Forgot your password?

typodupeerror
Networking Apple IT

Large-Scale Mac Deployment? 460

Posted by kdawson
from the rolling-'em-out dept.
UncleRage writes "I've been asked to research and ultimately recommend a deployment procedure for Macs across a rather large network. I'm not a stranger to OS X; however, the last time I worked on deployment NetRestore was still king of the mountain. Considering the current options, what methodologies do admins adhere to? Given the current selection of tools available, what would you recommend when planning, prototyping, and rolling out a robust, modular deployment scenario? For the record, I'm not asking for a spoon-fed solution; I'm more interested in a discussion concerning the current tools and what may (or may not) have worked for you. There are a lot of options available for modular system deployment... what are your opinions?"
This discussion has been archived. No new comments can be posted.

Large-Scale Mac Deployment?

Comments Filter:
  • by Anonymous Coward on Monday September 21, 2009 @07:51PM (#29498225)
    Is there even such a thing in this world? Folks like to disparage Windows, but it really is the only OS built for very large enterprises. Linux solutions don't really compare to Windows solutions - there, I said it...
  • Re:Macs (Score:4, Insightful)

    by Anonymous Coward on Monday September 21, 2009 @07:55PM (#29498267)

    Guess what? It would be you, not the Macs. I'd have fired you for wasting the time needed to tear a display apart instead of sending it to the manufacturer to be repaired.

  • Re:Macs (Score:4, Insightful)

    by Brian Gordon (987471) on Monday September 21, 2009 @08:03PM (#29498361)

    Taking it apart yourself is worse than paying somebody else $400/hr to take it apart for you?

  • by norkakn (102380) on Monday September 21, 2009 @08:07PM (#29498387)

    radmind ftw

  • try serverfault (Score:3, Insightful)

    by gbrandt (113294) on Monday September 21, 2009 @08:15PM (#29498465)

    Try asking this on serverfault.com. Lots of advice can be found there.

  • by Anonymous Coward on Monday September 21, 2009 @08:21PM (#29498517)

    I have had great success out of both DeployStudio (http://deploystudio.com/) and LanREV (http://www.lanrev.com) in K-12 schools with 200+ machines.

    wow the only real answer this guy is gonna get...

  • by i.r.id10t (595143) on Monday September 21, 2009 @08:36PM (#29498671)

    LDAP, thunderbird w/ lightning plugin (or openexchange, citadel or similar), XDMCP.. Updates? Your own local ubuntu/debian mirror w/ custom packages, etc. Lots of equivalents.

  • by Daniel Dvorkin (106857) * on Monday September 21, 2009 @08:38PM (#29498689) Homepage Journal

    Is there even such a thing in this world?

    Yes. Next question?

    Seriously, it's obvious from the story that there is, indeed, "such a thing in this world." Windows users love to accuse Mac and Linux users of fanaticism, but honestly, there's nothing more fanatical than a Windows drone who can say something like "[Windows] really is the only OS built for very large enterprises" and believe it.

  • by molarmass192 (608071) on Monday September 21, 2009 @08:39PM (#29498691) Homepage Journal
    Spoken like someone who's obviously never seen, much less used, OS X Server. OS X server is built around standards based enterprise tools like Apache, LDAP, CalDAV, and IMAP. You know, ISP grade stuff like this:
    http://www.apple.com/server/macosx/specs.html [apple.com]

    What standards is your Windows Server / gaming platform, based on?
  • by genner (694963) on Monday September 21, 2009 @08:42PM (#29498719)

    LDAP, thunderbird w/ lightning plugin (or openexchange, citadel or similar), XDMCP.. Updates? Your own local ubuntu/debian mirror w/ custom packages, etc. Lots of equivalents.

    ....and still no replacement for active directory.
    This is really the only practical reason why windows is still on top.

  • by Anonymous Coward on Monday September 21, 2009 @08:45PM (#29498743)

    yeah, google is so small time.

  • by amirulbahr (1216502) on Monday September 21, 2009 @08:46PM (#29498751)

    Active Directory

    You can't be serious on this one. LDAP + Kerberos can easily take on that role plus some.

    Exchange

    Email is easy enough to offer but shared address books and calendaring may give Exchange the edge. No harm in deploying Exchange on the back-end and using Evolution or Thunderbird or web based Exchange on the front-end.

    Terminal Services

    This is the most outrageous of your claims. Linux, Solaris, *BSD all come up trumps in this. You've got X11, NX, VNC, and the most advanced thin client solution at the moment, Sun Ray [sun.com].

  • by confused one (671304) on Monday September 21, 2009 @08:46PM (#29498753)
    OS X is a certified Unix platform. Why is it hard to believe it's capable of being used as a large enterprise OS.
  • Re:Macs (Score:3, Insightful)

    by NiceGeek (126629) on Monday September 21, 2009 @08:52PM (#29498819)

    "Ever replace a backlight in a fucking Apple Cinema Display? That's 3 layers (and a thousand assorted screws and layers of tape)"

    Sounds like replacing a backlight in every LCD monitor that has ever existed.

  • by GigsVT (208848) on Monday September 21, 2009 @08:53PM (#29498831) Journal

    We have an OS X server.

    It really does suck.

    It's kind of like a crippled BSD server with weird management utilities and a lot of buggy modified utilities.

    You might as well just use a normal Linux server, since all the same daemons are available, and much easier to manage.

  • by raddan (519638) * on Monday September 21, 2009 @08:53PM (#29498837)
    The only problem with Mac OS X Server (and this is speaking from 10.3-10.4 experience; maybe 10.6 server is better) is that if Apple's grand vision for your network doesn't fit your own vision, then Mac OS X Server is next to useless. The problem is that Apple has preconfigured a number of built-in services, and changing them causes major headaches.

    For instance, in 10.4, any change to the GUI would overwrite your /etc/smb.conf. What's worse is that Apple often runs old versions of this software. If, say, you want to go out and run the latest Samba, nothing is stopping you, but expect parts of Apple's system to break. Sure, I admit, lots of people go this route and have many workarounds for Apple's stuff, but for us, we figured: if we're going to do all this work to circumvent Apple's packaged stuff, why not just run Linux? So that's what we run on our backend now. We even run Netatalk, which has to be the simplest daemon I've ever configured-- it basically worked with PAM+winbind right out of the box, and so we're able to authenticate our AFP clients against AD, too.

    If you're a very small shop, and you want a simple drop-in fileserver, Mac OS X will probably work for you. If you want a simple Open Directory, and don't have an existing directory system, Mac OS X will probably work for you. But get any more complex than that and you might as well use something else.
  • by h4rr4r (612664) on Monday September 21, 2009 @09:22PM (#29499067)

    You don't, you use the many available tools to do what you want to all the machines via scripts. This is the same thing you do when you realize that group policy only exists for a couple things and everything else you are on your own.

  • Re:Virtualization? (Score:2, Insightful)

    by scottdmontreal (1003416) on Monday September 21, 2009 @09:43PM (#29499221)
    Yes.
  • by Anonymous Coward on Monday September 21, 2009 @09:57PM (#29499333)
    The fact that this is modded Funny is really shitty.
  • by ilmdba (84076) on Monday September 21, 2009 @09:58PM (#29499339)

    please... X11, NX, VNC and Sun Ray all suck ass compared to RDP. i use them all on a daily basis, and RDP is far and away the best of them all. authentication, remote devices (USB, printing), sound, mapped drives, etc. etc. none of these other solutions even touch on any of those features. not to mention, the performance of RDP smokes all of those others completely out of the water.

  • Re:Macs (Score:2, Insightful)

    by elfprince13 (1521333) on Monday September 21, 2009 @11:06PM (#29499837) Homepage
    A new PowerBook hmm? It's clear you're well informed on the subject of Apple computers, given that a "new" PowerBook has to be at LEAST 3 years old at this point.
  • by torkus (1133985) on Monday September 21, 2009 @11:34PM (#29499983)

    Sorry but no.

    Based on your anecdotal example...bla bla bla. Buy you readily say you're buying sub-par equipment. So i'm not sure how you can compare "good" equipment. If i bought a $300 clearance PC and compared it to a $800 enterprise-class PC i'm sure i'd see more failures in the cheapy one.

    Moving on...to the smaller end of 'large' business - 2500 users and ~4000 computers in my enterprise. Similarly configured Macs cost us about twice what a PC does. Apple doesn't give on hardware unless you're buying them by the truck load and even then it's not nearly as much as other large suppliers.

    Go negotiate pricing with 7-figure yearly spending and Dell, HP, etc. will give a LOT more than Apple. Yes, Macs are pretty but we're talking about enterprise. Pretty takes a back seat.

  • by MeNeXT (200840) on Monday September 21, 2009 @11:37PM (#29500009)

    This is so far of the mark it can only come from a windows centric operation. What happens when the business' interest lies in a non microsoft solution? How does MS AD handle that?

    If it's so simple to deploy then why are so many large companies so hesitant to upgrade?

    I hear this a lot but have not seen it work with a mixed environment yet. Windows does not play well with others. If you care to lock yourself down to windows fine with me. I manage over 15 companies and the only common software they have is in the office. Unique business solutions require unique management software and AD is very limited!

  • by Antique Geekmeister (740220) on Tuesday September 22, 2009 @12:16AM (#29500285)

    No, there are many historical reasons Microsoft has its leadership position. It has, in fact, been convicted for many of them.

    Active Directory is useful: its management interfaces are very useful for modest size environments. Scaling it down to small shops that can't spare dedicated, expensively licensed servers or scaling it up to large environments that require subtler control and redundancy, however, is extremely painful. Its underlying technologies are all more manageable with a more intelligent database behind it and a superior auto-configuration setup. These components are:

    DNS
    DHCP
    Kerberos (authentication)
    LDAP (user account and machine resource management)

    That's basically it. And given its lack of sanity checking of its own configurations, the difficulty of scripting its operations, and its mishandling of the addition or re-configuration of new resources, I don't recommend it for large environments.

  • by TrueKonrads (580974) on Tuesday September 22, 2009 @01:26AM (#29500707)
    Isn't this kind of the point? If You can spend 2 hours and have a domain deployment with all the features You need done by a average paid admin, why spend two weeks by a linux guru? IT on a basic level is not something that adds immense value so why spend a lot on it?
    P.S. I love hacking just as the next guy and linux on enteprise is my pet peevee.
  • by Cyberax (705495) on Tuesday September 22, 2009 @06:38AM (#29501955)

    "Egh, Active Directory is just LDAP with Kerberos and some proprietary crap thrown on top to make in hard to interoperate with other OS's."

    Yep, and Linux is just a couple of C files, written by underpaid engineers in their spare time.

    ActiveDirectory is much more than 'just LDAP with Kerberos'. It has nice management tools and integrates with almost all Microsoft applications. And most important: it actually works just fine. And you can easily interoperate with AD because using simple LDAP.

    I've tried to make a replacement for AD in Linux network. Even after spending a week I was not completely successful. For example, I still have no idea how to make offline logins using cached credentials. Or how to integrate Kerberos authentication and IPSec.

  • by drsmithy (35869) <drsmithy@@@gmail...com> on Tuesday September 22, 2009 @07:49AM (#29502257)

    However, where Microsoft wins out is that that isn't easy to roll out.

    That's got to be a strong contender for "laughably inaccurate understatement of the year", right there.

    The Linux's and BSD's of the world make you learn how the engine works first, but once you've got it figured out you still make it to 60MPH before MS does.

    Bollocks. Even an entry level, nothing-but-the-MCSE Windows admin could setup an simple AD environment in a day or so. On the other hand, a highly qualified Linux admin is going to be messing around for a week (or more) to hack something equivalent together using LDAP, Kerberos, cfengine, et al, unless they're specialists in those tools.

    This is before even getting into the ongoing maintainability of those systems. One is a standard cookie cutter deployment, easily understood by any remotely qualified Windows Admin. The other is a customised collection of puzzle pieces, held together with duct tape and string, that even "expert" level Linux admins will take days to fully understand.

  • by 99BottlesOfBeerInMyF (813746) on Tuesday September 22, 2009 @10:16AM (#29503571)

    Similarly configured Macs cost us about twice what a PC does.

    The last actual study I read on this, Macs cost about 20% more than the average PC on the market. That put them right in line with Sony and several other reputable computer manufacturers. Apple systems also rated best in the industry for hardware failure rates both DOA and within the first 2 years and had the best rating for support solutions to both hardware and software problems. That pretty much justifies placing them in the premium hardware category don't you think?

    When you say Macs sot more than PC's you're simply wrong. Mac's cost about the same as good PCs. They are better than and cost more than crappy PCs which are a lot more likely do die on you. If you buy a PC with the same level of reliability and quality components as a Mac you'll spend about the same. On the other hand, when you buy a Mac you will probably spend more money than when you buy a comparable PC. I know you're scratching your head at this point.

    The problem with buying Macs isn't that they cost too much for what you get. The problem is they have fewer models than the combination of all reputable PC makers, so you're less likely to be able to get exactly what you want so you often end up buying something that exceeds the requirements. The end result is a buyer spending more, but it's due to lack of selection not overpricing. I wish people on both ends of this stupid argument would actually look up the numbers and comprehend the situation, so we could stop having this discussion over and over again.

  • by Sandbags (964742) on Tuesday September 22, 2009 @11:33AM (#29504701) Journal

    Does price matter in enterprise, where the hard cost of the machine is maybe 10% of it's 3-4 year cost in IT labor, software, upgrades, and downtime?

    Fact is, and NOONE argues this, the PC simply costs 2-3 times the amount of time investment anually, plus requires additional software and agent licenses not required on the mac side (and no, I DO count AV for both Mac and PC, I'm refereing to image software, central management agents, and extras like PDF writers, etc that all come free with a Mac).

    Even if the Mac was 3 times the cost, $500 to $1500, at $50 a hour (low for internal IT costs, all inclusive of salary, training, tools, desk cost, space for the emplyee, etc, industry norm is considderend $70-100 per hour for helpdesk staff costs), it would only take a 20 hour differnce in IT investment, even if all other costs were the same software and upgrade wise (the Mac makes out better there too), for the Mac to be cheaper than the PC. This also doesn't count resale value, or tax incentives, which favor the Mac as well.

"Our vision is to speed up time, eventually eliminating it." -- Alex Schure

Working...