2097

Was working fine on Yosemite ( when i say fine was buggy ! but not these problems ). The server is a reasonable spec "Mac Mini Server" which was the i7 model. Looks like there was no easy way to Copy AD users to a OD group so i found a way: Create the OD groups and add a single user to them . Then export all the groups in Server.app ( save them as separate files). Now delete the OD groups. Now in the Server App goto each AD group ( 1 at a time ) Export to desktop , open file and you will see the list of usernames . I found that i had to remove the "Domain" part of the username so i did a find and replace to remove "Domain" . Copy list of usernames to the exported OD group file . now just click Import in Server App and it will be created. Does make me wonder if this is a bug ! as it seems i couldn't add a user into a OD group which is "Domain\Username" ( Thats how they are listed in my AD groups which are listed as 0 members ! ) but it would allow me to just add them as a single username without the domain tag at the beginning and they then show up in profile manager.

From what i can see it seems Login items is broken as none of it works ( i.e. i cant set it to open a program at login ) under a user policy I have instead added the shortcuts to the dock so they can click on it to mount it ! what a pain though

Unsure if any one has taken this plunge yet ! but i thought i would give it ago. This is a fresh install from Yosemite ( big trouble trying to migrate from a Raid setup so i went for a fresh ! ). Problems i have seen so far are In the server tool my groups took a whole day to populate ! , after adding a profile in profile manager the "Profile Manager" interface says these groups have no members ! , the server app says different ! . Workaround is assigning uses to OD groups instead ! , pain in the arse but is ok for the time being. My biggest problem is none of my bloody SMB shares are mounting !, they are able to connect to SMB's fine using the "Connect to Server" and it dont even ask them for credentials as its using AD credentials . Only way around this i can imagine is mucking around with custom settings to make a symlink on their desktop !. Any one else had these problems with Sierra or Mavericks ?

Yes to all and most of the time it tends to work ok . Only problems i seem to have is random machines dropping off and sometimes the users AD homedrive is full so the profile fails to pull down . I am thinking of change it to local profiles and doing linking to SMBs via a script of some sort.

Is there an option to do that via profile manager for clients ?

We are using profile manager here running on a Mac mini ( dual HDD server version) which came with Yosemite. They are setup to link TO AD and their mac profiles are stored within their AD homedrives. Half my machines are Yosemite and the other half are El Capitan , i find very randomly the macs decide to not login with an AD account and the only way to get them to work again is to unenroll and rejoin . Does any one else have this problem ? does my head in and has been happening on and off for a year atleast .

around 90 hikvision here with 3 NVRs ( raided ) I have 4 hikvision at home ( bullet and mini dome ), mine are just connected to a NAS though They are by far the best bang for the buck !

^ This , the 260 had the same problem . For windows 7 PXE booting . Via the bios i went to Security > Secure Boot Configuration and enabled "Legacy Support" also disabled "Secure Boot".

Buy them ? I prefer to do most on linux as its free

I have a hosted domain with cpanel . I have a script running on a Linux server that when my local ip changes it updates the DNS entry on the cpanel . This allows me to openvpn into home all the time .

Running at home in the garage and trunked into the loft Fujitsu PRIMERGY RX1330 M1 x2 Layer 2 HP Procurve 2520G-24-POE x2 Qnap Storage for Cameras x1 Cisco Meraki MR18 Hikvision cameras , Samsung smartthings ( just for security atm) , Sonos throughout No hardcore services running on the Fujitsu servers, just vmware hypervisor with multiple Linux and Windows OS's.

Indeed i have and even queried regarding the downtime and if users had a backup line . Does Zen offer DDOS protection as standard ?

We are currently considering moving to Schools Broadband ( From BT ) and would love if any network managers that have implemented them into their schools could comment on this thread. Ideally we would like to know about reliability , Failover to a backup line and general downtime . Another question is also the speed , any one using a 100mbit/200mbit connection getting close to the maximum speed ? I have read the previous thread regarding the fortigate issues and Filter 11 . We wont be using their webfiltering so that should be a problem with us . Many thanks

Yep Correct, for a school like ours that everything is hosted internally the only problem we would have is website and external access . Our mail server will go down , but we could always have an external server as the 2nd MX record .

Does no one here pay for a backup line that doesn't go through the fortigate ? , wouldn't that then give you a 100% uptime ? You may say that it shouldn't be required, but any business that needs an internet connection should have a backup line.

We was planning to do it with via LDAP secure , but there isnt actually a need for it now which is great . But Marci thank you for your help

I have tried /sbin/iptables -I FORWARD ! -s IP,IP,IP -p tcp --destination-port 389 -j DROP and it says iptables v1.3.5: host/network `IP,IP' not found

Thanks for the reply . Sadly i can only allow 1 ip address via that method ( i need to allow 3 ) Also turns out i cant block a forwarded Port ? i need to block on the internal port number.. is that correct ? I am now using /sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's) /sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's) /sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's) /sbin/iptables -I FORWARD -s -p tcp --dport 389 -j DROP ( blocks every ip)

Ok we are about to allow access to our AD server for a external cloud based application so users can login with the credentials. We use IPCOP as a firewall , and i have set up port forwarding correctly . Basically using IPtables i want to deny access from all external sources to the port (8005) apart from some IP address's i specify ( which are the companys ) The only iptable command i have working is /sbin/iptables -I FORWARD -s 213.205.251.213/32 -j DROP This basically just allowed me to block the above external IP from accessing anything on our router . Has any one done this ? and can help me out please. Thanks 2097

We currently have a Mac Mini server running Yosemite and profile manager. We have 2 suites of mac minis running Yosemite which are fine . Our newest suite is EL Capitan but the way i am deploying shortcuts/Alias via profile manager to them seems to not be liked very much with El Capitan. Basically when the shortcuts are created on there desktop the icons seem to be icons for terminal, it has exec written on them . As soon as i open the shortcut it changes the icon to the correct one which is a folder ? Any one else ran into this problem ? Thanks 2097

I hope that didnt sound condescending i just thought i was maybe missing something . I hope all goes well and don't forget to document for the next lot if you want to make it easy for them.

Replace all servers , V-sphere 5-6 migration , New San and data migration GFI and Eset Upgrades - web versions Solus 3 implementation They are some of the larger things done this 6 weeks by myself . Great fun !

Thats how profile manager works is it not ? We are bound to AD , i have all our macs in OD groups with profiles set All my users are in AD groups with different policies applied to each AD group . Easy when its all working correctly . Our users also have there home drive set to there AD home drive and i have a custom setting to create shortcuts on there desktop to access there AD Documents and their Mac documents

Have a problem with the "Remote Management" profile the SCEP Enrolment Request part of it. Turns out it expires after a year , and i cant see a way to have it automatically renew . I have had to manually sign in on the Macs and goto Profiles > and click renew on the "Remote Management" profile . ( annoyingly i can only do this once the profile has actually expired) The side affects are unless this is renewed no profiles will push to the machines Any one got a solution ? Thanks 2097

OK figured this out without the need of a script. Because of the key-chain being stored in the AD Home folder it was getting kinda messed up with permissions , for e.g. i couldn't chmod it using terminal and was producing a Unix permission error. Because of this i decided to redirect the key-chain folder to the /tmp folder on the local machine at logon using a symlink Now the keychain folder deletes at every logoff/reboot But now solves 2 problems with 1 solution 1.) Login keychain now no longer has a timeout and works perfect. 2.) When a user used to change there password in AD , they would get a keychain error message when they first logged back onto the macs . Because of the new location of the keychain this no longer happens ! .