There is some Authentication Services functionality that is limited by the Mac OS X system.
Administrators should ensure that if they are using custom home directory paths, the parent directories are pre-created with a valid ownership and mode that allows all Authentication Services users to access those paths.
Note: You can manually renew tickets with any utility that supports renewing tickets, such as Apple's Ticket Viewer.
With Authentication Services you can manage your Mac OS X clients using Group Policy. Authentication Services includes Group Policy extensions to manage preferences just as you would with Workgroup Manager. In addition, Authentication Services supports custom policies based on Preference Manifests.
Authentication Services Group Policy includes support for Mac OS X. Using Authentication Services you can manage your Mac OS X through Group Policy. This eliminates the need to set up additional Mac OS X Servers for Mac OS X client management. Mac OS X policy settings are applied using Profile-based policies.
Profile-based policy takes advantage of the Configuration Profile infrastructure provided by Apple. Policy settings are defined in Group Policy and downloaded to Mac OS X clients where the settings are assigned to Configuraiton Profiles, which apply the settings to various configuration files on the Mac OS X.
Profile policy settings are divided into two categories: Workgroup Manager Settings and Preference Manifest Settings.
The Workgroup Manager settings are designed to look and feel like the Workgroup Manager application. If you are familiar with Workgroup Manager from Mac OS X server, it should be easy to transition to Group Policy. Settings for Applications, Classic, Dock, Energy Saver, Finder, Login, Media Access, Network, Parental Controls, Printing, Software Update, System Preferences, Time Machine and Universal Access are included. Authentication Services supports the Never, Always and Once policy application options. You can apply settings to users or computers. With standard Group Policy security filtering, you can restrict settings to specific groups of users or computers.
Authentication Services also includes support for Preference Manifest files. Preference Manifest files describe application settings you can manage centrally. Many standard Mac OS X Preference Manifest files are included by default such as iChat, Mail, Sidebar, Time Zone and iTunes. You can import additional Preference Manifest files at any time, increasing the number of applications and features that you can manage.
On the Mac OS X agent, Group Policy integrates with the Configuration Profile subsystem according to Mac OS X best practices. This ensures that policy settings are applied correctly and appropriately to each new release of Mac OS X.
The following management modes exist for Mac OS X policy settings:
|Never||This mode means that the settings do not apply. This is equivalent to disabling the policy. This is the default mode.|
|Once||In this mode, policy settings are applied one time. Users can remove the Configuration Profile. This mode functions as a default value.|
|Always||In this mode, policy settings will always apply. Users cannot remove the Configuration Profile.|