Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Installing Remote Desktop
Now let’s get to the meat of this article: how to plan a Remote Desktop installation. Apple Remote Desktop essentially consists of two components: the client software that is built into Mac OS X and the Remote Desktop application that is installed on computers that will be used to manage remote workstations. Configuring a Remote Desktop environment requires first installing the Remote Desktop application on at least one management workstation and designating a task server for the network. Then, it requires configuring the Remote Desktop client on each workstation that will be managed. However, there are also several points to understand about how Remote Desktop works that can help ease its installation and configuration, as discussed in the following sections.
System Requirements
The Remote Desktop administrator application can be installed on any Mac running Mac OS X (or Mac OS X Server) 10.3.9 or higher. However, Tiger-specific features will function only on Macs running Mac OS X 10.4 or higher. Likewise, the Remote Desktop 3 client software can be installed only on computers running Mac OS X (or Mac OS X Server) 10.3.9 or higher, and requires Mac OS X 10.4 or higher to support Tiger-specific features such as Spotlight searching. The Remote Desktop administrator application can be used to upgrade the client software of workstations (either directly or by creating upgrade installer packages).
The Remote Desktop administration application can be used to manage workstations that have the Remote Desktop client version 2.2 installed, but many features are limited because of the changes made to Remote Desktop. The only features supported when managing older clients are observe and control.
Planning Task Server Infrastructure
Before we begin talking about specific installation procedures, let’s take a minute to discuss the use of task servers in a network. Users familiar with previous versions of Apple Remote Desktop know that each computer on which the Remote Desktop application was installed were referred to as administrator computers and that each one sent commands and files directly to managed workstations. However, when configuring the Remote Desktop application, you could configure one administrator computer to store the Remote Desktop reports database for the entire network (which cut down on reporting traffic by allowing workstations access to a centralized database).
In Apple Remote Desktop 3, this concept of administrator computers sharing a central server has been greatly expanded to include task servers. A task server is a computer that has the Remote Desktop application installed on it and that continues to retain a reports database that is shared between computers on which the Remote Desktop application is installed. However, it goes a step further in that the task server is used to store management actions, enabling them to be run at a point when the computer from which they were issued is not in use (or when the user who issued them is no longer logged in). This alone makes task servers a powerful feature. However, by pairing that with the Install Packages feature that already existed in Remote Desktop, Apple has created a feature called Auto-Install, which enables packages and the related install commands to be stored on a task server and held until the specified computers become available. This is excellent for deploying to portable computers that might be off the network when an install command is issued as well as for workstations that might simply be powered off at the time.
Because Apple Remote Desktop can be installed on servers as well as workstations, you can designate a Mac OS X Server that has greater resources than an individual workstation (and that is always online) as a task server in your network. This significantly improves on the concept of administrator computers. For larger networks, you can designate multiple task servers based on proximity to managed workstations throughout your network. When you run a task from Remote Desktop 3, you are asked whether to run it from a task server in your network or from the computer on which you are issuing the command.
How Remote Desktop Relies on User Accounts
Apple Remote Desktop relies on user accounts to determine the level of access that is granted to remote administrators (those people who log in to a workstation and launch the Remote Desktop application). At the simplest level, these are local user accounts on the client computers. Each local user account can be granted permission to use certain Remote Desktop features. When remote administrators add the client computer to their Remote Desktop configuration, they must authenticate with the username and password of a local user account on that workstation that has Remote Desktop privileges. The privileges granted to the account they authenticate using determines the features of Remote Desktop that they will be able to use. Following is a list of the privilege levels and features enabled by each of them.
|
Remote Desktop Privilege |
Commands that Require this Privilege |
|
Generate reports |
All report functions |
|
Open and quit applications |
Open Applications, Open Items, Log Out Current User |
|
Change settings |
Set Startup Disk, Rename Computer |
|
Delete and replace items |
Copy Items (if overwriting existing files), Install Packages, Empty Trash, Upgrade Client Software |
|
Send text messages |
Send Message, Chat |
|
Restart and shut down |
Sleep, Wake, Restart, Shut Down, Log Out, Current User |
|
Copy items |
Copy Items, Install Packages, Change Settings, Upgrade Client Software |
|
Observe |
Observe |
|
Control |
Control, Share Screen, Lock/Unlock Screens, Change Settings |
When configuring the Remote Desktop client, you can choose to use existing local user accounts or to create new ones specifically designed for Remote Desktop use (which is generally the better approach). You can also make these limited access accounts that have limited control over the workstation if they are used for local login for an added level of security. We’ll get to how to configure these accounts in a bit.
If you are using a directory services environment with network user accounts, you also have the option of creating user groups that designate Remote Desktop privileges. This can be done whether your directory services are provided by Open Directory under Mac OS X Server or Active Directory under Windows server. As long as the administrative workstations, the client workstations, and any task servers are bound to the same domain, you can use groups to grant Remote Desktop privileges instead of local user accounts. When you do this, simply add the network users that you want to have access to Remote Desktop features to the appropriate groups and use the Create Client Installer or Change Client Settings features of Remote Desktop (discussed later in this article) to enable directory services administration groups. Those users can then authenticate using their network username and password when adding client computers to their Remote Desktop configuration. The following table shows the various Remote Desktop group names and the privileges that each enables.
|
Directory Domain Group |
Remote Desktop Privileges Granted to Members |
|
ard_admin |
All privileges with the exception of Generate Reports |
|
ard_reports |
Generate Reports |
|
ard_manage |
All privileges with the exception of Observe and Control |
|
ard_interact |
Observe, Control, Send Text Message |
Installing the Remote Desktop Application
Installing the Remote Desktop application is a fairly straightforward process. Like any other Mac OS X application, simply double-click the installer package and let it do its thing. This will upgrade the Remote Desktop client on the workstation and install the Remote Desktop administrator application as well as the Remote Desktop Dashboard widget. The first time you launch the Remote Desktop application, it will ask you to supply a valid serial number and a Remote Desktop password.
The Remote Desktop password is somewhat new in Remote Desktop 3. Whereas older versions relied on a password for generating encryption keys, in this version the password is used as an added security feature for access to the Remote Desktop application. Because any user who can log in can launch the Remote Desktop application, requiring that the password be entered prevents unauthorized access to the application. However, the password can also be stored in the keychain of authorized users for their convenience. The password is also used for encrypting the usernames and passwords for Remote Desktop user accounts when adding them to a Remote Desktop configuration. As such, you should use as secure a password as possible.
Remote Desktop then asks you whether there is a designated task server within your network or if you want to designate the computer you are using as a task server. It also offers you the option of creating the default data collection scope and time. This tells a task server what report data to routinely collect from managed workstations and how often to collect that data. (This is discussed in more detail in Part 4 of this series.) After this information is provided, the install process is complete, and you are presented with Remote Desktop’s main window.