Why 'no Macs' is no longer a defensible IT strategy

More users are demanding Macs in the enterprise. Thanks to key computing shifts, supporting their appetite for Apple is now a straightforward option for IT

Once confined to marketing departments and media companies, the Mac is spilling over into a wider array of business environments, thanks to the confluence of a number of computing trends, not the least among them a rising tide of end-user affinity for the Apple experience.

Luckily for IT, many of those same trends are making it easier for tech departments to say yes to the Mac by facilitating IT's ability to provide enterprise-grade Mac management and support.

"We're seeing more requests outside of creative services to switch to Macs from PCs," notes David Plavin, operations manager for Mac systems engineering at the US IT division of Publicis Groupe, a global advertising conglomerate. There are so many requests that Plavin now supports 2,500 Macs across the US -- nearly a quarter of all Publicis' US PCs.

And Plavin is less of an anomaly than you might think. Buoyed by increased interest in the consumer arena, Macs are cropping up in more and more organizations, in large part because end-users are pushing for them.

According to NPD Research, Apple's share of the retail market has climbed to 14 per cent as of February 2008. Gartner and IDC report that the Mac's share in the US as of March 31 was 6.6 per cent. Alongside that home-based shift from PC to Mac is a significant uptake for Apple among businesses, as Forrester estimates organizational Mac adoption tripled last year to 4.2 per cent, mainly on the backs of enthusiasts seeking approval for Apple's silver boxes in small workgroups.

Perhaps a better barometer of the trend is the effect increased Mac sales are having at outsourcing firms, which have traditionally been reluctant to support the platform due to a perceived lack of market in the past.

Centerbeam, a Windows management outsourcer for midsize businesses, is one such outsourcer eyeing the possibility of extending its services to cover the Mac, says Karen Hayward, Centerbeam's executive vice president. Security firm Kapersky Labs has already created a Mac version of its anti-virus software for release should Mac growth continue (and the Mac thus finds itself prey to more hackers), while Boingo Wireless, a Wi-Fi hotspot federator, is developing a Mac client to allow Mac users to tap into the Boingo network.

Couple this increasing attention to services with the falling away of another knock on the Mac, price, and you can see why even the federal government -- which has pockets of Mac users in a diverse set of agencies, including NASA, the US Army, and the National Institute for Standards and Technology -- is prepping for increased use of Macs in business environments, having put together an official guide to implementing Mac security to conform to federal requirements.

After all, as Publicis' Plavin notes, Macs -- which cost the same as equivalently configured business-class PCs -- are cheaper to support because they are easier to support. And when it comes to diverting IT resources toward competitive advantage, doesn't ease of support sound compelling?

Page Break

What has changed to make the Mac fit better

IT can embrace that Mac momentum, not just tolerate it, thanks to several shifts in computing that make the Mac a better enterprise fit than in the past -- first and foremost being a rising threat to Microsoft's other mainstay in the enterprise desktop environment, Internet Explorer.

Firefox, which has risen in popularity to account for 16.8 per cent of browser use on the Web, according to Net Applications, as of December 2007, has broken IE's stranglehold on Internet app delivery, which it had maintained through ActiveX controls. Because Microsoft never released a version of IE for Mac OS X, Mac users were frozen out of ActiveX-based Web sites, making many SaaS (software as a service) offerings and enterprise-app Web clients off limits to the Mac.

But to ensure operability on Firefox, developers had to configure their wares to support Java instead of or in addition to ActiveX -- with Mac gaining compatibility as a client at the same time.

WebEx is one of the more notorious examples of this switch. The popular Web conferencing tool became fully Mac-compatible only last month, as new owner Cisco Systems decided to abandon an ActiveX-only deployment strategy and add both Java and Mac-client options. (Until then, ReadyTalk and Adobe Connect were two of the few Mac-friendly Web conferencing tools, notes Peter Lincoln, IT director at temp-staff agency Aquent.)

Of course, not everyone is hip to the Java-based Firefox push. Many of MSN's excellent tools require Microsoft's browser due to the use of ActiveX, as do the support tools at a variety of companies with heterogeneous customers, including Seagate and AT&T.

Still, many other vendors have avoided ActiveX dependency and the customer exclusion that results. Those options have driven vendor choices in environments where heterogeneity is the norm, such as at college campuses. Southern Polytechnic State University, for example, chose Juniper Networks' wireless VPN tool mainly because it didn't require a client on user devices, nor limit itself to ActiveX for on-the-fly client provisioning, which would have excluded the large number of Macs that students and faculty use on campus, says CIO Bill Gruzka.

The rise of Web-based computing

Another trend facilitating Mac use in business is the increased enterprise dependecy on SaaS, wherein a diverse array of applications -- from sales-force automation through supply-chain coordination -- is delivered through the browser. Most SaaS applications have not relied on ActiveX, given SaaS' inherent goal of making apps available to anyone, anywhere. This push toward platform agnosticism translates to the use of standards, letting the Mac right in. Ted Elliott, CEO of recruiting software provider Jobscience, says he has noted a rise in Mac customers now that Jobscience has moved to the SaaS model -- customers his platform supports out of the box.

Beyond Firefox and SaaS, many enterprise app developers have adopted the Web as a portal to their apps, following the strong Web-portal drive of the late 1990s.

"The trend in the enterprise is to Web-enabled apps," notes Ezra Gottheil, an analyst at Technology Business Research. Thus, a Mac user can access Oracle or SAP ERP apps over the Web, regardless of whether there is a Mac-specific client available. Even Microsoft takes this approach to provide Mac compatibility in its SharePoint collaboration environment, which its Mac Office tools don't directly support. (More on Microsoft later.)

Mac-heavy organizations tend toward Web-based apps rather than packaged ones because of Mac compatibility issues, says IT director Lincoln. That's precisely what happened at his company, Aquent. Almost everything is hosted or available as a SaaS application, including sales-force management, ERP, Web conferencing, and anti-malware apps. Aquent's packaged apps are largely limited to Office, e-mail clients, and Web browsers.

Page Break

Many mainstay, client-installed business apps -- Microsoft Office, IBM's Lotus Notes, Intuit QuickBooks, and the open source EnterpriseDB, for example -- come in mostly compatible Mac versions. And, of course, creative apps such as Adobe Creative Suite and QuarkXPress have long been cross-platform. But many of these, especially enterprise apps, "are late on the Mac and aren't as elegant as their Windows versions," says analyst Gottheil.

Compatibility: Physical and virtual

The rise of virutalization, as well as Apple's shift toward standardized PC components, has also helped pave the way for Mac use in business.

First Parallels Desktop, then EMC's VMware Fusion, enabled Apple's Intel-based Macs to run honest-to-goodness Windows, not just in a separate boot volume (Apple offered that capability a couple years ago with its free BootCamp utility) but within the Mac OS environment. Users can now run Windows-only apps in the Mac OS, or in a separate window if they prefer, with cut-and-paste, shared directories, and shared hardware access. Armed with virtual machines such as these, Mac users can access the full array of applications available to their Windows-based brethren.

And thanks to the Mac's move to standard PC components, such as Intel processors, USB ports, Ethernet ports, and 802.11 wireless capabilities, such compatibility uses are falling by the wayside. As late as the mid-1990s, Macs included a series of proprietary connections, such as LocalTalk and ADB, and tapped SCSI drive interface technology found only on high-performance PCs. This hardware divide complicated not only IT work but also application development. Most of these hardware issues have been rectified, leaving just a few special keyboard keys to map between Windows and Mac OS when developing cross-platform apps.

Managing Macs in the enterprise

If you concede that your Mac users can run any software they need, either directly or via a VM, you may raise an old IT canard: manageability.

It may surprise you that Mac OS X Server and the separate Apple Remote Desktop software have for a decade facilitated Mac management, providing functionality akin to any Windows-oriented management tool. Developed for Apple's education market, these tools allow you to manage OS updates and app installations and upgrades. With Apple's Automator tool, you can automate much of the management workflows, essentially by creating executable scripts. You can also configure your Macs to boot into a network volume, to cope with drive failure, or to provide visiting employees or guests a nonlocal copy of the OS.

Apple Remote Desktop also allows you to control a user's PC for troubleshooting and technical support, as well as inventory the Macs. And Apple doesn't charge a per-client license for the software, just US$500 per copy installed on your administrators' Macs, supporting an unlimited number of clients. (You can also manage Windows and Linux clients using Apple Remote Desktop's VNC support.)

If you don't want an Apple-owned tool, consider FileWave's cross-platform management tools, recommends Publicis' Plavin. Or the cross-platform Client Management Suite from Symantec's Altiris unit, suggests Aquent's Lincoln.

For managing users, access control, and related security policies, Mac OS X Server's Open Directory works with Microsoft's ActiveDirectory, so you can apply ActiveDirectory permissions to and enforce policies on your Mac users and Mac-based file shares from ActiveDirectory. Or you can manage them from OpenDirectory, such as when you have a separate Mac workgroup whose initial policies you want to inherit from ActiveDirectory but then customize for that workgroup in Open Directory. Apple says it supports every one of Microsoft's ActiveDirectory services.

Page Break

End-user controls in Mac OS X Server are similar to those of Windows management tools: You can restrict users from burning discs, mounting external hard drives, or running unauthorized applications. It also supports laptops' disconnected state, ensuring that settings, configurations, and policies are maintained before network access is granted when a user reconnects.

For organizations not tied to ActiveDirectory, Open Directory also integrates with standard LDAP directory services such as Novell's eDirectory, Sun's Java Enterprise Directory Server, and IBM's Directory Server.

For backup and disaster recovery, you can use Mac OS X Server's tools or any of several established enterprise systems, including those from Atempo, BakBone, EMC, IBM's Tivoli unit, Legato Systems and Symantec's Veritas unit. These all have Mac clients but manage the data from Windows systems. For Mac-based server management (of Mac and Windows clients), the most established option is Retrospect from EMC's Dantz unit. For Mac-only businesses or workgroups, analyst Gottheil suggests Apple's Time Machine running on Mac OS X Server or Apple's Time Capsule appliance as an easy-to-administer backup and recovery tool.

Although Mac management tools are less costly than per-client Windows ones, analyst Gottheil does note that there is a price associated with having IT staff "speak two languages" when supporting two platforms. That is one reason Macs tend to be more prevalent in small businesses, where it is easier to go all-Mac, or in workgroups within an enterprise, where the Mac IT experts do not also have to be Windows experts. Publicis' Plavin recommends that Macs crossing departmental or geographic boundaries be assigned to Mac specialists, to reduce knowledge overhead.

Another IT myth is that Apple provides no enterprise-class support. That's simply not true, notes Plavin. Apple's AppleCare program provides on-site support, as well as telephone support, he notes, although he concedes that perhaps because his operations are based in New York, Apple technicians may be more likely to come in than if he were in a smaller city or town.

Microsoft: The elephant in the room

Perhaps the most frustrating aspect of supporting Macs in a business environment resides in Microsoft's less-than-fervent embrace of the platform. Macs are by no means frozen out from the powerful and popular Microsoft Office productivity suite. In fact, thanks to Microsoft, Mac users can run Word, Excel, PowerPoint, and Outlook (called Entourage on the Mac) on their machines. This is crucial in heterogeneous environments, as it allows users to share business files and participate in the same e-mail, contact management, and calendaring system as their PC cohorts.

Yet Microsoft releases Mac Office a year after Windows Office, forcing dual-platform businesses to wait a year before rolling out an Office upgrade. Moreover, the Mac version of Office is never quite the same as the Windows version, in ways that add irritation to both IT and users. For example, display incompatibilities -- due to differing graphics engines -- have meant that Office drawing and art tools do not produce the same visuals on both platforms. (Microsoft brags that Office 2008 fixes this problem.)

Page Break

What Mac Office 2008 lacks, however, is support for Microsoft's VBscript, on which most serious Excel financial spreadsheets depend. Mac users can see the spreadsheets' data, but not work with them. The reason, says Amanda Lefebvre, senior marketing manager of the Mac business unit at Microsoft, is that it would have taken two years to port the VBscript engine from the PowerPC code base (PowerPC was the IBM CPU family Apple had used for about a decade before switching to Intel two years ago) to the Intel code base. So Apple dropped this key feature to minimize the delay between the two releases. Mac users can use AppleScript and Apple's Automator script manager, but Lefebvre concedes this general-purpose scripting language can't duplicate VBscript's Office-specific capabilities. This compatibility issue is why Publicis Groupe is sticking with Office 2003 and 2004. "It's a major issue," Plavin says.

Lefebvre says Microsoft isn't ruling out a future port of VBscript to the Intel Mac platform, although she did not comment on whether Microsoft would consider a platform-neutral scripting approach such as JavaScript, as Adobe did three years ago.

Also missing from Mac Office 2008 is a filter for Office 2004 to read the new Office 2007/2008 file formats; a beta version is now available, but a final version is expected this summer. The filter for Office XP (2002) users was not so delayed.

Excel 2008 carries with it several limits on spreadsheet size that Excel 2003 had but the Windows versions do not. And Mac Office 2008 contains no native compatibility with Microsoft's well-regarded SharePoint collaboration tools. Mac users must use a browser to access SharePoint. But they can use Microsoft's instant messaging server, as well as check documents in and out, notes Andy Ruff, lead program manager for Mac Office.

A saving grace for many Mac users is that they use just the basic Office features, given that most spend their days using graphics, layout, and Web development applications, Plavin says. So most of the issues that a financial jockey or report jockey might encounter just don't come up -- but he notes that as the Macs move beyond the graphics department, these issues will come up more and more.

For some, this may mean a move to the open source OpenOffice, which provides a viable cross-platform substitute for Microsoft Office. Of course, when it comes to cross-platform communications systems, choice increases. IBM's Lotus Notes and a host of small players such as Now Software (for just calendaring and contact management), Kerio and POP3- or IMAP-based e-mail systems using clients such as Mozilla Thunderbird are all worth considering, especially for those who have found Microsoft's Entourage e-mail client not without its frustrations, as Aquent's Lincoln has.

"It continues to be buggy and inefficient -- and it offers a subset of features when compared to Outlook," Lincoln says. But he does concede that Entourage is far superior to the last version of Lotus Notes that he examined, whose Mac client treated e-mail as flat HTML pages -- "ridiculous," he says.

Close, not equal

It would be naive to take in the Mac under the illusion of it being an equal player. It is not, as the various Microsoft issues and the ongoing need for VMs to run Windows-only software from a variety of vendors still attest.

But the Mac fits much better than it ever has, and the trend toward cloud computing is reducing the importance of the client platform to access both internal and external resources. Mac manageability is on par with Windows standards. So you can let your users choose the equipment they prefer, without undue worry.

And maybe you can even get a MacBook Pro of your own.