Sheridan

That's the thing, we're not talking about a lot of macs here, managing a dozen or so with WGM was simple and effective and didn't require any expense. Now we have to buy something because Apple have a) stopped supporting something that works and b) barely support something that has never worked When it comes down to the crunch, I can'/won't justify the expense to manage some old Macs - they will stay on 10.9 until they die. Then they will be replaced with Windows based PCs. If PM had actually worked at all I would have updated them all and kept them for longer.

Bit of an odd thing going on with some of our Macs (10.12) - we recently changed the AD settings in the Directory Utility to 'Create an mobile account at login' and therefore 'Force local home directory on startup disk' This is working for new users and they also see their AD home folder in the dock - as expected - but their home folders are stored on the local drive. However for users who have previously logged on before, they still seem to be mapped to their AD home folder, as I can see the Library, Desktop etc folders being created on login! I've deleted the user on the Mac local drive, and also cleared the Library folders from their AD home folder but it still keeps happening. Is there anywhere else a user's settings would cause this? We want to remove the AD as the main home folder as it slows them down so much.

I guess its either WGM or paid for. Its a shame as PM is 'nearly there' but having looked around it basically doesn't work properly in so many scenarios, apple must have just ditched any support for it. I though I had it working - created an OD group to add AD groups (as it doesn't read nested AD groups) and got profiles deployed to users. 24 hours later - no profiles being applied anymore - how flakey is this. There's no point buying the server app anymore as its pretty much dead in the water now.

Jamf Pro is licensed per device, per year I believe -that's what puts off some primaries as its an ongoing commitment for something they can't really see.

Looks like a paid for option is the only route apart from WGM - shame as its for such a small group Having spent some time with PM, I'm amazed how bad it actually is - its so unreliable and even the semi-working system I had yesterday has stopped applying profiles to users (but still applies them to macs oddly) If I could get away without Logic I'd bung Windows 7 on the lot of them!

PM does seem to be rather useless then! I've had so little issues with WGM in the past - but where do we go from here! Even the best paid for MDMs don't really give you the control that WGM did.

I have to admin defeat on this one, profile manager just doesn't give you anywhere near the management you need. For example, we want the users to have access to their AD home which works if you put the Network Home in their dock, but if you try and save there you get a network error, and their AD home isn't visible from within any apps (such as word, logic pro etc) so its a bit useless. So its back to 10.9 and WGM for me, it seems any later versions and PM just don't work like the old golden triangle methods

It looks like profile manager (or server 5.5) just can't read our AD groups properly. Browsing the groups list in the Server app shows some populated, but mostly not. I thought I was just at the point when I could use PM but this has scuppered that - profiles aren't applied simply because its not reading the group membership consistently.

Just been playing around with profile manager again, and it seems that applying settings to AD groups only works if it is a direct group membership, i.e not nested groups Problem is I'd like to apply a profile to 7 year groups, which all belong to an overall 'Students' group - but profile manager shows nothing in that group - it shows the members of the individual groups though. Does that mean I have to create a profile for every single group? That's a step backward from workgroup manager which seemed to deal with nested AD groups OK.

Yeah I’ve had a quick look at mosyle but the mdm solutions work well for iPads but not so much for Macs, where you want the level of configuration that group policy gives you. WGM was great for this and PM would just about do if it worked properly! None of the MDMs (and we use Meraki as well) offer much more than the basic app settings, so paid for is looking more likely, which is a shame as it’s only a small number of devices. I’m disappointed they way Apple have gone with WGM and pm, as in education suites of Macs are still very common and need some basic management tools. Writing scripts is a bit time consuming and not my area of expertise when it comes to macos!

It’s only 10 Macs, they have a mini to use as a server. Experimenting with profile manager hasn’t been a great success so far. I haven’t seen any free ones but I wondered if anyone had used one that they recommended.

It does like PM has never been properly finished, and now they're dropping it. Switching these to Windows is an option I guess, but we'd lose logic pro.

Its 10.13.3 on the Server (5.5) and the macs are running 10.12. Do you not restrict what apps can be run at all then? To be honest - if Apple are taking away the basic management tools then I'm inclined to run them as 10.9 with WGM and ditch them in a year.

Looks like I might have to revert back to 10.9 and WGM after all - most of the apps don't work unless I untick the 'Restrict which apps are allowed to launch' option. Despite adding Word (just as an example) to the list, and whitelisting the /Applications/Microsoft Office 2011 and /Applications/Microsoft Office 2011/Microsoft Word.app folders it still says 'You don't have permission to use the application Word' Even if I whitelist the entire /Applications folder it still doesn't work! So basically I have to allow everything or most of the apps fail.

Actually that's probably a better idea anyway - I might borrow that! Having all sorts of issues with PM, does it work reliably for anyone! I've restricted which apps can be run to a list - but the users still get an error saying its been restricted. I.e I've added Word 2011 to the allowed apps list, but when they try to open it they see the message 'you don't have permission to use the application' This all worked so reliably in WGM - I was hoping PM would be a step forward.

This is weird, having rebuild the server and client (to 10.13) the links are now working - all apart from the one that points to a Windows server - but I'll try your method for that one. On a seperate note, is there no way in Profile Manager to hide all the drives/devices listed in finder under Shared? Its showing all sorts of nas/servers in there that I'd rather were hidden.

No solution as yet, looks like we might have to buy a copy of the latest version purely to save the important ones out as PowerPoints. At least then we’ll be shot of proprietary stuff like this.

Great - thanks for posting that. I'm just rebuilding a new macos server so I'll test it on that when its ready.

Cheers would appreciate that! I’m rebuilding the server so want to get this working from scratch

The GA is still installed on the VM - and its set to immutable so no changes are saved when its shutdown. Some of the working machines have had the same updates as the ones that aren't working - mainly routine security updates and a CU, but in this case they're all the same hardward, same image and 70% have stopped working, 30% are still working.

We use Vbox 5.1 to run a W10 VM (on W10 hosts) fro programming course etc - its been working brilliantly but suddenly we've noticed that most of them have now stopped working with drag and drop/copy/paste. The option is still set to bidirectional, but dragging shows the 'no entry' icon, and paste is disabled. Nothing about the VM has been changed and the W10 hosts are all the same (ironically some still seem to work!) The host log shows we've got all the right things enabled: 00:00:02.336157 Shared clipboard service loaded 00:00:02.336174 Shared clipboard mode: Bidirectional 00:00:02.348795 Drag and drop service loaded 00:00:02.348816 Drag and drop mode: Bidirectional 00:00:02.373846 Guest Control service loaded They just don't work - what caused them to suddenly stop working is a bit of a mystery!

I need to update some macs in other school from 10.9 to the latest OSX and manage them (lock down settings, add proxy/certificate, restrict to using certain apps etc) and I have a mac mini I can use as a server. Thing is, I've used workgroup manager in the past which worked fine, and recently my experiences with profile manager have proved it just doesn't work - if there is any kind of proxy/firewall its just constantly 'pending' and settings don't work even when they do apply. Anyway - as apple have ditched WGM and are ditching PM effectively has anyone got any recommendations for something to manage only a dozen macs? Ideally free or cheap as this is just for one mini-suite. We did look at meraki but its not free anymore and the Macos settings are really basic and don't allow you to control them to the same level as WGM did.

Very odd - if I directly 'Connect to Server' with the same path it works fine - but not when pushed out with PM either as a dock item, or Authenticated Network Mount as a login item! Well - it seems you cannot deploy an SMB share to the dock with PM - fortunately WGM still works properly so I've put them back on that with immediate success.

I'm not a big user of PM, and have had to re-introduce myself to it to sort out another school's issue - but I'm not sure if what I'm trying to do is even possible. Basically the macs are OD/AD joined and users login with AD credentials and get a PM profile - this works but I'd like to add a shortcut to an SMB folder into their dock (using the PM settings 'Dock items') If I put a folder path in there (i.e smb://server/path) the user simply sees a question mark in their dock, which doesn't do anything when clicked. Am I barking up the wrong tree with this? or is there a better way to do this with PM?

Yeah they can use the web versions, they don't have any EES agreements as yet though so this is their only option! I'm sure it used to work last year sometime - wonder if this was changed recently?