AntonioRocco

Hi What's stopping you from contacting Thursby direct? You've purchased it from them as well as the license. I would think they'd be the ones best placed to help you. You've only got to contact them: Thursby Software HTH? Antonio Rocco (ACSA)

Hi Unless someone else posts and AFAIK there is no way of doing this easily. You have to realise you're talking about two distinct Kerberos Realms and KDCs. You can't add Prinicpals from one Realm to another and in an SSO environment there should only be one KDC generally. If for operational reasons your location benefits from running two parallel directory servers with all that that means then you could setup a Cross Realm Trust Relationship? Tickets/Keys from one Realm are trusted in another. That way authentication should work when Prinicpals are in one krb database with another. As you can appreciate this is not a trivial thing to do and may not be achievable in your environment depending on the Server Versions you have? However I don't think the above actually tackles your question? You can have an OD environment separated from the AD one yet still interacting with it on many levels. If Users and their passwords are exactly the same in both databases you could define an OD Password Policy that is synchronised as much as possible with the one in AD. This is easily achievable with the tools available in the interface - there should be no need for the command line, although it's there if you want it. If students are more likely to logon to a PC first on the password change due date they would have to repeat the procedure when they log onto a mac. The process would be repeated if it was the other way around. As already mentioned if no-one else posts with something that actually works and more importantly doesn't break anything else that's about as close as I think you can get. If TomH sees this post It would be interesting to hear his views? HTH? Antonio Rocco (ACSA)

Hi @salinpoo Sorry to hear you've having problems. If it's any consolation I've successfully integrated OSX Server and Clients in a Windows Server 2008 R2 AD environment with none of the problems you're seeing. More than once. There is a 30 second or so delay before Network Accounts are available but I think that's a natural consequence of an environment that contains 65000 active nodes. Apart from this it works well as you would expect. @Mark sudo killall -USR1 DirectoryService Enables the DS Debug Log. Once enabled you view the log by lauching Console and selecting /Library/Logs/DirectoryService/DirectoryService.debug.log. Or launching terminal and issuing "tail -f /Library/Logs/DirectoryService/DirectoryService/debug.log". The "tail" command with the "-f" switch displays constantly updated entries to the screen. You use the same command to disable the log. Don't let it go on for too long - 30 minutes or so should be long enough? It can get large fairly quickly if you forget. There's also another command that enables API (Application Program Interface) logging and lasts only for 5 minutes which you may also find useful? sudo killall -USR2 DirectoryService You could also issue this command in another shell: man DirectoryService Which is the manual for DirectoryService and should list all the error codes. These may be useful in understanding the logs? You could also log what DirectoryService does at startup by creating two files (use TextEdit with the Plain Text option) and save them as .DSLogDebugAtStart and .DSLogAPIAtStart. Save them in /Library/Preferences/DirectoryService folder. Restart for logging to take effect. It's advisable to not use hyphens when naming mac workstations. This could contribute to what you're seeing? Malformed SRV Records could also be a factor. Double-check they were created properly. I have been to sites where this was the case and macs were losing 'sight' of Directory Services as you've described. Avoid using user names that take this form: firstname.lastname. The full point between the names can cause login problems. HTH? Antonio Rocco (ACSA)

Hello Mark I'm well thanks. I trust the same for you? Re-reading my post it does tend to come over as being slightly pessimistic? Of course I would recommend port trunking whenever possible. It can't hurt can it? I did this the other week and the 'conversation' the bond has with remote nodes seemed improved on what I've seen before. So I guess you're right regarding Apple's improved implementation of LACP in 10.6. What would be good in a purely experimental sense is to try it with a single NIC first. Monitor throughput for a period of time. Then create the bond and repeat the experiment with the same amount of data. Compare the results. You'll know then won't you? Know what you mean mate! Everyday I wake up and think "what the **** happened?"

Hi Yes I've done this numerous times. However not everyone agrees on how to implement LACP. That's your first problem. Another possible problem is not all switches appear to be compatible. In my experience Cisco, Netgear and ProCurves work well. ZyXel and 3Com not so much. Not tested any others. Anther problem is you have no control over how the bond 'handles' data streams. For example don't expect a 2GBits pipe. You'll only actually get 1GBits. If you start data transfer from two or more nodes you may find the bond arbitrarily deciding not to use the other NIC. This would mean all traffic is handled by only one of the NICs in the bond. Then again the bond may arbitrarily decide to stream data on both giving you two simultaneous 1Gbit streams or portions thereof. Yes it provides a measure of redundancy in case one link goes down but you could as easily (if you're quick enough) connect a patch cable manually. HTH? Antonio Rocco (ACSA)

Hi This is not something that can be done using WorkGroup Manager. You want Apple Remote Desktop (ARD). Add client workstations to a List - make sure the local admin name and password is the same. That way they can be easily added as one. Select them all and send this unix command from the pre-defined Presets systemsetup -setnetworktimeserver whateveryouwantittobe Run the command as root. You can specify an IP address or better still the fully qualified domain name. If you don't have ARD you should consider buying it. Yet another way of doing this is via SSH. Open an SSH Terminal connection and send the command as already outlined. You can open numerous SSH connections from one source. However you have to enable SSH first on each workstation - if you've not already done so? If you've not done this it will mean going round each one logging in as the local admin and ticking the relevant box in the Sharing Preferences Pane. Whilst you're there you may as well set the Network Time Server! You could have pre-defined this setting in your NetBoot Images. Like a lot of things begin at the end to start at the beginning. Stick with it as it does make sense. HTH? Antonio Rocco (ACSA)

Hi Steve Unfortunately not. You have the pleasure of laboriously defining MCX all over again. Perhaps you could submit this as feature request? Apple - Mac OS X Server - Feedback HTH? Antonio Rocco (ACSA)

Hi TomH as with all these things were talking 'out the box' rather than 5 generations of various IT Technicians tweaks Absolutely!! Can't say that about OD can we? As we know mature, 'Legacy' AD environments have the most imponderables to deal with. Generally because the current admins have no notion of what was done before. Why would they? Besides previous admins have a tendency to not tell successors anything anyway. "Must keep hold of knowledge - Bad to share" attitude which ultimately helps no-one. For current admins, as far as they're concerned it works. There's no need to do anything to upset it. Does not make it right though does it? Some IT Admins facing mac integration don't know what Kerberos (along with DNS, sadly) really is; how it's implemented in their environment or how it truly works. Let alone that the time sync interval can be expanded. This is standard MIT Kerberos stuff as you know. This is not a criticism guys just an observation. I have nothing but respect for all of you as it's not easy doing what you do. Especially when someone takes an arbitrary decision not involving you in any way regarding equipment you know nothing about yet are expected to fully support. Gets your back up doesn't it? Sometimes this develops (quickly) into an 'unwilling attitude' which can add to the general 'mix'. "Have you ever seen a environment with a larger than default Clock Skew?" Yes as I always make that recommendation. Sadly only a few listen or understand its implication. Coupled with the 'passinterval' setting (sometimes) it can 'cure' all sorts of problems. Assuming everything else is perfect of course. "most things can be resolved and generally its just a case of proving what the problem is before applying 'random' fixes from google that may or may not improve the situation" I'm with you there Tom. We're talking the same language. "I have seen some really weird fix's that just hasn't helped the situation at all" Absolutely. Tony

Hi @ TomH A lot of good knowledgeable advice however this statement: "if the macs time are out of sync that can cause failed login atempts. are they picking up time from dc?" "Yes they have to be within 5 minutes" Is not strictly true. The default time sync interval when promoting to DC is indeed 5 minutes but can be easily expanded to 10. Simply changing the relevant Kerberos Policy setting in the Local or Group or Domain Security Policies is enough. Unbinding and rebinding afterwards is a good idea as that way clients will get a fresh TGT based on the expanded time sync interval. You could also do this via the command line. IMO it's still a good idea to disable the requirement for SMB Digital Signing (if Server/Client agrees). Not the 'deal breaker' it used to be in 10.4 and earlier it can still introduce an unnecessary 'lag' which might make it possible for workstations to 'lose contact' with the DC. Add this to the usual mix of a 5 minute time sync interval; slightly iffy DNS; TLDs based around .local; stale reverse DNS records resolving to hostnames previously assigned to PCs and even (depending on switches used) an inability to query ntp on port 119 can easily add up to the problems being reported. It should also be noted that PCs (no integrated macs at all) can also 'lose sight' (admittedly not as often) of the DC and present similar problems. If this happens at your location look at the network itself. A lot of school networks still have the odd hub hidden away somewhere probably up-linking something to something. Duplex mismatching is another thing to look at as well as Port Fasting and even Spanning Tree. Just because a switch is new does not mean it's not faulty. One thing is certain: Introducing macs into a mature AD environment will find every flaw and weakness like nothing else. The platform in many ways is a little like Goldilocks looking for the bowl of porridge that "tastes just right." However not all sites have problems. There are many many sites where macs don't have problems logging in or losing sight of AD. Admittedly they may have or do have other problems. There are also sites in my experience (and probably TomH's?) that have had and still have no problems at all. Generally these tend to be sites where the AD environment was built to accommodate macs to begin with. It should also be noted, in some cases, integration may not the best option? Especially true if the AD environment is an RM build. CC3 certainly although, strangely, not all of them. As for CC4? Don't even go there. It's bad enough for PCs alone. If this is true for your site it might be best to consider a different strategy instead. A separate OD environment completely divorced from AD yet still interacting it with on many levels is more than doable and possibly even desirable. HTH? Antonio Rocco (ACSA)

Hi @Dos_Box I agree. Retrospect for Windows (superficially similar but actually slightly different) is a much better product. The reliability and some of the functionality is not there in the Mac version. It's never let me down on a recover either. Antonio Rocco (ACSA)

Hi @theeldergeek Here are some others you may not have heard of: http://www.tri-edre.com/english/tribackup.htm BakBone Software - Products Atempo - Data Management, Simplified. - Atempo Time Navigator CrashPlan - Automatic Online Backup for Home, Business and Enterprise ARCHIWARE :: Software zur Sicherung, Verteilung und Archivierung von Daten And as already mentioned BRU. Some or all of these may not be to your taste or budget. Some or all of these will (sooner or later) require some command line interaction. You could however forego any or all of these and use what's built-in. Yes! There are backup utilities built-in and have been since 10.3! Command line utilities such as ditto and rsync (even asr at a pinch) can be easily scripted and defined as a scheduled service using launchd or cron. Depending on the OS cron may not be an option. You can even define an option that sends an email (to a desired address) on successful completion. A tutorial on how to use rsync here: Everything Linux - A Tutorial on Using Rsync Launchd: Getting Started with launchd launchd If the command line is not to your taste there are GUI alternatives. Lingon for launchd and for rsync: arRsync – an Rsync GUI for Mac OS X : Bart Busschots Or Google some yourself? Retrospect 8 is actually not too bad once you figure out how it works. IMO it's a better prospect than previous versions. The problem I have (and have always had) with Retrospect is how p***poor it is at recovering data when disaster strikes. Too many times recovered data is unusable. Not what you really want is it? HTH? Antonio Rocco (ACSA)

@ sidewinder Hi AFAIK you use 10.6 SIU to create your nbi as a NetRestore image. Once you have that you should be able to use NetBoot or if you want DeployStudio as it should be able to work with nbis regardless of which version SIU was used. Why don't you try and build your image using what's built in first to see if it works. It should do? Having said that I've not used DeployStudio. Hopefully others who have may respond to this thread soon and possibly help you out? Antonio Rocco (ACSA)

Hi Was the hardware used to build the image being deployed by DeployStudio a 27" iMac? If the answer is No that would be the reason. "Has something changed in these latest macs?" Yes. Graphics chipset for one plus the processor itself as well as a few other components that will probably be different to the hardware used to build the image you already have. You can't assume a single image for a iMac will install let alone boot all other mac models including older or newer model iMacs. For example if you used a 2.66 Ghz 20" iMac that originally came with 10.5.6 to build your image it won't boot or install on a MacMini, MacPro, MacBook, MacBook Pro or the latest 20" 2Ghz iMacs. You can use an image built from a 2.66Ghz 20" iMac and install it on a comparable 24" Model that was available at that time. Hope this helps? Antonio Rocco (ACSA)

Hi I have to agree with DMcCoy. Many years ago I also did the 10.4 Courses and I found the same thing. Luckily I was familiar with some of the bits that were broken and how to work around them. The ACSA Courses on the other hand don't pull any punches and cover far more ground at a much deeper level. However they come at a price in the mental investment required to not only complete the course but to pass the tests of which there are many (depending on the track course taken). If you think the ACTC Test is/was hard the ACSA Course is harder still by a factor of 10 (at least). Mark required to pass is higher. Things have changed since 10.4 as there were multiple track courses you could take. Apple began to ring the changes with 10.5 and now 10.6. No such thing as ACHDS anymore or even ACDT or ACPT. The 'rules' regarding re-certification are also changing although for hardware you're still required to re-certify yearly. I would not be surprised when 10.7 (KiteKat perhaps?) comes out it will all change again? Antonio Rocco (ACSA)

Hi Yes it's more than possible. In an AD SSO environment your mac workstations should be using one of your servers for their NTP Server anyway. Yes Windows Servers are poor at keeping time and do they drift but as long as they all drift by the same amount then it should be OK. To change the NTP Server mac clients use launch System Preferences > Date & Time > IP address of your PDC. Antonio Rocco (ACSA)

Hi @ macshinobi DMCoy is on the right lines. For a brief explanation and possibly some links: Shell Programming! If you want to learn Shell Scripting this is a good place to start: Advanced Bash-Scripting Guide I've not read it all (it's rather large) but I would not be surprised if the Tee-Cee and Korn shells are in there somewhere? Different shells have different strengths and are good at achieving certain things depending on what you want. The Bourne Again Shell (bash) which is predominantly used on OSX is a good all rounder but it's not the only shell available. For example keying in "tcsh" (minus quotes) in Terminal will put you in the Tee-Cee Shell. You know when you're in tcsh because the percent sign will follow the username. The bash shell uses the dollar sign. Keying "ksh" presents the dollar sign and nothing else. Keying "bash" gets you back again. To find out more from the command line itself simply launch Terminal and key in: man bash (for the Bourne Again Shell) man tcsh (for the Tee-Cee Shell) man ksh (for the Korn Shell) No doubt there are plenty of other shells/programming environments (the POSIX World is vast) which may or may not be available in OSX. Half the "fun" is discovering them for yourself. A fairly general rule of thumb is if there is a downloadable binary available you should be able to "make/compile" on OSX. Macports and fink are two examples. This would also be true of Linux. A good resource for UNIX on OSX is here: Apple - Support - Discussions - Unix Antonio Rocco (ACSA)

Hi Launch WorkGroup Manager. From the WorkGroup Manager Menu select Preferences. Enable the "Show "All Records" tab and inspector" option. A new icon (looks a bit like a bullseye) should have appeared in the icons tab. You should also gain an extra "Inspector" tab in the right hand window. Click on the bullseye icon. There should be a small pop-up menu which you can click on. Select Mounts. Can you see the previous automount share? Select and delete it. Quit out of WorkGroup Manager and re-launch it. Is the Home tab now displaying the information you want? When creating shares it's best to do this on the Server itself as is creating users and groups. Managed Policies are best set on a client workstation that has all the desired applications installed. Get into the habit of quitting out of both Server applications on the Server itself. Server Admin in the past had a 'tendency' to cause memory leaks if left open for long periods of time. WGM not so much. Not used 10.6 Server Admin that much to give an opinion either way. Both applications remotely don't present the same problems. Antonio Rocco (ACSA)

Arcath By all means install Sophos for the reasons you've said and any other reason you can think of or are contractually obligated to do. But you're not installing it to prevent viruses from infecting the Mac platform. All you're really doing is providing an extra layer of protection for the Windows platform. This is probably the best reason for installing it anyway. FYI I'm neither a fan or an apologist. If the Sophos package is not installing then either you've got the wrong one or you're doing something wrong. Antonio Rocco (ACSA)

Hi theeldergeek When creating any folder (either at the Finder level or using the option within Server Admin) that is to be used for 'housing' users' home directories/profiles the System 'sets' the default POSIX permissions at the moment of creation. Generally at the Finder level and depending which OS Version it is these would be: Owner : root/admin : R/W Group : admin/staff : R Everyone/Others : R Don't be tempted to change these. You may find network users won't be able to login as you've denied them access to their home folders at a level higher up than their homes. Setting the POSIX value for Everyone/Others to None is useful for denying a 'view' in certain circumstances depending on what you want to achieve. But denying a 'view' in POSIX is not the same as adding the $ symbol in Windows. It really does mean "No Access". With 10.5 and even more so with 10.6 you should not 'mix' the permissions models to control access. Whatever the system sets as the default POSIX permissions leave well alone and concentrate solely on ACLs. Once you drill down to Users individual home folders you should see the System has added an overriding 'deny' ACL anyway. There really should not be anything else you need do with regards to permissions unless you want to add an access ACL for desired staff. A 'Deny' takes precedence over an 'Allow'. If a 'Deny' is set at a level higher up than an 'Allow' the 'Deny' will be 'read' first. The 'Allow' won't ever happen. You can alter this behaviour with a custom ACL that will allow folder traversal. This can get complicated very quickly so use with caution. A 'Deny' in both permission models can cause major problems although this does depend on what you want to achieve. Antonio Rocco (ACSA)

Hi theeldergeek Save yourself some time and effort and leave things as they are. If as you say this is a 'pure' OD environment then it's not a problem as far as I can see. Glad I could help. Antonio Rocco (ACSA)

Hi theeldergeek "What I was thinking of doing is have a root home folder for each year group and then one for staff and others . . ." IMHO in a purely OD environment this would be the sensible approach. "My Year 11's would have their own folder, the same for Year 10 and so on . . ." This is one approach I generally use. "This means I could apply permissions at root so that, for example, teachers could have read only access to the 'year' folders, but not see other staff folders" Exactly. It's also simpler and easier to administer. If you want to deny a 'view' simply set the POSIX permissions for Everyone to NONE. "If I make a new share and tell it to be used as a Home folder will it have any adverse effect on the CURRENT home folder?" Depending on how you've structured things and what you want to achieve. No. "Can I create several folders this way and then when I create a new user, I simply ensure the relevant folder is selected in WGM?" Yes. Assuming a correctly configured OD Master all directories set to share and defined as automounting for Users' Home Directories in the LDAP node will present themselves in the Home Tab in WorkGroup Manager. It's up to you but I like to assign UIDS specific to a set of users and use the filter feature within WorkGroup Manager. For example Year 10 Users could all have UIDs starting with 10xx and so on; Year 11 would start 11xx and etc. You can simply select to show only UIDs that begin from a certain number. Okay you have to be slightly creative with this but I'm sure you get the picture? From there you should be able to click on the Home Tab, select the relevant path and click Create Home Now followed by Save. If everything is configured correctly all of the selected Users will have their home folders created at the desired path with the correct permissions consecutively. You can add overriding ACLs for whomever you like afterwards. A brief note regarding UIDs and their use on OSX: Any UID less than 501 becomes invisible. You want to avoid this for standard Users, Groups and Computer Groups unless you have a specific reason for hiding the user? "I have also noted, that the students can see the Xserve in their Finder sidebar, and whilst they don't seem to be able to get to other users folders, I would prefer for them to not see it. It has an 'eject' icon next to it, so it is being mounted from somewhere" This has been asked and answered elsewhere on this and other Forums: http://www.edugeek.net/forums/mac/35228-finder-browsing-sysvol-netlogon-folder.html You have to be a little careful with this 'desire' to make macs 'behave' as if they're PCs. On the platform this is how it's supposed to work. I don't know of any purely Mac environment that has a problem with it. Macs are 'designed' to announce themselves via as many network protocols the OS can support. You may also make it extremely difficult for users to 'navigate' to their own home folders when they want to save a document from within an application's interface. Hope this helps? Antonio Rocco (ACSA)

Hi @dansymons Your DNS is wrong. You have nothing resembling a fully qualified domain name (FQDN). Your Machine (A) Record is appleserver.local. This is not an (A) Record. Simply a hostname consists of a name for your server eg: myserver or ns01 followed by a dot; a zone/domain name, eg: mydomain followed by a dot; finally the top level domain suffix, eg: .com, or .net, or .private, or .anything you like . . . but not .local. There should be a dot after the TLD as this signifies the Server as being authoritative for that domain. Basically NS and SOA Records are created. Post the result of: host -a appleserver.local Do you see anything that looks like this: host -a edugeek.net Trying "edugeek.net" ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33510 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 2 ;; QUESTION SECTION: ;edugeek.net. IN ANY ;; ANSWER SECTION: edugeek.net. 172800 IN NS ns1.twisted4life.com. edugeek.net. 172800 IN NS ns1.edugeek.net. edugeek.net. 172800 IN NS ns2.edugeek.net. ;; AUTHORITY SECTION: edugeek.net. 172800 IN NS ns2.edugeek.net. edugeek.net. 172800 IN NS ns1.edugeek.net. edugeek.net. 172800 IN NS ns1.twisted4life.com. ;; ADDITIONAL SECTION: ns1.edugeek.net. 172800 IN A 78.46.90.218 ns2.edugeek.net. 172800 IN A 78.46.90.219 Compare the above with what you have DNS on one level does not really care what you use for the .TLD. The Windows platform has been using .local to differentiate what exists for public and private domains for years. Nothing wrong with this although I'd always go for split DNS as it makes things look nicer when dealing with external services. No obfuscation that way. On the mac platform however .local is reserved for Bonjour/Rendezvous services. This can and does cause problems when considering LDAP. This is because the local KDC is reserving the use of this for itself. As you can appreciate this can cause authentication problems when trying to login using Network Accounts from a mac client in an OD (or AD) environment based around .local. Sometimes the mac gets confused about which KDC it's supposed to be getting its SGTs from. Itself or a remote Service Principal? Don't forget clients look locally first for account/authentication before looking elsewhere. Apple have improved matters regarding the use of .local since 10.5.4 but this is only for AD environments. Your is an OD environment. In an OD environment avoid the use of .local every time otherwise you're going to have major problems all the time. On OSX Server Kerberos won't start if internal DNS Services are based around .local. in effect you don't get SSO and a fully working LDAP Service with all that that means. Open Directory on the mac platform consists of three separate components working together: PasswordServer, LDAP Server and MIT Kerberos. if any one of these has a problem you don't have Open Directory. On the server launch terminal and post the result of this command: sudo serveradmin fullstatus dirserv If this is 10.5 Server configured in Advanced Mode I'm guessing it will say: "STOPPED". If it does and depending on what stage you're at it may be easier/quicker to demote, sort out the DNS and re-promote afterwards? Everything apart from home directories is lost on demotion. Depending on how mature the LDAP database is this could be a good thing? Antonio Rocco (ACSA)

Hi Perhaps the naivety is yours? Your story is not really relevant as far as I can see? How long ago was it? Where you actually there or was this passed onto you second-hand? If that's the case how do you really know what happened? If a company is structured in such a way that they nearly go out of business because something like this happened then their problems go far deeper than not installing AV software. It takes nothing to purchase/hire another computer to keep things going whilst the others are being fixed. Any competent engineer would have had it sorted within 3-4 hours. Seriously this 'story' is so full of holes it's useless as an example. If we're truly talking about 'Viruses' and what most people would mean by a 'Virus' then there are none for the mac in the wild. There have been some 'created' programs that have appeared to have 'Virus' like abilities in the lab. Even if there happened to be a virus appear tomorrow how are students going to install it anyway? Anything Virus-like would need the express permission of root to install into BSD. To get that you'd have to go through the local admin account first. Even then it would only 'infect' the local mac. It's difficult to see how it could 'leap' across a network without sitting down at all the others, logging in as the local admin and invoking sudo to install it. Why would you do that anyway? More importantly how would students be able to do that? Unless you gave them the local admin's name and password beforehand? Perhaps you've probably stopped 'listening' by now anyway but FWIW my advice to you would be to stop approaching macs as if they were PCs, stop quoting the drivel that passes for information from websites that should know better and go and learn how the platform actually works. But you do have a point - sort of? Other forms of Malware can be something else. AFAIK apart from DNSChanger and some osascript scares - which turned out to be scaremongering rather than a true scare - there has been precious little else that actually causes major problems to the platform itself or to other platforms by transferring across. Once you take a balanced view of exactly what a Virus means you can then look at the 'opinions' Kaspersky, MacAfee and the rest have and approach it accordingly. They are trying to make money after all. Usually from the gullible and the ill-informed. IMHO all you need really do is make sure the PCs are covered. Clearly you can decide to dismiss all of this and do what you want. It's not going to make much difference either way. The delusion is all yours and you can nourish and cherish it as much as you like. Although to me it seems you have more money and time on your hands than sense? Antonio Rocco (ACSA)

Hi @Jamesreedersmith "To protect against Mac viruses!!!" I'm intrigued!!!! Which Mac viruses would these be???? Antonio Rocco (ACSA)

Hi AFAIK in previous versions you could not do this using the Enterprise Console. You have to go round and install the package either singly or if it's in .pkg or .mpkg format via ARD - assuming you have it? Once installed you should be able to 'see' the macs as well as do anything else Sophos related. Another way of tackling this is to take one mac workstation, install the package, prepare the workstation for imaging, create an nbi and then 'push' that image to the rest. Re-configure all the macs afterwards for your environment. You might be best advised to wait until an appropriate School Break? You would need OSX Server for this or if you have it DeployStudio. I guess it's kind of OK to install A/V software on macs but I have to ask why? Surely if PC workstations and Servers have it installed, configured and up-to-date what would be the point? Antonio Rocco (ACSA)