[tlarkin]

You can use [color=Dark Blue]edquota[/color] and set a soft and hard quota and the soft quota will allow the user to go over the limit to the soft amount but warn them to clear some things off as they are running out of space. As far as I can tell this can only be done from the command line.

[tlarkin]

According to the Apple white pages, my Apple SE, and every other doc I have read, MCX gets updated at log in/out and of course reboot. I have tested this a bit. A while back we had a local admin account that was compromised, and in return many mobile account users promoted them self to admin via system preferences. So, after a bit of fooling with the dscl command I found a way to remove them from the admin group, but to actually see what it did when they promoted them self I did some testing. MCX policy still trumped admin accounts even after log in/out and reboot until the local admin account authenticated, then it trumped MCX.

As far as I can tell, it updates itself in that manner but I am sure there are always tons of environmental factors.

[tlarkin]

you can mount the volume and then use a simple script using the [color=Blue]chflags[/color] command with the -hidden switch to hide it completely from the GUI. You may be able to set something in the image using /etc/fstab for mounting the volume and then using chflags to hide it.

See the chflags man page.

[tlarkin]

Are you assigning unique IDs to each application? If so you will need to drill down into the contents of each application and approve all of the apps with in the app itself. I know garage band is one of them. Which is why I ended up going with folder access over an approved application list, then revoked all write permissions to folders that store applications so users can’t drop anything in there. Then if any application does need write access I create a symbolic link to the file and toss that file into /Users/Shared.

[tlarkin]

I think you are better off using a shell script personally. However, you can take my script and use the [color=Red]do shell script[/color] command in Apple Script if you so desire.

[code]#!/bin/sh
#This script binds a 10.4.11 or 10.5 client to an LDAP (OD) server.

#please input your FQDN after the newserver variable
newserver=”server.domain.com”

#now binding to new server

/usr/sbin/dsconfigldap -a $newserver
/usr/bin/dscl localhost -create /Search SearchPolicy dsAttrTypeStandard:CSPSearchPath
/usr/bin/dscl localhost -merge /Search CSPSearchPath /LDAPv3/$newserver
/usr/bin/dscl localhost -create /Contact SearchPolicy dsAttrTypeStandard:CSPSearchPath
/usr/bin/dscl localhost -merge /Contact CSPSearchPath /LDAPv3/$newserver[/code]

[tlarkin]

You can take a look at my script to bind clients. In my master image the client is bound to the ODM, but we want all building level clients to bind to their specific Replica. So I have a script that removes the ODM and then rebinds to the Replica. It is a post script that runs at first boot after imaging is done.

[url]http://tlarkin.com/tech/shell-script-remove-clients-bindings-old-server-and-then-bind-them-new-directory-server[/url]

To add a computer you should use Work Group Manager. If you want to do it from the command line or script it, check out the [color=Blue]dscl[/color] command.

[tlarkin]

When you guys have these problems do you have any working accounts at all? I will keep this quick but am experiencing some of the same problems.

18 servers in OD, 1 ODM, 6 ODRs T1, 10 ODRs T2, 1 ODM Back up acting as a replica. I have 6,000+ client machines and 90% to 95% can log in. The ones that can’t log in the mobile account will not sync. I have checked ACLs, wiped ACLs and reapplied them, ran batch change ownership/permission scripts, recreated the accounts, redid my share points for home folders, manually made sure I was getting correct Kerberos tickets and would map drives after kerberos authenticated, and probably a lot more.

I have a small hand full of user accounts that just do not work, and other user accounts work fine. I have even reimaged a few machines to rule out software/OS problems on the client side.

I am kind of at my wits end almost with this problem.

[tlarkin]

I will try to answer your questions as best as I can.

[quote]These are my main questions though:
– What would you use 2 4 core xserves at each site for? Wouldnt 1 each be enough?[/quote]

When it comes to servers, if you have the budget just buy the higher spec’d one. It will be more worth it in the long run.

[quote]- How does this work with laptop users. If we were using AD, can we use mobile homes for login cache?[/quote]

I manage a complete 100% OD network. However, how I would do it would be as follows: Use AD for authentication only, and use the OD server for everything else. Keep mobile homes on the OD. We run 5,500 macbooks on my network and we run mobile homes off of the OD. This would require you put more HD space on your Xserves but in the end I think it is better managed that way. You can bind your OD servers to the AD master server so the client can authenticate and get drives mapped via AD, but get group policy and home folders from the OD. This is commonly called the magic or golden triangle. I am sure there is a plethora of articles out there on that subject to help you.

[quote]Network homes and saving seems ok for photoshop and indesign, but how well does it handle Logic or even Final Cut Pro? We are only 100mb switches and 100mb to the desktop, can you keep final cut local and sync to the network on logout?[/quote]

In OS X server under work group manager, you can set the sync preferences to exclude or include certain directories and file types. For example on my network we only sync the documents folder and nothing else.

[Author]

Posts