morganw

FOG is flat imaging, MDT is task sequence based (as described above). As part of a task sequence you can deploy a flat image if you wanted to use the traditional image building methods. MDT task sequences should be lower maintenance and more flexible across different hardware due to the methods of driver injection. MDT can't do remote rebuilds (for this you need SCCM) like FOG can, and FOG has printer management, hardware inventory, and it's own (albeit less flexible) software installation system.

While testing out some stuff for terminal services I did have some success using group policy preferences to delete the local folders as the user logs in so they aren't seeing a local one and a redirected one.

Active Directory Integration for Mac OS X Mainly to use set system settings via GPO and not use an Apple file server (as they no longer make servers).

You could set up two WPKG systems, one for running on workstation boot or as a background task for software installs, the other just for triggering user level stuff.

I've been using 0.31 since Monday, haven't had a chance to test it a range of hardware yet but so far no slow downs when imaging. The new interface is a lot nicer to look at and faster, it isn't finished though, the frontpage is a little buggy and the imaging history chart is just a fake placeholder. I definitely didn't image 400 PCs last week. Still no deployment of a single snap-in for groups though!

If the script is running in the context of the user logging in it won't work properly. You'll need to elevate permissions on it and probably trigger it some other way.

Are you calling the WPKG script through a scheduled task or something like that? If you are using the WPKG client or WPKG-GP then everything should install with the system account so permissions should be an issue. I've just set up all our software through WPKG-GP and haven't had any permission issues.

Personal space would just be the home folder which is either redirected to a server of held on the local machine. For shared storage you automate with a login scipt or have an icon to trigger a mount of a shared volume, if you have kerberos setup and working you should be able to mount smb shares but I would wait and see what 10.7 brings with it's new smb client before relying to heavily on it. You could just use another AFS share though. For media storage you will have a problem, 'helpfull' programs like iMovie will default to creating everything and working within your home folder and trying to work from an additional drive doesn't come naturally. You'll probably find it easy to just give a massive amount of space to whatever holds you home folders and then just do everything in there, you then need a massive backup provision to keep it all safe. If you are just starting out with this I would really recommend you pay someone else to setup and maintain it unless you can dedicate a lot of time to testing and maintenance. I would also be hesitant about paying for a setup and then trying to take it over without any ongoing support. In particular Apple's AD directory services client has been flakey in the past and software updates can sometimes break things.

Completely true in my experience, I've had to revert to using AFP shares on an OS X server. I'm going to to test 10.7 with Netatalk and see if I can migrate to that.

There is also Google Simian for cloud based OS X management, and Munki or Puppet if you want to host your own management system. The point being, with what you get from Apple, you don't get enough to manage it properly. +1 for Deploy Studio as well.

some additional things to consider: Web filtering - how are you going to authenticate users through your filtering solution (assuming you don't just use an ISP provided filter). Network performance - since the entire home folder sits on the network any bottlenecks in bandwidth can make OS X unstable, even opening a small application can lock up the machine if there is no bandwidth left. Wire everything if you can, the only issues we now experience are with big files over wireless. File size - it's typically impossible to set disk quotas for media work due to the massively varying size of media that will be worked with, applications like iMovie don't help by hiding the mechanics of what you are doing. I've seen someone hit the wrong button and their 5 minute video exported as an 80GB file. There isn't an equivalent of the windows update service to install Apple software updates, you'll either have to make sure no one is using the Macs and then push the command using something like Apple Remote Desktop or start writing scripts to try and intelligently time the installs. You'll end up doing it manually because it's the only surefire way for it to work correctly. I'm using Centrify Direct Control and am managing ours myself (and had some major headaches in doing so) but if you go to an external company you'll save yourself a lot of time and hassle.

Whatever you are importing into MDT, check that it will manually install with no issues by point the windows pnp wizard the the relevant .inf driver definition.

I haven't at the moment, went the last year without Quicktime and was okay but now I've got there some iPods Touchs floating around for educational purposes so I need iTunes somewhere to let teachers updates Apps and such. Not my idea and I'm not convinced it's a good one, not particularly keen on everything Apple related being managed through music and app stores with no enterprise tools. With my profile speed issue I've only got Smartboard Notebook (and it doesn't seem to be copying masses of stuff into the profile) and LanSchool installed. The only thing generating sizable files is Windows Mail.

Fast logons and make iTunes and Quicktime disappear, then maybe we've got a deal.

It's been three years and I wouldn't trade it in for anything else, Office 365 included :-)

Is the registry edit above the only way to get rid of it with automation? We use Google Apps so we don't need a local mail client.

The mandatory proflie is about 2, but when logging it it grows to 20. Most of it being down to the setup and backup of Windows mail.

I think as part of the profile setup it generates about 12mb of mailbox data for the user, then initiates a backup of it which adds another 2mb. Overall the profile picks up about 20mb of data during the login. Thanks for the registry tip, I'll take a look. Antivirus is Microsoft Forefront Endpoint Protection 2010.

I don't think your network card is supported by the kernel so there is no connectivity after once the TFTP transfer has finished. Do you know which chipset these netbooks use? It also looks like you are using an old version of FOG as the latest ones have an option on the PXE menu called 'Client Information' where you can run a test to check it is okay with the disk controller and network adapter. The next version of FOG is apparently out today / tomorrow so it might be worth running the upgrade. If you don't want to upgrade the entire system then try using an alternate kernel (try one with KS in the name as they support a broader range of hardware), or get the kernel from the latest version of FOG and just drop that in.

What stage does it get to and how does it fail?

I've just noticed this Maybe this is doing it.

No errors in the event log, everything looks normal and works with no problems. It's just slow to login.

I've found that when I create a mandatory profile for Windows 7 (by copying the default profile from the workstation - as supported by Microsoft), logging in with this profile takes about 1 minute 30 seconds. The two bits where it seems to pause for a while are 'Applying Folder Redirection' and 'Preparing Desktop'. The same delays occur when logging and building a letting a local profile build. If I make a profile by an unsupported method (i.e. log in with an account then using Windows Enabler to get a copy of the resulting profile) it only takes about 10 seconds to log in. Is it normal for the default mandatory profile from a Windows 7 install to take 1 minute 30 seconds to log in?

I've been using DriverMax to get drivers for use in MDT2010, not had any problems. For Nvidia drivers I think you can just download them and from the website and import directly into MDT. I've also had a few instances in the past where it was beneficial to put the drivers through a different filesystem (like a FAT32 memory stick) so that any weird permission stuff or 'this came from the internet' type warnings get reset.

If you set the 'AD joining' username by setting it through a FOG group then there is a bug which will remove the backslash, that might be worth checking. Are you adding these via a PXE boot or are you creating the host defintions yourself? Also the last few releases of FOG don't use netdom so if you think you have the newest one then something is amiss.