davidacland

Same for us, we have just had to roll a newly deployed classroom back to 10.9.5 as they were randomly hanging on startup. I have had this at two different sites we support so far with different models of iMacs. Both sites are using Active Directory.

Assuming you have a backup of any data in your local home folder, login as the local admin on the iMac, delete your home from /Users/yourusername, logout and log back in with your account. Just as a little disclaimer, this will delete any data you are storing in the local home folder. If it works fine, it was something in your home folder. If it fails again it will probably be a restriction on your AD account somewhere (possibly group membership, or just a corrupted / broken account). David Acland - Amsys

in ARD you can send (as a UNIX command): osascript -e "set volume 0" Not a very elegant solution but one to save in the sidebar of Remote Desktop as a shell script if you want to quickly mute the room! David Acland - Amsys

When you say 'sister machine', do you mean a Mac or a PC? As a troubleshooting process I would look at the following: Network system preferences: does the network interface have an IP address and all other necessary settings? Can you ping the router address? Can you ping the DNS server address? Can you resolve any internal or external DNS records? To ping, open terminal from the Utilities folder and type: ping routeraddress (Replace with actual address) To do a DNS lookup open terminal and use: dig dnsname (Replace with actual DNS name). You should get an answer section specifying the result. Next I would look at the proxy setup (again in the network system preferences). Are these correct? Next I would check if any anti-virus or classroom management software (such as Impero) is causing the issue (uninstall them or re-install the Mac without them and retest). Next, have you got any kind of port security enabled on the switch that is preventing full network / Internet access? Finally, take the Mac and connect it to a "simple" unfiltered Internet connection, such as at home. This will tell you if it is the Mac or an external factor. I hope this is of some help. David Acland - Amsys

You can also use these terminal commands if you have ssh access (or any other way to run a script on them): # enable apple remote desktop /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -activate # Allow remote access /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on # Set specific remote access /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -allowAccessFor -specifiedUsers # Give a specific user remote access /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users localadmin -privs -all (The localadmin name should be replaced with the actual local admin user short name on the target Mac).

Might not be what you want to hear but from my experience I don't think Profile Manager is really stable enough for this scale of deployment, particularly when it is leveraging Active Directory. Some of the errors are probably OS X dropping its connection with Active Directory, rather than a physical network connectivity issue between the Mac server and the domain controllers. We've been using Casper for the past few years, which is more designed for enterprise size setups. David Acland - Amsys

You need to create it using your MDM server (profile manager, Casper or something similar). There are two parts to the profile, the first is getting a certificate from Active Directory (How to request a certificate from a Microsoft Certificate Authority using DCE/RPC and the Active Directory Certificate profile payload - Apple Support), then in the same profile, under wifi, select WPA enterprise authentication, set it to be used at the login window and to use the AD certificate you created. Unfortunately its a bit of a tricky thing to get going and needs input from your certificate administrator, AD admin and wifi admin as it will depend on how each of these elements have been configured.

Hi, The wifi issue will depend on the type of authentication you are using. If its WPA/WPA2 Enterprise then you need to use certificate based authentication setup by a configuration profile. Regarding home folders, for wifi / laptop Macs I really would recommend local home folders, if you untick the "force local home directory on startup disk" in directory utility and the Mac is on wifi you will have a lot of stability problems. Hope this helps. David Acland - Amsys

Here's a link to our git hub version (full script), you just need to make a launchagent to get it to run at login: https://github.com/amsysuk/public_scripts/blob/master/mount_SMBHome/mounthome.sh Just in case, loginhooks (which are deprecated) don't work as they run as root and so send the wrong username to the script. David Acland - Amsys

It's similar, we've been working on it for quite a few years so its evolved quite a bit. The core bits of code are (in a bash script): ShortDomainName=`dscl /Active\ Directory/ -read . | grep SubNodes | sed 's|SubNodes: ||g'` # To get the NETBIOS domain name adHome=$(dscl /Active\ Directory/$ShortDomainName/All\ Domains -read /Users/$USER SMBHome | sed 's|SMBHome:||g' | sed 's/^[\\]*//' | sed 's:\\:/:g' | sed 's/ \/\///g' | tr -d '\n' | sed 's/ /%20/g') # to get the user's AD home # Then we mount the network home mount_script=`/usr/bin/osascript > /dev/null << EOT tell application "Finder" activate mount volume "smb://${adHome}" end tell EOT` If you trigger it via a launchagent it will mount the home using the credentials of the logging in user. We've added a bunch of logging and other custom bits to the script but the bits above are the core parts. David Acland - Amsys

Hi, this is a common problem because the print service in OS X isn't set to use Kerberos authentication. I haven't tried it for a while as we're using follow-me printing most of the time now but this command used to work to kerberize the print queue: /usr/sbin/lpadmin -p "name of printer" -o auth-info-required=negotiate David Acland - Amsys

On the home folder topic, we always recommend leaving "force local home directory on startup disk" ticked so the apps are working and saving locally. Using full network home folders will cause a lot of grief! We also uptick the "use UNC path to derive network home location" as that has caused a lot of login failures. Instead we use a login script that reads the SMBHome from Active Directory and mounts it separately. David Acland - Amsys

To install OS X on an external drive you boot to the installer on the recovery partition as normal, connect an external drive (formatted as HFS+) and select it as the target disk during the installer. That being said, if everything else has failed it sounds like its physically broken and needs parts replacing. David Acland - Amsys

It really sounds like a hardware failure. As pooled says, I would try booting from an external drive but if that fails then a repair will be needed. Just to make sure, are you installing a compatible version of OS X? Macs will only boot to the OS they originally shipped with, or newer. Anything earlier and you could get the symptoms you are experiencing. Last random though, try resetting the PRAM (hold down cmd + alt + p + r, the Mac will restart and you should wait until you have heard it chime around 4 times. And the last, last random thought, have you upgraded the RAM recently? Grey screens on startup are a common symptom of faulty, incompatible or just unseated RAM. Best of luck. David Acland - Amsys

We normally prefer local home folders, mounting a network drive on the desktop and letting the users copy their work to there as and when they need to. We've seen a lot of issues with iMovie (and other "heavy" apps) when using network home folders. A few years ago we did test out improving the network connections, ensuring the Macs were on gigabit ethernet but it didn't help much. Laptops on wifi were almost unusable. For some of our sites, where guaranteed central backup of user data is needed, we still keep the data local to the Macs but use rsync scripts to sync the data up to their network drive automatically. David Acland - Amsys

According to the OKI site, their recommendation is "Use 10.8 Driver Bonjour and USB only. TCP/IP support is under consideration". I would expect issues in this case. Printing vendors always seem to be behind so we hold back from deploying OS upgrades if the users need full printing functionality.

WGM only wants the path to the application. My method for this was to create "fake" files on the server using the "touch" command in the Terminal: touch /Applications/Pages.app This can then be used in WGM on the server.

Good point, we create a temp file at login using a LaunchAgent that runs: echo $USER > /etc/user # you could put this in any file really, as long as its writable by all users. The ">" makes sure it gets written cleanly at each login. We then use: username=`cat /etc/user` rm -R /Users/$username/Library/Keychains

You can't get rid of the keychain entirely as its needed by the OS and apps but you can delete it at logout. When a user logs in, if there isn't one present its created clean. Create a shell script that runs "rm -R /Users/$USER/Library/Keychains" at logout using a LogoutHook. Hope this helps. David Acland - Amsys

Hi Iain, I've set this up for a few schools recently. To get it working I had to: - Install a Wi-Fi profile before the Meraki profile (otherwise it doesn't have an Internet connection when it tries to enrol) - Install the Meraki MDM profile from your Meraki portal - Add the MDM server URL in the in Setup > Configure Settings (something like https://ios.meraki.com/apple_mdm/profile... etc) The error you're getting does sound Internet related so I would make sure the Wi-Fi profile is being manually installed before the MDM enrollment. If it is I would test it on a simple Internet connection, perhaps 3G tethered from your phone or at home if you have a laptop you could try it out on. Hope this helps David - Amsys