Mac management for Windows IT folks

Computerworld - One of IT's key roles is client management, which is all about defining or controlling many aspects of how users' computers function. This can include restricting access to specific applications or Web sites, configuring auto-update policies, securing various parts of the file system and setting various display preferences or log-in scripts. This is all done with an eye to easing PC setup and deployment, increasing security and ensuring compliance with internal policies or legal regulations.

Most Windows administrators are familiar with client management in the form of Active Directory group policies. Group policies are incredibly flexible and can be used to define environment settings for computers, individual users or user groups. They offer a wide range of options for both restricting access to particular Windows features and applying predefined settings to Windows itself or individual applications. While not the be-all and end-all of client management options, group policies that are well planned and executed can significantly ease setup, security and support processes for new users and computers.

So what happens to this nice, tidy Windows world when the hotshot sales director wants his next computer to be a MacBook Air? Although Macs are a long way from conquering the enterprise, their numbers are growing -- nearly 80% of businesses now have Macs in-house, according to a survey by Yankee Group Research Inc. It's to your advantage to understand how to add them to your network safely and effectively.

The prospect of introducing Macs into a well-tuned and functioning Windows environment brings with it many questions and challenges. Will Macs be able to access network resources? Can they be joined to an Active Directory domain? What sort of deployment and management options are there for Macs?

We've got the answers to these questions, along with some tips and tools to make your Mac-Windows integration as smooth as possible.

Authentication and file/printer access

For several years, Macs have included support for accessing Windows shared files and printers through Apple's implementation of Samba. And Apple does provide an Active Directory plug-in to Mac OS X's authentication and directory services components that allows Macs to be joined to a domain and to authenticate users via their Active Directory credentials.

While Apple has improved its Active Directory plug-in since it was introduced in Mac OS X Panther in 2004, the plug-in isn't designed to offer complete access to all the facets of Active Directory available in Windows clients. It is designed to rely on LDAP, Kerberos and other supported encryption technologies to provide authentication -- which it does a generally good job of accomplishing. This is good news for organizations implementing a handful of Macs in an Active Directory environment.

In most cases, integrating Macs using the Active Directory plug-in is effective and requires no additional expense. Apple's Directory Utility (or Directory Access if you're using a pre-Leopard version of Mac OS X) is the tool for configuring a Mac's connection to a central directory system such as Active Directory, Apple's Open Directory or other LDAP-based directory services.

Apple's Directory Utility
Click to view larger image

Directory Utility even includes a number of options that allow you to configure how the Mac will behave, such as choosing a preferred domain controller and whether members of specific domain groups will be allowed local administrator access to the Mac, as well as determining whether the Mac will cache credentials for use off the network (referred to as creating a mobile account).

Note: Apple provides a video demonstration of Mac/Active Directory binding as part of its Apple Quick Tour of Leopard Server podcast series.

When looking at integrating a larger number of Macs, simple authentication may not be enough. For these situations, several different options can be considered -- each of them offering a unique take on the question of how to implement client management or other Active Directory features for Mac clients.