So you want an office of Apple Macs - here's a survival guide
Trevor Pott digs out the tools to keep fanboi workers happy
Posted in Management, 5th November 2012 10:30 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Backups. You do have backups, right?
For file-based backups, it is hard to beat Apple's Time Machine. In fact, Time Machine is a selling point for Macs all on its own; it's more powerful and easier to use than Windows' native capabilities. Time Machine will back up your Mac to an external drive or compatible third-party NASes, my beloved, overworked Synology among them. You can also do Time Machine over iSCSI; the Drobo B1200i had no problems accepting backups from an entire office at the same time.
Image-based backups are critical for point-in-time recovery, restoring a system to a known-good state or coping with a dead hard drive. Traditional tools such as Clonezilla will do the trick, but Super Duper or Carbon Copy Cloner are far better suited. Between Time Machine and the image-based backups, Mac endpoints have become quite easy to maintain.
Centralised control
In a heterogeneous environment, how do you apply enterprise-grade centrally managed security, track usage and restrict access? The answer: using the same tools you use today. If you run a Mac-only environment, Mac only JAMF Casper Suite is where you should start. It does enterprise Apple management, it does it well, and it knows both OS X and iOS inside and out. Apple itself makes a popular option called simply remote desktop; it is a full centralised management suite and when combined with OS X Server can make Apple-only environments sing.
Microsoft's System Center 2012 SP1 is embracing management of Linux, Unix and OS X endpoints. To be frank, it's a good first try, but support is still not entirely there. It should be by the next revision, so keep your eye on it.
Symantec's Altiris and Dell's Kace are popular, truly enterprise-class management offerings with mature Mac support. I haven't personally had the opportunity to work with them in as much depth as I have with Microsoft's System Center. I have had only a few hours to play with both tools actively used in heterogeneous environments, but it is enough for me to strongly recommend them over System Center. System Center is a fantastic Microsoft-only solution, but these products have just been doing multi-vendor for longer.
Of course, Puppet is on the list here as well. If you do go the Puppet route for your configuration, Spiceworks is worth considering. Spiceworks and Puppet complement each other and even integrate well. Spiceworks gives you visibility of your network, and among other things, your software and hardware inventory. Puppet lets you control those items. Throw in monitoring from Nagios or Zenoss and SME admins can put together a powerful network management suite rivalling anything the big boys can offer, for a fraction of the cost.
'Have you tried turning it off and on again?'
Helpdesk software is the last critical item for any business deployment. System Center, Altiris, Kace and Spiceworks all offer ticket systems, asset management and so forth. They are all - to varying degrees - useful in a heterogeneous environment, and you shouldn't have to look beyond them for basic helpdesk software.
Behold, the beast of Redmond stalks my Mac desktop
Remote access is another matter entirely. For me, the biggest thing holding back Apple in the enterprise - even more than application compatibility - is the poor quality of the remote desktop software. OS X - like most flavours of Unix and Linux - uses VNC to share the desktop. The most modern VNC server is still slower than RDP from over a decade ago. Worse, Apple's licensing is such that you cannot do anything VDI-like: licences can only be used on Apple-provided hardware, and they offer neither high-density metal-as-a-service solutions, nor fully graphically accelerated VMware View-like VDI. If you want to remotely access your beefy Mac Pro and do some heavy lifting on it, you're out of luck.
If you are looking for remote access software for other purposes - the occasional peek into your home PC to check something, or for remote assistance - then there are many options available. Apple's remote desktop is one consideration. This application incorporates VNC client, SSH, file transfer and more. I personally use Teamviewer largely out of inertia; it works perfectly, why change? If you are going the Spiceworks route, Log Me In integrates directly into Spiceworks, making it a compelling choice.
Thinking different, in exactly the same way
If functionality gaps like the use of VNC serve as roadblocks to enterprise adoption, the blame lies squarely with Apple. In the case of this particular gripe, Apple could easily licence NX or pour resources into the very active community surrounding FreeRDP. Either would result in a more palatable remote option quickly. Lack of roadmap visibility, just plain dumb decisions and an obsession with secrecy also hurt corporate uptake.
Finally, all set up on the network and ready to fly
In truth, Apple simply doesn't care; Apple's goal isn't to build enterprise-class systems. It is a consumer electronics company. Secrecy is quite expertly parlayed into hype. Hype shifts units and has helped to build a religious following; one so strong that no gaffe can deter the faithful. Without a reason to innovate, Macs in the enterprise will never run an Apple solution stack unless you intend to run only Apple products. Unlike Microsoft networks - where the server and management side is Microsoft on Microsoft with added Microsoft - heterogeneous networks rely on third-party vendors to step in and fill the gaps.
Third parties have taken up the challenge and done a fantastic job; Macs in the enterprise are finally a perfectly viable option for organisations of any size. Microsoft is becoming a real option, with Symantec's Altiris and Dell's Kace being commercial off-the-shelf solutions. The freemium stack of Spiceworks, Puppet, Log Me In, Zenoss, Super Duper and globalSAN mean that even the smallest deployments can start bringing enterprise-class management to their Mac deployments today. ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
'Legacy'?
"A lot of legacy software is still Windows-only, and there remain today developers who don't make their software cross-platform"
The fact that something isn't Windows-only doesn't make it 'legacy', it probably means that there was no sensible business case for making Mac or Linux versions.
I can't much comment on the rest, but I will say that re: Time Machine, it's great until for no obvious reason the bloody thing starts dicking around. I've had people using Lion and Mountain Lion find their systems crash hard due to Time Machine, with no obvious fix in sight (with Apple Support's responses being of the helpful "Have you done a PRAM reset? Have you reinstalled? Have you tried another drive? Because despite Time-Machine-related OS updates it's not possible that it could be our side that's b0rked" variety).
The fact that software distribution to OS X is easier with KACE than with native OS X utilities is pretty bad.
But the big, BIG one for enterprise support that you've glossed over is hardware support. If you buy Apple portables, the best support you'll get on the hardware is collect-and-return with a 1-week turnaround (if you're lucky and you fall within the catchment area) or you can waste someone's time taking it to the Apple Store. Only their much-maligned desktops get on-site service.
The above, for me, are the problems. Some of my users want them, but I make damn sure they understand these issues before I let them buy one, and when they have an (increasingly likely) hardware issue the shine starts to wear off of their iShinies....
Support agreement with Apple?
I'd have thought that the "harder to fix" nature of the more modern Macs made them more challenging in a corporate environment? With my work Dell machine, when the hard drive dies, it's trivial to pop it out and put in another — if the SSD on my Air were to die, I'm not sure there would be a huge amount I could do without Apple's assistance? Having a stack of spare machines may be a workaround, to give time to get the borked machine to Apple, but keeping a stack of hard drives on hand seems easier and cheaper?
(Purely a guess on my part, based on being a Windows user at work, and a Linux/Mac/BSD user at home.)
How about open up a decent Unix command line without having to install cygwin?
I know this has been mentioned already but it really is worth mentioning again that this article misses out on one of the biggest problems with Mac in the enterprise; hardware support (or lack thereof).
I oversee a 100% Windows and Linux environment. 100% with the exception of one director, that is.
Not long ago the Macbook Pro of said director suffered an unknown logic board failure. The quickest solution was to fail over to a spare Macbook Air we had around and without going into the details lets just say the whole transition from Pro to Air, waiting for two weeks for Apple to mend the Pro, and then going from the Air back to the Pro was nothing short of a major pain in the arse... and a complete waste of time.
With our Windows and Linux systems however we have varying levels of ON-SITE hardware support (ranging from 24/7 4-Hour response times for upper management to Five-Days-a-Week Office Hour 4-Hour response times for everyone else, at minimum). Even without said support in place most trivial problems are a breeze to fix with a small cache of spare parts lying around.
Furthermore, for emergencies where even a 4-Hour response time is deemed too slow, non-drive related failures are as easy as pulling out the drive from a dead system, putting it into a functional spare, and updating TPM. Most staff however are comfortable with doing something which doesn't involve their computer during the 4-Hour downtime and with our experience thus far spare parts are always delivered via DHL Express within 30-60 minutes of me putting the phone down (and our vendor lets our own in-house staff do the fixing, though an engineer can also come down for trickier replacement procedures more typical with notebooks).
So... until Apple can come up with similar hardware support; thanks, but no thanks.
Enabling efficient data center monitoring
The new Office Garage series:
Top 10 SIEM implementer’s checklist
