nicholab Posted January 19, 2017 Posted January 19, 2017 We are having an issue at the moment that if a student has their password reset in AD they have issues with the keychain on mac. Any ideas
dgrinnell27 Posted January 19, 2017 Posted January 19, 2017 This is normal, same issues here. When a password is changed it doesnt change the local keychain stored password. To fix this, upon login they are prompted with what they wish to do with their keychain, always select CREATE NEW. This will fix issues relating to internet access and permissions.
Mark182 Posted January 19, 2017 Posted January 19, 2017 Try this set a logout hook to delete a students keychain if you use profile manager.
aidenbran2000 Posted January 19, 2017 Posted January 19, 2017 Same issues here. As long as they press create new keychain it is fine.
nicholab Posted January 30, 2017 Author Posted January 30, 2017 Try this set a logout hook to delete a students keychain if you use profile manager. Please could someone explain where you need to go in profile manager and what I need to do as I am still only seeing parts of the story?
3s-gtech Posted January 30, 2017 Posted January 30, 2017 I guess you're wanting to do http://www.edugeek.net/forums/mac/159322-delete-all-student-keychains.html#post1374520 ? Go to your chosen group in Profile Manager (I've set it on the AD group Domains Users). This may be 'Students' or whatever group you've tied PM settings to. Go to the Settings tab, click Edit, scroll to the bottom and select Custom Settings. Add the settings from that post, click OK and then Save. Now test.
Stormborn15 Posted April 12, 2017 Posted April 12, 2017 Grrr.. just came across this issue today.. did the create a new keychain and it still asked for old password ... what is the correct method for this?.. is it not always consistent?..
Bedders Posted April 12, 2017 Posted April 12, 2017 Sometimes we had to log in as the student affected, open Keychain manager (authenticate with local administrator account) and delete any keychain records for that student. Log them out and back in again, now when you click Create a New Keychain it should be fine. (sorry, haven't done this for about 12 months so can't remember the exact specifics)
Stormborn15 Posted April 12, 2017 Posted April 12, 2017 (edited) Sometimes we had to log in as the student affected, open Keychain manager (authenticate with local administrator account) and delete any keychain records for that student. Log them out and back in again, now when you click Create a New Keychain it should be fine. (sorry, haven't done this for about 12 months so can't remember the exact specifics) Thanks for replying @Bedders... I've googled it to death and every suggestion that I've tried the imac is asking for old password. Problem is it is MY network username and password. I've changed it probably a few times since I logged onto that particular imac so can't remember what it might have been ( exhausted the ones it could be..) It's something I'd like to get to the bottom of as currently have to tell AD joined mac users that they can't change their passwords.. not great for security.. Had an SLT change his password on macbook and now any other macbook he logs into ( that he used as a spare - and his imac is complaining)... Am i safe to go in as admin and delete ALL login keychains?... what damage will I do?... Ps - tried authenticating with admin user login and it wasn't having it.. :-/ Edited April 12, 2017 by Stormborn15
Bedders Posted April 12, 2017 Posted April 12, 2017 Sorry @Stormborn15, Mac's aren't my area - I just remembered that the process sometimes involved manually deleting the key before selecting Create a New Keychain would work. I don't know what is stored in the Login keychain - I'd suggest looking at one on your network and seeing if there's anything important. Also I'm not sure if there's a global one or if they are specific to individual users. It may be easier to move any local work off the account (if you have anything saved locally on the Mac) then delete the account completely and log in again. Good luck!
Stormborn15 Posted April 12, 2017 Posted April 12, 2017 Sorry @Stormborn15, Mac's aren't my area - I just remembered that the process sometimes involved manually deleting the key before selecting Create a New Keychain would work. I don't know what is stored in the Login keychain - I'd suggest looking at one on your network and seeing if there's anything important. Also I'm not sure if there's a global one or if they are specific to individual users. It may be easier to move any local work off the account (if you have anything saved locally on the Mac) then delete the account completely and log in again. Good luck! Thanks @Bedders.. I am planning on rebuilding the imac at some point so will have a play around then.. :-)
Brimstone Posted April 12, 2017 Posted April 12, 2017 This blog post from an education reseller explains in more detail... https://www.krcs.co.uk/news/mac-osx-keychain 2
TomCollins Posted April 14, 2017 Posted April 14, 2017 Would something like NoMAD work for you? https://gitlab.com/Mactroll/NoMAD 1
Stormborn15 Posted April 14, 2017 Posted April 14, 2017 @TomCollins - will take a look at this - thanks
Stormborn15 Posted April 25, 2017 Posted April 25, 2017 So, just coming back to this issue again.. when the user changes their password on their own macbook ( as long as they do it school) it all seems to work fine . If I change their AD password - it works fine.. The problem is more apparent when a user uses say a macbook and then also an iMac ( SLT ) if the password is changed on the macbook - then the iMac doesn't like it and the whole update/create keychain thing just doesn't seem to work ( it may be some time between uses ) is there a way of 'synching' more than one machine to AD changes - or will I need a mac server set up for this?... TIA
jdell Posted April 28, 2017 Posted April 28, 2017 So, just coming back to this issue again.. when the user changes their password on their own macbook ( as long as they do it school) it all seems to work fine . If I change their AD password - it works fine.. The problem is more apparent when a user uses say a macbook and then also an iMac ( SLT ) if the password is changed on the macbook - then the iMac doesn't like it and the whole update/create keychain thing just doesn't seem to work ( it may be some time between uses ) is there a way of 'synching' more than one machine to AD changes - or will I need a mac server set up for this?... TIA Can I ask a few questions? I dealt with a similar issue when I took over my current site and think I can help point you in the right direction with this. What OS are your Mac's running? Are both the iMac and Macbook's running the same version of the OS down to the release i.e 10.12.2 ? There is a known issue with x.x.1 . x.x.2 versions changing the set up of the keychain. What domain functional level are you running? What OS are your domain controllers running? Do you have Mac Server? Are the Mac's and Macbooks, Mac server bound to AD?
DaveAngel Posted April 28, 2017 Posted April 28, 2017 We used to have this issue with our mac suite, one option is to create a create a cron job to delete all keychains on the mac and shutdown them down at the end of the day this has to be done on each mac, the process isn't too difficult I have a how to guide on how to do it, if it's something you might be interested in let me know and I'll either pm you the guide or post the instructions here!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now