Mac Server... why should I get one?

[pantscat]

I've got 15 Mac minis in the Music department and I'm considering getting a dedicated Mac Server... (why not!?).

 

But... why should I get one? What benefits will I see?

 

I'm very new to the world of Mac but the sorts of things I'd like to be able to do are:

 

- Group Policy type settings

- Imaging

- Centralised authentication (a la Active Directory)

- Centralised storage would be handy too... (would I be able to back this up using my Windows Server with Backup Exec?)

 

I see that I can get a Mac mini server for around £1k... which looks reasonable enough for a dabble.

 

So then you lovely Mac experts... over to you!

[3s-gtech]

Our Mac Mini Server was far, far less than that! Educational pricing meant it was within the £650 + VAT bracket. It will allow you, with AD-OD integration if you have an AD server, to lockdown your Macs, image them and provide storage if needed. Ours only runs the OD at the moment, but it's a nice machine.

[dayzd]

I don't know how a Mini will cope with storage major storage setups. They only have 2.5" drives and I've read before that they're not ideal for central storage - sadly I can't find the article I looked at to quote it properly though.

 

OD authentication and imaging and stuff should be fine. Be aware that the 'Group Policy type settings' settings that the Workgroup Manager GUI offers are nowhere near as fine-grained. If it is your intention to secure your macs to a level similar to that which you probably have your windows machines, buckle up for a long and complicated ride. Many more things can be customised via what are essentially text config files, but it can take a lot of work. Depends on how thorough you want to be...

[dhicks]

Imaging

 

Do you already have an imaging solution? Can that not handle Macs?

 

Centralised authentication (a la Active Directory)

 

I belive Likewise Open also runs on the Mac, letting your Mac workstations authenticate against your Active Directory server (don't forget you'll still need CALs for each workstations, of course).

 

Centralised storage would be handy too

 

You Macs should already be able to connect to any Samba (Windows) or NFS shares you have.

 

--

David Hicks

[pantscat]

I use FOG currently for imaging -I've not managed to find a way to get the Macs to pxe boot...

 

Hmm... OD could be well worth shelling out for a mini server... I didn't really expect the granularity of Group Policy, but it would be useful to be able to lock down some settings (or configure them centrally...etc).

[AntonioRocco]

Hi

 

OSX does not use PXE Boot unless you're prepared to work very hard at it - ie: create your own PXE Boot Disk. Even that might not work with the latest hardware? If you're going to start supporting macs in your environment you're going to have to 'learn' not to approach them as if they were PCs.

 

You have a number of ways to manage mac workstations in an Active Directory environment. All of them will depend on your budget and how hard you want to work. Apple's Best Practices is to use any Apple hardware that meets OSX Server's minimum specification. If all you want to do is provide some form of management and little else a MacMini would be ample. However bear in mind there is no hardware redundancy in a MacMini. Additionally they're not the easiest of things to get into if there's a hardware failure.

 

AFAIK Third-Party applications you can use to provide mac-style GPOs to the Apple platform are Centrify and Likewise which you install on your Windows Server. AdmitMac is installed on the mac workstations, or if you're feeling particularly adventurous modify the AD Schema itself.

 

For an automated way of 'pushing' out images to the platform you're really only looking at what's built into OSX Server - NetBoot and/or DeployStudio - so far. AFAIK you can't provide the same functionality using what's built into Microsoft's Servers. If someone has found a way to make this work you would think they would have already posted?

 

Antonio Rocco (ACSA)

Edited June 15, 2010 by AntonioRocco

[pantscat]

Thanks Antonio - that's confirmed exactly what I've found so far in regard to imaging.

 

I think that for a bit of R&D a MacMini server would be sufficient - at least enough to investigate authentication and management.

 

If anyone has any other useful pointers for a 'noob' then that would be most welcome.

[HodgeHi]

I don't think you need as much restriction on the OS X side as you do on the Windows side. I haven't locked my os x clients down a great deal. I think this is a good thing. I hate locking down Windows clients as much as i do, and i know my users don't like it too much either but its either that or have them break stuff.

 

I would also get a mac mini server for image deployment. Especially since the new ones have been released.

[Roberto]

OSX doesn't support "PXE boot", true. It supports "Netboot", which is the apple equivilent. You can use this to deploy Mac OSX workstation to your clients fairly painlessly.

 

As for authentication - you can bind your mac workstations to Active Directory so users can log in with their Windows accounts without resorting to a Mac server, so I wouldn't worry about that part.

 

Storage - a Mac Mini server uses comparatively slower disks so I'm not sure I'd want to use this for heavyweight user file sharing - again you can connect to the Windows servers for this.

 

"Group Policy" type settings - If you have a Mac server, the workstations can be locked down with OSX Open Directory, the Mac world version of Active Directory. I'd control the users via AD however.

[Arthur]

If anyone has any other useful pointers for a 'noob' then that would be most welcome.

You may find the following guides quite useful. One of them covers DeployStudio which is used for imaging.

 

http://www.wazmac.com/servers_network/fileservers/osxserver_setup/osxserver106_setup.htm

[Arthur]

I see that I can get a Mac mini server for around £1k... which looks reasonable enough for a dabble.

You have probably already seen this, but Apple released a brand new Mac mini today. The server version now comes with two 500GB 7,200rpm HDDs and officially supports 8GB RAM.

[stevehp]

While we are on the subject of a Mac server I'd like to ask the "Mac experts" a question or two. We are getting our Mac server in July so I'd like to clear some things up in my head before then. The main question being about AD. I've read about and I'm interested in Likewise Open. Though I'd like to hear anyone's thoughts on the matter. How stable is the AD connection using the included AD plugin in 10.6? Would it make much sense to use Likewise over the included AD software in OSX?

 

Remote desktop capabilities with Windows. In other words what software can I use? I know I can use VNC, but I'd rather not mirror the desktop on the server. I have my own Macbook, but I'm booted into Windows 7 on it most of the time as our main infrastructure is Windows based. So that's why I'd like a Windows app for that purpose.

 

From my understanding and research the software updates functionality built into OSX server will not schedule or do automatic installs of updates it sends to clients. Am I misunderstood or not. If I'm not, is their anyway around that?

 

That's all I can think of right now. I might have some more later down the road.

Edited June 16, 2010 by stevehp
Cleared up a redundant sentence

[dayzd]

You have probably already seen this, but Apple released a brand new Mac mini today. The server version now comes with two 500GB 7,200rpm HDDs and officially supports 8GB RAM.

That's so pretty! I need an upgrade!

[SYNACK]

You can netboot macs from a linux if you really want netbooting howto

[pantscat]

Thanks for the useful info - all much appreciated.

 

Now to find a supplier!

[Roberto]

While we are on the subject of a Mac server I'd like to ask the "Mac experts" a question or two. We are getting our Mac server in July so I'd like to clear some things up in my head before then. The main question being about AD. I've read about and I'm interested in Likewise Open. Though I'd like to hear anyone's thoughts on the matter. How stable is the AD connection using the included AD plugin in 10.6? Would it make much sense to use Likewise over the included AD software in OSX?

 

We just use the OSX AD plugin, and don't have any problems. Unless there's a particular function the software you're looking at offers and the OSX plugin does not, then I vote for saving your money. The need for "helpers" was most definitely present in older versions of OSX but has got much better with each version, aside from a few bugs.

 

Remote desktop capabilities with Windows. In other words what software can I use? I know I can use VNC, but I'd rather not mirror the desktop on the server. I have my own Macbook, but I'm booted into Windows 7 on it most of the time as our main infrastructure is Windows based. So that's why I'd like a Windows app for that purpose.

 

Apple's "Remote Desktop" technology is based around VNC. It's either use VNC or go home empty handed. If you use a mac client to connect to other mac clients/servers then you get a fancy wrapper around this which makes the experience much better. But it's still VNC under the hood.

 

From my understanding and research the software updates functionality built into OSX server will not schedule or do automatic installs of updates it sends to clients. Am I misunderstood or not. If I'm not, is their anyway around that?

 

That's all I can think of right now. I might have some more later down the road.

 

Not sure if Software update can do this, it certainly isn't up to the standards of WSUS.

Apple Remote Desktop can do this sort of thing - scheduled tasks and updates.

[stevehp]

We just use the OSX AD plugin, and don't have any problems. Unless there's a particular function the software you're looking at offers and the OSX plugin does not, then I vote for saving your money. The need for "helpers" was most definitely present in older versions of OSX but has got much better with each version, aside from a few bugs.

 

 

 

Apple's "Remote Desktop" technology is based around VNC. It's either use VNC or go home empty handed. If you use a mac client to connect to other mac clients/servers then you get a fancy wrapper around this which makes the experience much better. But it's still VNC under the hood.

 

 

 

Not sure if Software update can do this, it certainly isn't up to the standards of WSUS.

Apple Remote Desktop can do this sort of thing - scheduled tasks and updates.

 

 

Thanks for answering those questions for me. The remote desktop functionality being based on VNC isn't show stopper by any means. I will get used to it. That will make it much easier for me as I'll be able to use readily available VNC viewers.

 

Thanks again.

[HodgeHi]

Once you start to use ARD you will see that it is perhaps one of the best remote management applications around. There is no other better way to manage multiple Mac machines IMO. It is perhaps one of Apple's best pieces of software.

 

As for scheduled software updates, you could use ARD to schedule an update on the clients. You would just add the group of machines you want to update to a Unix task, choose the softwareupdate -i command (or whatever it is) and then schedule that command for daily, weekly, monthly whatever. You could in theory use a task server to enhance this setup.

 

A task server is basically a separate install of ARD that holds the tasks that are run. This then runs on machines that are either not on or connected to the network. As soon as these machines come up or on to the network the task is run against them. This is how i think it works anyway. I haven't done it this way myself though so shouldn't be taken as 100% guaranteed to work

[pantscat]

Right... I've got my nice shiny new Mac Mini server - now what?

 

I want it to be AD integrated, but do I need to setup OD first?

 

Is there a nice guide for Mac simpletons like myself to follow?

[HodgeHi]

3rd Sticky down at the top of the mac forum, there is a thread titled new ad-od integration paper. It should still be relevant to OS X 10.6.

[pantscat]

Ah... ta!

[HodgeHi]

Before you do anything though it is always best to update the server to the latest release. Generally bugs are fixed in the directory util on each release. I know from experience with 10.5 -10.5.8 and 10.6.0 -10.6.3 that it was always best to update before even attempting this sort of integration. Also I usually forgo the standard setup and jump right into the advanced. In the end it makes setting up your mac server simpler. This is due to the fact that you don't have to mess around with disabling DNS on the mac server since you will be using the AD DNS anyway, well usually you would.

 

Also before starting the process make sure your AD DNS is spot on and then add the forward A record for your new Mac Server's FQDN name and don't forget to add the reverse pointer too. Also of note is to disable IPv6 when going through the configuration process, that's only if you don't use IPv6 though I've had issues with IPv6 running.