MarsRed

Thanks for your reply! Unfortunately these options wouldn't work for a few reasons. First of all, we're not using Open Directory to manage the clients; Casper has its own preference management functions. Second, I do not want to replace the entire dock icon since different machines have different default docks in their user templates - so I'd rather not have multiple packages with different com.apple.dock.plists for each build and generation of preference templates. I think I have a way to solve my problem. I'm going to try it out today and will post back if successful. Thanks again.

Hi all, We're upgrading to a new version of Office and need to change the dock icons in every dock on every client. I've scripted this and am all set for existing users. However, I haven't figured out how to do this for the user template that will be applied to new users. We're using the Casper Suite, which creates its own user template in /System/Library/User Template/user.template. So the file I'm trying to modify is /System/Library/User Template/user.template/Library/Preferences/com.apple.dock.plist. For the existing users I used the the defaults command, but that seems to only work when there is a user associated with a given home folder. Any ideas on how I can remove and add icons to that template plist? Thanks!

Hi all, So I need to build a video streaming server that will allow faculty to access live video from their computers. I've heard a lot of good things about using VLC for this. I will have 200+ clients connecting simultaneously. My goal is to have several capture cards, each set to a specific cable TV channel, as well as one for internal video feeds. Does anyone have any experience/thoughts/tips to share about this? Specifically, any ideas about capture cards that work with Ubuntu to convert analog video signals? And any ideas about how to send a video signal over the network from the camera's location to the streaming server in the server room? Thanks!

Hello there, I'm running Mac OS 10.5 Server with an SMB share that was working fine until recently. Users who receive their access to the share via ACL rather than POSIX permissions are not able to access any files in the share. They ARE able to mount the share and view the root's contents. Everything is working with AFP - just SMB is having the trouble. I also have another SMB share on the same server and same volume that is not having any problems. Here are some of the things I've tried doing: Restarting SMB service Removing and re-adding the ACLs Added "nt acl support = no" to /etc/smb.conf Any ideas? Thanks!

What do you use for IPTV and/or Video Streaming in your school? I've tried Quicktime Streaming Server in the past and been disappointed with the quality.

Just returning to this issue now... Where does the OS info for the user agent string come from (on a Mac, if that makes a difference)? The machines exhibiting this issue show the correct OS version in System Profiler.

Thanks, this is very helpful! Now, without intentionally/manually changing the user agent string, why would a site think I'm running a different OS?

Hi all, How does a website identify a client OS version? For example, when I go to download Google Chrome from Google's website, it automatically knows which version of Mac OS X I am running. How does it do this? Where on the client OS does this information come from? Thanks in advance!

With CardExchange and Card5, are there printers bundled with the software, or do you need to go out and find a printer? If the latter, are there specific printers that work well with this software (perhaps that you've had good experiences with)?

Thanks for the info. I honestly don't know what we're currently using. It's not something I was involved with until being asked to look into a new system. Could you post a link to Card5's website? There are a few variations when I Google it and want to make sure I'm looking at the right one.

Hi all, We're looking to upgrade our Student ID Card printing system. Any recommendations? Ideally we could integrate it with existing data from our student management system, like student names/ID #s, as well as existing photos. Thanks!

Is your OD server running the same OS as the clients? (i.e. 10.5 server and 10.5 clients)

Try using OD groups and see if that makes any difference. I've experienced issues where WGM does not apply settings to AD groups for some reason. I've gotten around this by nesting an AD group in an OD group, then using the OD group for preference management.

If you click on that link I posted, it should say "ad-bind-login.sh" about halfway down the page. In case anyone has trouble getting to it, I'll post the contents of the Leopard (and SL) AD Bind script here. Note that it looks like this one is meant to be used as a login hook, so it will probably be necessary to alter it a little to fit an individual's needs. ---- #!/bin/sh # This script binds to AD and configures advanced options of the AD plugin # As this scripts contains a password, be sure to take appropriate security # precautions # # A good way to run this script is to set it as a login hook on your master machine # Because it only needs to be run once, the last thing this script does is to delete # itself. If you have another login script that you typically run, include the # script on your master machine, and indicate its path in the "newLoginScript" # variable. # # If running this as a one-time login hook to bind to AD after imaging, # be sure to enable auto-login (for any local user) before creating your master image # Host-specific parameters # computerid should be set dynamically, this value must be machine-specific # This value may be restricted to 19 characters! The only error you'll receive upon entering # an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation #computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address #computerid=`hostname` #computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names! computerid=`/usr/sbin/scutil --get LocalHostName` # Standard parameters domain="apple.edu" # fully qualified DNS name of Active Directory Domain udn="bind_account" # username of a privileged network user password="" # password of a privileged network user ou="CN=Computers,DC=apple,DC=edu" # Distinguished name of container for the computer # Advanced options alldomains="enable" # 'enable' or 'disable' automatic multi-domain authentication localhome="disable" # 'enable' or 'disable' force home directory to local drive protocol="afp" # 'afp' or 'smb' change how home is mounted from server mobile="disable" # 'enable' or 'disable' mobile account support for offline logon mobileconfirm="disable" # 'enable' or 'disable' warn the user that a mobile acct will be created useuncpath="enable" # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir user_shell="/bin/bash" # e.g., /bin/bash or "none" preferred="-nopreferred" # Use the specified server for all Directory lookups and authentication # (e.g. "-nopreferred" or "-preferred ad.server.edu") admingroups="" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\mac admins") packetsign="allow" # allow | disable | require packetencrypt="allow" # allow | disable | require passinterval="14" # number of days namespace="domain" # forest | domain # Login hook setting -- specify the path to a login hook that you want to run instead of this script newLoginHook="" # e.g., "/Library/Management/login.sh" ### End of configuration # Activate the AD plugin defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active" plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist # Bind to AD dsconfigad -f -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou" # Configure advanced AD plugin options if [ "$admingroups" = "" ]; then dsconfigad -nogroups else dsconfigad -groups "$admingroups" fi dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol \ -mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath \ -shell $user_shell $preferred -packetsign $packetsign -packetencrypt $packetencrypt \ -passinterval $passinterval -namespace $namespace # Restart DirectoryService (necessary to reload AD plugin activation settings) killall DirectoryService # Add the AD node to the search path if [ "$alldomains" = "enable" ]; then csp="/Active Directory/All Domains" else csp="/Active Directory/$domain" fi dscl /Search -append / CSPSearchPath "$csp" dscl /Search -create / SearchPolicy dsAttrTypeStandard:CSPSearchPath dscl /Search/Contacts -append / CSPSearchPath "$csp" dscl /Search/Contacts -create / SearchPolicy dsAttrTypeStandard:CSPSearchPath # This works in a pinch if the above code does not #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains" #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3 #plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist #killall DirectoryService # Destroy the login hook (or change it) if [ "${newLoginHook}" == "" ]; then defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook else defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook fi # Disable autologin defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser srm /etc/kcpassword # Kill loginwindow to return to the login screen killall loginwindow # Destroy this script! srm "$0"

I second what dbhbbc says about the passinterval. OS X, by default, changes its AD machine account password every 14 days. However, if the machine cannot contact the domain controller at that time, it seems that the machine still changes its password and AD just doesn't know it! When you bind your Macs for the first time, you may want to do so with a script so that you can set the passinterval at the beginning and avoid issues. Bombich has a script that you can take a look at (Bombich.com: Mac OS X Management Custom Shell Script Library). Just plug in your site-specific info and make sure to change the "passinterval" option to 0.

Using something like Apple PackageMaker (free) or JAMF Composer, you could create a package that includes these settings, then install the package with Apple Remote Desktop. Packagemaker and Composer (and other similar applications) can monitor changes you make on a machine and then make a package of the modified files. So you would scan the machine beforehand, make your changes (i.e. add passwords to keychain), then scan it again; the software then creates a .pkg file.

Hi all, I have an external firewire drive set up as an AFP share on a 10.5 Server. All has been well (for 6+ months) until I went to find a file today. Two of my folders/directories have disappeared! I checked the AFP log and it has not logged anything since February 4th. I restarted the AFP service and the logging resumed, but I still can't figure out what happened to my folders. I am the only one with permissions to delete those folders. Any thoughts would be VERY much appreciated. Needless to say, this is worrisome! Thanks!

Apple Remote Desktop (ARD) has many more features than Windows Remote Desktop Connection. ARD allows you to screen share, install software packages, send UNIX commands, collect reports (usage, applications, etc), and several other helpful features. Apple - Remote Desktop 3 There is an Admin application that you have to buy, but each OS X client comes with the client software built in (can be activated in Sharing in System Preferences). As far as installing software goes, it would have to be in .pkg format - which many titles come in already, or you can easily re-package those that don't (using, for example, Apple's free PackageMaker utility). You can 'manually' install the software with ARD, sending it out at a specific moment to specific machines (or groups of machines), OR you can use ARD as a 'task server' that will automatically install the software when a client next comes online.

It sounds like you're looking to do several things. Let me see if I understand completely. 1 - Easily deploy new software 2 - By default, make icons appear in Dock when AD users log in 3 - By default, apply certain user-based preferences/settings when AD users log in Does that sound about right? How you go about this would probably depend on how many Macs you have and how much you want to spend. There are enterprise solutions like JAMF's Casper Suite that would allow you to do all of the above. However, smaller setting could probably use Apple Remote Desktop to deploy packaged software and local MCX preferences for user settings/preferences.

When they log in, are you using network home folders, a mobile account with network home folder, or a local home template? Are your Macs bound to Active Directory, Open Directory, or both? If OD, it's possible your mobile account creation settings are different for the student and teacher groups, so you might check that in Workgroup Manager.

I was having this issue, too. You need to set the machine to generate client data for the reports (simply adding the machine within ARD Admin will not do this). Double click on a machine in ARD to reveal the "info" window (if double clicking doesn't do this, you can control-click and select Get Info). You should see three tabs - Attributes, Reporting, and Administrators. Click on Reporting, then Edit, and choose which types of data you want to generate (System Profile, File System, Application Usage, User Accounting) and how often you want to generate it. Then click Done and you should be all set. Good luck! And post with any questions.

Hi all, I'm revisiting an issue I have with joining Windows machines to my 10.5 server PDC. I have PDC on SMB service enabled, as is WINS server. When I go to join the domain in XP, it prompts me to authenticate, but then returns with the following message: The following error occurred attempting to join the domain "DOMAIN": Insufficient system resources exist to complete the requested service." The only log that seems to log anything related to this is the Password Server Service Log, which says that authentication succeeded. Odd, right? Anyone have experience with OS X as PDC? Please let me know if you have any ideas! Thanks! Jason

So I finally figured out how to do this, and I'll post my findings here in case anyone else is interested. To run the script as the user and make changes to the current user's dock, I used the following: ---- #!/bin/sh sudo -u $USER defaults write $HOME/Library/Preferences/com.apple.dock persistent-apps -array-add "tile-datafile-data_CFURLString/Path/to/Application_CFURLStringType0" killall Dock exit 0

So I've made some progress on this... I can accomplish #1 with an .mpkg and I can do #2 with a script. However, the issue I'm running in to is that, when I run the script as postinstall or postflight at the end of the package, it is run as root and, therefore, does not have any effect on the individual's dock. Any thoughts on how I can get that final script to run as the USER even though the package is run as root? Thanks!

In your initial post you wrote that you added the machines to WGM by Mac address and IP address. If you properly bound the machines to the network (in Accounts preferences or Directory Utility on the clients) then it should automatically create the machine account in WGM. I would start by deleting the machine accounts you created in WGM and then re-binding your clients. (Just adding the machines by MAC address and IP address would not give you control over their preferences since there is no way of knowing if that machine trusts your server). Good luck!