TweetFollow Us on Twitter

MacEnterprise: MCX - No Excuses, Now!

Volume Number: 24
Issue Number: 11
Column Tag: MacEnterprise

MacEnterprise: MCX - No Excuses, Now!

New options for managing workstations in OS X Leopard

By Greg Neagle, MacEnterprise.org

Frequently Asked Questions

There is a certain type of question that pops up over and over again on the MacEnterprise mailing list, the radmind-users list, and other lists, forums, and discussion groups where Mac admins hang out. You'll also hear these questions at the Macworld IT track, and at WWDC. The questions go like this: "How do I manage the screen saver so it always asks for a password?" "How can I prevent the OS from asking the user if they want to use a newly connected FireWire/USB disk as a Time Machine backup destination?" "How do I get the Office 2008 Setup Assistant to not pop up for new users?" Or more generally, "How do I manage the user experience on all my machines?" Nine times out of ten, this question can be answered with "Use MCX!".

MCX

For several years, Apple has had a technology for managing workstations and the user experience, often referred to as MCX, or Managed Client for OS X. To take advantage of MCX to manage users, groups, and computers, an administrator uses Apple's Workgroup Manager utility to edit records in a directory service - typically Open Directory, but sometimes Active Directory or third-party LDAPv3 with Apple's schema extensions.

If your organization did not use Open Directory as its central directory service, and was unwilling or unable to extend the schema on its existing directory service, it was difficult to get the benefits of using MCX to manage your Macs and their users.

There were a few options: one, often referred to as the "Magic Triangle", involved binding client Macs to both the organization's central directory services, and to a locally-managed Open Directory server. Mac clients would then receive their user and group info from the central directory, and their client management data from Open Directory.

Another option was for admins to write scripts that replicated some of the behavior provided by MCX - usually by modifying plist files with the defaults command or PlistBuddy.

Far less frequently used was the option to store MCX data in the client's local directory service. This was possible with NetInfo, but the trouble was replicating those settings across multiple machines. You could not simply replicate the NetInfo database across multiple machines; you had to find a way to export the MCX data (and the objects it was attached to), and import this data on other machines.

So when a Mac administrator asked "How do I manage...", and you replied "Use MCX!", they'd often object: "But I don't have an Open Directory server, and my Active Directory admins won't let us extend the schema! So is there another way?" Using MCX data in the local NetInfo was too difficult, so they spent a lot of time writing scripts to manage things, and then pushed those scripts out to every machine.

Leopard changes the equation. Now there is really no excuse at all to not use MCX to manage your machines. If you don't have a central MCX-friendly directory service, you can store the MCX data in the local directory service. More importantly, since this data is stored as simple files, replicating this to other machines is as simple as copying a few files. If you manage multiple OS X machines, you must have a way to copy files to each machine - that might be a software distribution mechanism like Casper or FileWave, a filesystem management utility like radmind, or even something as basic as Apple Remote Desktop or the scp utility.

This method also allows administrators to ease into MCX management: you do not need an Open Directory server or extended schema to get started. Instead, you can start with the local directory service. Once the powers-that-be in your organization can see the benefits of MCX, they may be more inclined to invest in the resources needed to set up a "Magic Triangle" or extend the schema on your existing directory service.

Demo Time

Let's demonstrate what can be done with MCX and the local directory service.

You'll need Workgroup Manager, which is part of Apple's Server Admin Tools 10.5. Get them from your Leopard Server install media, or search Apple's website for "Server Admin Tools".

To work with the local directory service, launch Workgroup Manager on a OS X client machine. When presented with the dialog to connect to a server, type "localhost" as the server name, and enter the name and password of a local admin for the local machine.


You'll see a warning that you are working in a directory node that is not visible to the network. Check Do not show this warning again if you wish, and click OK to dismiss the panel.

For purposes of this demo, we'll manage aspects of the local machine using the guest computer object. Settings for this object apply to all computers that don't have an explicit computer account record in the directory, which makes it work well for this demo. Choose Create Guest Computer from the Server menu in Workgroup Manager. You'll now have a guest object in the Computer view:


Select the guest computer, then click the Preferences icon in the toolbar. We're going to set some options for the Login Window, so click the Login icon in the Preferences overview.


Under the Window tab, click Manage: Always, then make some changes to the managed settings. Below, I've changed the Heading to display the serial number instead of the machine name, added a message to the Login Window, and changed the Style to show only name and password fields (instead of the default list of users).


Click Apply Now to save your changes.

Now log out and you should see the Login Window display the changes. If you don't, a restart should get them to kick in.


Even more interesting: log back in and open System Preferences, select the Accounts preference pane, and choose Login Options. If you followed my example and set the Login Window to show name and password text fields, you'll see that option set in the preference pane, and grayed out so you cannot change it.


This is a huge advantage of using MCX instead of scripts that write to various plists - in many cases, the OS updates the user interface to reflect your management settings.

We've used Workgroup Manager to manage certain preferences for this machine, and stored the MCX record in the local directory service. But what exactly does that mean? To find out, login as an admin and open the Terminal application. You'll need root privileges, so type sudo -s and press return, entering your own password when prompted (your account will typically need to be admin level to work. If not, login with an admin-level account).

Now change to the local directory service directory, and list its contents:

root# cd /private/var/db/dslocal/nodes/Default
root# ls
aliases        computergroups config         machines       users
computer_lists computers      groups         networks

The guest computer object we created, since it's a computer object, is stored in the "computers" directory:

root# cd computers
root# ls
guest.plist 

Let's examine guest.plist:

root# cat guest.plist

And you'll see a standard OS X plist, which is too long and boring to list here. But you don't really need to deal with the internal structure at all - to replicate these MCX settings on another machine, you need only copy this file to the same location on another machine (and most likely restart the other machine, or restart DirectoryService to get it to notice your changes). If you have a way to push out files to your managed machines, you can now push out MCX settings the same way.

Future Directions

The demonstration isn't very flexible: since all the managed settings are stored in guest.plist, it's hard to mix and match settings. Next time, we'll look at some MCX management strategies using Leopard's new ComputerGroups that allow you to mix and match management policies.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Paragon Firewall 2.0 - Powerful firewall...
The Paragon Firewall - Network Monitor application gives you the full control over your Mac, protects the privacy of your computer, prevents unwanted network connections. Network Monitor discloses... Read more
Geekbench 5.4.5 - Measure processor and...
Geekbench provides a comprehensive set of benchmarks engineered to quickly and accurately measure processor and memory performance. Designed to make benchmarks easy to run and easy to understand,... Read more
The Unarchiver 4.3.5 - Replacement for t...
The Unarchiver is a much more capable replacement for "Archive Utility.app", the built-in archive unpacker program in OS X. The Unarchiver is designed to handle many more formats than Archive Utility... Read more
WhatsApp 2.2216.8 - Desktop client for W...
WhatsApp is the desktop client for WhatsApp Messenger, a cross-platform mobile messaging app which allows you to exchange messages without having to pay for SMS. WhatsApp Messenger is available for... Read more
ffWorks 3.0.5 - Convert multimedia files...
ffWorks, focused on simplicity, brings a fresh approach to the use of FFmpeg, allowing you to create ultra-high-quality movies without the need to write a single line of code on the command-line.... Read more
Bartender 4.1.49 - Organize your menu-ba...
Bartender lets you organize your menu-bar apps by hiding them, rearranging them, or moving them to Bartender's Bar. You can display the full menu bar, set options to have menu-bar items show in the... Read more
Steam v020 (1642451672) - Multiplayer an...
Steam is a digital distribution, digital rights management, multiplayer and communications platform developed by Valve Corporation. It is used to distribute a large number of games and related media... Read more
Arq 7.19.1 - Online backup to Google Dri...
Arq is super-easy online backup for Mac and Windows computers. Back up to your own cloud account (Amazon Cloud Drive, Google Drive, Dropbox, OneDrive, Google Cloud Storage, any S3-compatible server... Read more
QuickBooks 19.0.11.988 - Financial manag...
QuickBooks helps you manage your business easily and efficiently. Organize your finances all in one place, track money going in and out of your business, and spot areas where you can save. Built for... Read more
Dropbox 148.4.4519 - Cloud backup and sy...
Dropbox is a file hosting service that provides cloud storage, file synchronization, personal cloud, and client software. It is a modern workspace that allows you to get to all of your files, manage... Read more

Latest Forum Discussions

See All

Hand-Drawn ‘Monkey Island’-Inspired Poin...
Point-and-click adventure games are a perfect fit for mobile devices, and there have been dozens of fantastic adventures released on mobile over the years. Now Short Sleeve Studio is looking to add another to that list with their upcoming title... | Read more »
SwitchArcade Round-Up: Reviews Featuring...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for May 16th, 2022. In today’s article, we’ve got reviews of a few recent releases. Dungeons of Dreadrock, Eiyuden Chronicle: Rising, and Prinny Presents NIS Classics Volume 2 are in the... | Read more »
Best iPhone Game Updates: ‘Fighting Fant...
Hello everyone, and welcome to the week! It’s time once again for our look back at the noteworthy updates of the last seven days. A very spicy assortment of updates have arrived, with plenty of faces we don’t see very often in these hallowed halls.... | Read more »
A Steam Deck Verified Podcast – The Touc...
In this week’s podcast Eli is jumping for joy after spending the past week with his shiny new Steam Deck. We talk about the things we love about the hardware, the games that play well on it, and plenty more. Is this slowly morphing into a Steam Deck... | Read more »
TouchArcade Game of the Week: ‘Donut 80’
Donut Games is legendary around these parts, but they haven’t been as active in releasing new games for the past several years. Their latest release was Birk’s Adventure way back in 2019, and before that it was Footy Golf in 2017. In the earlier... | Read more »
‘Castlevania: Grimoire of Souls’ on Appl...
Castlevania: Grimoire of Souls on Apple Arcade has just received a huge update adding in new story chapters, characters, and more. Interestingly, these new chapters also bring the conclusion to the Grimoire storyline, which begs the question as to... | Read more »
SwitchArcade Round-Up: ‘Hyper Echelon’,...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for May 13th, 2022. We’ve got a little bit of news today before we head into the remaining releases for the week. Fewer big guns today, but there are a few decent games if you’ve a mind... | Read more »
‘Kingdom Eighties’ is a Totally Tubular...
If there’s one set of games I never imagined myself enjoying as much as I do, it would be the Kingdom series from Raw Fury. Originally a popular Flash game released in 2013, the original Kingdom was fleshed out and released as Kingdom: New Lands in... | Read more »
Ensemble Stars!! Music: 4 Reasons to Be...
While getting up close and personal with superstar idols may not be too feasible in real life, Ensemble Stars!! Music offers players the chance to do just that from the palm of their hand. The colourful sequel to Ensemble Stars! lets players immerse... | Read more »
Open World Action RPG ‘Dysmantle’ From 1...
Open world action RPG Dysmantle debuted on PC and console platforms, and it is setting its eyes on mobile beginning next week on iOS. 10tons calls Dysmantle an open world action RPG where you ruin everything. Your aim is to escape the island by... | Read more »

Price Scanner via MacPrices.net

New today at Apple: Clearance 2020 10.9″ iPad...
Apple has Certified Refurbished 2020 10.9″ iPad Airs now available in their online store in a variety of configurations. Models start at $469 and range up to $190 off Apple’s original MSRP. Each iPad... Read more
Prices continue to drop on Apple Refurbished...
Other World Computing has dropped prices again on Apple refurbished, factory-sealed, just-discontinued 27″ 5K iMacs with models now on sale for up to $814 off Apple’s MSRP, starting at only $985.... Read more
Apple has clearance 27″ 5K iMacs available st...
Apple has clearance, Certified Refurbished, 2020 27″ 5K iMacs available starting at $1299 and ranging up to $560 off original MSRP. Apple’s one-year warranty is standard, shipping is free, and each... Read more
Use your Apple Education discount to take $10...
Need a new 13″ Apple MacBook? Whether you’re a student, teacher, or staff member, you can use your .edu email address when ordering at Apple Education to take $100 off the price of a new MacBook. All... Read more
In stock today and on sale: Silver 13″ M1 Mac...
Amazon has Apple’s Silver 13″ MacBook Pros with M1 Apple Silicon processors in stock today and on sale for $150-$250 off MSRP for a limited time. Shipping is free. These prices are the lowest the... Read more
Mac Studio with M1 Max CPU in stock and on sa...
Apple reseller Simply Mac has the new Mac Studio with M1 Max CPU (10-Core CPU) in stock and on sale for $1899.99 including free shipping. Their price is $100 off Apple’s MSRP, and it’s the lowest... Read more
In stock: Open-box 16″ M1 Pro MacBook Pros fo...
Having trouble finding a 16″ M1 Pro MacBook Pro to buy? QuickShip Electronics has open-box return 16″ M1 Pro MacBook Pros in stock and on sale for $350-$450 off MSRP on their eBay store right now,... Read more
Apple Watch SE models are on sale today for u...
Amazon has Apple Watch SE GPS models on sale today for $50 off MSRP including free shipping. Their prices are the lowest currently available for SE Watches: – 40mm Apple Watch SE: $229, save $50 –... Read more
Switch to Red Pocket Mobile and get an Apple...
Switch to Red Pocket Mobile and get an Apple iPhone SE for $100 off MSRP, plus get free 6 months of Unlimited nationwide service with the purchase of any iPhone. Red Pocket Mobile is a nationwide... Read more
8.3″ WiFi iPad minis are in stock today and o...
Amazon is offering sale prices on Apple’s 8.3″ WiFi iPad minis ranging up to $100 off MSRP, depending on configuration. Prices start at $409. Most models are in stock today with free shipping. Amazon... Read more

Jobs Board

Systems & Applications Specialist I - *A...
Systems & Applications Specialist I - Apple / Mac Desktop Support Focus **Texas Medical Center-Houston, Texas** Information Technology UTHealth Administration Read more
Sr. Strategic Marketing Programs Manager - *...
The Sr. Strategic Marketing Programs Manager - Apple will be focused on helping SHI tell a compelling and exciting story around its partnership with Apple Read more
Senior *Apple* Support Technician - Randsta...
senior apple support technician. + newport beach , california + posted may 2, 2022 **job details** summary + $45 - $50 per hour + contract + bachelor degree + Read more
Senior *Apple* Support Technician - Randsta...
senior apple support technician. + newport beach , california + posted 10 days ago **job details** summary + $45 - $50 per hour + contract + bachelor degree + Read more
*Apple* / Mac Administrator - JAMF Pro - Ame...
Job Summary Amentum is seeking an Apple / Mac Administrator - JAMF Pro to provide support with the Apple Ecosystem to include hardware and software to join our Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.