MacOS – Client Management of MacBook Pros

administratormacbook promacos

My team is starting to get large enough (9 and growing) that I'm looking for some thoughts on best ways to support our MacBook Pros & Airs. I'm fairly new to Macs though, much more comfortable with Linux. But now I'm looking for best practices to:

  • Configure and deploy new Macs (or repurpose existing ones)
  • Install and manage software of Macs that are in active use
  • Install software updates from Apple & third-party developers
  • Provide secure login and user experience management on each Mac
  • Inventory or asset management

I don't think I need enterprise solutions (and don't have a enterprise budget) but would like any pointers on best way to go about this.

Best Answer

I work as the Mac admin for a large non profit. At the moment I oversee roughly 200~ or so Macs, both in our main office and deployed across the world. The Mac influx has only been a thing for the past 3-4 years, before that they were largely windows based and as such are deeply intrenched in MS Exchange and Active Directory. Now that Macs make up about 35-40% of the user base, and are growing rapidly, that may change. However, this is still the environment. This is how I deal with the questions you posed...

  • Configuring and deploying of new/existing Macs: This is largely handled by DeployStudio. I have scripts and a workflow in place that mostly automate the process of installing all the base software (MS Office, Citrix Receiver, etc), custom user settings (user template, dock settings, Finder preferences, etc), base admin account creation, printer drivers, etc. This is the workflow I apply to all new Macs that come in the door, it is done without first wiping and imaging the Mac, a process referred to as thin imaging. For existing Macs that need to be redeployed I will reimage them using an image that has been created from comparable new Macs that have new software (just pulled 10.9.2 from a MacBook Pro Retina for example) and then apply the same workflow I mentioned before. New Macs take about 5 minutes to complete from unboxing to ready to deploy, re-deployed Macs take about 30 minutes due to the larger image. All of this is done via net boot and can be done anywhere in our 6 story building. Profile Manager is later used to deploy different settings and whatnot.

  • Install and manage software of Macs that are in active use: This is mostly handled through Apple Remote Desktop (ARD). You can use free tools such as PackageMaker, IceBerg, etc to create a custom installation package (if needed) and then remotely install that to either a single Mac or groups of Macs using ARD. I believe ARD costs about $80 but in my experience it pays for itself rather quickly. It has lots of management tools built in, allowing you to VNC control Macs, send scripts, install packages, etc. I have a second install of ARD on our main Mac server, which I use as a Task Server. I can set up installations on that server and as Macs come online it pushes out the installations to them, which is great since we have lots of staff coming and going at all times. Another popular tool for this is Munki, which I don't have much experience with but am starting to look at. Most Mac admins tend to swear by it.

  • Install software updates from Apple & third-party developers: I use the built in Software Update Serve (SUS) and Caching Server provided by Mac OS X Server. The SUS allows you to serve out and manage (blocking/allowing updated) software updates from your local Mac server. The drawback to this is it can only serve out updates for systems matching it's OS version and older, Macs need to be configured to look for it specifically, etc. Caching Server is proving to be a better fit. It requires to configuration on the client end, caches and serves out Mac App Store, iOS App Store, iBooks and Apple software updates. Its only downside is that you can't block certain updates. This is another area where a lot of people use Munki. For third party updates (usually Flash, Java, etc) I'll create an installer package then push it out via ARD.

  • Provide secure login and user experience management on each Mac: As I mentioned we use Active Directory (AD) for the majority of our user account control. I also bind all of our Macs to the Open Directory (OD) on our main Mac server, which allows for more Mac centric controls. Beyond that each Mac has a local administrator account, which is what we use for connecting via ARD and whatnot. New users sign in at the login screen, it checks Active Directory, pulls their info and creates a Mobile Account, which allows them to still login when their outside our network.

  • Inventory or asset management: Right now we use Spiceworks, free help desk software, that has a lot of this built in. It scans the network on a user set schedule and adds new Macs/devices as they are found. It's built more for Windows / AD use but it is ok with Macs. We're currently exploring other options.

Additional - If I were you I would seek to make use of OS X Server. It has relatively meager system requirements so you could likely find and use an old iMac or Mac mini for relatively cheap. The Server app itself is $20, ARD is $80. All in all it's pretty cost effective to setup a Mac server environment using their tools. Once setup you can do the majority of things that larger software/management tools, like JAMF Casper and whatnot, offer for much greater costs. It's likely not as smooth but it will still save you lots of time.

Hope that helps!