Slashdot Mirror

I use DeployStudio for my mac rollouts. I had one of the Apple engineers
from Apple Canada visit my site and he showed it to me. It was exactly
what we were looking for. It runs over NFS on one of my Xserve servers.
It is fantastic.

http://www.deploystudio.com/Home.html

It works very well and can image the new machines very quickly, even
in times where only a 100mb connection is available.

I highly recommend it to you.

Cheers,

For freebies InstaDMG http://www.afp548.com/article.php?story=20090812091929480 and DeployStudio http://www.deploystudio.com/Home.html with Radmind (if you need it). For pro stuff try Jamf http://www.jamfsoftware.com/. Join the system-imaging list with Apple. The people on there are far less 'flamey' than on the OSX server list and will be able to advise you on the different tools, their experiences etc and really are helpful.

Radmind can be good.

InstaDMG from AFP548 is a great way to build SOE images from a collection of packages.

DeployStudio is a great way to get the images on a hard drive.

NetBoot/NetRestore is also a good way to get an image on a drive.

If you really like tinkering, you can tweak the supplied Mac OS X installer, and modify the list of packages it knows about. Using Adobe's enterprise deployment toolkit, for instance, you can package up CS4 with serialisation, and have the installer call these packages after it's installed the bare OS, but this is a lot of work.

I still use tools like the Enterprise Deployment Toolkit, but use the packages it creates in an InstaDMG workflow.

For the server - Mac OS X Server is good as a general solution and (not having tried Snow Leopard server in any kind of heavy-duty deployment) I use Kerio Mail Server as a general groupware solution - it's as close to a drop-in replacement for Exchange as you'll get on the Mac platform, and as well as serving IMAP and CalDAV clients really well, it can also serve Outlook.

Storage and backup is really critical - there's Apple's rebadged Promise RAID units if you want everything to be all Apple, and there are some good third-party alternatives. Backup to tape is pretty important with any kind of serious server deployment - I use LTO libraries wherever possible...

The System Image Utility in 10.5 Server has built-in Automator workflows, and works with the server's NetBoot service. I use it to deploy 35 GB images over the network in in about 18 min. But the big kids use DeployStudio: http://www.deploystudio.com/Home.html

It was mentioned once up above, but I've gotta recommend DeployStudio. After using a stock NetInstall setup for a few years and getting tired of stuff breaking, I gave it a try -- a hurdle or two at the start, but then holy crap is it ever a million times better. Waaayy more flexibility, no need to create actual NetBoot images based on entire masters (just a tiny boot-only image, then it grabs the rest off a sharepoint), and wwaaaaayyy faster. I was doing six simultaneous 16GB eMac images on a 100mbit network in about 15 minutes, which would have taken like a day and a half with NetInstall.

DeployStudio looks fantastic with it's multicasting capabilities, but the System Image Utility in Leopard Server is just so trusty I have a hard time looking at anything else. http://www.deploystudio.com/Home.html You don't hear much about Leopard Server but it is by far the most promising aspect of the platform. It is the key to any large scale OSX network. I am a one man shop for 400 users. I'm sure that with a staff of three It could scale way up.

Apple has a robust remote installation suite with OS X Server, which is darn cheap compared to most other commercial offerings.

10.6 includes a first party version of NetRestore (full system image deployment, similar to Ghost or Flash Archive on Solaris), but most people deploying across a large number of systems should roll their own images with packaged based tools like DeployStudio or InstaDMG:

http://www.deploystudio.com/
http://code.google.com/p/instadmg/

Some other good sites for finding info:
  http://www.afp548.com/
  http://www.macenterprise.org/

We use DeployStudio, a freeware project http://www.deploystudio.com/ . Support for DS is pretty from the community, or you can buy training, but if you want to go with a vendor product JAMF Casper suite makes a great product, that we did not think was outrageously expensive.

DeployStudio appears to be the anointed successor to the venerable and discontinued NetRestore from Mike Bombich. Mike personally recommended DeployStudio. Best thing about it is that it's cross-platform and will also image PXE-capable PCs with Linux or Windows or what have you.

I found - from doing exactly what you're doing - that if you choose the route of locking *anything* down, then that will very quickly become the majority focus of your day. However, you do have a responsibility as each one of those laptops is a lawsuit waiting to happen. That being said, the suggestions that you "don't lock anything down" is ludicrous. You wouldn't tell kids they can take the school bus for a drive would you? That's reckless, and while ownership is something that everyone wants to encourage, it's not realistic to expect 100% participation. The best way to encourage respect for the laptops is to set up a very straightforward policy that requires two things: 1) parental involvement 2) real financial damages in the case that gross negligence is involved with the loss / damage of a laptop. We had parents sign a binding contract and every student had to pay a nominal laptop fee. We also had a MANDATORY assembly in order to take the laptops home each year. During the assembly, we covered care instructions and the school's acceptable use policy for both the computers and laptops In the case of damages, we had a committee of students, teachers, and parents that evaluated and meted out what punishment or damages should be assessed. It wasn't perfect, by any means, however having a system in place for handling the disaster that will happen is essential for success. Sticking to that system is even a greater challenge. Technically, if you want to lock everything down, let me make some recommendations: 1) set a firmware password that is significantly different from the admin password. 2) set an admin account with a password that can't be easily guessed and hide it from view 3) invest in Lightspeed Systems. It's a little app that tracks where students go and what they do on the internet. Just confronting kids with that info is helpful in controlling illicit behavior. Make sure your guidance counselor is on board and has some resources to deal with internet addiction and porn addiction. 4) Set up a lo-jack system for recovery. This can be as simple as a startup script that submits the machines IP, current user, and any other relevant info to a server. There are more expensive systems out there that allow. Here's a free one: 5) RADMIND! Use it! 6) Let kids know that the policy for broken machines is reimaging them. Reimage remotely using DeployStudio: http://www.deploystudio.com/ 7) Move all the apps that students never need into a folder and hide it and change the permissions so they can't run the programs unless they're in the admin group 8) Join the apple sysadmin's group. It's worth the read.