iSteve

Hello, We are looking to update our wireless system at our school with a more up to date Ruckus system. This would replace a much older Ruckus system that has been in place for many years. Since we installed this, things have moved on, so I am looking for those of you who have a 'current' Ruckus set-up to ask some advice - - I understand that, for the number of APs we wish to manage, we need to get the Ruckus Virtual SmartZone VM. What rough price should we be paying for this? - On top of the VM, is it correct that each AP needs a licence to connect to the SmartZone VM? - On top of the VM, and the licence, we are recommended 'WatchDog' support, per AP, per year. Is this support useful / necessary? It seems the cost for a working system seems to have gone up, and we are wary of buying in to things which we do not need. What do you guys have for your Ruckus systems?

We use DepolyStudio to create an image of the machine and then netboot / delay it over DeployStudio. We install 3rd party software using Apple Remote Desktop to install the package, or add it to the image and image the machine when we update things periodically Default Profile would have to be tinkered with on the machine / scripted

You can script this for your groups, then use Platypus to make the script a clickable 'app', or set that app to run at login for your users. This is what we are doing to get around the fact setting network shares for groups does not work in Profile Manager (as it seems).

Check out /private/var/folders We had an issue under 10.9 where temporary items in this path were not being cleared, and HDDs would fill up. Delete all the trash in here.

Hi all, We have had Macs at our site since 1996, and I have been administering them from OS 8.1, through to the present day. However lately we are finding more and more niggles with integrating macOS and iOS in to our Windows based systems. We have looked after the systems in-house and not sought any assistance from solutions providers, or have any support contracts in place for this sort of thing - typically using the Internet for guidance and/or trial and error, and therefore with this post I would be delighted to hear your experiences and share good practice. We were long time users of Workgroup Manager. We carried on using it with OS X Mavericks (10.9) Server to manage El Capitan (10.11) clients. This summer we bit the bullet and began moving our machines to Profile Manager on Mojave (10.14) server - why? - we wanted to attempt to keep up with a more contemporary OS and method of management. The way of managing macOS and iOS devices form the same interface was also appealing. Initial testing went well, but after the first 7 weeks of term we have some reservations about our move and are considering a return to Workgroup Manager. So what’s wrong…… 1) Network Shares It seems that telling a user group to mount a shared drive just doesn’t work. We have a network drive on a Windows server, which we wish all staff to mount on their computer. It will not work / apply when the setting is set for a group. It will work if we set it for specific users - which is not manageable, or machine, but not for group. The share is manually mountable, but it will not do it when set through Profile Manager at Group level, with no obvious reason. We have 10.11 and 10.13 clients and the failure is universal. We can’t upgrade these clients due to their age. This worked fine in Workgroup Manager, so we are considering going back for this reason alone. 2) Multiple platform management - we were of the belief that we could manage iPads from Profile Manager with consistent settings to macOS. It seems that once an iPad is enrolled in Profile Manager, the user can navigate to Settings and remove the device profile, making ‘management’ useless. I understand that the only way to prevent profile removal is to have the iPads enrolled with the Device Enrolment Program (DEP) at time of purchase. Is this true? We couldn’t predict this use at time or purchase, but now it seems we ‘can’t do it’. Some have suggested we have to manage the devices using Apple Configurator 2, before putting them in to Profile Manager - why do we need two products for this? If iOS devices can’t be effectively managed by Profile Manager, then should we go back to Workgroup Manger for our desktop Macs, and leave our tablets unmanaged? 3) Preference Management - Workgroup Manager had lots of existing preference manifests, for example, for Folder Redirection. It seems that Profile Manager does support adding manual preferences, but these all have to be written from scratch, or do not apply in the same way that they did in Workgroup Manager. For example, we used the MCX Redirector to redirect our users’ ~/Library/Caches folder. When replicating this functionality through Profile Manager, we attempted to redirect the whole ~/Library folder so that it was not the local machine in order to speed up logins and general use. This worked fine for a few weeks, then all clients had a melt down, becoming glacially slow on login for no reason at all. We then had to abandon using folder redirection from the server, and use a script (sourced from these forums). Our users now have a local home folder, with the folders symlinked to their network space. This is simple functionality (redirecting a folder) which we are having to jump through hoops to achieve. We got there, however now all users’ sidebar shortcuts are broken. There seems to be no way to manage this at all. The result is a rubbish user experience - a user will click “Documents” in the sidebar, to be met with a warning that the path doesn’t exist. They then believe that their files are not accessible. If we go back to using fully network based home folders, the machines are too slow to use with constant bechballing. Forward and reverse DNS is working correctly. 4) Mobile users - We had used Mobile Accounts for our laptop users, replicating the offline files approach that Windows OS uses. This lead to data loss with whole directory structures disappearing for users. We had to set our staff laptops to use local home folders, then backup their data using Retrospect. We are feeling that as years go on, the ability to integrate macOS devices in to the enterprise is leading to a poorer and poorer experience for users and administrators. Tasks that should be simple, like reliable folder redirection, or mounting a share on login, are not working with many users online simply saying “yeah, it’s a bug” or “upgrade”. What are you doing to manage your Macs on your networks? Are you finding that you have gone from years of stable and transparent Mac/Win integration to a system which is glitchy and a pain? Is it worth engaging a support company on this? Your thoughts and advice, as always, very welcome

Typically this error occurs when the computer cannot access the home folder, for example if there is a home folder path in AD, but the permissions on the folder are wrong, the user can't log in.

Hi all, We are running Profile Manager with our machines and using the com.apple.MCXRedirector preference to redirect the entire ~/Library folder for our users to the /tmp folder on the machine to prevent issues with cache file speed and Keychain lock-outs. This has been working perfectly for the last 3 weeks, however today we have found that the symlink to the user's library folder, redirecting it to /tmp, gets replaced with a hard, network based Library folder when the user opens an application. We can watch this happen: 1)User logs in. Their home folder has no library folder or symlink ie it is clean. The preference creates the symlink to /tmp as expected 2)The desktop loads on the client machine. The user launches an app, eg Safari 3)The symlink file in the home folder is replaced or converted to a normal folder called Library. The machine falls over and beachballs. Safari moans that the Keychain is not accessible etc We had thought that maybe something had gone awry with Profile Manager, however we have a few legacy machines which are not yet on Profile Manager, which we are managing with Workgroup Manager - these too have started behaving in the same way above. The Workgroup Manager and Profile Manager services are on two separate machines with no interaction between to two, so we are not sure what is causing this identical symptom on two separate systems. The only thing we have not done is restart our (Windows) file servers, incase there is something odd going on here, however I can't see why there would be, and if there was why it would be related to this odd symlink to folder conversion which is happening. If anyone has any advice I would be really happy to hear it!

Thanks for your reply. I had another look at things. Seems that the syntax as part of MCXRedirector differs from our 10.9 plists to High Sierra. I corrected this, managing to get ~/Caches to redirect. I then tried to redirect ~/Library to the /tmp folder. So far so good - the machine is snappy, and home folders still reside on the network. Just means all the personal settings, which kids don't really need, are kept off the network. This also makes the pain of administrative password resets breaking Keychain go away! Have also implemented a logout redirection to delete their trash on exit.

Hello, We are moving from El Capitan and Workgroup Manager to High Sierra and Profile Manager this summer. All is going well, except on testing, when a network user logs in, their account is glacially slow with the spinning beachball appearing whenever they attempt to do anything. I expect this is due to certain folders needing redirecting to a local volume, rather than the network, in High Sierra. Does anyone have any tips for best practise on this? Previously we were redirecting the ~/Library/Application Support /Adobe folder to /tmp, as well as ~/Library/Caches but I suspect these paths have changed in HS. At the moment, we have nice machines with SSDs which boot in seconds, but then as soon as a user logs in they become unusable. Any advice welcome

Reverse DNS was missing for our manged preference server - have added that in and will see how things go.

Hello, We have a large network of Macs (running El Capitan), talking to a Windows 2012 server with network home folders served over SMB and a normal AD domain. Since moving to the Windows server we have had an increasing number of issues for a lot of users, involving speed or lack of. -We experienced a problem where users had "full control" of their home folder, which would lead the Mac to block permissions for the user, giving an entry for 'Everyone' to Deny access. We have since resolved this. -The most recent issue is one where Safari and Chrome take an eternity to load. We are using a symlink to redirect the ~/Caches folder to the /tmp folder on the machine, which we have done for nearly a decade, but it seems that both browsers take ages to load. -Sometimes Microsoft Office 2016 is glacially slow to open We have been deleting the user's ~/Library folder in an attempt to blast any rogue settings, but this seems to not be a long term solution. We have also found that the ~/Library/Printers folder often has "everybody" deny permissions for some reason. Is anyone else running OS X with a vanilla AD and Windows home folder environment? Do you have fully network home folders? Client machines are 2.5GHz i5 machines with 8GB RAM and SSDs. Gigabit switched network. Any help VERY welcome!

Hi, Is anyone using App Inventor with students on networked Macs (http://appinventor.mit.edu/explore/ai2/mac.html)? We are experiencing problems with the software running over the network and I was wondering if anyone here is using it or if they can suggest an alternative that will run on 10.11.6 El Cap?

I would recommend https://www.macrefresh.co.uk Mac Refresh. Email them for machine availability. We have had probably 200 machines from them over the years from laptops to Mac Pro towers and the service / price / support is excellent.

Dear all, I have been asked if it would be possible for a teacher to stream their lesson via webcam, with audio, to a student in a different part of the school or at home. We have never done this before so I was wondering if anyone has any experience with this, or if there are any 'off the shelf' solutions that will allow a teacher to kick off a lesson and have a student connect to the webcam session remotely without too much fuss?

Not needing to know about proxy stuff - just wanted to know if there was a way to skip registration as per the first batch I did.

Hello, I have been presented with 20 Kindle Fire 7 tablets to set up. They all demand they are registered with and email address and amazon password before you get to the home screen. Is there any way to skip this step? I was given 10 to set up a couple of months ago and they did not have this registration screen. Any words of wisdom?

Thanks robk. I had seen the button in Net2, but was hoping there might be some sort of client that allowed for a very easy to use software button. Oh well, looks like a I need to do a silly cable run for the extra button!

Hello, I've been asked to fit a Net2 door system, which is no problem, but it has been requested that a receptionist has access to a second push to exit button so that she can open the door for certain people without having to move. Does anyone know: -Is it possible to connect a second push to exit button in parallel to the usual push to exit button - will the controller register to open the door? -Can this be done in software where the receptionist can click some soft of obvious thing on screen on computer to open the door?

One other quick question: Can the NC,NO etc terminals within the maglock be used to detect if the magnet is in contact? I understand you can fit a reed/door contact to signal alarm conditions to the net2 controller, but I believe if the magnet has "magnetic bond sensing" this can be wired back to the door contact terminals of the net 2 controller. Is that correct? I'd like to detect if the door has been held open, and it would be neater to use the lock if possible, than to fit door contacts.

Perhaps it is the manual then! Thanks guys.

Hello, We have a Paxton Net2 system, which we are expanding in-house. I have a question regarding maglock wiring, if anyone can help - We have maglocks with bi-colour LEDs. The manual states that when the lock is energised, and the door held closed, the LED should light green. When the lock is energised but the door is open, ie the magnet is not making contact, the LED should light red. In my situation, the LED lights red when the door is closed, and green when energised but open, so it's the wrong way round. I am wiring the maglock (via a break glass) to the +12v and 0v connections on the lock, disregarding the NC, NO, common terminals, back to the Net2 controller. Is this correct? The lock physically functions, but it's niggling me that the LED colours are the wrong way!

Hello, I was wondering if anyone is using, or has heard if it is possible for failover / redundancy for Profile Manager in OSX 10.12 server. It seems, certainly in previous versions of OSX that this functionality is not possible. It is possible to set up an Open Directory replica, however the config for Profile Manager is not wholly stored in OD, like it was in Workgroup Manager. I've a nice new Mac set up as an OD replica, which I would like to use for failover for Profile Manager...ready and waiting.

Hello, We have a batch of MacBook Pro users, and have been using Mobile Accounts with these as this is what we've always done. User logs in to laptop, it synchronises their home folder from the network, to their laptop, and any changes the make to files away from the network are synchronised back to the server. Sounds great, right? We've run in to a few problems with this in recent years - Home Sync can't cope with syncing open files leading to a home sync error which causes end users to break out in to a sweaty panic. Some users reported vast chunks of their home folders disappearing (and so we moved back to serving these over AFP, which seemed to cure the problem). We spoke to a company regarding a different issue, and touched on best practice for mobile users. It seems that using Mobile Accounts is not the done thing anymore due to reliability. Suggestions were made such as users storing home folders on USB drives, or using cloud storage - which is in vogue, but breaks away from our method of working where files are on OUR server, and sync to the laptop etc. For Windows machines we use Offline Files, and feel that Mobile Accounts, on Mac, replicates this functionality....ish. What are you guys doing in terms of staff with Mac laptops? How are you making files available on laptops, and available on desktops should the staff member log in to a desktop machine? What should we be doing?

Hi folks, We've been integrating Macs / Windows for nearly 10 years now, but are recently experiencing some trouble with user home folders. Clients are 10.9.5, AD is server 2008R2, home folders are stored on Server 2008R2 over SMB. This is all vanilla Mac OS and Windows - no 3rd party integration tools. When a user logs in to a Mac, and their home folder is mounted, it seems that the Windows server adds an Everybody entry to the ACL with special permissions, which are Deny for Delete operations. This causes problems as it will lock a user out of their Library folder so that applications do not run etc. If we remove the 'Everyone' entry, they can work as normal. There have been no changes to clients or servers in the last 18 months. This behaviour has been happening for a couple of weeks. Interestingly, at the same time, we are setting up and testing a new AD domain (with a trust relationship between current and new), using Server 2012 R2 for AD and file server. If I log in one of the Macs to the new AD, with a home folder on the new file server, the same thing happens - an 'Everyone' entry appears in the ACL with Deny Delete set. If I attempt to create a new folder on my desktop it will vanish. If I check on the server it's there, but with these deny permissions. If I remove the entry from the ACL they ping back up on the Mac. Has anyone seen this behaviour, or have a way to prevent this ACL entry happening on the Windows server?

We activated it, then students came to the door saying "I signed in to my email last night on my phone, and now my camera don't work no more" - it had disabled the camera, and torch and other such stuff.