can authenticate on 10.3.3 against win2k3 ad, nothing else

[Anonymous]

i’m running a win2k3 ad controller in our office which has several macs running os x 10.3.3.

i’ve successfully joined the machines to the domain using the active directory plugin for directory access, and i can login to the macs using my ad account, which is a member of the domain admins, enterprise admins, domain users, et al groups.

once i login though, i can do practically nothing. i can’t save files to the desktop, i can’t view what is in the music, pictures, documents, et al folders. i can’t even open internet explorer. a little popup appears with three headings which looks like it is trying to tell me about a security requirement that is not fulfilled, but it’s actually empty.

do i need to somehow change permissions on the mac workstations locally, or in the ad controller to allow network users to save files to their home directories and desktop?

as far as i understand it, i should have administrative privileges on the mac as i am a member of domain admins, is that not correct?

i also have a problem when i try to mount an smb share with apple k. it asks me for the domain, username, and password. i enter them (and they are correct for my domain admin user) but access is denied with an error about an incorrect username or password. do i need to lighten to security requirements of smb in the ad group policy for win2k3, or do i need to install some kind of uam on the macs?

thanks.

[sketch]

the users in a group need to be imported by the Mac into the local admin group which resides in the NetInfo database. This is a slow process, and gets even slower if you have a lot of users in the group, so you can’t expect to have admin rights automatically UNLESS you manually edit the NetInfo database and add the user in yourself.

As far as the SMB issue goes, first make sure that your Windows 2003 servers aren’t requiring signed communications. Then make sure you’re getting the correct TGT from your Domain Controller (use either the kerberos app or klist from the terminal). If you’re not, check the setup of your mit.edu.kerberos file.

[Author]

Posts