MCX settings

[ingenious7]

I am having continuing troubles getting my OS X Leopard computers to take on managed settings from Leopard Server WGM.

At the moment my lab of G5 iMacs running 10.5.2 will take on any settings that I assign to the computer group. They do not need to be binded to the directory for this to happen, but binding still works.

I have numerous labs of Intel iMacs which will not bind to the OD server. They put up a message along the lines of invalid credentials which is not true. If I add them to the computer group without binding them the local accounts will be managed correctly by the server, but any network accounts will not.

To make things more confusing – on the Intel iMac I created an image on, it appeared to be applying the managed settings to network and local users correctly, but since deploying the image this has failed.

The only difference between the computer I created the image on and the G5s, and the Intel labs that aren’t working is that the Intel iMacs have a Windows XP partition and are using Bombich’s BootPicker at OS X startup, but I can’t see how that could affect things.

Is anybody experiencing similar issues? This is driving me insane as I can’t set up the computers correctly with printing, web access, application access and it is messy in my setup to manage these settings on a group or user basis.

[ingenious7]

I have ruled out the problem being related to the BootPicker program.

One other thing to note is that the Intel iMac that I set the image up on was a brand new machine that had not previously been managed by our network. Does Leopard server cache the computers and managed settings somewhere and can I flush these settings out.

[ingenious7]

I have found the solution, and it makes me feel a bit dumb, but at least I have learnt something I guess.

I am not exactly sure on how it works but from what I have read on the matter Leopard server is using Kerberos to do some level of MCX settings on a machine basis. I was using the Kerberos tool as someone mentioned on Apple Discussions to try and fix the problem, when I discovered that the reason it couldn’t do Kerberos correctly was that the time skew was too big. The system clock was out by two days!

We have been overhauling our network and introduced a new ntp server among other things and I had not entered this in on the image I created. As soon as I set the time correctly all managed computers in the lab were working correctly and applying MCX settings in the way I wanted.

I hope that this might help somebody with the same brain power as me!

[Author]

Posts