Final project report for "Investigate the new centrally managed Mac desktop"

Project Description

Investigate the new centrally managed Mac desktop and consider/research whether it would be of any benefit to Mac users within the School.

Project page

Project updates (minimal)

Documentation/Links

JAMF Pro

IS docs - user-facing

IS docs - comprehensive documentation

JAMF web interface

EdLAN DB

AD user lookup/editing

How it works

The University centrally provided managed mac desktop is based on JAMF Pro.

Conversion to a managed mac is performed through installation of the QuickAdd package, as found on IS support pages.

The procedure is slightly different for laptops and desktops - this is well documented on IS support pages. For both, there is a concept of a "primary user" to be associated with the machine. For laptops, this is used to generate the machine name, for use by the JAMF web interface and in AD.

Desktops must be registered in EdLAN DB. The machine name in DNS must match the netbios name (case is irrelevant). Informatics netbios names begin with 'INF-'. A dns alias is acceptable, e.g. the machine with a netbios name of INF-CUYP is named 'cuyp' locally and has a DNS cname of inf-cuyp.

Desktops allow network logins for anyone in Active Directory, without requiring a local account on the machine. For this to work, the active directory record for a user wishing to log in must not have an AFS home directory path (as many of ours do).

Further configuration as the primary user will probably be required following the installation of JAMF software and subsequent reboot, e.g. eduroam and VPN (for laptops), configuration of OneDrive.

The conversion to managed Mac does not affect any accounts or software already on the machine, nor affect the ability to add either subsequently.

The SelfService application lets users easily install additional applications (from a list of approximately 90 - both free and otherwise licensed), add printers and network shares.

Informatics has an admin support account added by default on all informatics managed macs, name: infsupport, password: ask Jennifer/Toby.

The 'uoemanage' admin account is created by JAMF on all managed macs and is used for running policies.

JAMF can be completely removed from any managed mac by running the SelfService "Remove JAMF Management" utility, when logged into SelfService as the 'infsupport' user. This facility is comparatively new, but seems to work well. In the early stages of this project it was something we identified as something we would like.

The default use of ED.AC.UK credentials can be annoying for a user who wishes to remain authenticated within the INF.ED.AC.UK realm - authenticating to the screen-saver refreshes the former in the user's default credentials cache. This would, for example, require re-authenticating to INF.ED.AC.UK for gssapi ssh connections to work. There are technical solutions which could be investigated should this prove to be an issue.

Support

There is extensive documentation on the IS support pages. IS have been helpful and responsive to our many questions via Unidesk. There is also an issues tracker for submitting bugs.

Conclusions

The centrally managed mac support looks to be potentially useful, particularly for less experienced users. It should be noted that it doesn't take complete control of a machine, in that local management is still possible. It will probably be used more for individual laptops (and is already in use for at least two users in the school/college), but installation on a desktop provides an easy way of providing a multi-user Mac without having to manage accounts.

Our recommendation is that requests for new macs, particularly laptops, should be assessed for suitability for the managed mac programme by user support and then monitored afterwards.

Other issues

The issue of who is responsible for supporting non-Informatics staff in Bayes should be clarified.

Time spent

Toby: 51 hours (~7.3 days)


-- TobyBlake - 24 May 2019

Topic revision: r3 - 17 Jul 2019 - 11:33:19 - TobyBlake
 
This site is powered by the TWiki collaboration platformCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback
This Wiki uses Cookies