+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 18
Mac Thread, Mac WGM settings not taking/Windows GPO's overriding in Technical; I'm hoping someone here has some idea of what I'm about to waffle on about. Have just integrated a mac ...
  1. #1


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141

    Mac WGM settings not taking/Windows GPO's overriding

    I'm hoping someone here has some idea of what I'm about to waffle on about.

    Have just integrated a mac suite into the windows domain.
    Details as best I can remember:
    -Mac Server: Lion 10.7.3 (Mac Mini), running in magic triangle setup (OD master, kerberos disabled, AD authentication, DNS running)
    -Windows: Server 2k3 and 2k8r2, both running at 2k3 domain functional (and forest) level, with the relevant AD upgrade file applied (I forget what it's called, but it's a thingy file that upgrades AD schema to accept Win7/2k8 boxes on a 2k3 domain).
    -GPO's applied to OU's containing all users, seperate policy for students/teachers, along with a default domain policy.
    -MacbookPro's with lion 10.7.3
    Followed standard guides for setting up magic triangle, used Deploystudio to create netboot and netinstall clients, then hopped the clients on and set the names accordingly.

    The problem:
    WGM settings are not taking effect correctly
    -User WGM settings are only applied to users with no AD GPO's in effect, or users with domain admin access.
    -Machine WGM settings are only applied to machines if user has admin access (local or domain)

    I moved the machines to a dedicated OU and blocked policy inheritance, didn't have any affect on settings.
    I created a new user and only made it a member of Domain Users group, and put that user into folder with blocked policy inheritance. This user correctly applied WGM user settings.
    I tried adding users with Augmented records into OD, no effect.

    Now it looks to me like AD is forcing the GPO's and ignoring all WGM settings, but I can't for the life of me work out how to get round this.

    It's not GPO settings overriding specific options, it's ignoring ALL WGM settings if a GPO is in effect for a non-admin user, but does seem to apply for users with admin priviledges.


    Anyone know what I've done wrong? What am I missing? I'd rather not create all my users with no GPO's applied! And I don't want to have different logins just for the macs.

    Any help much appreciated.
    Last edited by Rydra; 1st May 2012 at 11:00 AM.

  2. #2
    pooley's Avatar
    Join Date
    Sep 2005
    Location
    S Wales
    Posts
    1,134
    Thank Post
    78
    Thanked 119 Times in 100 Posts
    Rep Power
    67
    WGM will only affect the users when they are logged into the Mac side and AD should only affect users when they are logged into windows. I've not come across a setup where AD affects MAc and OD (Mac AD) affects Windows.

  3. Thanks to pooley from:

    Rydra (3rd May 2012)

  4. #3
    ste1988's Avatar
    Join Date
    Jan 2012
    Location
    West Midlands
    Posts
    176
    Thank Post
    77
    Thanked 24 Times in 23 Posts
    Rep Power
    13
    I may be wrong, but gpo's shouldnt have any effect on the mac side of things, here are windows side is heavily locked down, but our macs only take settings from WGM.

    What i would say is to refrest the mcx records that are held on the machines. Just so you know the machines, have the very latest settings applied and that all those changes are hanging around causing issues.

    You can do this here Managed Client: How to flush cached settings

    This worked for me when my settings werent being applied

  5. Thanks to ste1988 from:

    Rydra (3rd May 2012)

  6. #4


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141
    The windows GPO's aren't applying to the mac's, but it seems any user in the main AD structure are not taking the settings. Only ones that have no policies applied (aka blocked inheritance) and domain admins are getting the changes.

    I can login as a user without policies and get the settings, log out, then login as a user that's never logged in before with a GPO applied, and the WGM settings are not taking. I can even make settings changed on WGM and see them apply on a logout/login on the non-inherited user, but the others all ignore it.

  7. #5
    pooley's Avatar
    Join Date
    Sep 2005
    Location
    S Wales
    Posts
    1,134
    Thank Post
    78
    Thanked 119 Times in 100 Posts
    Rep Power
    67
    The only thing I can think of is maybe its the way you have linked the macs to OD and AD, When you connect the macs to both directory services, under Directory domains Make sure that LDAP is below Active Directory

  8. #6


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141
    Quote Originally Posted by pooley View Post
    The only thing I can think of is maybe its the way you have linked the macs to OD and AD, When you connect the macs to both directory services, under Directory domains Make sure that LDAP is below Active Directory

    checked that, AD is first.

    I don't have any reverse DNS setup, could that cause issues? I never found anywhere that suggested how to set that up. for triangle setup.

    I had it suggested it might be to do with Default Domain Controller Policy settings
    Computer > Windows Settings > Security Settings > Local Policies > Security Options >> Microsoft Network Server: Digitally Sing communications (Always + if client agrees).

    That made no difference.

  9. #7
    pooley's Avatar
    Join Date
    Sep 2005
    Location
    S Wales
    Posts
    1,134
    Thank Post
    78
    Thanked 119 Times in 100 Posts
    Rep Power
    67
    OK lets rethink this, under the managed preferences, you have setup "Groups" that are to be managed, staff, admin, kids etc?

    Have you made sure that you have selected to "always" manage a preference as apposed to only managing it once?

  10. #8


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141
    Quote Originally Posted by pooley View Post
    OK lets rethink this, under the managed preferences, you have setup "Groups" that are to be managed, staff, admin, kids etc?

    Have you made sure that you have selected to "always" manage a preference as apposed to only managing it once?
    yes.

    Created group for users and for computers.

    Minimal settings applied (pre-set proxy for staff, different one for student under user settings, under machine settings add office programs to dock bar).

  11. #9

    Join Date
    Jan 2011
    Location
    Brighton
    Posts
    36
    Thank Post
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    9
    Quote Originally Posted by ste1988 View Post
    I may be wrong, but gpo's shouldnt have any effect on the mac side of things, here are windows side is heavily locked down, but our macs only take settings from WGM.

    What i would say is to refrest the mcx records that are held on the machines. Just so you know the machines, have the very latest settings applied and that all those changes are hanging around causing issues.

    You can do this here Managed Client: How to flush cached settings

    This worked for me when my settings werent being applied
    I've got this one mac that's refusing to refresh - It's picking up half of the policies, I tried flushing the cash as you suggested but it's still only picking up some of the policies.. I've also tried renaming, rebinding, readding to the group in WGM. Still same deal.. It's small things like all users are still get the default dock alongside their managed dock.. and local admin can't refresh preferences when logging in.. All other macs in the group are fine it's just this one! Any other tricks I can try?

    Cheers,

    Martin

  12. #10
    ste1988's Avatar
    Join Date
    Jan 2012
    Location
    West Midlands
    Posts
    176
    Thank Post
    77
    Thanked 24 Times in 23 Posts
    Rep Power
    13
    In WGM you have your groups, and they are linked to ad, so you staff group contains your staff ad group?

    I apply my preferences, mostly to the user groups, and not by machines. Which way are you doing it?

    @martin_hannah

    Have you tried deleting the locally stored preferences, its in Library > Preferences if you know which one it is just delete that one, if not remove them all.

    Theres a thread on here that goes it to a bit more detail. ill try and find it for you

  13. Thanks to ste1988 from:

    Rydra (3rd May 2012)

  14. #11


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141
    Quote Originally Posted by ste1988 View Post
    In WGM you have your groups, and they are linked to ad, so you staff group contains your staff ad group?

    I apply my preferences, mostly to the user groups, and not by machines. Which way are you doing it?

    @martin_hannah

    Have you tried deleting the locally stored preferences, its in Library > Preferences if you know which one it is just delete that one, if not remove them all.

    Theres a thread on here that goes it to a bit more detail. ill try and find it for you
    I've tried it with AD groups in the WGM groups, and individual AD users. Didn't make any difference.

    I have a machines group, with machine settings just to tell it to add Word + Powerpoint to the dock, and at the moment I've got proxy settings being pushed out for the user based settings. Neither take affect unless it's admin/non policy user.

  15. #12
    JR-PCS's Avatar
    Join Date
    Apr 2012
    Posts
    91
    Thank Post
    3
    Thanked 19 Times in 18 Posts
    Rep Power
    11
    Based on a your original post there are a few things that you don't seem to have setup correctly.

    You don't want DNS running on the mac mini server if your have other DNS servers in the school. Just point your mac mini at the windows (or other OS) DNS servers.

    On the other DNS servers you will need to add a forward and reverse DNS entry for your mac mini server. (important to do both directions)

    Not essential, but it is a good idea to have Kerberos running as it would have automatically configured itself if you had your DNS correct before you created your OD Master.

    If this was me presented with this kind of problem (and I have had to support many school that have tried to setup there own macs and got stuck where you are right now) I would export the settings I need from WGM, demote the OD Master to standalone, fix the DNS issues as mentioned above and then restart the server. Then premote to OD Master after the restart and import setting again in workgroup manager. If you get stuck get an expert (like me) in to sort it out for you as it will save you a lot of time and money and you can learn from the expert quite a bit during there time fixing it.

  16. Thanks to JR-PCS from:

    Rydra (3rd May 2012)

  17. #13

    Join Date
    Mar 2012
    Location
    Stafford
    Posts
    33
    Thank Post
    6
    Thanked 7 Times in 5 Posts
    Rep Power
    10
    Click the apple logo on one of the machines - click on about this Mac then click on more info >> scroll down to managed preferences and take a look at what you have here if anything.

    Also what binding setting have you got set under the Directory Utility ? could you screen shot it for me please.

  18. Thanks to chill3r from:

    Rydra (3rd May 2012)

  19. #14

    Join Date
    May 2006
    Location
    West Bromwich
    Posts
    2,190
    Thank Post
    299
    Thanked 215 Times in 185 Posts
    Rep Power
    56
    Does kerberos start now on Lion Server when in a magic triangle configuration? It usually says stopped on the OD master as the services are kerberised by the AD.

  20. Thanks to HodgeHi from:

    Rydra (3rd May 2012)

  21. #15


    Join Date
    May 2009
    Location
    UK
    Posts
    2,105
    Thank Post
    256
    Thanked 450 Times in 251 Posts
    Rep Power
    141
    ARGH!

    I have been working on this problem for DAYS.

    I went to test something just now, and the user settings are taking. (Machine ones are still only working for admins, but I can work around that by applying the settings for the users instead)

    I am not kidding when I say I had tried everything before, changed every setting there was, rebooted more times than I can count, and NOTHING worked, and now it's all working quite smoothly.

    Thanks and rep going to all who helped me here, I'm going to go away now...






SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Proxy settings not being applied - GPO - XP
    By j17sparky in forum Windows
    Replies: 20
    Last Post: 10th December 2013, 02:16 PM
  2. Replies: 4
    Last Post: 30th November 2010, 06:56 PM
  3. Mapped printers not taking settings across
    By mrbios in forum Windows 7
    Replies: 1
    Last Post: 5th March 2010, 11:46 AM
  4. Replies: 10
    Last Post: 12th October 2009, 11:16 AM
  5. Replies: 11
    Last Post: 27th September 2005, 12:30 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •