Virtualization

I've used Casper Suite in a virtualized environment for my development and testing side, but never my production side. I was having quite a few issues with performance with parallels server, particularly when I tried to use a dual processor setup for the VM. Otherwise It's been working OK with a single processor test server.

I don't know that I'd be comfortable virtualizing the JSS.

Craig E

This is a bit of an odd question but we have a parent who is insisting that
we should be able to run virtualization software (e.g. VMWare) on his son's
laptop in order to retain the current OS X boot disk and data structure
while installing our config on the virtual OS for the student to use during
our 1:1 laptop program.

I assume he means that we would image the virtual drive with Casper
Imaging. Is this possible? Would this even work? Would policy management,
etc. also work in this virtualized environment?

Tatian

I don't believe it is even possible to run a VM of OS X client, only OS X Server. Now, if you are deploying VMs of Linux or Windows, you can create a virtual image from the VM software, like Parallels and VMware Fusion.

That’s correct as far as my understanding of the EULA goes, you can NOT virtualize OS X Workstation/Client, but you can virtualize OS X Server.

Now...not to say virtualizing the client can’t be done, but it wouldn’t be legal.

Craig E

I agree, the EULA only allows virtualization of OS X server. Virtualization of OS X Workstation is not allowed per the EULA of Apple. I have been using a virtualized OS X Server vmware fusion image I created and modeled after our workstation configuration with all unecessary services disabled to test software installs on, which has been working great for us. The snapshots are particularly useful when I create software packages.

Dave

David Bruno
Computer Scientist
ARL/CISD
410-278-8929
david.bruno at us.army.mil

Hi Tatian,

I would probably say that this falls into the “technically possible, but operationally infeasible” category.

The first stumbling block is that virtualizing Mac OS X client violates Apple’s EULA. You can virtualize Mac OS X Server, but that increases your per-computer cost by $500.

A virtual machine can be put in a managed state, will run policies, and can be targeted with Casper Remote. Imaging would be a hurdle since I don’t believe a virtual machine can be NetBooted or put into target disk mode. This could be overcome by deploying baseline virtual machines that then have policies run against them to perform any customization, but I see it as far from perfect.

Another very big consideration would be how much this would increase demand on the helpdesk and support teams. Unless your school is exclusively populated by computer whiz kids, I would expect that for many, if not most students, operating within a virtual machine would be daunting, if not show-stopping. Perhaps this one child in question could handle it, but what about the rest?

I think it’s great that this one student’s parent believes that he or she can handle operating in a virtual environment, but I wouldn’t suggest going down that path. Macs are great in large part because they’re so very user-friendly. I would consider putting a system that requires significant IT knowledge to work with in between the user and their computing experience to be counter-productive. A good system has to be usable by the least-savvy user, and making exceptions to policy cost money and increase demand on support resources.

Were I in your place, I’d probably have a discussion with the school administration with the goal of establishing or verifying and then publishing a policy that states something along the lines of... “Computers issued as part of the 1:1 program are issued for educational purposes and will be managed by school staff to support the following priorities in order; 1 - official school curriculum, 2 - the school’s general academic environment and goals. Any other use will not be supported by school staff and may in fact be restricted in order to support the primary goals.” In my experience, it helps to have people higher up the food chain buy into a policy before you need to enforce it with someone who will argue with it. I could be completely wrong, but my gut tells me that the person who requested this will likely make noise and go over your head if you say no.

This is just my personal perspective as a sysadmin, and does not reflect official JAMF positions or opinions.

I hope this is helpful,

--
Miles Leacy
Technical Training Manager
Mobile (347) 277-7321

miles at jamfsoftware.com
....................................................................
JAMF Software
1011 Washington Ave. S
Suite 350
Minneapolis, MN 55415
....................................................................
Office: (612) 605-6625
Facsimile: (612) 332-9054
....................................................................
US Support: (612) 216-1296
UK Support +44.(0)20.3002.3907
AU Support +61.(0)2.8014.7469
....................................................................
http://www.jamfsoftware.com

Thank you Miles et al. We were pretty much thinking along those lines (i.e
that it would be time-prohibitive even if it could be done), but the parent
runs some sort of virtualization consulting company and is being pushy about
the fact that it would "be easy" to do this.

I needed a little ammunition for a discussion with him, so your answers have
been very helpful!

Tatian

Hahahahaha

Sorry, did not mean to laugh. It would be "easy," huh? Well, what OS
is he trying to virtualize? OS X client you cannot virtualize with out
hacking and breaking the EULA. Once you hack it, and break the EULA you
are breaking the law, and on top of that you are tossing out quality
control right out the window. Next, running a VM inside a laptop will
consume more battery power, so you are reducing mobility. Now, lets say
you did decide to go ahead and deploy a VM of Windows, say Windows XP. Well, the Microsoft networking client requires unique computer names on
the network, which means most post config and sysprep type stuff. I
know with Windows 7 a lot of that stuff is gone now, but I don't have
much experience mass deploying Windows 7. At my current job and
previous job every Windows box we had was XP Pro.

Then come in the licensing fees. There is a special Windows license
for a 1:1 laptop deployment, I know because we bought it one year for
testing and I mass deployed a dual boot image to all my Macbooks (6,000
of them). It was hardly easy, and it had tons of caveats. If you find
a bug or a misconfiguration or need to update the VM, how do you
efficiently push out that fix/update?

It only really works when you are running some sort of Enterprise level
virtual machine deployment system, like what RedHat Enterprise Servers
do.

http://www.redhat.com/virtualization/rhev/

Sure I bet it can be easy, if you have the infrastructure and back bone
to make it easy. Otherwise, it is just sounds like way more work than
it is worth.

I mean, why wouldn’t they just buy a Mac, run BootCamp with Windows 7, and then purchase Fusion or Parallels to access windows while in Mac OS X?

What’s the deal here? If you want windows so bad go buy a Dell or whatever, but it sounds like your school standardizes on Mac. If you for some reason have value in Mac OS X don’t bastardize it and swallow your pride and buy a MacBook Pro that can run both natively, and well...it’s what I do. =)

Craig E

I can't say for VMware Fusion, but Parallels does not offer a volume
license, it is $50 a pop regardless of how many you buy. At least it
was two years ago when we did our dual boot image. Which is why we went
with dual boot instead of VMs because it was cheaper.

I remember a couple years ago we were asked to explore virtualizing Windows XP for some of our Design and Creative executives (at a branding firm). We had the full cooperation of the Wintel team. They provided us a Windows XP VM, joined to the Domain and managed in the same fashion as PC laptops. After some testing and proof-of-concept, we deployed to a pilot group, then later to the end users. The project was a success. Or so we thought.

After a few months the novelty wore off and the Helpdesk fought to get the Design and Creative executives back onto PC laptops. In the end, we swapped out their 15" Mac and PC laptops for smaller ones plus large monitors. Our warnings about total cost of ownership were dismissed. Lesson learned. ;)

Don