Remote Manage computers that are not on my LAN.

Question

Hi.
i want to be able to remote manage laptops & desktops that are not on my LAN all running 10.6.4
i want to be able to ARD and get logs and even changed settings in workgroup manager if i can.
ideas?
would wide afea bonjour achieve this for me? or is there better options ideas out there.
just a note: i would still like to use apple remote desktop. not some web client like log me in.
and also just a random question, if i have laptops that are bound to the directory but the users home folder is on the device. if they were to change there password on the LDAP / login, mail, CalDAV password. would that update the laptop not on our LAN. so the user has to login with there new password?
you might be asking why: new start up company with a lot people spread across to countries. and i wont to enforce password has to change every 28 days for their login, mail, CalDAV, CardDAV etc.
Message was edited by: -{ jonohayes }-

Answer 1

i want to be able to remote manage laptops & desktops that are not on my LAN all running 10.6.4
I'm not sure I understand the question. ARD isn't limited to machines on your LAN. You can manage any machine you have TCP/IP connectivity to - in other words, if you can ping the machine you can (probably) manage it via ARD.
The only issue you may have is that the Bonjour auto-discovery mode won't necessarily find remote machines - you obviously don't want it scanning the entire internet for available machines, so you can either use the Scanner and define a range of IP addresses to check, or specify the remote machine's IP address directly.
and also just a random question, if i have laptops that are bound to the directory but the users home folder is on the device. if they were to change there password on the LDAP / login, mail, CalDAV password. would that update the laptop not on our LAN. so the user has to login with there new password?
Impossible to answer with the data provided.
If the user's account is on the Open Directory server, then changing the password on the LDAP server will require them to login to their laptop with their new password.
However, it's also entirely possible that the users have local accounts on their machines and just use Open Directory for server-side functions (mail, etc.). In this mode account 'joe' in Open Directory might not be the same account 'joe' on the Open Directory server. As such, changing the Open Directory server will require the user to use the new password for the server-side functions, even though they continue to log on to the laptop with their old account/password.
Only by looking at the machine's configuration will you know which mode you in (or trying it and seeing what happens, I suppose )
i wont to enforce password has to change every 28 days for their login, mail, CalDAV, CardDAV etc.
Personally, I hate this approach. Forcing users to change passwords frequently results in users choosing weak passwords because they don't have time to learn the muscle memory that eases the typing of complex passwords. Moreover what you'll often find is that users choose the same password stub and just append a number on the end - kind of like 'password1' -> 'password2' -> 'password3', etc., which is barely useful.
It's your company, though, and this is just my personal opinion. A better solution hinges on having an effective notification and account revocation process (i.e. if someone's account gets compromised it can be shut down quickly).