new suite of iMacs - helped needed - Mac newbie

[cr31]

Hi all im hoping someone could help me out here with regards to setting up macs on a windows based network.

 

At the moment we have no macs in the school, and the media studies department is currently considering purchasing a suite of new iMacs.

I am fairly comfortable using windows with no problems, but I have no really played around with Macs.

 

Currently our servers are windows server 08

 

I have been asked to find out what is required (hardware/software wise).

A couple of questions

 

firstly. – Drive mapping --- Can you map \\share\year\username?

I heard that you can only map a share and not folders? Is there a way around this?

Also each student has around 5 mapped drives when they log in. what is the best way to do this..and is this process automated or would students have to manually search/type in the location?

 

User restrictions

Iv read that using something like a mac mini to act as a server to lock the machines down will do the job. Is this right?

What is security like on a mac when accessing shares on windows files? Is there anything to look out for?

 

 

So to sum up

35 new imacs to be purchased

the imacs will be bootcamped

imacs to be integrated with active directory to allow users to login with their own username and mapped drives when they log in

mac mini to act as a server to apply restrictions to imacs

 

Any help appreciated.

[Tricky_Dicky]

In all honestly do not try this on your own. The best and easiest thing to do is to go to one of the main Apple Suppliers to education (AT Computers, KRCS) and get them to quote for the whole lot installed and setup.

 

35 is a pretty decent number and so you will need a mac server of some kind. Depending on what you are doing it will either be a mini or a full blown server.

 

In terms of managing them, they are really easy. Once all setup and working it's just a case of software updates and that's your lot. Just wondering, why are you dual booting them? Is there something very specific that the department needs from Windows? I only ask because thats the one area I have trouble with the macs, when they are switching between the 2 OSs.

 

If you want to come and look at our suite you are more than welcome.

 

Rich

[IrritableTech]

We've recently bought 16 macs for use within our creative media departments, and will be letting some staff loose on them in the next week or so. So I'm not the worlds leading expert on this, but it is fairly fresh in my mind.

 

You can just bind your macs to your AD domain, the advantage of using a mac server (we went for a mac pro, but a mac mini server should be fine) is to lock down your mac clients. Like a basic GPO really.

 

Drive mapping the type of which you want is working in my environment. Our users use \\server\share\intakeyear\username quite happily as their home drive. We have also created shortcuts on the dock to our usual windows shares.

 

Your shares on the network should be secured anyway. What happens if someone walks into the building and plugs their laptop into a data socket? I would worry less about what the macs can access, and more what anyone could access if they so wished!

 

Apple remote desktop is a useful bit of software, and not too expensive. Also look into Deploy Studio. Fantasic bit of software for imaging the macs.

[clareq]

Sounds like what I did last year. It isn't difficult to do alone, but do lots of reading up on it first. We have a Mac mini server and it copes fine with the 30 imacs and 25 macbooks we have around the place. Ask yourself whether the students really need all those mapped drives - we realised that mapping an apps drive to a mac was a waste of time so ended up just mapping their user area and shared files. Bootcamp does give you a better return on investment, because the machines can be used by other subjects as well. Look at rEFIt to select the boot drive at startup, and at Deploy Studio to image and deploy both partitions - both are free.

[Slartibartfast]

I would strongly advise against dual-booting unless you have a very specific need to do so - it effectively doubles the number of machines you need to support. If the machines spend most of the time in MacOS, Windows Updates don't get applied; if they spend most of the time in Windows, MacOS X maintenance scripts don't run.

[tom_pearson]

We've recently had this kind of set up installed in our school.

1 Mac Mini Server + 12 iMacs bound to Windows 2008 domain. We've locked everything down and customised using Workgroup Manager on Mac Server

 

I was initially going to do this myself, but in hindsight I'm glad I didn't!

 

John Roberts was our consultant who rolled everything out for a very fair price JR Professional Consulting Services | Home

[morganw]

some additional things to consider:

 

Web filtering - how are you going to authenticate users through your filtering solution (assuming you don't just use an ISP provided filter).

Network performance - since the entire home folder sits on the network any bottlenecks in bandwidth can make OS X unstable, even opening a small application can lock up the machine if there is no bandwidth left. Wire everything if you can, the only issues we now experience are with big files over wireless.

File size - it's typically impossible to set disk quotas for media work due to the massively varying size of media that will be worked with, applications like iMovie don't help by hiding the mechanics of what you are doing. I've seen someone hit the wrong button and their 5 minute video exported as an 80GB file.

There isn't an equivalent of the windows update service to install Apple software updates, you'll either have to make sure no one is using the Macs and then push the command using something like Apple Remote Desktop or start writing scripts to try and intelligently time the installs. You'll end up doing it manually because it's the only surefire way for it to work correctly.

 

I'm using Centrify Direct Control and am managing ours myself (and had some major headaches in doing so) but if you go to an external company you'll save yourself a lot of time and hassle.

[pete]

There isn't an equivalent of the windows update service to install Apple software updates, you'll either have to make sure no one is using the Macs and then push the command using something like Apple Remote Desktop or start writing scripts to try and intelligently time the installs. You'll end up doing it manually because it's the only surefire way for it to work correctly.

 

That's not strictly true. Reposado allows you to use a simple webserver to provide updates. Though admittedly if you're not a penguin fondler (and I get the impression the OP isn't) it may not be straightforward.

 

See:

Introducing Reposado « Managing OS X

https://github.com/wdas/reposado

reposado | Google Groups

 

You can also use Time Machine for scheduled backups to smb storage. Requires a couple of changes to config files, but does allow end-users to backup media work to cheap bulk storage from the local scratch disk (our lot all work locally on video files, then save to dedicated media storage on the network). QNAP have a decent how-to: How to setup your QNAP NAS with Apple Time Machine - QNAPedia

[morganw]

There is also Google Simian for cloud based OS X management, and Munki or Puppet if you want to host your own management system.

The point being, with what you get from Apple, you don't get enough to manage it properly.

+1 for Deploy Studio as well.

[apeman]

This isn’t difficult to do at all, give it a go and if you get stuck there are plenty of support forums out there with people willing to help. Don’t use contractors to do it all, as you wont know what’s been done so when things go wrong you wont know where to look.

 

Binding to active directory is very easy; you use the directory utility to bind to AD, which also has a check box to map the mac home directory to the AD home directory

 

Policies can be done locally but I would advice against this, as there is no central management. So every time you need to make a change you have to visit each machine.

Instead buy a mac mini server and setup Open Directory and connect it to AD so you have what’s called a magic triangle setup, this allows you to apply policies to AD security groups and users etc.

 

Policies for basic settings are very straightforward but for more advanced setting you have to look at each applications plist file (if they have one) and work out which bits you need.

You can also use the policies to map printers and also use them to map shares at logon using the users credentials.

 

Things to watch out for/Tips

 

I think your biggest problem is going to be snow leopard (10.6), it is utter s**t when used in a network environment and connecting to SMB/CIFS shares, there are random lockups and freezing of the OS and apps.

It worth enabling ABE on your windows shares, this means users only see what they have access to (as long as security permissions are correct) but it also really helps the mac speed when browsing shares

 

Bootcamp: I wouldn’t bother with this unless needed, other users in this thread have point out good reasons why not to bother plus you will need to buy windows licenses for each mac as well

 

Imaging the mac: look into deploystudio it’s very good and free. It can restore osx and windows if you need bootcamp. It can also automate binding to Active Directory and Open Directory when restoring the image. I would purchase another mac mini if possible and use it as a deploystudio server and a backup Open Directory controller.

 

Networking: if possible have gigabit all the way from the servers to the desktop. This is does make a big difference as some apps are bandwidth hungry and it will also help the restore time when re-imaging the macs.

Wireless isn’t really an option for anything other than web browsing.

[morganw]

I think your biggest problem is going to be snow leopard (10.6), it is utter s**t when used in a network environment and connecting to SMB/CIFS shares

 

Completely true in my experience, I've had to revert to using AFP shares on an OS X server. I'm going to to test 10.7 with Netatalk and see if I can migrate to that.

[cr31]

some great replies there thanks very much.

all of which is noted..

I will try and persuade them NOT to dual boot and just keep it purely mac (which will save me alot of hassle!)

Id rather tackle this myself (with the help of the other IT techs) then get contractors in to do the work.

Should be a great learning curve!

[cr31]

so i use AD-OD to bind the macs to the windows serve

some sort of MAC server to manage GPO\restrictions using workgroup manager

 

whats the best way to get drives to map when a userlogs in? (some kind of script?)

There shares will typically be

-personal space

-staff/student shared area

-Media storage (different server where media students have a very large storage quota to save big files)

[morganw]

Personal space would just be the home folder which is either redirected to a server of held on the local machine.

For shared storage you automate with a login scipt or have an icon to trigger a mount of a shared volume, if you have kerberos setup and working you should be able to mount smb shares but I would wait and see what 10.7 brings with it's new smb client before relying to heavily on it. You could just use another AFS share though.

For media storage you will have a problem, 'helpfull' programs like iMovie will default to creating everything and working within your home folder and trying to work from an additional drive doesn't come naturally. You'll probably find it easy to just give a massive amount of space to whatever holds you home folders and then just do everything in there, you then need a massive backup provision to keep it all safe.

 

If you are just starting out with this I would really recommend you pay someone else to setup and maintain it unless you can dedicate a lot of time to testing and maintenance. I would also be hesitant about paying for a setup and then trying to take it over without any ongoing support. In particular Apple's AD directory services client has been flakey in the past and software updates can sometimes break things.

[jubbi]

All your Shares can be added to the dock using workgroup manager. This is how I did it, which mounts them on first click rather than at login, which some people dont like to do. It improved login times so much doing it this way. On your machine with the admin tools, connect to the shares. Then in workgroup manager, go to dock preferences for your user group and add each mounted volume to the right of the dock. Easy.