OSX in the Enterprise?

Education here - we are mainly a Windows shop, but we have about 100 Macs which students use in our Arts areas, and associated lecturers use Macs too. We use OSX Mavericks for all our Macs at this time. (Ok, I have one Yosemite Mac Mini in production as a guinea pig).

All Macs are bound to Active directory forests. A long time ago we extended our AD with Apple's additions (deprecated now I think) which makes things a lot easier as they are still honoured by Mavericks - things like 'apple-user-homeurl' for the server and share and apple-user-homequota for example.

We have two Apple XServes which we use one only as an AFP fileserver. We use AFP as when we were using Adobe CS4, apps would repeatedly crash when using SMB but would be rock solid using AFP. We use Creative Cloud now, and we are planning to migrate back to SMB hosted on Server 2012R2 (with de-dupe) in the future assuming Adobe software is now stable (Yosemite and later now default to using SMB3, so the OS is ready). Mavericks does support connecting to Windows DFS shares.

We use Apple's ARD management tool, however it's a bit clunky and gets easily confused in a DHCP environment, particularly as pretty much every Mac these days has wifi and potentially multiple IP addresses. This can be worked around by setting up smart groups based on serial number to manage rooms rather than dragging them into collections. Another problem with ARD is machines have to be on and responding when you send out packages or commands, otherwise they wont execute them. It is great however for classroom management.

I do have SCCM working for Mac management, but not really done anything with it apart from getting the clients installed and reporting in and testing that it works. This would potentially resolve software deployment issues.

Deployment is handled with DeployStudio which is really well put together. Imaging is really really simple and can be fired off remotely using ARD (assuming your machines are turned on...)

The best way to manage OSX for things like WiFi, printers etc. is via Apple's MDM solution 'Profile Manager' (bundled with OSX Server) - this makes it really easy to push out WiFi settings and certificates (protip: OSX wifi certificates are CaSe sEnSiTiVe) and printer settings. It will also manage all your iOSX devices, and integrated with AD so you can set for example, Exchange settings on a usergroup basis with variables which will apply to both OSX and iOS devices meaning that once set up, you assign devices to an individual and they all get the same mail settings etc.

/r/sysadmin Thread