Login Keychain Settings " Lock After x Minutes of inactivity" , Disable ??

[2097]

As title , all my ad logins have this enabled and set to 5 mins we need around 240 mins because Safari will be using kerberos soon and it prompts for password once the user is inactive for 5 mins. If i manually change it, its fine untill after they log back in and itresets back to the default.

 

Am i missing something ? we are using profile manager and i have a few custom Plists setup but cant find out why this applys to AD accounts only ? local accounts seem fine .

 

We are running Yosemite btw

[Carter]

If you have a default user profile in place make sure you delete the "keychain" folder. Doing this forces a new one to be created when a new AD user logs in and it will be theres. If you keep a default one in place it will prompt you for the password of the user you created the default profile with.

[2097]

The profile is stored in the users windows home directory. I have tried deleting there keychain , but everytime a user logs in the setting "Lock After 5 Minutes of inactivity" is enabled in there logon .

 

Weirdly it doesnt do it on Local logins , it allows me to change it on AD user accounts manually but as soon as i logoff and back on it comes back to default

 

I now have the terminal command to alter the length , so looking at a way at running it at logon

 

ta for the reply.

[2097]

OK figured this out without the need of a script.

 

Because of the key-chain being stored in the AD Home folder it was getting kinda messed up with permissions , for e.g. i couldn't chmod it using terminal and was producing a Unix permission error.

 

Because of this i decided to redirect the key-chain folder to the /tmp folder on the local machine at logon using a symlink

 

Now the keychain folder deletes at every logoff/reboot But now solves 2 problems with 1 solution

 

1.) Login keychain now no longer has a timeout and works perfect.

2.) When a user used to change there password in AD , they would get a keychain error message when they first logged back onto the macs . Because of the new location of the keychain this no longer happens ! .