Configuring Apple MACs for use in an enterprise environment

-
We currently own over 150 Apple computers, 20 which are MacBook Pro's and the remaining amount being iMAC’s. All of our MACs are unmanaged and require onsite assistance when issues occur.

These are some of the issues we experience when using MACs in our enterprise environment;
  • DNS resolution issues
  • Proxy settings disappearing from the Network Settings for the Network Adapter.
  • Constant bombardment of proxy authentication prompts once logged into the MAC for the first time using your Windows Credentials. There are two prompts for system HTTP & HTTPS and two prompts for the Safari Web Browser (HTTP & HTTPS).
  • Safari Web Browser not set to the default home page for our company
  • Printers have to be manually configured on the MACS
  • Blocking of applications is too complicated for staff to manage (causes other issues with other programs)
  • Attached network drives, home shares and memory sticks are not always visible on the users desktop
  • All of the computers individually connect to Apple’s update repository wasting bandwidth
  • Unable to perform any remote administration to the MACs
  • MACs regularly showing ‘Network Accounts Unavailable’ (NAU) which prevents Active Directory users from logging into the MACs.
  • Docks should be consistent with the most frequently used applications available to select instantly.

Our current setup;
  • All Apple computers run 10.7.1
  • All MACs joined to the Active Directory Domain
    • NTP configured in clock preferences. This is important as if the time is out of sync with Active Directory then you may find the computer showing the error ‘Network Accounts Unavailable’
    • Option specified to allow administration by network accounts via Active Directory Group Membership. See Reference 1.
    • Modified the Search Policy to include a custom path. We found that adding the missing item within the authentication policy reduced the frequency which we would experience NAU error. All Domains is the last entry of the Search Policy.
  • Users home directory available within the User Dock
  • Windows printers manually attached to computer. See Reference 2.
  • All computers are connected to the Microsoft ForeFront 2010 Firewall Web Proxy Service. 
  • Fully Functioning Windows Server 2003 Active Directory Domain

What we have done to address the issues our users are experiencing;
  • DNS resolution issues - within the DHCP Scope, I have ticked the ‘Dynamically update DNS A and PTR records for DHCP clients that do not request updates.’ This fixes the issue of trying to contact the host name of the machine when trying to provide remote assistance.
  • Computer Preferences - We have obtained an old iMAC, installed 10.7.4 MAC OSX and downloaded and installed MAC OSX Server. Once the MAC Server is installed, you can use the Work Group Manager (WGM) to create a Computer Account Group and configure deployment of settings such as;
    • Proxy Configuration
    • Browser Customization
    • Login Messages
    • Blocking of Applications
    • Advanced configuration of Finder Preferences
    • Printer Deployment
    • Login Scripts
    • Software Update Repository
    • Dock Customization

Once the deployment is configured, you need to select computers who will be ‘members’ of that group. This is discussed next. See References 3 & 4 for help downloading and installing MAC Server
  • Join the MACS to the Open Directory Domain and ensure the LDAP Directory for the MAC server is the last entry is the Search Policy. Once the MAC is joined to the OD (Open Directory), it is also necessary to bind it using an OD administrator account. Once this is complete, the computer will appear in the WGM. You need make sure the computer account is a member of a Computer Group within WGM. Once this is done, all you need to do is log out and back in and the preferences will have applied. If not, check;
    • The MAC is binded to the OD domain properly
    • You have an IP Address
    • You have attached the MAC to the correct container which contains preferences
    • Do some digging!
  • Configuration of Software Update Server on MAC Server - Identify the URL and attach it to the preferences for the ‘Software Update Repository’ within the Computer Group Preferences. See Reference 5.
  • All MACs updated to 10.7.4. The change log specifically states that issues have been resolved with ‘Improve the reliability of binding and logging into Active Directory accounts.’  We have instantly noticed the difference. An example would be some machines showing the NAU message. After the installation, the error message would disappear. See Reference 6 for list of updates.
  • In order to provide remote assistance to the MACs, the following features within Sharing have been enabled;
    • ‘Remote Login’ for Administrators only. This allows you to use SSH to connect to the terminal of the MAC and perform remote commands.
    • ‘Remote Management’ for specific users (unable to select AD Accounts, but you can control another users account who is logged in if you have their username and password). If you click the Options button, you can select the ‘force VNC users to type in a password before connecting to this machine’.
    • Installed TightVNC Client on our Windows Clients. Once the hostname is specified, we are prompted for the VNC password and then connected to the remote MAC.
  • Multiple Proxy Prompts - This actually look a while to resolve. I was looking at third party software such as Centrify and Thursby which might allow me to use my current credentials to authenticate to proxy server but they all failed. The issue was related to the Kerberos ticket issued to the user from the Domain Controller once logged in. Although the Kerberos ticket was perfectly valid and allowed me to authenticate to other network shares without prompting me for a password, it would not allow me to authenticate against the firewall. The issue came down to the ServicePrincipleName (SPN) attribute attached to the computer account for the firewall. If a specified service is not listed, the Kerberos ticket is not allowed to be utilized. After I made the change to the SPN, all of the four proxy prompts disappeared after a reboot. If you specify the proxy server via IP address, you would have an SPN value of ‘HTTP/10.1.1.1’ for example. See Reference 7 for my support query within Microsoft’s Forums and Reference 8 which helped me resolve the issue from McAfee.
  • Login Scripts - we have used a simple bash script which runs as root to apply various settings such as disablement of the 'Cloud' popup storage notification.

The End

This is just my experience of using MACs within a corporate environment. I am not responsible for any damage caused to your network environment by following the content of this article - I am only trying to help someone out there.

I hope it helps you and gives you a pointer in the right direction. Comments welcome.

Thanks

References:
  1. http://support.apple.com/kb/HT4332 - Adding Network Groups to Adminster MAC
  2. http://support.apple.com/kb/HT3049 - Adding SMB Printers
  3. http://www.apple.com/osx/server/how-to-upgrade/ - How to download MAC OSX Server
  4. http://www.dummies.com/how-to/content/how-to-create-an-open-directory-master-using-lions.html - How to install MAC OSX Server
  5. http://support.apple.com/kb/HT4069 - Software Update Service
  6. http://support.apple.com/kb/HT5167 - MAC 10.7.4 updates
  7. http://social.technet.microsoft.com/Forums/en-GB/Forefrontedgegeneral/thread/3c6a6c16-0ac0-41c4-95ab-cfaf19c04f31 - Kerberos Authenication
  8. https://community.mcafee.com/docs/DOC-2682 - Configuring Kerberos for Web Gateway on McAfee

Comments

Post a Comment

Popular posts from this blog

Create bootable CUC CUCM CUP Image / ISO

-
The following script allows you to automatically create a bootable CUCM/CUC/CUP image without the need for any paid for software when you only have access to the update outside of put or the datastore for the new server. I have spent several hours on this, but I just wanted to make it simple. Only really for lab purposes, the checksum will fail due to the ISO being manipulated but essentially once you fill in the variables, you will just be left with a single ISO file in the staging directory. To use; 1. Download the mkisofs.exe file as described in the script 2. Paste script below into Powershell ISE Script Editer 3. Modify the variables 4. Execute the script. Simple. Tested creating an ISO on a Windows 10 machine and running the ISO on a ESXI server. Thanks for this guy Aaron Harrison as per the URL, was helpful in the finding out the mkisofs.exe command syntax. http://www.ipcommute.co.uk/technical-articles/17--creating-isolinux-boot-dvds-with-free-software-cucm-uccx-c...
Read more

Configuring Oracle 12c backups on Veritas Backup Exec 16.

-
Image
This is a short guide to configuring backups of Oracle 12c using Veritas Backup Exec 16. 1.        Establish trust with Oracle Database server within Backup Exec console and ensure agent is installed. 2.         Create a login to the database for backup purposes in Oracl e; Open up a command prompt and run the following command – Sqlplus / nolog Log in with your database admin account as sysdba Connect myusername / mypassword@databasename as sysdba CREATE USER BACKUP IDENTIFIED BY MYPASSWORD; GRANT UNLIMITED TABLESPACE TO BACKUP; GRANT AQ_ADMINISTRATOR_ROLE TO BACKUP; GRANT DBA TO BACKUP; GRANT CONNECT TO BACKUP; ALTER USER BACKUP DEFAULT ROLE ALL; ALTER USER BACKUP DEFAULT TABLESPACE SYSTEM; 3.        Within the Local Users and Groups section of Computer Management on the Oracle database server, add the backup servers windows domain adminis...
Read more

Configuring Cisco CME Voice Gateway (VG) for incoming and outgoing calls using Sipgate trunk

-
Image
Hi All For my reference and your's, here is a working sample configuration for configuring sipgate (sipgate.co.uk) for incoming and external VOIP calls on a 2800 series Cisco router. Using GNS3; My wireless adapter has internet connection sharing enabled, and I have created a loopback adapter which is the 'internet' adapter as you can see below. I have tested making calls using Cisco's CIPC version 8 and receiving calls. This doesn't have to be done in GNS3, just pick up yourself a real voice gateway. version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname VG-EP ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication login http local aaa authentication login ssh local aaa authorization exec http local ! aaa session-id common ! resource policy ! memo...
Read more