Managed Pref's, WGM or both

You may want to take a look at configuration profiles as that seems to be the roadmap... Not to say not to use Casper and MCX, the writing's on the wall is all.

j
---
Jared F. Nichols
Desktop Engineer, Client Services
Information Services Department
MIT Lincoln Laboratory
244 Wood Street
Lexington, Massachusetts 02420
781.981.5436

If you are on 10.7 you get profiles, if 10.6 MCX is still available. It just depends on your needs. Also, since OS X Server doesn't have any
native hardware anymore you are stuck either using their Mac Minis or
Mac Pros (and Mac Pro may be going away soon) for their server product,
or run OS X Server in a VM.

Giving the lacking features of OS X Server (no print services,
email/calendar are lacking, etc etc) I am thinking about ditching OS X
Server completely and going with AD/OpenLDAP accounts and local
MCX/Profiles on my machines.

Just gotta look at your road map and the big picture to make the best
decision for yourself. I have 40 Xserves that when they die they can
never be replaced, so I am looking at switching server platforms soon.

-Tom

We are mostly 10.6. We have extended Active Directory for managed preferences. Are the 10.7 profiles, as far as what you can configure, the same as MCX? I haven’t had much time yet to look over Lion.

Mark Kent (MCP,A+)
Sr. Desktop Systems Engineer
Desktop Systems – Systems Administration and Services
Computing & Technology Services - Buffalo State College
"Have you tried turning it off and on again?"

I don't use 10.7 yet so I have only read the docs on it. Yes, Profiles
replaced MCX in 10.7. Think of it as roaming Profiles in AD but for
Macs. There were several presentations on this at the JAMF National
User Conference. Maybe someone can post them up so you can take a look.

I have yet to run 10.7 in production so I cannot answer your questions,
and I just now have time to start testing 10.7.

-Tom

There was a specific session on using Lion Profiles at the JAMF NUC, and in that session there were discussions around bugs with the service at this point. It requires APN (Apple Push Notification) and certificate-based communication with the JSS. The biggest benefit to Profiles over MCX is "undoing" a setting. With MCX, if you set a preference you can't "unset" it. You can only change it to a different or opposite setting. With Profiles, the Profile sets it. If you remove a Profile, the "setting" goes away. If the user had their own setting prior to the Profile, it will revert back to their setting. The Profile always overrides the user's setting, but you can always remove the Profile. MCX is harder to "remove" or "undo".
--
Walter Rowe, System Hosting
Enterprise Systems / OISM
walter.rowe at nist.gov<mailto:walter.rowe at nist.gov>
301-975-2885

On Dec 13, 2011, at 2:14 PM, casperadmin wrote:

I asked apple for some clarification on Profiles in 10.7 as we rely heavily on MCX settings. They replied you can still use WGM to manage preference with Lion clients, and any setting set in profile manager and WGM, profile manager wins… I was definitely concerned at the lack of settings available in profile manager so I hope this is true.
I assume JSS MCX settings could be used in place of WGM similarly. Unfortunately I missed the settings at the JAMF conference, I guess again there are no videos of the speeches?

I asked apple for some clarification on Profiles in 10.7 as we rely heavily on MCX settings. They replied you can still use WGM to manage preference with Lion clients, and any setting set in profile manager and WGM, profile manager wins… I was definitely concerned at the lack of settings available in profile manager so I hope this is true.
I assume JSS MCX settings could be used in place of WGM similarly. Unfortunately I missed the settings at the JAMF conference, I guess again there are no videos of the speeches?

I filed a bug about this back when it was pre-release. I had concerns that Profile Manager would not have the capabilities and reliability that WGM had. Unfortunately, they didn't really care. Profile Manager is more for iPad/iPod Touch/iPhone deployments than anything else. I would not trust it unless you don't need very strict management on a machine.