MACs on a windows network

[Disease]

Hi all,

 

We are looking at introducing Music Technology as part of a new block that is being built and we are looking introducing a MAC suite, how practical is it to run MACs on a windows network with logins and file shares etc., can you easily map things like windows user home areas.

 

I personally would just stick high end windows machines in to be honest but the HEAD wants a statement piece for the department so this led me to look at iMacs or mac minis.

 

Thanks

[3s-gtech]

Mac, not MAC Short for Macintosh.

 

It's very practical. You can just add them to AD and off you go, but it's better to use an MDM like Mosyle or JAMF to manage them (the equivalent of Intune or AD settings). Intune can be used too but feedback is variable.

Edited November 5, 2024 by 3s-gtech

[Olliedawg]

We don't have Mac's but I have heard that JamF connect allows you to use Azure/365 credentials to sign into the macs. I believe there are also scripts you can use to mount SMB shares. Hopefully someone who already runs this setup can answer more in detail

 

You will need some sort of MDM anyway to manage apps/updates etc..

[flyinghaggis]

You can just add them to AD and off you go..

 

I'd heard that Apple/Microsoft were deprecating the feature to bind Macs to Active Directory in future versions of MacOS? Is this still happening?

[Bankesy]

@Disease I'm also looking at this as part of our Mac refresh for the Music department, I grabbed a test Mac and joined AD easily enough.

 

I'm trying to go down the Intune management route and had some success rolling out the Office apps plus found a great script that maps network shares to the dock but stuff such as Sophos and PaperCut seems trickier so have turned to a trial of Mosyle as @3s-gtech mentions.

 

I'm not sure how Intune or Mosyle will handle Sibelius or Logic yet.

 

Also I am discovering that due to the ports on the Macs these days we will need some docks for peripherals such as mice, keyboards and MIDI keyboards.

[3s-gtech]

I'd heard that Apple/Microsoft were deprecating the feature to bind Macs to Active Directory in future versions of MacOS? Is this still happening?

It's going to go that way, but I suspect it'll sit quietly working for several years yet. Things like JAMF Connect can do the job, but I don't like how JAMF sell so many modular products for one purpose.

 

You'll want some USB-C to USB-A converters if using things like MIDI keyboards as new Minis only have two USB-A ports (plus two on the old Apple wired keyboards).

[Brimstone]

@Disease

I'm not sure how Intune or Mosyle will handle Sibelius or Logic yet.

.

Due to Intune's limit on app size it can not package large apps like Logic and the samples pack which alone is over 50Gb's, Logic has to be run on a local home directory, it will fail if you try and run this from a networked directory.

[speakercon]

Don't do it unless you enjoy endless misery... I've never seen it work well at all, but those were the days of AD joined, folders (and user profiles) redirected and apple profile manager. Maybe it works better now with a proper MDM/Azure, (luckily) I wouldn't know.

 

But seriously, the head wanting Macs as a 'Statement' is imo silly (but all too common focusing on image over substance), choose something that fits the need/works best not something just because its a fancy brand.

 

Or just buy them and install windows on them, or even better chrome flex A compromise if I ever saw one.

[kevin_lane]

we use macs yea its a bit of a pain but, we have AD intergration etc password resets are a bit of a faf but they get on access homedrive / office 365 / garage band etc just get one or 2 test them out and see how you get on find the quarks, plus its a good learning curve

[dmj]

 

But seriously, the head wanting Macs as a 'Statement' is imo silly (but all too common focusing on image over substance), choose something that fits the need/works best not something just because its a fancy brand.

 

If the school/college can attract more students, that will more than pay for the difference in hardware cost.

Head teachers have to think about branding these days: students/parents get a say in where they choose to go (especially in a 6th form setting) and, unfortunately, schools have become competitive in this environment.

[thimon]

We use Jamf to manage them and they’re a doddle, don’t give us any grief. Go with it, seeing as it’s also coming from your head.

[Aprice]

MDM is definitely what I'd be looking at, recently our mac's were removed here. It was an outdated profile manager setup that was put in by the appointed contractors and never worked very well. Personally love my Mac but this setup was awful. The only downside of removing them is that the schools really struggling with Qbase, the Macs once they were running just tended to work with the Midi keyboards and audio just worked fine. 30 kids with MIDI keyboards and little mixing consoles with PCs just doesn't seem to work reliably, almost every PC needs troubleshooting every music lesson to work out why nothing happens when they use the MIDI keyboard.

[3s-gtech]

Macs aren’t just a showcase - they are very good at the Music Tech stuff and don’t need too much support. We primarily use them with KS3 and KS4 and Garageband, which is good enough for their compositions, sequences and remixes etc. the MIDI side is pretty reliable too. We used to use Pro Tools for KS5 but the dongles…were bad. Avid, avoid.

 

The RoI has been good on ours - they are well built and not overpriced with the right frameworks. I have just bought 15 Mac Minis which were about £100 more than similar PCs - however, Garageband’s capabilities cost so factor in the licence for a Windows equivalent.

 

Our 2009 iMacs are just about to be retired (thankfully, they’re pretty tired!) They’ve done well.

[Disease]

Thanks for the replies, we use Intune as our MDM so I think I might just get one and have a play around. I think at most we will just be using GarageBand on it.

[speakercon]

If the school/college can attract more students, that will more than pay for the difference in hardware cost.

Head teachers have to think about branding these days: students/parents get a say in where they choose to go (especially in a 6th form setting) and, unfortunately, schools have become competitive in this environment.

 

Fair enough, and if the Mac is the best tool for the job that's fine, but I don't think choosing a product based on its perceived image (not limited to macs) is good, when it is not necessarily best suited to the purpose or environment.

[dhicks]

how practical is it to run MACs on a windows network with logins and file shares etc.

 

We now use Moysle MDM to manage our ICT suite of iMacs (Summer 2024 model). That lets users log in with their Google credentials, I assume it also supports Microsoft (and Apple?) logins. For our previous set of iMacs, we had them authenticating via LDAP - first the on-site Active Directory server, then we switched to Google's LDAP server so user could log on via LDAP but with their Google credentials. Again, if you're using Entra ID (Azure Active Directory) you might be able to do something similar.

 

We've re-used some of the older set of iMacs (2016 model, I think?) as ChromeOS Flex machines, which they work really nicely at.

[Bankesy]

@Disease I would be very grateful if you could pass on anything you do or learn with the Macs via Intune and I'm happy to share what I have achieved.

 

As I say we are in the same place with buying one Mac and playing around on Intune.

[gwendes]

We use Jamf to manage them and they’re a doddle, don’t give us any grief. Go with it, seeing as it’s also coming from your head.

 

We have Jamf School and 3 x Mac Mini M4 and they're being anything but a doddle. Deploying profiles keeps failing, then working, then failing. All plugged directly into the cab in the office. We've managed to bind them yesterday and they're gone today. Anything we might be missing?

[3s-gtech]

Is your filtering getting in the way of Jamf? I’ve not tried with M4 models but got some M2s on it, and it works pretty well and consistently.

[gwendes]

Is your filtering getting in the way of Jamf? I’ve not tried with M4 models but got some M2s on it, and it works pretty well and consistently.

 

It actually says: The ‘Directory Binding Account’ payload could not be installed. The server ‘dc01’ either couldn’t be found or was not responding.

 

If we change it to IP it immediately says the IP rather than dc01/dc02/dc03

 

Sometimes it installs, mostly it errors.

 

We did whitelist schoolname.jamfcloud.com

[mavhc]

can you ping that dns name? as a single hostname and also as the whole local domain? Is your domain ending in .local?

[gwendes]

Ping is fine. Our domain ends in .sch.uk

[pete]

And if you do nslookup int.schoolname.region.sch.uk (or whatever the domain is called), do you get a complete list of DC IPs?

 

Open a command prompt on one of the macs and try:

 

kinit [email protected] and type the corresponding user password when prompted. Does it succeed? Do you see the details of a Kerberos ticket when you follow up with "klist"?

 

(kdestroy will flush the credentials)