TweetFollow Us on Twitter

MacEnterprise: Loco for Local MCX

Volume Number: 25 (2009)
Issue Number: 02
Column Tag: MacEnterprise

MacEnterprise: Loco for Local MCX

Using Apple's client-management settings on the Local machine. Following up on MCX

by Greg Neagle

Previously in MacTech...

In the November issue, we looked at getting started with MCX by using MCX records in the local directory service. We set some policies for the loginwindow using the Guest Computer object, verified they worked, and noted that the Accounts preference pane had certain controls grayed out to match our management settings.

Since local directory service entries in Leopard are simply plist files stored in /var/db/dslocal/nodes/Default, replicating MCX settings to multiple machines can be as simple as copying a few files.

Lod

Scalability and Modularity

If you are going to use the local directory service to store MCX data, you'll quickly discover that putting all your management settings into the Guest Computer object doesn't give you very much flexibility. If you want different groups of machines to have different management settings, you'll have to maintain multiple versions of /var/db/dslocalnodes/Default/computers/guest.plist, and mixing and matching management settings becomes tedious, as you'd have to create a version of the guest.plist for every needed combination of management settings.

A new feature of MCX in Leopard can help: Computer Groups. Prior to Leopard, MCX supported "Computer Lists", which were, unsurprisingly, lists of computers. Management settings could be applied to Computer Lists, which would then apply those settings to all computers in the list. The downside is that a given computer could be a member of only a single computer list at a time.

Leopard's new Computer Groups behave more like groups of users: a computer can be a member of multiple Computer Groups. This allows you to modularize your management settings. Create a Computer Group called "loginwindow" and apply all the loginwindow management to that Computer Group. Create another Computer Group called "screensaver" and apply your screensaver policies. If you want a machine to have both the "loginwindow" and "screensaver" policies, just add it to both Computer Groups. In this way, you can modularize your policy settings and mix and match them among machines. This approach even works if you are implementing MCX management in a traditional network directory environment.

Complications ensue

Perhaps now you're thinking, "Great! I'll create Computer Groups with my desired management settings, add the Guest Computer to each of those Computer Groups, and I'm all set!" Not so fast. There's a complication: even though Workgroup Manager allows you to add the Guest Computer account to a Computer Group, the MCX settings for the Computer Group are not applied to guest computers. So we'll need to use another way to take advantage of Computer Groups.

Use Workgroup Manager to connect to the local directory service as we did last time:


We will create a computer record that will represent the current local computer. Make sure you are working in the /Local/Default directory. Select the Computer accounts icon in the left pane, and click New Computer. Set the Name and Short Name to "local_machine", and click Save. You can leave all other fields empty.


You can now add this computer record to your Computer Groups:


We're not done yet - MCX still has no way to know that by "local_machine" you mean the current machine that this is running on. To do this, we have to add some data to the local_machine record.

MCX identifies machines by the MAC layer address of their en0 interface - this is usually the built-in Ethernet port, but in the case of a MacBook Air, this is the AirPort interface. Here's a way in the command-line to get this info:

root# ifconfig en0 | awk ' /ether/ {print $2}'
00:1b:63:93:8b:ac

So the MAC layer address for this machine is 00:1b:63:93:8b:ac. We can add that to the local_machine record like this:

root# dscl . -create /Computers/local_machine \
ENetAddress 00:1b:63:93:8b:ac

Checking our work:

root# dscl . read /Computers/local_machine
AppleMetaNodeLocation: /Local/Default
ENetAddress: 00:1b:63:93:8b:ac
GeneratedUID: 15BEE70A-A32D-4A33-B740-93CBE95F75A4
RecordName: local_machine
RecordType: dsRecTypeStandard:Computers

Note that the GeneratedUID will vary, as it is created when you create the computer record in Workgroup Manager.

To actually take advantage of this, we'll need to write a script that runs on each machine that modifies the local_machine record with the MAC layer address of the current machine. Here's a very simple version:

#!/bin/sh
MAC=`ifconfig en0 | awk ' /ether/ {print $2}'`
dscl . -create /Computers/local_machine ENetAddress $MAC

This script gets the current MAC layer address and updates the local_machine record accordingly. You'd want to implement this script as one that ran during startup. You could do this as part of a StartupItem, or use launchd.

Pulling it together

Now you have a computer object that corresponds to the local machine, and management settings attached to Computer Groups. To implement these management settings on another machine or machines, you need to copy to each machine:

  • /var/db/dslocal/nodes/Default/computers/local_machine.plist

  • The appropriate plists from /var/db/dslocal/nodes/Default/Computer Groups

  • Your startup script that modifies the local_machine record.

Testing and Troubleshooting

While testing your new MCX settings, you'll want to be aware of tools available to you so you can see which MCX settings have been applied to your machines. The easiest tool to use in Leopard is System Profiler. Under the Software section is a new Managed Client category. You can use this to see what preferences are being managed, and their source.


In the illustration, we can see that com.apple.TimeMachine's preference "DoNotOfferNew-DisksForBackUp" is set to "1", that this is applied "often", and these settings come from membership in the "timemachine" Computer Group.

Another tool is available at the command line: mcxquery. Prior to 10.5.3, mcxquery did not display proper results when MCX records were in the local directory service, but it now behaves as expected.

mcxquery -user shortname

will show you the effective MCX settings for the user on the current machine.

Conclusion and additional thoughts

In this series of articles, we've looked at ways of using the local directory service to implement MCX settings. This would be useful for environments that don't have Open Directory, and cannot or will not do schema extension for Active Directory or third-party LDAP directory services. Mac administrators can also use these techniques as a proof-of-concept for MCX client management, using the local directory service implementation as a prototype for what benefits your organization would realize by extending the schema on its existing directory services.

There are certainly applications of this concept outside the management of enterprise workstations. Parents could use Workgroup Manager to manage their children's user account and capabilities - a sort of Parental Controls on steroids. In another application, the author used MCX records in the local directory service to lock down a Mac used as an iTunes jukebox. Since you are using local records, you can experiment with various settings and not worry that what you try will affect other machines on your network.

If nothing else, taking advantage of local MCX records should lower the entry bar to using Apple's client management system. If you haven't been using MCX in the past, there is no excuse not to at least try it now, and see how it can help you better manage Macs in your organization and give your users a consistent user experience.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

EtreCheck Pro 6.0.2 - For troubleshootin...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
BitTorrent 7.4.3 - Official client of th...
BitTorrent is a protocol for distributing files. It identifies content by URL and is designed to integrate seamlessly with the web. Its advantage over plain HTTP is that when multiple downloads of... Read more
Adobe Premiere Pro CC 2019 13.1.3 - Digi...
Premiere Pro CC 2019 is available as part of Adobe Creative Cloud for as little as $52.99/month. The price on display is a price for annual by-monthly plan for Adobe Premiere Pro only Adobe Premiere... Read more
ffWorks 1.3.1 - Convert multimedia files...
ffWorks, focused on simplicity, brings a fresh approach to the use of FFmpeg, allowing you to create ultra-high-quality movies without the need to write a single line of code on the command-line.... Read more
BetterTouchTool 3.134 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom)... Read more
TextMate 2.0.rc.28 - Code/markup editor...
TextMate is a versatile plain text editor with a unique and innovative feature set which caused it to win an Apple Design Award for Best Mac OS X Developer Tool in August 2006 A rapidly growing... Read more
BetterTouchTool 3.132 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom)... Read more
calibre 3.45.2 - Complete e-book library...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
calibre 3.45.2 - Complete e-book library...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
BetterTouchTool 3.132 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom)... Read more

Latest Forum Discussions

See All

TEPPEN guide - Tips and tricks for new p...
TEPPEN is a wild game that nobody asked for, but I’m sure glad it exists. Who would’ve thought that a CCG featuring Capcom characters could be so cool and weird? In case you’re not completely sure what TEPPEN is, make sure to check out our review... | Read more »
Dr. Mario World guide - Other games that...
We now live in a post-Dr. Mario World world, and I gotta say, things don’t feel too different. Nintendo continues to squirt out bad games on phones, causing all but the most stalwart fans of mobile games to question why they even bother... | Read more »
Strategy RPG Brown Dust introduces its b...
Epic turn-based RPG Brown Dust is set to turn 500 days old next week, and to celebrate, Neowiz has just unveiled its biggest and most exciting update yet, offering a host of new rewards, increased gacha rates, and a brand new feature that will... | Read more »
Dr. Mario World is yet another disappoin...
As soon as I booted up Dr. Mario World, I knew I wasn’t going to have fun with it. Nintendo’s record on phones thus far has been pretty spotty, with things trending downward as of late. [Read more] | Read more »
Retro Space Shooter P.3 is now available...
Shoot-em-ups tend to be a dime a dozen on the App Store, but every so often you come across one gem that aims to shake up the genre in a unique way. Developer Devjgame’s P.3 is the latest game seeking to do so this, working as a love letter to the... | Read more »
Void Tyrant guide - Guildins guide
I’ve still been putting a lot of time into Void Tyrant since it officially released last week, and it’s surprising how much stuff there is to uncover in such a simple-looking game. Just toray, I finished spending my Guildins on all available... | Read more »
Tactical RPG Brown Dust celebrates the s...
Neowiz is set to celebrate the summer by launching a 2-month long festival in its smash-hit RPG Brown Dust. The event kicks off today, and it’s divided into 4 parts, each of which will last two weeks. Brown Dust is all about collecting, upgrading,... | Read more »
Flappy Royale is an incredibly clever ta...
I spent the better part of my weekend playing Flappy Royale. I didn’t necessarily want to. I just felt like I had to. It’s a hypnotic experience that’s way too easy to just keep playing. | Read more »
Void Tyrant guide - General tips and tri...
Void Tyrant is a card-based dungeon-crawler that doesn’t fit in the mold of other games in the genre. Between the Blackjack-style combat and strange gear system alone, you’re left to your own devices to figure out how best to use everything to your... | Read more »
Webzen’s latest RPG First Hero is offici...
You might be busy sending your hulking Dark Knight into the midst of battle in Webzen’s other recent release: the long-anticipated MU Origin 2. But for something a little different, the South Korean publisher has launched First Hero. Released today... | Read more »

Price Scanner via MacPrices.net

Price drop! Clearance 12″ 1.2GHz Silver MacBo...
Amazon has dropped their price on the recently-discontinued 12″ 1.2GHz Silver MacBook to $849.99 shipped. That’s $450 off Apple’s original MSRP for this model, and it’s the cheapest price available... Read more
Apple’s 21″ 3.0GHz 4K iMac drops to only $936...
Abt Electronics has dropped their price on clearance, previous-generation 21″ 3.0GHz 4K iMacs to only $936 shipped. That’s $363 off Apple’s original MSRP, and it’s the cheapest price we’ve seen so... Read more
Amazon’s Prime Day savings on Apple 11″ iPad...
Amazon has new 2018 Apple 11″ iPad Pros in stock today and on sale for up to $250 off Apple’s MSRP as part of their Prime Day sale (but Prime membership is NOT required for these savings). These are... Read more
Prime Day Apple iPhone deal: $100 off all iPh...
Boost Mobile is offering Apple’s new 2018 iPhone Xr, iPhone Xs, and Xs Max for $100 off MSRP. Their discount reduces the cost of an Xs to $899 for the 64GB models and $999 for the 64GB Xs Max. Price... Read more
Clearance 13″ 2.3GHz Dual-Core MacBook Pros a...
Focus Camera has clearance 2017 13″ 2.3GHz/128GB non-Touch Bar Dual-Core MacBook Pros on sale for $169 off Apple’s original MSRP. Shipping is free. Focus charges sales tax for NY & NJ residents... Read more
Amazon Prime Day deal: 9.7″ Apple iPads for $...
Amazon is offering new 9.7″ WiFi iPads with Apple Pencil support for $80-$100 off MSRP as part of their Prime Day sale, starting at only $249. These are the same iPads found in Apple’s retail and... Read more
Amazon Prime Day deal: 10% (up to $20) off Ap...
Amazon is offering discounts on new 2019 Apple AirPods ranging up to $20 (10%) off MSRP as part of their Prime Day sales. Shipping is free: – AirPods with Charging Case: $144.99 $15 off MSRP –... Read more
Amazon Prime Day deal: $50-$80 off Apple Watc...
Amazon has Apple Watch Series 4 and Series 3 models on sale for $50-$80 off Apple’s MSRP as part of their Prime Day deals with prices starting at only $199. Choose Amazon as the seller rather than a... Read more
Amazon Prime Day deal: 50% discount on Apple...
Amazon has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $79.50 shipped as part of their early Prime Day deals. That’s a 50%... Read more
Abt drops prices on clearance 2018 MacBook Ai...
Abt Electronics has dropped prices on clearance 2018 13″ MacBook Airs by $201 with models now available starting at only $998. Shipping is free: – 13″ 1.6GHz/128GB MacBook Air (Space Gray, Silver, or... Read more

Jobs Board

Best Buy *Apple* Computing Master - Best Bu...
**710003BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Store Associates **Location Number:** 000171-Winchester Road-Store **Job Description:** Read more
Best Buy *Apple* Computing Master - Best Bu...
**709786BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Sales **Location Number:** 000430-Orange Park-Store **Job Description:** **What does a Read more
Geek Squad *Apple* Master Consultation Agen...
**709918BR** **Job Title:** Geek Squad Apple Master Consultation Agent **Job Category:** Services/Installation/Repair **Location Number:** 000106-Palmdale-Store Read more
*Apple* Systems Architect/Engineer, Vice Pre...
…its vision to be the world's most trusted financial group. **Summary:** Apple Systems Architect/Engineer with strong knowledge of products and services related to Read more
*Apple* Device Support - Kelly Services (Uni...
…including iPads, iPhones, iPods etc. You will be supporting and troubleshooting all Apple mobile devices in a corporate environment. If you are interested please Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.