Mac OS X Server User Managment - Apple

294 Pages·2009·2.34 MB·English

by  Apple Inc.

Mac OS X Server
User Management
Version 10.6 Snow Leopard
K Apple Inc. Apple, the Apple logo, AirPort, AppleShare, Bonjour,
© 2009 Apple Inc. All rights reserved. FireWire, iCal, iTunes, Mac, Mac OS, MacBook, Macintosh,
QuickTime, SuperDrive, Xgrid, Xsan, and Xserve are
The owner or authorized user of a valid copy of
trademarks of Apple Inc., registered in the U.S. and other
Mac OS X Server software may reproduce this
countries. Apple Remote Desktop, Extensions Manager,
publication for the purpose of learning to use such
Finder, iWork, and Safari are trademarks of Apple Inc.
software. No part of this publication may be reproduced
Mac is a service mark of Apple Inc.
or transmitted for commercial purposes, such as selling
copies of this publication or for providing paid-for Adobe and PostScript are trademarks of Adobe Systems
support services. Incorporated.
Every effort has been made to ensure that the The Bluetooth® word mark and logos are registered
information in this manual is accurate. Apple Inc. is not trademarks owned by the Bluetooth SIG, Inc. and any
responsible for printing or clerical errors. use of such marks by Apple is under license.
Apple Java and all Java-based trademarks and logos
1 Infinite Loop are trademarks or registered trademarks of Sun
Cupertino, CA 95014-2084 Microsystems, Inc. in the U.S. and other countries.
408-996-1010
UNIX is a registered trademark of The Open Group.
www.apple.com
Other company and product names mentioned herein
Use of the “keyboard” Apple logo (Option-Shift-K) for
are trademarks of their respective companies. Mention
commercial purposes without the prior written consent
of third-party products is for informational purposes
of Apple may constitute trademark infringement and
only and constitutes neither an endorsement nor a
unfair competition in violation of federal and state laws.
recommendation. Apple assumes no responsibility with
regard to the performance of these products.
019-1415/2009-08-01
Contents
13 Preface: About This Guide
13 What’s New in Workgroup Manager
14 What’s in This Guide
15 Using Onscreen Help
16 Documentation Map
17 Viewing PDF Guides Onscreen
17 Printing PDF Guides
18 Getting Documentation Updates
18 Getting Additional Information
19 Chapter 1: User Management Overview
19 Tools for User Management
19 Workgroup Manager
20 Server Admin
21 Server Preferences
21 Command-Line Tools
21 Accounts
22 Administrator Accounts
23 User Accounts
24 Group Accounts
25 Computer Accounts
25 Computer Groups
25 The User Experience
25 Authentication and Identity Validation
27 Information Access Control
28 SIDs and Windows Interoperability
29 Chapter 2: Getting Started with User Management
29 Setup Overview
32 Planning Strategies for User Management
32 Analyzing Your Environment
33 Identifying Directory Services Requirements
33 Determining Server and Storage Requirements
3
35 Choosing a Home Folder Structure
36 Devising a Home Folder Distribution Strategy
36 Identifying Groups
37 Determining Administrator Requirements
38 Chapter 3: Getting Started with Workgroup Manager
38 Configuring the Administrator’s Computer and Account
38 Setting Up an Administrator Computer
39 Creating a Directory Administrator Account
40 Using Workgroup Manager
40 Using Mac OS X Server v10.6 to Administer Earlier Versions of Mac OS X
40 Connecting and Authenticating to Directory Domains in Workgroup Manager
41 Major Workgroup Manager Tasks
42 Modifying Workgroup Manager Preferences
43 Finding and Listing Accounts
43 Working with Account Lists in Workgroup Manager
44 Listing Accounts in the Local Directory Domain
44 Listing Accounts in Search Policy Directory Domains
45 Listing Accounts in Available Directory Domains
46 Refreshing Account Lists
46 Finding Specific Accounts in a List
47 Using Advanced Search
47 Sorting Users and Groups
48 Shortcuts for Working with Accounts
48 Using Presets
48 Editing Multiple Accounts Simultaneously
50 Importing and Exporting Account Information
51 Chapter 4: Setting Up User Accounts
51 About User Accounts
51 Where User Accounts Are Stored
52 Predefined User Accounts
53 Administering User Accounts
53 Creating User Accounts
57 Creating Augmented User Records
58 Editing User Account Information
59 Editing User Account Information from the Command Line
59 Working with Read-Only User Accounts
60 Working with Guest Users
60 Working with Windows User Accounts
61 Deleting a User Account
62 Disabling a User Account
63 Working with Presets
4 Contents
63 Creating a Preset for User Accounts
64 Using Presets to Create Accounts
64 Renaming Presets
64 Editing Presets
65 Deleting a Preset
65 Working with Basic Settings
65 Modifying User Names
66 Modifying Short Names
67 Choosing Stable Short Names
68 Avoiding Duplicate Names
69 Modifying User IDs
70 Assigning a Password to a User
71 Assigning Administrator Privileges for a Server
72 Choosing a User’s Login Picture
73 Working with Privileges
73 Removing Administrative Privileges from a User
74 Giving a User Limited Administrative Capabilities
75 Giving a User Full Administrative Capabilities
76 Working with Advanced Settings
76 Enabling a User’s Calendar
77 Allowing a User to Log In to More Than One Computer at a Time
77 Choosing a Default Shell
78 Choosing a Password Type and Setting Password Options
79 Creating a Master List of Keywords
80 Applying Keywords to User Accounts
80 Editing Comments
81 Working with Group Settings
81 Choosing a User’s Primary Group
82 Reviewing a User’s Group Memberships
82 Adding a User to a Group
83 Removing a User from a Group
84 Working with Home Settings
84 Working with Mail Settings
84 Enabling Mail Service Account Options
85 Disabling a User’s Mail Service
85 Forwarding a User’s Mail
86 Working with Print Quota Settings
86 Enabling a User’s Access to All Available Print Queues
86 Enabling a User’s Access to Specific Print Queues
87 Removing a Print Quota for a Queue
88 Resetting a User’s Print Quota
88 Disabling a User’s Access to Print Queues That Enforce Quotas
89 Working with Info Settings
Contents 5
89 Working with Windows Settings
90 Changing a Windows User’s Profile Location
91 Changing a Windows User’s Login Script Location
91 Changing a Windows User’s Home Folder Drive Letter
92 Changing a Windows User’s Home Folder Location
92 Working with GUIDs
92 Viewing GUIDs
93 Chapter 5: Setting Up Group Accounts
93 About Group Accounts
93 How Group Accounts Track Membership
94 Where Group Accounts Are Stored
94 Predefined Group Accounts
96 Administering Group Accounts
96 Creating Group Accounts
98 Creating a Preset for Group Accounts
98 Editing Group Account Information
99 Creating Hierarchical Groups
102 Upgrading Legacy Groups
102 Working with Read-Only Groups
103 Deleting a Group
103 Working with Basic Settings for Groups
103 Naming a Group
104 Defining a Group ID
105 Choosing a Group’s Login Picture
106 Enabling a Group’s Web Services When Connecting to Mac OS X Server v10.5
107 Working with Member Settings for Groups
107 Adding Users or Groups to a Group
109 Removing Group Members
111 Working with Group Folder Settings
111 Specifying No Group Folder
112 Creating a Group Folder
114 Designating a Group Folder for Use by Multiple Groups
115 Chapter 6: Setting Up Computers and Computer Groups
115 About Computer Accounts
116 Creating Computer Accounts
117 Working with Guest Computers
118 Working with Windows Computers
118 About Computer Groups
118 Differences Between Computer Groups and Computer Lists
119 Administering Computer Groups
119 Creating a Computer Group
6 Contents
120 Creating a Preset for Computer Groups
121 Using a Computer Group Preset
121 Adding Computers or Computer Groups to a Computer Group
122 Removing Computers and Computer Groups from a Computer Group
122 Deleting a Computer Group
123 Upgrading Computer Lists to Computer Groups
124 Chapter 7: Setting Up Home Folders
124 About Home Folders
125 Hosting Home Folders for Mac OS X Clients
125 Hosting Home Folders for Other Clients
126 Distributing Home Folders Across Multiple Servers
127 Administering Share Points
127 Setting Up a Share Point
128 Setting Up an Automountable AFP Share Point for Home Folders
129 Setting Up an Automountable NFS Share Point for Home Folders
130 Setting Up an SMB Share Point
132 Administering Home Folders
132 Specifying No Home Folder
133 Creating a Home Folder for a Local User
134 Creating a Network Home Folder
136 Creating a Custom Location for Home Folders
138 Setting Up a Home Folder for a Windows User
140 Setting Disk Quotas
141 Setting Disk Quotas for Windows Users to Avoid Data Loss
142 Using Presets to Choose Default Home Folders
142 Moving Home Folders
142 Deleting Home Folders
143 Chapter 8: Managing Portable Computers
143 About Mobile Accounts
144 About Portable Home Directories
145 Logging In to Mobile Accounts
146 Resolving Sync Conflicts
146 About External Accounts
147 Logging In to External Accounts
148 Considerations and Strategies for Deploying Mobile Accounts
148 Advantages of Using Mobile Accounts
149 Considerations for Using Mobile Accounts
151 Strategies for Syncing Content
152 Setting Up Mobile Accounts for Use on Portable Computers
152 Configuring Portable Computers
153 Managing Mobile Clients Without Using Mobile Accounts
Contents 7
153 Unknown Mac OS X Portable Computers
154 Using Mac OS X Portable Computers with One Primary Local User
154 Using Mac OS X Portable Computers with Multiple Users
156 Securing Mobile Clients
157 Optimizing the File Server for Mobile Accounts
158 Chapter 9: Client Management Overview
159 Using Network-Visible Resources
160 Customizing the User Experience
160 The Power of Preferences
161 Designing the Login Experience
163 Choosing a Workgroup
164 Working with Synced Homes
164 Improving Workflow
166 Chapter 10: Managing Preferences
166 Using Workgroup Manager to Manage Preferences
168 Understanding Managed Preference Interactions
170 Understanding Hierarchical Preference Management
171 Setting the Permanence of Management
172 Caching Preferences
172 Preference Management Basics
173 Managing User Preferences
173 Managing Group Preferences
174 Managing Computer Preferences
175 Managing Computer Group Preferences
175 Disabling Management for Specific Preferences
176 Managing Access to Applications
177 Controlling User Access to Specific Applications and Folders
179 Allowing Specific Dashboard Widgets
179 Disabling Front Row
180 Allowing Legacy Users to Open Specific Applications and Folders
181 Managing Classic Preferences
182 Selecting Classic Startup Options
182 Choosing a Classic System Folder
183 Allowing Special Actions During Restart
184 Controlling Access to Classic Apple Menu Items
185 Adjusting Classic Sleep Settings
185 Maintaining Consistent User Preferences for Classic
186 Managing Dock Preferences
186 Controlling the User’s Dock
187 Providing Easy Access to Group Folders
188 Adding Items to a User’s Dock
8 Contents
189 Preventing Users from Adding or Deleting Dock Items
189 Managing Energy Saver Preferences
190 Using Sleep and Wake Settings for Desktop Computers
191 Setting Energy Saver Settings for Portable Computers
192 Displaying Battery Status to Users
193 Scheduling Automatic Startup, Shutdown, or Sleep
194 Managing Finder Preferences
194 Setting Up Simple Finder
195 Keeping Disks and Servers from Appearing on the User’s Desktop
196 Controlling the Behavior of Finder Windows
196 Hiding the Alert Message When a User Empties the Trash
197 Making Filename Extensions Visible
197 Controlling User Access to Remote Servers
197 Controlling User Access to an iDisk
198 Preventing Users from Ejecting Discs
198 Hiding the Burn Disc Command in the Finder
199 Controlling User Access to Folders
199 Removing Restart and Shut Down from the Apple Menu
199 Adjusting the Appearance and Arrangement of Desktop Items
200 Adjusting the Appearance of Finder Window Contents
201 Managing Login Preferences
202 Changing the Appearance of the Login Window
204 Configuring Miscellaneous Login Options
205 Choosing Who Can Log In
206 Customizing the Workgroups Displayed at Login
208 Enabling the Use of Login and Logout Scripts
210 Choosing a Login or Logout Script
211 Automatically Opening Items After a User Logs In
212 Providing Access to a User’s Network Home Folder
213 Providing Easy Access to the Group Share Point
213 Managing Media Access Preferences
214 Controlling Access to CDs, DVDs, and Recordable Discs
214 Controlling Access to Hard Drives, Disks, and Disk Images
215 Ejecting Removable Media Automatically When a User Logs Out
215 Managing Mobility Preferences
216 Creating a Mobile Account
218 Preventing the Creation of a Mobile Account
218 Manually Removing Mobile Accounts from Computers
219 Enabling FileVault for Mobile Accounts
221 Selecting the Location of a Mobile Account
222 Creating External Accounts
224 Setting Expiration Periods for Mobile Accounts
224 Choosing Folders to Sync
Contents 9
226 Stopping Files from Syncing for a Mobile Account
226 Setting the Background Sync Frequency
227 Showing Mobile Account Status in the User’s Menu Bar
228 Managing Network Preferences
228 Configuring Proxy Servers by Port
229 Allowing Users to Bypass Proxy Servers for Specific Domains
230 Enabling Passive FTP Mode
230 Disabling Internet Sharing
231 Disabling AirPort
231 Disabling Bluetooth
232 Managing Parental Controls Preferences
232 Hiding Profanity in Dictionary
232 Preventing Access to Adult Websites
233 Allowing Access Only to Specific Websites
235 Setting Time Limits and Curfews on Computer Usage
235 Managing Printing Preferences
236 Making Printers Available to Users
236 Preventing Users from Modifying the Printer List
237 Restricting Access to Printers Connected to a Computer
238 Setting a Default Printer
238 Restricting Access to Printers
238 Adding a Page Footer to All Printouts
239 Managing Software Update Preferences
240 Managing Access to System Preferences
241 Managing Time Machine Preferences
242 Managing Universal Access Preferences
242 Adjusting the User’s Display Settings
243 Setting a Visual Alert
244 Adjusting Keyboard Accessibility Options
245 Adjusting Mouse and Pointer Responsiveness
246 Enabling Universal Access Shortcuts
246 Allowing Devices for Users with Special Needs
247 Using the Preference Editor with Preference Manifests
248 Adding to the Preference Editor’s List
249 Editing Application Preferences with the Preference Editor
251 Removing an Application’s Managed Preferences in the Preference Editor
251 Using the Preference Editor to Manage Core Services
253 Using the Preference Editor to Manage Safari
254 Using the Preference Editor to Manage Apple Remote Desktop
255 Managing Preferences from the Command Line
255 Using Managed Client Extensions
259 Determining Effective Managed Preferences
260 Manually Refreshing Managed Preferences
10 Contents