Security settings for a mac on a server 2003 network.

[djsmiler]

Hi There we are just in the process of buying new macs for the school.

i have just brought my mac in for a few days to convince them that there are no problems with adding this to the network.

 

I have managed to get it on the network and have added the home directory's and printers.

The only thing i am struggling with is locking the machine down so that user does not get access to the system preferences etc.

 

Can anyone help me to do this with out purchasing expensive software which Will integrate with active directory.

 

Thanks in advance.

[AntonioRocco]

Hi

 

A number of ways you could do this:

 

(A) Modify the AD Schema and add apple specific Classes and attributes. This would mean updating/overwriting the AD Schema afterwards. Is that something you're prepared for?

 

(B) Purchase OSX Server (10-Client version) and install it on an existing mac. If all you want is Mac-style GPOs that should suffice. However I'm not sure if this meets your 'without purchasing expensive software' requirement?

 

© You could try downloading Apple's Server Administration tools from here:

 

Apple - Downloads - Application Updates - Server Admin Tools 10.5.6

 

You only need to use the Workgroup Manager application. Install the application on a mac client whilst logged in as the local administrator. Make sure the mac client is bound to Active Directory first and that AD is listed in the Search Policies. Launch the application. Navigate to the /Active Directory/All Domains node. You should now see your AD Users and Groups listed. Authenticate to the node using an AD admin account credentials that has authority for the Domain. Make sure all your mac clients have been bound to AD first. Click on the Computer Groups icon (looks like two interlinked rectangles). Create a new Computer Group. Call it something suitable. You should now be able to 'add' bound mac clients using the diaresis button (the three dots). They should show up in the following window. If they do you can select them and add them to the Group.

 

Once added to the Group you should be able to click on the Preferences icon and begin to apply mac-style GPOs. Normally referred to as Managed Client OS X or MCX for short.

 

This forum as well as numerous other sites have plenty of information on how to apply MCX for mac clients. Ross and others have provided useful links at the top of this Forum which you could have looked at first prior to posting.

 

Antonio Rocco (ACSA)