pantscat Posted January 27, 2011 Posted January 27, 2011 Hello, I've recently bought a Mac mini server and have been playing around with AD/OD integration. I've got my macs bound to AD and OD, and I've set the AD binding to map the user's home folder based on the entry in AD. I've got three issues that I'd quite like help with... Number 1: The home directory mapping seems to be working absolutely fine for staff (the home folder connects without a problem) - but it doesn't work for pupils at all - I always get a message: "The home folder for user "bananas" is not located in the usual place or cannot be accessed. The home or users folder may have been moved or deleted. If the home folder is locatedon the network, the server may be unavailable temporarily." Any ideas? The user can connect to the folder absolutely fine by using "Go --> Connect to Server" which is odd. Issue number 2: If I sucessfully login using an AD account, then logout and try and login again using a different AD account I get a message "You are unable to log in to the user account "bananas" at this time" (Logging in to the account failed because an error occurred). What's going on there?! Issue number 3: When the system boots up it takes it a brief moment to show the "Other..." user logon option. Then if I choose that to logon using an AD account it takes a few attempts (or a minute of waiting or so) before the user will authenticate properly. Having been initially skeptical about having Mac integration there was a brief moment when I got excited about the prospect when I got it working nicely on my macbook. Now that I've discovered these other little quirks I'm now back to being a bit skeptical. I'd be really grateful for any pointers. Thanks, Ant
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Further investigation shows that I get these issues on 10.5 and 10.6... bah!
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Hmm... found this (Mac OS X v10.6: Successive Active Directory users receive "You are unable to log in to the user account (username) at this time" alert) relating to issue number 2 - but I can't find the file it refers to in the KB article. In fact I can't even find a folder called "etc". Surely it's on the MacOSX volume somewhere?!
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Ah... I seem to be answering my own questions. (It's like an online version of talking to yourself and slowly slipping into insanity). So... the fix above works for 10.5 as well as 10.6. Turns out that you need to pretend that your mac is a linux box, use a terminal and vi to edit the file. Who knew?! ;-) Wow... one down... two to go. I thought these mac things were supposed to "just work". Still, I do like the shiny loveliness of my Macbook Air.
Tricky_Dicky Posted January 27, 2011 Posted January 27, 2011 Getting a bit lost here. Which bit have you solved and which bit is still not working?
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Sorry about that - I did ramble a bit. Issue number 2 is solved. Issue 1 and 3 still here...
sjatkn Posted January 27, 2011 Posted January 27, 2011 Issue number 2: If I sucessfully login using an AD account, then logout and try and login again using a different AD account I get a message "You are unable to log in to the user account "bananas" at this time" (Logging in to the account failed because an error occurred). What's going on there?! I had the same problem. What does nslookup yourdomain.localgive you. It should return a list of all the DC's available on your network, in mine there was an extra entry which was not a DC. Removing it seems to have resolved the problem here (staff are not reporting any problems at least!).
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Already checked out DNS - it's all hunky-dory. Just my normal three DCs.
Tricky_Dicky Posted January 27, 2011 Posted January 27, 2011 Number 1: The home directory mapping seems to be working absolutely fine for staff (the home folder connects without a problem) - but it doesn't work for pupils at all - I always get a message: "The home folder for user "bananas" is not located in the usual place or cannot be accessed. The home or users folder may have been moved or deleted. If the home folder is locatedon the network, the server may be unavailable temporarily." Any ideas? The user can connect to the folder absolutely fine by using "Go --> Connect to Server" which is odd. I found this to be a permission problem on the home folders. I'm presuming your home folders on on your normal Windows box in a format that looks something like \\server\users\students\bananas \\server\users\teachers\bananas_teachers Then they need to be able to read the student level folder, not just bananas to allow it to mount it at login. I don't know why, or if this is the best way of doing it, but it seems to work. Issue number 3: When the system boots up it takes it a brief moment to show the "Other..." user logon option. Then if I choose that to logon using an AD account it takes a few attempts (or a minute of waiting or so) before the user will authenticate properly. Using the managed preferences, just remove the Other and have only username and password showing. Then when the light goes green you are good to go. Our Macs work well now, but it does take some tweaking to get right. 1
pantscat Posted January 27, 2011 Author Posted January 27, 2011 (edited) @Tricky_Dicky - Ah! I did wonder if it was a permissions issue... but didn't really think too much about it. That makes sense now - I'll try it with a test user and report back. Thanks - I'll try changing the logon box and see how it goes! Have changed to "username and password" showing... but I can't see a green light... am I being dim? Edited January 27, 2011 by pantscat Quick update...
Tricky_Dicky Posted January 27, 2011 Posted January 27, 2011 The green light: Can you see above the username and password boxes you probably have the machine name? If you click on it it will scroll through various pieces of information such as time and date, IP address and then network account status. 1
pantscat Posted January 27, 2011 Author Posted January 27, 2011 (edited) I never knew that! Genius! I owe you a beer... Is there a way to make it default to displaying the 'green light'? Edited January 27, 2011 by pantscat ETA
Tricky_Dicky Posted January 27, 2011 Posted January 27, 2011 Lol, it's one of the very handy little tips that macs are full of but are a nightmare to find. It will normally retain the one you last left it on. Is everything else working now?
pantscat Posted January 27, 2011 Author Posted January 27, 2011 Cheers for that - I think everything is working now!
clareq Posted January 27, 2011 Posted January 27, 2011 You can use Workgroup Manager to enforce Directory Status heading and Name and Password text fields in the login box.
pantscat Posted January 27, 2011 Author Posted January 27, 2011 (edited) Thanks Clare - that's good to know! Edited January 27, 2011 by pantscat edited to remove stupidity.
_Bat_ Posted January 31, 2011 Posted January 31, 2011 Issue number 3: When the system boots up it takes it a brief moment to show the "Other..." user logon option. Then if I choose that to logon using an AD account it takes a few attempts (or a minute of waiting or so) before the user will authenticate properly. Just an additional reason why this could happen (it happened to me). I found that our OSX server hadn't integrated properly with AD, and kerberos was still running, so there was OD kerberos, and AD kerberos running simultaneously. This caused the symptoms you describe, but logging in was far more hit and miss - it seemed to be whichever kerberos server responded first. Disabling kerberos on the OD server solved this issue for us. Just thought I'd post this in case it helps anyone else.
pantscat Posted January 31, 2011 Author Posted January 31, 2011 @_Bat_ - thanks for that - just double checked and I've got OD kerberos disabled. I think it was just my impatience and ignorance that was the problem!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now