[Mac OS X Server] iMac Not Appearing in Workgroup Manager

[Zoom7000]

We've just brought a new 24" iMac and I cannot get it to appear in Workgroup Manager. Hence it won't pick up our custom "policies". I built it using a prebuilt image we had in DeployStudio however as it didn't work, I have since rebuilt it from scratch using the Mac OS X Disk yet I still can't get the iMac to be discovered in Workgroup Manager. I know that Bonjour is working fine because it get discovered by Apple Remote Desktop.

 

Any ideas as to what I can do to get it to pick up the "policies"? (Is policies even the correct word when it comes to Macs?)

[rolfea]

on the client, ensure it is connected to your server using the Directory Utility, found in the utilities folder in applications. If it isn't I would add it in there.

 

On the server in Workgroup Manager, I'm guessing you have set the policies to a group?

If so,

Add the machine manually by clicking on the machine button above the search box (looks like a square box), click on new computer at the top of the screen. Add the machine name, the select the network tab and put the IP Address in related box.

 

Then in the machine groups, add the machine into the group by selecting a group, select the Members tab, and click on the add button. Drag and drop the machine into the group.

 

Hope this is abit of help

[Zoom7000]

I have checked the "Directory Utility" and it is added in to both our Open Directory and Active Directory, as with all the other iMacs on the Network.

 

When I try to add the computer in manually I get the following message:

 

"The name you have chosen conflicts with a name assigned to another computer.

 

You can't assign the name "clean-imac" to two different computers. Remember that names are not case sensitive when checking for conflicts."

 

I get this every time I try to add it in even after rebuilding it with different names.

[rolfea]

search for the machine with that name in WGM and edit the IP Address, or the Mac address would be a better option as it doesn't change, to match the machine your trying to link it to?

[AntonioRocco]

Hi

 

On the affected mac log in as the local admin. Launch terminal and issue:

 

sudo rm -R -v /Library/Preferences/DirectoryService

 

Provide the password when prompted. You won't see it being typed so don't worry. Now issue:

 

sudo rm -R -v /Library/Preferences/edu.mit.Kerberos

 

Next issue:

 

sudor rm -R -v /Library/Preferences/SystemConfiguration

 

Finally issue:

 

sudo reboot -h now

 

The mac should now restart. On successful log in reinstate the local computer name as well as any network settings ie: proxy settings etc. Launch Directory Utility and bind to AD first. Verify you've received the TGT by looking in /Library/Preferences. You're looking for the edu.mit.Kerberos file. If you have mac server providing MCX now use the LDAPv3 Plug in in the same application to 'join' the client. Make sure you de-select 'Use for Authentication'. Log out of the local admin account and try for a network log in again. If you're pushing out hardware specific MCX make sure you re-add the client to the relevant computer list in Workgroup Manager.

 

Try and make sure all the clients are on 10.5.6. If you can rebuild a new image after the update has been applied. If the original image was built prior to 10.5.6 then this is a known problem. See these articles for further information:

 

About the Mac OS X Server 10.5.6 Update

Mac OS X 10.5: Duplicate computer name alert when binding to Open Directory

 

Antonio Rocco (ACSA)

[Zoom7000]

Right, thanks for your help AntonioRocco. I have run the commands. A few questions:

 

"sudo reboot -h now" didn't work so I removed the "-h"

 

I wasn't sure how to rename the iMac so I did this from "System Preference > Sharing"

 

I have binded the iMac back in to AD and verified the edu.mit.Kerberos file.

 

I'm not entirely sure how to do the next bit. We have a Mac OS X Server for deploying policies to the Mac workstations. I have no idea what MCX is. Sorry I am a total Mac n00b and haven't had any training so I'm just trying to trod along.

 

Also, I have noticed that the affected iMac is having problems with it's name. Despite the fact that I called it "clean-imac" after rebuilding it numerous times, it is still appearing in Apple Remote Desktop as imac50 (an older name) but reporting the DNS name as "clean-imac". Is there anyway to force it to remove all references to its older name of "imac50"

 

ARGH! Macs are driving me nuts!

[AntonioRocco]

Hi

 

Glad I could help. Sorry about the command. Sometimes I can't see the wood for the trees! Still you figured it out yourself. The -h switch is used when the shutdown command is invoked.

 

We have a Mac OS X Server for deploying policies to the Mac workstations. I have no idea what MCX is?

 

MCX = Managed Client X. Apple's version of Global Policy Objects. If you like its the 'official' name for 'Policies'. Now that you know this its not such a mystery and you should be comfortable in the knowledge that you've been using it successfully without really knowing what its called. Apple make available for free fairly extensive administration manuals from here:

 

Apple - Mac OS X Server - Resources

 

Two Admin Manuals which I think you'd benefit from are:

 

http://images.apple.com/server/macosx/docs/Open_Directory_Admin_v10.5_3rd_Ed.pdf

http://images.apple.com/server/macosx/docs/User_Management_v10.5.mnl.pdf

 

Changing the name using System Preferences > Sharing would be the way to do it. However you could flex your command line muscles and use scutil instead. To access the manual page launch terminal and issue man scutil. For example:

 

sudo scutil --get LocalHostName

 

should reveal what you've set. Using the --set switch to define the name will achieve the same thing as the Sharing Preferences Pane. In fact scutil can go a lot further. You'll see for yourself what it can do when you consult the manual.

 

Workgroup Manager has a tendency to 'hang on' to old names. Let's call it a 'feature'. What you can do is make a note of the MAC Address, remove it from the list and then manually add it. However you may find WGM will insist on using the old name. The only other way of hopefully 'resetting' the computer list is to delete the list completely. Create a new one. Name it something different and add the members again.

 

The thing is to make sure the name is listed correctly when viewing the schema itself. To view the schema launch Workgroup Manager and select Preferences from the Workgroup Manager Menu. Enable the "Show All Records tab and inspector". You'll get a suitably dire warning regarding viewing raw data. OK this and don't panic. What you should now see is a small bulls eye like icon has been added as well as an Inspector menu. Select the affected computer from the Computer List and click on the Inspector tab. You can view its name (Record Name) and other information in the LDAP database. You can also change the value directly at this level.

 

It's a good idea to quit either Workgroup Manager and especially Server Admin once you're done. Server Admin has a tendency to cause memory leaks if left open for long periods of time

 

ARGH! Macs are driving me nuts!

 

I know what you mean. Still once you begin to understand them its not that bad. You've done well so far considering you've done this all yourself. Well done!

 

Antonio Rocco (ACSA)

[Zoom7000]

What's interesting is I just fired up a Terminal and the prompt that I get is:

 

imac50:~ ladmin$

 

ladmin being the username of course. (Localadmin)

 

Yet when I run the "sudo scutil --get LocalHostName" command it replies with "clean-imac"

 

So, the iMac itself is getting it's name wrong. Presumably the --set command with just change the "clean-imac" part of it. Is there anyway I can force it to forget it is "imac50"?

 

What baffles me is that I have re-imaged it at least twice calling it "clean-imac" both times. So why and where is it remembering "imac50" from?

 

The iMac appears in our DNS as "clean-imac" and is listed in AD also as "clean-imac". Yet, Apple Remote Desktop sees the Bonjour name as "clean-imac" and the DNS name as "imac50"!

Edited March 26, 2009 by Zoom7000

[HodgeHi]

You can use Apple remote desktop to change some of the records. Click on the machine you are looking at and then file > get info. This will bring up a window with the details for the machine. You can click the edit button and change the data shown. Whether this changes the data on the machine or just in ARD i'm not sure.

 

Have you also restarted the machine since?

[Zoom7000]

Have you also restarted the machine since?

 

Yes, many, many times!

[AntonioRocco]

Hi

 

I don't think this is your iMac? Look in the reverse DNS part of your DHCP/DNS Services. In my experience most windows admins tend to leave the scavenge stale records part of these services at their defaults. I think its 7 days? OpenLDAP in the main is all about reverse DNS, leastways that's how it is in Apple's implementation of it. From what I've seen of Active Directory its not that different.

 

Because macs are not necessarily DDNS aware it could be they're just picking up whatever stale record is left in the relevant services on your DC.

 

I would also look in the WINS tab of the Network Preferences Pane on the Mac itself and see what's being reported there. Macs are a lot more NetBIOS aware than ever before and I've sometimes seen an assigned name in that tab cause a problem with what the mac thinks its local hostname is.

 

I've also seen a NetBIOS name present itself as the local terminal user. Typically its a single number, usually the first octet of a reserved IP address range. Occasionally a name or combination of letters/numbers.

 

Antonio Rocco (ACSA)