My Digital Life

Yesterday I was having a conversation with someone about the iPhone configuration utility and heard a comment asking why the iPhone allows settings to be emailed to the device.  What they meant was that if your device is un-configured it wouldn’t have any email accounts to receive the settings - a chicken and egg kinda thing.

The simple answer is for ongoing maintenance of the config.  Sure it’ll be easier to deploy an initial setup using other means - the web for example.  But if you already have iPhones out in the field email should be a good delivery method for applying changes.

One thing to consider there though is training your users not to install configuration profiles that are marked as un-trusted, or that they are not expecting.  After all, anyone can download the config utilities and email out profiles.

I just found this pretty good video on the apple site describing - at a high level - Mac integration with Active Directory. 

http://seminars.apple.com/seminarsonline/activedir/apple/

For someone from a Windows background (like me) it’s worth a look.  It’s also interesting to see the difference in style between the Apple and MS.  Given the brand personas of the two companies you’d expect the styles to be reversed, with the more friendly informal stuff coming from Cupertino rather than Redmond.  But, you can’t fault the content.

I got a Mac today.  Ok… it’s works rather than mine, but you know what I mean! :)

I’ve always been a PC kinda guy.  Not for any particular reason, I’ve just never needed to use a Mac, PC’s and Windows have always done the job.  Recently however a few things have made me look more closely at Mac’s. Some of it is personal interest (I am a geek after all), but my immediate need is for work.

Although we’ve got a few Mac users dotted around, we don’t really support Mac’s in a big way.  We’re essentially a PC house, based around Windows and Active Directory.  Over the next few years though it’s pretty clear that we’ll need to adopt and support multiple platforms - at least on the client.

So… I ordered a Mac.  It’s only a plain old Macbook, but it’s all I should really need for now.  First impressions?  I really like it.

In fact, the first impression you have of Mac is bound to be great because of the beautiful packaging.  Apple really know how to make feel good about spending your money.  Quite why the PC vendors haven’t caught onto this over the years is beyond me.

One thing that impressed me was the out-of-box-experiance, that’s in the desktop deployment sense, the initial setup and config.  As one of the first things to be configured is the networking, the OOBE was able to go onto the net to get the latest up to date setup.  Or at least I assume it does as I was asked to join Mobile Me, and I’m pretty sure this Mac was built long before it’s release last week.

With regards to the hardware itself, it’s as pretty as a Mac should be.  Nice and shiny white.  The keyboard is fantastic - much nicer than the ones on my Lenovo or old HP laptops.  Although having said that I’m still getting used to the different layout and shortcuts (no del key?!?) but I’m sure all that will come in time.

Tomorrow I’ll start looking at how I go about integrating this new toy into our MS environment.  From what I’ve read and planned, basic integration won’t be too tricky, but I want to do it myself to be sure.  Then I’ll start looking at the basic applications.  First on my list will be Office 2008, like it or loath it businesses run on Office, especially exchange.  I’ll also need to take a good look at AV/Malware tools and print drivers etc.  Should be fun :)

Oh… and I’m already missing Live Writer.  What a great little app MS have there.

Apple have just released the new configuration utilities for the new iPhones.  As I covered a few weeks ago, these will allow enterprises to develop specific configuration files for iPhones within their infrastructures.  It’s a very welcome move, like many businesses I’ve certainly seen a number of business requests for iPhones and the prospect of managing another platform could have been quite daunting.

iPhone Web Configuration Utility for Mac
iPhone Web Configuration Utility for Windows
iPhone Configuration Utility 1.0 Mac OS X

Each of these tools will allow you to create xml configuration files that can be either emailed to the devices or opened from the web browser.  The Configuration Utility 1.0 however can also track and install provisioning profiles and authorized applications, and capture device information including console logs.

Yesterday I got a HTC Touch Diamond to play with for a few days.  I’ve been wanting to see one in the flesh for a while, partly because I need a new phone, and partly because we’re a Windows Mobile house here and with the 3G iPhone looming we’re thinking hard about future direction.

The Diamond… well it’s a sight to behold.   The phone itself is tiny, with sharp styling and is very lightweight.  One comment I heard yesterday was that it makes any phone you sit it next to look 10 years old.  I like the look of it a lot.  The rear surface (as you’ve probably seen in photos) isn’t flat, it has slightly raised jagged pattern that makes it look like it’s been cut from stone, or well… diamond.

The small size of the device poses some interesting question.  Previously WM Smartphones used to be the smaller option, sacrificing the touch screen for a smaller footprint.  Now however, this full WM device with all the GPS and stuff is small enough that it doesn’t matter.  I’m not sure what future the Smartphone OS has if devices are now this small.

Powering the thing up, the first think I noticed was the quality of the screen, off hand I’m not sure what the resolution is, but I’ve seen desktop LCD monitors with worse picture quality, it’s very very good.  This allows the interface to use small, sharp fonts without them being hard to see or use. 

The main ‘home screen’ interface is miles ahead of any other Windows Mobile phone I’ve used (and that’s quite a few!).  At the bottom there’s a scroll bar of buttons for the main functions (contacts, photos, music, settings etc) that is easy to use and and quite intu itive once you realise it’s there.  You just move your finger across the screen until you reach what you want, for example photos, the bulk of the screen is used to show previews that you can then scroll through.  It’s all great looking and reasonably well thought out.

In fact, in terms of the user interface I’d say the worst thing was the underlying Windows OS.  Once you find a function or task that isn’t covered by the HTC installed user interface, the jolt of going back to the old Windows Mobile interface is quite shocking.  I’ve always got on quite well with WM before, but the Diamond really does highlight that MS need to start concentrating on the ‘Mobile’ part of their OS not the ‘Windows’ part.  The normal windows like GUI just doesn’t cut it in the mobile space anymore.

Would I buy one?  Not sure… If there wasn’t a 3G iPhone just days away then yes, without a doubt.  As it is I’ll wait and see.

Following it’s announcement on Monday I think its fair to say that the 3G iPhone has stirred up quite a bit of interest with people.  And rightly so I believe.

In preparation for the inevitable requests from people out in our business I thought I would do a little digging into what Enterprise support Apple have built in this time round. 

With the original iPhone business users were pretty much ignored.  There was no real support for businesses, even to the point were (in the UK at least) you had to be an individual to buy one - it was available on personal contracts only, there were no businesses tariffs at all.

Here’s a few notes on what I found in case it’s useful:

Exchange Support
Apple have licensed Exchange ActiveSync from Microsoft so can connect directly to exchange for push email, calendars and contacts.  Providing you already have Exchange (2003 or 2007) adding iPhone support should be trivial.  From the device perspective it shouldn’t be any different to setting up a Windows Smartphone.

In addition to messaging support, the iPhone now also supports ActiveSync security policies for:

- Remote wipe
- Password Enforcement
- Forcing password complexity
- Forcing alphanumeric passwords
- Specifying password length
- Defining inactivity times before the phone ‘locks’

These are increasingly important to business, especially with the current media attention on data loss and privacy.

Device Configuration
To help reduce the support overhead of deploying smartphones companies (us included) often make arrangements to have company specific settings applied by some for of automated process.  This is so that end users can be up and running as soon as possible when, and hopefully ensure everything is set up correctly avoiding extra support calls etc.

For the iPhone 2.0 software apple has built in support for remote deployment of configuration using either email or a website.

You use an iPhone Configuration Utility to build up a preferred config, and then export that setup as an XML config file.  That file can then be:

- hosted on a website that users can browse to
- Emailed to the user as an attachment

In both cases the end user will need to open or run the attachment/file.  During the installation they will be prompted for any additional information needed such as passwords.

it would have been nice to have seen some support for over-the-air config like Windows Smartphones, but its a pretty good solution nonetheless.

Within the configuration utility you can configure:

- Exchange settings (server, domain, account etc)
- Wireless settings (network, authentication etc)
- VPN Settings (server, account, passwords, groups, proxies etc)
- Password policy (complexity, attempts, length, age, timeout (etc)
- Email settings (POP, IMAP, servers, accounts etc)
- Certificates (Deploy PKCS1 and PKCS12 certs)
- Policy and Restrictions (Control 3rd party apps, iTunes, content etc)

The device also allows these settings to be signed so that you can be sure they are from your company and not a rouge source.  This might be particularly important.

Virtual Private Networks
iPhone 2.0 now has built in support most of the common VPN protocols:

- PPTP
- L2TP/IPSec
- Cisco IPSec

and authentication methods:

- MS-CHAPv2 (standard passwords)
- RSA SecureID
- CRYPTOCard
- Certificates (PKCS1 and PKCS12)
- Shared Secret

The settings for both can be deployed using the Configuration Utility described above.

Wireless
The iPhone now supports the following wireless security protocols:

- WEP
- WPA Personal
- WPA Enterprise
- WPA2 Personal
- WPA2 Enterprise

It also supports the following 802.1x authentication protocols:

- EAP-TLS
- EAP-TTLS
- EAP-FAST
- PEAPv0 (EAP-MSCHAPv2)
- PEAPv1 (EAP-GTC)
- LEAP

All of these can be setup with an configuration profile and applied using the Configuration utility over email or the web.

IMAP Mail
For organisations not using Exchange the iPhone provides support for IMAP so should be able to access more or less any email system that allows it.  Within this is support for encryption and X.509 root certificates. 

There also appears to be some support for enterprise application distribution, but I’ve not found too much info about that yet so will probably add some more info on this later.

Overall I think apple has done a good job here.  It’s hard to say for sure without having an iPhone to test with, but for now it looks like it supports most of the things we currently look to do with our Windows Smartphones.  Perhaps its not quite as much as we’d look to do if implementing something like Mobile Device Manager or B2M’s mProdigy, and I’d like to see support for data encryption, but it’s a great start an should make the lives of Enterprise IT departments quite a bit easier.  They might not become preferred device’ within companies, but there’s certainly no major reasons why they shouldn’t exist happily within the Enterprise any more.

The big question for me at the moment is how O2 will see them to business customers and what costs will be involved - especially for customers with existing contracts and data agreements.

Apologies for this post, I’m writing it to collect together my own thoughts so it’ll probably be even more disjointed than usual!

So… we’re more or less a Microsoft shop here.  We run a standardised Windows XP desktop supported by Active Directory, Systems Management Server (SMS) and a host of Windows based application services.  This is all managed by a pretty skilled operations team and support by a decent service desk and desktop support organisation.  In summary pretty much all the technology and skill is Windows/PC focused.

We’re now seeing an increasing demand for Mac desktops and laptops, especially from the design community.   I need to work out what the impact of adopting a multi-platform desktop fleet will be both technically and from a service management perspective.

I no particular order I reckon I’ll need to consider the following to some degree or another.  It’s probably worth noting here that some of this may have obvious solutions, but I’ve no really experience of Macs - looking forward to learning though!

Software Delivery
Any computer is pretty much useless unless you have applications to run on it, so this is a fairly important point.  At the moment we have fairly robust software delivery and asset management.  End users request an application through a web ’shop’ and the software gets delivered through SMS onto their computer. 

How will this work with Mac’s?  We don’t really want to go back to a word where we’re handing out CD’s - the asset management of that is too hard.  So from a technology perspective we’ll need some way delivering the applications. 

That will include amendments to our shop front so that people can select between PC and Mac versions of Applications, and also the actual delivery solution.  Given that for now the Mac user base is likely to be much smaller than the PC base, it would seem to make sense to try and use SMS rather than adopt a new system - we already know and use SMS.  it looks like there are a few solutions out there to achieve this.

Applying Policy
There are certain company policies and configuration that we have to apply to our corporate desktops - proxy server settings for example.  Within the Windows world we use AD Group Policy to achieve this.  How do I go about doing this with Mac’s?  Again, there appear to be tools out there which help.

Patching
This is where my ignorance of Mac’s starts to show… :)  Now I understand that Apple runs a Software Update service, and that from the client you can select which updates to install, which to hide etc.  What I’m not sure about at the moment is whether there is a WSUS equivalent that will allow an organisation to administratively select and schedule updates from a central point.   It’s possible the software delivery solution will deal with this, but for now I’m not sure.

Desktop Support
Speaking to friends at other companies that support Mac’s it would seem that although Mac’s require less overall support than a PC, the hardware does tend to fail more regularly.  Whether this is true I’ll wait and see (flame suite on none the less…). 

In either case there’s a skills gap here as we don’t currently have any Mac support skills in-house.  Potentially this might mean we could bring someone in to help, at least in the short-medium term to get us over the initial learning curve.  It’s something we would need to address fairly early on in order to provide a decent level of service.

With hardware support the likes of HP and Lenovo have hoards of guys just waiting to warranty repair faulty kit.  The impression I get so far is that the same isn’t likely to be true with Apple.  Potentially that means we’ll have to have Mac’s in stock and on-site to replace faulty units quickly whilst repairs are organised out of band.

SharePoint Compatibility
We use SharePoint to deliver our intranet and provide the usual team and project workspaces, so compatibility with this and the workflow and applications built on it is pretty important.  This will probably drive which browsers we provide, but may also have lower level implications.

Exchange Compatibility
As with the SharePoint item above, corporate email is provided through Exchange so compatibility is critical.  I’ve not looked into this yet, but I’m guessing there will be some fairly well established solutions available.

Remote Access
Within our PC platform, remote access is provided though a Cisco based VPN solution.  Although some services are also available of web based interfaces, compatibility with this VPN solution will be important for mobile and remote users.

Looking through the Cisco site it looks like there is a client available so hopefully this shouldn’t be a problem.

Authentication
All authentication is provided though Active Directory.  All users have accounts within AD, and where ever possible applications use Windows integrated authentication for sign-on.  To provide an integrated service to the Mac users i think its important that this can be maintained as far as possible - nothing worse than log on prompts interrupting your work!

There’s lots of decent information on this on the Apple site, so pending me reading through it all I’m not too worried about getting this working.

I was just catching up on what’s been happening on twitter this afternoon and I noticed that Jemima posted an article on the Guardian about Apple and its (non-)moves into the Enterprise space.

I’ll let you read the post yourself (Jemima’s stuff is always worth reading), but the gist of the story is that Apple are now moving into the enterprise without even trying.

For years Apple has deliberately ignored the corporate world.  The enterprise just isn’t where Big Steve wants the company to be.    He’s concentrated on home consumers and the education market.  That’s fair enough, I can see why.

The thing is… over the past few years Apple has pulled of something quite remarkable.  It changed the world.  It made computers, or more specifically it’s computers, cool.  Not just geeky cool, but mainstream cool. 

Combine this with Apples focus on education, offering cheap Macs to students and faculty, and the enterprise space is now seeing a huge influx of talent and skills that are expecting to find a Mac on their desk at the office.

Now I fully expect Steve to take credit for this master plan at some point, whether it was a plan or not who knows, only him I guess.  But what this means for me is that I need to start shifting IT infrastructure to a multi-platform model. 

Now I think this is fantastic.  After all, IS organisations are there to make the business more productive.  But For IT departments that have spent the last 10 years standardising and streamlining their platforms the prospect of adopting a whole new set of management systems isn’t that attractive.

It’s here that Apples indifference to the enterprise world begins to show.

Microsoft, for all its faults, gets Enterprise computing.  Really gets it.  It knows how IT works in big business and creates tools to help make IT organisations more effective.  So do a whole bunch of other companies who specialise in  deploying, managing, patching and securing large PC based environments. 

This ecosystem doesn’t really exist in the Mac world - or at least not to the same extent.  There are definitely tools out there, but for the most part they are pretty bespoke to Mac’s.  They need tools and skills that otherwise don’t exist in a PC environment.  Supporting both the Windows and Mac platforms therefore has the potential to increase overall costs. 

Help is at hand however, and we end up with a rather strange situation where the ecosystem that supports the current PC focused enterprise is possibly better placed to simplify the adoption of Mac than Apple is. 

You can already see this happening, people like Quest and other members of the SMSAlliance provide extensions for System Centre Configuration Manager and other management suites.  LANDesk and Altiris are continually adding to their own support for Macs.  Microsoft themselves recently released Messenger for Mac 7 that built in support for Office Communications Server. 

Hopefully with all this increased support enterprises can start to adopt Mac’s without having to drastically rework their internal systems and processes.  Big companies are already starting the move (here and here).  It’ll certainly make my life easier!  I wonder if Big Steve really did have a master plan?

I’ve just been reading over on Johann Kruse’s blog that Messenger for Mac 7 has been released.  I guess for most people the big news for most people will be the usual Live Messenger support, but if you’re an Enterprise IT guy like me its the Office Communication Server (OCS)support that’s interesting.

One of the challenges I’ve got at work at the moment is how best to integrate Macs into our (mostly) Windows environment.  Before we tackle the big problems we’re focusing on providing access to our basic services - email, file and IM. 

At the the moment we’re using Live Communication Server rather than OCS, but hopefully we’ll be moving to OCS over the next year or so.  One of the big drivers for that migration is OCS’s multi-party audio and video conferencing.  Having a Mac client that supports this is a huge bonus.

Maybe it’s time I got myself a Mac of my own.

Working for a company that does significant amounts of design work, being a ‘Microsoft house’ can cause our users some headaches.  Although the design guys all love their mac’s, as an IT group traditionally it’s been hard for us support them and integrate them into the rest of our environment.  There are plenty of aspects to this problem and it’s something I’ll be writing about more over the coming months.  For now though, lets just say its an area that we know we can do better in.

It was with great interest then that I read this post over on RoughlyDrafted about IBM’s own testing and pilot project for Mac’s.  I imagine that IBM’s drivers are much the same our own, end user demand being weighed against a business driver for IT cheaper IT services - and hence an standardised environment.  Not something you’d currently want - or be able - to do with Apple, multi-platform has to be the way forward.

The article is perhaps a little over-zealous, there are huge challenges in providing multi-platform IS services and still being cost effective, but I’ll be watching this with interest.  I think I’ll be calling in my IBM account guys for a chat soon.

Anyone else out there do similar work or running both platform in a big way?