[27819] in resnet
Re: Macs in AD
daemon@ATHENA.MIT.EDU (Lightbody, Erik J)
Tue Jul 17 15:58:31 2012
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_83915F7DB5BB9A48AD5AC78CAB4BDF3C28D1A867SMCEXMBX02miken_"
MIME-Version: 1.0
Message-ID: <83915F7DB5BB9A48AD5AC78CAB4BDF3C28D1A867@SMCEXMBX02.mikenet.smcvt.edu>
Date: Tue, 17 Jul 2012 19:56:52 +0000
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Lightbody, Erik J" <elightbody@smcvt.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <20120712141811090.00000007772@CID5664>
--_000_83915F7DB5BB9A48AD5AC78CAB4BDF3C28D1A867SMCEXMBX02miken_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Jenni,
I've been working over the last year to implement Macs into our existing Ac=
tive Directory environment with the expressed goal of having the user exper=
ience on both our Macs and PCs to be as identical as possible. This include=
s setting up our centralized printing software, network drive mappings (bot=
h departmental shares and personal storage), proper administrative rights, =
domain account authentication, and inclusion in our standard inventory mana=
gement tools. Frankly, it's as fun as it sounds :)
We use the Golden Triangle setup. For those unaware, this involves binding =
the client to both your AD server (which we use for user account authentica=
tion) and an Open Directory server (for drive mappings and "group policy" s=
tyle settings). First, using the Workgroup Manager tool (which can be downl=
oaded from the Apple site if it's not already installed on your OD server),=
you'll want to set up Computer Groups for each group. For example, we have=
a group for mobile users, a group for faculty/staff desktops, and a group =
for labs. After setting up the policies you want (and verifying that the po=
lices work the way you want) you'll want to bind the client machines to the=
OD server (if you haven't already). Then, move the individual computers in=
to the appropriate group. To set up policies simply select the group on the=
left, then click the Preferences button at the top. This will open a panel=
on the right that looks like the standard Preferences pane in OSX. I'll ou=
tline some of the settings you may be interested in:
1) Under the "Login" section you'll find a number of options, includin=
g the ability to add unique splash screens, screen saver options, login mes=
sages, access restrictions, and login scripts. If you skip over to the "Ite=
ms" tab you'll be able to add items that auto-launch upon login. This is wh=
ere I specified the network share locations. The easiest way to do this is =
to map the desired drive to the ODserver and then drag the newly mapped dri=
ve from the desktop to the white box in the center of the Items tab screen.=
You'll also be able to set whether you want the drives mapped on only the =
first login (Manage: Once) or every time someone logs in (Manage:Always). M=
ake sure to check the box that says "Authenticate selected share point with=
user's login name and password" if you are having the users log in with th=
eir personalized network accounts. For the Department Shares (which in our =
case are DFS trees, with each user having personalized access granted via A=
D) this works quite well. For the individual shares it was a bit trickier, =
as they are actually Hidden Shares, so OSX can't map directly to them. To g=
et around this I simply mapped to the root of the share, and allowed the Us=
er's credentials to do the rest of the work (since they only have access to=
their folder-it causes them to have to "walk" part of the way there, but i=
t's functional).
2) Mapping printers should act the same way-map the printer to the ODs=
erver, then select the "Printers" section in the Preferences pane, and then=
you should see them in the "Available Printers" section-simply add them to=
the "User's Printer List". I would also uncheck the "Allow user to modify =
printer list" just so no one deletes anything...(personally, our printer sy=
stem doesn't work this way, so I haven't actually done this)
3) Other fun things can be found in the Dock (to add/remove specific p=
rograms/icons) and the Finder (to add desktop items, force view options, et=
c). A big one is the "Mobility" preference-in here you can force "mobile a=
ccounts" to be created for users. The biggest benefit I found here is that =
it allows domain users to log into the machine even if it can't access the =
AD server (if they are off campus, for example). I wouldn't do this for des=
ktop machines, as in theory they will always have access to the AD server.
I hope this helps, and if you have any questions/need clarification/want to=
know anything else about this stuff let me know (elightbody@smcvt.edu<mail=
to:elightbody@smcvt.edu>) .
Erik Lightbody
Saint Michael's College
Technology Learning Center
Helpdesk Manager
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Jenni Pip=
er
Sent: Thursday, July 12, 2012 2:18 PM
To: RESNET-L@LISTSERV.ND.EDU
Subject: Macs in AD
What tool are you using to manage Macs in an Active Directory environment a=
nd what sort of management are you doing? Have you successfully linked Prof=
ile Manager to domain users and groups?
We are currently evaluating options for more fully integrating Macs into ou=
r Active Directory environment. Our main interests are pushing drive mappin=
gs and printers (from our Windows print server) based on computers and grou=
ps of computers (e.g. labs), domain users, and domain groups. We use and ar=
e happy with ARD for remote management and software deployment, and deploys=
tudio for imaging.
Our clients are all running OS X 10.7, and we are currently evaluating Mana=
ged Preferences (both via the AD/OD "Golden Triangle" and AD schema extensi=
ons) and the new Profile Manager in OS X 10.7 server. We are mostly focused=
on Profile Manager as we are interested in the mobile device management ca=
pabilities as well, but have run into difficulty using Profile Manager to m=
anage preferences based on domain users and groups.
Jenni Piper
Associate Director of Technology Services
Eastern Mennonite University
___________________________________________________ You are subscribed to t=
he ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.=
EDU/archives/resnet-l.html ________________________________________________=
___
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_83915F7DB5BB9A48AD5AC78CAB4BDF3C28D1A867SMCEXMBX02miken_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:75788841;
mso-list-type:hybrid;
mso-list-template-ids:1395024092 67698705 67698713 67698715 67698703 67698=
713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Jenni,<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">I’ve been workin=
g over the last year to implement Macs into our existing Active Directory e=
nvironment with the expressed goal of having the user experience on both ou=
r Macs and PCs to be as identical as possible.
This includes setting up our centralized printing software, network drive =
mappings (both departmental shares and personal storage), proper administra=
tive rights, domain account authentication, and inclusion in our standard i=
nventory management tools. Frankly,
it’s as fun as it sounds </span><span style=3D"font-family:Wingdings=
;color:#1F497D">J</span><span style=3D"color:#1F497D"><o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">We use the Golden Tria=
ngle setup. For those unaware, this involves binding the client to both you=
r AD server (which we use for user account authentication) and an Open Dire=
ctory server (for drive mappings and
“group policy” style settings). First, using the Workgroup Man=
ager tool (which can be downloaded from the Apple site if it’s not al=
ready installed on your OD server), you’ll want to set up Computer Gr=
oups for each group. For example, we have a group for mobile
users, a group for faculty/staff desktops, and a group for labs. After set=
ting up the policies you want (and verifying that the polices work the way =
you want) you’ll want to bind the client machines to the OD server (i=
f you haven’t already). Then, move the
individual computers into the appropriate group. To set up policies simply=
select the group on the left, then click the Preferences button at the top=
. This will open a panel on the right that looks like the standard Preferen=
ces pane in OSX. I’ll outline some
of the settings you may be interested in:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"color:#1F497D"><span style=3D"m=
so-list:Ignore">1)<span style=3D"font:7.0pt "Times New Roman"">&n=
bsp;
</span></span></span><![endif]><span style=3D"color:#1F497D">Under the R=
20;Login” section you’ll find a number of options, including th=
e ability to add unique splash screens, screen saver options, login message=
s, access restrictions, and login scripts. If you skip
over to the “Items” tab you’ll be able to add items that=
auto-launch upon login. This is where I specified the network share locati=
ons. The easiest way to do this is to map the desired drive to the ODserver=
and then drag the newly mapped drive from the desktop
to the white box in the center of the Items tab screen. You’ll also =
be able to set whether you want the drives mapped on only the first login (=
Manage: Once) or every time someone logs in (Manage:Always). Make sure to c=
heck the box that says “Authenticate selected
share point with user’s login name and password” if you are ha=
ving the users log in with their personalized network accounts. For the Dep=
artment Shares (which in our case are DFS trees, with each user having pers=
onalized access granted via AD) this works quite
well. For the individual shares it was a bit trickier, as they are actuall=
y Hidden Shares, so OSX can’t map directly to them. To get around thi=
s I simply mapped to the root of the share, and allowed the User’s cr=
edentials to do the rest of the work (since
they only have access to their folder—it causes them to have to R=
20;walk” part of the way there, but it’s functional).<o:p></o:p=
></span></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"color:#1F497D"><span style=3D"m=
so-list:Ignore">2)<span style=3D"font:7.0pt "Times New Roman"">&n=
bsp;
</span></span></span><![endif]><span style=3D"color:#1F497D">Mapping printe=
rs should act the same way—map the printer to the ODserver, then sele=
ct the “Printers” section in the Preferences pane, and then you=
should see them in the “Available Printers” section—simp=
ly
add them to the “User’s Printer List”. I would also unch=
eck the “Allow user to modify printer list” just so no one dele=
tes anything…(personally, our printer system doesn’t work this =
way, so I haven’t actually done this)<o:p></o:p></span></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"color:#1F497D"><span style=3D"m=
so-list:Ignore">3)<span style=3D"font:7.0pt "Times New Roman"">&n=
bsp;
</span></span></span><![endif]><span style=3D"color:#1F497D">Other fun thin=
gs can be found in the Dock (to add/remove specific programs/icons) and the=
Finder (to add desktop items, force view options, etc). A big one is=
the “Mobility” preference—in here you
can force “mobile accounts” to be created for users. The bigge=
st benefit I found here is that it allows domain users to log into the mach=
ine even if it can’t access the AD server (if they are off campus, fo=
r example). I wouldn’t do this for desktop machines,
as in theory they will always have access to the AD server.<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">I hope this helps, and=
if you have any questions/need clarification/want to know anything else ab=
out this stuff let me know (<a href=3D"mailto:elightbody@smcvt.edu">elightb=
ody@smcvt.edu</a>) .
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Erik Lightbody<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Saint Michael's Colleg=
e<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Technology Learning Ce=
nter<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Helpdesk Manager<o:p><=
/o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<div>
<div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:10.0pt;font-family:"=
;Tahoma","sans-serif"">From:</span></b><span style=3D"font-s=
ize:10.0pt;font-family:"Tahoma","sans-serif""> Resnet F=
orum [mailto:RESNET-L@LISTSERV.ND.EDU]
<b>On Behalf Of </b>Jenni Piper<br>
<b>Sent:</b> Thursday, July 12, 2012 2:18 PM<br>
<b>To:</b> RESNET-L@LISTSERV.ND.EDU<br>
<b>Subject:</b> Macs in AD<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p style=3D"margin-bottom:12.0pt"><span style=3D"font-family:"Calibri&=
quot;,"sans-serif"">What tool are you using to manage Macs in an =
Active Directory environment and what sort of management are you doing? Hav=
e you successfully linked Profile Manager to domain users
and groups?<br>
<br>
<br>
We are currently evaluating options for more fully integrating Macs into ou=
r Active Directory environment. Our main interests are pushing drive mappin=
gs and printers (from our Windows print server) based on computers and grou=
ps of computers (e.g. labs), domain
users, and domain groups. We use and are happy with ARD for remote managem=
ent and software deployment, and deploystudio for imaging.<br>
<br>
<br>
Our clients are all running OS X 10.7, and we are currently evaluating Mana=
ged Preferences (both via the AD/OD "Golden Triangle" and AD sche=
ma extensions) and the new Profile Manager in OS X 10.7 server. We are most=
ly focused on Profile Manager as we are interested
in the mobile device management capabilities as well, but have run into di=
fficulty using Profile Manager to manage preferences based on domain users =
and groups.</span><o:p></o:p></p>
<p class=3D"MsoNormal">Jenni Piper<o:p></o:p></p>
<p class=3D"MsoNormal">Associate Director of Technology Services<o:p></o:p>=
</p>
<p class=3D"MsoNormal">Eastern Mennonite University<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti=
mes New Roman","serif"">____________________________________=
_______________ You are subscribed to the ResNet-L mailing list.
<o:p></o:p></span></p>
<p>To subscribe, unsubscribe or search the archives, go to <a href=3D"http:=
//LISTSERV.ND.EDU/archives/resnet-l.html">
http://LISTSERV.ND.EDU/archives/resnet-l.html</a> _________________________=
__________________________
<o:p></o:p></p>
</div>
</body>
</html>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_83915F7DB5BB9A48AD5AC78CAB4BDF3C28D1A867SMCEXMBX02miken_--
