AD/OD Password and Keychain Syncronisation

[jlucas]

We have 3 suites of Macs (Leopard) here all authenticating against active directory and I'm having problems keeping the Macs keychains in sync with their AD counter-parts.

 

Normally if a user has forgotten their password we change it for them from the Windows server but when they log back into the Macs their keychain no longer matches. The main problem is Safari complaining which is starting to drive our Creative and Media students round the bend.

 

I've looked into the KeyChain Minder application and looks like it does the job but I'm a bit worried about how well the users will be able to use it.

 

Has anyone got any experience in using KeyChain Minder or another more transparent solution?

 

Cheers

James

[HodgeHi]

From what I understand when a password on the Windows account has been changed, when you log into the Mac it brings up a dialog that tells you that it doesn't match the keychain and so gives you the option to update it.

 

Alternatively you could just trash their keychain when an account has had it's password reset.

[morganw]

I've got the same problem here, I think the problem is that the keychain dialogue boxes that pop require far too much thought to work out what they mean. If you press the right buttons it isn't a problem, but it seems most people just press anything just to get to start working.

 

I think the easiest solution is to use a script to delete the keychains every night, but then you wreck it for everyone who does actually understand how to use it.

[Carter]

Why use this? I have the default profile set so that when a new AD user logs in, it will copy the default profile and create a new keychain for the user. Login is only a few seconds, no difference from a local user except that it just needs to quick copy the default profile that I built.

 

How do you built your default profile? If you need a hand I have a Automator script that I built that runs through and does the needed copying, trashing of unneeded files, cache, keychain, repair permissions, and so on all in one click.

 

All I ever do is make the needed adjustments to the local user "default" that I have for building what I want the user to see then once I'm happy I logout to then run the script then that's it, make a copy and deploy.

 

When users go to login they get the new profile and so on.

 

Hmmm... may have stated more than I needed to in my response :-)

 

Let me know if you want to see the script.

 



Edited March 11, 2011 by Carter

[Carter]

Ok, so incase what I posted above may help out with your issue I decided to go ahead and update my document and post it up with the updated script. http://www.edugeek.net/forums/mac/72443-how-create-os-x-default-profile-template-bind-ad-10-5-10-6-a.html

 

Hope this helps

 

