reggiep Posted May 12, 2009 Posted May 12, 2009 Hi All, Despite the fact that we have had macs running in our school for the whole school year I can still not claim that they have worked they way I wanted them to. Firstly they were local log on, then they were added to active directory THEN i went on a mac course and set up a mac server so that I could control the user experience while still letting users authenticate to active directory. My problem is that when I bind the workstations to both open and active directory the machines tend to lose the active directory and will not let users log on. It doesn't happen straight away. But when it does I have to remove the active directory binding and then add it again. The machine may work then for a day a week or more but then it will lose it again? there are 30 machines and every day I have resorted to logging in to them as a test user and then fixing the broken ones. this is time consuming and stupid! Does anyone have any ideas? Oh yeh I'm on 10.5.6.
reggiep Posted May 12, 2009 Author Posted May 12, 2009 (edited) It's always nice to know you are not the only one! Edited May 12, 2009 by reggiep
DMcCoy Posted May 12, 2009 Posted May 12, 2009 Server and clients both 10.5? 10.4 will corrupt the AD settings on a regular basis. Are you synchronising the time on the machines to the DC? When the stop working do a "sudo dsconfigad -show" to see if the domain name is still correct (this becoming part of the ldap oid was the issue on 10.4).
Geoff Posted May 12, 2009 Posted May 12, 2009 I recall DMcCoy having a hilarious time with these sorts of issues. I'll try and find his threads.
DMcCoy Posted May 12, 2009 Posted May 12, 2009 I recall DMcCoy having a hilarious time with these sorts of issues. I'll try and find his threads. I'm not sure hilarious is the word. 3 years of Apple hell? That's probably a better description! Up to 12 of 25 screens replaced now
Marci Posted May 12, 2009 Posted May 12, 2009 Have you moved AD plugin to be positioned ABOVE the OD plugin the SearchPolicy list (Go > Utilities > Directory Utility) on your clients? Also, bear in mind that on boot, it takes a few minutes for the AD plugin to connect, so will refuse to login for up to 2 minutes - despite presenting you with a login box, the system still isn't completely ready to connect basically.
reggiep Posted May 12, 2009 Author Posted May 12, 2009 Server and clients both 10.5? 10.4 will corrupt the AD settings on a regular basis. Are you synchronising the time on the machines to the DC? When the stop working do a "sudo dsconfigad -show" to see if the domain name is still correct (this becoming part of the ldap oid was the issue on 10.4). I fired up terminal and typed the above. My domain is correct but the computer account is not!! When I go to sys prefs/sharing I see that the computer name is iMac-u40-011 but below that it says "computers can access this computer by going to iMac-u40-70.local" And at the terminal it gives that name too. Could this be the problem?
reggiep Posted May 12, 2009 Author Posted May 12, 2009 Have you moved AD plugin to be positioned ABOVE the OD plugin the SearchPolicy list (Go > Utilities > Directory Utility) on your clients? Also, bear in mind that on boot, it takes a few minutes for the AD plugin to connect, so will refuse to login for up to 2 minutes - despite presenting you with a login box, the system still isn't completely ready to connect basically. Yep done that.
iSteve Posted May 12, 2009 Posted May 12, 2009 You can't bind to both. We bind to AD, but then add in our OD server to the LDAP list but do not bind. This allows logins via AD and management via OD/MCX. This set up (with 10.4 and 10.5 clients) works fine. Management is off a 10.5 server. There was a big fat bug in the 10.5.4 AD plug in which caused bindings to be lost whenever the machine felt like it, but using version 1.6.3 which went in to 10.5 works much more reliably.
DMcCoy Posted May 12, 2009 Posted May 12, 2009 You can't bind to both. We bind to AD, but then add in our OD server to the LDAP list but do not bind. This allows logins via AD and management via OD/MCX. This set up (with 10.4 and 10.5 clients) works fine. Management is off a 10.5 server. You can bind to both, it's perfectly fine with 10.5. With 10.4 it would just get upset unless you sorted out the kerberos records manually to stop it getting confused. Not that our OD contains any users anyway!
PEO Posted May 12, 2009 Posted May 12, 2009 did a lot of swearing today but managed to get all the machines binded to the AD. all working now Dam mac's
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now