AntonioRocco

Sounds like the issue 9 threads down from yours? http://www.edugeek.net/forums/mac/150299-imacs-still-hanging.html Might help? Antonio Rocco (ACSA)

Caching Server is designed to work behind NAT. A single external IP address translating to your private network. It's transparent to the end users and there should be nothing for you to configure. However not all private networks use single subnets. Assuming you haven't seen them these Apple Support articles might help? http://help.apple.com/serverapp/mac/4.0/#/apd74DDE89F-08D2-4E0A-A5CD-155E345EFB83 Scroll down to the heading "What if my network is more complicated than that?" This second link may be helpful for networks using routable IP addresses. http://help.apple.com/serverapp/mac/4.0/#/apd6015d9573 Antonio Rocco (ACSA)

Workgroup manager is deprecated (has been since 10.7) and you really should not be using it for 10.9 (mavericks) and/or 10.10 (yosemite). However it still does work (assuming you can put up with the odd crash and error message?) after a fashion. Secondly, even when it was not deprecated WGM has only ever had read only access to Active Directory. Which means you can't use it to create new home folders for users on AD. What you're proposing can be a lot of work especially if you don't fully understand the underlying technologies in both directory systems. if you've the budget, a 3rd-Party consultant who can guide you through it, would be beneficial. Antonio Rocco (ACSA)

The share is "students" and individual student home folders would all be floating loose inside it. If you're denying list/read rights to that share you've effectively denied students the right to 'view' their home folder. This will cause the problems you're seeing and give your students an unhappy 'mac' experience. I would look at what ACLs and/or policies you have applied to that share and at least assign list/read rights to that share. They should be able to login and access their home folders after that if you've done it correctly. Permissions for student's home folders should be set to allow individual students read/write rights to their own home folder and at the very least read only rights to everyone else. Ideally everyone else should be denied even that, except administrators of course. OS X is UNIX underneath and anyone logging into a mac must have the ability to mount their home folder and have read/write access to the contained folders. Especially the Desktop and Library folders. If access is hampered to both those two folders, login will be incomplete or fail. Antonio Rocco (ACSA)

Sounds like you have a policy/ACL denying access to parent containers? You must allow at least read/list/traverse rights to containers (folders/shares) containing home folders. However this may cause you a problem if you've not configured your AD home structure in a logical and locked down way? For example by doing the above you may inadvertently give a student access to every other students home folder contents when they log in. Usually if things have been configured with macs in mind all that should happen is students simply 'see' ever other students home folder but not the contents of that folder. I would test this first so you don't inadvertently provide students with a free for all access to everything else. If this does happen I would re-think your structure, policies and ACLs so these things don't happen. Antonio Rocco (ACSA)

KRCS is one avenue you can explore although I doubt if they can now 'sell' you a Installer media version of Apple Remote Desktop? I'd be surprised if anyone can now other than Apple themselves? What you should be doing is buying it via Apple's App Store on OS X. Even if you were to get your hands on an installer media version the installer itself won't install easily on anything newer than Snow Leopard. Antonio Rocco (ACSA)

OS X Server: Admin tools compatibility information - Apple Support WorkGroup Manager was deprecated as far back as Lion. Apple made it available for 10.8 and 10.9 but it only worked in a limited way as it was supposed to be used in conjunction with Profile Manager during its infancy. As Profile Manager matured it became less relevant and it's days were always going to be numbered. There was speculation prior to Yosemite's release that Workgroup Manager for Mavericks would be the last time it could be used with any real effectiveness and the above support article confirms its final demise. Antonio Rocco (ACSA)

You've not mentioned which version of OS X the command works with? Reason I'm asking is because the file httpsproxyd does not seem to exist on the systems I'm testing it with. This would be 10.6 and 10.9: Maybe Apple's support document will help with your situation? Mac OS X 10.5: Proxy configurations and Parental Controls If it was me and assuming you're using a solid OS X deployment tool for your Mac estate, I would either use a post-deployment script invoking the networksetup command, or use ARD or SCCM (assuming you have them?) to run the command post deployment. Something like: For HTTP: networksetup -setwebproxy "Network Interface" "Proxy IPaddress" "Port number" For HTTPS: networksetup -setsecurewebproxy "Interface" "IPaddress" "Port" A working example would look something like this: networksetup -setsecurewebproxy Ethernet 10.10.10.10 800 If you want to bypass certain domains use this command: networksetup -setproxybypassdomains Ethernet *.local 169.254/16 *.domain name 10.10.* Hopefully this might help your situation? Antonio Rocco (ACN)

Simple answer is yes. OS X is essentially a fairly simple localised LDAP database. WorkGroup Manager can read that database as well as interacting with it amongst other things. It's also a good way of creating xml-based property lists but there are other ways of manipulating the local directory. Using dscl, defaults and plutil (amongst others) in the command line is one way, accessing Directory Editor in the Directory Utility app is another. Bear in mind WGM is deprecated in Mavericks (it has been since 10.7) and won't necessarily be anywhere as effective as it used to be in 10.6 and earlier. If your mac estate is small (say 10 or less) you can use WGM - installed locally on each workstation - to manage the user experience on those workstations by applying policies at a local level without the need for OS X Server at all. Antonio Rocco (ACN)

Hopefully I can help? The Simple Finder setting may seem like a good idea at first but can very quickly become too restrictive. In the main I would tend to use it in an Infant and Primary school setting. It tends to be unhelpful, in my experience, in a senior school setting. This sounds like an unfamiliarity with the OS issue more than anything else? Using the normal Finder setting the Open/Save dialog box (by default) is presented in a simplified way at first and simply clicking the down arrow to the right of the document name field will expand the dialog box and automatically place the end user at the root of their home folder. Altering how the open/save dialog box presents itself is something that can be controlled with a managed setting. By default text-based applications will automatically 'direct' themselves to the users Documents folder. This will be the 'Mac Documents' folder and not necessarily the 'Windows My Documents/Documents' folder. Students are usually guided by teaching or IT staff or sometimes their own intuition (amazingly some of them do have it!) to navigate their home folder structure and select the 'right' folder themselves. When using mac specific music applications such as GarageBand, Logic etc, or Video such as iMovie, FCP etc, the Save Dialog Box will automatically 'direct' the user to their mac Pictures and mac Movies folder that are also (by default) part of their 'mac' home folder structure. It may prove useful (assuming you've not done so?) to take time exploring the mac OS first, especially the home folder structure, so when the invetible questions such as this arise they can be quickly dealt with. Once a document has been saved, the application will 'remember' the last saved location and present it again the next time the application is used. Because of the way applications are written for the mac it's not something that can be easily managed using WorkGroup or Profile Manager. It's really part of what the user is supposed to experience and become familiar with when using and navigating the mac OS. Antonio Rocco (ACN)

If you're trying this on 10.8 Mountain Lion then asr multicast is broken. Apple did not fix this till Mavericks. The best it reliably worked on was 10.7. Antonio Rocco (ACN)

@ScottBordoni "Can I ask if you have looked up the 'Magic Triangle' scenario mentioned above?" I'll answer your question this way if that's OK? I was one of the few to try integration back in 10.3 (Panther) when it first became tentatively possible. At that time conditions had to be even more 'just right' than they became later on if it was to be successful. With the release of 10.4 (Tiger) integration became more viable even though the AD environment still had to have the 'Goldilocks' factor. Since then I've been trying my hand at integrating anything Apple anywhere and everywhere. In those early days Apple did not call it triangle anything. If you managed to talk to an Apple Systems/Software Engineer (these were then and still are now, thin on the ground) they would call it 'dual directory' or AD-OD Integration, and, for me, that sums it up neatly. Unlike Windows OS X can interface with multiple LDAP databases and I suppose that's what makes it unique - or if you like, 'Magic'. As 10.4 matured Apple began to call it the 'Golden Triangle' and with the advent of 10.5 (Leopard) Joel Rennich and others coined the phrase 'Magic Triangle' and, depending on what was required, the even sillier 'Cylinder of Destiny'. CoD was unique to 10.5 and 10.6 as it involved augmenting records to provide dual home folders for a single user (if that was required) that were independent of each other. CoD 'died' with the advent of 10.7 (Lion) but that did not matter because 'Magic Triangle' was all anyone really wanted and could cope with anyway. Apple do indeed recommend using OS X server but that does not mean their recommendation is the best or suitable for everyone's needs as their are other solutions that are better. Casper is one that stands out for me and their are others. As ever consulting with the end user regarding their requirements and developing a solution thereafter is more preferable rather than giving them what's recommended whether they want it or not. I've experienced this myself at some sites where they've had the 'recommended' and it didn't work for them at all. Who picks up the bill when that happens? Us, the taxpayer. I leave you with this last thought. Apple regards their own MDM as the baseline for the others. Mobile Iron and AirWatch are far superior and neither of them have anything to do with Apple. Anyone ever wondered which MDM Apple themselves use? Antonio Rocco (Apple Consultant & Systems Engineer)

What you're asking is not going to be easy because OS X's home folder structure is designed to be created within the user's root folder. You could create a bespoke script (more on this later) that might possibly do this on first login though? However doing so could hamper a successful log out and potentially successive logins may not occur because the OS won't be able to locate the user's root folder properly and decide to create them all over again! Things could get extremely messy and confusing within a very short space of time. It's also not realistic to try and apply a policy that instructs every text-capable application written for the platform not to create documents within the 'mac' documents folder. There are some potential solutions though. You could simply ignore it and tell everyone "that's the way it is." Or you can instruct students to navigate to the 'correct' documents folder when saving in whatever application they're working in. This solution has benefits because it allows the students to 'learn' how to navigate the mac OS finder as well as the application itself 'remembering' the location of the 'correct' documents folder. The problem with bespoke scripts is there's no way of knowing what changes Apple will make to their OS resulting in any future updates potentially stopping the script from working correctly. It's OK to fire-fight a problem but to keep going back to put out the same fire over and over makes no real sense and is potentially a waste of manpower and resources. Hope this helps? Antonio Rocco (ACN)

"The Mac server will also facilitate the integration of your Macs to your AD . . ." Apologies but I don't think this is correct? Any client OS X will do this all by themselves without OS X Server facilitating anything. In reality you don't really need OS X Server if all you want to do is integrate mac workstations into AD. Furthermore there'll be local out-of-the-box policies that will apply for any user that is not the local administrator on that workstation. Again no need for OS X Server. However, OS X Server does provide a cheap platform for powerful deployment tools (the best are 3rd-party) as well as defining a more granular and far reaching approach to policing mac workstations similar to what you see in Windows. Antonio Rocco (ACN)

If all you're interested in is "managing" iPads you don't need the Server App. You don't even need Apple hardware. You could use a web-based MDMs such as Meraki (free) instead. I would recommend using Configurator for initial set-up and mass deployment as it's designed for the job and as already mentioned can only run on Apple hardware. Most schools with 10 or more iPads generally opt for an entry level MacBook Air and install the free Configurator App afterwards. Other equipment you should consider are sync cases and/or trolleys. As you add more iPads add more cases/trolleys. How much hardware will depend on how you want to deploy, charge and manage what you have not only initially but also for the future. Other important aspects you should consider is understanding how Apple IDs and APNS work. For example APNS does not play well with most proxies used by most schools. To be clear Apple have for some time now moved away from dedicated Enterprise hardware and software so there's no such thing as what most people would call a server. What Apple brand as a Mac Server is a standard Mac Mini with two drives instead of one and the Server App pre-installed. Remove the Server App and it reverts back to a bog standard MacMini with two drives. You can just as easily install the Server App on any compatible Apple hardware and it will become your 'Mac Server'. They've not as yet started to brand their latest Mac Pro in the same way although it's hard to see how that too can be seen as a server? Antonio Rocco (ACN)

Can't you use something else that's more appropriate for your environment? I ask because iMovie was never designed for use with networked home folders. The fact that it sometimes sort of works in some locations (dependant on AD structure, permissions policies and network bandwidth) is a bonus. However it's not something that can be guaranteed. It can be made to work if you've designed your network and users around its use but if you're trying to shoe-horn it into an existing and mature network environment based primarily for Windows then expect problems. All may not be lost though as judging by the error message maybe doing the 'easy' solution by raising the quotas is the way to go. I could be wrong but from reading your post it does seem as if this has been gone into half-cocked with no real thought in achieving what you want with what you've got. For example capturing, rendering and especially storing video anything (especially hi-def) in a networked environment (regardless of platform) is going to be an unpleasant experience unless you plan accordingly. Ideally you should not be looking at quotas; You should be thinking about creating an area specifically for video production etc with workstations (Mac or PC - your choice) to match; Beefing up the network to at least 3-4GB fibre backbone and - if possible - 2GB to desktop; Most of all storage and backup are two extremeley important areas to consider as well. Of course all of the above is not cheap and will stretch most budgets. But if the institution you work for is keen about providing an opportunity for their students to learn something about film production then it should take the steps it needs to take to cater for that opportunity. My question is: if there's no compelling reason to use iMovie for video why use it? If however the teaching staff are comfortable with it, know how it works and they can integrate its use with other aspects of the students work then it is worthwhile. But prepare the ground first. Antonio Rocco (ACN)

@ Marci Apple are clear about what hardware you can use to virtualise OS X that does not contravene their T&Cs. It does not have to the EoL X-Serve hardware nor does it need to be OS X Server software. The only requirement is it must be virtualised on OS X and as any Apple hardware will run OS X then any Apple hardware will do. Antonio Rocco (ACN)

Apple moth-balled Workgroup Manager with the release of Lion (10.7). They did this because they wanted everyone to use Profile Manager instead for 'Mac Management'. But . . . educational institutions in America complained and Apple resurrected it without really changing it in any major way other than to make it launch in the OS without crashing. However it does still work after a fashion with Mountain Lion (10.8) and/or Mountain Lion (10.9) even though it's not really compatible with either of them. It does depend on what you're trying to do though? If all you're interested in is looking at an LDAP database, it's fine. If you're trying to make major changes to policy settings expect a random problem or two? If you're trying to make changes to the AD database (which you only have read only access to) you will definitely get this type of error message or similar. Antonio Rocco (ACN)

"This seems to have happened after doing a disk to disk image . . ." It's uncertain what you're trying to achieve using this method but if this is your deployment method of choice then it's not a good idea. What Profile Manager is probably having a problem with is possibly the Hardware UUID and/or ByHost settings. These should be unique for each individual mac hardware you have. You have a similar deal for PCs. Simply cloning from one mac workstation to another is almost always a recipe for strange behaviour such as what you're seeing. Depending on how many mac workstations you have either set them up singly one by one (if you have 10 or less) or use one of the usual deployment tools available for the platform. Antonio Rocco (ACN)

The command given will work provided you understand what sudo means? You can´t log in as a network user unless you´ve given that user admin rights (something you would not want to do anyway) and expect the sudo command to work. For sudo to work you must use the local administrator´s shortname and password. For example if the local admin account for the the Mac workstation you´re using is localadmin and its password is admin and you´re logging in as billybob (a network user account extant on Active Directory) the command will take this form: sudo localadmin mcxrefresh -n name of staff member When prompted key in admin for the password which you won´t see being typed. But . . . rather than giving this information to a member of staff perhaps it would be simpler/better if you simply made the change in WorkGroup Manager and/or Profile Manager and then ask the user to log out and log back in again. Any policy changes would then be re-applied. FWIW when contemplating integrating/using macs in a pre-dominantly Windows environments where all the users have only ever used PCs with (perhaps) some declaring they know a ´little about macs´it´s generally better (in my view) to use the KISS approach wherever possible - Keep It Simple Stupid! Thinking about it I would use the same approach for PCs as well! Hope this helps? Antonio Rocco (ACN)

Network users defined on Windows Server that are logging onto OSX systems must have at least read and/or list and/or traverse rights to folders/containers upstream of their home containers. Although ACLs prohibiting this for the same users logging onto PCs work fine the same can´t be said for Macs. All that happens is login fails or if login is successful users´ ability to launch applications and/or save work is restricted and/or hampered in some way. You may have to get creative with this depending on what form your AD structure takes? The last thing you want is to define ACLs that finally allows successful login and use of the OS X workstation yet gives free and easy access to any other network user´s data. However simply allowing list/traverse rights is usually enough as having the ability to ¨see¨ any other users folder is purely cosmetic as there would/should be no ability (assuming ACLs are assigned to grant full access to that user and no other) to go further would not be possible. Try to understand that OS X is a fairly sophisticated GUI to an underlying UNIX sub-system with a dual POSIX/ACL permissions models already built-in. Antonio Rocco (ACN)

The Server App for Mavericks is simply an App and not an OS as Snow Leopard Server was. This means that '10.9 Server' won't necessarily be upgrading the server components found in 10.6 Server. Everything 10.9 Server needs is contained within the Server app itself. With 10.6 Server important config and data directories were sprayed all over the place most of which were hidden in the UNIX sub-system. When Server App is installed and you run through the setup assistant it will create a Server folder in the top level Library folder and store all the configuration and service directories there instead. Although Apple says migration from Snow Leopard Server to Mavericks is possible the Migration Assistant won't necessarily transfer everything to do with the previous server version in a fit state if at all. If it was me and assuming the usual AD-OD integration most educational institutions go for I would export policies for OD Groups and/or OD Computer Groups using WorkGroup Manager first and then start from scratch with the planned server upgrade. Obviously back-up deployment data first plus any important user data that may be on there although I'm not sure why you would have any user data on the Mac server to be honest but you never know? Only a suggestion but once you've done the above install Mavericks on an externally attached drive and do a clean/fresh installation. This gives you the added benefit of moving back to 10.6 Server in case things don't work out and if they do you can simply use CarbonCopyCloner to clone the now 'live' and fully operational and tested 10.9 Server to the internal drive and take it from there. Antonio Rocco (ACN)

"Is this possible?" Yes. Assuming the Virtualbox app (and therefore its icon) is in the top level Applications folder launch Terminal and issue this command: sudo chflags hidden /Applications/VirtualBox.app At the prompt key in the local administrator's password which you won't see being typed. Remove the icon from the managed dock MCX in WorkGroup Manager assuming you haven't done this already? Using this method has added benefits you may not be aware of? If you're using ARD as part of your OS X suite of management tools you can send the command to all the macs you have and everything else you need to do with it will continue as before. To 'unhide' the app run this command: sudo chflags nohidden /Applications/VirtualBox.app IIRC VirtualBox was in its own folder? In which case the command should look like this: sudo chflags hidden /Applications/VirtualBox If there's a space in the folder name escape the name by using double quotes like this: sudo chflags hidden /Applications/"Virtual Box" When using ARD remove sudo when you send the command ". . . as root". This removes the need for providing the administrator's password. Antonio Rocco (ACN)

MAC capitalised stands for Media Access Control. Any networkable device will have a MAC address (can be ethernet, wireless, bluetooth etc) which as we know is unique. Mac with the capital M has been shortened over time from Apple Macintosh - which itself was shortened through usage to AppleMac - which was/is one of Apple's trademarks. My guess is in an effort to keep things short and pithy and also to maintain parity in some way with Personal Computer being shortened to PC rather than pc, most Mac users shortened Apple Macintosh or AppleMac to simply Mac. OK it has one more letter but it's nearly there However you could look at it another way because in terms of hardware, regardless of vendor/manufacturer and OS, they are all Personal Computers or PCs. Antonio Rocco (ACN)

Some of the folders or files won't exist. Any file/folder on any UNIX sub-system that begins with a full stop will be invisible in the finder which is why you use Terminal. Removing the .ServerSetupDone file will cause the Server App (once you launch it) to begin the configuration again. If you did not see this after removing the files I mentioned then you never reset the Server App completely. To remove the .ServerSetupDone file launch Terminal and use this command: sudo rm -Rv /var/db/.ServerSetupDone When prompted supply the admin account's password which you won't see being typed. My advice now is to follow the advice given above and try again unless you want to follow seawolf's which is just as good as any. My advice was given just in case you had important data you did not want to go through the hassle of backing up and restoring from. A brief word about .local domains and multicast DNS. All macs regardless of whether it's server or client 'know themselves' by their Bonjour name. As an example this could be MacMini.local or MacMiniServer.local. Bonjour names can be pinged but won't ever resolve as their won't necessarily be a DNS server that will resolve those names to IP addresses. They can also know themselves with fully qualified domain names or hostnames. A hostname is not the same as .local hostname. Hostnames are A records with (ideally) an associated rDNS record. As an example this could MacMini.myschool.net or MacMiniServer.myschool.net. Can you understand the difference? Finally there is also the Computer name itself which - using the same example as before - could be MacMini or MacMiniServer. On Macs themselves it's practically impossible to remove their Bonjour names. Remember Bonjour uses .local and .local in Bonjour terms is not really a 'Mac Domain'. The reason why the advice is given not to use .local as the basis for a Windows domain when contemplating AppleMac integration is because one of the foundations for successful integration is the quality of the Windows DNS Service. If the DNS Service is based around .local there can be confusion with Bonjour - which the Macs are using regardless of anything else - that can result in poor or non-existent login performance as well as other weird and wonderful behaviour. AntonioRocco (ACN)