Questions & Answers from the Webcast: Integrating the Mac into a Windows Infrastructure - 5 Case Studies. Sponsors: Atempo. Centrify.

Transcription

1 Questions & Answers from the Webcast: Integrating the Mac into a Windows Infrastructure - 5 Case Studies Sponsors: Atempo Centrify GroupLogic LANrev Parallels June 5, 2009 Contents Compilation of the questions asked by attendees of the webcast and answered by the panelists. Also includes the results of polls conducted during the presentation. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of EDA.

2 The webcast: Integrating the Mac into a Windows Infrastructure - 5 Case Studies The presentation was webcast on June 2, An on demand version of the webcast is available at integratingmac.html This document includes questions that were submitted by the attendees during the webcast and the answers provided by the panelists at the time or subsequent to the webcast. It does NOT include answers to the questions that the panelists responded to during the Q&A session during the webcast. It also includes the results of three polling questions asked during the session. Comments on the Q & A Session Many members of the audience were adept at dealing with sophisticated environments and their questions reflected that depth of skill. Others were relatively new to the possibilities. Regardless of your skill set, we urge you to visit the Enterprise Desktop Alliance Resource Center. It contains many documents, videos and information sources, as well links to documents and resources on the members home sites. If your questions are not answered through those means we ll would be glad to talk to you about your challenges integrating the Mac. Contact us Atempo Enterprise Data Protection info.us@atempo.com Centrify Identity & Access Management info@centrify.com Group Logic File & Print Services info@grouplogic.com LANrev Systems Lifecycle Management info@lanrev.com Parallels Virtualization EDA. ALL RIGHTS RESERVED PAGE 2

3 Questions and Answers: 1. Responses by company: Atempo Question This section lists each question grouped by the company to which they were directed. We ve indicated the questioner by their initials to help them identify the question they asked. Q: How does Atempo handle full disk encryption with CheckPoint/Point Sec, PGP and/or WinMagic? Other options for FDE? Answer A: We are a certified CheckPoint OPSEC partner and fully support Pointsec for PC/Mac. We support PGP. We support WinMagic in FDE mode except special steps may be needed for Bare metal Recovery. In general we support FDE, backups Unencrypted. BW RS SH SH SH Q: How does Atempo Live Backup compare to Restrospect 8? Q: Please describe the "CDP" methodology. Q: Does Atempo backup complete files that have changed or can it accommodate block level changes in files? Q: Can Atempo synchronize data between 2 volumes? Q: Or Offsite as in my RAID here get synchronized to my DR site A: Retrospect is a traditional (schedule based) app so the protection style is quite different and of course the recovery UI is quite different (we would say "better") and we are designed to accommodate very large numbers of systems (2500 is no problem) A: Continuous Data Protection We track open file handles and watch for them to close. We also have special file based OFM for certain files such as Outlook PSTs. A: We support block level incremental backup, absolutely A: Afraid not, we don't touch the local storage of protected clients. Effectively we are synchronizing to a remote file system (embedded in a SQL database in our case) A: We could replicate our storage to a remote site. I don't know that it would be useful for failover purposes But as an offsite replica it is pretty straightforward. Since we are SQL2005 based, we can take advantage of tools designed for replication. HA/failover may be a bit complex because of our architecture, but it is something we would investiage in professional services if it was a req. for a particular customer 2009 EDA. ALL RIGHTS RESERVED PAGE 3

4 AH SH SH MK CK EA BG Q: Time Machine tends to have problems with FileVault users and if they are logged it claims that it cannot back it up. Does Atempo handle FileVault users and back them up if they are logged in? Q: Are the Atempo backups encrypted? Q: Can Atempo communicate with VM based servers such as VMware? We are looking to consolidate a Backup strategy for 60% Mac 30% PC 10% VMware Servers. Q: Can LiveBackup perform a bandwidth test and only utilize a predefined amount? Q: Atempo backup solution support PC too? Q: How does Atempo handle backing up large, continuously changing files, such as the Entourage database or a VMware virtual machine? Q: Can you compare Atempo to CrashPlan PRO Server Q: Where are Atempo backup locations?? USA? Europe?? Q: Atempo, do you have a solution that will work will with an MSP (Managed Service Provider)? A: FileVault uses banded sparsebundles and this is a problem currently for LB, one we intend to fix in a maintenance release. We do NOT have similar problems with NTFS EFS on the MS side. The problem is they are runtime mounted, which makes them look removable, and LB is taught to ignore removable volumes. But it is something we can fix, as I mentioned. A: They are encrypted when in motion. At rest they also can be, if that's what you want. We can use any CryptoAPI provider installed on the LiveBackup server A: Yes absolutely A: It does so dynamically yes A: Windows 2000, XP, and Vista (and soon, Windows 7) A: We include special OFM handling for some files that are open continuously, like PSTs. VMDK files are not included in that and we would not back them up when the VM is running. A: Atempo LiveBackup is proven technology with 10+ years in the field and experience with enterprise class customers across verticals. We deliver a more scalable, flexible, and dependable solution. A: We are a pure software vendor; we partner with other companies that can deliver Live Backup as a managed service 2009 EDA. ALL RIGHTS RESERVED PAGE 4

5 Centrify Question Q: What is required on the Mac for Centrify to be used? Is there client software? What about security concerns of end user with admins having privileges? Can they tell who all has what access? What about privacy of end user data? Answer A: Centrify provides an agent that installs on the Mac which enables the integration with AD. User Privileges can be controlled based on user account to provide the security that is required. Group Policy can control the sudoers file as well as the local Admins group membership to ensure that network Admins gain appropriate privileges. Centralized identity and Access management can be reported to show which user has specific privileges. WL KL BF DC WL Q: How does Centrify work with Apple's OSX AD Plugin? Q: Does Centrify have a policy to enforce what users are and are not in the Administrator group? Q: Can you explain a bit more how Centrify allowed Mac users to access SharePoint via SSO? Q: Centrify: Work okay with FDE solutions (i.e. CheckPoint/PointSec, PGP and/or WinMagic)? Q: Does the single signon work for Lotus? Q: Will Centrify require AD Schema change? A: Centrify DirectControl replaces the OS X AD plugin since we implement all the functionality required to properly integrate with Active Directory. In addition, by using the Centrify Agent, you are then able to use Group Policy to enforce security policies equal to those on the PC, as well as those that you would use with Workgroup Manager. A: Yes, Centrify can add AD users to the membership of the local Admin group, and to exclude those who should not have admin privileges. A: Centrify DirectControl provides a Kerberos environment that enables the Mac to access Windows Integrated Applications such as Exchange and Sharepoint without requiring userid and password = SSO. A: We have customers using these FDE products and have not heard of any coexistence issues. A: We have not tried SSO to Lotus Notes, however if SSO is supported from Windows computers, then it should be possible, we'd be happy to provide an eval and test it at your site. A: No Schema Changes Required EDA. ALL RIGHTS RESERVED PAGE 5

6 SM JB AV DS JM JV SH AV CG Q: We use Centrify but Mac users will send their computer to Apple store and have them redo their computer, how/can you stop this from happening, other than firing the employee. :) Q: Will Centrify map more than one drive to a user? Q: Does Centrify preclude use of ARD or can they co exist? Q: Is there server side software required to run Centrify or is it client only? Q: Do you plan to recognize Apple AD schema extensions with your plugin at some point? Q: Does Centrify allow you to control which Mac clients get what updates (like WSUS) or is it just a re direction to a local update store (like Mac Server's Software Update application)? Q: Are there any management aspect that can't be leveraged to Macs that can be utilized on PC's? Q: What is the cost model for Education / Enterprise? Q: What does Centrify do to streamline Entourage configuration? Q: Our biggest pain point to use Mac in out org is Entourage (Apple Mail, ical does not work with users) The Parallels and VMware solution does not help A: You would simply need to install and join to AD again, just need a way to prevent access to internal services until it is joined to AD. If you use a full disk encryption solution there would be no way for the Apple tech to get in and reboot in single user mode unless of course the employee helps them out. Sounds like a personnel policy issue, not an AD one. A: Sure, This can be done with a login script A: We have tested coexistence with Apple Remote Desktop and typically use it to deploy Centrify DirectControl where the admin has ARD installed. A: No, Centrify does not require any Servers or Changes to AD. A: We are not planning to support other AD extensions, but would like to understand what you need that we cannot provide A: We are controlling the setting on the Mac that enables us to redirect the Update to a local update store, this can be controlled via Group Policy application to different OUs. A: There are several different settings for both Windows and Mac, so we've created independent sets of Group Policies to make it clear which apply to the Mac vs. Windows. A: Centrify sells DirectControl on a per workstation basis with discounts applied based on quantity of systems, we'd be happy to talk more about a quote specific for your needs A: Using DirectControl joined to Active Directory the first time launch of Entourage simply asks the user for login name and confirms the mailbox to setup the environment properly. A: We have found that Entourage 2008 operates properly with Exchange and supports SSO using the current user Kerberos credentials once joined into Active Directory 2009 EDA. ALL RIGHTS RESERVED PAGE 6

7 CC DR KST NS RC RM CS from cost and performance. What are my alternatives? Q: We're debating purchasing a Mac OS X Server vs software to handle the integration. Is there an advantage of using software over the server? Q: The Mac built in authentication plugins allow you to auth. to AD first and, failing that, fall back to OD, then local passwords. Does the Centrify AD replacement allow this too? Q: The entourage is useful but not for Mail savvy org like ours. Q: Is there a way to query what Centrified group policies are set from a Mac OS X client (something along the line of dscl or mcxquery)? Q: Does Centrify handle all of the same policies as a native OD server? Q: Does Centrify allow AD credentials to be passed within Safari, Firefox and QuickTime sessions through an ISA proxy environment? Q: Does anyone have experience using Macs in a Windows environment while also using Novell with login scripts to map to network drives? Q: Will this also let you use AD to authenticate to an apple server? A: The biggest advantage is that you can leverage the existing AD environment and servers as well as the administrators and administrative processes within your helpdesk by integrating into Active Directory vs. setting up OS X Open Directory. A: yes, this is provided as a function of how Unix systems manage the authentication process, which the Mac leverages internally. It will try AD authentication and then pass thru to other configured Directory Services A: I certainly hope that Apple updates ical and Address Book to talk to Exchange like the iphone/ipod, I currently use Entourage for Calendar and Mail for . A: You can see this by looking at the gp.report that is periodically updated on the system as Group Policy executes. You can find this file in the /var/centrifydc/reg directory under either the machine for the computer policies or users/username for each user who has logged in. A: Centrify provides the vast majority that are present within Workgroup Manager and continue to add to our set of GPs based on customer feedback. We currently have over 180 Group Policies for the Mac. A: Safari and Firefox both support SPNEGO for Kerberos based user authentication, which should work to an ISA server. Our login scripts can be used to mount any afp or smb drive onto the Mac. Yes, provided our software is installed on both the client and server. Centrify Agent software also supports Apple Servers and 180 other flavors of UNIX / Linux including VMware and other hypervisors EDA. ALL RIGHTS RESERVED PAGE 7

8 JC Q: we have an issue syncing our Mac account passwords with the pc accounts We solve all those problems by using the PC passwords for the Mac users. With the Centrify Agent, the users only need one password Group Logic BG Question Q: How do these types of services deal with the.ds_store files going from the Mac to the Windows servers? Answer A: I will assume your.ds_store question refers to ExtremeZ IP. ExtremeZ IP does not stop the client from creating.ds_store files. We found a bug where some versions of Mac OS X would issue millions of attempts to create them if the first attempt failed. RS JM Q: How does ExtremeZ IP integrate with a SAN environment (NetApp for example)? Q: Does that mean leveraging Portable homes without an OS X server in the environment? A: ExtremeZ IP fully supports servers connected to a SAN. In the NetApp case it is usually using the "Unified Storage" feature. Group Logic Using Centrify and ExtremeZ IP you can provide AFP based portable home directories. Those home directories can even be DFS targets if you want. The setup is not particularly involved but we expect to have a white paper on the EDA site about it soon. Centrify If you are constrained to SMB, you can also configure Portable Home Directories to be synchronized to a Windows SMB Server. LANrev Question Q: LANrev any issues with clients using full disk encryption? Tools such as CheckPoint/PointSec, PGP and/or WinMagic. Answer A: No. LANrev should work fine once you've authenticated against the full disk encryption product and the OS has loaded. Obviously it cannot manage clients before this. KL Q: Does LANrev have a self service software provisioning portal where an end user can install software from the "portal" himself? A: Yes. The current release includes support for self service/on demand software installation. The end user needs to go into the agent preference pane/control panel to bring up the list of available software packages that can be installed EDA. ALL RIGHTS RESERVED PAGE 8

9 SH SH BW PB JA Q: LANrev : Can I predefine a set for deployment for example based on MAC address so the machines can ship direct to end users? when they 'N' boot they will get the predefined image etc? or am I off track in this question. Q: LANrev : Can users reimage offline i.e a locally cached recovery partition? Q: How does LANrev do installation on the Mac, I currently use Netboot to do image install, how does your product differ. Q: What does LANrev offer in the way of system imaging/app package deployment over free solutions such as InstaDMG/DeployStudio? Q: Can LANrev remote control PCs and Macs, or do you still need ARD? Can you use ARD with LANrev? A: Yes. You can create a smart group based on MAC address in advance and assign a Reinstall Command to it to reimage these Macs. It's not something I've seen our customers do but it should work. A: If it's triggered by the end user, not at this time. If it's triggered by the server, then yes. You can reimage from a locally cached recovery partition but end users cannot trigger this because a reimaging operation has to be triggered by the LANrev server. If you your LANrev server is Internet accessible then you can trigger it over the Internet since the disk image is hosted on the local machine in another partition. A: LANrev can reimage your startup volume without having to NetBoot. LANrev also includes provisions for migrating a Mac from one OS to another, like from 10.4 to 10.5 including preserving home folders, local user accounts, and network settings. There are options for preserving user home folders, local user accounts, and network settings A: The default mode is non destructive disk imaging so we do not remove the existing OS until you successfully boot into the new OS. Also we can replace your startup volume while you're booted up into it. No need to boot from an alternative volume. You do not need a NetBoot server with LANrev. LANrev also includes provisions for migrating a Mac from one OS to another, like from 10.4 to 10.5 including preserving home folders, local user accounts, and network settings. A: LANrev does not provide the remote control application but it will integrate with the major ones such as Mac OS X Screen sharing, ARD, Timbuktu, and VNC. If you do not have ARD then I would suggest using the integration with the built in Mac OS X Screen sharing app, even though it might not have as many features as the full ARD EDA. ALL RIGHTS RESERVED PAGE 9

10 Parallels Question Answer CM Q: Does Parallels have plans on making a version that can run on an Xserve bare metal? A: A bare metal version for the Xserve is on the road map. It is dependant on Apple agreeing to it. JB JK GS EA BP Q: I only see Parallels running XP, does it work with Vista or Windows 7? Q: Have any Parallels customers successfully used PXE booting to install Windows onto the boot camp partition (not using a hard disk file)? Q: Is it possible to install Windows XP from a network drive on Parallels? Q: What kind of version of Mac do you need for Parallel to work Q: for Parallels. How do your customers handle deployment of the virtual machine(s) to all the Macs? A: Parallels does run multiple versions of Linux as well as Vista and Windows 7 A: You cannot use Parallels to install Windows onto a bootcamp partition. Parallels only accesses the bootcamp partition after it has been created. Yes. You can either install from an ISO image stored on a network drive, or you can PXE boot a VM with a blank hard drive and install Windows remotely. Parallels will install on any Intel based Mac with a processor of 1.66 GHz or greater. Deployment is very scalable. From just a handful of Macs to hundreds, Parallels makes it simple. Since the virtual Windows environment is just a file, it can be easily moved to the target Macs over the network or even from an external drive or DVD. If you have management software such as LANrev or ARD, this document will walk you through the process. ocs/en/mass_deployment_of_parallels_desk top.pdf General Question JL Q: curious if any of you provide a means to host Mac sessions to windows desktops in an xwindows/term server/citrix sorta way Answer A: you can just use a VNC viewer on Windows to remotely see a Mac desktop that is running Apple Remote Desktop 2009 EDA. ALL RIGHTS RESERVED PAGE 10

11 Webcast Polling Questions It seems like it will make the Macs look more expensive. 6% What is the biggest impediment to getting Macs integrated with Windows in your organization? We don't see the need. 0% The integration technology doesn't seem right for us. 11% Other 8% Windows administrators don't want to deal with them. 40% Mac people don't want the Windows people controlling them. 14% 244 Responses During Webcast June 2, 09 The Macs are already integrated in our organization. 21% In reponse to the option to answer Other the respondents wrote: JC Enabling Kerberos (SSO) on our Mac servers and services Our biggest challenges are file and print integration, as well as preference and patch JV management CB Keeping the Macs connected to the domain KL Ease of deployment and policy enforcement in our current AD infrastructure. JL General ignorance of the platform. AT Lack of funds to implement a management suite. We are currently integrating Macs in our windows environment, looking for better ways JF of doing so. We have issues binding the Macs to an active directory environment and keeping them RC bound to active directory We don't have the technology to do so. ES Active directory integration more info: we have a Windows Active Directory system in place and need to be on that JC realm...not an OD realm 2009 EDA. ALL RIGHTS RESERVED PAGE 11

12 JA RH MK JM RC PM TG Have AD, and LANDesk. Need solution to manage Macs as well as Windows PCs. I'm a total "newbie" to this area Application compatibility the integration does not seem right for us We have issues binding the Macs to an active directory environment and keeping them bound to active directory Macs are not windows machines people want to manage them differently. Some of our difficulty is the amount of labor it takes to meet many of the federal security requirements and having to constantly re engineer solutions Compliance The auditors said so for compliance requirements., 4% If you have to integrate Macs with Windows, what is the number one reason? Other, 6% Savings To save money on hardware and software, or to save admin time., 6% Alleviate Workload Offload some management tasks, reduct trouble tickets, and to eliminate duplicate efforts., 16% Security to protect data and control access to the systems., 19% User Productivity any of these: file sharing, workflow, access to Windows apps, 48% 222 Responses During Webcast June 2, 09 WH PM RH RJ AB ML SM JL to provide choice to our users CIO wanted MAC's in our environment I'm sometimes called upon to sort out the problems that were self created by the inhouse (Windows) IT staff and I'm guessing most of the time All the above... Our Art Department refuses to use the corporate standard PC so we are forced to integrate a new generation of MAC machines into our AD. Allow users to choose. Users want freedom to do what they want when they want and how they want. With MACS they do. Reference polling question. Our call center requires supporting products written for the mac. sox and pci compliance requires us to integrate them into our secure services EDA. ALL RIGHTS RESERVED PAGE 12

13 What would you like to hear more about? An in depth case history, 20% Other, 6% Deep technology dives on the solutions, 51% More ROI/TCO information, 26% Interoperability between Enterprise Desktop Alliance member company solutions, 37% JC AS We have an existing Magic Triangle setup with our existing Mac servers, however SSO/Kerberos is not working. What steps are needed to accomplish this (as specific as possible)? More information on Security products such as hardware based encrypted drives and Information protection solutions similar to what Digital Guardian provides on the windows platform. I'd like to see full/more indepth case studies regarding the integration of macs into an MS environment. Need true IT integration tech presentation. Specifically, how does it work? For example, it uses AD and GPO's... great! How? It would have been great to get more in depth details as to how the solutions work and what that experience is like for the customers. Would really like to see something on integration - how to deploy and manage Macs that are running Windows in Parallels, for example. Backup needs of graphic and video professionals with very large files. Actually, my interest is the opposite. I need to integrate Windows into my Mac Server Infrastructure better EDA. ALL RIGHTS RESERVED PAGE 13

14 About the Enterprise Desktop Alliance The Enterprise Desktop Alliance represents an essential suite of solutions that make it easy to deploy, integrate and manage Macs in a Windows based management environment. The Enterprise Desktop Alliance (EDA) is a collaboration among enterprise class software developers to make it easy to deploy, integrate and manage Macs in a sophisticated Windows managed IT environment. By leveraging the suite of capabilities that EDA offers, an enterprise can easily achieve the same level of control, security, policy compliance, data protection and services that they exercise across Windows platforms. The cross platform solutions available address: Enterprise data Protection Atempo, Identity & Access Management Centrify, File & Print Services GroupLogic, Client Management LANrev, and Virtualization Parallels. For more information, visit EDA. ALL RIGHTS RESERVED PAGE 14