OS X and Linux controls

[DLWilcox]

(ISC)²-

My company is a Windows shop.  We're looking to bring OS X (and possibly Linux) into the corporate environment.  To be able to allow that we will need robust centralized/managed controls on the OS X devices.

JAMF and Intune look like a good fit for us as we use Intune as our MDM solution.

https://cloudblogs.microsoft.com/enterprisemobility/2017/12/14/microsoft-intune-and-jamf-pro-better-...

That said, I'm curious what other folks are using in their environments to manage their OS X boxes.

Thanks!

-Dave Wilcox, CISSP

[halakahiki82]

We use some open source tools now (munki) because JAMF (Casper when we had it, up until last year) was just so atrociously horrid and caused legitimate outages and serious problems for the district that we had to stop using it. More bugs than functionality and exorbitant support costs when literally any support request was met with "upgrade and see if that fixes it." And the upgrades usually resulted in additional bugs to add onto our existing issues. Very frustrating and aside from sometimes making bulk imaging go faster, it caused more problems than it was worth. And then imaging broke as well so...yeah, definitely not an advocate for introducing anything JAMF-related into a functioning environment.

[mc_linde]

We have been a JAMF shop for about 7 years (200-300 systems), IMO a well-managed environment works fine. We are currently looking at the JAMF/Intune integration recently announced. SCCM management of OS X is limited but worth looking into if you are a big MS shop running SCCM already. You really need to look into the Apple DEP program if you are just getting started, it's a decent foundation under the rest of the management environment. I've looked at Puppet in the past, also an option, if that's something you are familiar with.

[praving5]

CIS [0] provides various security benchmarks for automating security controls for these OSs and there are several vendors who support such CIS benchmarks including my company [1]. [0] https://www.cisecurity.org/cis-benchmarks/ [1] https://cavirin.com/.

[MarkZigadlo]

Tred lightly with Intune.  Support for ios is better than MacOS, and going down the Intune route can be hard to back out of in favor of another MDM.

Casper is a good a solution, but not cross platform.

Look at Airwatch as it can manage both MacOS and Windows equally well, and may be a better fit for a mixed environment.

[DLWilcox]

Thanks everyone for your replies... we'll be evaluating your suggestions.  Thanks again!