TweetFollow Us on Twitter

MacEnterprise: Loco for Local MCX

Volume Number: 25 (2009)
Issue Number: 02
Column Tag: MacEnterprise

MacEnterprise: Loco for Local MCX

Using Apple's client-management settings on the Local machine. Following up on MCX

by Greg Neagle

Previously in MacTech...

In the November issue, we looked at getting started with MCX by using MCX records in the local directory service. We set some policies for the loginwindow using the Guest Computer object, verified they worked, and noted that the Accounts preference pane had certain controls grayed out to match our management settings.

Since local directory service entries in Leopard are simply plist files stored in /var/db/dslocal/nodes/Default, replicating MCX settings to multiple machines can be as simple as copying a few files.

Lod

Scalability and Modularity

If you are going to use the local directory service to store MCX data, you'll quickly discover that putting all your management settings into the Guest Computer object doesn't give you very much flexibility. If you want different groups of machines to have different management settings, you'll have to maintain multiple versions of /var/db/dslocalnodes/Default/computers/guest.plist, and mixing and matching management settings becomes tedious, as you'd have to create a version of the guest.plist for every needed combination of management settings.

A new feature of MCX in Leopard can help: Computer Groups. Prior to Leopard, MCX supported "Computer Lists", which were, unsurprisingly, lists of computers. Management settings could be applied to Computer Lists, which would then apply those settings to all computers in the list. The downside is that a given computer could be a member of only a single computer list at a time.

Leopard's new Computer Groups behave more like groups of users: a computer can be a member of multiple Computer Groups. This allows you to modularize your management settings. Create a Computer Group called "loginwindow" and apply all the loginwindow management to that Computer Group. Create another Computer Group called "screensaver" and apply your screensaver policies. If you want a machine to have both the "loginwindow" and "screensaver" policies, just add it to both Computer Groups. In this way, you can modularize your policy settings and mix and match them among machines. This approach even works if you are implementing MCX management in a traditional network directory environment.

Complications ensue

Perhaps now you're thinking, "Great! I'll create Computer Groups with my desired management settings, add the Guest Computer to each of those Computer Groups, and I'm all set!" Not so fast. There's a complication: even though Workgroup Manager allows you to add the Guest Computer account to a Computer Group, the MCX settings for the Computer Group are not applied to guest computers. So we'll need to use another way to take advantage of Computer Groups.

Use Workgroup Manager to connect to the local directory service as we did last time:


We will create a computer record that will represent the current local computer. Make sure you are working in the /Local/Default directory. Select the Computer accounts icon in the left pane, and click New Computer. Set the Name and Short Name to "local_machine", and click Save. You can leave all other fields empty.


You can now add this computer record to your Computer Groups:


We're not done yet - MCX still has no way to know that by "local_machine" you mean the current machine that this is running on. To do this, we have to add some data to the local_machine record.

MCX identifies machines by the MAC layer address of their en0 interface - this is usually the built-in Ethernet port, but in the case of a MacBook Air, this is the AirPort interface. Here's a way in the command-line to get this info:

root# ifconfig en0 | awk ' /ether/ {print $2}'
00:1b:63:93:8b:ac

So the MAC layer address for this machine is 00:1b:63:93:8b:ac. We can add that to the local_machine record like this:

root# dscl . -create /Computers/local_machine \
ENetAddress 00:1b:63:93:8b:ac

Checking our work:

root# dscl . read /Computers/local_machine
AppleMetaNodeLocation: /Local/Default
ENetAddress: 00:1b:63:93:8b:ac
GeneratedUID: 15BEE70A-A32D-4A33-B740-93CBE95F75A4
RecordName: local_machine
RecordType: dsRecTypeStandard:Computers

Note that the GeneratedUID will vary, as it is created when you create the computer record in Workgroup Manager.

To actually take advantage of this, we'll need to write a script that runs on each machine that modifies the local_machine record with the MAC layer address of the current machine. Here's a very simple version:

#!/bin/sh
MAC=`ifconfig en0 | awk ' /ether/ {print $2}'`
dscl . -create /Computers/local_machine ENetAddress $MAC

This script gets the current MAC layer address and updates the local_machine record accordingly. You'd want to implement this script as one that ran during startup. You could do this as part of a StartupItem, or use launchd.

Pulling it together

Now you have a computer object that corresponds to the local machine, and management settings attached to Computer Groups. To implement these management settings on another machine or machines, you need to copy to each machine:

  • /var/db/dslocal/nodes/Default/computers/local_machine.plist

  • The appropriate plists from /var/db/dslocal/nodes/Default/Computer Groups

  • Your startup script that modifies the local_machine record.

Testing and Troubleshooting

While testing your new MCX settings, you'll want to be aware of tools available to you so you can see which MCX settings have been applied to your machines. The easiest tool to use in Leopard is System Profiler. Under the Software section is a new Managed Client category. You can use this to see what preferences are being managed, and their source.


In the illustration, we can see that com.apple.TimeMachine's preference "DoNotOfferNew-DisksForBackUp" is set to "1", that this is applied "often", and these settings come from membership in the "timemachine" Computer Group.

Another tool is available at the command line: mcxquery. Prior to 10.5.3, mcxquery did not display proper results when MCX records were in the local directory service, but it now behaves as expected.

mcxquery -user shortname

will show you the effective MCX settings for the user on the current machine.

Conclusion and additional thoughts

In this series of articles, we've looked at ways of using the local directory service to implement MCX settings. This would be useful for environments that don't have Open Directory, and cannot or will not do schema extension for Active Directory or third-party LDAP directory services. Mac administrators can also use these techniques as a proof-of-concept for MCX client management, using the local directory service implementation as a prototype for what benefits your organization would realize by extending the schema on its existing directory services.

There are certainly applications of this concept outside the management of enterprise workstations. Parents could use Workgroup Manager to manage their children's user account and capabilities - a sort of Parental Controls on steroids. In another application, the author used MCX records in the local directory service to lock down a Mac used as an iTunes jukebox. Since you are using local records, you can experiment with various settings and not worry that what you try will affect other machines on your network.

If nothing else, taking advantage of local MCX records should lower the entry bar to using Apple's client management system. If you haven't been using MCX in the past, there is no excuse not to at least try it now, and see how it can help you better manage Macs in your organization and give your users a consistent user experience.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Smultron 10.0.2 - Easy-to-use, powerful...
Smultron 10 is an elegant and powerful text editor that is easy to use. You can use Smultron 10 to create or edit any text document. Everything from a web page, a note or a script to any single piece... Read more
Capto 1.2.5 - $29.99
Capto (was Voila) is an easy-to-use app that takes capturing, recording, video and image editing to the next level. With an intelligent file manager and quick sharing options, Capto is perfect for... Read more
Cocktail 11.0.1 - General maintenance an...
Cocktail is a general purpose utility for macOS that lets you clean, repair and optimize your Mac. It is a powerful digital toolset that helps hundreds of thousands of Mac users around the world get... Read more
Sketch 47.1 - Design app for UX/UI for i...
Sketch is an innovative and fresh look at vector drawing. Its intentionally minimalist design is based upon a drawing space of unlimited size and layers, free of palettes, panels, menus, windows, and... Read more
Slack 2.8.2 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.8.2: A small release containing nothing but another Electron... Read more
Path Finder 7.6.1 - Powerful, award-winn...
Path Finder makes you a master of file management. Take full control over your file system. Save your time: compare and synchronize folders, view hidden files, use Dual Pane and full keyboard... Read more
Sketch 47.1 - Design app for UX/UI for i...
Sketch is an innovative and fresh look at vector drawing. Its intentionally minimalist design is based upon a drawing space of unlimited size and layers, free of palettes, panels, menus, windows, and... Read more
Cocktail 11.0.1 - General maintenance an...
Cocktail is a general purpose utility for macOS that lets you clean, repair and optimize your Mac. It is a powerful digital toolset that helps hundreds of thousands of Mac users around the world get... Read more
Path Finder 7.6.1 - Powerful, award-winn...
Path Finder makes you a master of file management. Take full control over your file system. Save your time: compare and synchronize folders, view hidden files, use Dual Pane and full keyboard... Read more
Slack 2.8.2 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.8.2: A small release containing nothing but another Electron... Read more

Dune! guide - how to toe the line and ge...
Publisher Voodoo is at it again with an all new high score chaser -- Dune! In this fast-paced arcade game, you have to propel yourself along sand dunes, gaining enough momentum to jump above the line to score points, while making sure you have... | Read more »
The best deals on the App Store this wee...
Happy Tuesday, dear readers. Your favorite part of the week as officially arrived. It's time to take a look at the best deals in games. Things are admittedly a bit sparse, but there are a few diamonds in the rough to see you through if you're... | Read more »
Be the last person standing in Legacy of...
Yoozoo Games’ popular action MMO Legacy of Discord is getting a huge new update to celebrate its first anniversary. Perhaps the biggest change is the addition of an exciting survival mode titled Last Guardian. This new survival mode will pit you... | Read more »
Home Street guide - how to make friends...
From the creators of Food Street comes Home Street, a new simulation game that tasks you with building a social network and designing a beautiful home. It's a bit like The Sims, but you won't have to worry about the daily chores involved (feeding,... | Read more »
Color Ballz guide - how to bounce to the...
Color Ballz is an addictive new arcade title from Ketchapp Studios. It takes old school mechanics from games like Brickles and puts a fun twist on it. Your job? To catch balls with a paddle and send them back into a chute to be carried back to... | Read more »
Q&A: A-33 Studio explains why Combat...
When it comes to mobile FPS, it’s often tricky to get the fundamentals right on a platform lacking a physical controller, large display and hefty RAM. With Combat Squad: Project Wednesday, A-33 Studio bravely took on the challenge of making a... | Read more »
Taichi Panda 3: Dragon Hunter guide - ti...
Taichi Panda 3: Dragon Hunter launched this week to players all over the world. It's a beautiful mobile MMORPG that blends elements of Eastern and Western fantasy. It reminds us of a mix between World of Warcraft and Jade Empire. MMO's can have a... | Read more »
The best new games we played this week -...
Phew. It has been a week, but now it's time to relax, put your feet up, and enjoy some brand new mobile games. It was a bit of slow week, but there's still plenty of new titles to add to your collection. Here are four of our favorites. [Read... | Read more »
Yoink - Improved Drag and Drop (Product...
Yoink - Improved Drag and Drop 1.0 Device: iOS Universal Category: Productivity Price: $2.99, Version: 1.0 (iTunes) Description: Yoink for iPad and iPhone lets you easily and quickly store items you drag, copy or share, for later use... | Read more »
Cottage Garden (Games)
Cottage Garden 1.11 Device: iOS Universal Category: Games Price: $4.99, Version: 1.11 (iTunes) Description: | Read more »

Price Scanner via MacPrices.net

13″ MacBook Pros on sale for up to $120 off M...
B&H Photo has 2017 13″ MacBook Pros in stock today and on sale for up to $120 off MSRP, each including free shipping plus NY & NJ sales tax only: – 13-inch 2.3GHz/128GB Space Gray MacBook... Read more
15″ MacBook Pros on sale for up to $200 off M...
B&H Photo has 15″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax in NY & NJ only: – 15″ 2.8GHz MacBook Pro Space Gray (MPTR2LL/A): $2249, $150... Read more
Roundup of Apple Certified Refurbished iMacs,...
Apple has a full line of Certified Refurbished 2017 21″ and 27″ iMacs available starting at $1019 and ranging up to $350 off original MSRP. Apple’s one-year warranty is standard, and shipping is free... Read more
Sale! 27″ 3.8GHz 5K iMac for $2098, save $201...
Amazon has the 27″ 3.8GHz 5K iMac (MNED2LL/A) on sale today for $2098 including free shipping. Their price is $201 off MSRP, and it’s the lowest price available for this model (Apple’s $1949... Read more
Sale! 10″ Apple WiFi iPad Pros for up to $100...
B&H Photo has 10.5″ WiFi iPad Pros in stock today and on sale for $50-$100 off MSRP. Each iPad includes free shipping, and B&H charges sales tax in NY & NJ only: – 10.5″ 64GB iPad Pro: $... Read more
Apple iMacs on sale for up to $130 off MSRP w...
B&H Photo has 21-inch and 27-inch iMacs in stock and on sale for up to $130 off MSRP including free shipping. B&H charges sales tax in NY & NJ only: – 27″ 3.8GHz iMac (MNED2LL/A): $2179 $... Read more
2017 3.5GHz 6-Core Mac Pro on sale for $2799,...
B&H Photo has the 2017 3.5GHz 6-Core Mac Pro (MD878LL/A) on sale today for $2799 including free shipping plus NY & NJ sales tax only . Their price is $200 off MSRP. Read more
12″ 1.2GHz Space Gray MacBook on sale for $11...
Amazon has the 2017 12″ 1.2GHz Space Gray Retina MacBook on sale for $100 off MSRP. Shipping is free: 12″ 1.2GHz Space Gray MacBook: $1199.99 $100 off MSRP Read more
Bare Bones Software Releases macOS High Sierr...
Bare Bones Software has announced the release and immediate availability of BBEdit 12.0, a significant upgrade to its professional strength text and code editor. BBEdit 12 introduces a new foundation... Read more
Yale Announces Availability of Apple HomeKit-...
Yale Locks & Hardware has announced that Apple HomeKit support for its Assure Lock family is available this month. The new Yale iM1 Network Module, which provides support for the Apple Home app... Read more

Jobs Board

Fraud Analyst, *Apple* Advertising Platform...
Job Summary Apple Ad Platforms has an opportunity to redefine advertising on mobile devices. Apple reaches hundreds of millions of iPhone, iPod touch, and iPad Read more
*Apple* Information Security - Security Data...
Job Summary This role is responsible for helping to strengthen Apple 's information security posture through the identification and curation of security event data. Read more
Lead *Apple* Solution Consultant - Apple In...
…develop a team of diverse partner employees focusing on excellence to deliver the Apple story. Even when you're not present, you will maintain a consistent influence Read more
watchOS Frameworks Engineering Manager, *App...
Job Summary Join the team that is shaping the future of software development for Apple Watch! Apple is looking for an exceptional software engineering leader to Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.