jasonthat

emamjomeh - good to hear that it worked for you. Yea we really couldnt do the text file thing for computer assigning using mac addresses, since our laptop distribution method is a mess. our boss has his own way of doing things

Sure no problem. Here you go: [size="1"]#!/bin/sh #Give the network time to come online logger "Sleeping 30 seconds" sleep 30 systemsetup -setusingnetworktime off systemsetup -setnetworktimeserver myAD.com systemsetup -setusingnetworktime on #Set Bonjour and Computer Names logger "Setting Bonjour and Computer Names" computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }' | cut -c 7-19` # last 6 digits MAC Address computerid2="(Optional)Prefix for computer name""$computerid" logger "Computer name is $computerid2" scutil --set LocalHostName "$computerid2" scutil --set ComputerName "$computerid2" sleep 3 # Standard parameters domain="myAD.com" udn="AD Administrator" password="AD password" odudn="OD Administrator" odpassword="odpassword" ou="CN=Computers,DC=myAD,DC=com" odserver="myOD.com" # Advanced options alldomains="enable" localhome="disable" protocol="smb" mobile="disable" mobileconfirm="disable" useuncpath="enable" user_shell="/bin/bash" preferred="-nopreferred" admingroups="myAD\Domain Admins,myAD\Enterprise Admins" packetsign="allow" packetencrypt="allow" namespace="domain" ### End of configuration # Activate the AD plugin defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active" plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist # Bind to AD dsconfigad -f -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou" # Configure advanced AD plugin options if [ "$admingroups" = "" ]; then dsconfigad -nogroups else dsconfigad -groups "$admingroups" fi dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol \ -mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath \ -shell $user_shell $preferred -packetsign $packetsign -packetencrypt $packetencrypt \ -namespace $namespace # Bind to OD sleep 10 dsconfigldap -v -f -a "$odserver" -n "$odserver" -c OD_$computerid -u $odudn -p "$odpassword" sleep 20 # Restart DirectoryService killall DirectoryService # Add the AD node to the search path if [ "$alldomains" = "enable" ]; then csp="/Active Directory/All Domains" else csp="/Active Directory/$domain" fi sudo dscl "/Active Directory/All Domains" -list /Computers > /dev/null sleep 10 sudo dscl /Search -append / CSPSearchPath "$csp" sudo dscl /Search -create / SearchPolicy dsAttrTypeStandard:CSPSearchPath sudo dscl /Search/Contacts -append / CSPSearchPath "$csp" sudo dscl /Search/Contacts -create / SearchPolicy dsAttrTypeStandard:CSPSearchPath #Add LDAPv3 to od server odcsp="/LDAPv3/$odserver" sudo dscl /Search -append / CSPSearchPath "$odcsp" # This works in a pinch if the above code does not #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains" #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3 #plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist #killall DirectoryService[/size] Now there is a possibility that this script might sometimes not work for you, as I have seen the scripts that work for others do not work for me and end up modifying it (the above is originally from Bombich's binding script). It all depends on your setup environment, what you are trying to achieve and sometimes different versions of the components involved in the "triangle" setup. Are you trying to manage your Mac machines and do you plan to apply MCX policies on computer-based groups or just user-group policies ? Anways if it helps, I will just tell you a bit about my setup,: - Initially, only an AD server (Win 2k3) on the network and later on, we decided to setup a Mac OS X server(Leopard 10.5.7) - Done by joining the AD domain first and promoting to OD master later (guessing you have covered all the AD & OD setup topics properly) - The Search policies on OD master is in the order - OD first & AD second under Authentication and under Contacts, only the AD entry. While it is exactly the opposite on the client machines, i.e, AD first & OD second under Authentication and only AD entry under Contacts tab. Also to note, using the above script, I bind clients to the AD first & then OD - reason for this is because while I had tried both ways - it seems the "Other" option at login window, for domain users to login, took more time to show up (approx.5-6 seconds) when I do a OD bind first whereas it takes only like 1-2 seconds for the "Other" option to show up when I do AD bind first. Anway see what works for you. - One change that you would need to make to the above script is the dsconfigldap -f switch, depending on whether you need authenticated or unauthenticated binding. If unauthenticated, replace in script with something like this: [size="1"]# Bind to OD sleep 10 dsconfigldap -v -a "$odserver" -n "$odserver" -c OD_$computerid sleep 20[/size] Again, this needs to be decided based on what you plan to do with MCX policies. I know for me doing an unauthenticated bind on clients works perfectly (some tell otherwise) for applying user-group based policies whereas if you are thinking about computer-based policies, you might need to think about authenticated binding which makes the computers show up automatically in Workgroup manager. Of course, there are ways to get around this so as to make the computers show up in WGM like manually adding the computers in WGM along with their mac addresses by either typing each one individually or using scripts to add them to WGM Computer Groups. But I prefer not to go much in that direction just because I am not in favor of it. - Another interesting observation that I found along the way is the fact of running the script (through ARD) on clients over a wired or wireless connection. This is also related to the authenticated/unauthenticated binding - seems that when I have the -f switch in there and running it wirelessly gives out the dscl errors and with failed binding to OD most of the times. Again running over wired, the script works like a charm for all the machines. On the other hand, if you the remove the -f switch (unauthenticated) it works properly on both wired or wireless. This might have something to do Apple's binding technology looking only for an ethernet mac address or simply put, just dont bind wireless Long story short, see how the script works out for you - I use it both as a login hook on master images and ARD. If you are using ARD, you could just rename the computers there itself and do not need the "#Set Bonjour and Computer Names" and replace with ## Host-specific parameters computerid=`/usr/sbin/scutil --get ComputerName`

Thanks antonio. But since I needed to have it done soon, I went ahead and tried the script again. Silly me, I just had to put quotes around the /Active Directory/All Domains. But I will remember to use these commands next time. sounds easier and quick. And totally resetting the network settings on the mac sounds cool to me. Always like to follow the "total reset" methods with most of the tasks I do on the network. Thanks again.

If any of you wouldn't mind giving some recommendation on this? Thanks again.

I am looking for the best way to do this - Need to remove a bunch of machines on my network from the AD & OD bindings. Is removing the Directory Services "folder" (& the edu.mit.kerberos file) a recommended way to do this, by doing the following: cd /Library/Preferences rm -R -i DirectoryService sudo shutdown -h now Any known issues that would come up if I delete this folder? Or if not, could someone help me with these commands. I tried the following commands and the removal from AD & OD were successful but I just cant seem to take out the "/Active Directory/All Domains" entry from the Authentication & Contact search path policies with these commands: #!/bin/sh # Standard parameters domain="myAddomain" udn="administrator" password="password" odudn="OD administrator" odpassword="password" ou="CN=Computers,DC=myAD,DC=com" odserver="myOD.com" # Remove from AD dsconfigad -f -r -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou" # Remove from OD sleep 10 dsconfigldap -v -r myOD.com sleep 20 # Restart DirectoryService killall DirectoryService sudo dscl "/Active Directory/All Domains" -list /Computers > /dev/null sleep 10 sudo dscl /Search -delete / CSPSearchPath /Active Directory/All Domains sudo dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/All Domains sudo dscl /Search -delete / CSPSearchPath /LDAPv3/myOD.com sudo dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/myOD.com sudo -r /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains" sudo -r /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3 killall DirectoryService Thanks

Thanks skawarrior. Nevermind I figured it out, it might have been because I did not add "sudo" to the dscl commands (that's strange even though we run the script as root) and also corrections to the writing of the SearchNodeConfig.plist files - we do not need to add LDAP search paths in there. These are the corrections that had to be made to the script (if it will help anyone): Yes we have been very much looking into the possibility of using Deploystudio for our imaging, but has been put in the backburner for now, since we haven't had enough time to test it out before start of the acamedic year. Thanks again for the reply!

I am trying to use this script for binding mac clients (10.5.7) to AD and OD (10.5.7) to be included in the master image. However the script keeps giving me this error most of the time (works rarely): attribute status: eDSNodeNotFound DS Error: -14008 (eDSNodeNotFound) Strange thing is that it works sometimes, like when I make some small changes to the script, save it and run again through the terminal, on the exact same computer that it doesn't work. The binding to both AD & OD works fine though - it is only the search path for AD that does not get added automatically. HELP! Here is the script I am using: [size="1"]#!/bin/sh #Give the network time to come online logger "Sleeping 30 seconds" sleep 30 systemsetup -setusingnetworktime off systemsetup -setnetworktimeserver myAD.com systemsetup -setusingnetworktime on #Set Bonjour and Computer Names logger "Setting Bonjour and Computer Names" computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }' | cut -c 7-19` # last 6 digits MAC Address computerid2="""$computerid" logger "Computer name is $computerid2" scutil --set LocalHostName "$computerid2" scutil --set ComputerName "$computerid2" sleep 3 computerid=`/usr/sbin/scutil --get LocalHostName` # Standard parameters domain="myAD.com" udn="myAD admin" password="myAD password" ou="CN=Computers,DC=myAD,DC=com" la="local administrator" lp="local password" # Advanced options alldomains="enable" localhome="disable" protocol="smb" mobile="disable" mobileconfirm="disable" useuncpath="enable" user_shell="/bin/bash" preferred="-nopreferred" admingroups="myAD\Domain Admins,myAD\Enterprise Admins" ### End of configuration # Activate the AD plugin defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active" plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist sleep 20 # Bind to LDAP dsconfigldap -v -f -a myOD.com -c OD_$computerid -n "myOD" -u myOD admin -p myOD password -l local administrator -q local password sleep 10 # Bind to AD dsconfigad -f -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou" -la $la -lp "$lp" # Configure advanced AD plugin options if [ "$admingroups" = "" ]; then dsconfigad -nogroups else dsconfigad -groups "$admingroups" fi dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol \ -mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath \ -shell $user_shell $preferred # Restart DirectoryService (necessary to reload AD plugin activation settings) killall DirectoryService # Add the AD node to the search path if [ "$alldomains" = "enable" ]; then csp="/Active Directory/All Domains" else csp="/Active Directory/$domain" fi dscl /Search -read dscl /Search -create / SearchPolicy CSPSearchPath dscl "Active Directory/All Domains" -list /Computers > /dev/null dscl /Search -append / CSPSearchPath "/Active Directory/All Domains" dscl /Search -append / CSPSearchPath /LDAPv3/myOD.com dscl /Search/Contacts -create / SearchPolicy CSPSearchPath dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains" # This works in a pinch if the above code does not defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains" defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/LDAPv3/myOD.com" defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3 defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains" defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig "Search Policy" -int 3 plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist #Exit exit 0[/size] Could someone please tell me whats wrong with this script? Have been trying to fix it for so long but just can't seem to get this working properly. Thanks.

Hi Antonio I tried the integration according to the methods above but now on the mac clients, after binding to AD & OD, the OD node in the "Directory Servers" tab gives status as "This server is responding normally. This server is not your authentication search policy." The AD is responding normally. FYI, all the macs are imaged clients using netstore. Not sure if imaging is an factor to be considered in any sort of binding issues. AD login is working fine.

Thanks Antonio for the excellent reply!! Please read my replies inline in blue. It all depends on what you want. If you want a 'classic' AD-OD Integration and you're not interested in Augmented Records then: Yes a classic AD-OD integration is all I am looking for at the moment, don't want to try out anything crazy with macs, mostly because I am still new to macs and although I have read a few things about Augmented Records, the topic is still not fully understood to me. However from a user point of view, what kind of OS X related services are available to AD users, i.e, for an AD user logged into a mac, what are things that DOES/DOES NOT work if augmented records WERE/WERE NOT setup respectively, say if, they were using iChat? (a) make sure relevant DNS Entries have been made OSX Server Perfectly working with all DNS forward & reverse records setup ,entry in DHCP, etc. (b) Bind OSX Server to the DC using the relevant plug-in Module in Directory Utility What you should see after doing this is AD Users and Groups 'flow' into the /Active Directory/All Domains node in Workgroup Manager. At this point OSX Server is simply behaving as a Domain Member. The Open Directory Service will report it as being 'Connected to a Directory System'. /Active Directory/All Domains will be listed first in the Search Policy in Directory Utility. Happy to say that this is exactly the method I followed and saw the AD listed first. © Promote OSX Server to OD Master. This should not take too long. If it does review the DNS Service as well as looking at the slapconfig.log in Console. Everything gets logged in OSX Server. Good tip. Might help in future also. (d) If Promotion has been successful you should see in the Open Directory Service's Overview Pane that everything except Kerberos is Running. Kerberos should be stopped. Since 10.5.4 you don't get the 'Join Kerberos' button anymore. Any Services that can be 'kerberized' will already have service principals records created for them. You can test this by starting a service and issuing: Now I have to ask (one of my doubts), Are you absolutely sure that since 10.5.4 the "Join Kerberos" button does not show anymore? Because I could swear on my life that this shows up for me - Server is running on 10.5.7 Leopard. I would have shown you a screenshot of this but I am away from the network right now. While testing over & over again (demoting, removing from domain, etc. must have tried 5 or 6 times) I kept seeing that button but never clicked on it. I just went ahead and promoted the server to Master, after joining to AD., after which, in the Overview of OD settings, I see everything except Kerberos started and with proper LDAP search base below (No kerberos realm here, guess does not show in Leopard). sudo kadmin.local -q list_principals from the command line. If you launch Directory Utility and inspect the Search Policy you should now see the Server has promoted itself above the /Active Directory/All Domains listing. Inspect the LDAPv3 Plug-in and you should see the server has added an entry for itself using the loopback address 127.0.0.1. This is all normal. The only time this would change would be if you're interested in providing Augmented Records for OSX Server Services for Active Directory Users and Groups. For example: iCal, iChat, Wiki & Blog etc. In that environment you would make the Server an OD Master first and then bind to AD. This definitely makes sense...the fact that I have been getting confused a lot from reading people's post on many forums about promotion to OD Master first or binding first. Client side and if you're not using Augmented Records you always bind to AD first followed by a join to LDAPv3. Clear! Give the above and to answer your questions specifically: (Q) I was looking at WGM, after a test client was bound to AD first and OD second - my confusion is, once the client is bind to an OD, wouldnt that computer record show up in the list of "Computers" in WGM (not the AD records) (A) A mac client computer will only show in WGM once it has been bound to OD (regardless of whether it is bound to AD or not) if you add it to a computer list using the diaresis button (3 dots) in the relevant area in Workgroup Manager. Sorry but your bracketed line broke up the sentence - Do you mean even after binding a client to OD, I would still not see it in WGM and further I have to "manually" add the computer to a computer list by going into "New Computer" option. Would there be no way of making the mac client show up automatically? Depending on how you have your OUs, DHCP and DNS Services configured you may well see an 'entry' for it appear in Active Directory. However I doubt there would be much you could with it once there unless you had something like Centrify installed on your DC. Centrify allows AD-style GPOs and management preferences to be 'passed on' to mac clients without the need for OSX Server. Yes I have come across this topic (I see the bound clients in default computers OU). Which is I have been looking into those options - Centrify & Likewise. But thanks again for the wonderful lesson Antonio Definitely helps a lot.

Thanks for the reply matt 2) This search order would be on the OD server or clients or both? 3) Yes it does show the test client (bind to first AD & OD) in WGM, but this is under the list of AD objects but would not show up under the list of OD Computers, i.e., you change the WGM directory browsing to /LDAPv3/myodserver.com (I can see the OD master listed in there though).

My questions in order of confusion: 1) At the time of joining OD into AD, do I need to hit the Join Kerberos button before turning the server into an OD Master? 2) On the OD Master, does the LDAP entry have to be before the AD in order (in search policy - authentication) ? On the Mac client, does it have to be the other way around? Search Policy order - AD first & OD second? 3) The "Enable authentication to directory binding" option in Open Directory - Server Admin - does this have to be enabled or does it matter? 4) I was looking at WGM, after a test client was bound to AD first and OD second - my confusion is, once the client is bind to an OD, wouldnt that computer record show up in the list of "Computers" in WGM (not the AD records) ? Really would love to hear some answers to these! Thanks.