AntonioRocco

Ranj If your client mac is 10.5 then you should not be using 10.4 Server's SIU to create the image. Basically the 'rule of thumb' is 10.4 Server's SIU to create 10.4 images, 10.5 Server's SIU to create 10.5 images. With 10.4 SIU you have to be careful which index number you use. Don't use anything over 4095 and each successive image should have its own unique index number. Basically start with 4095 and move downwards in sequence. With 10.5 SIU you don't have to bother as it's 'smart' enough to do it all for you. You can 'serve' 10.4 or 10.5 nbis from either 10.4 or 10.5 Server. You don't need to take nbis out of the /Library/NetBoot directory. Simply enable or disable desired images using the Service Interface. If you have more than one image you wish to serve you can select whichever one you want using the Startup Disk Preference Pane on the client. If there is no system on the client boot from the installer disk as there is a Startup Disk selector there as well. You can also use the option key (start up disk manager) to select any/all available bootable sources. You can 'clone' a client mac (the Golden Mac) using DU or Mike Bombich's CarbonCopyCloner to an external drive (preferably firewire although USB can be used for Intel Macs). You can then boot any other suitable mac with the external drive and deploy that way. You could use a cascading method to deploy a single image. Configure a mac as you would like it. Boot from an appropriate Installer Disk. Target Disk Mode another mac to that mac and use DU to image from one to the other. Once you have two use the same technique on the next two. Keep on going until you have four. You're only limited by the amount of firewire cables you have as well as physical desk space. Netboot image creation can fail if you used aliases or links (symlinks) to files/folders or network resources that were subsequently removed or no longer available after the client was configured. Changing hard drive name is not a good idea as well. Try to stick to Macintosh HD. Antonio Rocco (ACSA)

Hi Just about any make/model SATA drive should work in a MacPro. Deciding on the size is a slightly harder question to answer? Any drive being used for the System requires as a general rule of thumb approx 10-15% of free space. If you're going to install some hefty applications such as Adobe's CS suite that would realistically rule out the smaller drive. You're kinda pushing it a bit with the 150GB as well. To be honest in a MacPro I would start with a 250GB and work your way upwards. You do get a location choice when installing most applications. Some you can even run from a non-system drive. Again if its one of the meatier applications such as Adobe's CS suite it would be better ran from the boot drive. Years ago you could run just about any application from the non-boot drive. When OSX came along I stopped doing it so it's been some time since I tried it. Why don't you have a go and report back? Simply copying the application once it has been installed should be enough? For it to be a true test delete it from the boot drive first before launching it. Antonio Rocco (ACSA)

Hi You can use either cron or launchd from the command line. Cron is being phased out so launchd is the preferred method for 10.5 but cron will do the job equally as well. Consult the manual pages for each; man cron and man launchd. Launchd has its own utility called launchctl. You configure what you want using that. If the command line is not to your taste use Lingon: Apple - Downloads - System/Disk Utilities - Lingon Antonio Rocco (ACSA)

@ Ric The statement still stands. Pricing for education is less than the commercial sector. Yes you're right it's still expensive but you knew that anyway. @ DMCoy I'm sorry to hear your experience has not been great. I agree with some of your comments. Generally Apple don't behave any differently to any other computer/OS manufacturer. I disagree slightly with your view of Apple's implementation of LDAP. I don't come to the same conclusion. Not when comparing it to the other offerings. Of course it's nowhere near perfect. Neither is Active Directory. At least Apple does try to make their platform work in heterogenous environments. I don't see Microsoft making quite the same effort? Printer Sharing? Why are you bothering? Let the DC handle it - its better at it anyway. Antonio Rocco (ACSA)

Hi You might all be guilty of jumping to an unwarranted conclusion? Don't forget the prices you're seeing on the web site do not necessarily reflect the pricing policy for educational institutions. Apple have always had and AFAIK still have an aggressive pricing policy when it comes to education. How can this be seen as ignoring education? To say otherwise is simply wrong and slightly naive. Most of you are in education and must have been involved at some level when purchasing IT? Do you not compare the unit price you pay against the unit price available commercially? Antonio Rocco (ACSA)

Hi It all depends on what version the server is? If it's 10.5 then DNS is absolutely required for the server itself simply to provide stability. The service does not have to run on the Server itself just as long as its running somewhere else on the same network will do. Clearly in a mature Windows environment that would be your DC. What 10.5 Server does is continually bleat (make requests or register for want of a better word etc) for something that it can resolve itself to. You'll see the system.log filling itself up with entries saying something like "DNS hostname is not available, please repair DNS" etc. It's easy enough to fix. Create an A Record with associated reverse pointer using the DNS Snap in Module on your DC and enter the DNS Server's IP address as the Primary DNS Server in the Mac Server's Network Preferences Pane. Make sure the server can resolve itself on both pointers. Use nslookup, dig or host from the command line to do this on the Server itself. Finally you could issue: sudo changeip -checkhostname From the server itself and if it returns "the names match, there is nothing to change" that should be it. To answer your question and AFAIK there's no way to stop it from registering itself not without breaking it in a major way. With 10.4 Server its should not be a problem and if it is there's something else going on that has probably nothing to do with the server. Out of interest what exactly is the problem with Deploy Studio? I'm struggling to see why it would give it a problem? Antonio Rocco (ACSA)

Yes. Changeip is used if you're contemplating changing either the IP address, the hostname or both. Bear in mind its not necessarily a panacea for any possible DNS/LDAP ills resulting from such changes. Depending on how mature it is changing one or the other can have dire consequences for your LDAP database. Sometimes the only way to effectively do this is to export users and groups (you could archive the LDAP database although you might have problems restoring it), demoting to Standalone, sorting out DNS followed by a re-promotion and re-import etc. Changing the gateway/router address or the subnet mask should have no bearing. However you should be careful with the subnet mask if you're opening it up or narrowing it down (eg: 8 or 16 bits to 24 etc). Not so much for the server itself but for clients who may be using it for NetInstall or NetBoot for example. Some of these clients might have a problem if the Server's subnet changes and theirs does not. As always make sure you have fully working bootable clone of your server - you never know! Antonio Rocco (ACSA)

This has been around for some time on the mac platform. Use this: DNSChanger Trojan Horse Removal - OSX.RSPlug.A OSX/Puper to remove it. Alternatively you could issue: sudo rm -R -v /Library/Preferences/SystemConfiguration from the command line (/Applications/Utilities/Terminal), followed by sudo reboot now Or you can manually reboot the affected client. Make sure you quit all open applications before doing this. On successful restart navigate to the Sharing Preferences Pane and reinstate the Computer's Name. If Network Settings are supplied by a DHCP Server then verify those settings are as they should be. Re-instate any Proxy Server Settings you might have. Antonio Rocco (ACSA)

I think I'm beginning to understand what's happened? Assuming you've updated all your Client's Office applications then you should be able to install WorkGroup Manager on one of those macs. Remove the application from the approved list and re-add it. All WGM is doing is providing a link to that application if it's installed on the Clients being managed. If the client workstation used to add the application still has the older version installed then I can see this would give a problem for the other clients if their version was newer or older. You should also realize that Workgroup Manager as an application can throw a wobbly every now and again. Removing com.apple.WorkgroupManager.plist from ~/Users/Home/Preferences folder followed by a relaunch of the application sometimes gets it back on track. The property list should be removed from whichever mac you're using to apply MCX. I would not apply application MCX from the Server itself. Otherwise you have to install or copy all the client's applications to the server. Why bother? Antonio Rocco (ACSA)

Assuming this is a 'classic' Open Directory deployment then whatever folder/directory is being shared for User Home Folder creation the default POSIX permissions should be: Owner: admin or root R/W Group: admin R/W Everyone: R Depending on how you created the folder/directory (using the finder or the application) you'll either see root or admin. Either will do. For individual User's Parent Homes: Owner: User's name R/W Group: staff R Everyone: R When you look at the individual folders themselves they should all belong to the User who should have full Read/Write privileges. The Group should be staff with No Access as should Everyone. All of the folders should have these permissions apart from Public and Sites. These two folders will have the same permissions as the the User's Parent directory. You can't repair permissions on a volume/drive that does not have a valid OS installed. What I've sometimes seen is an overzealous teacher or IT admin get confused about the permissions models available? They assign ownership at the Parent folder level to a different user and propagate downwards from there using the POSIX model. End result students don't get access to their homes or have read access only. Not good. It might be best to explain the Permissions Models available so as a greater understanding can be achieved? Essentially there are two - there is a third. Access Control Lists (ACLs) and standard POSIX. ACLs are similar to what is available on the Windows platform and have been available since 10.4. In 10.4 you have to enable ACLs for a given volume followed by a restart. This is for the Server. The Client OS still used POSIX. ACLs supercede or worked in conjunction with standard POSIX. You had to be careful as a deny in both models could lock you out with dire consequences. Standard POSIX are limited (no support for multiple groups for example) in their scope whereas ACLs are far wider and more 'granular'. You have to be careful with ACLs as things can soon get complicated. However once you begin to understand how they work there is not much you can't achieve. For example ACLs can traverse directories. With 10.5 ACLs are used by default in both the Server and Client OS. Standard POSIX is deprecated in favour of ACLs. Apart from special users reserved for the system and home folder creation only ACLs are honoured. However this is not perfect - what a surprise! On OSX Server you should never 'fiddle' with permissions using the Finder. Its okay to do it with the Client OS although it can go wrong sometimes. Better to use the relevant application on the Server OS or the command line on both. Consult the manual pages for chown and chmod for examples and usage. The above is especially true for 10.5. For your problem and unless someone comes up with something else - a script with relevant variables included possibly? I think you are really looking at 'resetting' each individual users home parent folder and propagating from there. As mentioned you should only be using standard POSIX to achieve this. It's easier to troubleshoot that way. If you want to provide access for a teacher or group of teachers or members of the IT staff do so using an overriding ACL. The third permissions model available are SACLs (Service Access Control Lists). These can be set and defined using Server Admin. In practice you generally leave them at their defaults. Antonio Rocco (ACSA)

If you're looking for something similar to Windows Restore in OSX you won't find one. If it's an important System Update the advice is to create a workable bootable clone before running the update. Not that important for the Client OS but should always be considered for the Server OS. Why don't you simply copy over the application from one of the other clients that you've not updated? Assuming you've only updated a handful and not all of them? Besides I'm not sure I understand the problem you're seeing with Workgroup Manager? The application should not care what version any application is. Unless you've updated the OS as well? What is it you're trying to do exactly and how are you trying to do it? Antonio Rocco (ACSA)

Thunderbird, Netscape, Eudora are some I can think of? I'm fairly certain there are others? If you're using OWA and it looks odd in Safari try the other alternatives: Firefox, Netscape, Opera, Demeter, Shiira, Fluid. You could google these yourself? Only potential problem I can see is whether these mail apps support Exchange Server? You might also see problems with the way Microsoft implements MIME? In addition you might find limited support for Exchange's authentication methods? Entourage can be made to work with Exchange Server - leastways the latest version can. Something which I have done successfully, but only in a commercial environment. You could create a secondary or sub-domain. Configure the Mail Service on OSX Server (if you have one) and forward mail for that secondary or sub-domain from the primary domain. You should be able to use Entourage in that case as it would respond with the MTAs (Postfix, Cyrus etc) on OSX Server. However I doubt if you could access the scheduling/calendaring/shared contacts facility coming from Exchange? Not unless you can dream up of way of 'pushing' that information on? If it's all about making money then surely Microsoft would make more if they left whatever it is they take out, in? Antonio Rocco (ACSA)

What processes/daemons do you want to control? Bear in mind you have to be careful with most of what is there as they are set to launch for good reasons. The main one being they make most things work. If there is something similar to MSCONFIG then I'm guessing that would be launchd and its utility launchctl? If you're familiar with Linux/Unix there is also Cron available although Apple are dropping this in favour of launchd. Most of the files launchd uses are located here: ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons /System/Library/LaunchAgents /System/Library/LaunchDaemons If you issue: ls /System/Library/LaunchDaemons using the command line you'll see some of the files being accessed by launchd which in turn is invoked by the kernel. All of these are .plists or Property Lists which can be edited using Property List Editor. Alternatively you could use nano, pico, vi or emacs via the command line. Another place to look is /etc. Within /etc are just about all of the BSD config files the system refers to. For example /etc/hosts is something you may be familiar with? If you look at /etc/protocols you'll see which ports are assigned to what services. Some of these can be altered/modified to suit a specific purpose. I would be careful fiddling with /etc or /var as you could break the OS? However I might have misunderstood? Perhaps you simply want to control which applications or utilities start at login time? You can modify these by selecting System Preferences > Accounts > Login Items. Browse for what you want and add/remove it. Antonio Rocco (ACSA)

Command + Carriage Return Antonio Rocco (ACSA)

Use CarbonCopyCloner: Bombich Software: Carbon Copy Cloner You can even schedule it. Best of all its Free! Otherwise use the Restore feature in Disk Utility as already mentioned. Must be used when booted from another drive or the installer disk. Another way of doing this is to use NetBoot/NetInstall. This technology is only available on OSX Server. Essentially you build your mac as you would like it and then use System Image Utility to save the image as a NetBoot Image or nbi for short. You can build as many nbis as you like with as many variations as you like. You're only limited to what you are able to store. NetBoot Images can be stored and served from any drive that's physically attached to the host server. Stay clear of externally attached USB drives. If your mac's drive goes belly up you can rebuild the mac (once you replace the drive) with an exact clone of what you had before. You can build nbis for MacPros, iMacs and MacBooks. Each nbis would be unique to the specific mac hardware. Unless you have the correct infrastructure in place it will only work on Class C subnets. Antonio Rocco (ACSA)

Presumably you built one of the iMacs, imaged it and built the nbi to be pushed out by the NetBoot Service? The error log may refer to the LKDC being the same? Essentially all the iMacs think they are being authenticated to themselves locally using the same Local Key Distribution Centre. This is in addition to and separate from AD's KDC. The 10.5.6 Combo Update (Server) is supposed to fix this. Apple have posted a kbase article with more information. Mac OS X 10.5: Duplicate computer name alert when binding to Open Directory Normally in an OD environment with no AD you'd get the error message as explained in the article. With AD in the mix the problem may be compounded? Could be why you see the blue screen? The System Imaging section of this article explains more: About the Mac OS X Server 10.5.6 Update If connectivity is via ethernet (presumably it is) make sure you disable IPv6. Antonio Rocco (ACSA)

Hi Ross You would think so? However when ARD is pointed out to most of the Admins/Teachers I come across - and what it can do - I generally get a blank stare. Yes I know. I know of some sites where they have ARD (10 Client or unlimited) and they don't use it. It's still in the box with the cellophane wrapping intact. Yes I know. Can you make a well-know phrase or saying from these words? lead water make drink can't horse Antonio Rocco (ACSA)

@ Ross & Mark Apple (United Kingdom) - Remote Desktop 3 10-client is more than enough for most people? Antonio Rocco (ACSA)

Hi Mark They are not there anymore. They were not that great in 10.4 in the first place. The Public view was the only one that kinda worked but was essentially mis-named! You would have thought the Public view meant everyone? It meant the opposite. Leopard provides Computers and Computer Lists (or Groups) if you prefer. That's about it. Antonio Rocco (ACSA)

Hello What Mark has suggested is very good and might work? DNS has to be configured correctly - as always on the AD. There are other variables that need to be taken into account. Namely SMB Digital Signing is not supported. NTP is another critical area to look at. However I'm not sure if you can have a Replica when the Master is not the KDC? Personally I think Replication may fail as slapcat and kerberosautoconfig won't be able to do their thing. SSH needs to be on as well and I think this too will be affected if the OD Master is not the Key Distribution Centre. I suppose the only real way to find out is to try it? There may well be further problems with this? For example how are these users going to be able to authenticate when the AD KDC knows nothing of them? Don't forget they only exist in the LDAP node regardless of whether replication works or not. At some point these users would have to be imported into AD. What about home folders? You'd have to let the AD know the UNC path. That's a lot of typing for 350 users. Antonio Rocco (ACSA)

Hi As far as I know there are no 'Free' Data Recovery applications. DataRescue is more for recovering data from a drive that is still spinning but is not accessible in the normal way. Generally drives that have lost their ability to hold and maintain a valid file system directory. You can find DataRescue from here: Data Recovery Software, Hard Drive Data/File Recovery Software for Windows/Mac You could try FileSalvager: FileSalvage - Mac OS X Data Recovery, Undelete Files, Rescue Lost Data What 'sometimes' works is to pull the power cable out of the affected mac immediately after the deletion has taken place. If you are quick enough and if the action does not 'shock' the drive into a failed state then on successful reboot you may find the Trash has 'miraculously' filled itself with the deleted data. The speed of the action was too quick for the file system to organize itself with an updated catalog of the drive's contents. Clearly use this method with extreme caution and at your own risk. You have to ask yourself how important is the data? To be honest the longer you leave this the less chance you have of recovering anything meaningful. As already pointed out files that are deleted either using delete Trash or through terminal using rm -R -v don't hang around for long. Even moving the mouse after deletion alters the contents of the drive in a small way. This would affect the chances of a successful recovery. Seriously once its gone its gone. If the files were on a OSX Server-based share point and were deleted by a user 'over the network' there is even less chance. You could for example limit this from happening. It's a good idea to enable ACLs on the shared volume and define read/write but deny delete access. That way users can create, read and overwrite but never delete files and/or folders. Root and ssh are enabled by default on every OSX Server installation/deployment. On OSX Client you have to enable root as well as assigning a password if you want superuser (sudo) to work. You would have to precede a powerful command such as rm with sudo in any case. Finally you could sidestep all of this by making sure you have an effective back-up strategy in place. Antonio Rocco (ACSA)

Hello Mark Post the result of postconf -n please Tony

Hello Mark No I don't think its you at all. I already knew a little of your environment. You are one of the few I know of who is pushing these technologies as far as you can take them I did have a 'What if' which I'm guessing you may have already tried? As an experiment and only if it's possible take AD and OD out of the mix completely? For example if you can get your hands on a 'vanilla' mac client or unbind an existing client from both nodes. ARD should work with the local admin account alone in the way you've already mentioned without throwing an error message. Tony

Hello Mark! Thank you for your kind words! I trust you are well? Firstly congratulations on getting SUS to work in an AD-OD environment. I'm not surprised you had to bypass the Proxy. I have nothing but respect for all of you Windows System Admins working in the environments you find yourselves in. I've seen how tough it can be. Most of the time you're on your own with not much control over the budgets and at the mercy of every teacher's whims and wants. A lot of them from wht I've seen generally impractical or even a waste of time. I was at one site recently which was a new build, Cat 6 throughout yet not one Gigabit Switch anywhere. One step forwards, two steps backwards? This is not a criticism only an observation. Of course you are right. There are those oddities and inconsistencies you mention. We have to do the best we can and work with what is there. Nothing is ever perfect regardless of whether its Microsoft or Apple. But of course you know this already. In my experience the error message you see is sometimes indicative of a DNS Resolution or authentication problem? Which is strange as I happen to know your internal DNS Service is as good as it can be. Perhaps its a DHCP problem? Have you considered assigning fixed IP addresses to your Mac clients and trying again? Perhaps the error message might change? At least that way you know the problem has moved forwards in some way? The commands you listed are ones I generally run although you could also try sudo softwareupdate -i -r instead. At this moment I can't think of anything else to offer? Tony

Hello Paul You are more than welcome! I am well thank you and still very busy! Not unlike yourself? There is lots more I could post if I'm asked. Take care and have yourself a nice Christmas! Tony