[tlarkin]

I am not sure of exactly how you can track it down, maybe install little snitch on your client and connect to the adhoc and then watch traffic from point A to point B?

However, the airport daemon has options to set Ad Hoc networks to only be allowed to be created if done so by an admin by running this:
[code]sudo /usr/libexec/airportd en1 -ibss_admin 1[/code]

That is basically a link to the 802.11 frame work found here:
[code]
bash-3.2# /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -help
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport AirPort v.528.1 (528.1.0)
Supported arguments:
-z –disassociate Disassociate from any network
-i[] –ibss=[] Create IBSS
-x –xml Print info as XML
-s[] –scan=[] Perform a wireless broadcast scan.
Will perform a directed scan if the optional is provided
-r –repeats= Repeat the command the specified number of times
-A[] –associate=[] Associate to network.
Will prompt for network name if arg is not specified
and if necessary, for a password if the network is using WEP or WPA.
The following additional arguments may be specified with this command:
–bssid= Specify BSSID to associate with
–password= Specify a WEP key or WPA password
-I –getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-P –psk= Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
–ssid= Specify SSID when creating a PSK
-c[] –channel=[] Set arbitrary channel on the card
-h –help Show this help
[/code]

This will now require all users to input admin credentials to create adhoc networks.

[tlarkin]

I know this may not be the answer you want to hear, but I exclusively use Passenger, which is a third party app that allows you to build your own import files. I wrote a review for it on my website and have used it for the past 4 years in my 1 to 1 laptop deployment.

[url]http://tlarkin.com/tech/passenger-v379-review[/url]

I think a single enterprise user license is around $99 and worth every penny. I have used it for 4 years so I have easily got my $99 worth. I also allows you to chop up usernames (like first initial last name, or first 3 last 3, or whatever) and it will actually check for duplicates and then drop the last letter and add a number.

[tlarkin]

The systemsetup command can force SSH off. Also there is a disabled ssh group that already exists in directory services

[code]
bash-3.2# dscl . list /Groups | grep ssh
_sshd
com.apple.access_ssh-disabled
[/code]

However, I believe ARD Admin uses SSH for authentication so you may not want to turn it off but rather restrict usage to a particular account.

[tlarkin]

If you changed the IP address of your server, you need to use the changeip command to ensure that all DNS records are set up properly.

[tlarkin]

I use the Casper Suite at work, and man it is a Godsend! It can do everything you want, and in fact it’s real limits depends on your knowledge/skills. I accomplish everything I do at work with it. The only down side is that it ruins you as a System’s Administrator and you will never ever want to work with out it.

[tlarkin]

I am on 10.5.8 still, and when a network user logs in and I look at what is mounted under /Volumes I get:

[code]
$ ls -al /Volumes/
total 8
drwxrwxrwt@ 10 root admin 340 Jul 8 13:22 .
drwxrwxr-t 29 root admin 1054 Jun 21 08:37 ..
drwxrwxr-t 23 tlarkin staff 850 Oct 12 2007 Mac OS X Upgrade DVD
lrwxr-xr-x 1 root admin 1 Jul 6 09:51 Macintosh HD -> /
drwxrwxr-x 7 root admin 306 May 5 15:33 data
drwxrwxr-t 49 tlarkin staff 1734 Jul 8 13:19 external
dr-x——+ 24 netadmin staff 772 Jul 8 12:46 homes
dr-x——+ 24 netadmin staff 772 Jul 8 12:46 homes-1
dr-x——+ 24 netadmin staff 772 Jul 8 12:46 homes-2
dr-x——+ 24 netadmin staff 772 Jul 8 12:46 homes-3
[/code]

However, if I try to use any disk quota command line tools they always return disk quotas are not enabled. If I do a df I get this:

[code]
$ df
Filesystem 512-blocks Used Available Capacity Mounted on
/dev/disk0s2 252268720 104042520 147714200 42% /
devfs 223 223 0 100% /dev
/dev/disk0s3 59379120 226216 59152904 1% /Volumes/data
map -hosts 0 0 0 100% /net
map auto_home 0 0 0 100% /home
map -fstab 0 0 0 100% /Network/Servers
afp_4fhNXa0000pe0000oM0000VU-1.2d000008 204800 25608 179192 13% /Volumes/homes
afp_4fhNXa0000pe0000oM0000VU-1.2d000009 204800 25608 179192 13% /Volumes/homes-1
/dev/disk1s3 14911944 14904872 7072 100% /Volumes/Mac OS X Upgrade DVD
afp_4fhNXa0000pe0000oM0000VU-1.2d00000a 204800 25608 179192 13% /Volumes/homes-2
/dev/disk2s2 311909984 191713200 120196784 62% /Volumes/external
afp_4fhNXa0000pe0000oM0000VU-1.2d00000b 204800 25608 179192 13% /Volumes/homes-3
[/code]

When I try to run quotacheck on any of those paths it always returns back quotas are not enabled.

[tlarkin]

That is a tricky question, and I don’t quite have the answer to it. I think we could whip something up, like a log-in-hook which always tells the user how much space they are using, but as for built in tools I have yet to really discover any that work like they are suppose to with the Macintosh platform. Especially when it comes to folder synchronization and portable home directories.

So, if you wanted to whip up some script or something maybe I could point you in the right direction.

[tlarkin]

I saw this at my old job but it was with eDirectory and not AD. The problem we had was at log out, it was not unmounting all the shares from the previous user. So the next user could not log in because the share was mounted under that previous user I believe. That was a long time ago though, the 10.4 days. A restart would unmount everything, so that is why I am guessing that.

[tlarkin]

[QUOTE][u]Quote by: skeates[/u][p]From what I can figure the quota set in server admin applied to a share point applies to the share point and not the user folders on the share point (I may be wrong). So what I see is that applying a 2gb limit to the share would give all the users 2gb of space to share instead of giving each user 2gb of data storage. Again I may be wrong about this.

From what I have read setting the quota’s in WGM only applies to non PHD users.[/p][/QUOTE]

You must enable disk quotas on the share point for them to be honored. You can also use disk quotas for PHDs. I have tons of protable users (I work in a 1:1) and they all get the correct limit. Now, if you want to enable soft quotas that is a bit rough around the edges and I believe requires command line work in 10.5.x. We have not migrated to 10.6 yet at my work.

When I import users into OD, I set up a test user exactly how I want it. give them the disk quota I want in WGM under the home folder tab, and then create the user and test it. If it works out how I want it, I save that user as a template user. Then I import my list of users off that template and their quota gets applied.

The only problem with a PHD is, say you need to delete that account out of LDAP for whatever reason, and then recreate it. That new account will have a new UID and that new UID will not match the old one and that account is no longer managed. I had some account corruption once and had to delete some accounts that were already synchronized to the client machines. So, those machines no longer were really managed and I had to get the users to come see me so I could migrate their local data to their new UID mobile account.

[tlarkin]

The disk quotas are set up in Server Admin by selecting the share point and enabling quotas. The actual quota limit is set either by user, group, or computer list policy in WGM. As for synchronizing specific folders, you can do that in group policy as well. In the mobility section you can set what file paths to skip and what file paths to sync. I ignore every folder in my users home directory except for ~/Documents, and I also set the Microsoft data in ~/Documents to be skipped as well.

I used to run search and destroy scripts that would scan the server shares with the find command and delete anything that was music or video related by file extension. However, now I just make users delete that stuff or move it out of their ~/Documents folder and tell them to only keep their important work in ~/Documents and nothing else.

[tlarkin]

Also a copy of Passenger can go a long way. You can dump the users into a plain text file, then use Passenger to build import lists and set a range of UIDs so you don’t conflict with current UIDs.

[tlarkin]

I assume you know the user’s short name? A simple send Unix command over ARD Admin should suffice. Run it as root.

[code]

dscl . passwd /Users/localadmin the_new_password
[/code]

[tlarkin]

[QUOTE][u]Quote by: macshome[/u][p]To change the name of a computer I wouldn’t just do it in WGM. I would unbind and then rebind it with the new name…[/p][/QUOTE]

I agree, I would unbind and then rebind and use the [i]-force[/i] switch in the command to bind to force a new entry. Then it should update the record in WGM. I have a certain number of machines in my deployment that I want to disallow any network accounts to log in and only use local accounts. To do so I bind the computer (via authenticated bind script) to OD and when I do so, it updates the computer records in WGM.

example:
[code]
#!/bin/bash

# set this script to bind sumner iMac desktops

# set the FQDN of server for client to bind

server=”FQDN.myserver.com”

# start script

/bin/echo “Starting script..”

# bind to ODR Sumner

/usr/sbin/dsconfigldap -f -v -e -a $server -u diradmin -p mypassword -c `/usr/sbin/networksetup -getcomputername` -l localadmin_acct -q localadmin_passwd

/bin/sleep 40 #give it time to authenticated bind before proceeding

/usr/bin/dscl localhost -create /Search SearchPolicy dsAttrTypeStandard:CSPSearchPath

/usr/bin/dscl localhost -merge /Search CSPSearchPath /LDAPv3/$server

/usr/bin/dscl localhost -create /Contact SearchPolicy dsAttrTypeStandard:CSPSearchPath

/usr/bin/dscl localhost -merge /Contact CSPSearchPath /LDAPv3/$server

/bin/echo “completed process of autehnticated bind..”

/bin/echo “now purging all logs to clean up what we just did…”

/bin/rm -rf /var/logs/*

/bin/echo “logs purged now exiting…”

exit 0[/code]

I have this run via Casper policy or post image, or have one of my fellow techs run it manually say off a thumb drive if need be. It does contain passwords so I remove all the log files after it runs. The -f switch should force the computer to add to OD even if the record exists, which should over write the existing record. So, unbind your client, rename it, then run the script and it should update the records in OD.

[tlarkin]

if you go into dscl interactive mode do they show up?

[code]
sudo dscl (this will put you in interactive mode)

cd /LDAPv3/mycompany.com/Groups

ls
[/code]

You should see a listing of all groups.

[tlarkin]

Marko-

I think the best solution for you would be to add a log in hook script to those macbooks so when the students log in to their network homes they get synced locally via portable home directories. You can do this with a simple script, if you set it as log in. You would only want it to run once. There is an executable in the CoreServices folder that can do this.

Here is the manual page for it:
[code]
bash-3.2# ./createmobileaccount -help
createmobileaccount built Jul 7 2009 17:17:01
*** error: “-n username” is a required argument

usage: createmobileaccount -n username [-h homepath] [-P | [-p password]] [-e] [-q] [[-x] | [-X]] [[-s] | [-S]] [-u syncURL] [-v]
-n username : user record name
-h homepath : user home path; Default is “/Users/”
-p password : user password
-P : prompt for password. A password is required for FileVault home
-e encrypt : encrypt new home with FileVault
-q quota : max size in bytes of FileVault home
-x : create as external account on non-boot volumes. Default
-X : create as mobile account account non-boot volumes.
-s : set home sync on if home created.
-S : set home sync off if home created. Default.
-u syncURL : server target of home synchronization
-v : verbose output

Examples:
createmobileaccount -n jsmith
createmobileaccount -v -P -x -n jsmith
createmobileaccount -vsdn jsmith -h /Volumes/HD3/jhome
createmobileaccount -i

Notes:
– createmobileaccount must run as root.
– If you do not specify a password, the account’s cached password will be created during the account’s first log in.
[/code]

So, a hypothetical possible shell script to do this, may look something like this:

[code]
#!/bin/bash

# grab the currently logged in user by checking to see who owns the /dev/console

CurrentUser=`/bin/ls -l /dev/console | /usr/bin/awk ‘{ print $3 }’`

# now create the mobile account

/System/Library/CoreServices/createmobileaccount -S -n $CurrentUser -h /Users/$CurrentUser

exit 0
[/code]

That would create a mobile account and set synchronization off after it is created, so all the credentials should be cached locally. See [url]https://www.afp548.com/article.php?story=20090415155232756[/url] article for more deatils

[Author]

Posts