OS X Mavericks and Active Directory Home drive problems (NHR)

So, I'm going to document what problems I currently have with Active Directory home drives stored on windows SMB shares.

In the past when we put our macs on the active directory logins, I always untick the "Force local home" in the active directory options. The main reason is so that users take with them all of their account settings and preferences where-ever they login. This does however come with problems. It seems the mounted home drive has some permission issues which some applications have real problems with.

In the past I have installed Network Home Redirection (NHR). At login, this script runs whenever it detects the user to be a network user. It then creates a local temporary folder and creates alias' from particular folders on your home drive to the local folder. From the perspective of an application running, it thinks that these folders are normal local folders which they tend to prefer.

The default NHR setup redirects folders of known problems in OS X 10.6. But I don't think it is updated anymore. I have been constantly adding and taking away folder re-directions for the application we use in the computer suites.

Here I shall document current problems with network home preferences where NHR has worked.

Adobe Acrobat Pro 9
Seems to Crash when opening a document
Redirected folder: ~/Library/Application\ Support/Adobe/Acrobat
Seems to have fixed the crash

OS X Mavericks AD failed to login because an error occurred

After updating to Mavericks 10.9.1 I seem to be having problems logging in under active directory.

Found this post which describes similar issues.

Seems my problem is now fixed. Not sure what caused it or fixed it though.

Problems with Administrator login for 10.7 imaged macs

In the computer suites with 10.7 image machines I'm having a problem with the administrator account. When I login as the local administrator UID 501 I have no access to any of this users home folders, inluding the ~/Library folder. Having a look at the permissions shows that administrator is the owner with read-write permissions. Typing in the command:
sudo chown -R $USER ~$USER

Comes up with:
Folder does not exist

but typing in:
sudo chown -R $USER ~/Users/administrator


Administrators-iMac-49:~ administrator$ id -u $USER
501
Administrators-iMac-49:~ administrator$ ls -Al
total 64
-rw-------   1 administrator  staff      3  5 Jul  2012 .CFUserTextEncoding
-rw-r--r--@  1 administrator  staff  12292 10 Jul  2012 .DS_Store
drwxr-xr-x   4 administrator  staff    136  6 Jul  2012 .adobe
-rw-------   1 administrator  staff   3357 12 Jul  2012 .bash_history
-rwxrwxrwx@  1 administrator  staff     30  6 Jul  2012 .fgufohsrc
-rw-r--r--@  1 administrator  staff     17  6 Jul  2012 .sewtzsfn
drwxr-xr-x   2 administrator  staff     68  6 Jul  2012 Applications
drwx------+  5 administrator  staff    170 15 Oct 15:40 Desktop
drwx------+  7 administrator  staff    238  9 Jul  2012 Documents
drwx------+  6 administrator  staff    204 10 Jul  2012 Downloads
drwx------+ 39 administrator  staff   1326  9 Jul  2012 Library
drwx------+  3 administrator  staff    102  5 Jul  2012 Movies
drwx------+  4 administrator  staff    136  9 Jul  2012 Music
drwx------+  5 administrator  staff    170  6 Jul  2012 Pictures
drwxr-xr-x+  5 administrator  staff    170  5 Jul  2012 Public
lrwxr-xr-x   1 administrator  staff     63 12 Jul  2012 Send Registration -> /Users/administrator/Library/Assistants/Send Registration.setup
Administrators-iMac-49:~ administrator$ sudo chown -R $USER ~
Password:
Administrators-iMac-49:~ administrator$ ls -Al
total 64
-rw-------   1 administrator  staff      3  5 Jul  2012 .CFUserTextEncoding
-rw-r--r--@  1 administrator  staff  12292 10 Jul  2012 .DS_Store
drwxr-xr-x   4 administrator  staff    136  6 Jul  2012 .adobe
-rw-------   1 administrator  staff   3357 12 Jul  2012 .bash_history
-rwxrwxrwx@  1 administrator  staff     30  6 Jul  2012 .fgufohsrc
-rw-r--r--@  1 administrator  staff     17  6 Jul  2012 .sewtzsfn
drwxr-xr-x   2 administrator  staff     68  6 Jul  2012 Applications
drwx------+  5 administrator  staff    170 15 Oct 15:40 Desktop
drwx------+  7 administrator  staff    238  9 Jul  2012 Documents
drwx------+  6 administrator  staff    204 10 Jul  2012 Downloads
drwx------@ 39 administrator  staff   1326  9 Jul  2012 Library
drwx------+  3 administrator  staff    102  5 Jul  2012 Movies
drwx------+  4 administrator  staff    136  9 Jul  2012 Music
drwx------+  5 administrator  staff    170  6 Jul  2012 Pictures
drwxr-xr-x+  5 administrator  staff    170  5 Jul  2012 Public
lrwxr-xr-x   1 administrator  staff     63 12 Jul  2012 Send Registration -> /Users/administrator/Library/Assistants/Send Registration.setup


fixes the problem. Logging out and back in again randomly recreates the problem. It's as though there are two administrators with different UID's and it's random which one it logs in with. There is the possibility that there is a networked account. Next I shall switch off networked accounts and log in.

Just used the ls command which lists the UID instead of username:
ls -n
total 8
drwxr-xr-x   2 1414341556  20    68  6 Jul  2012 Applications
drwx------+  5 1414341556  20   170 15 Oct 15:40 Desktop
drwx------+  7 1414341556  20   238  9 Jul  2012 Documents
drwx------+  6 1414341556  20   204 10 Jul  2012 Downloads
drwx------+ 39 1414341556  20  1326  9 Jul  2012 Library
drwx------+  3 1414341556  20   102  5 Jul  2012 Movies
drwx------+  4 1414341556  20   136  9 Jul  2012 Music
drwx------+  5 1414341556  20   170  6 Jul  2012 Pictures
drwxr-xr-x+  5 1414341556  20   170  5 Jul  2012 Public
lrwxr-xr-x   1 1414341556  20    63 12 Jul  2012 Send Registration -> /Users/administrator/Library/Assistants/Send Registration.setup
Administrators-iMac-75:~ administrator$

Sorted, it simply thinks that there is an administrator account with UID 1414341556


Administrators-iMac-75:~ administrator$ id -u $USER
501
Administrators-iMac-75:~ administrator$

I have now run the command:
chown -R 501 /Users/administrator

I have yet to find a re-occurrence.

------------------- march 2014

well, I found a re-occurrence. I ended up renaming the administrator account to:

administratorb

Cheers

Deleting 'forced' local home folders created from OS X 10.7 Active Directory Logins

When users log in to the apple macs at the college it creates a local home on the machine to save preferences and files, and mounts their home drive too.

After a year these fill up. After a few searches and researches, looks like the easiest way is to write a script which deletes all folders except certain ones. Looks like you can use the 'find' command. Found a good example here:

find . -maxdepth 1 -not -name 'filename.gif' -iname '*.gif' -delete

Here's the man page for find

So, I don't want to delete the folders:
Guest
Shared
administrator
media

So:

find . -maxdepth 1 -not -name 'Guest' -not -name 'Shared' -not -name 'administrator' -not -name 'media' -name '*' -delete

I tried '*.*' but it only then deletes files with '.' in them, not folders. '*' selects everything including folders

Actually, I found here that the slightly better way to do it was to use the -exec rm instead of -delete. This then tells you which directories were actually deleted:

find /Users/Shared -maxdepth 1 -mindepth 1 -not -name 'administrator' -not -name 'Guest' -not -name 'Shared' -not -name 'media' -exec rm -Rvf {} \;

The -mindepth 1 option makes sure it doesn't delete the parent directory.

A longer term solution would be to delete these folders on logout, so the students and staff could get used to not relying on these folders.

Social networking sites and joomla

Just looking into enabling login via other site logins. i.e. facebook, google etc.

Found quite a few in the joomla extensions.

The best one I think I've found is LoginRadius Social Login. It's got a nice tutorial on how to install. Only problem is that you make an account through them, so they sort of act as the middle men.

I shall add to this once I've done a bit more research and tried it out.

For complete site jomsocial looks good

also joomlapolis.

Facilitates member interaction.


Just reading this article on creating a social network and it recommends SocialEngine.

sendLogon.app and installer

Well, after much troubles over getting NHR to also run sendLogon on startup, I decided to just make an application which ran the sendLogon script:

/usr/bin/sendLogon 145.xxx.xxx.xxx 5438 $(logname)

1. I simply made it in Automator:
1. 
2. Next I made an installation package to install it along with the sendLogon command program

I used Apple Remote Desktop's "Task Server" to install it on all managed machines. And finally I used Workgroup Manager to have it as a Login Item on the managed machines.

I think it works out better this way, as there is a little bit more control over it.

Current NHR LIclean.hook

So, after a few years of using NHR I've had to add a few more exceptions. Instead of writing them down I thought I'd might as well just paste the LIclean.hook file here:



#!/bin/sh
#set -xv; exec 1>>/tmp/out 2>&1
PATH=/bin:/usr/bin:/usr/sbin export PATH



#The line above is used for logging and troubleshooting only - if you need to troubleshoot this script, remove the "#" from the line.  Once you are done, put the "#" back at the beginning of the line.
logger "LoginHook: Starting for $1"

#Update on June 27, 2006 - added support for 10.3 clients and other improvements
#Update on July 10, 2006 - added feature so that all local users will bypass redirection.
#Update on October 18, 2006 - added $1 directory in /tmp for better folder structure.
#Update on July 13, 2007 - added Leopard compatibility
#Update on July 19, 2007 - added line to delete Clip Gallery Preferences, if they have not already been removed from the local admin's account.
#Update on April 28, 2008 - took out iHook application, as some users didn't like seeing the iHook window during login.
#Update on August 20, 2008 - due to ACL's put on user home folders starting with 10.5.4, this will now remove the ACL so that redirection can still take place on the folders with Deny Delete ACL's.
#Update on September 3, 2008 - added Office 2008 support
#Update on September 17, 2008 - deleted EOF commands, as it was causing issues with some PPC machines.
#Update on October 5, 2008 - added support for SMART board software, as they store caches in ~/Library/Application Support
#Update on March 5, 2009 - fixed issue with finding local users that matched part of the username (added -x to grep)
#Update on March 11, 2009 - added support for Adobe Acrobat 9
#Update on April 17, 2009 - added support for Adobe CS4
#Update on August 17, 2009 - added support for iMovie 09 with network homes
#Update on September 23, 2009 - added support for users with "." in their shortnames (thanks to Ben Gollmer for this addition)

LocalAdminUser=`dscl . -list /Users uid |grep 501 |awk '{print$1}'`
Local=`dscl . -list /Users |grep -x $1`

#This script will re-direct several folders from a user's network home location to the local machine to help with performance.

if [[ "$1" == "$Local" ]]; then
        exit 0
fi

eval home_loc=~$1

#This section will verify that there are no DENY DELETE ACL's on the folders - and if so, remove the ACL so that redirection can still take place.

aclline=`ls -led "$home_loc"/Library/Caches | grep "deny delete" | head -1 | awk -F: '{print $1}' | sed 's/^[ \t]*//'`
chmod -a# $aclline "$home_loc"/Library/Caches

aclline=`ls -led "$home_loc"/Library/Fonts | grep "deny delete" | head -1 | awk -F: '{print $1}' | sed 's/^[ \t]*//'`
chmod -a# $aclline "$home_loc"/Library/Fonts

aclline=`ls -led "$home_loc"/Library/Application\ Support/SMART\ Technologies\ Inc/Gallery | grep "deny delete" | head -1 | awk -F: '{print $1}' | sed 's/^[ \t]*//'`
chmod -a# $aclline "$home_loc"/Library/Application\ Support/SMART\ Technologies\ Inc/Gallery

#This section will delete the Fonts, Microsoft User Data, AppleWorks User Data, SMART Board Gallery folder and Microsoft Preferences folders from the current user's network home location
rm -rf "$home_loc"/Library/Caches
rm -rf "$home_loc"/Library/Fonts
rm -rf "$home_loc"/Documents/Microsoft\ User\ Data
rm -rf "$home_loc"/Documents/AppleWorks\ User\ Data
rm -rf "$home_loc"/Library/Preferences/Microsoft
rm -rf "$home_loc"/Library/Application\ Support/Microsoft/Office
rm -rf "$home_loc"/Library/Application\ Support/SMART\ Technologies\ Inc/Gallery
rm -rf "$home_loc"/Library/Application\ Support/Adobe
rm -rf "$home_loc"/Library/Application\ Support/Google

#This section will clean up the local drive, so that iMovie 09 will work with network homes
rm -rf /iMovie\ Events
rm -rf /iMovie\ Projects

#This section will make a folder for the current user in /tmp
mkdir /tmp/$1/
mkdir /tmp/$1/Adobe
#mkdir /tmp/$1/Adobe/Acrobat
#mkdir /tmp/$1/Adobe/Illustrator\ CS4
mkdir /tmp/$1/Google

#This will copy several Microsoft folders of the local admin user (make sure this account was the first account set up on the client - with UID 501) to /tmp.
cp -R /Users/$LocalAdminUser/Library/Preferences/Microsoft /tmp/$1/Microsoft/
rm -f "/tmp/$1/Microsoft/Clip Gallery Preferences"
cp -R /Users/$LocalAdminUser/Library/Application\ Support/Microsoft/Office /tmp/$1/Office2008
cp -R /Users/$LocalAdminUser/Documents/Microsoft\ User\ Data /tmp/$1/Microsoft\ User\ Data/

#This will create the iMovie 09 folders needed to work with network homes
mkdir "$home_loc"/Movies/iMovie\ Events
mkdir "$home_loc"/Movies/iMovie\ Projects

#This will create an AppleWorks User Data folder in /tmp.
mkdir /tmp/$1/Appleworks

#This will create the user's Caches folder in /tmp.
mkdir /tmp/$1/Caches

#This will check for the Notebook application (SMART) and create a SMART folder in /tmp (if needed).
SMART=`test -e /Applications/Notebook\ Software/Notebook.app && echo Yes`

if [[ "$SMART" == "Yes" ]]; then
mkdir /tmp/$1/SMART
mkdir -p "$home_loc"/Library/Application\ Support/SMART\ Technologies\ Inc/
fi

#This will change ownership of all files in /tmp/$1 to the current user
chown -R `dscl /Search -read /Users/$1 UniqueID | awk '{print $2}'` /tmp/$1

#This will create the Microsoft and Adobe folders, inside the Application Support folder, for the user.
mkdir "$home_loc"/Library/Application\ Support/Microsoft
#mkdir "$home_loc"/Library/Application\ Support/Adobe

#This last section will set up symbolic links for the current user.
ln -s /tmp/$1/Caches/ "$home_loc"/Library/Caches
ln -s /Library/Fonts/ "$home_loc"/Library/Fonts
ln -s /tmp/$1/Appleworks "$home_loc"/Documents/AppleWorks\ User\ Data
ln -s /tmp/$1/Microsoft/ "$home_loc"/Library/Preferences/Microsoft
ln -s /tmp/$1/Microsoft\ User\ Data/ "$home_loc"/Documents/Microsoft\ User\ Data
ln -s /tmp/$1/Office2008/ "$home_loc"/Library/Application\ Support/Microsoft/Office
ln -s /tmp/$1/SMART/ "$home_loc"/Library/Application\ Support/SMART\ Technologies\ Inc/Gallery
#ln -s /tmp/$1/Adobe/Acrobat/ "$home_loc"/Library/Application\ Support/Adobe/Acrobat
#ln -s /tmp/$1/Adobe/Illustrator\ CS4/ "$home_loc"/Library/Application\ Support/Adobe/Illustrator\ CS4
ln -s /tmp/$1/Adobe/ "$home_loc"/Library/Application\ Support/Adobe
ln -s "$home_loc"/Movies/iMovie\ Events /iMovie\ Events
ln -s "$home_loc"/Movies/iMovie\ Projects /iMovie\ Projects
ln -s /tmp/$1/Google "$home_loc"/Library/Application\ Support/

logger - "LoginHook:  Finished for $1"

#sendLogon extras (IP address and Port number has been taken out)

/usr/bin/sendLogon 123.456.32.1 1234 $1
/usr/bin/sendLogon 123.456.32.2 1234 $1
/usr/bin/sendLogon 123.456.32.3 1234 $1

I've commented out a few lines so I could see what I've done in the past.


Addition:

so, I've now found that Adobe Bridge has trouble opening. After some investigation it looks like Bridge 4 (CS5) doesn't like symbolic links, but prefers to use the networked folder.

After looking into all the Adobe Applications, the only one now which needs the symbolic link is Adobe Acrobat Pro. So I'm re-writing this script to create a symbolic link from ~/Library/Application Support/Adobe/Acrobat a the local folder.

I'm also getting rid of the Adobe symbolic link so that bridge works.



Addition (08/11/2012)

A few months on and I soon realised that although Illustrator is behaving much better then it did do in the past, I found that if it did not have a symbolic link to the local drive it would have trouble saving and exporting files to the desktop, making it appear that the files were saved, when in fact they had 0kb! This caused a bit of trouble with students at the time, and backups had to be retrieved.

I then added a symlink with ~/Library/Application Support/Adobe/Adobe Illustrator CS5.

I also realised that if it was a new student which didn't have an Application Support folder, NHR would be unable to create an Adobe folder inside this. I hence added a few lines to make the folders:
~/Library/
~/Library/Application Support/
~/Library/Application Support/Adobe/

Joomla pop-up logins

I think it's all the rage now-a-days to have fancy pop-up login screens. It means it doesn't take up any 'real-estate' on the home page.

Here's a few free plugins for Joomla which can do it:

• Q Login Popup
• requires registration to download
• as it took a while to get the validation
• adds itself as a module
• you just have to "publish" it and put it in a position
• also, put you want it to appear on all pages
• colour didn't match, so I re-did the button. Placed it in 
• /modules/mod_qloginpopup/images/login.png
• YJ Pop Login
• downloaded without registration
• it adds a module
• you just have to "publish" it and put it in a position
• also, put you want it to appear on all pages
• It just showed all of it (not just the button). Javascript must have a conflict somewhere

sendLogon and NHR for OS X 10.7

So, I'm just setting up some new machines with OS X 10.7.4 installed. I tried to install the NHR and sendlogon scripts which I implemented here, but looking into it, it doesn't seem to work.

The NHR side which redirects folders from the networked home drive to a local folder works beautifully, but when I browse the internet, it doesn't let me on sites which i am authorised to go on? So, to conclude, the LIsendLogon.hook isn't running properly.

The one thing I wanted to happen was to get the loginhook to run a script which in turn ran a sendLogon script and the NHR script. But it was an 'either/or' situation. I could never have both scripts running no mater how hard I tried.

After trying many different things, I ended by just giving up and putting the lines for sendLogon into the LIclean.hook script at the bottom. Very frustrating.

I did find an interesting and useful article on running a centralised login script here.

I also found a nice little course on the subject of scripting which I found very useful here and another here

OS X 10.7 and 10.8 and 802.1X wifi configuration

So, new operating system new things to do. Just read the Help Center bit on "Connect to a network that requires 802.1X authentication". The interesting bit was:

In most cases your network administrator provides a configuration profile that contains the information and settings you need to authenticate with the network.

To get on the 802.1X you now need to do a lot of stuff. Looks like it needs a .mobileconfig file.

Just read this Apple Discussion on it which gives you a nice guide on how to do it.

After much time we finally got around to having a network administrator on the case.

So, we were looking for a way to connect to the wifi without using usernames and passwords. The answer was EAP-TLS. We followed the link above and created a certificate for the computer. Only trouble was we had problems enabling TLS on the wifi. Network administrator looking into this I think.

We resorted to PEAP I think. We made a .mobileconfig file using the iphone configuration utility, got hold of the wifi certificate, put that in the credentials payload of the .mobileconfig file, and loaded it up on the machine in question. It added the certificate to the Users keychain (not system!) and put the old 802.1X stuff in the network settings! When we turned the wifi on it tried to connect to the wifi (with the username and password we set in the .mobileconfig file) but it came up with an error. Could not verify the server. Looks like the configuration file was at fault. Seems that the certificate server is automatically dishing out expired certificates. Network administrator is trying to fix.

A handy page to manually create a .mobileconfig file with more settings then the iphone configuration utility can create was here. You can specify the certificate to be added to the system keychain, and also that the wifi loads at login window!


------

So far so good. Our network team has now made a new wifi SSID with EAP-TLS. Using this tutorial we made the machine have a signed certificate from the certificate server, and add the profile for the wifi. We used this certificate (with the username - host/DNSnameofMachineHere) to successfully get onto the wifi, but did it manually.

Next time we'll need to set this file up with the wifi details properly (we didn't add system login window stuff here).


-----

We're now giving up on the old 'manually edit the .mobileconfig file' and going for the 'Mavericks Server' option.

Here's the help page on it

So, we've set up a mavericks server (just a computer with Mavericks installed and the "Server" app installed).

I've enabled "Profile Manager" and set it up so in a browser you can go to:
http://YourMavericksServer.ac.uk/profilemanager

go to groups, general.
from the list of payloads, go to AD Certificate

found this article on how to configure the page

Not quite working yet. Getting an error when installing the profile.

Need to add devices, but I think it looks like you have to add users which are in charge of devices? Not sure.

Number Lock (numlock) at login screen in Windows XP

After re-imaging a MacBook Pro with Windows XP, I noticed (annoyingly) that the num lock was always switched on upon boot up at the login screen! After googling it I found this post, which describes how to change it on startup in the registry. Simply change:


HKEY_CURRENT_USER\Control Panel\Keyboard\InitialKeyboardIndicators=3
to
HKEY_CURRENT_USER\Control Panel\Keyboard\InitialKeyboardIndicators=1


This turns num lock off. Unfortunately, I think this just applies to whoever's logged in at the time, and doesn't apply to the login screen. Simple enough though, and is described at the bottom of the post in a reply (although for some reason he used some weird code - "2147483650" (string value)). I did this:


HKEY_USERS\.Default\Control Panel\Keyboard\InitialKeyboardIndicators=1


and it worked.

OS X multiple login scripts - sendlogon and NHR

So, after having NHR running for quite a while, it looks like we also need to have sendlogon running at login. This isn't the first time I've had to have multiple login scripts. I remember doing this for BootPicker back when it wasn't included in the operating system.

So to do this I will use the system already in place thanks to NHR. At the moment, at login, the file /etc/login.hook runs. This runs any scripts within the /etc/hooks folder which begin with "Li". The same thing happens for logout but with any files beginning with "Lo". So, all I have to do is to rename the "login.sh" script something like "Lisendlogon.hook" and it will run at login.

Now, this "lisendlogon.hook" script simply contains the command to run the "sendlogon" program plus the right syntax to put after it. i.e. the server and the current users credentials. This is how it looks:

#!/bin/tcsh

/usr/bin/sendLogon dns.name.of.server.com 3898 $1

The sendLogon is in the /usr/bin folder, as this is where their tutorial says it should be.


After testing this, I need to make an install pkg file to run from the task server. I like using IceBerg.


So, here's some screenshots from it:

Iceberg - fix NHR and sendlogon settings page

postflight installation scripts.

writeloginhook.sh contains:

#!/bin/tcsh

sudo defaults write com.apple.loginwindow LoginHook /etc/login.hook

which tells the operating system to run /etc/login.hook at login. 

iceberg - files section. Later found the default destination needs to be "/"

I got slightly confused as to which folder to make the default destination?

I'll test it out on a computer suite machine to see if it works.

After a little testing, it looks like it didn't put sendLogon into /usr/bin! After trying a few things it turns out it was down to the "Default Destination". After setting this as "/" it worked. It looks like this is basically the folder which all installation folders have in common.

Iceberg - files section with the correct "default destination" as the lowest common folder.

Tested and works fine.

Cheers

Canon LiDE 60 on OS X 10.6.6 and Active Directory probs

So, after installing the scanner (heres the notes) I then thought all would be fine. It turns out that students logging in through active directory would not be able to scan. It would not provide a preview of what was in the scanner, nor would it let you press the scan button.

On looking in the logs I found this entry:
28/03/2012 12:56:47 /System/Library/CoreServices/coreservicesd[48] removing dropped transaction for -114,_mac_bind/Library/Preferences/CanoScan LiDE 60/~SGCheck.tmp

It appears the program cannot gain the right access privilages to this folder, as it is on a Windows SMB share (I think) through active directory.

On trying to create an alias to this using OS X finder I saw this error:
28/03/2012 13:02:29 kernel smb_maperr32: no direct map for 32 bit server error (0xc0000279)

As I have NHR installed, which redirects certain folders, I thought I'd try and redirect this /Library/Preferences/CanoScan LiDE 60/ folder.

After redirecting it to the local drive, I found it still not working. I found another error:

3/28/12 1:07:52 PM /System/Library/Image Capture/Devices/TWAINBridge.app/Contents/MacOS/TWAINBridge[4423] Allocator race detected: transaction is not verified for -114/2 - _mac_bind/Library/Preferences/~SGCheck.tmp
3/28/12 1:07:55 PM /System/Library/CoreServices/coreservicesd[48] removing dropped transaction for -114,_mac_bind/Library/Preferences/~SGCheck.tmp
3/28/12 1:07:59 PM /System/Library/CoreServices/coreservicesd[48] removing dropped transaction for -114,_mac_bind/Library/Preferences/~SGCheck.tmp
3/28/12 1:07:59 PM /System/Library/CoreServices/coreservicesd[48] removing dropped transaction for -114,_mac_bind/Library/Preferences/~SGRot.tmp

It looks like it needs to write two files to the ~/Library/Preferences folder:
~SGCheck.tmp
~SGRot.tmp

I regigged the LIclean.hook to delete the Preferences folder, create it in the tmp folder on the local drive, and to create a symlink in the users Library folder.

Having done this, it worked like a dream. I would preferably have it so that it just had a symlink to these files it needs, but they are probably deleted as soon as they're not needed any more, and that would be the end of the symlink until the next login.

Anyway, for reference, here are the lines I added to the LIclean.hook file:
rm -rf "$home_loc"/Library/Preferences
mkdir /tmp/$1/Preferences
ln -s /tmp/$1/Preferences/ "$home_loc"/Library/Preferences


Thinking about it I'll also need to sort the LOcleanupclean.hook file. Here's what I need to add:
rm -rf "$home_loc"/Library/Preferences

Thats a good days work.

Mac OS X 10.6.6 Active Directory Login issues

A while after updating all the Apple Suites to 10.6.6 I started getting a few Apple Macs which would not let anybody log in. I had a look at the system log and found this:


07/03/2012 15:44:22    kernel    Ethernet [AppleBCM5701Ethernet]: Link up on en0, 100-Megabit, Full-duplex, No flow-control, Debug [796d,0300,0de1,0300,41e1,0000]
07/03/2012 15:44:25    configd[13]    setting hostname to "n240-11904.local"
07/03/2012 15:44:25    configd[13]    network configuration changed.
07/03/2012 15:44:26    configd[13]    network configuration changed.
07/03/2012 15:44:26    configd[13]    setting hostname to "n240-11904.ictservicestest.somewhere.ac.uk"
07/03/2012 15:44:27    com.apple.DirectoryServices[15]    Enter machine password:
07/03/2012 15:44:28    com.apple.DirectoryServices[15]    [2012/03/07 15:44:28, 0, pid=466] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:28    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:28    com.apple.DirectoryServices[15]    [2012/03/07 15:44:28, 0, pid=466] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:28    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:29    mDNSResponder[31]    RegisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:CA2A:14FF:FE0B:B63D)
07/03/2012 15:44:33    com.apple.DirectoryServices[15]    Enter machine password:
07/03/2012 15:44:33    com.apple.DirectoryServices[15]    [2012/03/07 15:44:33, 0, pid=474] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:33    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:33    com.apple.DirectoryServices[15]    [2012/03/07 15:44:33, 0, pid=474] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:33    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:33    com.apple.DirectoryServices[15]    Enter machine password:
07/03/2012 15:44:33    DirectoryService[15]    Failed to changed computer password in Active Directory domain students.somewhere.ac.uk
07/03/2012 15:44:33    com.apple.DirectoryServices[15]    [2012/03/07 15:44:33, 0, pid=479] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:33    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:34    com.apple.DirectoryServices[15]    [2012/03/07 15:44:34, 0, pid=479] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:34    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:34    com.apple.DirectoryServices[15]    Enter machine password:
07/03/2012 15:44:34    com.apple.DirectoryServices[15]    [2012/03/07 15:44:34, 0, pid=484] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:34    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:34    com.apple.DirectoryServices[15]    [2012/03/07 15:44:34, 0, pid=484] /SourceCache/samba/samba-235.5/samba/source/libads/kerberos.c:ads_kinit_password(228)
07/03/2012 15:44:34    com.apple.DirectoryServices[15]      kerberos_kinit_password N240-11904$@STUDENTS.somewhere.AC.UK failed: Preauthentication failed
07/03/2012 15:44:36    ntpd[20]    time reset +0.717779 s
07/03/2012 15:45:01    /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer[91]    CGSKeyTranslateInitialize: KLGetCurrentKeyboardLayout or KLGetKeyboardLayoutProperty is not available, fall back to USA keymap
07/03/2012 15:45:09    SecurityAgent[96]    Could not get the user record for '_mac_bind' from Directory Services
07/03/2012 15:45:09    SecurityAgent[96]    User info context values set for _mac_bind
07/03/2012 15:45:09    SecurityAgent[96]    unknown-user (_mac_bind) login attempt PASSED for auditing
07/03/2012 15:45:13    SecurityAgent[96]    Could not get the user record for '_mac_bind' from Directory Services
07/03/2012 15:45:13    SecurityAgent[96]    User info context values set for _mac_bind
07/03/2012 15:45:13    SecurityAgent[96]    unknown-user (_mac_bind) login attempt PASSED for auditing


This is what happened after I woke the machine up and then tried to log in as a user called "_mac_bind". It happens with any Active Directory user.

After trying all the standard things:

1. reset PR-RAM
2. /sbin/fsck -yf
3. unbind and bind again

I finally resorted to re-imaging, which actually fixed the problem, although I am not sure why.

I came back to the problem after finding it happen quite a few times and tried binding it to Active Directory with a different name (although I had my doubts). This fixed the problem.

I conclude to say that there must have been a problem on the server side. Perhaps the mac had been placed in the wrong list. My next thing to try would be to delete any instance of it on the servers and try binding it under it's old name.

After this, I would either assume someone had done something to the instance on the server, or the server had not liked the machine at one point and disallowed it.

.......

Well, I've come back to this some time later. It appears one of the Staff iMacs is now exhibiting the same behavour, but changing its Active Directory bound name does not fix it this time. So, before I re-image hopefully the Network Administrator can have a look. Here's the log for the one exhibiting this behavour:

13/03/2012 09:36:28 SecurityAgent[95] Showing Login Window

13/03/2012 09:36:28 kernel Ethernet [AppleBCM5701Ethernet]: Link up on en0, 100-Megabit, Full-duplex, No flow-control, Debug [796d,2300,0de1,0300,41e1,0000]

13/03/2012 09:36:34 configd[13] network configuration changed.

13/03/2012 09:36:36 configd[13] setting hostname to "n214a-11905.ictservicestest.somewhere.ac.uk"

13/03/2012 09:36:50 com.apple.DirectoryServices[15] Enter machine password: 

13/03/2012 09:36:52 com.apple.DirectoryServices[15] DNS update failed!

13/03/2012 09:36:56 DirectoryService[15] GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Cannot find KDC for requested realm)

13/03/2012 09:36:56 DirectoryService[15] GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Cannot find KDC for requested realm)

13/03/2012 09:36:57 DirectoryService[15] GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Cannot find KDC for requested realm)

13/03/2012 09:36:57 com.apple.DirectoryServices[15] Enter machine password: 

13/03/2012 09:36:58 com.apple.DirectoryServices[15] DNS update failed!

13/03/2012 09:36:58 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:36:58 SecurityAgent[95] Will sleep 1 seconds and try again (retryCount = 4)

13/03/2012 09:36:59 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:36:59 SecurityAgent[95] Will sleep 2 seconds and try again (retryCount = 3)

13/03/2012 09:37:01 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:37:01 SecurityAgent[95] Will sleep 4 seconds and try again (retryCount = 2)

13/03/2012 09:37:05 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:37:05 SecurityAgent[95] Will sleep 8 seconds and try again (retryCount = 1)

13/03/2012 09:37:13 SecurityAgent[95] User info context values set for _mac_bind

13/03/2012 09:37:13 SecurityAgent[95] unknown-user (_mac_bind) login attempt PASSED for auditing

13/03/2012 09:37:17 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:37:17 SecurityAgent[95] Will sleep 1 seconds and try again (retryCount = 4)

13/03/2012 09:37:18 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:37:18 SecurityAgent[95] Will sleep 2 seconds and try again (retryCount = 3)

13/03/2012 09:37:20 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:37:20 SecurityAgent[95] Will sleep 4 seconds and try again (retryCount = 2)

13/03/2012 09:37:24 SecurityAgent[95] User info context values set for _mac_bind

13/03/2012 09:37:26 authorizationhost[94] k5_store_ticket_in_cache(): got -1765328243 (Matching credential not found) on /SourceCache/SecurityAgent/SecurityAgent-39574/plugins/krb5/krb5_operations.c:115

13/03/2012 09:37:26 SecurityAgent[95] Login Window Showing Progress

13/03/2012 09:37:26 authorizationhost[94] ERROR | -[HomeDirMounter mountNetworkHomeWithURL:attributes:dirPath:username:] | PremountHomeDirectoryWithAuthentication( url=smb://faraday.students.somewhere.ac.uk/FaradayStudents, homedir=/Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind, name=_mac_bind ) returned 45

13/03/2012 09:37:53 DirectoryService[15] GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Cannot find KDC for requested realm)

13/03/2012 09:37:53 SecurityAgent[95] Could not get the user record for '_mac_bind' from Directory Services

13/03/2012 09:37:53 SecurityAgent[95] User info context values set for _mac_bind

13/03/2012 09:37:53 SecurityAgent[95] unknown-user (_mac_bind) login attempt PASSED for auditing

13/03/2012 09:38:04 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:38:04 SecurityAgent[95] Will sleep 1 seconds and try again (retryCount = 4)

13/03/2012 09:38:05 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:38:05 SecurityAgent[95] Will sleep 2 seconds and try again (retryCount = 3)

13/03/2012 09:38:07 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:38:07 SecurityAgent[95] Will sleep 4 seconds and try again (retryCount = 2)

13/03/2012 09:38:11 SecurityAgent[95] Could not get the user record for _mac_bind from DirectoryServices.

13/03/2012 09:38:11 SecurityAgent[95] Will sleep 8 seconds and try again (retryCount = 1)

13/03/2012 09:38:19 SecurityAgent[95] User info context values set for _mac_bind

13/03/2012 09:38:19 SecurityAgent[95] unknown-user (_mac_bind) login attempt PASSED for auditing

13/03/2012 09:38:24 SecurityAgent[95] User info context values set for cove

13/03/2012 09:38:25 SecurityAgent[95] Login Window Showing Progress

13/03/2012 09:38:26 SecurityAgent[95] Login Window done

13/03/2012 09:38:26 loginwindow[31] Login Window - Returned from Security Agent

Just for comparison, here is a log for a 'normal' machine:

13/03/2012 08:30:40 configd[13] network configuration changed.

13/03/2012 08:30:40 configd[13] setting hostname to "n219-002225"

13/03/2012 08:30:41 blued[17] writeExtendedInquiryResponse returned 105

13/03/2012 08:30:41 com.apple.SystemStarter[22] Starting Qmaster services

13/03/2012 08:30:43 com.apple.DirectoryServices[15] Enter machine password: 

13/03/2012 08:30:43 com.apple.SecurityServer[25] Session 0x30a460 created

13/03/2012 08:30:43 com.apple.SecurityServer[25] Session 0x30a460 attributes 0x30

13/03/2012 08:30:44 loginwindow[31] Login Window Started Security Agent

13/03/2012 08:30:45 WindowServer[68] kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

13/03/2012 08:30:45 com.apple.WindowServer[68] Tue Mar 13 08:30:45 n219-002225 WindowServer[68] : kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

13/03/2012 08:30:45 TabletDriver[99] Finish launching /Library/Application Support/Tablet/PenTabletDriver.app/Contents/Resources/ConsumerTouchDriver.app

13/03/2012 08:30:45 com.wacom.pentablet[99] TabletDriver[99]: Finish launching /Library/Application Support/Tablet/PenTabletDriver.app/Contents/Resources/ConsumerTouchDriver.app

13/03/2012 08:30:45 SecurityAgent[105] Showing Login Window

13/03/2012 08:30:45 TabletDriver[99] Finish launching /Library/Application Support/Tablet/PenTabletDriver.app/Contents/Resources/TabletDriver.app

13/03/2012 08:30:45 com.wacom.pentablet[99] TabletDriver[99]: Finish launching /Library/Application Support/Tablet/PenTabletDriver.app/Contents/Resources/TabletDriver.app

13/03/2012 08:30:45 com.apple.DirectoryServices[15] DNS update failed!

13/03/2012 08:30:47 com.apple.DirectoryServices[15] Enter machine password: 

13/03/2012 08:30:48 com.apple.DirectoryServices[15] DNS update failed!

13/03/2012 08:30:55 root[125] sntp options: a=2 v=1 e=0.100 E=5.000 P=2147483647.000

13/03/2012 08:30:55 root[125]    d=15 c=5 x=0 op=1 l=/var/run/sntp.pid f= time.euro.apple.com

13/03/2012 08:30:55 root[125] sntp: not enough valid responses received in time

13/03/2012 09:46:27 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer[106] Authentication: SUCCEEDED :: User Name: cove :: Viewer Address: 172.25.3.128 :: Type: DH

13/03/2012 09:46:42 SecurityAgent[105] User info context values set for _mac_bind

13/03/2012 09:46:43 authorizationhost[104] k5_store_ticket_in_cache(): got -1765328243 (Matching credential not found) on /SourceCache/SecurityAgent/SecurityAgent-39574/plugins/krb5/krb5_operations.c:115

13/03/2012 09:46:43 edu.mit.Kerberos.CCacheServer[148] launchctl start error: No such process

13/03/2012 09:46:44 SecurityAgent[105] Login Window Showing Progress

13/03/2012 09:46:49 gssd-agent[153] Could not canonicalize our host name in kerberos_init

13/03/2012 09:46:55 mcxalr_agent[165] Listener client (pid: 165) entering listen mode for uid: 2069522553

13/03/2012 09:46:55 SecurityAgent[105] Login Window done

13/03/2012 09:46:55 loginwindow[31] Login Window - Returned from Security Agent

13/03/2012 09:46:55 com.apple.loginwindow[31] LoginHook: Executing /etc/hooks/LIclean.hook...

13/03/2012 09:46:55 root[173] LoginHook: Starting for _mac_bind

13/03/2012 09:46:56 kernel mcxalr{0} 32-bit  Build date: Feb  3 2010 19:02:48

13/03/2012 09:46:56 kernel mcxalr{1} Started

13/03/2012 09:46:56 kernel mcxalr{2} Management ENABLED for uid: 2069522553

13/03/2012 09:46:56 kernel calling mpo_policy_init for mcxalr

13/03/2012 09:46:56 kernel Security policy loaded: MCX App Launch (mcxalr)

13/03/2012 09:46:56 kernel mcxalr{3} Auth provider registered.  connection: 1  uid: 2069522553  version: 1

13/03/2012 09:46:56 com.apple.loginwindow[31] ls: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Library/Caches: No such file or directory

13/03/2012 09:46:56 com.apple.loginwindow[31] usage: chmod [-fhv] [-R [-H | -L | -P]] [-a | +a | =a  [i][# [ n]]] mode|entry file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] chmod [-fhv] [-R [-H | -L | -P]] [-E | -C | -N | -i | -I] file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] ls: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Library/Fonts: No such file or directory

13/03/2012 09:46:56 com.apple.loginwindow[31] usage: chmod [-fhv] [-R [-H | -L | -P]] [-a | +a | =a  [i][# [ n]]] mode|entry file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] chmod [-fhv] [-R [-H | -L | -P]] [-E | -C | -N | -i | -I] file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] ls: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Library/Application Support/SMART Technologies Inc/Gallery: No such file or directory

13/03/2012 09:46:56 com.apple.loginwindow[31] usage: chmod [-fhv] [-R [-H | -L | -P]] [-a | +a | =a  [i][# [ n]]] mode|entry file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] chmod [-fhv] [-R [-H | -L | -P]] [-E | -C | -N | -i | -I] file ...

13/03/2012 09:46:56 com.apple.loginwindow[31] cp: /Users/cove/Library/Application Support/Microsoft/Office: No such file or directory

13/03/2012 09:46:57 com.apple.loginwindow[31] mkdir: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Movies/iMovie Events: File exists

13/03/2012 09:46:57 com.apple.loginwindow[31] mkdir: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Movies/iMovie Projects: File exists

13/03/2012 09:46:57 com.apple.loginwindow[31] mkdir: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Library/Application Support/Microsoft: File exists

13/03/2012 09:46:57 com.apple.loginwindow[31] ln: /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind/Library/Application Support/SMART Technologies Inc/Gallery

13/03/2012 09:46:57 com.apple.loginwindow[31] : No such file or directory

13/03/2012 09:46:57 root[242] - LoginHook:  Finished for _mac_bind

13/03/2012 09:46:57 loginwindow[31] USER_PROCESS: 31 console

13/03/2012 09:46:57 com.apple.UserEventAgent-LoginWindow[95] ALF error: cannot find useragent 1102

13/03/2012 09:46:57 com.apple.UserEventAgent-LoginWindow[95] plugin.UserEventAgentFactory: called with typeID=FC86416D-6164-2070-726F-70735C216EC0

13/03/2012 09:46:57 com.apple.launchd[1] ([0x0-0x5005].com.wacom.Consumer_TouchDriver[112]) Exited with exit code: 255

13/03/2012 09:46:57 com.apple.launchd.peruser.2069522553[146] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

13/03/2012 09:46:57 com.apple.launchd[1] (com.wacom.pentablet[99]) Exited with exit code: 255

13/03/2012 09:46:59 mds[29] (Normal) DiskStore: Rebuilding index for /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind

13/03/2012 09:47:00 mds[29] (Normal) DiskStore: Creating index for /Network/Servers/faraday.students.somewhere.ac.uk/FaradayStudents/_mac_bind

13/03/2012 09:47:04 com.apple.launchd.peruser.2069522553[146] (com.apple.Kerberos.renew.plist[261]) Exited with exit code: 1

13/03/2012 09:47:05 ServerScanner[257] Not scanning because node /LDAPv3/xserve.somewhere.ac.uk is in searchPath

13/03/2012 09:47:07 MacClient[272] Starting UniFLOWMacClient

13/03/2012 09:47:08 Adobe Acrobat Updater Helper[267] Adobe Acrobat Updater encountered errorCode 1504

13/03/2012 09:47:09 MacClient[272] ID: 2 Request url 'http://gutenberg.students.somewhere.ac.uk/pwclient/logon/logonmacuser.asp?MachineName=_mac_bind&ClientType=1' with timeout 90.000000

13/03/2012 09:47:10 MacClient[272] ID: 2 Request url 'http://gutenberg.students.somewhere.ac.uk/pwclient/isapi/momntfy.dll?RunEventLoop?Handle=250' with timeout 90.000000

The only differences between these two machines are the fact that they are on different VLANs. The mac with the problem is on a special MAC VLAN, and the other is not.

Coincidentaly, I've only seen the problem on Mac's on this specific VLAN? Might be a coincidence as half of them are on the VLAN, soon to be all.

I shall update this. If anybody has any ideas please reply.




Update:


So, still no luck but lots more logs. Not sure if I'm going to post them all as it seems like a lot of data. Anyway, I ran out of time and had to re-image. It's working now. I shall update this when I find another machine with the same issues.