Sibrows

I moved us away from CC4 last summer I underestimated the time needed to build and test software packages you may not have this issue if your sticking with the same software distribution method.

That sounds right.

Sounds right

Ok So my comment in post 9 was wrong its not the domain name its based on the SSID!

Change "Called-Station-ID Type" to MacAddress:SSID

You can only see the menu controller.

In short yes. You need some way of differentiating between the different wireless networks. We've done this by setting the "Called Station ID" which is looking for the clients DNS Domain name ".SJBStudents" which is set on the DHCP server. We have three SSID's all configured in this way.

I've configured our Meru controller's Captive Portal to look for authentication, using RADIUS, from one of our Domain Controllers and then the radius accounting is past to our Lightspeed Rocket for web filtering. We have three SSIDs each working on a separate VLAN and with a different domain name (this allows us to query the 'Station ID') and limit the user based on group membership. From your screenshot it looks like your connecting domain connected machines but I may be worth looking at adjusting the 'Called-Station-ID Type' setting in Configuration > Security > RADIUS to see if you can achieve the same thing. In our situation we didn't want to do this on our web filter as our staff iPads connect to their own SSID and SLT didn't want them having to login to use the internet at which point we base their access to the internet on the IP range they are currently working on.

Am I missing something? We've achieved this using RADIUS based on Security Group Membership in AD.

We have a studio/green room. Currently with: - three SD cameras linked into a visual mixer - separate sound mixing desk - lighting I don't pretend to know that much about it but I can find out some more if it would be useful.

Thanks @Brimstone for the lengthy response. While they will never officially admit it iPads, even when using 'Apple Configurator', were always designed to be used as a personal device. Using them in class sets will always be like trying to 'get a square peg to fit inside a round hole'. The original question was: Can only be answered by how your organisation intend to manage and use the devices. The reason for Managed App distribution is to all an organisation to keep ownership of an app license. Originally Apple only offered redeemable codes within the VPP scheme. This isn't an issue if your use Apple Configurator to manage the devices but you have to collect in all of the devices each time you want to distribute an app this isn't practical and its been found that anything over 100 iOS devices per Mac running Apple Configurator causes instability in the backend database. If pushed out using an MDM solution leaves the license associated with the end-users' iTunes/App Store account. This is where I was going with post 4 while it was short sweet and to the point it was also factually correct. I'm sorry I don't have the time to write lengthy posts cross-refferanced with links to the relevant knowledge base articles I have better things to be doing with my Friday evenings .

The controller is a MC3200 running 6.1-0-3 I'm sure you've seen the 'Rogue' options along the bottom menu. I've been lifting the MAC addresses of the APs from here an entering them in the 'Blocked List' under: Configuration > Rouge APs The 'Block only BSSIDs in the blocked list' is a 'Mitigation' setting on the global tab. The Blocked list is one of the other tabs

I've found the settings and have started to use the option to 'block BSSID's in the block list' in an attempt to avoid irritating the neighbours.

Ok, so the advantage of managed is that you can move the code between App Store account but if your using using class bookable I'm assuming the school 'owns' the account in question its less of an issue

Can you elaborate on your deployment scenario? - 1:1 devices or class / bookable set?

Thanks for all of your responses. As you've already alluded using MDM will stop them connecting at home. I was half hoping for a function on the Wireless System that monitored unauthorised Wireless Networks and dealt with them in some way. I believe that Rukus have a solution for this from a discussion with a network manager using their system.

Is there a way to deal with students using their phone as a personal hot spot in school to circumvent the web filter on a school provided iPad? We are currently running a Meru Wireless Network (MC3200 on 6.1-0-3).

I use Disk Drill Pro.

I be straight with you I'm not familiar with 'Enterasys'. - A number of wireless systems have the ability to block wireless client to wireless client traffic. This is more commonly used on public hotspots but I found a school with it setup mid last year. I'm sure you've already checked it but thought I'd ask. - Are you sure that the equipment isn't setup to block multicast traffic? - What kind of reporting is available on the system? - Can you see the bonjour traffic created by either the PC running reflector or the AppleTV?

I'm sure that you've already checked this but: Are the Apple TVs and iPads on the same subnet or are you using a Bonjour gateway to get the traffic between subnets?

Sorry for not being clearer: You would need to stump up for their full enterprise account (thats what we did).

In short yes - you can use their enterprise distribution.

I've just posted the following to the Apple Support forum but I wanted to see if anyone else was using Profile Manager in this way here? https://discussions.apple.com/message/27222793 ---------------------------------------- Background: I work for a large school in the UK each student now has their own iPad. We've experimented with various MDM solutions but Profile Manager appears to have one major flaw that I can't believe I'm the only one to find... The issue: Mac Mini running OS X 10.9.5 with Server 3.2.2 connected to Active Directory (2012 native mode). Profile Manager is applying settings and apps based on the user's group in Active Directory. This was working fine for about two months we'd enrolled coming up for 400 users and then overnight we had an issue with the settings being removed from every enrolled device and the devices have become detached from the user. Current progress: First time this happened half convinced myself that it was something that either me or one of my team had done had caused the issue so manually re-associated each device with each user. Then it happened again less than a month after that. This time I logged a fault with Apple who've investigated and tracked the fault back to being "loosing connectivity with Active Directory". I'd happily accept that this could be the issue but we're running with a pair of Domain Controllers each on separate virtual hosts. Both the virtual hosts and the Mac running profile manager are connected to the same HP ProCurve switch. I can't see any issues in the logs on our Virtual Cluster or on the HP ProCurve switch. As a result I have a hard time believing that this is the cause and now Apple would like to charge me to troubleshoot an issue that appears to be more fundamental with Profile Manager. Am I the only one trying to use Profile Manager in this way? Is what I'm asking of the hardware or software in anyway unreasonable? - Before configuring I found an Apple KB article about the response times for the previous version of Profile Manager with apparent support for 1,000+ devices.

For us Frog have insisted that its published via our internal network with ports forwarded as they couldn't cope with using 2 unused network ports in the rear of the server to allow us to put it on the DMZ. It took me long enough to get through to someone at their support who understood what I was asking.

Have you added the devices to a device group? Do the devices have the same name? Can you provide any further details on your environment? Are the users in open directory or active directory or something else. Profile manager can push out 'managed apps' from Apple's VPP scheme but the devices need to be assigned to a user and that user's iTunes account will need to be enrolled in your VPP scheme. If you are using 'redeemable codes' you will need to redeem the code on the iOS devices directly.