User Management
The one thing that's clear about Windows 7, and previous versions of Windows, is that it's designed to be used in corporate environments and managed centrally. Add a Windows 7 computer to a domain and the administrators can completely lock it down using the Group Policy Editor, centrally manage permissions to network resources and even remote install software.
If you want to lock down your client versions of Lion, you'll need the Server edition of 10.7 and its Profile Manager feature.
In its default state, domain users only have restricted use of the computer that prevents them from messing with settings and installing new applications. It's a reliable and rugged system that's been refined and developed over the years.
Windows allows for some flexibility in the way it works. Domain users can be added to the local administrators group of a PC. This way, a user can be given rights to their own computer, but prevented from logging on to another computer and changing settings and installing applications on that computer. With Windows Server 2008, updates to the OS can be downloaded centrally and distributed over the network, saving bandwidth in the process.
By comparison, while Apple computers can be added to a Windows domain, there's not the same level of control that you get with a Windows computer. Domain users can be restricted in what they can do, but security isn't as good as with Windows. So, a restricted user may not be able to install an app to the Applications folder, but they can usually just drag and drop an application package into a folder they do have access to - completely bypassing security.
OS X Lion Server can help improve the situation. It's a simple upgrade to an existing Lion computer that costs just 35 and gives administrators more control over the Apple computers connected to the network. Of key interest is the Profile Manager, which restricts what Apple users can and can't do on their computers. It's effectively the Mac equivalent of the Group Policy Manager and gives administrators that extra control that's missing. In other regards, OS X Lion Server is a little bit too simplistic for many environments, particularly as there's no rack-mountable hardware available. As a result, a large organisation may just want one or two Lion servers for Profile Manager.
