[olePigeon]

At my work I get all sorts of technology brochures (spam) but I sometimes hold onto the Apple brochures because they're usually really nicely done (I have one that's practically a book of nice B&W portraits of people using various Apple products, good for art class) However, this recent one caught my eye simply because of what they're advertising.

Apple's finally doing the right kind of advertising to schools. This is their new "Rethink" campaign:

Apple - Education - Rethink

The post card is a 4 page flipout with 2 registration cards that you can send out for white page studies on TCO, efficiency, and compatibility. It directly covers the whole running Windows on top of OS X and talks up about being the best of both worlds; Macintosh and Windows. It mentions specifically about Macs integrating into existing ActiveDirectory networks and Windows infrastructures.

Really smooth. I bet they'll pick back up a few schools who dropped off.

This is the kind of advertising Apple's needed to do for a long time. They're driving the message home that Windows is pretty much here to stay, but if you get a Mac, you're not going to be left out in the cold. You can enjoy all the benefits of Macintosh as well as tolerate everything you may need Windows for; all in one package.

[angelmb]

Thanks, can't download the free white paper since I am not from the US :-/

[olePigeon]

See if this works:

http://education.apple.com/contact_m...nEducation.pdf

[brassplayersrock²]

*takes a piece of white paper out of the printer* hmm, and i didn't even have to type anything for a free piece of white paper
seriously though, Berklee is pretty much leading the college scene onto the right track with giving all entering students a new apple portable, and because of our success in doing so, many other colleges in the area got on board as well. good times


Alex

[besson3c]

There are a lot of students on campus with Macs here, but Apple's enterprise support and software for those who have to deploy Mac labs and integrate Macs in with the rest of the University and its services remains quite poor.

If Apple really wants to nail education, they need to step up to the plate in offering enterprise solutions, and large Universities/Colleges are indeed considered enterprise.

[olePigeon]

Originally Posted by besson3c 

There are a lot of students on campus with Macs here, but Apple's enterprise support and software for those who have to deploy Mac labs and integrate Macs in with the rest of the University and its services remains quite poor.

Define poor?

[brassplayersrock²]

besson3c: actually, if you ever get a chance to, come over to Berklee and I'll show you our all Mac labs that Apple has helped set up. All full of iMacs, and some towers, and if we have a problem Apple helps us out personally.

also, we have a classroom that's in a separate building stock full of iMacs (and other computer goodies) for computer classes.

true the setups we have here are probably rare in any school right now, but I'm feeling that the OP has a good point. If this is Apples new way of getting into the classroom, then more and more places will have what we at Berklee have.


Alex

[olePigeon]

Apple has improved their enterprise support. You can buy support plans that are as quick as 1 hour 24/7 onsite support (depending on location.) Their standard support plan includes 4 hour onsite support. Apple's servers are also one of the most price competitive servers on the market. For $3000 you get a dual Xeon 1U XServe with Unlimited Client license OS X Server with no client license fees like Microsoft. Dells dual CPU Xeon servers start at over $4000. Unlimited Client server already makes it tens of thousands of dollars cheaper than any Microsoft solution. The fact that there aren't any client licenses makes Apple's offerings infinitely cheaper than anything from Microsoft.

The only area where Apple really needs to improve on in terms of servers is Terminal Services. NetBoot just isn't there yet and is extremely network intensive. Microsoft does offer a nice Terminal Server, albeit unbelievably expensive.

[olePigeon]

On a side note, Apple XServers are so much better built than Dell PowerEdge. There's a thread someplace on here about my dealing with Dell PowerEdge servers. Having aluminum trays in the XServe is a luxury. Stupid PowerEdge server's plastic sleds break. Pieces of sh*t.

[brassplayersrock²]

Originally Posted by olePigeon 

Apple has improved their enterprise support. You can buy support plans that are as quick as 1 hour 24/7 onsite support (depending on location.)

you sure can (as said in my post, but not so information driven as yours )

alex

[besson3c]

Originally Posted by olePigeon 

Define poor?

As in, they have been utterly clueless in helping with anything that goes outside of their point and click interface, which for complicated environments is very much required in getting things involving authentication and authorization to work properly. Their point upgrades have broken things without warning (such as when they decided to require SSL support within their OpenLDAP implementation), and their ADS/Directory Services plug is closed, meaning the whole setup is a combination of Microsoft's closed ADS (which is based on OpenLDAP and Kerberos), OpenLDAP (which is completely open), and Apple voodoo. This makes tracing data exchange difficult, and forces a reliance on Apple and severs getting support from the general LDAP community given these variables Apple introduces.

Since Apple wants you to pony up for more OS X Server licenses, I get the sense that they haven't been terribly helpful with helping administrators migrate away from having to authenticate against an OS X Server OpenLDAP server rather than authenticating directly to ADS and having UIDs mapped - a feature made possible within Windows Server 2003 and its Unix Services doohickey.

I also came from a smaller department run by a guy who used to be team lead on the University's larger Mac team, and he struggled with OS X specific OpenLDAP issues all the time. It's nice that Apple tried to make OpenLDAP easier since it can be quite a challenge, but their support also needs to be highly knowledgeable of the inner workings of LDAP, not just knowing what checkboxes to check off in the GUI.

Some of this info might be slightly inaccurate, but you get the idea...

[besson3c]

Originally Posted by brassplayersrock 

besson3c: actually, if you ever get a chance to, come over to Berklee and I'll show you our all Mac labs that Apple has helped set up. All full of iMacs, and some towers, and if we have a problem Apple helps us out personally.

also, we have a classroom that's in a separate building stock full of iMacs (and other computer goodies) for computer classes.

true the setups we have here are probably rare in any school right now, but I'm feeling that the OP has a good point. If this is Apples new way of getting into the classroom, then more and more places will have what we at Berklee have.


Alex

Creating software builds for labs is not a problem, it's the authentication and authorization required in working within a larger environment.

[olePigeon]

Originally Posted by besson3c 

Creating software builds for labs is not a problem, it's the authentication and authorization required in working within a larger environment.

We have iBooks authenticating directly to the ActiveDirectory server here at my school/work. The only problem we've encountered is the Keychain. It doesn't understand that the system password has changed when it's changed over the network. Having an OS X Server as the intermediary between the iBooks and the ADS fixes that problem, however, we don't have an OS X Server so they have to deal with resetting their keychain every 3 months.

Leopard fixes that problem, however. So you don't even need an OS X Server box someplace to have Mac client machines on the AD tree.

OS X Server is not necessarily a replacement to a Windows Server based infrastructure, as I pointed out in the original post. It does work with Windows Server pretty darn well. The clients work decently enough directly with the network (aside from the Keychain issue, which is fixed in Leopard.)

We do this more than successfully at my school district and especially at the college I used to work at.

My question is whether or not you've worked with OS X recently? ActiveDirectory support was halfhazard in 10.2, and only marginally better in 10.3. 10.4 works pretty darn well. 10.5 is almost seamless.

As for Apple techs not knowing anything, again, I'm wondering if you've worked with OS X recently. When you purchase an Enterprise level support service, you are connected directly to real Apple software and hardware engineers, not payed interns. These guys know UNIX inside and out. Often fixes and workarounds happen in the terminal with undocumented features not present inside the GUI.

Also, since XServes and OS X Server is so damn cheap, you can buy three or four XServes with OS X Server Unlimited client for every one Dell box with Windows Server (depending on CALs.) So there's no problem setting up three or four patch servers to make sure they stay compatible. The patch servers can just cluster with the main server for additional CPU power.

[brassplayersrock²]

uhh, DNR ??????????????????



alex

[besson3c]

Originally Posted by olePigeon 

We have iBooks authenticating directly to the ActiveDirectory server here at my school/work. The only problem we've encountered is the Keychain. It doesn't understand that the system password has changed when it's changed over the network. Having an OS X Server as the intermediary between the iBooks and the ADS fixes that problem, however, we don't have an OS X Server so they have to deal with resetting their keychain every 3 months.

And the reason why you have to use OS X Server, AFAIK, is because up until one of the Unix Service updates for Windows 2003 there was no way to map OS X users with ADS users, which meant that everybody would have been assigned the same generic login UID. This is why many lab schemes resort to cleanup scripts to automatically move user files somewhere else via a login/logout hook.

Leopard fixes that problem, however. So you don't even need an OS X Server box someplace to have Mac client machines on the AD tree.

Does Leopard include AD group/account maintenance tools that were prior only available under Windows?

My question is whether or not you've worked with OS X recently? ActiveDirectory support was halfhazard in 10.2, and only marginally better in 10.3. 10.4 works pretty darn well. 10.5 is almost seamless.

I'm going off of some experience in my last job under 10.4, and hearsay from our campus Mac guys who I talk with fairly frequently to this day.

What I want to know is why Apple simply didn't make the AD Plugin for OpenLDAP open source? They could have solved a lot of problems this way, no?

As for Apple techs not knowing anything, again, I'm wondering if you've worked with OS X recently. When you purchase an Enterprise level support service, you are connected directly to real Apple software and hardware engineers, not payed interns. These guys know UNIX inside and out. Often fixes and workarounds happen in the terminal with undocumented features not present inside the GUI.

How recent is "recent"? Were you affected by a point upgrade to Tiger requiring SSL be enabled with LDAP? How long ago was this?

Also, since XServes and OS X Server is so damn cheap, you can buy three or four XServes with OS X Server Unlimited client for every one Dell box with Windows Server (depending on CALs.) So there's no problem setting up three or four patch servers to make sure they stay compatible. The patch servers can just cluster with the main server for additional CPU power.

I won't argue this, because I don't deal with Windows servers or with Unix servers in the XServe class right now. The XServe has gotten a hell of a lot better since the last revision, I'll give you that. The servers I work with right now are HP/Red Hat and Solaris.

[besson3c]

Originally Posted by brassplayersrock 

uhh, DNR ??????????????????



alex

Huh? What is DNR?

[brassplayersrock²]

do not resuscitate. i think i got the letters wrong. anyways, isn't there a thing that says giving info about leopard = not liked by Apple?


alex

[besson3c]

Nda

[brassplayersrock²]

Those are the ones!

alex

[awaspaas]

I sure hope all pre-release developers don't have to sign a DNR agreement!! I mean I know Apple is strict and all, but...

[olePigeon]

Originally Posted by besson3c 

And the reason why you have to use OS X Server, AFAIK, is because up until one of the Unix Service updates for Windows 2003 there was no way to map OS X users with ADS users, which meant that everybody would have been assigned the same generic login UID. This is why many lab schemes resort to cleanup scripts to automatically move user files somewhere else via a login/logout hook.

You usually have an OS X Server as the intermediary between the ADS and the Mac clients. You're right, though, Windows Server 2003 does allow the UNIX/Linux clients to join ActiveDirectory directly without the need of OS X Server translating between the two, but there are still problems. It's a good idea to have an OS X Server gobetween anyway because User Policies and UNIX Permissions don't always translate very well.

Originally Posted by besson3c 

Does Leopard include AD group/account maintenance tools that were prior only available under Windows?

I asked that very question at Macworld at the XServe area and neither person there knew. They said that they're only demoing what's on the checklist Apple gave them. They also didn't allow anyone handson with the servers, either. I'm guessing from the all the hoopla about integration with Windows when it comes to Leopard Server that they'll have something on that level. At least, I hope they do. I can't answer that one.

Originally Posted by besson3c 

I'm going off of some experience in my last job under 10.4, and hearsay from our campus Mac guys who I talk with fairly frequently to this day.

Me as well, and I am the Mac guy. I am rather novice when it comes to Active Directory, though. I am learning a lot, and I'm also learning how much I really hate managing 1500 mixed Windows PCs.

Originally Posted by besson3c 

What I want to know is why Apple simply didn't make the AD Plugin for OpenLDAP open source? They could have solved a lot of problems this way, no?

That could be some of the code sharing agreement between Apple and Microsoft. If it's proprietary code from Microsoft, it has to be kept a closed binary.

Originally Posted by besson3c 

How recent is "recent"? Were you affected by a point upgrade to Tiger requiring SSL be enabled with LDAP? How long ago was this?

There is no point upgrade to Tiger... but if you're asking if we ran into problems with SSL when migrating from Panther to Tiger, no, because we hadn't integrated our Panther Server with the ActiveDirectory server. We didn't really do anything with ActiveDirectory until after Tiger, so I can't comment on that.

Originally Posted by besson3c 

I won't argue this, because I don't deal with Windows servers or with Unix servers in the XServe class right now. The XServe has gotten a hell of a lot better since the last revision, I'll give you that. The servers I work with right now are HP/Red Hat and Solaris.

That's good. At least they're not Dells. *shudder* Ever have an HP server literally go up in a plume smoke the first time you turn it on? We got a whole building evacuated because of our Dell.

[angelmb]

Originally Posted by olePigeon 

See if this works:

http://education.apple.com/contact_m...nEducation.pdf

Thanks.