AntonioRocco

Hi rolfea You say it's not connected to the Internet? By this do you mean it's not connected to a network at all? Is the NIC not active? Is the network cable not connected? In other words is it not connected to an active switch? If this is the case it may be this is where your problem lies? One of the minimum requirements for OSX Server is an active ethernet connection. This does not mean an active internet connection. These can be two separate things. A reinstall or a major update such as a Combo could well display the behaviour you've described if there was or is no active ethernet connection. I have seen Leopard Server behave 'erratically' as well as showing an alarming tendency to become unstable if that was the case. Antonio Rocco (ACSA)

Hi BootCamp, VirtualBox, VMFusion, Parallels are some that spring to mind. I run XP and Vista on my MacBook quite happily either via BootCamp or Virtual Engine. Works really well - better than on most dedicated PC hardware IMHO. I even have Publisher (rubbish as it is) installed. This board (as well as others) mentions this aspect of the platform's capabilities often. Perhaps you've simply forgotten? Antonio Rocco (ACSA)

Hi Perhaps I'm missing something here? Would it not be simpler to install Publisher for Windows? The other suggestion offered should have been the one passed onto the pupils. Antonio Rocco (ACSA)

Hi Jason One thing you must do when joining mac clients to the LDAPv3 node (after binding to AD first) is to uncheck the 'Use for Authentication' option. Clearly you have to do this because the OD Master is not the KDC and besides you will have already had this option pre-selected as part of the AD binding process. The 'Use for Contacts' can be left checked and unchecked although if you're not using the OD Master for anything else other than to provide MCX then you may as well leave this unchecked as well One thing you will notice (which is something I've always seen when doing AD-OD Integration) is the LDAPv3 node does not automatically add itself to the Search Policies. You have to manually add this yourself by selecting the '+' icon. The appearance or non-appearance of the 'Join Kerberos' button is a tricky one to answer. I sometimes think it's due to the slightly 'schizophrenic' nature of Server Admin as an application. Something you will learn soon enough once you've been using it for a while. The tip with both applications (although Workgroup Manager is not as bad) is to quit the applications whenever you're not using them. Using them remotely is actually better. Prior to 10.5.4 I'm fairly certain I used to see the option - but not always? Perhaps the option 'appears' if you started out with a version of the server prior to the 10.5.4 release? Subsequent updates may not have necessarily affected the button being there (or not) as an option? All I'm saying is when I've started out with 10.5.4 and after I've ran the updates, I don't always see the button. I can't remember every single detail of every AD-OD Integration I've ever done, but I think I don't see the button if I've configured required services first and then promoted to OD Master? Although this is not definitive in any way. Besides even if it is there it does not mean it's a reliable method for 'kerberizing' OSX Server based services in an AD environment. Due probably to Server Admin behaving the way it does as already mentioned. As ever it may be better to do this sort of thing from the command line instead? Launching Terminal and issuing: sudo sso_util configure -r REALM -a admin_name -p password all Should do it? The 'all' switch 'kerberizes' all active services capable of supporting Kerberos. You could consult the manual pages for the above command line utility from here: Mac OS X Manual Page For sso_util(8) Or you could simply issue: man sso_util in Terminal itself. To answer your question about making mac clients show up automatically; I don't offhand know of a way? Not if you've configured your Server using the Advanced Mode at any rate. I have never used the other two Server Configuration Modes: Standard and/or Workgroup. I doubt if Standard would be applicable in your environment as it assumes OSX Server is the only server on the network. Standard Configuration Mode would provide everything exclusively for mac clients alone. Workgroup is a Mode designed by Apple for environments such as yours. Perhaps this could provide a way of auto-discovering and displaying mac clients as you would like them to be? However you must realize OSX Server in an environment where Windows Servers are the primary servers is only there for augmenting what is already being provided by those servers. Whatever expectations you may have based on how Windows Client OS behaves in such an environment would not necessarily be the same for the Apple Client OS. In a purely Open Directory environment then you could achieve a level of discovery you may be looking for? This could mean completely ditching everything to do with your Windows environment. Is this something you see happening anytime soon? Mike Bombich outlines in detail how to use Augmented Records in an environment such as yours: http://www.bombich.com/mactips/activedir.html In my view it's still the best one around? Apart from other things Mark (HodgeHi) has used it with some success in his environment. Perhaps you should try and get some feedback from him? NB: You can move from Standard to Workgroup and back again as many times as you like. You can also move from Standard to Advanced and/or Workgroup to Advanced. Once you're at Advanced you can't go back to Standard and/or Workgroup. You basically have to start from scratch (format and reinstall) again. Antonio Rocco (ACSA)

Hi It all depends on what you want. If you want a 'classic' AD-OD Integration and you're not interested in Augmented Records then: (a) make sure relevant DNS Entries have been made OSX Server (b) Bind OSX Server to the DC using the relevant plug-in Module in Directory Utility What you should see after doing this is AD Users and Groups 'flow' into the /Active Directory/All Domains node in Workgroup Manager. At this point OSX Server is simply behaving as a Domain Member. The Open Directory Service will report it as being 'Connected to a Directory System'. /Active Directory/All Domains will be listed first in the Search Policy in Directory Utility. © Promote OSX Server to OD Master. This should not take too long. If it does review the DNS Service as well as looking at the slapconfig.log in Console. Everything gets logged in OSX Server. (d) If Promotion has been successful you should see in the Open Directory Service's Overview Pane that everything except Kerberos is Running. Kerberos should be stopped. Since 10.5.4 you don't get the 'Join Kerberos' button anymore. Any Services that can be 'kerberized' will already have service principals records created for them. You can test this by starting a service and issuing: sudo kadmin.local -q list_principals from the command line. If you launch Directory Utility and inspect the Search Policy you should now see the Server has promoted itself above the /Active Directory/All Domains listing. Inspect the LDAPv3 Plug-in and you should see the server has added an entry for itself using the loopback address 127.0.0.1. This is all normal. The only time this would change would be if you're interested in providing Augmented Records for OSX Server Services for Active Directory Users and Groups. For example: iCal, iChat, Wiki & Blog etc. In that environment you would make the Server an OD Master first and then bind to AD. Client side and if you're not using Augmented Records you always bind to AD first followed by a join to LDAPv3. Give the above and to answer your questions specifically: (Q) At the time of joining OD into AD, do I need to hit the Join Kerberos button before turning the server into an OD Master? (A) See above (Q) On the OD Master, does the LDAP entry have to be before the AD in order (in search policy - authentication). On the Mac client, does it have to be the other way around? Search Policy order - AD first & OD second? (A) See above (Q) The "Enable authentication to directory binding" option in Open Directory - Server Admin - does this have to be enabled or does it matter? (A) Not required. Don't forget User authentication is coming from Active Directory. AD would not know or even necessarily care about Open Directory. Besides Kerberos is with the AD and not OD. NB: This can be altered if you wish but only if you're prepared to alter the AD Schema fairly extensively. (Q) I was looking at WGM, after a test client was bound to AD first and OD second - my confusion is, once the client is bind to an OD, wouldnt that computer record show up in the list of "Computers" in WGM (not the AD records) (A) A mac client computer will only show in WGM once it has been bound to OD (regardless of whether it is bound to AD or not) if you add it to a computer list using the diaresis button (3 dots) in the relevant area in Workgroup Manager. Depending on how you have your OUs, DHCP and DNS Services configured you may well see an 'entry' for it appear in Active Directory. However I doubt there would be much you could with it once there unless you had something like Centrify installed on your DC. Centrify allows AD-style GPOs and management preferences to be 'passed on' to mac clients without the need for OSX Server. Does this help? Antonio Rocco (ACSA)

Hi Nick Use rsync - man rysnc (from the command line). Its what it was designed for. There's already a thread posted my HodgeHi that mentions its use I think? Antonio Rocco (ACSA)

Hi Prior to 10.4 Server you only ever had Standard UNIX (or POSIX-style) Permissions. This was a permissions model that, although effective, was limited in its scope. Apple changed this with 10.4 Server. Access Control Lists were introduced and they worked in conjunction with the default standard POSIX model. To utilise ACLs you had to enable them on the volume first followed by a restart. ACLs take precedence oer standard POSIX. A deny in both models blocks access to the specified directory/file. A deny in POSIX but an allow in ACL means users can access the directory/file once the correct authentication details are entered. On the client side all directory/files carry with them standard POSIX permissions and these are honoured. In other words locally applied permissions 'follows' the file/folder. For example user Johnny creates a TextEdit Document on his 10.4 Client Mac. Locally on his Mac the OS will apply the standard POSIX Model. He automatically becomes the owner with full access. Anyone in the local admin group is assigned read only access as well as the local everyone group being assigned the same permission. Johnny copies the file over to a designated share on his 10.4 Server which has not had ACLs enabled. However this share has been configured to allow Everyone full access using the standard POSIX model. The file once copied 'acquires' the share's given permissions. Suzy comes along and accesses the share point and has full access to the file created by Johnny. Full access on the standard POSIX model means read, write, delete. Now apply ACLs to the volume on the 10.4 Server. This time you define an ACL to the same share denying the ability to delete any files/folders. When Suzy or Johnny access the share they can still read and write but can't now delete. As you can see both models are in effect but the ACL has superseded standard POSIX. Do you understand the distinction? In 10.5 (Server and Client) standard POSIX is deprecated in favour of ACLs. ACLs are the default Permissions Model. If you have a 10.4 Server not configured to use ACLs but your clients are 10.5 this can/will cause permissions problems sooner or later. Why? Imagine this time Johnny is sitting at a mac with 10.5 Client installed. The Server is still 10.4 and ACLs have not been enabled. When Johnny creates the file and copies it over Suzy will only have Read only permissions. Even though the share has been configured using the standard POSIX model to allow Everyone full access, she still won't be able to do anything other than Read only. Why? You have to look at what happened locally for Johnny on his 10.5 Mac. Johnny creates the file but unlike the 10.4 Client Mac the file also acquired an ACL in addition to the standard POSIX model. To everyone else, except Johnny working locally, this ACL is 'masked' and can't be viewed. The only indication you have that the file/folder has an ACL applied is to launch terminal and issue: ls -lae /pathtofile/folder You should see the @ symbol at the end of the entry. This signifies an applied ACL. It is this ACL that denies Suzy access when she tries to access the file. The way around this is to enable ACLs on the 10.4 Server and define permissions using that model instead. On 10.4 Server ACLs were not enabled by default. As already mentioned you had to enable them (either using the GUI or the command line) followed by a restart. Unlike 10.4 Apple have removed the ability to disable/enable ACLs on a given volume from the interface in 10.5. To disable ACLs on a volume launch terminal and issue: sudo fsaclctl -p path -d disable (where path is the volume) To re-enable ACLs: sudo fsaclctl -p path -d enable (again where path is the desired volume) Whenever disabling and enabling ACLs the Server must always be restarted. Strictly speaking this should only apply to the boot volume itself. However it is good practice to do this for other volumes - internal or external, RAID or otherwise - as ACLs tend to 'take' better. On 10.5 Server ACLs are enabled by default and since 10.5.4 I don't think it's wise to turn them off either. Leastways I've never tried it. Besides if all your clients are 10.5 what would be the point? Files/folders copied or amended on a 10.5 Server with ACLs disabled would be a recipe for disaster for the reasons already mentioned. My conclusion and advice is to always use ACLs (either 10.4 or 10.5) and don't bother with standard POSIX. The propagation tool in Server Admin GUI is actually not too bad. However some people have had problems making ACLs 'stick' using the interface. This is usually because the volume/directory has a problem or the Volume has been shared rather than a directory/folder or the share point itself is a legacy one copied over from previous versions of the server or from a 3rd-Party Server using a permissions model not easily transferable. For example a share originally created on a legacy Windows Server or PC. For legacy shares it's best to create a folder/directory using Server Admin itself and to copy over files/folders. You could use robocopy or similar (from the PC side) or scp, ditto, rsync or similar (from the Mac side). Once copied propagate accordingly. Never share a volume because permissions don't propagate as easily. Always leave the standard POSIX permissions at their defaults: root (or admin) as the Owner with R/W; admin as the Group with RO and Everyone as RO. Don't fiddle with these unless you want to set the Everyone permission to 'None'. This is actually a useful feature as it denies anyone who is not the POSIX owner or group the ability to see the share. Be careful when applying a deny in both models as this can have dire consequences. Never Ever use the Finder to define permissions. Poor practice if on a client OS and a definite 'No' on Server OS. Always use the interface (on the Server) or the command line (Server and Client). The command line utilities chmod, chown and chgrp are the ones I mainly use. You can view the manual pages for each utility by launching terminal and issuing: man chown and so on. The manual pages generally have usage examples. Failing that you can always Google for an example or download the command line utility admin manual from Apple's website itself. Be advised that not all command line utilities have manuals and not all manuals are either correct or even up-to-date. This is not necessarily because Apple are lazy it's just the way it seems to be in the POSIX world. A lot of these binaries and shells have been around since the very beginning. The guys who developed them have either not bothered to keep them up to date or have moved on to something else. Finally for a more rounded understanding of both models I can't think of anything better than reading Gerrit de Witt's series of articles: Apple - Support - Discussions - ACL Tips ... Apple - Support - Discussions - ACLs all screwy ... The first one is for 10.4 Server where the principles are outlined and gone into great details. The second is for 10.5 and has some useful examples and explanations. Does this help? Antonio Rocco (ACSA)

Hi A number of ways you could do this: (A) Modify the AD Schema and add apple specific Classes and attributes. This would mean updating/overwriting the AD Schema afterwards. Is that something you're prepared for? (B) Purchase OSX Server (10-Client version) and install it on an existing mac. If all you want is Mac-style GPOs that should suffice. However I'm not sure if this meets your 'without purchasing expensive software' requirement? © You could try downloading Apple's Server Administration tools from here: Apple - Downloads - Application Updates - Server Admin Tools 10.5.6 You only need to use the Workgroup Manager application. Install the application on a mac client whilst logged in as the local administrator. Make sure the mac client is bound to Active Directory first and that AD is listed in the Search Policies. Launch the application. Navigate to the /Active Directory/All Domains node. You should now see your AD Users and Groups listed. Authenticate to the node using an AD admin account credentials that has authority for the Domain. Make sure all your mac clients have been bound to AD first. Click on the Computer Groups icon (looks like two interlinked rectangles). Create a new Computer Group. Call it something suitable. You should now be able to 'add' bound mac clients using the diaresis button (the three dots). They should show up in the following window. If they do you can select them and add them to the Group. Once added to the Group you should be able to click on the Preferences icon and begin to apply mac-style GPOs. Normally referred to as Managed Client OS X or MCX for short. This forum as well as numerous other sites have plenty of information on how to apply MCX for mac clients. Ross and others have provided useful links at the top of this Forum which you could have looked at first prior to posting. Antonio Rocco (ACSA)

Hi AdmitMac could be one way? Not my favourite bit of software (Sorry Mark!). To be honest you would not actually need it? Judging by your post there should be enough built into the client OS to achieve what you want anyway. You could manage mac hardware clients via a Computer List/Group. Server Administration applications are available free to download from Apple's website which should allow you to achieve this. How successful integration is will rest pretty much on how well DNS and your AD are configured. You might want to seriously consider beefing up the network infrastructure as well. Depending on their ultimate use - video, music etc - gigabit networking throughout should be what you're aiming for. Interestingly introducing macs into a wholly windows environment will find out every little flaw in your current environment that PCs don't normally care about like nothing else. There should be plenty of examples that could you see for yourself in your area? AD-OD Integration has been going on for at least 5 years that I know of. As time has gone on there has been less legwork and hassle involved. Leopard does make it easier than ever before. This does not mean to say it's not without its problems or faults. However if approached correctly a fair level of success can be achieved. At the top of the forum Ross has provided links to his site detailing what can be done. Antonio Rocco (ACSA)

Hi @ rush_tech Have you tried their website? Sophos - Anti-virus, anti-spam and encryption software for businesses IIRC MacAfee are/were developing a client for the mac platform as well as Avast/AVG. For the amount of macs you have it's probably less hassle/expense (it's free) if you simply downloaded and installed ClamXav? ClamXav @ bladedanny Apart from lab conditions there are no viruses out in the wild that can infect a mac. However there are more and more trojans, spy and malware that can and do affect the mac platform. DNSChanger springs to mind. In view of this it makes sense to treat macs the same way. Having macs in a predominantly Windows environment is potentially an unsecured and unprotected 'way in'. You can protect a PC against a pupil bringing in a memory stick he/she has just downloaded something from BitTorrent or Limewire on. However you can't really say the same for the mac? OK it won't 'infect' the mac but that's not the point. It's now on the network as a whole. Potentially a big problem. However if the environment was wholly mac or even a 'ring-fenced' network separated from the rest of the Windows environment you could consider not bothering. @ Ric Good Point! Antonio Rocco (ACSA)

Hi You could take another approach? Use BootCamp to create a small (10-20GB maximum should suffice) partition for scratch disk purposes only. Once created use Disk Utility to reformat the partition as OS Extended. Now ehen students log in using their networked accounts (AD or OD - does not matter) they can still access their networked home folders rather than creating one locally - this can get messy. Now when launching iMovie and importing a new project they can save it directly to the newly created scratch disk. Once the initial save has been done they can then copy that Project directory to their own Home Folder's Movie directory. iMovie will work as normal thereafter without the need to access the Scratch partition again. These set of instructions are something the teacher can easily get across as part of the curriculum anyway. The good thing about this method is there should be no need for the extra cost and effort involved in attaching multiple external USB or Firewire drives to each client mac. A script could be written that will format the drive or delete the directory on logout. This can be applied using MCX from an appropriate server. To delete the partition - if you decide to re-purpose the macs - use Disk Utility again to reformat as MS-DOS FAT 32. Use BootCamp thereafter to delete the Windows partition. Or use an appropriate NetInstall image. You could take this further and create a customised NetInstall image that prepares client macs with a partition for the OS and desired applications as well as a Scratch Disk Partition. I have tested this briefly in a gigabit network environment (I would not entertain anything less for iMovie) and it works very well. Did not see one dropped frame. However this was for a small class of 6-10 macs. I think a larger classroom would struggle unless client hardware used had twin NICs and port trunking utilized. An appropriate switch capable of supporting Apple's implementation of LACP would be needed if this was something you'd be interested in? Antonio Rocco (ACSA)

Hi All the command does is initiates a software update for clients added to ARD. If clients have not been configured to use the local Service they'll go out and fetch them from Apple's Updates Server. Not good if bandwidth is an issue. To use the command effectively you still have to configure clients to point to the local Service first. If you are pushing MCX to mac clients it makes sense to provide the service as a managed one. Then you could use ARD via remote session to initiate updates. ARD does have the facility to restart and shutdown clients remotely amongst other things. Look in the Manage menu. In my experience some buy the product without fully realizing its capabilities. Moreover some have it still wrapped up in its box locked in a cupboard somewhere having never used it. Antonio Rocco (ACSA)

Hello Mark It looks like powdarrmonkey has cleared this up nicely for the pair of us. Just be aware that cron has been superceded by launchd. Although cron should still be usable in 10.5 the recommendation is to use launchd/launchctl. There is a nice GUI front-end to this if you did not already know available from here: Tuppis - Lingon by Peter Borg Hello Powdarrmonkey My thanks for correcting the typo. Out of a matter of interest in OP's case would you recommend rsync over ditto or possibly even asr? Antonio Rocco (ACSA)

Hello Mark Have just come across this thread. What you could try is: rsync -avz /Volumes/Raid-Main /Volumes/Raid_Backup This should recursively transfer all files from /Volumes/Raid-Main on the source node into the destination directory on the remote node. Files should be transferred in archive mode. Hopefully preserving symbolic links, attributes & permissions etc. during the transfer. You should even get a bit of compression thrown in. You should be able to even log the transfers: rsync -aEx /Volumes/Raid-Main /Volumes/Raid_Backup >/var/log/rsync.log 2> /var/log/rsync.err or possibly: rsync -avExz /Volumes/Raid-Main /Volumes/Raid_Backup >/var/log/rsync.log 2> /var/log/rsync.err Rysnc uses ssh to make remote transfers. What that means is ssh should be installed at both ends. If both nodes are macs then it should be there in the default binaries. You're not limited to ssh either as you can use remsh or even rsh. Other alternatives are ditto and asr. Consult the manual pages for usage. However the other contributor's suggestion would be more than adequate Hope this helps? Antonio Rocco (ACSA)

Hi http://www.edugeek.net/forums/mac/27502-mac-update-service-wsus-4-mac.html and http://images.apple.com/server/macosx/docs/System_Imaging_and_SW_Update_Admin_v10.5.pdf Should be enough to get you going? However as it says in the first link SUS won't work if access is via an authenticated proxy/firewall. There is some measure of success via a transparent proxy. If your client macs are fully integrated in an AD-OD environment then you can define the SUS as a managed service. Clients will 'pull' updates down from the Server rather than looking outward to Apple's Updates Servers. Essentially all you have to do is make sure there is no interference from any proxy/firewall first and Start the Service. Updates should then begin to download from akugami.net. Depending on your bandwidth this can take anywhere from 2-3 days. You don't get an option to 'cherrypick' which updates are downloaded - they all come down in one big lump. You do get some options to update recently replaced ones after the initial download. You don't get a progress bar either of what's happening during the download. For 'progress status' you need to look at Activity Monitor (/Applications/Utilties) or issue top in the command line. You're looking for a process daemon(s) that looks something like this: swupdsync. The admin manual tells you the where the updates are stored. You could periodically "Get Info" on that directory and watch it's size bloat over time. Eventually you should see anywhere between 13-16GB of downloads. Apple's Updates are downloaded in a particular format which makes it impossible to create .dmgs or .imgs from. Neither can you take a .dmgs, .imgs, .pkgs or .mpkgs and drop them in the relevant directory as they won't work. Antonio Rocco (ACSA)

Hi On the affected Mac launch Terminal (/Applications/Utilities) and issue this command: sudo du -chxd 1 / Provide the local admin password when prompted. Don't worry if you don't see anything being types as there is no echo in terminal. It's normal. Be patient as the command can take some time to run. When complete it will give you a complete breakdown with sizes of every file and directory including BSD on the hard drive. I'm guessing a runaway log has bloated to some ridiculous size? You'll find it in /var/log. Antonio Rocco (ACSA)

Hi Multiple Beeps at Boottime is usually indicative of a RAM Module failure of some sort. On the affected mac reseat the RAM Modules and try again. If that fails go through the normal troubleshooting procedures you use to eliminate bad/faulty RAM module(s). Swop the modules around to eliminate a faulty slot. Remove one and leave one in. Take modules from a known equivalent working mac and try those instead etc. Troubleshooting RAM is no different on a Mac than it is on a PC. If none of the above works you still have the option of taking it to your nearest Apple Repair Specialist for further diagnosis and repair. All macs come with a year's warranty as well as the option to extend it a further two years. Antonio Rocco (ACSA)

Hi You should be able to download Office 2008 for mac as an ISO image directly to the mac itself from Microsoft's website. This was done approx 4-6 month ago at a site I support. Once downloaded simply double-clicking on the image should 'mount' it as a virtual drive. Install from there. Antonio Rocco (ACSA)

Hi The 4 days set aside for the Server Essentials Course is never enough in my view. Having said that creating nbis should not be that difficult? What you can do is build the client mac as desired. If applications required are 3rd-Party then make sure its a site license. Make sure its fully up-to-date as well as the Server. Don't do any pre-binding to AD or even OD. Don't create any symlinks or aliases to other network resources either. You can set up networked printers. Avoid directly attached printers/scanners etc. These can be tackled later on. Steer clear of authenticated binding as well. I would also disable any network port you won't be using. OD works best if all clients are wired. Especially if you're contemplating music, graphics and of course Video. Don't entertain anything less than gigabit networking. Once you have your image built, make sure you name the client mac with an appropriate name. You can do this two ways. In the Sharing Preferences Pane > Computer Name. Choose something suitable. For example if all your client Macs are iMacs then something like iMac01 will do. If your client hardware is a mix of iMacs and MacBooks then iMac01 and MacBook01 will do. Once you're happy with this 'golden' mac shut it down and move it as near as possible to your server. Use a Firewire 400-400 or 800-800 or even 400-800 to connect the Server and your mac client together. Switch on the client mac and hold down the 'T' key. In a short while you should the Firewire logo appear on the screen as a screen saver. You should now see the mac's drive appear on the Server's desktop as a slave drive. Launch System Image Utility. The drive should then present itself in the application. With 10.5 SIU the Interface is fairly straightforward. With 10.4 SIU you had to give the image an Index Number. Prior to doing any of this Enable the NetBoot Service. You can't start it until there's an image saved in the appropriate folder. Select the Service in Server Admin and click Settings. Select the Interface you want NetBoot to work from. Select the drive you want to put the images and client data. Tick both boxes. Up the logging level to at least Medium. Save any changes and quit out of Server Admin. If you navigate to top level /Library folder you should see a NetBoot folder has been created. This folder is automatically shared by the Server with the appropriate POSIX permissions. There is no need to fiddle with this any further. Get into the habit of quitting out of Server Admin and WGM whenever you're done. Server Admin has a tendency to cause memory leaks if left launched for long periods of time. Continue with SIU. There will be a point after you click the Agree button in the EULA window where you'll be directed to save the NetBoot Image (nbi) save it in the NetBootSP0 folder. SIU can take some time. I recently built an image that was 110GB on the client computer and ended up being 78GB as an nbi. Took the better part of 3-4 hours. Once the image has been built quit out of SIU launch Server Admin, select the Service, select Settings, select Images and enable the image. Finally start the Service. Test by either selecting the image from the Startup Disk Preferences Pane or by using the 'N' key on reboot. NetBoot will only work if there's a DHCP Server on the network. It can't traverse subnets easily unless an appropriate switch has been configured to forward the NetBoot's Server IP Address. It can't work wirelessly. 10/100 networks will support 6-10 clients although it does depend on the size of the image. I've successfully installed up to 20 mac clients with a 45GB image using NetBoot over a gigabit network. Took about an hour. Your mileage may vary. Antonio Rocco (ACSA)

Hi Launch Virtual Box but don't launch any of virtual environments. Select the Virtual OS you're interested in and from the Machines Menu select Settings. At the top of window should be a row of icons. One of them should say Shared Folders. Select this and then click on the Folder icon with the '+' symbol. Navigate to the desired folder or provide the path. That's what I do and it works for me. Antonio Rocco (ACSA)

Hi If the pin from the charger has snapped off and remained inside the power-in socket then you need to replace the charger. Getting the broken pin out is a little harder. You could try and fish it out? Who knows you might get lucky? However it's probably better to replace the DC-inboard. Any Apple Authorised Repair Specialist can supply you with the part as well as fitting it. Although you could have a go yourself? On the 15" & 17" models its a fairly trivial repair - if you know what you're doing. For the 12" model it's a major event requiring removal of practically every internal component. IIRC the DC-inboard also doubles as the Sound Board on the 15" models. Antonio Rocco (ACSA)

Hi I don't think this is your iMac? Look in the reverse DNS part of your DHCP/DNS Services. In my experience most windows admins tend to leave the scavenge stale records part of these services at their defaults. I think its 7 days? OpenLDAP in the main is all about reverse DNS, leastways that's how it is in Apple's implementation of it. From what I've seen of Active Directory its not that different. Because macs are not necessarily DDNS aware it could be they're just picking up whatever stale record is left in the relevant services on your DC. I would also look in the WINS tab of the Network Preferences Pane on the Mac itself and see what's being reported there. Macs are a lot more NetBIOS aware than ever before and I've sometimes seen an assigned name in that tab cause a problem with what the mac thinks its local hostname is. I've also seen a NetBIOS name present itself as the local terminal user. Typically its a single number, usually the first octet of a reserved IP address range. Occasionally a name or combination of letters/numbers. Antonio Rocco (ACSA)

Hi Glad I could help. Sorry about the command. Sometimes I can't see the wood for the trees! Still you figured it out yourself. The -h switch is used when the shutdown command is invoked. We have a Mac OS X Server for deploying policies to the Mac workstations. I have no idea what MCX is? MCX = Managed Client X. Apple's version of Global Policy Objects. If you like its the 'official' name for 'Policies'. Now that you know this its not such a mystery and you should be comfortable in the knowledge that you've been using it successfully without really knowing what its called. Apple make available for free fairly extensive administration manuals from here: Apple - Mac OS X Server - Resources Two Admin Manuals which I think you'd benefit from are: http://images.apple.com/server/macosx/docs/Open_Directory_Admin_v10.5_3rd_Ed.pdf http://images.apple.com/server/macosx/docs/User_Management_v10.5.mnl.pdf Changing the name using System Preferences > Sharing would be the way to do it. However you could flex your command line muscles and use scutil instead. To access the manual page launch terminal and issue man scutil. For example: sudo scutil --get LocalHostName should reveal what you've set. Using the --set switch to define the name will achieve the same thing as the Sharing Preferences Pane. In fact scutil can go a lot further. You'll see for yourself what it can do when you consult the manual. Workgroup Manager has a tendency to 'hang on' to old names. Let's call it a 'feature'. What you can do is make a note of the MAC Address, remove it from the list and then manually add it. However you may find WGM will insist on using the old name. The only other way of hopefully 'resetting' the computer list is to delete the list completely. Create a new one. Name it something different and add the members again. The thing is to make sure the name is listed correctly when viewing the schema itself. To view the schema launch Workgroup Manager and select Preferences from the Workgroup Manager Menu. Enable the "Show All Records tab and inspector". You'll get a suitably dire warning regarding viewing raw data. OK this and don't panic. What you should now see is a small bulls eye like icon has been added as well as an Inspector menu. Select the affected computer from the Computer List and click on the Inspector tab. You can view its name (Record Name) and other information in the LDAP database. You can also change the value directly at this level. It's a good idea to quit either Workgroup Manager and especially Server Admin once you're done. Server Admin has a tendency to cause memory leaks if left open for long periods of time ARGH! Macs are driving me nuts! I know what you mean. Still once you begin to understand them its not that bad. You've done well so far considering you've done this all yourself. Well done! Antonio Rocco (ACSA)

Hi On the affected mac log in as the local admin. Launch terminal and issue: sudo rm -R -v /Library/Preferences/DirectoryService Provide the password when prompted. You won't see it being typed so don't worry. Now issue: sudo rm -R -v /Library/Preferences/edu.mit.Kerberos Next issue: sudor rm -R -v /Library/Preferences/SystemConfiguration Finally issue: sudo reboot -h now The mac should now restart. On successful log in reinstate the local computer name as well as any network settings ie: proxy settings etc. Launch Directory Utility and bind to AD first. Verify you've received the TGT by looking in /Library/Preferences. You're looking for the edu.mit.Kerberos file. If you have mac server providing MCX now use the LDAPv3 Plug in in the same application to 'join' the client. Make sure you de-select 'Use for Authentication'. Log out of the local admin account and try for a network log in again. If you're pushing out hardware specific MCX make sure you re-add the client to the relevant computer list in Workgroup Manager. Try and make sure all the clients are on 10.5.6. If you can rebuild a new image after the update has been applied. If the original image was built prior to 10.5.6 then this is a known problem. See these articles for further information: About the Mac OS X Server 10.5.6 Update Mac OS X 10.5: Duplicate computer name alert when binding to Open Directory Antonio Rocco (ACSA)

Hi The usual ones you should be familiar with? Sophos have a mac client as does MacAfee. Symantec are still doing one although its not that obvious from their website. The last time I looked into it you had to call them. To be honest I'm not a fan of Symantec's products. I've heard Avast and AVG are developing a client for the mac platform? Perhaps they're now available. Something you could Google for? ClamX is free to download. Intego provide AV software for the mac platform as well. They also do a Server version. Antonio Rocco (ACSA)