Mac > MS RDP > SIMS (VM)

[Koldov]

OK, bit of a cryptic title... sorry.

 

The Headteacher has a Macbook, as if that isn't bad enough he wants Outlook, Teams, Office, Windows Server share access and... SIMS (I'm still not entirely certain why he 'needed' a Macbook as he doesn't seem to use or know anything about the actual Mac OS)...

 

Initially I was thinking dual boot/parallels etc. But the quickest (and most fool proof) way I thought of to make this happen was to get a VM running SIMS stood up on the server and the MS Remote Desktop app for Mac.

 

This works OK and has been fine for a while, but I have to punch a hole in the firewall for the I.P. of his Mac. Every so often DHCP changes this and he is blocked... it's only happened a couple of times but now unfortunately he comes to the office saying he can't get on to SIMS with that "it's happened AGAIN" undertone...

 

I showed him how to find his I.P. and it can be quickly sorted once he lets me know, but it's becoming a 'thing' and I don't want it to be a nail in the coffin of my job (I mean it's not that drastic in the grand scheme of things, but it all adds up)...

 

I've looked at setting his I.P. address as static, but then it won't connect to any other network (?).

 

I would look at something like a reservation (?) in DHCP, but DHCP is done on our CISCO switches and that's way over my head (so, difficult to do in the first place and to troubleshoot if it goes wrong).

 

I've also looked at setting the admin wi-fi range of I.P.s in the firewall GPO, but, well RDP... am I right?! This HAS to be locked down if used at all, not opened up further...

 

Any other suggestions (considering I am not a Mac or CISCO expert)...?

[3s-gtech]

As you've found, you either need to set a reservation in DHCP, or potentially a network location profile in MacOS (which can use a config selected by the user from a list) - https://support.apple.com/en-gb/HT202480 together with a static.

 

It sounds like putting Windows on his Mac would be the best solution, though if it’s M1 that puts limits on the OS abilities of Windows as it’s not full featured.

 

Your current setup is too techie for the Head though, IMO. Can be fixed.

 

Edit: don't put RDP itself through your firewall as a protocol. Even a web gateway is a risk, though reduced.

Edited March 23, 2023 by 3s-gtech

[Steve21]

Are you talking about external RDP or internal?

 

If it’s internal any reason you “need” to limit it by IP? You could restrict it via username on the host VM etc so only he can login anyway (in your scenario that’d be more secure than via IP if you’re referring to cyber essentials etc, and then allow internally IPs access via firewall for RDP just to the VM he needs

 

I’m assuming that the VM you built is just a standard Windows box that he could log onto any other pc anyway? (Rather than with any other special permissions)

 

Steve

[Koldov]

Yes, the VM is just a standard Windows 10 instance, joined to the domain and SIMS added like any other desktop.

 

Sorry, I guess I should've added that the user has been (exclusively) added to the Windows VM as an RDP user.

 

RDP is internal (as in the GPO is configured on the Domain Firewall), but I'm not sure what else makes it internal/external.

 

Not sure how I put RDP through the firewall, without putting RDP through the firewall...?

 

The main GPO for RDP access is this:

 

 

It has the I.P. of my work PC and the VPN range.

 

 

Then the specific GPO added to the VMs OU which includes the main ones above plus the I.P. of the Macbook:

 

As suggested here:

 

http://www.edugeek.net/forums/windows-server-2019/231472-firewall-cumulative-overwrite-multiple-firewall-gpos.html#post1984048

Edited March 23, 2023 by Koldov

[Davit2005]

What a waste of resources (both in your time and computing resources) jus because said person wants a MAC but then can only access apps through a RDP session to a Windows PC. Maybe this should go in Pet Peeves, lol.

 

But as you say the solution would be a reservation but it is something that would still require admin, i.e. when he leaves or gets another machine it will need either deleting or modifying.

Edited March 23, 2023 by Davit2005

[3s-gtech]

Ah, thought you meant firewall appliance. Windows firewall is fine there, it's essentially working internally as you have a VPN.

[Koldov]

Yes, a waste... I'm sure most of what I've managed to accomplish has been from various posts on here (there might even have been one in 'Pet Peeves/Annoying things')...

 

Unfortunately when they come in with the 'it's happened again' overtone, I've started to reply with a 'because it's a Macbook in a Windows ecosystem' overtone... which I'm sure isn't helping my standing (unless you count my reputation of grumpy IT man)...

 

Thanks @3s-gtech I like the idea of the 'network location profile'... I'm almost sure I can get him to remember how to click on it... dare I say it, sounds like a 1up for Mac OS...

Edited March 23, 2023 by Koldov

[3s-gtech]

Our head uses it - allows him to quickly hop onto and off our proxy settings. It's a great feature.

[Koldov]

I seem to remember back in the day, we had a VBS script (two actually) for Windows laptops put on the desktop for teachers. One that used to put in the IE proxy settings and the other to remove them!

[Koldov]

Well, unfortunately this seems to have become an issue... again! I can't seem to get this sorted, due to many reasons I won't bore you with or rant about.

 

However, once again the Headteacher has an issue with their Macbook and I think it might have something to do with the 'network location profile' I set-up.

 

I created one for 'WORK' and set a static I.P. (subnet, gateway, DNS, WINS) and left the original 'automatic' one as is, so it can continue to be used as usual.

 

Yesterday (?) they told me that over the holiday they couldn't connect to their home network (it would appear that this was the first time they tried this 'urgent requirement' since I set it up almost a month ago)...

 

Anyway, on the Apple support page it describes one of the uses of 'network locations' to be "Your Mac isn't connecting to your network and you want to reset your network settings quickly for testing purposes, without losing your current network settings."

 

https://support.apple.com/en-gb/HT202480

 

This implies to me that everything configured in the settings for a 'network location profile' would be individual to that profile, but it appears things like DNS is global...

 

As I set-up the 'WORK' network locations with all settings including our on-site DNS sever, it seems that when taken off-site and switched to 'Automatic' it still looks in the settings, doesn't find the DNS servers and fails.

 

To work around this I have added in Google public DNS 8.8.8.8 and 8.8.4.4 into the DNS settings along with our on-site DNS servers and presume it will search the list, but when on-site, will it continue to use Google DNS if it sees them in the list?

 

I have a feeling I want it to use our DNS what with the static I.P. set-up, but what impact will it have it uses Google and ultimately does it matter?

 

Should I have put anything in the DNS settings at all? I'd really like this to be the last time I have to deal with this....

[3s-gtech]

Again - this may be where a reservation helps you. No need to apply static settings other than the proxy, the client stays on auto whichever network they're on. However, DNS etc should not be global and should be unique to the profile. You should be able to test this if you hotspot it.

[Koldov]

Thanks, but I think the 'reservation' thing is going to be a little over my head... DHCP is run from our Cisco switches and not our servers.

 

DNS is run from our servers but although the Macbook never registers in there, it won't connect without them in the config (on static of course).