About to throw macs through the window!

[craigw]

Just a passing comment on our experience here...caution (civilised)rant ahead..

 

Let's get the good bit out of the way first. iMAC's look nice. Now let's get onto reality.

For a company that focuses so much on education and the role technology can play - Apple seem to have totally forgotten that (right or wrong) - use of IT in schools predominantly centres around networks. Network accounts, redirected shared drives, policies and restrictions.

 

Yes the iMACs work beautifully in a standalone environment. The apple culture is focussed on the local user. When used that way, ilife, iworks etc all play nicely and their simplicity is refreshing.

But introduce a network and the concept of doing anything outside of the "/usr" environment and it goes pear shaped.

 

I am gobsmacked that people are considering stand alone accounts, abandoning security etc just to get the product to work. This is not our fault or problem. We are not trying to do anything that is unusual or out of the realm of reason. Apple should provide the flexibility to access and share files where WE want them to be. They have made their programs so "simple" to use that they are almost impossible to implement using good network practice.

 

And this is even using products like Centrify. We have 24 macs deployed for the first time in an AD environment using Centrify Direct Control to manage the machines.

At one level it has proven to be very successful. The kids logon with AD accounts, GPO's control access to applications, proxy settings are centrally deployed and user home directories are redirected to their SMB network shares. Logon scripts map (mount) the shared drives, and we GPO's to push out the printer files. Small things like Apple/Unix limitation on 8 character logon names and problems with non standard characters in logon names (- and ') resulted in us massaging the data, but we know better for when we create new accounts.

 

So - yes on one level it has been great. My end goal was to make the machine independent of the experience. If the kids logon to a Windows machine or MAC they get the same access, policies and restrictions. They get a consistent experience and we keep a stable secure environment that we can manage. (And all just so they can use Garageband!!!! - don't start me).

 

Anyway - where it goes wrong is once you start to work with the applications. Fire up imovie and create a project - close imovie and it doesn't save anything. No error - nothing - just doesn't work. Why? Because the redirected home directory does not have a folder called Movies on it. Would be helpful if it told you that at start up and you didn't lose all your work.

So - create a folder called Movies and fire it up - and works ok.

 

Ok - so if I now stick to the idea of working in that directory for all my data - then it seems to work OK. The problem is of course video. No matter whether PC or MAC - few people would recommend working with large video files across the network. So - how do I then get imovie to work with video outside of the Events folder created in the /usr folder - redirected or otherwise?

 

On any other program (and I stress that other apple programs may well do this - I am talking ilife here) - there is no option to save anywhere other than the "almighty" home directory. Can I use video outside of the events folder - yes - but I must import it (copy or move) to the /usr events folder. So what happens is that we end up filling the kids user folders and soaking up all the network space. I just want to keep the project on the /usr folder and keep the video on the local (or even shared network) folder. How hard can that be?

 

Maybe it is just my lack of knowledge - but things were never this hard on Windows.

 

At this extends to other products in the suite. I just spent 2 days at an apple conference where they showed off Garageband etc - the end result of one 15 minutes session being a podcast that you could "share" on itunes.

I asked the logical question - can we access the same itunes library then? Well you just turn on sharing in itunes, ok...but isn't itunes limited to sharing to 5 users (in the same SUBNET - god forbid you design your network properly with vlans). Oh - OK - well yes there is that problem. Again - apple designs products for the home - preaches education and then fails to deliver a product that can do the job.

 

So - back to you guys - how can I do this. I am sure there must be work arounds with scripts and tricks etc etc. I am willing to learn and eat humble pie if I simply not googling enough to find my own answers - but surely it is time that Apple deliver a platform that works in a 21st Century education environment.

 

Their answer when challenged on any of the above is simple. 1 to 1. Then you have no issues. $$$$$

Craig

[dayzd]

I've struggled with the iMovie video location issue since Macs entered our building 18 months ago. I can only see that it is so difficult because of Apple's aforementioned focus on domestic users.

 

Most people at home aren't concerned where the video goes, just as long as they can get it on the computer so they can start making their generic movie trailers to share with friends. So Apple have taken this out of the equation. The same way they have removed responsibility from the user for picking the right frame rate/size and compression type at import. The average user doesn't know or care about this, they just want it to work. That's what Apple software does - it just works. And rightly so.

 

Which sucks for those of us who need a little more control over our machines. I agree completely with all you've said above. Apple software should be more flexible. There should be ways of offering more control over certain things when used in a network environment.

 

Originally, for the first year they were in school, our Macs downloaded a users' video from a network share at login. Which would have worked well, if iMovie didn't 'touch' every single video each time it loaded, stopping rsync from being able to tell what was new and needed syncing and what didn't. This led to ALL the video being syncronised, even if nothing new had been added. Compound this with students' inability to delete footage they did not need and you have some VERY long login times.

This system was removed in the summer, and now we've gone all-Apple. Our Macs are no longer AD-connected and we use mobile accounts to keep local copies on the client machines that automagically sync to the server in the background. It seems to work, too!

 

Managing two sets of accounts for a small number of users (we only have about 50 who use the Macs, which is manageable) and it sure beats the problems we were having last year!

[HodgeHi]

Not sure if you guys know of a possible workaround for the iMovie issue? It does mean larger home dirs but you can first drag the video footage into iPhoto. This then adds the video into the iPhoto Library. You can then add the video from here into your iMovie files bypassing the issue with the Events folder since the footage is stored in the iPhoto library folder.

 

It takes a little longer since it has to add the footage into iPhoto first and then builds the thumbnail images on import but it does work.

 

The process is:

 

Drag video into iPhoto > open iMovie > Click on iPhoto Video on the left > Choose the video clips you want.

Edited December 16, 2010 by HodgeHi

[craigw]

But doesn't this just place the movie file still in the user directory - albeit in the iphoto library rather the imovie events folder?

What I would like to be able to do is place the movie file wherever I like and link to the file rather than import it. Or if I have to import it so that imovie can ensure it is correct format etc - specify where the import should be saved.

 

Some other suggestions were to create a folder at the root of the HD called imovie event and give users read write access and somehow it would magically save there instead. I have tried this mutliple times and every time I import the video it still creates the event in the /usr/Movies folder - which in our case is the redirected network share.

 

Note - this is not a total disaster - if we provide enough network storage space we can live with this - but it is certainly not efficient. Being able to link to 1 shared file or work on a one off project with video stored on the local drive where necessary would seem like a reasonable request in a modern network capable operating system.

 

Craig

[Dave_H]

Syncing within an AD/OD environment can often throw up many errors. Especially when user profiles are stored on a SMB share. Has anyone thought about having local homes on log in with the AD home folder getting mounted on the desktop? This way end users can appreciate the full power of a mac whilst still having access to home folders. Lets be realistic - a mac is a creative piece of equipment and the reason people use macs is for creative software. Is it not an option to work locally and then drag finished pieces of work across to the network share? Yes this takes user education - but its definitely worth it in the long run?

[Marci]

S'exactly how I do it at our place...

[dayzd]

a mac is a creative piece of equipment

No it's not. It's just a computer. It's a tool, the same way a car is. Or a vacuum cleaner. Or a hammer.

Using a mac doesn't make you or anything you do inherently more creative.

I will, however, agree with your point that the most common use of Macs is for running creative software.

 

When it comes to storing work locally, most support teams frown on this. The lack of decent, expandable backup solutions for this idea is the primary reason not to do it.

As for having users 'drag' completed work to another location, that's a no-no, too. No matter how much user education you do, there'll still be those that get it wrong and lose their own or someone elses work. Or accidents happen -I know of a school local to us who lost several pupils' coursework when an external drive they all copied to broke.

 

The ideal set-up, that most of us strive for, is for the user not to even know that their work is being copied/moved/backed-up/secured in whatever way. They shouldn't have to think about it, or be involved in it. It's our job to make sure their work is safe, not theirs.

 

...Hence the OP.

[Marci]

...which is where RSYNC comes into it's own. Here, each machine runs a local rsync daemon. The server runs it's daemon in pull mode every 15 minutes for each local client (with a time offset per client) and pulls the entire /users/ folder for each local machine, and syncs it all back to the /users/ tree on the server based on checksum diffs. The server is then backed up via normal methods.

 

Should our users need to access files in another curriculum area (or vice versa), they can drag and drop to their windows home folder which we mount on the desktop and on their dock, but from the windows side they can access their individual user folders on the X-Serve as a network share mapped to a local drive letter.

 

Eliminates all software issues as everything is working with local home folders, those home folders are backed up frequently, and accessible from any platform on the network.

 

X-Server is an OD Master, bound to AD. We have AD Groups mapped to OD Groups & apply managed preferences to users at the OD Group level from the X-Server via WGM. We apply machine restrictions in OD via WGM. Clients are bound to both OD & AD. Users authenticate against AD on login, then retrieve all managed preferences via OD, and local folders are created on demand during first logon to a client. The only real thing a student has to do is to consistently use the same Mac in the same lesson, but that's purely because I couldn't be bothered to write a script at logon to trigger an rsync to move user data from the server back to the client on-demand.

 

(I think that made sense...!?)

[martin_hannah]

craigw - But doesn't this just place the movie file still in the user directory - albeit in the iphoto library rather the imovie events folder?

What I would like to be able to do is place the movie file wherever I like and link to the file rather than import it. Or if I have to import it so that imovie can ensure it is correct format etc - specify where the import should be saved.

 

Some other suggestions were to create a folder at the root of the HD called imovie event and give users read write access and somehow it would magically save there instead. I have tried this mutliple times and every time I import the video it still creates the event in the /usr/Movies folder - which in our case is the redirected network share.

 

Note - this is not a total disaster - if we provide enough network storage space we can live with this - but it is certainly not efficient. Being able to link to 1 shared file or work on a one off project with video stored on the local drive where necessary would seem like a reasonable request in a modern network capable operating system.

 

Craig

 

I solved this one by creating a symbolic link from ~/Movies to /tmp/@%/Movies - Means that their data is being stored locally but some of the students projects are 10GB plus so it's unrealistic backing all of that up to the network. It's been working okay though I recently ran into a problem where one students work wasn't saving.. fine for everyone else. Having a lot of other problems though so I'm thinking it will resolve itself once the other fires are put out. Seems like i'm not the only one with these problems... Here's my other post.

[benharker]

We had OD/AD running beautifully with our edir / novell backend in 08-09 but our teaching staff couldn't understand the concept that the "student Movies folder isn't actually on this machine? what do you mean, i can see it...!" as a result, my shiny new xserve was assaulted daily by gigabyte after gigabyte of poorly shot DV footage for a whole year no matter how many training sessions i did with the staff. Long story short is that after running fine for six months and then falling to bits once video-based coursework kicked in, I had to return my setup to its default of local logins [what i'd tried to get away from in taking over the job].

 

I've stuck at local logons as it's what the staff are used to now, they're A-level teachers and it's very hard to get them to adjust their teaching methods past 2005, in fact they downright refuse...

 

My current setup is local logins all the way, with mounted SMB user shares; the clients each rsync their local data [footage] into the teacher's machine before shutdown each night, the teachers macs then rsync their data up to a departmental 'server' [repurposed G4 powermac usually...] and then these departmentals rsync theirs up to main server, and from there to the tape backup.

 

All automated, simple local logins, fast performance, no slowdowns, and the most levels of failover i've ever worked with in IT! now all I have to do is design a blend of the locally stored / rsync backed-up footage, with the OD/AD logins...

 

Our mac network may not behave the way my novell/windows/integration-crazy manager would like, and iLife is most definitely not designed for network use, at least not by 150 machines at once, but this setup gives my kids the same performance they're used to at home, they trust it, and I trust it!

 

Unix, I love it, there are ALWAYS options and different ways to do things.

[Sheridan]

We've had this beachballing problem with our macs for a while now. The whole machine hangs up for a while. I've noticed errors in the log referring to smb_iod_sendall which happen when the hangs do.

 

Apple provide the option to map Home to an SMB share - this sort of full integration is why we trialled Macs. As it is, Macs don't fully work with AD/SMB so our trial has resulted in the conclusion that Windows will continue to be the OS of choice here for now.

 

And Apple support? Not all its cracked up to be!

[Marci]

Apple Support in the UK is useless at best imo. There are unqualified (read: uncertified) geeks on here that do a better job of it than they do.

[Sheridan]

Yup, Apples response was simply to buy Premium support, which is not an option based on their failure to identify the problem in the first place!

 

We now have effectively unusable Macs, with an error message that doesn't really help us to diagnose the issue. We have Linux boxes working ok in our AD environment without major problems.

 

Makes its a very simple choice for us though - no more of Apples 'design over substance' kit for us!

[GoldenWonder]

Yes, the conclusion we've come to here is that Macs simply aren't suited to working in a mixed network. All Mac network or standalone might be ok, but as far as I'm concerned they just don't work correctly with AD/SMB or anything vaguely Microsoft.

 

And their support is poor - so we're ditching in favour of Windows 7. Cheaper too.

[Sean-OC04]

The responses on here point out that Apple's own support is useless, but have none of you tried contacting an Authorised Service Provider with ACSA engineers?

 

I'm sure they would be more than happy to help you with your problems...

[Sheridan]

Its made us realise how reliable Windows 7 is! At least we can dual boot our imacs and get some use out of them.

[GoldenWonder]

Thing is we'd have to now pay an ACSA engineer stupid money and the basic problem seems to be os x has a broken implementation of SMB.

 

Very disappointed here that we've come to the point as I had high hopes for these macs, but they aren't usable with a windows network.

 

I wonder if we can roll one back to 10.4/5 and see if that works? We only have 10.6.2 install disks that come with the macs.

[dayzd]

Previous versions of OS X don't support newer hardware.

Hardware will only run the version of OS X it shipped with or later.

[GoldenWonder]

Shame, I wondered if it was a driver issue. I've tested a Macbook (similar generation with 10.6.5 but not intel based) with the same setup and theres no issues at all, no hangs and no errors connecting.

[HodgeHi]

Apple's implementation of SMB on the server is (I think) similar to the linux one except they have to roll their own for Open Directory Support. You can edit the smb.conf file directly if you wish to but you will then need to manually start and stop the service on the server. The clients though I'm not so sure about but then it shouldn't too different since to connect to XP client shares relatively fine as well as Server 2003r2.

 

My setup is like so:

 

My OD Server distributes the management settings but also hosts the home dirs via AFP and SMB. The clients also connect to my Windows Server 2003 r2 shares for the Papercut client app as well a 2003r2 server for the Applications share, again via SMB. These all mount on login using Kerberos.

 

These clients are a mix of 10.6.6 and 10.5.8.

 

My domain suffix is sch.uk. I steered clear of the .local due to the issues with Tiger. My DNS is replying with all of the correct DNS records.

 

My clients also have manual IP with DHCP and reserved DNS entries. I have configured the DHCP Server to update the DNS records on the clients behalf, trying to keep the reverse and A records updated.

 

I generally don't run into issues apart from a slight slow-down (due to a single 1gb connection to the server) or the odd client not picking up it's managed preferences (damn you Apple, you said you fixed it )

 

Are your servers 2008 or 2003? Do you have a spare 2003 license you could use to test some home dirs on to see if it is indeed a compatibility issue between the two?

 

It took Apple to 10.5 to start digitally signing connections to the SMB service or whatever it was. Before this you had to disable the setting in Group Policy. Did I read that MS have recently beefed up the security around that area again? Maybe causing incompatibility issues again.

 

Just a thought.

 

Also remember that OS X doesn't support DFS shares out of the box.

[GoldenWonder]

We're slightly different in our setup. OD just dishes out preferences (basic server) and clients use AD for authentication. The problem comes when we set clients to map their home directory to their AD share name. It works - but we get these complete system hangs. If we force the home directory to the local drive, no hangs.

 

But as we wanted the macs to integrate properly and not have manual file copying this isn't a good solution. Obviously SMB is the problem, but what part of it is causing the problem I'll never know! Anyone got a smb.conf file I can compare ours against?

[stevehp]

We apparently are having an "Apple engineer" coming in to look at our issues. I've tried so many different things including the plain golden triangle, dabbled with a cylinder of destiny on one client with two augemented users. Right now I have a cart of macbooks that use local user accounts with managed system preferences that seem to work without any hangs but that's a less than ideal setup for us. I cringe to think what this magic Apple engineer is going to do.

[Sheridan]

Just to update, I've also updated a macbook to 10.6.6 and it generates the smb_iod_sendall messages frequently and hangs the laptop.

 

Has anyone used a third party or non Apple smb client? I'm not sure how I would do this (not a Mac expert by any means!)