Macintosh OS X - Active Directory Integration

Having an interesting issue with and OS X/AD integration.  I have a Windows 2003 domain with many servers.  I also have an OS X server running Open Directory.  The OS X server is bound to AD, and all of the Macintosh clients are bound to both AD and to OD.  This forms Apple’s “Golden Triangle” and allows users to login to a Mac using their AD credentials, while allowing you to specify “preferences” for the machine via the OD server.  These preferences can be though of as Group Policies for Macs, however they are nowhere near as detailed as the catalog of settings you can enforce using Group Policy on the WIndows side.

Anyway.. I have a small issue with this system, and I am not yet certain where it comes form.  My users all have a home directory mapped to the drive letter P:.  This is specified in their AD accounts in the form of \\fileserver\users\students\user_name.

Recently, during a MacBook deploy to a small group of students I discovered that none of them could log in… or more specifically, they were able to log in, but received a message as the Mac tried to mount the sharepoint.  I don’t have a copy of the message here, (its on my desk at work) but essentially it said that the sharepoint was not available.  The students clicked OK to this and the machine proceeded to log them out.

A head scratcher indeed.

The machines are also running BootCamp with WIndows XP, and the students were able to log in and access their mapped drive under XP… so what gives.  Also… I was able to login to a student computer as myself and get my network home folder mapped to my dock.

With a little bit of thinking, and some experimentation by one of my coworkers, we discovered that if we used the server’s correct hostname, rather than the generic “fileserver” CNAME that had been assigned to the machine, the student’s could log in.

None of this explains why for the past week we have had faculty (who have little more in the way of privileges than the students) able to log into their newly deployed Macs, pulling their network home form the same server, using the same CNAME, with absolutely no problem.

I can see that I will need to do a good bit of testing to see just what permission level the faculty has, that grants them access to the fileserver by it’s CNAME record rather than by it’s A record.  It would make sense to me if this failed for users, but that it only effects a subset of them makes me wonder what kind of magic is working behind the scenes.

I will update this as I come up with more info.

Posted on Sat, 29 Aug 2009 23:21:50 -0700 in
AWS • Geek • Mobile • Network Administration • Servers • Technology • Apple Computer • Macintosh • OS X • Open Directory • Microsoft • Windows • Server 2003 • Active Directory
(0) Trackbacks • Permalink

Picton Castle - 10 years later

Walked on the decks of Picton Castle today.  It’s been years…  ten years in fact, since I last set foot on her decks.  It was an interesting experience.  Dan is the only person on board that was there when I was on board.  The ship was much the same, and yet, much changed in the small details.  Parts of the ship had been painted different colors, the blocks had been replaced by ornately carved blocks.  Other differences too.  The stove is now diesel fired, rather than coal, the engine room is cleaner than ever before, (but the engine still leaks oil in all the same places.)

I looked longingly at the ship, knowing that I am not likely to get a chance to sail on her again.  Certainly not around the world again.

Posted on Mon, 06 Jul 2009 17:48:06 -0700 in
Picton Castle • Sailing
(0) Trackbacks • Permalink

In Boston - Whipple Hill Users Conference - 09

I am in Boston.  Home.  It’s pretty great to be home.  It’s even better that work paid for me to come home this summer.  I will have to see if I can make that work out again in the future.  I am here because we use Podium from Whipple Hill to generate our web content and to manage our student information system.  It’s OK.  It has it’s quirks.  The conference is designed around orienting us to Podium and learning the tricks to make it do what we need it to do.

One of the most exciting things I will take home with me, (home on the West coast, not in Boston) is the idea that Social Media is something we, (the school) have absolutely no control over.  Run a Google query similar to this: “My Company Name” -mycompany.com and tell me what you find.  The query, for those of you who don’t use the advanced features of Google, will provide you with all the Google indexed content that mentions your company by name, yet doesn’t come from your company’s website.  See… people are talking about you in ways you have zero control over.  Well… the only way in which you can control this type of interaction is to behave ethically as an organization.  If you do this, people will talk positively about you.  If not… not so much.

You can check out what people are saying about the conference on Twitter.

Posted on Wed, 01 Jul 2009 20:41:32 -0700 in
AWS • Geek • Social Media Networks
(0) Trackbacks • Permalink

Subway

It has been years since I last rode the subway. Seattle doesn't exactly have one, and neither does Tacoma. Last time I did this, people either read a book or listened to their walkman. I look around today and see that nearly everybody is listening to an iPod, phone, and tapping away on a phone of some sort. I guess that puts me in sync with everybody else around me. Media has taken over our lives. It occupies our work lives, our personal lives, and even the spare cycles in between.

Posted on Tue, 30 Jun 2009 15:40:44 -0700 in
Mobile • Social Media Networks • Technology • Apple Computer • iPod • Blackberry - RIM
(0) Trackbacks • Permalink

Weekend in Jersey

My weekend in New Jersey was pretty great. Hanging out with friends and the spawn of friends is the stuff that dreams are made of. Right? Anyway, I had a great time just chilling out, drinking a few cold ones, and having some good laughs. All on the cheap too. Heading back to Boston on the Acela now. Hanging out in the quiet car, tapping out this entry.

Posted on Sun, 28 Jun 2009 13:32:20 -0700 in
Mobile
(0) Trackbacks • Permalink