Screen Sharing

[jarednichols]

Off the Casper topic, but what the hey, you folks are smart...

I'm using Screen Sharing in Leopard to admin servers when I need to use the GUI. The server is in Active Directory, and I have a group in our AD that can admin the server. AD users in that group are able to add the servers in Server Admin, Server Monitor etc and everything works as expected. However, when you try to use an AD account to connect to the server in Screen Sharing, you're repeatedly denied access unless you use a local admin account.

Can anyone shed some light on this? I thought that as long as you were in the Admin group, (which those AD accounts are in the AD plugin) you could use screen sharing with those credentials...

Thanks!
--
Jared Nichols
ISD Infrastructure and Operations - Desktop Engineering
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420-9108
(781) 981-5500

[milesleacy]

I'm looking into Aqua Connect, but to remote into one machine to use as an
intermediary to remote to a second machine doesn't seem very logical or very
speedy to me.
It would be simpler and faster to directly connect to the machine in
question.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com

[Bukira]

Screen sharing uses the local kdc

I use apple remote desktop

Screen sharing also uses bonjour

I disable bonjour for polictal networking issues around mDNS and i also
destroy the lkdc as it messes with binding to an open directory server

Criss

Criss Myers
Senior Customer Support Analyst (Mac Services)
Apple Certified Technical Coordinator v10.5
LIS Business Support Team
Library 301
University of Central Lancashire
Preston PR1 2HE
Ex 5054
01772 895054

[jarednichols]

I imagine I'll need to use ARD anyway down the road as our user focus group will likely deem that remote assistance/management will need some sort of notification for the users (which currently as far as I'm aware doesn't happen with Casper Remote and the management account). This is just a short term solution for additional admins.

j

[milesleacy]

Is ARD enabled for these users?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com

[talkingmoose]

Actually, one of the features I requested a few of versions back was to
On 1/29/09 9:48 AM, "Nichols, Jared" <jared.nichols at ll.mit.edu> wrote:
enforce requests/responses for connecting to remote workstations using
Casper. This has been available since at least version 5.0. We enable the
following privileges for all our admins:

ˆ Observe Remote Computers ˆ Observe Remote Computers Without Asking At Login Window Observe Remote Computers Without Asking ˆ Control Remote Computers ˆ Control Remote Computers Without Asking At Login Window Control Remote Computers Without Asking

To date, ARD doesn't offer this feature but it's still worth having in your
administrative arsenal.

--

bill

William M. Smith, Technical Analyst
MCS IT
Merrill Communications, LLC
(651) 632-1492

[#7]

OK, how about this. Get rid of all the local apps and make them all run from a web-browser. or a web-browser that will download the app automatically when requested to run something like Casper Remote or CasperVNC. . . .

that might be cool :)

[milesleacy]

This reminds me of a point I'm dealing with now and have dealt with before. Most of the help desk and NOC staffs I have dealt with typically use
Windows desktops. I would love to have a Casper VNC client for Windows.
I'm more than happy that Casper is a Mac-only management tool, but not being
able to delegate tasks to anyone who isn't using a Mac is often a hindrance. Since it is logged, can require user permission and is only initiated when
an authorized user makes a connection, I would love to use the Casper VNC as
my primary, if not only, VNC tool. To do that, I'll need a client for
Windows.

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com

[ernstcs]

Get a Mac and run Windows and switch back when they need OS X.

The windows based remote app has been asked for before, by me included... long way back.

Bottom line to me, if you support Macs get one and use one on your support areas and staff.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

[tlarkin]

You guys know that MS has a remote desktop client for OS X right? I use
it at work all the time and it is free. You can download it from here

http://www.microsoft.com/mac/products/remote-desktop/default.mspx

if you have a Windows directory, ie AD or ED you can plug a computer
name list right into it.

FYI

[ernstcs]

Thats the reverse point really, Tom. We want to remote in to managed Macs via JAMF's secure VNC and SSH from a Windows clients which is typically dominant in help desks and other support centers.

Our help desk finally has a Mac or two so they can offer the same remote assistance Windows has afforded us for years. It took too long to get there though.

I have a pack of that software since I remote into a terminal server for our help desk system (IE ONLY BLEH), and for AD Work.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

On Jan 29, 2009, at 12:18 PM, "Thomas Larkin" <tlarki at kckps.org<mailto:tlarki at kckps.org>> wrote:

You guys know that MS has a remote desktop client for OS X right? I use it at work all the time and it is free. You can download it from here

<http://www.microsoft.com/mac/products/remote-desktop/default.mspx>http://www.microsoft.com/mac/products/remote-desktop/default.mspx

if you have a Windows directory, ie AD or ED you can plug a computer name list right into it.

FYI

[milesleacy]

I'd love to. However, outfitting a corporate call center with Macs to
On Thu, Jan 29, 2009 at 1:59 PM, Ernst, Craig S. <ERNSTCS at uwec.edu> wrote:
replace or even to supplement their PCs is expensive, a political
near-impossibility, and in my opinion, unnecessary.

It would be a lot easier and more practical to get a software tool which
allows the help desk staff to observe and control Macs than it would be to:

• replace their computers or put a second computer on their desk
• Train help desk staff on a new operating system and new set of tools.
• Convince management that this is a good idea.
• Get management to pay a premium for Macs when PCs have a lower entry cost
(I know the TCO on a Mac is better, but unless you can convince the help
desk management and the finance people, they just see the bigger number on
the invoice.)

Corporate purchasing groups often have purchasing quotas to meet with PC
makers in order to maintain a contracted pricing structure. Suggesting a
sudden drop in deployed PCs will get those folks after you.

In the larger organizations I've been involved with, there are three
separate and distinct groups within IT that the "Mac guy" (or gal) has to
deal with. 1. Desktop/Client support 2.
Infrastructure/Engineering/Platform management 3. Help desk. Most
situations I see have the "Mac guy" as part of group 1 or group 2, and
occasionally both 1 and 2. The help desk is often a separate group with
it's own leadership and goals, and sometimes it is outsourced. I think it
would be infinitely easier to say "Here, use this app to observe and control
Macs" than it would be to say "You need to buy Macs for all of your people."

Besides, we get a Recon.exe with the suite, so why not a CasperVNC.exe?

----------
Miles A. Leacy IV

? Certified System Administrator 10.4
? Certified Technical Coordinator 10.5
? Certified Trainer
Certified Casper Administrator
----------
voice: 1-347-277-7321
miles.leacy at themacadmin.com
www.themacadmin.com

[ernstcs]

Not that I wanted to get carried of on the political side topic, but I did say 1 Mac, or at least meant that.

I also realize there are exclusive single company contracts people adhere to for price breaks.

Craig Ernst
UW-Eau Claire
(715) 836-3639

Sent from my iPhone

[jarednichols]

Maybe the solution is for Apple to change the terms of OS X's client license to allow virtualization so you could run it on a VMWare Infrastructure server and your help desk clients could run it from their desk...

Just sayin'

j

[dustydorey]

Different worlds colliding here folks, Corporate IT is run different
than Educational IT. The differences can be only minor to wildly
different. Most of the people here that come from Education Support
backgrounds may see a use for such a tool, but not necessarily the need
based on how their IT department is structured. Where as someone in a
Corporate environment where IT support is incredibly compartmentalized
would see a huge advantage to a tool like this.

For instance if you are tier 1 support or helpdesk at a major
corporation, you could go your entire career there without ever seeing
the inside of the server room. How many of you in education support
can say the same thing? From what I've seen on both sides is that often
times you find people in corporations have a very set job, and goal, and
the tools provided to them are done in such a manner that it fills the
need of only that job. Where as in Educational IT your tech support
person may not have quite as clear of a job description and has many
more tools made available to them, simply because they must fill more
roles.

That may not seem to have anything to do with this conversation but it
does. What I'm getting at is the corporation is only going to give
those lower end support people the tools the NEED to do their job
because anything more would be a waste. Simply saying "get a mac"
isn't going to cut it. Especially when many companies would love to
cut IT all together as to them all they see is money going out.
Perceived value is paramount and it's pretty hard to tell finance you
need to pay that apple tax. Especially when you may have 50 people in a
support area at different desks or cubicles at different times of the
day. Getting one mac isn't going to cut it.

Not trying to make anyone mad, just explaining the rules are very
different between corporate environments and educational environments.

have a good day everyone!

[tlarkin]

I have been to several Apple sponsored training events with Server,
Directory Services, and all of that jazz they offer for edu
organizations. I have brought up virtual machines many many times and
always get the same answer, NO!

VMs would be invaluable for us IT guys/gals but it isn't going to happen
any time soon. Of course you could always try using OS X x86 and put it
into a VM no idea if that would even work or if it would be worth the
hassle, but just saying.

[jarednichols]

I really, really don't understand their reasoning. Make the VM run on Apple hardware at least. That's fine - they do this with Server today!. Having 8 partitions on a machine for testing purposes, always rebuilding/reimaging one of them in SO rediculous.

j

[tlarkin]

Well for one, straight from the horses mouth to quote Jobs, "Apple is
not an enterprise company." That is their attitude towards it. They
also think it would hurt their sales since people could run VMs on PCs. I don't think they can code the TPM in a VM to make sure its running on
a Mac since it is all x86 hardware and VMs run on that virtual layer. Yes it is freaking ridiculous. I have a FW HD with 4 partitions on it. OS X 10.4 server/client and OS X 10.5 server/client so I can target mode
boot off them for testing purposes.

Every time I go to an Apple sponsored event I always ask out loud when
we can see OS X in a VM. I figure if I ask enough maybe someday we will
get it.

---

Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry: 913-449-7589
office: 913-627-0351

[#19]

I haven’t tried it with Leopard, but we used to have some success with Real VNC (http://www.realvnc.com/) talking to a 10.4 Server. It suffers from some lag compared to OS-native software (RDC or ARD), but it runs the standard VNC protocol and I believe that you can point it at other ports.

Ric

--
Ric Getter
Portland Community College/Sylvania
Coordinator, Computer Resource Center
(503)977-8036