Inconsistent behaviour on mixed network

[Osprey]

Situation:- Windows 2003 Server as domain controller, lots of PCs running XP. MacOS X server on eMac, four iMacs and four iBooks (all intel based) running fully patched MacOS X.

Users can logon to the Macs with their AD user names and are authenticated by AD, Mac desktops, etc are managed by the Mac Server.

This is based on Mike Bombich's documents.

Anyway, to the problem. This system was working well then we got lots of silly problems such as users not able to logon or when they logon they get an open desktop (no control from the Mac Server). We eventually swapped the switch that the server was plugged into (previously documented on these wonderful pages ) and it started to work again. Now it is playing up again. I've tried a different switch. I've taken two of the Macs off the network and rebuilt them, put them back on, intermittent problems still.

Can anyone Help? Where should I look next?

We've also got the Macs running XP on Parallels connecting to the AD network. You should see the confused faces on some of the visitors!

[plock]

We've also got the Macs running XP on Parallels connecting to the AD network. You should see the confused faces on some of the visitors!

I would love to have done this too! Would be so beneficial! However, the head of the department where they are based is a 'control freak'!

You're probably aware of this, but just making sure, with regards to authentication not taking place. Do ensure that the system time on the Mac's is exactly the same as the OS X Server and Windows Domain Controllers. Otherwise authentication fails; a security feature part of Mac OS X I believe.

You'd be surprised how long it took me to work out why every now and then a Mac or two would stop authenticating! :P

Good luck!

[Osprey]

Thanks. That could actually be the problem, when I was looking at this last week I was correcting the time on the macs and they seemed to be behaving. By the end of the week we were having problems again. I'll have to check and see why they aren't keeping time. We have some time keeping software on the Windows server which the PCs are all looking at. Is there a way of getting the Macs to look at it to?

It's half term this coming week and I'm having a break so I'll look at it when I get back in.

Thanks!

[plock]

I hate to say it, but it could possibly be the students changing the time? Have you restricted this using the Mac OS X Server?

Sadly I can't give you a complete guide to doing this, this was implemented before me, but I have done little bits and pieces on it.

[Rozzer]

Hello,

I have been having the same problem and as much as i would love to say its the students changing time sadly its not. this started to happen after the 10.4.9 update and apple have not brought out a fix. On a plus side the day lights saving is kicking in soon so it may fix itself out. I did put together a script on startup which resets the time deamon but i haven't fully tested it yet.

Ross

[m25man]

If you are certain you are having AD integration issues then I would look closely at your time sync.

I recently had an issue with a Sonicwall SSL VPN the AD clients were complaining that they were getting logged in one minute and refused the next.

When I checked, the clock was 5mins 30secs out of sync.

When the clocks displayed a 5min skew they worked when it got into the 30second overlap they wouldnt!
Eg if the Sonicwall was showing 14:30 and the PDC 14:35 fine as soon as it rolled to 14:36 no login for 30 seconds! How bloody fussy is that!

Set the pdc to use the uk time server;
net time /setsntp:uk.pool.ntp.org

Set the Sonicwall to do the same, never had a problem since.
Make sure your Mac's do the same.

At least eliminate the clock skew issue Keberos is very unforgiving with this.

[Rozzer]

This might help.
http://docs.info.apple.com/article.html?artnum=303731

[Osprey]

In the past we used to set up the Windows server as a time server. If I were to do that is there a way of setting the Macs to point to it rather than having them trying to navigate through ISA servers and logins? The apple.com article may help but it would be nice to just tell all the Macs to sync with the Windows server.

[Osprey]

Derrrrr! Maybe I should take note of the footer that says "Google Everything"!

Just found Configuring ntp on clients which points out the b****y obvious. Maybe my brain has switched off. Will try it out when I'm back in the school and will report back!
ops:

[psydii]

On the subject of time, our mac lab is configured to automatically synch with Apples euorpean time servers, yet within 24hrs they have drifted randomly by up to 10 minutes.

This has the predictable effect on AD integration.

As soon as I open the Date and Time preferences the clock snaps back to the correct time.

Eh?!

[m25man]

Did we actually determine that clock skew was the problem?

If so set up your own ntp server locally.
You can get a Rugby MSF clock (usb or serial) and a bit of software then you can keep everything aligned yourself.

I saw one kit for about £100 I'm sure you can google for it.

[Osprey]

Haven't been back into school yet to determine if time is the issue. It's half term here (why am I typing this when there's a glass of wine in the kitchen with my name on it? :? )

[Osprey]

It seems so simple now! We have set all the macs including the mac server to sync time with the 2003 Server. Everything seems to be running smoothly now. If we have any more problems I'll let you know!

Thanks for all the help.

[Osprey]

The end of a week and no one has reported any problems with the macs so it must have been the time drift.

Now it's time to drift off for the weekend

[m25man]

Glad to have been of help!