Mac OS X Server User Management For Version 10.4 or Later Second Edition K Apple Computer, Inc. Apple, the Apple logo, AirPort, AppleShare, AppleTalk, © 2006 Apple Computer, Inc. All rights reserved. FireWire, iBook, Keychain, LaserWriter, Mac, Mac OS, Macintosh, PowerBook, and QuickTime are trademarks The owner or authorized user of a valid copy of of Apple Computer, Inc., registered in the U.S. and other Mac OS X Server software may reproduce this countries. Extensions Manager, Finder, and SuperDrive publication for the purpose of learning to use such are trademarks of Apple Computer, Inc. software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling Adobe and PostScript are trademarks of Adobe Systems copies of this publication or for providing paid-for Incorporated. support services. Java and all Java-based trademarks and logos are Every effort has been made to ensure that the trademarks or registered trademarks of Sun information in this manual is accurate. Apple Computer, Microsystems, Inc. in the U.S. and other countries. Inc., is not responsible for printing or clerical errors. UNIX is a registered trademark in the United States and Apple other countries, licensed exclusively through X/Open 1 Infinite Loop Company, Ltd. Cupertino, CA 95014-2084 408-996-1010 Other company and product names mentioned herein www.apple.com are trademarks of their respective companies. Mention of third-party products is for informational purposes Use of the “keyboard” Apple logo (Option-Shift-K) for only and constitutes neither an endorsement nor a commercial purposes without the prior written consent recommendation. Apple assumes no responsibility with of Apple may constitute trademark infringement and regard to the performance of these products. unfair competition in violation of federal and state laws. 019-0638/02-14-06 1 Contents Preface 13 About This Guide 13 What’s New in Version 10.4 14 What’s in This Guide 15 Using Onscreen Help 16 The Mac OS X Server Suite 17 Getting Additional Information Chapter 1 19 User Management Overview 19 Tools for User Management 19 Workgroup Manager 20 Server Admin 21 NetBoot 21 Network Install 22 Accounts 22 Administrator Accounts 23 User Accounts 24 Group Accounts 25 Computer Lists 25 The User Experience 26 Authentication and Identity Validation 27 Information Access Control Chapter 2 29 Getting Started with User Management 29 Setup Overview 33 Planning Strategies for User Management 33 Analyzing Your Environment 33 Identifying Directory Services Requirements 34 Determining Server and Storage Requirements 35 Using Client Management 35 Choosing a Home Folder Structure 36 Devising a Home Folder Distribution Strategy 36 Identifying Groups 37 Determining Administrator Requirements 3 Chapter 3 39 Getting Started with Workgroup Manager 39 Configuring the Administrator’s Computer and Account 40 Setting Up an Administrator Computer 40 Creating a Domain Administrator Account 41 Using Workgroup Manager 41 Working with Pre–Version 10.4 Computers from Version 10.4 Servers 41 Connecting and Authenticating to Directory Domains in Workgroup Manager 42 Major Workgroup Manager Tasks 43 Listing and Finding Accounts 43 Working with Account Lists in Workgroup Manager 44 Listing Accounts in the Local Directory Domain 44 Listing Accounts in Search Policy Directory Domains 45 Listing Accounts in Available Directory Domains 45 Refreshing Account Lists 46 Finding Specific Accounts in a List 46 Sorting User and Group Lists 46 Using the Search Button in the Toolbar 47 Shortcuts for Working with Accounts 47 Editing Multiple Accounts Simultaneously 47 Using Presets 48 Importing and Exporting Account Information 48 Backing Up and Restoring User Management Data 48 Backing Up and Restoring Directory Domain and Authentication Files 48 Backing Up Root and Administrator User Accounts Chapter 4 49 Setting Up User Accounts 49 About User Accounts 49 Where User Accounts Are Stored 50 Predefined User Accounts 51 Administering User Accounts 51 Creating Mac OS X Server User Accounts 52 Editing User Account Information 52 Editing Multiple User Accounts Simultaneously 53 Modifying Accounts in an Open Directory Master 53 Working with Read-Only User Accounts 54 Working with Guest Users 54 Deleting a User Account 54 Disabling a User Account 54 Working with Presets 55 Creating a Preset for User Accounts 55 Using Presets to Create New Accounts 56 Renaming Presets 56 Editing Presets 4 Contents 56 Deleting a Preset 57 Working with Basic Settings 57 Defining User Names 58 Defining Short Names 59 Choosing Stable Short Names 59 Avoiding Duplicate Names 60 Defining User IDs 61 Defining Passwords 61 Setting Password Options for Imported User Accounts 62 Assigning Administrator Privileges for a Server 62 Assigning Administrator Privileges for a Directory Domain 63 Working with Advanced Settings 63 Defining Login Settings 64 Choosing a Password Type and Setting Password Options 65 Creating a Master List of Keywords 66 Applying Keywords to User Accounts 66 Editing Comments 67 Working with Group Settings 67 Defining a User’s Primary Group 68 Adding a User to Groups 68 Removing a User from a Group 69 Reviewing a User’s Group Memberships 69 Working with Home Settings 69 Working with Mail Settings 70 Enabling Mail Service Account Options 71 Disabling a User’s Mail Service 71 Forwarding a User’s Mail 72 Working with Print Settings 72 Enabling a User’s Access to Print Queues that Enforce Quotas 73 Disabling a User’s Access to Print Queues that Enforce Quotas 73 Deleting a User’s Print Quota for a Specific Queue 73 Resetting a User’s Print Quota 74 Working with Info Settings 75 Choosing Settings for Windows Users Chapter 5 77 Setting Up Group Accounts 77 About Group Accounts 78 Where Group Accounts Are Stored 78 Predefined Group Accounts 79 Administering Group Accounts 79 Creating Mac OS X Server Group Accounts 80 Creating a Preset for Group Accounts 80 Editing Group Account Information Contents 5 81 Creating Nested Groups 81 Upgrading Legacy Groups 82 Working with Read-Only Group Accounts 82 Deleting a Group Account 83 Working with Member Settings for Groups 83 Adding Users to a Group 84 Removing Users from a Group 84 Naming a Group 85 Defining a Group ID 86 Working with Group Folder Settings 86 Specifying No Group Folder 86 Creating a Group Folder 88 Designating a Group Folder for Use by Multiple Groups Chapter 6 89 Setting Up Computer Lists 89 About Computer Lists 90 Special Purpose Computer Lists 91 Working with Guest Computers 92 Administering Computer Lists 92 Creating a Computer List 93 Creating a Preset for Computer Lists 93 Using a Computer List Preset 94 Adding Computers to an Existing Computer List 95 Changing Information About a Computer 95 Moving a Computer to a Different Computer List 95 Removing Computers from a Computer List 96 Deleting a Computer List 96 Searching for Computer Lists 97 Working with Access Settings 97 Restricting Access to Computers 98 Making Computers Available to All Users 98 Using Local User Accounts Chapter 7 101 Setting Up Home Folders 101 About Home Folders 102 Hosting Home Folders for Mac OS X Clients 103 Hosting Home Folders for Other Clients 103 Distributing Home Folders Across Multiple Servers 104 Administering Share Points 104 Setting Up a Local Share Point 105 Setting Up an Automountable AFP Share Point for Home Folders 106 Setting Up an Automountable NFS Share Point for Home Folders 107 Administering Home Folders 6 Contents 107 Specifying No Home Folder 108 Creating a Home Folder for a Local User 109 Creating a Network Home Folder 110 Creating a Custom Location for Home Folders 113 Setting Disk Quotas 113 Choosing Default Home Folders by Using Presets 113 Moving Home Folders 113 Deleting Home Folders Chapter 8 115 User Management for Portable Computers 115 About Mobile Accounts 116 About Portable Home Directories 116 Logging In to Mobile Accounts 117 Considerations and Strategies for Deploying Mobile Accounts 117 Advantages of Using Mobile Accounts 119 Disadvantages of Using Mobile Accounts 120 Strategies for Synchronizing Content 121 Setting Up Mobile Accounts for Use on Portable Computers 121 Configuring Portable Computers 122 Managing Mobile Clients Without Using Mobile Accounts 122 Unknown Mac OS X Portable Computers 123 Using Mac OS X Portable Computers with One Primary Local User 123 Using Max OS X Portable Computers with Multiple Local Accounts 124 Security Considerations for Mobile Clients 125 Preventing Unauthorized Computer Access 126 Directory Services 126 FileVault for Mobile Clients Chapter 9 127 Client Management Overview 128 Using Network-Visible Resources 129 Customizing the User Experience 130 The Power of Preferences 131 Designing the Login Experience 134 Improving Workflow 135 Using Images to Install Software and Start Up Computers 136 Day-to-Day Computer Administration Chapter 10 137 Managing Preferences 138 How Workgroup Manager Works with Mac OS X Preferences 139 Understanding Managed Preference Interaction 141 Setting the Permanence of Management 142 Caching Preferences 143 Managing Preferences Contents 7 143 About the Preferences Cache 144 Updating the Managed Preferences Cache at Intervals 144 Updating the Preference Cache Manually 145 Managing User Preferences 145 Managing Group Preferences 146 Managing Computer Preferences 147 Editing Preferences for Multiple Records 147 Disabling Management for Specific Preferences 148 Managing Access to Applications 148 Creating a List of Applications Users Can Open 149 Preventing Users from Opening Applications