I want to enforce MCX computer policies, but all my users are admins...

Question

I want to enforce MCX computer policies, but all my users are admins...

Hi Jim

I have an interesting situation that maybe you have dealt with in the past. Maybe I can pick your brain. I am very familiar with Mac OS X, but new to MCX and OD.

I am deploying ~200-400 Macs in Q1 08. All of them will be Intel iMacs running 10.5.x (Leopard). I am going to be running both AD (for authentication/authorization) and OD (for MCX). My OD servers will be running Leopard Server (Xserves)

I want to manage all of the Mac computers via MCX. One gotcha: My CIO has insisted that all the Mac users will be administrators. Rather than trying to manually set each user up as a local admin, I have created a AD group called "Mac Power Users" and each user that gets a Macintosh system will be in this group. My master Netinstall Mac image is set to acknowledge the AD "Mac Power Users" group as a valid admin group via the Directory Utility, and thus any Mac bound to AD will see the Mac AD effectively users as administrators. Dont ask why I have to do this - its a political issue and even our current 400 Windows XP desktops are setup like this too. Grrr.

Anyway - I want to manage basic settings via OD/MCX like automounts, Web proxies, loginwindow settings & maybe printers too. Mostly computer based policies, not much user or group level policies will be needed (I hope)

Question: If all my users are considered local admins based on the AD "Mac Power Users" group, will they override my OD/MCX policies? If so, is there any way to allow them to be admins but still enforce computer policies via MCX?

Its the chicken and the egg!

TIA

Xserve, Mac OS X (10.5), OD & AD

Posted on Nov 7, 2007 8:23 AM

Reply

Answer 1

Nov 7, 2007 11:40 AM in response to Daniel Stranathan

Hi

If I understand you correctly then you should be able to do this using computer lists. Don’t be tempted to use or delete the default ones already there, create a new one instead and add all of your clients to that list. You can use the diaresis (3 dots) button to discover all of your clients (they have to be turned on and have unique names eg: iMac01, iMac02 etc). Its actually better if you manually add the clients to the list by collating all the MAC addresses. Although if you use the Server’s DHCP Service then you can generally get away without doing this. You should also disable automatic logins.

Apply managed preferences from there.

Managed preferences applied to computer lits are applied to the hardware and as such it will not matter whether network or local users are admins or not. You’ll also notice that there are a few extra settings that can be managed at computer level that are not available in either Users or Groups. Login Window and Energy Saver settings for example. The order in which MCX are applied are Users, Computer Lists and Groups. Managed preferences are also accumulative.

Tony

Reply

Answer 2

Nov 7, 2007 12:24 PM in response to Antonio Rocco

There's a Workgroup Manager Computer settings that allows admin users to turn off managed preferences. Be sure this is disabled.

Reply