I want to start using Profile Manager on macOS Server but I am baffled by the documentation with respect to which steps to follow to set it up. I am already using mobile accounts and my client macs are using these. I'd like to extend this to some user setting management.
Mac mini, macOS Sierra (10.12.4), Server 5.3
There's this: http://help.apple.com/profilemanager/
Mobile Accounts won't have too much to do with Profile Manager. The users or admins will still have to "enrol" the Macs (IF you want device management and automatic profile pushing), or they can just use the My Devices portal to allow manual downloading of configuration profiles.
What're your intentions?
Unfortunately, as far as my understanding goes, any User or Group Profiles are only going to be applied to the User or Group that installed the profile, either automatically (via enrolment), or manually (via My Devices).
To apply a setting that would affect multiple users on one device, you'd either have to push or install those setttings as Device or Device Group settings, or each user would have to install (or have installed on their behalf) each Profile, on each device. Because each device can only be enrolled once, after the first user, it would have to be manual.
Workgroup Manager used to apply settings at login, but my understanding is that Profile Manager applies tham at Profile installation (which only occurs manually or via enrolment). It's a pretty different paradigm.
Profile Manager help isn't really up to date (for instance, I ran into descriptions that were not what I saw with the most recent Server). Anyway, I've come reasonably far in setting things up, it's just that it doesn't work yet.
My intentions are to manage Parental Controls from Server.app/Profile Manager for a specific user or group of users across all Macs. So far, I have not been able to get this working. I can't have that Parental Control setting work for all users on the enrolled Macs and while I have created a group for the users that get that Parental Control payload and put a user in that group, on login on the enrolled Mac, the user does not get those Parental Controls. So, what I am wondering about is how do I get this payload working for that user?
Basically, I am trying to replicate what I could do with WorkGroup Manager four years ago.
So, if I let a specific user install a Parental Controls profile that is available for a device that is enrolled, that Parental Controls only applies to that use and not to any other user? Because, how do I get that profile to the user if he goes to mydevices?
And wouldn't the user be able to just remove that profile?
I guess the first thing to understand is whether you are Enrolling these devices and whether these settings are set to Automatic Push or Manual Download. If anything is set to Automatic Push, it gets pushed at the time of the enrolment, based on the User (that logged into My Devices) and the Device they logged with (and any subsequent User Groups or Device Groups). These Settings do NOT appear under the Profiles tab in My Devices, and when you're looking at Profiles in System Administrator, they are not listed as separate Profiles, but rather as settings under the Device Management Profile.
With Manual Download, the Profiles show up in My Devices -> Profiles for the user to selectively apply. Unfortunately, this does not seem to work with Device Groups or Devices. While it does let you set them to Manual Download, I was not able to get them to show up in My Devices -> Profiles. Only User & Group Profiles set to Manual Download showed up for me there. So, you would need to use a different distribution method for Manual Device and Device Group Profiles.
Gerben Wierda wrote:
So, if I let a specific user install a Parental Controls profile that is available for a device that is enrolled, that Parental Controls only applies to that use and not to any other user? Because, how do I get that profile to the user if he goes to mydevices?
And wouldn't the user be able to just remove that profile?
So, that kind of profile download would not be possible. It would have to be a User or Group Profile or you would need a different distribution mechanism. But if you were to generate a Device or Device Group profile and download it from Profile Manager (not My Devices) and transfer and install it, since it's Device or Device Group, it would affect all users.
But if you made the profile a User or Group profile, it would be available for user download at the My Devices Portal.
Regarding removal, you can set rules in the General Settings. Options are Always (removable), With authoization, or Never:
So you could either install these on the users' behalf, or perhaps include a necessary carrot in the Profile like proxy or network settings.
Is there a primer for Profile Manager somewhere?
