Levels of Management

Date: 2015-10-07; view: 355.

Introducing Account Management

Managing with Profile Manager

If you run an organization with several hundred users or even just a handful, how can you manage their experience with OS X and iOS? In previous lessons, you learned management techniques involving the user name and password. There are many other aspects to user account management, and it is important to understand how these various aspects interact with each other.

OS X Server provides the Profile Manager service, which allows you as the administrator to assign preferences and allow or deny certain settings to iOS and OS X devices.

OS X Lion introduced the concept of profiles that contain configurations and settings, and OS X Yosemite expands on the idea. By assigning profiles to users, user groups, devices, or groups of devices, you can more effectively control them.

With profiles, you can achieve a range of results including but not limited to the following:

▶ Controlling settings on mobile devices and computers

▶ Restricting resources to specific groups or individuals

▶ Securing device use in key areas such as offices, classrooms, or open labs

▶ Customizing the user experience

▶ Providing apps and books to the users

You can create settings for four types of accounts:

▶ User—This usually relates to a specific person. This is the account that the person identifies herself with when logging in to the computer. A user's short name or user ID (UID) number uniquely identifies the user on a system.

▶ Group—This represents a group of users, a group of groups, or a mixture of both.

▶ Device—Similar to a user account, this is the singular entity that represents a given piece of hardware. This can be either a computer or an iOS device. Device accounts are uniquely identified by their Ethernet ID (MAC address), serial number, international mobile equipment identity (IMEI), or mobile equipment identifier (MEID).

▶ Device group—This represents a grouping of computers or iOS devices or both. A device group can include other device groups nested in it or a mixture of both individuals and nested groups. Not all management levels make sense for all purposes, so when setting policy, you have to decide what is appropriate. For example, you might want to define printers by device group because a typical situation has a group of computers located geographically close to a specific printer. You may want to set virtual private network (VPN) access via a group of users such as remote salespeople. And individuals might have specific application access rights granted to them. Each level can have a default group of settings and then custom settings. Mixing and layering profiles with conflicting settings is not recommended. The results may not be what you expected. If a user or user group has an assigned profile and the user logs in to the user portal web‐ site to enroll an OS X computer, the profiles assigned to that user will be applied to that computer regardless of who logs in to that computer. The same applies if they have an iOS device assigned to them as a user.