HodgeHi

Also bear in mind that it cannot sync the time until it has obtained an IP address. If this process takes longer than it does to boot the OS X Client then it will need to either sit at the log in window until it does and then syncs the clock or log in as a local admin. You will see that only when you click on the padlock in the time prefs does it then sync the time. Only happens on 10.5 I did the launchd thing on my clients and seemed to do the trick I think but had issues with the rebinds anyway. In the end I went with static IPs with DHCP under the network config and also updated to 10.6

If you print to a Windows print queue from a mac when logged in using an AD User account you have to re-authenticate to print. An authentication dialog pops up asking for your credentials. Using ksmbprintd this bypasses this issue by instead of using the normal smb print queues it uses the ksmb print queue. They are set up in the same manner but pass the kerberos ticket properly to the print server. This removes the need for users to re-authenticate just to print. We have it set up similar to yours. We have os x 10.5 and 10.6 clients with papercut. Users print, don't need to auth and the jobs passes through the queue and quota reduces accordingly, seamlessly (most of the time )

What printer queues were you using? Are they AD printer queues? If so you will need to deploy an additional piece of software as macs don't work with windows print kerberos authentication. You will need ksmbprintd. Then once this is installed you can then use Windows Server print queues. You will still need to make sure that the drivers are in place on the clients. Also when managing client print queues you need to create the queues on a client machine and not the OS X server. To do this, install ksmbprintd on the client you are using to manage the OS X print queues. Go to the system preferences and then print and fax. Click the + icon below the printers list. This will bring up a dialog box. Right-click any space on the toolbar and then click customise toolbar. Add the advanced option. On the type choose Windows printer via samba with kerberos support. Under the URL it should now be prefixed with ksmb:// Complete the URl by pointing to the Printer Share name Do not use the print queue name. This does not work for OS X. Enter the remaining details such as name, location and choose the driver. Once the printers are in the list on your client management machine. Test printing to make sure that they work. If they do, then you can continue to start the managing. Open WGM and then click on the printing preference. Now in the Printing list in WGM you should see a list of the printers that you added previously. Hope this helps. I think this is the same for OS X Server print queues except the ksmbprintd part is not needed. However, print queues on OS X Servers is terrible. Could never get them to work properly from 1.4 to 10.5. Not tried 10.6.

We have the same problem. In my case though it is hardware compatibility. We have 15 to 20 webcams that work well with 10.5.8 and a piece of software we use. If we upgrade to 10.6 we can no longer use these webcams or this piece of software. So we either don't upgrade, or upgrade and purchase another load of webcams and at £60 to be compatible with a mac is a bit much for a webcam really.

The problem with the wii wasn't the novelty wearing off but rather the sorry state that they called games being released for the machine. Every single title released for the machine at one point were 'party' games. Even this should be taken with a pinch of salt as most of those were so bad you would struggle to include them in any decent party. The 3rd party titles killed the Wii and also the DS. You could blame piracy but hell who would even want to go out and spend £30 on the crap for either of those platforms. Nintendo show the other developers how to create games for their consoles. You don't need awesome graphics (although the Wii does look pretty bad on a 1080P 46" TV) to have a great game. Just a good concept for a great game. Every single Zelda game released has been well worth the money put down for them, even if it isn't in 1080P HiDef graphics. If Sony have a good range of games that take advantage of the motion controls properly then it could be good. killzone 3 is apparently 3D and PS Move compatible? Imagine controlling the jetpacks using the move controller in each hand (if the nun-chuck like device) is motion controlled as well) turning them to change direction.

It sounds like the user you are running the command under is not allowed to run the sudo command. IE a standard AD networked account is not listed in the sudoers file. I don't know how to remedy this as i never bothered looking. But have seen this several times myself, unless or course you know the user should be able to use sudo in which case I'm not sure. Running the command as a local admin should give the correct results.

If you are using Networked-based accounts the documents folder in the sidebar takes them straight to their Documents folder within their Home folder. To check this, open the documents folder as a user than then while holding down the Apple/cmd key click on the icon across the top of the window. This will show you the path to that folder. It should be something like: machine-name > HDD > Network > Servers alias > Server name > Home Share > Users home dir > Documents.

Does it not work with the latest updated version of 10.5.8? I thought that they usually updated the previous version to work on newer hardware with .1 increments. I thought whenever a new piece of hardware came out a .1 increment usually followed. I would maybe fully patch the 10.5 version and then try that. You never know.

It's strange that you say this as I have had a similar thing happen here. It is also very random. I just logged the user out and then back in and it sorts itself out. Very odd as this never happened on 10.5.x. There was also a user where he had the same dock settings no matter how he logged in. I found this to be down to group membership. He was not in the group of users that had the dock preference assigned to that group, thus not getting the preference setting. Once I had added him to the right group he immediately started picking up the settings accordingly.

The first thing I would do is get a restriction working. Once you can confirm there are no issues with regards to the restrictions taking place, you can send start to plan the process. If it were meI would perhaps look at creating a dedicated group in the OD or AD and join these users that are to be allowed access to these machines. Then add this group to the list. I never tried using the Allow option. I can give it a go if you want to see what happens. Deny takes precedence over Allow according to WGM.

Not sure if the time machine is the best method to use as the GUIDs/UUIDs and LKDC need to be re-created and also the byhost preferences need to be fixed as well. I'm not saying that it doesn't work though. Luckily DeployStudio does all of this for you after the deployment. I have also recently used SysPrep to complete majority of the Windows partition as well. So all I have to do now is name each client (until I can find the best way to do this automatically) and thats it. The Mac side however can be fully automated but I have run into a few complications with the binding process being automated. I use reserved IPs for the suite and Macs don't do it like Windows boxes. You have to manually enter the IP address in the network preferences. This causes an issue with DeployStudio as it doesn't yet have an IP address or a DHCP lease so cannot bind using FQDN. This frustrated me quite a bit. In the end I resorted to deploying the images and then sending out the Bind command using ARD, which is another piece of software you will more than likely need.

I have just tested this out with my own machine and user account. I added my machine to a Computer list in the OD and configured this computer list for restricted access. I have 2 AD groups in the list. 1 is a group for all pupils and the other a group for all staff. The only user not in these groups is mine. Upon restarting the client machine (to pick up the new managed preferences) I tried my sons account (he's in reception), the login window shook. I then proceeded to try my login and logged in fine. I tried another staff users login whose details I can remember, and they could not log in. So the restrictions are working fine. However, if I added my user to the all staff group, I could no longer login. But if I removed my account from the group again, I still could NOT log in. Only when I restart the client does the removal from an account take effect. The Settings I used are Deny on the access for both groups. There may be a conflict of group membership causing the issue. I don't know. What I do know though is that the restricted network access does seem to work. Sorry if that's no help to you.

I will have a test tomorrow to see if mine do the same. We can find out then if its a general issue rather than just yours

If you wish to lock down a single machine you can do it using the local system preferences. click on system prefs, then User accounts and then login option. You will see a tick box that allows you to allow network users. If you then click on options it should list all the users and groups both from the AD and OD. You can also do it via the WGM. I think this is what you are looking at now since you mentioned access control lists. I've not done it using WGM so not entirely sure if there are problems or not. But from the looks of it the process should be something like this: Create a Computer group and then add the computers you want to restrict to the group. Once done go to the preferences section and then login and then access. Click on the + icon to the left of the box. You should then see the a screen like the one below. When the drawer of users pops open to the left (or right depending on how much screen is available) look at the top of this drawer. You can see a small blue globe. Click on this and choose your AD from the list. You should then see all of your AD users/groups. Once these are available you should be able to drag them into the box, allowing them access to the machines in the group. I hope this helps. As i say I've never needed to do this through WGM so not sure how well it works.

There is a setting that allows you to select the groups/individual users you want to allow access to the machines. Give me a few minutes and I will upload a screen dump of the location.

Maybe best trying 10.6 as it has full exchange support. I thought it was in 10.5 but not so sure now.

What is it that you are trying to do? Are you trying to make it so that users don't have to navigate through a tonne of folders to their home dir? Would it Ok to place their home dir in the dock? There is a tick box when managing the dock preferences to do this very thing. It makes the whole process simpler, but of course only if this is what you are wanting to do.

LanSchool is a good alternative to ARD and is cross-platform. It's not as quick at refreshing the screen though IME but it could have just needed some tweaking. Take a look at the trial. The Windows side can be controlled from the mac side and seems to have the same amount of control as you would from a Windows box. I only trialled it for a small period of time though. Added bonus of having an iPad app out as well.

What about using a web-based access to the folders with a password protected realm and session time outs. Would resolve most potential issues with being left unattended.

I am rather limited to the amount I can help as all forums are restricted here except this on e and a couple others. It's quite annoying. I did find a forum post that, i think in the apple discussions before when I had a problem with Netboot. It was to do with checking the NFS mount points. I would disable the firewall to do some checks to ensure that the firewall is not causing the problem. You can always enable it again afterwards. Also check your DeployStudio version. It may be an issue of incompatible versions. You could also try moving the NetbootSP0 and NetBootClient0 shares. It maybe that the permissions have gotten messed up somehow. Doing this I think re-creates the shares with appropriate permissions. Also make sure that AFP is working correctly. I will see if I can find the info I used for my problem but I wouldn't hold my breath that I can get to it! You could even try putting the boot up in verbose mode by holding down cmd +V

Unless theres a bigger issue with users having more rights than they should have?

I would suggest looking at the disk util as i mentioned before. May have a dodgy disk or perhaps some issues with permissions. Unless you have already tried that. Failing that a possible re-install of the OS may be needed. Unless someone else can think of something.

What disk space is available to the server?

I would reboot off the Install DVD and use the disk utility on the menu bar across the top. To boot off CD/DVD hold down the c button while starting up the server. Once in Disk util click on the HDD holding your OS in the left bar and then click verify disk. Also try verify /repair permissions. Was this a brand new Install or an upgrade? My Xserve has been up the same time as my Windows Servers. Once settled they are pretty reliable. Keep with it. Also if it's an OD/AD integration make a backup of the OD settings and also export the OS X Groups from WGM. You should then be able to re-import these once re-built.

ARD is possibly the best piece of software Apple make. For management of the OS X Clients it is more or less essential. You can send out custom ARD client packages that install an additional ARD specific account. It can adjust all of the remote management preferences too using the custom client package. Also as long as the software supports Apple's .pkg file format installation is a breeze. This was the biggest moan about MS Office for mac. Even this moved over to the .pkg format. Now the updates are in the same format so management is simple. You can also (money permitting) purchase a 2nd copy of ARD and use it as a Task manager server. So you could set up a deployment of updates for Office say and then when each client comes online it will run the task from the task management server. You can also manage the clients remotely as well i.e. change startup disk, empty the trash, search for files and then copy them to your own machine. It really is quite good. It's also worth looking into setting up for the teacher station in the Suite if you have one as you can also share someone else's screen and also control what they can do e.g mute volume on all machines at once. It also integrates into Automator as well. For the windows side it is really just basic VNC/screen sharing. Nothing more. Oh and £400 is pretty expensive. We only paid around £200 - £250 for a unlimited client license, hence why we bought 2 copies.