

DEP and a proper paid for MDM does seem the way to go, but getting funding for a proper MDM for 50 Mac's is going to prove difficult.

 

Interested to hear which ones people are using and costs which I can present.

Ta

Mark