One of IT’s key roles is client management, which is all about defining or controlling many aspects of how users’ computers function. This can include restricting access to specific applications or Web sites, configuring auto-update policies, securing various parts of the file system and setting various display preferences or log-in scripts. This is all done with an eye to easing PC setup and deployment, increasing security and ensuring compliance with internal policies or legal regulations.
Most Windows administrators are familiar with client management in the form of Active Directory group policies. Group policies are incredibly flexible and can be used to define environment settings for computers, individual users or user groups. They offer a wide range of options for both restricting access to particular Windows features and applying predefined settings to Windows itself or individual applications. While not the be-all and end-all of client management options, group policies that are well planned and executed can significantly ease setup, security and support processes for new users and computers.
So what happens to this nice, tidy Windows world when the hotshot sales director wants his next computer to be a MacBook Air? Although Macs are a long way from conquering the enterprise, their numbers are growing— nearly 80 percent of businesses now have Macs in-house, according to a survey by Yankee Group Research. It’s to your advantage to understand how to add them to your network safely and effectively.
The prospect of introducing Macs into a well-tuned and functioning Windows environment brings with it many questions and challenges. Will Macs be able to access network resources? Can they be joined to an Active Directory domain? What sort of deployment and management options are there for Macs?
We’ve got the answers to these questions, along with some tips and tools to make your Mac-Windows integration as smooth as possible.
Authentication and file/printer access
For several years, Macs have included support for accessing Windows shared files and printers through Apple’s implementation of Samba. And Apple does provide an Active Directory plug-in to Mac OS X’s authentication and directory services components that allows Macs to be joined to a domain and to authenticate users via their Active Directory credentials.
While Apple has improved its Active Directory plug-in since it was introduced in Mac OS X Panther in 2004, the plug-in isn’t designed to offer complete access to all the facets of Active Directory available in Windows clients. It is designed to rely on LDAP, Kerberos and other supported encryption technologies to provide authentication — which it does a generally good job of accomplishing. This is good news for organizations implementing a handful of Macs in an Active Directory environment.
In most cases, integrating Macs using the Active Directory plug-in is effective and requires no additional expense. Apple’s Directory Utility (or Directory Access if you’re using a pre-Leopard version of Mac OS X) is the tool for configuring a Mac’s connection to a central directory system such as Active Directory, Apple’s Open Directory or other LDAP-based directory services.
Directory Utility even includes a number of options that allow you to configure how the Mac will behave, such as choosing a preferred domain controller and whether members of specific domain groups will be allowed local administrator access to the Mac, as well as determining whether the Mac will cache credentials for use off the network (referred to as creating a mobile account).
Note: Apple provides a video demonstration of Mac/Active Directory binding as part of its Apple Quick Tour of Leopard Server podcast series.
When looking at integrating a larger number of Macs, simple authentication may not be enough. For these situations, several different options can be considered — each of them offering a unique take on the question of how to implement client management or other Active Directory features for Mac clients.
Apple’s managed preferences architecture
Apple has developed its own, very comprehensive client management architecture, commonly called MCX (Managed Client for OS X) or simply managed preferences. Like group policies, managed preferences are stored as records in Apple’s native directory service, Open Directory. Also like group policies, managed preferences can be used to restrict access to many parts of the Mac OS X interface and control various user and system settings.
In fact, in Mac OS X Tiger and Leopard, administrators using Mac OS X Server’s Workgroup Manager tool can define settings for any application or system component using a Preferences Editor. So long as an application is written to store its preferences data according to Apple’s guidelines, any aspect of it should be controllable via managed preferences. (See What’s new in Leopard Server for more about its administration tools.)
The process of deciphering the XML data that Mac OS X applications use to store preferences may be a little challenging, but it is possible. (Apple does offer the option for developers to explain the XML-based keys that they use in what is known as a preference manifest, which provides clearer explanations when looking at settings in Workgroup Manager, but many developers have yet to make use of the feature.)
In a simple GUI in Workgroup Manager, Apple also provides 15 categories of more general management options that let the administrator control users’ access to applications, power management and automatic start-up settings, log-in settings, access to hard drives and removable media, mobile accounts and how they sync data with a network home directory, basic network settings and proxy servers, access to local printers and auto-configuration of network printers, access to the System Preferences utility and which features a user may change on a system, the designation of a file server for use as backup destination with Apple’s Time Machine, and more.
For a thorough guide to Apple’s managed preferences, check out John DeTroy’s Tips & Tricks for Mac Mgmt.
Using Open Directory
Just as group policies are a product of Windows Active Directory, managed preferences are a product of Mac OS X’s native directory service, Open Directory. This means that implementing them also means implementing Open Directory running on Mac OS X Server. Active Directory and Open Directory can be integrated in a dual-directory environment in which user and group records stored in Active Directory can have managed preferences associated with them, resulting in the best of both worlds.
There are a few approaches to implementing a dual-directory environment of this type. The first is to simply join both the Mac clients and Mac OS X Server to the Active Directory domain and then to also join (or “bind,” in Apple jargon) the Mac clients to the Open Directory domain hosted by the Mac server. This approach, often referred to as the magic triangle, allows users to authenticate against Active Directory but also to have managed preferences enforced by Open Directory.
The result is that preferences can be set for individual computer accounts or computer groups as well as for Active Directory user accounts. This is done by creating user groups in the Open Directory domain and then populating them with user accounts stored in Active Directory.
While this approach is effective in many situations, it isn’t always perfect. For one thing, it provides limited management at the user level. To achieve broader capabilities, it is possible to extend the Active Directory schema to include support for Apple’s MCX attributes as well as for other Mac user account details.
You can also choose to map existing or new Active Directory attributes to support functionality specified in the Open Directory schema. This approach can be highly effective, but it also requires a fair amount of experience with Active Directory and Open Directory (or at the very least OpenLDAP, on which Open Directory is largely based) and schema modifications.
A third, more recent approach to Open Directory and Active Directory integration was introduced with Leopard Server in 2007. Leopard Server supports Kerberos cross-domain authorization and the use of stub records in Open Directory. This means that Leopard Server can be configured to act as a subordinate directory server to another infrastructure (such as Active Directory).
Such a server will rely on the primary directory system for authentication but will supplement attributes stored in its own domain as needed by clients. The downside is that workgroup mode is one of Leopard Server’s simplified setup modes, which offers very limited client management capabilities.
More details on Active Directory integration are available in the Bombich Software white paper Leveraging Active Directory on Mac OS X.
Centrify’s Direct Control for Mac OS X
Centrify offers an alternative to relying on Mac OS X Server and Open Directory for client management. Direct Control for Mac OS X (pricing varies depending on your needs) provides the easiest solution for experienced Windows administrators because it actually implements additional group policies (at this point over 200 of them) in Active Directory via pre-packed schema extensions that can be used to manage Mac OS X.
If you’re used to client management via group policies, Direct Control will feel very comfortable to you. (Direct Control versions for other Unix-based platforms are also available.)
On the client side, Direct Control installs as an alternative plug-in to the Active Directory plug-in shipped by Apple. One of the great features of Direct Control for Mac is that it actually leverages Apple’s managed preferences architecture so that many of the key aspects of the Mac OS X environment can be managed using the group policies that ship with it.
I’ve been a fan of Direct Control for Mac since I initially reviewed it for Computerworld in early 2007. The simple interface, which is among the product’s biggest selling points, remains a significant advantage. And Centrify has expanded on its product since then, incorporating support for Leopard, providing secure smart card authentication options, and most importantly, including a wide range of additional policies.
Thursby’s ADmit Mac
ADmit Mac ($149 per license, with bulk license options available) from Thursby Software is another longtime solution for providing enhanced Active Directory support for Macs. Like Centrify’s Direct Control, ADmit Mac includes authentication support and installs as a replacement for Apple’s Active Directory plug-in.
Additionally, ADmit has its own feature set that goes beyond client management. It is, in fact, the only product that provides support for the Windows distributed file system. It also provides options for leveraging Apple’s managed preferences.
The big difference in implementation between Direct Control and ADmit Mac is that ADmit doesn’t use group policies (or, for that matter, Active Directory at all) to store client management information. Instead, managed client settings are stored on a file server within your network.
Effective in small to medium-size environments, this solution may require more planning to scale well because this file must be accessible to any Macs in the organization (as opposed to data stored and replicated through Active Directory). However, the data is replicated to Macs and implemented even when they are off the network.
ADmit Mac relies on a separate management console that must be run from Mac OS X. The console also provides administrative access to Active Directory. For experienced Windows administrators not interested in managing Macs from a Mac, this could be a downside. On the other hand, for organizations that have a Mac-specific IT group, this allows them to perform all administrative tasks without having to rely on Windows administrative tools.
Beyond managed preferences
Just as group policies aren’t the only option for defining Windows client settings, neither is Apple’s managed preferences architecture and the solutions that leverage it. Like any other platform, Mac OS X relies on various configuration and preferences files to define settings. This means that when deploying Macs using a disk-based imaging solution, you can define preconfigured many aspects of the user experience.
You can also use various file deployment tools (such as Apple’s Remote Desktop ($299 for a 10-client management license or $499 for an unlimited license) JAMF Software’s Casper Suite (pricing varies depending on your environment and which components you wish to purchase) or the open-source Radmind to push these files out to clients.
For user-specific settings, you can also modify the contents of the home directory template on a Mac. This template is used to create a home directory for any new user. By placing appropriately configured preference or application support files in the /Library folder within the template, you will ensure that any new users will automatically inherit those preferences.
This approach can also work for populating user home folders with documents (such as acceptable-use policies or in-house documentation). The downside is that it won’t prevent users from changing the settings you define.
Preventing changes to Macs
If you are working without a full Mac client management solution and want to ensure that your configuration is retained regardless of what users do, you can use Faronics Deep Freeze (begins at $45 per license; maintenance subscriptions and discounts are available for volume purchases and education, government, and nonprofit customers). This software restores Macs to their original configuration on every restart. Faronics also produces a range of related products that can manage Deep Freeze installations throughout a heterogeneous network of Macs and PCs.
Similarly, Radmind lets you monitor managed systems (Mac, Windows, Linux, Solaris and BSD Unix distributions) for changes and optionally reset changes after they are made. As mentioned above, Radmind’s flexible architecture can also be used to push out software and files to clients, and it includes the ability to define multiple file sets for increased flexibility and organized administration.
Supporting and managing Macs in a predominantly non-Mac environment is a unique challenge, particularly if you’re new to the platform. The good news, though, is that while the machines may be different, the basic strategies for client management are pretty much the same. With the right combination of tools and techniques, you can develop effective processes and solutions that don’t take as much effort as you might initially expect.
[ Ryan Faas is a frequent Computerworld contributor specializing in Mac and multiplatform network issues.]