APPLICATION NOTE Using Apple Remote Desktop to Deploy Centrify DirectControl Published: June 2007 Abstract Apple Remote Desktop is commonly used by administrators to perform various administrative management tasks on remote Mac systems, including remote controlling the system, gathering inventory, and installing software. Centrify DirectControl 3.0.3 and later is packaged to enable Apple Remote Desktop to deploy DirectControl to one or more remote Mac OS 10.4 systems through a few simple steps that are described in this application note. Contents 1 Introduction...1 1.1 Requirements... 2 2 Prepare the Package for Deployment... 3 2.1 Configuring the Package to Automatically Join Active Directory During Installation... 3 3 Deploying the Package to Remote Mac Systems... 3 4 Verifying the Installation Was Successful... 9 5 For More Information... 9 5.1 Legal Notices...10 1 Introduction Starting with the release of Centrify DirectControl 3.0.3 and later, customers have the ability to remotely deploy DirectControl to multiple Macintosh systems running Mac OS 10.4 throughout your network. Using Apple Remote Desktop 3 (commonly referred to as ARD), an administrator can install DirectControl automatically, without user intervention, to one or more remote computers. Apple Remote Desktop copies the package to the computers selected for installation, runs the installer with no visible window or user interaction required, and then erases the installer files on completion. This application note guides you through installation of the Centrify DirectControl software package using Apple Remote Desktop. 2007 CENTRIFY CORPORATION.ALL RIGHTS RESERVED. AN-009-2007-06-14
1.1 Requirements This application note was written based upon testing the following environment: A Macintosh running Apple Remote Desktop Admin software 3 and Mac OS 10.4 One or more Macintoshes running Mac OS 10.4 with Apple Remote Desktop 3 Client installed Centrify DirectControl 3.0.3 and above.dmg file (disk image file) Note. While Apple Remote Desktop may be able to deploy a DirectControl package to other older Mac systems, it has not been tested by Centrify. Before getting started: On your administrative Macintosh, verify that you are using Apple Remote Desktop Version 3. On all client Macintoshes where you want to install DirectControl, verify that you are using Apple Remote Desktop Client Version 3. Make sure these client Macintoshes are set to Allow Remote Desktop using the Sharing System Preference. Figure 1. The Macintosh Sharing System Preferences pane. You also need to ensure that each destination Mac system has a local account that will enable you to both connect to the remote system as well as to perform an installation of a package that requires Administrative privileges. The remainder of this Application Note 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 2
assumes that you have properly set up Apple Remote Desktop and established that you can connect to each destination system with the required Administrative privileges. 2 Prepare the Package for Deployment Centrify delivers DirectControl for Mac OS X in both a tgz package as well as a disk image (DMG) which contains a package (pkg) file that Apple Remote Desktop uses to install the software. To deploy the DirectControl package, you need to open the disk image to access the pkg file. 2.1 Configuring the Package to Automatically Join Active Directory During Installation Apple Remote Desktop can be used to simply install the package, which will then require you to manually run the Directory Access utility in order to configure DirectControl to join the computer to your Active Directory domain. You can also modify the DirectControl package so that it joins the Active Directory domain during the installation process. The steps below describe how to modify the package so that it runs adjoin as part of the installation process to join the Active Directory domain. Open the disk image and make a copy of the package file so that you can edit and save it for later distribution and installation. Open the package, right-click the pkg file, and select Show Package Contents. Browse to the Content/Resources folder and locate the file postinstall. First, make the file read/write/execute (it is shipped as read/execute only), and then open it for editing. Add a line at the end of the file as follows, substituting the variables with the appropriate values: /usr/sbin/adjoin --zone <zone_name> --user <AD user with computer join rights> --password <AD user s password> <AD Domain Name> Save the file and change it back to read/execute only. Now that we have a package file, either the original or the modified version that will autojoin, we can distribute the package to the remote systems. 3 Deploying the Package to Remote Mac Systems Make sure the appropriate Mac DMG file from the Centrify DirectControl distribution has been launched and mounted as a Disk Image and the contents are located where it can be accessed by your Macintosh running the Apple Remote Desktop Admin utility. For 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 3
example, make sure the file CentrifyDC-3.0.3-333-mac10.4-i386.dmg has been copied to your local administrative Macintosh and the CentrifyDC disk image is mounted. Figure 2. The Macintosh desktop with the CentrifyDC disk image mounted. On your administrative Macintosh, launch Apple Remote Desktop. Go to the Scanner control and verify that you are able to see a list of the Macs on which you wish to install DirectControl. Verify the Macintoshes have ARD Version 3 installed as indicated by the ARD Version column. Figure 3. Apple Remote Desktop Scanner screen. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 4
Multi-select (using Command-Click or Shift-Click) one or more Macintosh computers on which you want to install DirectControl. Figure 4. Selecting the Macintoshes on the network for remote installation. Click the Install button on the top of the Remote Desktop window. Figure 5. The Install button. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 5
After you click the Install button, the Install Packages window appears. Figure 6. The ARD Install Packages window. Click the + button at the top left of the Install Packages window to locate the CentrifyDC disk image. Figure 7. Adding packages to be installed with the + button. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 6
Locate the file CentrifyDC.pkg in the disk image. Figure 8. Choosing CentrifyDC.pkg to install Select this file and click Open to add it to the Install Packages List. There are many options in the Install Packages window. The default settings work well if you are manually joining the computers to the Active Directory domain. It isn t necessary to have the After Installation option set to restart the client Macintoshes after the.pkg installation; the Don t Restart option works fine. However, if you have configured the package to auto-join Active Directory during installation, you should restart the computer after installation. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 7
The other parameters are optional, and selecting them shouldn t interfere with proper installation of Centrify DirectControl. For more information on Apple Remote Desktop installation parameters, refer to the Apple Remote Desktop manual, Chapter 8, Administering Client Computers, section Installing Software Using Apple Remote Desktop. Figure 9. ARD Install Packages options. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 8
Click Install to perform a complete installation of Centrify DirectControl on the selected Macintoshes. Apple Remote Desktop shows a progress bar and task status of the installation for each of the Macintoshes selected for the installation. Figure 10. ARD Install Package progress task window. After Centrify DirectControl has been installed on the client Macintoshes, you can configure Centrify DirectControl, either remotely via SSH or manually at the client Macintoshes if you did not configure the package to auto-join the Active Directory domain. To manually join the Active Directory domain, follow the Centrify DirectControl configuration instructions in the Centrify DirectControl Administrator s Guide. 4 Verifying the Installation Was Successful You can verify that DirectControl has been installed and that the system has joined the Active Directory domain successfully by either checking Active Directory for the newly created computer account or by typing the following on the remote system to check the installation log: cat /var/log/install.log grep successfully joined After the computer restarts, you should be able to log in with a properly enabled Active Directory account for the Centrify Zone that the computer joined. 5 For More Information For the latest product information on DirectControl, check out our web site at: www.centrify.com/products 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 9
5.1 Legal Notices Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e- mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Centrify Corporation. Centrify may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Centrify, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 2007 Centrify Corporation. All rights reserved. Centrify is a registered trademark and DirectControl is a trademarks of Centrify Corporation in the United States and/or other countries. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 2007 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 10