Apple Pro Training Series: OS X Lion Server Essentials: Managing Accounts
This chapter is from the book
This chapter is from the book
This chapter is from the book
Introducing Account Management
Account management was controlled by Workgroup Manager in Mac OS X 10.6 and earlier, but Lion introduces the concept of profiles that contain configurations and settings. By assigning profiles to users, user groups, devices, or groups of devices you can achieve control over your systems.
With effective account management, you can achieve a range of results, including the following:
- Providing users with a consistent, controlled interface
- Controlling settings on mobile devices and computers
- Restricting certain resources for specific groups or individuals
- Securing computer use in key areas such as administrative offices, classrooms, or open labs
- Customizing the user experience
- Customizing Dock settings
Profile Manager
Profile Manager is an account management tool that allows the development and distribution of configurations and settings to control the experience on Lion computers and iOS devices. The configurations and settings are contained in XML based text files called profiles. Profile Manager has three parts:
- Profile Manager web tool
- User Portal web site
- Mobile Device Management Server
Profile Manager Web App
The web tool allows easy access to the Profile Manager functionality from any browser that can connect to the Lion Server with the Profile Manager service turned on. An administrator can utilize the web interface to create profiles for use on client machines. It is also used to create and manage device accounts and device group accounts. Users and Groups are created in the Server app, but are displayed in the Profile Manager web app. The Profile Manager is reached at https://server.domain.com/profilemanager/.
User Portal
The User Portal is a simple way for users to enroll devices, obtain profiles, and wipe or lock their devices. The User Portal is accessed via a web browser and lists the user’s enrolled devices and available profiles. It is reached at https://server.domain.com/mydevices/.
Device Management
You can configure and enable the Mobile Device Management (MDM) functionality to allow you to create profiles for devices. When you or your users enroll Lion computers and iOS 4 or later devices, this allows over the air (OTA) management of devices including remote wipe and lock.
Levels of Management
Using Profile Manager you can apply profiles at various levels including:
- Individual Users
- Groups of Users
- Devices
- Device Groups
Not all management levels make sense for all purposes, so when setting policy you have to decide what is appropriate. For example, you might want to define printers by device groups, because a typical situation has a group of computers located geographically close to a specific printer. You may want to set VPN access via a group of users such as remote salespeople. And individuals might have specific application access rights granted to them.
Each level can have a default group of settings and then custom settings. Mixing and layering profiles with conflicting settings is not recommended.