stevehp Posted September 30, 2009 Posted September 30, 2009 Ok so I'm pulling out my hair and over working myself trying to find a simple stable solution to my problem. The district I work for recently received a shipment of fifteen Macbook Pro's, one iMac, and one Mac Pro for use in a Media Communications class the High School started offering this year. We do not have the funding for an OSX server this year, so that's out of the question. We will next year as the Junior High received a five hundred thousand dollar technology grant. For now though, I'm trying to find a simple way to lock down these Macs. They work fine with our 2003 AD environment when bound to it, but the fly is down on the clients so kids can see everything and change everything. I've already spent way too much time on this as is so I want something simple. I've been looking at Linux since it's a stable, free platform, but I'm in way over my head. I've tried a plain OpenLDAP server on Fedora 11, 389-directory services, and others. I'm not scared of the cli, but I'm not a Linux guy, and I haven't touched it for a couple years. I have other projects weighing me down as is so I really need something simple and quick. So long story short. I need to be able to use Workgroup Manager to apply restrictions to users that logon to these Macs. I'd prefer not to mess with our Windows servers as I don't want to screw things over for our 450+ Windows clients and the 900 plus users who use them. Thanks
GrumbleDook Posted September 30, 2009 Posted September 30, 2009 As well as looking at the stickies at the top of the forum I would also have a look at the following blog post from Robert Moir ... a bit old but still pretty relevant to your case. Basics of integrating modern Macs onto a Windows network, FAQ: Creating a Default User Profile - Someone Else Basically lock all the machines down for *any* user and then authenticate against the AD by binding them to your domain. Additional feature can be done via login hooks (have a look at Home (MacEnterprise) for examples) but keep it simple for the next year.
stevehp Posted October 1, 2009 Author Posted October 1, 2009 That unfortunately will not work as I need a specific permissions/preferences set for different groups i.e. students and the two staff that teach that course. The blog post you linked to I've tried before and found similar articles on internet of course with varying levels of detail. The issue with that is even if I force local homes, a good chunk of the configuration I did on that account does not carry over to a user that logs on with there AD credentials. I may just end up creating different local accounts and having the staff and students use that until we can get proper equipment to handle these machines. Thanks for the help, I appreciate it.
HodgeHi Posted October 2, 2009 Posted October 2, 2009 You could create a default template. What you would do is create a Local user (template) and then run all the apps and configure Finder and other items as how you would want them to look. Once this is done log out of the machine and log into the client as an admin user. Then you can run a command to copy the template user's Home dir into the default template of the machine itself. This is found at /System/Library/User Template/English.lproj/ To make things a little easier at this point you could use the app Template. I used this myself and works well. But what i did for my users though is copied the template into their already created home dirs found on the OS X Server. I think though that the forced AD Local home picks up the systems default template. But if you have an iMac and it could be made available, then i would use that as your OS X Server to help manage the clients. It doesn't have to be an XServe and the Home dirs don't have to reside on an OS X AFP server as far as I'm aware.
sted Posted October 2, 2009 Posted October 2, 2009 i got stuck on trying to get a logon script to run on the mac for any user and it diddnt seem to like \\server\users$\group\name user areas much and i really dont want to go back to using \\serer\username$ its a pain and makes copying users much harder
HodgeHi Posted October 2, 2009 Posted October 2, 2009 IIRC OS X doesn't like the dollar on the end of shares. If i added them on the end then the shares wouldn't work. However i can't recall if this was a problem with SMB on OS X server or just OS X in general accessing SMB shares. If the netlogon and sysvol shares use $ then its irrelevant any way since these can be seen in OS X. So this would answer the question of if it is just OS X server's SMB and also render hiding shares as pointless, at least from the point of OS X anyway.
stevehp Posted October 3, 2009 Author Posted October 3, 2009 You could create a default template. What you would do is create a Local user (template) and then run all the apps and configure Finder and other items as how you would want them to look. Once this is done log out of the machine and log into the client as an admin user. Then you can run a command to copy the template user's Home dir into the default template of the machine itself. This is found at /System/Library/User Template/English.lproj/ To make things a little easier at this point you could use the app Template. I used this myself and works well. But what i did for my users though is copied the template into their already created home dirs found on the OS X Server. I think though that the forced AD Local home picks up the systems default template. But if you have an iMac and it could be made available, then i would use that as your OS X Server to help manage the clients. It doesn't have to be an XServe and the Home dirs don't have to reside on an OS X AFP server as far as I'm aware. The iMac will be placed in the back of the classroom, so it's intended to be a student computer. The Mac Pro is intended for the teacher station, but I'm not releasing it yet since I'm using Deploystudio and other apps on it. According to my boss the Mac Pro was at one time spec'd with the server OS, but that was dropped since the cost was much too high. At the moment purchasing media and CAL's for 10.6 Server would not be financially possible. The grant the junior high recieved is going to be utilized supposedly to place Macs (not sure what model) at each teacher station in that building (we have four on a campus setting). I thought it was hearsay, but according to my boss it's not so I demanded an XServe be purchased with that money. Unfortunately I have already tried the default user template as mentioned before. It will not hold a large chunk of settings when using a AD network account with forced local homes (docs still reside on 2k3 file server). I will give the app you linked to on Apple-Scripts.com a try, but I'm not holding my breath. Thanks for the help. I'd like to get a linux server up for other things as well so I'm going to keep cracking at that, but I will ultimately just use local accounts on this small set of Mac's until proper equipment is in place. Again thanks to everyone who posted in this thread.
eean Posted October 3, 2009 Posted October 3, 2009 This Apple WhitePaper says: Managed Preferences When fully integrated, Mac OS X offers a complete managed environment where users can be fully controlled and required to abide by AD password policies. Depending on the level of management your organization requires, there are several options for managing Mac client preferences. Do nothing. Apple’s plug-in automatically enables authentication to AD, including full support of password policies. It also allows you to set up network homes for Mac users on AD. Extend the AD schema to handle management. By adding 36 attributes and 10 classes to the AD schema, your AD system can support all Mac OS X management policies. Just use the normal Mac OS X management tools and target the AD domain. Use a dual directory. Sometimes known as the “magic triangle,” this scenario adds Mac OS X Server to the solution. [...] [...] Managed Client for Mac OS X (MCX) Because Windows and Mac OS X handle preferences differently, a Mac is unable to use GPOs in AD. Instead, Apple has a system called MCX that accomplishes the same task. MCX can be stored locally on Mac clients that have been integrated into AD, but this makes updates difficult because it involves each individual computer. It’s also possible to host the MCX objects in AD, which requires you to extend the schema. Another solution is to configure a secondary LDAP directory using Mac OS X Server and Apple’s Open Directory. In this scenario, clients still use AD for user authentication, while Open Directory supplies managed preferences only. This would imply that it's possible to lock down clients via Active Directory without requiring an Mac server. However, it doesn't tell you how. If you figure it out let us know as I need to do this soon!
HodgeHi Posted October 3, 2009 Posted October 3, 2009 (edited) This Apple WhitePaper says: This would imply that it's possible to lock down clients via Active Directory without requiring an Mac server. However, it doesn't tell you how. If you figure it out let us know as I need to do this soon! I can help you with this one. http://www.edugeek.net/forums/mac/36863-would-i-need-mac-server-2.html Edited October 3, 2009 by HodgeHi
HodgeHi Posted October 3, 2009 Posted October 3, 2009 (edited) The iMac will be placed in the back of the classroom, so it's intended to be a student computer. The Mac Pro is intended for the teacher station, but I'm not releasing it yet since I'm using Deploystudio and other apps on it. According to my boss the Mac Pro was at one time spec'd with the server OS, but that was dropped since the cost was much too high. At the moment purchasing media and CAL's for 10.6 Server would not be financially possible. The grant the junior high recieved is going to be utilized supposedly to place Macs (not sure what model) at each teacher station in that building (we have four on a campus setting). I thought it was hearsay, but according to my boss it's not so I demanded an XServe be purchased with that money. Unfortunately I have already tried the default user template as mentioned before. It will not hold a large chunk of settings when using a AD network account with forced local homes (docs still reside on 2k3 file server). I will give the app you linked to on Apple-Scripts.com a try, but I'm not holding my breath. Thanks for the help. I'd like to get a linux server up for other things as well so I'm going to keep cracking at that, but I will ultimately just use local accounts on this small set of Mac's until proper equipment is in place. Again thanks to everyone who posted in this thread. I don't think os x utiise CALs. You just purchase either a 10 client or an unlimited client server license. Over here the unlimited license for 10.6 costs roughly around £250-£300. This would also allow you to take advantage of using Deploy Studio along with netinstall and deploy the images across the network. This works very well since you can also rename and bind the machines to the ad as part of the imaging process as well as deploy additional packages along the way. Edited October 3, 2009 by HodgeHi 1
sted Posted October 10, 2009 Posted October 10, 2009 (edited) right i now have it kind of working. my test "mac" (actually a hp running hackintosh 10.5.6) is bound to ad. I have extended the schema to cope with apple prefs so i can assign scripts keep people out of system settings etc (very slow but work i suspect thats down to my hardware/software/using a straight cable to link server and mac) the policies are applying to my test user so it loads calc (easy test) at startup and on the dock bar i have my network shared folder. Is there any way to make that the default save location and for some reason while i can create files in my network area they dont appear visible on the mac but i can see them on my server. Any ideas as i appear to be 90% of the way to doing what i want scratch part of that after a logon/off files/folders are showing under my user area but id still like it to be default save area or at least listed in dropdowns Edited October 10, 2009 by sted
HodgeHi Posted October 10, 2009 Posted October 10, 2009 it sounds like you have ad users logging in but have force local home dir. This means that each ad user will have a local home dir which will mean they will have to choose to save to the network location. The way i got round this was to use synching on log out and background synching if needed. But i only did this on the heads machine since he was the only one using parallels.
mac_shinobi Posted October 11, 2009 Posted October 11, 2009 http://www.seminars.apple.com/cgi-bin/WebObjects/ASPRegistration.woa/wa/sol?cat=ent Apple - Seminars Online - Best Practices for Integrating Mac OS X into Active Directory Think this is the one you want below http://www.seminars.apple.com/seminarsonline/modifying/apple/index.html?s=203&locs=us_en 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now