Keychain!!!!

[Shadow_Walker]

We have a mac suite at the school and lately we keep going down and finding out that kids are getting keychain issues. It turns out that they are not clicking "create a new keychain" option when prompted even though the teacher is telling them to press that one. Is there anyway of prompting the kids to press "create a new keychain" or getting rid of keychain all together. The macs in the suite are on mavericks but i have got a couple of spare macs running yosemite up in the office connected to the new osx server.

 

Thanks

[Zezima]

We are having same problem...

 

It seems that most of the kids have managed to click "create a new keychain" when they logged in which sorted out their problem... but some kids aren't even having the dialog box pop up now though and when they get to their desktop... it starts asking for keychain passwords without the option to create a new keychain...

 

Will post here if we get anywhere with it.

[davidacland]

You can't get rid of the keychain entirely as its needed by the OS and apps but you can delete it at logout. When a user logs in, if there isn't one present its created clean.

 

Create a shell script that runs "rm -R /Users/$USER/Library/Keychains" at logout using a LogoutHook.

 

Hope this helps.

 

David Acland - Amsys

[Norphy]

You can't get rid of the keychain entirely as its needed by the OS and apps but you can delete it at logout. When a user logs in, if there isn't one present its created clean.

 

Create a shell script that runs "rm -R /Users/$USER/Library/Keychains" at logout using a LogoutHook.

 

Hope this helps.

 

David Acland - Amsys

 

Good idea!

 

One question, doesn't running a logout script with a LogoutHook run the script as Root? How do you get around that?

[davidacland]

Good point, we create a temp file at login using a LaunchAgent that runs:

 

echo $USER > /etc/user

# you could put this in any file really, as long as its writable by all users. The ">" makes sure it gets written cleanly at each login.

 

We then use:

 

username=`cat /etc/user`

rm -R /Users/$username/Library/Keychains

[OrangeExige]

We've also had annoying issues with users Keychains. When a user changes their password on a Windows machine, the stored keychain becomes invalid and causes seriously annoying problems and constant keychain errors if the user ignores the login message.

 

A workaround for us was to create a simple group policy so that when a user is logged into a windows machine it deletes the keychain folder which is stored in their user area (User Configuration > Preferences > Windows Settings). This seems to work well and ensures a new keychain is created with nearly every log in on a mac. We have also expanded this delete policy to delete the entire contents of the users Library folder. This is keeping every log in quick and fresh.

[Pashers]

My workaround (not the most ideal) but considering the music teacher wanted a solution where it 'just works'. ADMonPas worked great modified the code so when a user logs on it checks if they have a keychain issue. If so then delete the keychain and then prompt to restart the mac. Seems to be running fine for us.

 

ADPassMon.app.zip (please note this is my modified version)

Edited November 19, 2014 by Pashers
Wrong application name

[gseifert7]

Good point, we create a temp file at login using a LaunchAgent that runs:

 

echo $USER > /etc/user

# you could put this in any file really, as long as its writable by all users. The ">" makes sure it gets written cleanly at each login.

 

We then use:

 

username=`cat /etc/user`

rm -R /Users/$username/Library/Keychains

 

If this is set up in Workgroup Manager as a log out, would you need to worry about running it as root??

[davidacland]

Not sure about runnign it with Workgroup Manager. Are you talking about the LoginWindow preferences or something else?

 

For now I would run it as a LogoutHook. Hopefully Apple aren't planning on dropping that functionality as there's nothing to replace it!

 

David Acland - Amsys