Posted on 02-08-2011 05:40 AM
Hi Everyone,
I am doing some research on best practices for our student computers along with our faculty and staff computers. Has anyone developed a best practices for management of computers and software? Is there a published white paper by Apple or some other entity that I can refer to? Trying to figure out what level of control a student should have on a computer and the same for users of their own district equipment. For instance, should we use parental controls for students and standard settings for our staff and faculty? This would mean only an admin could make changes to installations or software updates.
In addition to this research, I am looking into what it will take to manage our computers using Apple's workgroup manager. We have active directory running and the Macs are not a part of that yet, though they will be. That being said, should I use AD to push down group policies or should we simply use an Apple server solution to use workgroup manager?
Another question is referring to Apple's software update server. I understand it works best for workgroup manager environments, but if we don't use workgroup manager, can we still effectively use Apple's software update server?
Finally, if we choose to use workgroup manager, is there a limit on how many computers it can manage effectively? I thought several versions ago the limit was somewhere around 50-100 computers for effective utilizations.
Thanks everyone for your responses in the past and I am looking forward to continued dialog in the future. Sorry for all of the questions. We have a new security policies being put into place and I am trying to get a head of the fact and not to play catch up with the windows computers.
Regards,
Mick
--
Michael D. Conners, APP
Apple Project Leader
3550 Anderson Street
Madison, WI 53704
Phone: 608-246-6360
Fax: 608-246-6329
Work E-Mail: mconners at matcmadison.edu
www.realworldsmart.com
Posted on 02-08-2011 10:02 AM
Hi Mike,
If you want to do GPO, you'll need a 3rd party AD plugin line Quest/Likewise/Centrify/ADMitMac. If you can afford it and are able to support it, it leverages your existing AD management staff so they can manage policies on the Macs. Um, hope they understand enough to not make a mess out of things (been there).
If you mean MCX, you can extend AD schema and point WGM to it for storing settings. Apple has the procedure documented. If AD is in good shape, this is very reliable...and aside from project time for extending AD schema, it's free. Goole for any words that come out of Tim Perfitt's mouth in the area of AD schema extension:
I wouldn't recommend AD/OD triangle to my worst enemy. Too cost prohibitive and painful to implement and support. Better to have your enemy's naked body be dragged through broken glass.
Don