BootManager

By the way, I do have reserved DHCP entries although some of these dont actually get used since the servers have fixed/manual IPs. It doesnt do any harm to list the items anyway since it puts everything in one place and I know whats free and what isnt.

I think the main thing was that it just looked in a mess when comparing it to DNS at a different school, or I should say that perhaps it just looked 'different'. When I rebuilt DNS I had the forward and reverse zones, my cached lookups and my events folders, nice and neat. One the old DNS I also had things like _msdcs on the same level and possible some other entries. I guess the important thing was that the server had been through an upgrade path from Win2K so some old functionality was being catered for, possible to the detriment of a happy win-mac environment. So when I did the rebuild I took the opportunity to switch to Win 2003 functionality ONLY. Another important issue is probably to not manually add records to DNS while logged in as another user, I think the old records got added by our apple contractor using remote desktop, (no idea what he would have logged in as), and I believe windows system then treats those records totally hands-off, or something [i can't remember exactly what I read but it was in a windows online doc], ....erm basically I registered my servers, including macs, by instructing the servers to register themselves in DNS instead of manually adding records to DNS directly. Anyway, I'm still happy to say the network is continuing to behave itself now.

Hi All, finally got back to posting a reply and the good news is that my apple-no-login-shake problem now seems to have gone away, *joy* , so the rebuild of the DNS did the trick, I can use the windows side for weeks, then switch to the mac side for a lesson (no shake off), then back to windows. To think of all the time I wasted rejoining the domain on each and every mac for each and every time I needed to use it. Well now its fixed and nobody, not even the apple experts, ever suggested that the problem is all down to DNS. Thank you.

An update.... well I found out that some of my dual boot macs that got reconfigured now wont log onto windows, it says the domain is not available, fixed this by logging into a local windows admin account, deleting all the local profiles for domain accounts (they all were marked as unknown account anyway), then coming off the domain and finally back on domain. It seems that although the dual boot win side was originally happy, problems occurred after the dual boot OS X side was taken off the domain (and re-added). Generally it doesnt bode well. Oh and yet another mac has gone faulty, is there anything more unreliable than an apple-built computer?

(continued).... what I found after doing some reading was that our DNS was probably in a bit of a mess from upgrading the server from win 2000 to win 2003 some years back and also from having various experts come in and allowing them to hack about, particularly when they manually add records to windows DNS from their client machines (eg a mac server). The DHCP settings were also messed about with, probably by external 'experts' like half-setting-up range policies when in fact the top level server policy had all the relevant settings already set up. But I also found that our Active Directory was 'old' and needed to upgrade to Win 2003 (a single mouse click operation). The articles on DNS are fairly straightforward though I found that some things didnt apply to our setup here and there were a couple of minor panics when I thought I'd done some damage, but as it turned out everything was really quite easy, you just have to plan it out. I'm not going to go into massive detail, most of the actions are performed from menu options or right mouse clicks, you do need to feel your way around the DNS structure but most actions are performed on the 'server' container and not the zones (which were getting deleted). I think that the steps that I took [on each DC server] were to: 1) break the replication across the servers by setting DNS to standard primary on each server and make sure there is no cross referencing of servers. 2) from the dos prompt use command "ipconfig /flushdns" to flush cache, then after a couple of minutes to go into DNS console and just delete all the A and PTR records for each zone, then note down all the C records (because you will need to recreate them), before deleting each zone in the forward and reverse containers (I also found/deleted a top level _msdcs_ zone that I think was supposed to be a child of a named zone - can these things be moved?!?) 3) clear out the DNS events log, then come out of DNS console. another flush of the dns from the dos prompt, and then stop the DNS service (net stop dns). 4) The microsoft documentation talks about deleting zones from within Active Directory but I couldnt see where any old records were kept, however I did find that there were some old files in the folder c:\windows\system32\dns, (these have the extension .dns) so I moved the ones that obviously belonged to us out of the way to a new folder [ I left behind cache.dns and dns.log and the folders Samples and Backup ]. 5) Network Connection Settings. I had some conflicting info on this change but what I opted for was for each network connection on our nominated DNS servers to make sure that if its a static IP then the network settings has preferred DNS pointing to itself, ie a server with replicated DNS doesnt point to the primary DNS server instead, the alternate DNS was set to point to the internet service providers DNS. In case you are interested conflicting arguement was pretty much the exact opposite ie to point to the primary DNS and the alternate DNS to point to a secondary internal DNS - but I'll monitor what happens as I can always change these settings at a later date. 6) configure DHCP service on the machine where it resides. I didnt have to do much to ours but I changed a couple of settings out of interest, on the general tab "enable DHCP audit logging" ticked, on the advanced tab "conflict detection attempts" set to 1, and on the DNS tab everything ticked (I selected "always dynamically update DNS A and PTR records" on the option) . Although I didnt delete any records, you may want to tidy things up if you know some leases have expired, you can select the Reconcile action to give a little peace of mind afterwards. One thing which I did do was delete the scope options that someone had half-heartedly set up on the main scope - on our DHCP server these options are correctly set up in the global options and therefore do not need any overriding (or messing up). 7) when all servers are stripped of dns operations then reboot each server, except for the mac servers - which got taken off the windows AD domain and then shut down. 8) The DC servers get booted first, the other servers get booted after you set up DNS. 9) IMPORTANT NOTE: On the Primary DC in Active Directory a right click >properties, on the domain name revealed that our Domain Functional Level was set to Windows 2000, but a simple mouse click allowed this to be upgraded to Windows 2003 (an upgrade that cannot be reversed). I feel this is an important issue because it shows that the AD is being made overly complicated by trying to retain compatibility with Windows 2000 or whatever, but since we no longer have Windows 2000 servers I decided to ditch the functionality and upgrade. 10) On the primary DC I setup DNS pretty much using default settings of the DNS wizard (from "Configure Your Server"), there is an option to replicate to all the DCs and you should do that. Give it a few minutes to replicate across your servers. You can also run some tests to check DNS is behaving correctly. 11) On each server with a static IP you should then go to the dos prompt and issue the command "Ipconfig /registerdns", note on the mac servers there isnt really a command to do this but on the macs you can configure IPv4 with the option "using DHCP with manual address" which will register the static IP address in DNS. 12) You can use directory utility to get your mac servers rejoined onto AD; note I did put a tweak on my mac servers (dsconfigad -passinterval 0) as per some earlier recommendation. 13) remember to manually enter any C (alias) records in your DNS, things like which server hosts your website are fairly important. Hopefully thats everything to configure the servers. Thats all I can remember. I wanted a situation where the DNS entries are controlled by windows and tied in with active directory. If you read the microsoft notes it talks about records remaining in DNS if they were manually inserted, ie the owner of the record is not the system, something that I would consider bad news if you want a to go for dynamic updates, and could potentially lead to conflict/duplicates on addresses I think. I'm sure that there is going to be a whole lot of people out there who are going to criticise my actions, telling me that I cant possible be right, well OK you have your opinions, but solutions like "have you synchronised time" or putting techie tweaks on mac variables are not exactly 'out of the box' and one fact that I think you should chew over before you rush ahead anyway is to consider this: Some sites that I know of do not have any problems with mac integration. The people who set those sites up didnt go off performing techie tweaks, they just had a bog-standard windows network, freshly built, which they then connected their brand new apple macs to using Directly Utility. AND IT WORKED AND CONTINUES TO WORK. So all I'm trying to do here is to take away some of the complexity which potentially has been caused through upgrading, upgrading is a nice convenient thing but sometimes its messy. So I've rebuilt my DNS and made some slight changes to DHCP and Active Directory, as far as I'm concerned I'm trying to simplify the network, thats all. Finishing Off Well this is the moment of truth, which unfortunately I wont find out if its worked until probably a few weeks time. First step, just boot all the windows machines and logon to an AD account, you can probably guess that nothing went wrong with this step. (dual boot macs were booted onto the windows side before even thinking about booting onto the OS X side). On the macs, (dual boot macs were booted onto the windows side before even thinking about booting onto the OS X side), I booted into the local admin account, then did the tedious setup: 1) followed the procedure to get the macs off the AD and OD, deleting directory utility plists afterwards. 2) check the computer name is correct, then check/correct the name of each network connection, the TCP/IP tab should state "Configure IPv4 using DHCP" 3) check for software updates, then reboot. Back into mac (on dual boot machines) 4) rejoin AD and OD, this time I joined OD first of all. Shut down. 5) hope and pray that your mac woes have gone away have I forgotten something - well probably - but do your research. reconfiguring your server can be a bit scary but some times its got to be done.

Regarding my DNS rebuild. I am writing these notes down now so that I dont forget what I did when I post an update on how my network is behaving (probably in a few weeks time). My feeling is that our windows network was fine for PC clients but macs, being extremely fussy, didnt like it. I rather suspect the apple have just done some minimal testing as far as integrating into windows environments is concerned and therefor if your network isnt 'just so' then your macs are going to go into a huff, ......did I mention about the hassle with using macs on our expensive and sophisticated network environment - the upshot was that we had to 'dumb-down' our switches in order to accommodate the picky macs with network card drivers that dont conform to internationally recognised networking standards [and Apple think its not their problem]. Anyway this is what I've done to our servers and I am still monitoring the situation, so dont take it as gospel.... Most of the client computers had been switched off over easter so the DNS records would have mostly been stale - the DNS was going to be flushed and rebuilt so it was to our advantage too. First step make sure all the servers (windows and OS X) are updated with patches, and BACKUP system state. Second step, refresh my brain on how to configure DNS & DHCP, I'm a great believer on setting things up with the instructions in front of me, then hopefully I wont need to look at for at least a few years. Third step clear down DNS and de-integrate it from active directory. Then stop the service and delete all traces of DNS in AD or text file. Fourth, check DHCP, reconfigure if neccessary Fifth, configure the servers and get them all talking and behaving nicely with one another. Next, rebuild DNS and replicate across servers, check DNS contains correct records and register any machines with static IPs. Next get the windows client PCs back onto the network, well logon to an AD account cos you just know they are gonna work Finally reconfigure each mac client (our machines are dual boot), this is the tedious bit involving coming off the domain, clearing down plists, renaming, rebooting, rejoining domains etc, hoping that things get finally sorted. some reading (do read them): How to clear bad information in Active Directory-integrated DNS How to reinstall a dynamic DNS Active Directory-integrated zone How to configure DNS dynamic updates in Windows Server 2003 How To Install and Configure a DHCP Server in a Workgroup in Windows Server 2003 there are other articles, you can take days to read, but I'd decided that I was going to rebuild DNS so they were irrelevant to me. oh I'm too long on my text, read my next post....

another (old) thread on AD binding problems... Snow Leopard AD Integration woes today I rebuilt my Windows DNS and also played around with some DHCP settings. Also in Active directory I found that our domain it was flagged/running as "Windows 2000 Mixed" so I upgraded to "Windows 2003" (a simple click of a button - but one where there is no going back). Obviously quite a few changes and I'm currently monitoring the situation. I'll let you know what the outcome was in due course.

another (old) thread on AD binding problems... http://www.edugeek.net/forums/mac/43879-snow-leopard-ad-integration-woes.html today I rebuilt my Windows DNS and also played around with some DHCP settings. Also in Active directory I found that our domain it was flagged/running as "Windows 2000 Mixed" so I upgraded to "Windows 2003" (a simple click of a button - but one where there is no going back). Obviously quite a few changes and I'm currently monitoring the situation. I'll let you know what the outcome was in due course.

try this thread, no solutions yet... http://www.edugeek.net/forums/mac/51069-mac-will-not-log.html

just been reading this thread which has expands on my dns hunch... http://www.edugeek.net/forums/windows-server-2000-2003/50877-dns-reverse-lookup-server-2003-a.html

until you have experienced this problem for real then you cannot even begin to guess what the cause is. Currently I'm looking at rebuilding DNS, over easter when nobody is using the systems. its not a trivial problem, believe me there is no easy fix relating to time-sync, or locked-out accounts. you can logon as a local administrator and inspect everything on the mac client, everything looks fine, green lights on directory utility entries, time-synced ok. the only thing that I notice that is wrong is that the mac client may have somehow, strangely, inherited a name that it was never originally given. you cannot change the name unless you unbind from the AD & OD and even then the name change will only be affected after a reboot. there are no malicious people going around in the middle of the night hacking the computers or anything that would give a simple explaination. One day you can log on fine the next day you get the shake off. Do note that my computers are dual boot macs, that means that the NIC on the network card will obviously be the same if I choose to boot mac or boot windows, but the 'machine name' needs to be different for mac and for windows otherwise the AD entry for that particular computer may be right royally messed up. Our Domain was created many years ago and the operating system has been upgraded from win 2k server to win 2003 server. I can visit a neighbouring school which has a similar mac set up to ours except their win 2003 server was a fresh build a in recent years. Comparing our DNS setup to that schools reveals some wild differences, and since that school isnt experiencing the problems we are experiencing then I'm inclined to think thats where the issue lies. Also I have to think about what services the mac client may use, there really isnt many services that store info relating to machine name and ip address. going back to the weird computer-name-change thing, this was something I stumbled across completely by chance, after all you dont expect it to happen so you diont look in that area. Anyone that is experiencing these mac refusal to logon problems please do click the info text found underneath where it says "MAC OS X" on the logon box and note down what it says for the computer name, IP address, etc. you can then investigate your DNS, or AD and follow the trail DNS forward lookup to reverse lookup and note if there are any duplicate entries particularly on the reverse lookup. And please do report back here, I would be interested to know.

we've had apple experts in to fix our problem on several occasions, the result is just the same - once the mac is bound to active directory they think the problem is fixed. The problem THE REAL PROBLEM is that for some unpredictable reason a mac will 'forget' that its bound and there is absolutely nothing that you can do about it until you unbind/rebind again, this typically happens a few days or weeks after the apple experts have been and gone. The apple experts that we've had tend to think that nothing can possibly be wrong cause macs are 'so superior' that nothing could possible be at fault. But I've been on the Apple Certified training courses and the off-the-cuff advice we got was dont rely on any bundled apple service (except the web service), apple may upply pretty-looking software but business critical software it isnt. So though I'm not saying this particular problem is all apple's fault, I think its probably DNS related, dont be suprised if it does turn out to be apple. The time thing is again another red herring, yes if the time is out of sync then it will cause problems, but here all of our computers are synced internally to the main server and DHCP provides the correct parameters, everything looks OK on that front. There was an issue regarding daylight saving on the windows side of things but a boot camp patch fixed that problem some while back.

the time-out-of-sync thing will cause problems but lets assume that everyone who manages a network keeps their computers in sync. It was a known problem to do with BST but Apple patched that soon after boot camp was released, years ago. check the other posts on this topic, its a big issue thats been discussed before, no fix yet tho.

well, I would bet its not sorted, this is an ongoing problem for many people, the 'fix' might last a few days or weeks. I've just put a whole load of stuff about this problem on another post.

sorry I forgot. Also on DNS subject, it would appear that the bad Apple mac client uses its last-used IP address to query a reverse lookup on DNS to find out what its computer name is ??!??? yeah it sounds crazy but follow the DNS trail, you will probably find that the only connection between the bad computer name that the bad mac client has got can only be directly linked via DNS using the reverse lookup, why this happens I dont know. the problem is that once the IP address is renewed by DHCP you will have to wait for the lease to expire before a issues re-occur. Its a tedious problem and not one to easily track down. Oh and by the way another myth to solving the problem is configure DHCP so that leases never expire or expire within a day. Both bits of advice seem to be clutching at straws, I tried both configurations, didnt help either way.

its an ongoing problem here too and I havent found anyone that knows the real reason why this happens but I'm getting closer to the solution myself. Heres the tedious 'dirty fix' - log onto the troublesome mac using local admin, typically username "ladmin" if you've been on an Apple Course - thats what they get everyone to setup/use. you should be able to get in as you wont be validating against AD or OD. OK - the steps are 1) get off AD & OD, 2) delete the pref files, 3) rejoin AD & OD, 4) log out local admin and log in to the domain user that you want. Step1) run Applications>Utilities>Directory Utility. Hopefully you should know how to use the + and - buttons to add and remove entries so I wont go into detail, you just need to remove all the entries then exit out of the Directory Utility, YOU MUST EXIT OUT OF DIRECTORY UTILITY. Step2) browse to this folder Macintosh HD > Library > Preferences > Directory Utility > .... delete all of the files within the folder but dont delete the folder itself. (note that the files are just preferance files in xml format and dont bother trying to decipher them as you will find many red herrings, the contents are quite different across various OS X updates so you really aint going to get anywhere are you) Step3) go back into directory utility and use the + button to get back onto your win domain and mac server open directory. Step 4) zzzzzzzzzz you know, log off and log on as the proper user. Thats It, a dirty fix that you will have to keep doing every week or so until someone finds the real solution. Heres some things that I have noticed and some myths debunked: Reboot the machine - myth - if you reboot the machine you will probably find that you dont gain anything except having to wait about 5 minutes while it reboots and 'thinks'. IP address changes cause this problem - expand your IP range as its too small - myth - so much effort expanding the IP range and the end result is still the same, your mac is not giving you problems because its IP address has changed, your mac's IP address can still change even if you have thousands of spare IP addresses at hand. On a dual boot mac you should keep the machine name the same on both the windows and mac side - ABSOLUTELY NOT! - I followed this 'advice' and found that my 'computers' active directory entries for windows got replaced/trashed by the fact that the machines were then listed in AD as having MAC operating systems and then nobody could logon to the domain when using windows instead. DNS problems - well I think this is more likely, but why DNS is playing up is another matter. One thing that you may observe is that if you look closely at your machine name on a badly behaving mac, you may see that its changed to something else !, it may have picked up the name of a differnt computer - even the name of a PC computer!! Look closely at your DNS entries, particularly following the forward lookup and reverse lookup, do you notice any stray duplicates, do you notice that reverse entries are missing. I certainly have been observing these things here and have came to the conclusion that my DNS is getting messed up. I suspect that open directory is messing things up but I dont have any hard proof, all I know is that dual-boot computers are causing problems.

I think the easy solution is to 'farm out' your mac support to a separate company and cut loose any responsibilities. If the department that insists on mac are willing to take responsibility within their own team then let them do it themselves, basically just leave them to their own devices, and let them deal with hassles and the financial burdn...... macs its a fairly expensive solution for just one team, ....its like going out for a meal with your workmates and someone orders the most expensive items on the menu for themselves then when the bill comes they want everyone to pay an equal share. Note, here at my workplace we have nearly turned 100% mac, but the dual-boot option is an absolute nightmare to maintain - mainly because Apple's support for win problems is dire at the best of times, plus macs have a tendency to break down and you cant repair them yourself. basically macs = problems.

even if your new PCs cannot take the old PCs RAM you might find that some of your printers will take it, and thats well worth doing.

If it was your primary domain controller went down then make sure that no secondary domain controller has been delegated (and kept) the 'primary' role by default. I was working in a school some years back when a similar thing happened, we were upgrading our main servers over the summer but after boot up we experienced the whole network grinding to a halt. Eventually we found that a 'forgotten' old server running NT4 sitting in a backroom had taken over the primary role and all network traffic was being routed to there. Try isolating your server with a switch and a couple of client machines and see how it performs with that set up.

just casually browsing this thread and would be doubtful that everyone-to-admin-rights would be the correct solution even if it does get the desired results. I think personally that something has been missed and since you state that these problems occur on the new machines even after re-imaging etc then I would be looking at bios, ...and to me the only obvious thing in that case is that your clocks may be out of sync with your server (this would cause all sorts of unobvious faults). You might find that your login script has a command that resyncs time with the server but the command fails when the user doesnt have admin rights. Worth a look.