Original URL: https://www.theregister.com/2012/11/05/apple_in_enterprise/
So you want an office of Apple Macs - here's a survival guide
Trevor Pott digs out the tools to keep fanboi workers happy
Posted in OSes, 5th November 2012 10:30 GMT
Apple Macs are ready for the enterprise. Unsurprisingly, they can already be found in organisations of all sizes. The five sigma announcement by CERN of the Higgs boson bordered on an Apple advertisement. IBM has more than 10,000 Macbooks deployed. My own SME clients have heterogeneous networks, some are even Mac only.
With so many organisations deploying so many Macs, we can no longer rely on the psychological crutch that these units are seeing service simply because of the ego or desire of a handful of top brass. My personal experience says that business Mac usage is being driven by employees looking for comfortable and familiar environments; the results of BYOD policies at IBM, Intel, Google and other large organisations would seem to agree. It would seem that when everyday people are given the choice of computer platform, we do not all choose the same thing. Let's review what it takes to make the jump.
Playing nicely with others
A network of any appreciable size has some form of centralised authentication in place. Synchronising local users so everyone can access shared resources isn't feasible; a directory service becomes the logical choice. Coaxing Macs into playing along with directory services has sometimes proven to be a small challenge. Fortunately for sysadmins everywhere, this has changed with recent releases.
For small networks - or Mac-only networks - I see little advantage to using Active Directory to tie your network together. In a Windows-only environment, Group Policy Objects (GPOs) and Preferences (GPPs) give small-network administrators powerful options to control systems on their networks. Their ROI argument is diminished in modern heterogeneous environments.
LDAP-based directories - which share common ancestry with Active Directory - are available from multiple vendors. Virtually every Linux distribution comes with one; Apple's own OS X Server has one as well. For deployments below 25 devices, I prefer using the LDAP server built into Synology DiskStations. Synology's NASes are excellent "small-business server" appliances. Using pGina, legacy Windows systems can be joined to these open LDAP servers.
For predominantly Microsoft deployments, Active Directory is the only sensible choice. Macs don't disappoint; OSX 10.8 (Mountain Lion) "just works" [PDF] with Active Directory. A few simple clicks and you are logged in with domain credentials. If you want more robust Active Directory integration than is provided by OS X itself, Thursby's ADmitMac has a cult following and for good reason.
Taking authentication a step further means adapting Microsoft's Group Policy for the Mac world. Centrify and Quest both make products that extend Microsoft's Group Policy to Apple's operating system. Naturally, whenever discussion turns to pushing GPO-like configs to endpoints, Puppet also deserves a mention; the depth of Puppet's offer surpasses the others mentioned above.
There can only be one Trevor Pott... hopefully
Click to enlarge photos
None of this should be taken to suggest that Macs cooperate in a centrally managed environment without their own quirks. Macs don't require you to enter the domain portion of a login, instead iterating through its directory search sequence in a linear fashion. You can specify a domain suffix (trevor@pott.local, for example) or you can log in with just your username and hope that the user isn't replicated in any of the other domains on the trust list. Not a problem for smaller organisations; potentially big headache for larger ones.
Mac OS X Mountain Lion also contains a bug regarding profile naming. If the user trevor@pott.local has been accessing the system, the Mac is disjoined and then rejoined to a new domain and then trevor@theregister.local logs in, the Mac will assign trevor@pott.local's profile to trevor@theregister.local. This can lead to some truly bizarre behaviour, such as phantom icons in the dock, or system preferences applets crashing when you try to launch them. (Specifically, the "Users & Groups" and "Security & Privacy" applets.) Deleting the offending profile and logging back in resolves the issue.
iSee you! A phantom iPhoto icon in the Mac OS X dock
Macs have robust, reliable software for accessing shared company resources. NFS and SMB shares "just work". Whereas it took fiddling in previous versions to get Macs to play nice with Windows network, Mountain Lion has given me no grief at all using either Windows Servers, my Synology NAS or the Drobo B1200i I have on loan.
Fine-tuning what to share on the network
The globalSAN iSCSI initiator works like a charm; the Drobo is screamingly fast and fed LUNs for virtualisation and backups quite reliably. I haven't been able to tip any Macs over using any of these common file-server protocols on either IPv4 or IPv6. Mountain Lion also comes with a solid VPN client, sealing the deal on communicating with other systems in most business networks.
Designed for Windows doesn't mean you must use Windows.
What if you have Windows-only applications that Mac users need to use? A lot of legacy software is still Windows-only, and there remain today developers who don't make their software cross-platform. If you must use these applications, don't despair. Solutions to this problem exist.
Virtual Desktop Infrastructure (VDI) is a popular solution to the legacy application problem. For simple applications, straight up RDP will do; Microsoft offers a client with its Office suite. CoRD has proven to be a reliable alternative for those choosing another productivity package. VMware's View is ready for OS X if you need a high-performance centrally delivered desktop.
Client-side virtualisation is also a worthy consideration. Macs don't tend to skimp on the hardware. Both Parallels and VMware's Fusion are capable of delivering fully graphically accelerated Windows environments on your Mac. Everything from CAD software to video games works smoothly in either application. If your needs tend more towards the delivery of a single application, App-V is a great transition technology.
Most software vendors have realised that the days of Windows-only environments are numbered. Nobody wants to be relegated to a legacy software provider that entire companies can't wait to ditch, and so the number of applications being written either native to the Mac or for web delivery is on the rise. Many critical business applications, such as Microsoft Lync, now have Mac clients and this trend isn't looking to reverse any time soon.
Backups. You do have backups, right?
For file-based backups, it is hard to beat Apple's Time Machine. In fact, Time Machine is a selling point for Macs all on its own; it's more powerful and easier to use than Windows' native capabilities. Time Machine will back up your Mac to an external drive or compatible third-party NASes, my beloved, overworked Synology among them. You can also do Time Machine over iSCSI; the Drobo B1200i had no problems accepting backups from an entire office at the same time.
Image-based backups are critical for point-in-time recovery, restoring a system to a known-good state or coping with a dead hard drive. Traditional tools such as Clonezilla will do the trick, but Super Duper or Carbon Copy Cloner are far better suited. Between Time Machine and the image-based backups, Mac endpoints have become quite easy to maintain.
Centralised control
In a heterogeneous environment, how do you apply enterprise-grade centrally managed security, track usage and restrict access? The answer: using the same tools you use today. If you run a Mac-only environment, Mac only JAMF Casper Suite is where you should start. It does enterprise Apple management, it does it well, and it knows both OS X and iOS inside and out. Apple itself makes a popular option called simply remote desktop; it is a full centralised management suite and when combined with OS X Server can make Apple-only environments sing.
Microsoft's System Center 2012 SP1 is embracing management of Linux, Unix and OS X endpoints. To be frank, it's a good first try, but support is still not entirely there. It should be by the next revision, so keep your eye on it.
Symantec's Altiris and Dell's Kace are popular, truly enterprise-class management offerings with mature Mac support. I haven't personally had the opportunity to work with them in as much depth as I have with Microsoft's System Center. I have had only a few hours to play with both tools actively used in heterogeneous environments, but it is enough for me to strongly recommend them over System Center. System Center is a fantastic Microsoft-only solution, but these products have just been doing multi-vendor for longer.
Of course, Puppet is on the list here as well. If you do go the Puppet route for your configuration, Spiceworks is worth considering. Spiceworks and Puppet complement each other and even integrate well. Spiceworks gives you visibility of your network, and among other things, your software and hardware inventory. Puppet lets you control those items. Throw in monitoring from Nagios or Zenoss and SME admins can put together a powerful network management suite rivalling anything the big boys can offer, for a fraction of the cost.
'Have you tried turning it off and on again?'
Helpdesk software is the last critical item for any business deployment. System Center, Altiris, Kace and Spiceworks all offer ticket systems, asset management and so forth. They are all - to varying degrees - useful in a heterogeneous environment, and you shouldn't have to look beyond them for basic helpdesk software.
Behold, the beast of Redmond stalks my Mac desktop
Remote access is another matter entirely. For me, the biggest thing holding back Apple in the enterprise - even more than application compatibility - is the poor quality of the remote desktop software. OS X - like most flavours of Unix and Linux - uses VNC to share the desktop. The most modern VNC server is still slower than RDP from over a decade ago. Worse, Apple's licensing is such that you cannot do anything VDI-like: licences can only be used on Apple-provided hardware, and they offer neither high-density metal-as-a-service solutions, nor fully graphically accelerated VMware View-like VDI. If you want to remotely access your beefy Mac Pro and do some heavy lifting on it, you're out of luck.
If you are looking for remote access software for other purposes - the occasional peek into your home PC to check something, or for remote assistance - then there are many options available. Apple's remote desktop is one consideration. This application incorporates VNC client, SSH, file transfer and more. I personally use Teamviewer largely out of inertia; it works perfectly, why change? If you are going the Spiceworks route, Log Me In integrates directly into Spiceworks, making it a compelling choice.
Thinking different, in exactly the same way
If functionality gaps like the use of VNC serve as roadblocks to enterprise adoption, the blame lies squarely with Apple. In the case of this particular gripe, Apple could easily licence NX or pour resources into the very active community surrounding FreeRDP. Either would result in a more palatable remote option quickly. Lack of roadmap visibility, just plain dumb decisions and an obsession with secrecy also hurt corporate uptake.
Finally, all set up on the network and ready to fly
In truth, Apple simply doesn't care; Apple's goal isn't to build enterprise-class systems. It is a consumer electronics company. Secrecy is quite expertly parlayed into hype. Hype shifts units and has helped to build a religious following; one so strong that no gaffe can deter the faithful. Without a reason to innovate, Macs in the enterprise will never run an Apple solution stack unless you intend to run only Apple products. Unlike Microsoft networks - where the server and management side is Microsoft on Microsoft with added Microsoft - heterogeneous networks rely on third-party vendors to step in and fill the gaps.
Third parties have taken up the challenge and done a fantastic job; Macs in the enterprise are finally a perfectly viable option for organisations of any size. Microsoft is becoming a real option, with Symantec's Altiris and Dell's Kace being commercial off-the-shelf solutions. The freemium stack of Spiceworks, Puppet, Log Me In, Zenoss, Super Duper and globalSAN mean that even the smallest deployments can start bringing enterprise-class management to their Mac deployments today. ®