10.7.2 Profile manager semi broken

Hi,
Yesterday morning i've upgraded a Mac mini to 10.7.2, since that moment profile manager is acting weird.
I can still register devices, but when i try to update information or lock the device from the interface, it just hangs.
However, it doesn't do this all the time.
The last issue i encountered, was an unhandeld exception when i was testing with the App pushing.
Oct 14 12:37:03 mac01 ProfileManager[283]: Caught unhandled exception undefined method `each' for nil:NilClass at /usr/share/devicemgr/backend/app/models/cfprefs_knob_set.rb:45:in `replace_string_types'
When i got this error, the Update Info also stopped working, same for the App push.
Anyone else who encountered this problems, and perhaps knows a fix?
Thanks.

Hi David,
here is the output of profilemanager.log:
Jan 9 09:43:40 fqdn ProfileManager[254] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:40) [POST]
Jan 9 09:43:40 fqdn ProfileManager[255] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:40) [POST]
Jan 9 09:43:41 fqdn ProfileManager[255] <Info>: Completed in 103ms (View: 0, DB: 3) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[256] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:41) [POST]
Jan 9 09:43:41 fqdn ProfileManager[254] <Info>: Completed in 294ms (View: 1, DB: 19) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[259] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:41) [POST]
Jan 9 09:43:41 fqdn ProfileManager[257] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:41) [POST]
Jan 9 09:43:41 fqdn ProfileManager[256] <Info>: Completed in 303ms (View: 0, DB: 4) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[257] <Info>: Completed in 311ms (View: 0, DB: 4) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[260] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:41) [POST]
Jan 9 09:43:41 fqdn ProfileManager[259] <Info>: Completed in 465ms (View: 0, DB: 16) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[260] <Info>: Completed in 114ms (View: 0, DB: 3) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:41 fqdn ProfileManager[261] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:41) [POST]
Jan 9 09:43:42 fqdn ProfileManager[261] <Info>: Completed in 398ms (View: 0, DB: 95) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:43:54 fqdn ProfileManager[254] <Info>: Processing DataFileController#upload (for 172.16.0.201 at 2012-01-09 09:43:54) [POST]
Jan 9 09:43:55 fqdn ProfileManager[254] <Info>: Completed in 103ms (View: 1, DB: 11) | 200 OK [https://fqdn/data_file/upload]
Jan 9 09:43:55 fqdn ProfileManager[255] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:43:55) [POST]
Jan 9 09:43:55 fqdn ProfileManager[255] <Error>: Caught unhandled exception undefined method `each' for nil:NilClass at /usr/share/devicemgr/backend/app/models/cfprefs_knob_set.rb:45:in `replace_string_types'
          /usr/share/devicemgr/backend/app/helpers/data_file_helper.rb:63:in `create_ios_application_from_file'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:202:in `send'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:202:in `do_magic'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:176:in `each'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:176:in `do_magic'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:175:in `each'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:175:in `do_magic'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:168:in `each'
          /usr/share/devicemgr/backend/app/controllers/magic_controller.rb:168:in `do_magic'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:1333:in `send'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:1333:in `perform_action_without_filters'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:617:in `call_filters'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:638:in `run_before_filters'
          /usr/share/devicemgr/backend/app/controllers/application_controller.rb:71: in `give_session_to_models'
          /usr/share/devicemgr/backend/vendor/rails/activesupport/lib/active_support /callbacks.rb:178:in `send'
          /usr/share/devicemgr/backend/vendor/rails/activesupport/lib/active_support /callbacks.rb:178:in `evaluate_method'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:186:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:635:in `run_before_filters'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:615:in `call_filters'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:610:in `perform_action_without_benchmark'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /benchmarking.rb:68:in `perform_action_without_rescue'
          /usr/share/devicemgr/backend/vendor/rails/activesupport/lib/active_support /core_ext/benchmark.rb:17:in `ms'
          /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/be nchmark.rb:308:in `realtime'
          /usr/share/devicemgr/backend/vendor/rails/activesupport/lib/active_support /core_ext/benchmark.rb:17:in `ms'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /benchmarking.rb:68:in `perform_action_without_rescue'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /rescue.rb:160:in `perform_action_without_flash'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /flash.rb:151:in `perform_action'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:532:in `send'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:532:in `process_without_filters'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /filters.rb:606:in `process'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:391:in `process'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /base.rb:386:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /routing/route_set.rb:438:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /dispatcher.rb:87:in `dispatch'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /dispatcher.rb:121:in `_call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /dispatcher.rb:130:in `build_middleware_stack'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /string_coercion.rb:25:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /string_coercion.rb:25:in `call'
          /usr/share/devicemgr/backend/vendor/gems/rack-1.1.0/lib/rack/head.rb:9:in `call'
          /usr/share/devicemgr/backend/vendor/gems/rack-1.1.0/lib/rack/methodoverrid e.rb:24:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /params_parser.rb:15:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /session/abstract_store.rb:177:in `call'
          /usr/share/devicemgr/backend/vendor/rails/activerecord/lib/active_record/q uery_cache.rb:29:in `call'
          /usr/share/devicemgr/backend/vendor/rails/activerecord/lib/active_record/c onnection_adapters/abstract/query_cache.rb:34:in `cache'
          /usr/share/devicemgr/backend/vendor/rails/activerecord/lib/active_record/q uery_cache.rb:9:in `cache'
          /usr/share/devicemgr/backend/vendor/rails/activerecord/lib/active_record/q uery_cache.rb:28:in `call'
          /usr/share/devicemgr/backend/vendor/rails/activerecord/lib/active_record/c onnection_adapters/abstract/connection_pool.rb:361:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /failsafe.rb:26:in `call'
          /usr/share/devicemgr/webserver/gems/gems/rack-1.1.0/lib/rack/lock.rb:11:in `call'
          /usr/share/devicemgr/webserver/gems/gems/rack-1.1.0/lib/rack/lock.rb:11:in `synchronize'
          /usr/share/devicemgr/webserver/gems/gems/rack-1.1.0/lib/rack/lock.rb:11:in `call'
          /usr/share/devicemgr/backend/vendor/rails/actionpack/lib/action_controller /dispatcher.rb:106:in `call'
          /usr/share/devicemgr/backend/vendor/rails/railties/lib/rails/rack/static.r b:31:in `call'
          /usr/share/devicemgr/backend/vendor/rails/railties/lib/rails/rack/log_tail er.rb:17:in `call'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/connection.rb :76:in `pre_process'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/connection.rb :74:in `catch'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/connection.rb :74:in `pre_process'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/connection.rb :57:in `process'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/connection.rb :42:in `receive_data'
          /usr/share/devicemgr/webserver/gems/gems/eventmachine-0.12.10/lib/eventmac hine.rb:256:in `run_machine'
          /usr/share/devicemgr/webserver/gems/gems/eventmachine-0.12.10/lib/eventmac hine.rb:256:in `run'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/backends/base .rb:57:in `start'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/server.rb:156 :in `start'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/controllers/c ontroller.rb:80:in `start'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/runner.rb:177 :in `send'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/runner.rb:177 :in `run_command'
          /usr/share/devicemgr/webserver/gems/gems/thin-1.2.7/lib/thin/runner.rb:143 :in `run!'
          /usr/share/devicemgr/webserver/thin:8
Jan 9 09:43:55 fqdn ProfileManager[255] <Info>: Completed in 362ms (View: 0, DB: 3) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[259] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[257] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[259] <Info>: Completed in 109ms (View: 0, DB: 3) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[261] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[257] <Info>: Completed in 311ms (View: 0, DB: 17) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[254] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[255] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[261] <Info>: Completed in 307ms (View: 0, DB: 3) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[254] <Info>: Completed in 105ms (View: 0, DB: 4) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[256] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:23 fqdn ProfileManager[256] <Info>: Completed in 97ms (View: 0, DB: 2) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[255] <Info>: Completed in 404ms (View: 0, DB: 16) | 200 OK [https://fqdn/magic/do_magic]
Jan 9 09:45:23 fqdn ProfileManager[258] <Info>: Processing MagicController#do_magic (for 172.16.0.201 at 2012-01-09 09:45:23) [POST]
Jan 9 09:45:24 fqdn ProfileManager[258] <Info>: Completed in 392ms (View: 0, DB: 72) | 200 OK [https://fqdn/magic/do_magic]
We can't upload any apps. Do you have any ideas to solve this?
Thank you!
Bye Gunnar...

Similar Messages

Difference between Profile Manager in Server v2.2 and Workgroup Manager - Mobility

Hello everyone,
I was wondering if anybody experienced mobility management with Profile Manager in Server v2.2 ? It is known that mobility management in Profile Manager is broken in previous versions of Server:
https://discussions.apple.com/thread/3637378?start=0&tstart=0
Does anybody know if mobility management has been fixed ?
Thanks for your help. Best regards.

I'd also like to know an answer to this. I'm managing a small network and don't have a test environment to stage things in. (This is needed as Profile Manager is WAY too unstable to production.)
I'm currently using WGM to look after Mobility settings and Profile Manager for everything else. I used this setup after I got the same reply as per thread 3637378. It would be nice to have the settings all in once place!

Profile Manager Broken after Migration to OS X Server 10.8

After migrating from Lion Server to OS X Server 10.8, Profile Manager will not start. Server.app -> Profile Manager reports "Error Reading Settings". Apache Error log reports:
[Thu Aug 30 13:32:29 2012] [error] (61)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:3329 (127.0.0.1) failed
[Thu Aug 30 13:32:29 2012] [error] ap_proxy_connect_backend disabling worker for (127.0.0.1)
I tried shutting down all web services (Profile Manager, Wiki, Web), ran "serveradmin command web:command=restoreFactorySettings", then turned back on Web and Profile Manger... same problem.
Any ideas what, exactly, is wrong and how to fix it?

this might not be true in your case but when I've seen "error reading setting"it has been a permission problem on the Library/Server/profilemanager folder (or other service)
Profile manager should have owner _devicemgr RW, group _devicemgr R, everyone R
same for the Data folder inside.
Might be forth checking

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

Cry for help: a decent network profile manager

Am I the only one that finds the default arch linux network profile management a bit.. lacking? Maybe I just don't have it set up right, but it only works for my ethernet connection and connecting to non-encrypted wireless networks. Problem is, I run WPA2-AES networks at home and at work. I finally got wpa_supplicant properly set up (I'm on wireless right now), but I can't just select the network profile from the menu and be on my way.
Here is what I have to do to get connected right now:
[root@cdl-magnesium chris]# wpa_supplicant -dw -c/etc/wpa_supplicant.conf -Dmadwifi -iath0
[root@cdl-magnesium chris]# dhcpcd ath0
and I'm connected, everything working great. That's fairly simple, right? I'm thinking my network profile has a lot more in it than necessary.
# Network Profile
DESCRIPTION="57 May"
# Network Settings
INTERFACE=ath0
#HOSTNAME=myhost
# Interface Settings (use IFOPTS="dhcp" for DHCP)
IFOPTS="dhcp"
#GATEWAY=192.168.0.1
# DNS Settings (optional)
#DOMAIN=localdomain
#DNS1=192.168.0.1
#DNS2=
# Wireless Settings (optional)
ESSID="Galactica"
#KEY=
#IWOPTS="mode managed essid $ESSID channel 6 key restricted $KEY"
WIFI_INTERFACE=wifi0 # use this if you have a special wireless interface
# that is linked to the real $INTERFACE
WIFI_WAIT=5 # seconds to wait for the wireless card to
# associate before bringing the interface up
USEWPA="yes" # start wpa_supplicant with the profile
WPAOPTS="-D madwifi" # use "" for normal operation or specify additional
# options (eg, "-D ipw")
# see /etc/wpa_supplicant.conf for configuration
#AUTOWPA="yes" # automatically configure WPA
If I do a /etc/rc.d/network restart and select the profile from the menu, I get all sorts of errors about not being able to connect to wpa_supplicant (because for some reason it isn't running.. was I supposed to do something about that?).
I'm a bit tired right now so pardon any incomprehensible sentences or questions
ps: while we're on the subject, is there a way to re-sort the items in the network profile list? It always wants to connect to this broken wpa2 profile first, as I think it just goes in alphabetic order or somethin. I guess I should just turn off the timeout so it always waits for me to choose.

i'm working on one.
http://wiki.archlinux.org/index.php/Network_Scripts
James

Argh! Profile Manager and Code-Signing of profiles

I am setting up Profile Manager in Mavericks with Server.app 3.0.1.
I have DNS correctly setup, I have created an OD Master for Profile Manager, Profile Manager is running and network users can login and I can setup profiles. I also have the https site working properly for clients although that needed some help.
We have a self-signed root CA and off that we have two intermediate CAs, one for signing server SSL certificates, and one for signing codesigning certificates. On my server I have installed the rootCA, and the intermediate CAs and of course the server SSL certificate itself. As mentioned initially I had a problem with the https site on the server and what was happening was that the server was not sending the intermediate certificate along with the server certificate to clients. (The clients already have our rootCA certificate installed and trusted.)
As a result the chain was incomplete and clients did not trust the http site. I tracked this down to the files in /etc/certificates it turned out that of the four files for the server certificate i.e. .key.pem, .chain.pem, .concat.pem and .cert.pem that the .chain.pem did not contain the intermediate CA. I replaced it with the intermediate CA pem file and restarted Apache and clients now get the full chain and can therefore trust the https site.
My problem now is with the codesigning certificate, this also has been selfsigned this time by the intermediate codesigningCA. It is accepted by Profile Manager and it does sign the profiles. However when I download the Trust profile and try installing it, it comes back unverified. (If it was unsigned it would say unsigned instead.) This trust profile contains a copy of the server certificate and the rootCA certificate but does not contain the intermediate codesigningCA certificate.
I tried the same trick of swapping out the codesigning .chain.pem file in /etc/certificates but this did not help. I am currently stuck, any suggestions from any one?
Thanks.

I would really appreciate being walked through these steps. I just upgraded to Yosemite and Server.app 4 and am dealing with all the brokenness.
Profile Manager does not show a code signing certificate when I ask it to sign configuration profiles.
I DO NOT have the Code Signing Certificate in my keychain created when OD was created.
I DO have the four code signing certificate files:
/etc/certificates/host.domain.tld.Code Signing Certificate.<UUID hash>.cert.pem
/etc/certificates/host.domain.tld.Code Signing Certificate.<UUID hash>.chain.pem
/etc/certificates/host.domain.tld.Code Signing Certificate.<UUID hash>.concat.pem
/etc/certificates/host.domain.tld.Code Signing Certificate.<UUID hash>.key.pem
Furthermore, when I search my System keychain passwords, for <UUID hash>, I see that have the password that decrypts these pem's, e.g. via the openssl command
openssl rsa -outform der -in 'host.domain.tld.Code Signing Certificate.<UUID hash>.key.pem' -out 'host.domain.tld.Code Signing Certificate.<UUID hash>.key'
What's the specific step-by-step to convert these four files into something that Profile Manager can use to sign configuration profiles?
I am stuck.

Safari Keep-Alive via Profile Manager

Greetings Community!
Does anybody know of a way to issue a keep-alive to Safari via profile manager so it always stays open and that if it somehow closes it will automatically re-open?

Worked it out!
I also host a couple of personal websites and these were configured to use the IP of the server; removed this and set it to use the "Any" option and profile manager started working as expected. Not done a full test of the entire thing to see if anything else is broken but this has me moving on from here!

Push MS Office Prefs in Profile Manager?

Has anyone found a good way to push Microsoft Office preferences in Profile Manager? All of my Mac workstations will run the setup assistant for every user that logs in. I did try to add a Custom Pref and it did add and push out but it didn't stop the setup assistant and then it crashes Word continuously. I remember with Workgroup Manager I would use the same preferences and it would never prompt users to run the setup assistant.
My server is running 10.9 Server pushing out to 10.10.1 clients. I've also tried the same thing to a 10.9.4 client with the same results so I don't think its an OS issue, but rather somehow its pushed prefs simply aren't working and are continuously crashing all Office apps.

If there is an approach via Profile Manager then using the Custom Pref is the way to do it. The fact that something is happening when you try this even though it results in Word crashing suggests you are successfully pushing a setting out but that it is likely either malformed or missing items.
Note: I don't know offhand which particular plist file is relevant so insert it where applicable below.
I suggest you log in to a Mac (or user) with a working Office plist file and run -
defaults read ~/Library/Preferences/name of the plist file
Then do the same on the broken one set via Profile Manager and see what the differences are, this may help you narrow things down, I believe the Custom Pref syntax in Profile Manager is different to how Workgroup Manager does it, this is certainly true for setting up folder-redirection as an example.
An alternative approach you could consider is to add the file to the User Template folder which is in -
/System/Library/User\ Template/English.lproj/Library/Preferences/
When a new user account is created on a Mac with a pre-configured User Template the contents of the User Template are copied to the matching locations within the users home folder - when the user logs in for the first time. Existing users will not get these files. If your using Network Home Directories or Portable Home Directories then you need to do this on the server hosting the Network Home Directories as well.

New App Purchases never show in Profile Manager

I have been using VPP Managed Distrubuition and Profile Manager without issue since December then out of the blue new any app purchases never appear in Profile Manager under the App tab. Includes both paid and free apps and they are in the Purchase History of my Program Facilitator account. Nothing has changed at the server setup that I'm aware of and I'm not really sure where to go now as emailing VPP support resulted in a reply that they can't offer advice on Profile Manager and I need to speak to Enterprise support. I think my VPP token is broken.
I have turned Profile Manager off and back on, removed the token and redownloaded and applied it again and performed another purchase and still nothing is showing that has been purchased since Febuary. Have also turned the Push Notifications off and back on. The 80 odd apps purchased before Feb continue to work as expected and I can assign them to users, remove users from the program and retrieve the licence etc.
As a last ditch I updated the OS to 10.9.2 along with the corisponding Server App version yesterday but this has had no effect.
Greatly appreciate any thoughts or suggestions.

Can do however won't that clear all my App assignments in Profilemanager and Managed Profile Settings? The MDM functions of Porfile Manager are working fine. Just can't see new App purchases.
I tested again yesterday and purchased 5 new distrubuited licences of Edmodo and Micosoft Word. Neither display to assign to users.
Have 73 existing purchases made before March showing still and I can assigned them to users who have enrolled. I can also continue to enroll new users.

Unable to push user profiles to AD groups with Profile Manager since upgrade to Server v3

Since upgrading our OS X Mac server from 10.8.5 to 10.9.1, and OS X Server app to v3 (now 3.0.2) I have been unable to push or modify user profiles to AD groups (or AD users) using Profile Manager. This was working fine on OS X 10.8.5. Pushing device profiles is still working OK after the upgrade.
From what I can see from the logs on the client side and server side, it seems related to a problem with the mdm authtoken.
In the client console I can see this entry:
27/01/14 14:30:15.844 mdmclient[38557]: *** ERROR *** [Agent:636102071] Unable to proceed with connection to: https://ourserver.ourdomain/devicemanagement/api/device/mdm_connect (com.apple.mdmconfig.mdm) because don't have valid MDM AuthToken
On the server, in the php.log I can see the corresponding attempt to authenticate:
1::Jan 27 14:29:50.930 [158] <192.168.28.171> {require_once (mdm_checkin.php:11)} vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv - PUT mdm_checkin
0::Jan 27 14:29:50.931 [158] <192.168.28.171> checkin: 'UserAuthenticate'
1::Jan 27 14:29:50.936 [158] <192.168.28.171> {Target_for_incoming_request (target.php:209)} Found target NETWORK LS: <User[156]@ourclientmachine>
0::Jan 27 14:29:50.937 [158] <192.168.28.171> {LabSession_validate_auth_token (mdm_checkin.php:22)} Failed auth for target NETWORK LS: <User[156]@Device[1697]>, incoming_request={
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'MessageType'=>'UserAuthenticate',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UDID'=>'17aff5c5a40f51acbbd78023d0028c80',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UserID'=>'A5EA25B7-7CCD-4EF4-B240-F23DED275EEC'
0::Jan 27 14:29:50.937 [158] <192.168.28.171> }
1::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Sent Final Output (407 bytes)
1::Jan 27 14:29:50.965 [158] <192.168.28.171> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - /devicemanagement/mdm/mdm_checkin
0::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Completed in 34ms | 200 OK [https://ourserver.ourdomain/devicemanagement/api/device/mdm_checkin]
So I can see there is a failure to authenticate, but don't really know how to troubleshoot this further. Or maybe this is just a bug in the new server app?
I have tried to remove and re-enroll clients in Profile Manager but no joy there.
In the client's Keychain I can see an MDM user AuthToken linked to the correct user account.
Thanks in advance for any help or suggestions

I just wanted to update my post, as this issue for me is resolved.
I uninstalled and reinstalled the Server.app on our Mac server, since then I've been able to push profiles to AD Users and Groups. I guess that in my case the Server app got into a bit of a mess when it was upgraded to v3.
Now the next headache I have is that my AD Groups which are displayed in Profile Manager are not syncing any recent changes. I think I'm probably seeing the same issue as described in this post
https://discussions.apple.com/message/25420919#25420919

VPP Distribution issues with OSX Server Profile Manager

Hi, I have a new issue with my OSX 10.9.5 Server. I use VPP to distribute apps to users devices, when I would add a new user I would send them an invitation message through /profilemanager . All was working well until recenetly , the message still arrives in the users mailbox however when you click the "sign in" link on the "receive apps and books from xxxxx" email instead of opening through the Mac App store app it now opens Safari and connects to the profile manager server , any ideas ? it never has done this before and although I thought it was a new feature or method I can not seem to resolve the issue.

Hi if when you are redirected back to your Mac Server you enter the user name and password of the user you are trying to receive VPP apps for i.e the Open Directory credentials it will then open the App Store providing the credentials are correctly entered so it looks like an additional layer of security. The process is click on the link in the VPP invite email, this takes you to your Mac Server profile manager, log on with your OD account, App store then opens on your Mac like it used to.

Profile manager won't clear previous settings

While messing around with profile manager it do a couple basic things. Start FaceTime at login and map some network drives. This worked fine but when i went back in later to turn those off they continue to go through. When I log on to a different computer the settings are correct, however. Is there someone I can do a clean refresh of the machine to wipe it of all previous profile manager settings. I've even tried deleting and re adding the machine to Profile manager but this still doesn't work.

You'll need to cleanup DNS on the domain controller not client systems.
Give me some information on how this server is integrated into your environment.
Is it bound to Active Directory? If so, what happens when you launch terminal? Does the hostname match the name under Sharing in sys prefs on your server? If not, you've probably got some stale DNS screwing things up.
To see if this is the case, log in to your primary DC (or whichever server hosts DNS records in your environment) and check your forward and reverse lookup zones. In my case, I saw more records than we have machines! Problem with Macs is those records stick around even after you remove a machine. Macs aren't always automagical unfortunately.
Another way to see if you have DNS problems is simply take a freshly imaged server (BEFORE it's bound to AD) and fire up profile manager. If it launches easy breezy (aka not getting DNS from the potentially messy server) then it's safe to assume you'll need to scavenge out those records. But that another story for a Win 2008 R2 board.

How do I use multiple VPP accounts in a school system with 1 Profile manager server?

I have 40 schools with their own money they want to spend on apps. I need these accounts to be seperate. We are registered in the Device enrollment program and are using Apple's profile manager to distribute VPP apps. In the DEP website you can add existing vpp admins. I had hoped when these accounts purchased apps, the apps would show up in Profile Manager which uses the master Apple ID, but this didn't happen. Anyone know what the correct process is for doing this?

If you haven't found the answer: You have to install the correct token for each account. Apple Servers, as far as I know, do not support using multiple tokens at once. As a result, you will have to swap out each of the 40 tokens anytime anyone wants to buy something then assign it to a user then push the app.
Or just buy it with a redemption code and give that code to your users.

How do I use the Profile Manager to run multiple PHP sessions?

I have a website that tracks the session and state of users as they traverse through the site. Several users can "work together" simultaneously. To test this cooperative functionality, I ran multiple Firefox profiles simultaneously on my computer, using Firefox's Profile Manager. After logging in as two users (one on each separate running Firefox instance), one of my Firefox instances still works, while the other one does not seem to track the session.
How do I create and run multiple Firefox instances to allow me to test the functionality of such sites? I believe this worked a few months ago. Perhaps this is a new bug?
I even tried running normal Firefox and Firefox Extended Support Release simultaneously, but I ran into the same error.

Disregard the question. The solution has nothing to do with any "Firefox bug". Turns out that my session wasn't being managed properly. Or rather, I was accidentally deleting other users' information when new users logged in. So if I had user 1 and user 2, and user 2 logged in after user 1, some of user 1's information would be deleted, resulting in the errors.
Oops; sorry about the false alarm. :)
(Was hoping to retract the question, but it looks like others have a similar problem.)

Why will firefox not start on my laptop? can't uninstall or open the profile manager either. it simply does not run. it used to work fine until i had to restore my system.

had firefox 4.0 & have been a user of firefox for a few years now. never had any problems. had to do a system restore after my computer detected a virus of some sort & i couldn't do anything. the virus kept popping up a bogus add for me to buy an antivirus program. had to restart laptop in safemode to initiate the restore. ever since then firefox has not opened. can't even uninstall it or open the profile manager. anything that has to do with firefox will simply not run/open at all. i'm stumped.

System restore can cause problems as well as solve them, it has probably completely mucked up your Firefox installation.
Try deleting your Firefox installation directory, the default location on 32 bit Windows is C:\Program Files\Mozilla Firefox\
Now re-install Firefox, it should pick up your current profile folder so you should not lose your bookmarks, passwords etc.

10.7.2 Profile manager semi broken

Similar Messages

Maybe you are looking for