Keychain Issues

[ValeAcademy]

At our school, students login using their network login that is brought down from AD on the macs.

 

When using the internet on Safari, or any other browser for that matter, they are constantly prompted for their keychain credentials which becomes quite annoying.

 

The option is there to reset their keychain, however it does not follow them around when the change Mac, which quite often students do inbetween lessons and therefore resetting keychains is not really the answer.

 

I was just wondering if anyone had a solution for this, maybe so that the individuals keychain is pulled down from the server or something like this?

 

Thanks.

[Gloxxy]

This only happens when a user has changed their AD password or it has been changed for them. When the user logs on for the first after changing their password a splash box appears regarding their Keychain. The options are to Continue login, Create New Keychain or Update Keychain. If you don't click Create New Keychain then the Keychain will continually ask for the Keychain password which is the users OLD password as a new keychain hasn't been created with the new password.

 

The only way to get rid of the keychain password popup box is to delete the login keychain in the Keychain Access app. Use spotlight to search Keychain Access then right click and delete the login keychain. The Mac will be forced to create a new keychain with the new password.

[woodham]

sorry to bring up an old thread but do you need to do this for every user on the mac ? or just the admin account

 

thanks

 

Andy

[Gloxxy]

sorry to bring up an old thread but do you need to do this for every user on the mac ? or just the admin account

 

thanks

 

Andy

 

If the Mac is bound to Active Directory then it only affects the Managed users on the Mac. It won't affect the local Admin accounts on the Mac as they are not managed by Active Directory.

[Pashers]

Are you using roaming profiles?

System Preferences - Users and Groups - Login Options - Then go into Active Directory as if you are going to bind it to AD. Under show advanced options untick "Force local home directory on startup disk". This will allow the profiles to move with them.

[woodham]

thanks that confirmed my nightmare,

year 7's and 8's are usless at remembering there passwords so get changed on the pc's all the time,

 

hence the keychain issue when they go into the mac suite for music there must be a solution to this.

 

each mac can have in a week maybe 30 different users logged onto it so deleting all the keychains is going to be a nightmare

[Pashers]

If you have the "Force local home directory on startup disk" unticked it then saves their profile (keychain) on their homedrive\Libraries.

[woodham]

but would that help when they change there password in AD? as wed still have to delete them I wonder if theres a script that I can write/ aquire to delete all keychaing from user accounts?

[Pashers]

https://jamfnation.jamfsoftware.com/discussion.html?id=7562 there's a setting in there to hide prompts and you can use keychain minder to help make the process easier.

I don't think there's an easy way to delete the keychain during login or logoff.

[seawolf]

At our school, students login using their network login that is brought down from AD on the macs.

 

When using the internet on Safari, or any other browser for that matter, they are constantly prompted for their keychain credentials which becomes quite annoying.

 

The option is there to reset their keychain, however it does not follow them around when the change Mac, which quite often students do inbetween lessons and therefore resetting keychains is not really the answer.

 

I was just wondering if anyone had a solution for this, maybe so that the individuals keychain is pulled down from the server or something like this?

 

Thanks.

 

 

Why not try Keychain Minder - Keychain Minder on Mavericks | Der Flounder

 

The Keychain is prompting because the AD password has changed. The user is being asked for the previous password, not the current one. Keychain Minder allows you to provide users with a better message explaining what they need to do. You can also try using a logout script to delete the keychain, but generally keychain minder should work better.

 

https://jamfnation.jamfsoftware.com/discussion.html?id=685

[Mark182]

I’m having the same issue as above.

Anyone any ideas how to get this working? :-

Source https://jamfnation.jamfsoftware.com/discussion.html?id=685

add this to your logout hook

 

################################

 

#Delete the Users Keychain

 

echo Removing keychain

 

rm ~/Library/Keychains/login.keychain

 

 

#record this will a log file

 

touch ~/Library/Login/Reset.rft

 

echo "Done"

 

Working for 10.9.4 OSX using AppleScript Editor?

 

I’ve edited some of it down to this :-

 

#Delete the Users Keychain

 

echo delete

 

rm /Library/Keychains/login.keychain

Echo “Done

 

But I’ve never created a script for my Macs. It seems to be getting stuck on the . in login.keychain I know in windows I could put “/Library/Keychains/login.keychain” but that doesn’t work.

 

Just wondering if anyone could help / advise?

[Pashers]

Are you still having issues with this? Because I've found ADPasMon works extremely well (better than Keychain Minder IMO). It also give you access to the code so you can modify it. I've modified it (to suit our needs) so it automatically deletes the keychain (if it's locked) and warns the user that the Mac will reboot when logging in.