Microsoft System Center Mac
Nov 14, 2018 Starting today, customers with active deployments of SCEP for Mac will have the option to get ESET Endpoint Security for Mac. If you qualify, log in to the Microsoft Volume License Service Center (VLSC) to get more information. Further details are available on the download pages for the various versions of System Center Endpoint Protection. Centralized Management of Windows and Mac in Microsoft SCCM Enable Mac management beyond native Microsoft SCCM functionality to discover, enroll and manage Mac devices the same way you manage PCs. Make Mac computers first-class citizens on your corporate network by having them managed. Extract the Mac client package, Macclient.dmg, to a folder on the local disk. The default path is C:Program FilesMicrosoftSystem Center Configuration Manager for Mac client. Copy the Macclient.dmg file to a folder on the Mac computer. On the Mac computer, run Macclient.dmg to extract the files to a folder on the local disk.
-->Applies to: Configuration Manager (current branch)
Endpoint Protection manages antimalware policies and Windows Firewall security for client computers in your Configuration Manager hierarchy.
Important
You must be licensed to use Endpoint Protection to manage clients in your Configuration Manager hierarchy. Microsoft equivwlent of mac os keychain.
When you use Endpoint Protection with Configuration Manager, you have the following benefits:
- Configure antimalware policies, Windows Firewall settings, and manage Microsoft Defender Advanced Threat Protection to selected groups of computers
- Use Configuration Manager software updates to download the latest antimalware definition files to keep client computers up-to-date
- Send email notifications, use in-console monitoring, and view reports. These actions inform administrative users when malware is detected on client computers.
Beginning with Windows 10 and Windows Server 2016 computers, Windows Defender is already installed. For these operating systems, a management client for Windows Defender is installed when the Configuration Manager client installs. On Windows 8.1 and earlier computers, the Endpoint Protection client is installed with the Configuration Manager client. Windows Defender and the Endpoint Protection client have the following capabilities:
- Malware and spyware detection and remediation
- Rootkit detection and remediation
- Critical vulnerability assessment and automatic definition and engine updates
- Network vulnerability detection through Network Inspection System
- Integration with Cloud Protection Service to report malware to Microsoft. When you join this service, the Endpoint Protection client or Windows Defender downloads the latest definitions from the Malware Protection Center when unidentified malware is detected on a computer.
Note
The Endpoint Protection client can be installed on a server that runs Hyper-V and on guest virtual machines with supported operating systems. To prevent excessive CPU usage, Endpoint Protection actions have a built-in randomized delay so that protection services do not run simultaneously.
In addition, you manage Windows Firewall settings with Endpoint Protection in the Configuration Manager console.
Example scenario: Using System Center Endpoint Protection to protect computers from malware Endpoint Protection and the Windows Firewall.
Managing Malware with Endpoint Protection
Endpoint Protection in Configuration Manager allows you to create antimalware policies that contain settings for Endpoint Protection client configurations. Deploy these antimalware policies to client computers. Then monitor compliance in the Endpoint Protection Status node under Security in the Monitoring workspace. Also use Endpoint Protection reports in the Reporting node.
Additional information:
How to create and deploy antimalware policies for Endpoint Protection - Create, deploy, and monitor antimalware policies with a list of the settings that you can configure
How to monitor Endpoint Protection - Monitoring activity reports, infected client computers, and more.
How to manage antimalware policies and firewall settings for Endpoint Protection - Remediate malware found on client computers
Managing Windows Firewall with Endpoint Protection
Endpoint Protection in Configuration Manager provides basic management of the Windows Firewall on client computers. For each network profile, you can configure the following settings:
Enable or disable the Windows Firewall.
Block incoming connections, including those in the list of allowed programs.
Notify the user when Windows Firewall blocks a new program.
Note
Endpoint Protection supports managing the Windows Firewall only.
For more information, see How to create and deploy Windows Firewall policies for Endpoint Protection.
Microsoft Defender Advanced Threat Protection
Endpoint Protection manages and monitors Microsoft Defender Advanced Threat Protection (ATP), formerly known as Windows Defender ATP. The Microsoft Defender ATP service helps enterprises detect, investigate, and respond to advanced attacks on the corporate network. For more information, see Microsoft Defender Advanced Threat Protection.
Endpoint Protection Workflow
Use the following diagram to help you understand the workflow to implement Endpoint Protection in your Configuration Manager hierarchy.
Endpoint Protection Client for Mac Computers and Linux Servers
Important
Support for System Center Endpoint Protection (SCEP) for Mac and Linux (all versions) ends on December 31, 2018. Availability of new virus definitions for SCEP for Mac and SCEP for Linux may be discontinued after the end of support. For more information, see End of support blog post.
System Center Endpoint Protection includes an Endpoint Protection client for Linux and for Mac computers. These clients aren't supplied with Configuration Manager. Download the following products from the Microsoft Volume Licensing Service Center:
System Center Endpoint Protection for Mac
System Center Endpoint Protection for Linux
Note
You must be a Microsoft Volume License customer to download the Endpoint Protection installation files for Linux and the Mac.
These products can't be managed from the Configuration Manager console. A System Center Operations Manager management pack is supplied with the installation files, which allows you to manage the client for Linux.
How to get the Endpoint Protection client for Mac computers and Linux servers
Use the following steps to download the image file containing the Endpoint Protection client software and documentation for Mac computers and Linux servers.
- Sign in to the Microsoft Volume Licensing Service Center.
- Select the Downloads and Keys tab at the top of the website.
- Filter on product System Center Endpoint Protection (current branch).
- Click link to Download
- Click Continue. You should see several files, including one named: System Center Endpoint Protection (current branch - version 1606) for Linux OS and Macintosh OS Multilanguage 32/64 bit 1878 MB ISO.
- To download the file, click the arrow icon. The file name is SW_DVD5_Sys_Ctr_Endpnt_Prtctn_1606_MultiLang_-3_EptProt_Lin_Mac_MLF_X21-67050.ISO.
The January 2018 update (X21-67050) includes the following versions:
System Center Endpoint Protection for Mac 4.5.32.0 (support for macOS 10.13 High Sierra)
System Center Endpoint Protection for Linux 4.5.20.0
For more information about how to install and manage the Endpoint Protection clients for Linux and Mac computers, use the documentation that accompanies these products. This product documentation is in the Documentation folder of the .ISO file.
Parallels Mac Management v4.5 Now Available for Microsoft System Center Configuration Manager
by Yury Averkiev, Program Manager, Parallels, Inc.
Parallels Mac Management 4.5 for Microsoft System Center Configuration Manager (SCCM) empowers IT administrators and system architects, as well as CIOs, to quickly and cost-effectively extend their current Microsoft SCCM infrastructure, controlling Mac and PC computers through one interface.
Parallels Mac Management 4.5 for Microsoft SCCM is available today, introducing new features that address top customer requests.
Added Parallels Mac Management 4.5 for Microsoft SCCM Features:
- OS X patch management
- Active Directory System Discovery support
- Inventory:
- Report LDAP (organizational unit membership) of Active Directory joined Mac devices
- Report logged on users
- OS X image deployment: Implemented Capture OS X Image task sequence step
- Automatic upgrade of Parallels Mac Client
- Reporting of deployment statuses of SCCM Applications
Let’s explore the new capabilities in more detail and see how these can help you easily configure, secure, and manage your Mac devices.
OS X Patch Management
Patch management for Windows and other Microsoft products is one of the cornerstones of SCCM’s capabilities. With the release of Parallels Mac Management 4.5, we are extending SCCM’s powerful patching capabilities to Mac.
As with most of the Parallels Mac Management features, our goal is to keep the management workflow of Windows and Mac devices within one pane of glass. The new OS X patch management feature is no exception.
The SCCM administrator will see the list of available patches from Apple under the “Software Updates All Software Updates” folder:
Figure 1. List of Apple and Microsoft updates in SCCM console
The administrator will then need to create a software update group…
…and deploy it to a collection with Mac computers. It’s that simple!
Active Directory System Discovery Support
Because we are seeing more customers enrolling their Mac devices into Active Directory, we have implemented support for SCCM Active Directory System Discovery to make it extremely easy for customers to enroll Mac machines into SCCM. Just as when you enroll Windows devices with Active Directory System Discovery, you will need to configure the discovery settings and then configure the Parallels Mac Client push installation settings:
Figure 3. Parallels Mac Client push installation properties
Inventory Improvements
Parallels Mac Management 4.5 contains two very important additions to the information that Parallels Mac Client reports to SCCM:
- Reporting User Logon Information
We have added the ability to report information about users who are logged into a Mac, as well as information about network login profiles available on Mac devices:
Windows Download
- Reporting LDAP Patch of Active Directory-Joined Mac Devices
For Mac devices that are joined to Active Directory, Parallels Mac Client now reports its LDAP patch, which is shown as the Distinguished Name in the device properties:
Figure 5. Distinguished Name of an Active Directory-bound Mac
Capture OS X Image Task Sequence Step
Last year, Parallels Mac Management added support for SCCM task sequence steps, and in this latest update, we have implemented support for Capture OS X Image task sequence steps, which significantly simplifies the process of taking an image of a “golden” Mac:
Figure 6. Parallels Mac Management OS X task sequence editor
Automatic Upgrade of Parallels Mac Client
Every time a new version of Parallels Mac Management is released, it is highly recommended, and in some cases, required, to upgrade the Parallels Mac Client on managed Mac devices to the latest version. Parallels Mac Management 4.5 adds an auto-upgrade capability to the Parallels Mac Client. From now on, the process of upgrading the Parallels Mac Client is as simple as checking a box.
Figure 7. Parallels Mac Client auto-upgrade settings
Availability and Pricing
Parallels Mac Management 4.5 is available now. The pricing starts at $30 annually per Mac.
What’s Next?
We are already hard at work on the next Parallels Mac Management update. As we continue to introduce more managing capabilities for Mac devices via SCCM, we’ll share the latest updates on this blog.
Microsoft System Center Endpoint Protection Mac
Meanwhile, go ahead and try Parallels Mac Management for Microsoft SCCM and tell us via our web forum what additional Mac management capabilities you’d like to see added in future releases.