rob998 Posted January 13, 2015 Posted January 13, 2015 Hello, I have a lot of Mac's joined to my Windows domain. Users from my AD can log in to the Mac side fine and get their home drives etc mapped. The problem I am having is that they get a Keychain message popping up all of the time for CalendarAgent and Messenger. It asks them for their password but when they type it in it says it is incorrect. If you cancel it, it doesn't disappear. You have to move it to the bottom corner to work but sometimes this crashes the program i.e. garageband. It is very annoying. Has anyone come across this issue? Rob
abillybob Posted January 13, 2015 Posted January 13, 2015 Hello, I have a lot of Mac's joined to my Windows domain. Users from my AD can log in to the Mac side fine and get their home drives etc mapped. The problem I am having is that they get a Keychain message popping up all of the time for CalendarAgent and Messenger. It asks them for their password but when they type it in it says it is incorrect. If you cancel it, it doesn't disappear. You have to move it to the bottom corner to work but sometimes this crashes the program i.e. garageband. It is very annoying. Has anyone come across this issue? Rob Yup. It's annoying and normally occurs when a user has had to have their password changed on AD. You need to load up keychain on their machine and delete all entry thus generating a new keychain. Pain in the bum, I know but hey it's apple so it's good, right!?!?! 1
rob998 Posted January 13, 2015 Author Posted January 13, 2015 So I have a class of 30 students and say 18 of them get the keychain pop up. I have to log them out, log on as admin, delete all entries and have them log back on? There has got to be an easier way? 1
abillybob Posted January 13, 2015 Posted January 13, 2015 So I have a class of 30 students and say 18 of them get the keychain pop up. I have to log them out, log on as admin, delete all entries and have them log back on? There has got to be an easier way? There could be although I haven't ever been able to find it. I'd very much like to hear of an easier way myself. Also you shouldn't need to logon as administrator to delete the other users keychains, do a search in spotlight on the users login and you should find it. A class of 30 should take you no longer than 10 minutes to do, I do it as and when they get pop-ups. 1
rob998 Posted January 13, 2015 Author Posted January 13, 2015 I use Workgroup Manager to restrict the Finder so students cannot search for Keychain. Do you not do this? 1
rob998 Posted January 13, 2015 Author Posted January 13, 2015 I like the sound of: If you have the "Force local home directory on startup disk" unticked it then saves their profile (keychain) on their homedrive\Libraries. From that post. I am not using roaming profiles. Could be something to try when i'm back onsite tomorrow.
davidacland Posted January 13, 2015 Posted January 13, 2015 We normally use local home folders and delete the keychains at logout (described in this thread http://www.edugeek.net/forums/mac/144951-keychain.html). Everyone has different experiences but I wouldn't personally recommend it. The concept sounds great but in reality it causes logon problems, application crashes and general chaos.
abillybob Posted January 13, 2015 Posted January 13, 2015 Thank you everyone it's been very helpful to me also. @rob998, we did until I came across this problem I can lock it down again now... We don't use Workgroup Manager anymore it's old software now in my book. Since the release of Yosemite we've been using profile manager to apply restrictions. So much more choice and it works really well.
rob998 Posted January 15, 2015 Author Posted January 15, 2015 I'll have to get my profile manager setup. Do you still have the keychain issue @abillybob
abillybob Posted January 15, 2015 Posted January 15, 2015 I'll have to get my profile manager setup. Do you still have the keychain issue @abillybob I do mate yes, is there a simple way to sort it?
OrangeExige Posted January 15, 2015 Posted January 15, 2015 (edited) If you have the "Force local home directory on startup disk" deselected then the Library folder, containing the Keychains is stored on the users network share. In our case the best solution was to have a group policy which deletes the Keychains folder (User Configuration, Preferences, Windows Settings, Folders) from the users network area each time they log on. Obviously this only applies to Windows machines but it has virtually solved the problem as by the time a user gets round to logging on to a Mac, they have no existing keychains files using old passwords. This works well for us as we only have 30-40 Macs and hundreds of Windows Machines. Hope this helps. Edited January 15, 2015 by OrangeExige 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now