One of IT’s key roles is client management, which is all about defining or controlling many aspects of how users’ computers function. This can include restricting access to specific applications or Web sites, configuring auto-update policies, securing various parts of the file system and setting various display preferences or log-in scripts. This is all done with an eye to easing PC setup and deployment, increasing security and ensuring compliance with internal policies or legal regulations.
Most Windows administrators are familiar with client management in the form of Active Directory group policies. Group policies are incredibly flexible and can be used to define environment settings for computers, individual users or user groups. They offer a wide range of options for both restricting access to particular Windows features and applying predefined settings to Windows itself or individual applications. While not the be-all and end-all of client management options, group policies that are well planned and executed can significantly ease setup, security and support processes for new users and computers.
So what happens to this nice, tidy Windows world when the hotshot sales director wants his next computer to be a MacBook Air? Although Macs are a long way from conquering the enterprise, their numbers are growing – nearly 80 per cent of businesses now have Macs in-house, according to a survey by Yankee Group Research Inc. It’s to your advantage to understand how to add them to your network safely and effectively.
The prospect of introducing Macs into a well-tuned and functioning Windows environment brings with it many questions and challenges. Will Macs be able to access network resources? Can they be joined to an Active Directory domain? What sort of deployment and management options are there for Macs?
We’ve got the answers to these questions, along with some tips and tools to make your Mac-Windows integration as smooth as possible.
Authentication and file/printer access
For several years, Macs have included support for accessing Windows shared files and printers through Apple’s implementation of Samba. And Apple does provide an Active Directory plug-in to Mac OS X’s authentication and directory services components that allows Macs to be joined to a domain and to authenticate users via their Active Directory credentials.
While Apple has improved its Active Directory plug-in since it was introduced in Mac OS X Panther in 2004, the plug-in isn’t designed to offer complete access to all the facets of Active Directory available in Windows clients. It is designed to rely on LDAP, Kerberos and other supported encryption technologies to provide authentication — which it does a generally good job of accomplishing. This is good news for organizations implementing a handful of Macs in an Active Directory environment.
In most cases, integrating Macs using the Active Directory plug-in is effective and requires no additional expense. Apple’s Directory Utility (or Directory Access if you’re using a pre-Leopard version of Mac OS X) is the tool for configuring a Mac’s connection to a central directory system such as Active Directory, Apple’s Open Directory or other LDAP-based directory services.
Directory Utility even includes a number of options that allow you to configure how the Mac will behave, such as choosing a preferred domain controller and whether members of specific domain groups will be allowed local administrator access to the Mac, as well as determining whether the Mac will cache credentials for use off the network (referred to as creating a mobile account).
Note: Apple provides a video demonstration of Mac/Active Directory binding as part of its Apple Quick Tour of Leopard Server podcast series.
When looking at integrating a larger number of Macs, simple authentication may not be enough. For these situations, several different options can be considered — each of them offering a unique take on the question of how to implement client management or other Active Directory features for Mac clients.
Apple’s managed preferences architecture
Apple has developed its own, very comprehensive client management architecture, commonly called MCX (Managed Client for OS X) or simply managed preferences. Like group policies, managed preferences are stored as records in Apple’s native directory service, Open Directory. Also like group policies, managed preferences can be used to restrict access to many parts of the Mac OS X interface and control various user and system settings.
In fact, in Mac OS X Tiger and Leopard, administrators using Mac OS X Server’s Workgroup Manager tool can define settings for any application or system component using a Preferences Editor. So long as an application is written to store its preferences data according to Apple’s guidelines, any aspect of it should be controllable via managed preferences. (See “What’s new in Leopard Server” for more about its administration tools.)
The process of deciphering the XML data that Mac OS X applications use to store preferences may be a little challenging, but it is possible. (Apple does offer the option for developers to explain the XML-based keys that they use in what is known as a preference manifest, which provides clearer explanations when looking at settings in Workgroup Manager, but many developers have yet to make use of the feature.)
In a simple GUI in Workgroup Manager, Apple also provides 15 categories of more general management options that let the administrator control users’ access to applications, power management and automatic start-up settings, log-in settings, access to hard drives and removable media, mobile accounts and how they sync data with a network home directory, basic network settings and proxy servers, access to local printers and auto-configuration of network printers, access to the System Preferences utility and which features a user may change on a system, the designation of a file server for use as backup destination with Apple’s Time Machine, and more.
For a thorough guide to Apple’s managed preferences, check out John DeTroy’s Tips & Tricks for Mac Mgmt.
Using Open Directory
Just as group policies are a product of Windows Active Directory, managed preferences are a product of Mac OS X’s native directory service, Open Directory. This means that implementing them also means implementing Open Directory running on Mac OS X Server. Active Directory and Open Directory can be integrated in a dual-directory environment in which user and group records stored in Active Directory can have managed preferences associated with them, resulting in the best of both worlds.
There are a few approaches to implementing a dual-directory environment of this type. The first is to simply join both the Mac clients and Mac OS X Server to the Active Directory domain and then to also join (or “bind,” in Apple jargon) the Mac clients to the Open Directory domain hosted by the Mac server. This approach, often r
