Using Centrify's DirectControl with Mac OS X - Cerberis

More documents

Recommendations

Info

CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS XFigure 9. Mac OS X users are notified when they try to launch a proscribed application.4 Streamlined Deployment: Workstation Mode and AutomatedInstallationThe Centrify DirectControl for Mac OS X installation program, provided in universalbinary format, makes it easy to deploy DirectControl whether you need to install on Macsindividually or centrally install on hundreds or thousands of Macs across your enterprise.A pre-installation environment analysis tool and DirectControl’s workstation mode alsostreamline deployment.On individual systems, a graphic, interactive installation program walks users through thesetup. System administrators can of course also use this interactive installation programon individual systems, but for large deployments they will want to extract the packagefile for use with Apple Remote Desktop; see Using Apple Remote Desktop to DeployCentrify DirectControl on the Centrify web site for instructions. The installation packagecan also be distributed using third-party systems management solutions such LanREV.The ADcheck analyzer can identify any issues that could prevent a successfulinstallation. The most common problems are DNS configuration issues that prevent theMac from locating an Active Directory domain controller on the network. End-users canrun the ADCheck tool themselves prior to installing DirectControl as long as theADcheck tool does not identify any issues; although they would probably need assistancefrom IT if ADcheck discovers any problems.© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 21
CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS XIn many organizations, Mac OS X workstations can be treated just like Windowsworkstations for access control purposes, permitting anyone with an Active Directoryaccount to log in once the Mac has joined the domain. For those organizations,DirectControl’s workstation mode streamlines installation using the same methodology toadd a Mac workstation to an Active Directory domain as that used to add Windowsworkstations. The interactive installation program offers users the option to add the Macin workstation mode. Remote installations can specify workstation mode throughcommand-line parameters.Figure 10. Administrators can join Mac OS X systems into AD just as any other Windowssystem in Workstation Mode into a Centrify Zone for more complex environments.Macs operating in workstation mode have almost identical features to Macs operating instandard DirectControl mode. For example, end-users have transparent access to local ornetwork home directories, and they enjoy the same single sign-on benefits to other ActiveDirectory integrated services and applications. Administrators can also use Group Policyto remotely manage security and configuration settings on DirectControl-managed Macsin workstation mode.However, workstation mode differs from standard mode in two regards. First, theinstallation process has been streamlined. You do not need to install the CentrifyAdministrator’s Console first. You simply install DirectControl on a Mac and it isautomatically joined to Active Directory and appears as a computer object in ActiveDirectory Users and Computers. Second, the Mac is added to Active Directory withoutbeing associated to a DirectControl Zone. This means that any user with an ActiveDirectory account can log into that Mac, just as any user with an Active Directoryaccount can log into a Windows workstation. If you need to limit access to a subset ofActive Directory users, it is easy enough to install the Centrify Administrator Console© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 22
Page 1 and 2: WHITE PAPERCENTRIFY CORP.OCTOBER 20
Page 3 and 4: CENTRIFY WHITE PAPERUSING CENTRIFY
Page 23: CENTRIFY WHITE PAPERUSING CENTRIFY
Page 31: CENTRIFY WHITE PAPERUSING CENTRIFY

Using Centrify's DirectControl with Mac OS X - Cerberis

Create successful ePaper yourself

Delete template?

Save as template?