10.7.2 with AD Mobile User Accounts

Hi All,
I am experiencing a very strange issue.
I am build MacBook Air operating environments, that bind via a script to a 2008 AD Server. The problem I am experiencing is when the system/Mobile account is removed from the network, the user can no longer access the Accounts Pane in system prefs, it get a message syaing "Preference Error - Could not load Users & Groups preference pane"
Also, if I log out, the Mobile Accout cannot log back in again, but local user accounts are fine.
When I check Directory Utility, under the Directory Editor, the User does not appear, it is like Lion is not creating the account as mobile. I have the AD services pane set up with "Create Mobile Account at Login" enabled, and "Require confirmation before creating a mobile account" diabled.
The part that makes this really weird, is I have a MacBook Pro 10.7.2 image built off the exact same config (I followed the config sheet step for step) - the only difference is the MBA is built off a MBA Retail Bundle (these images are intended for CSS) and the MBP is built of the MBP Retail Bundle.
Has anyone experienced this before, or would be able to give me some clue where I could look for a solution - the school I work at is gearing up to roll out about 600 laptops early next year, and the deadline for a solution to this is getting very close.
thanks
Matt

A little bit of more research - it seems it is something int he binding process (most likely in the binding process we use here) that is reset wh the OS is re-inatalled.
- I used a the MBA Retail bundle to install a system on the computer.
- I bound the computer to our ad and logged in with a mobile account.
- I check for failure and confirmed it had the issue I described above.
- I reinstalled Lion over the top of the system (using the internet download model)
- The problem was gone.
but.. when I try to build an image around this, I can't reinstall the OS after the system is bound (I am working at a school and with the number of system I am using it is just not practicle)
so i did the following
- I used a the MBA Retail bundle to install a system on the computer.
- I reinstalled Lion over the top of the system (using the internet download model)
- I bound the computer to our ad and logged in with a mobile account.
- and the system failed. (the exact same as has been described above)
So I am now fairly stuck on where to go with this...

Similar Messages

Questions about Mobile User accounts

I'm having some trouble fully grasping Mobile User accounts and hoping someone could clarify whether they would be appropriate in my situation.
We have some non-"mobile" users that solely use one machine and we would like them to continue to use their local hard drives. Is a "Mobile" account the solution?
Second, if a user is already using an independent Mac that is not bound to any server..is it possible to bind it, create a mobile account, then sync local with network home folders such that all of the current data in their existing Home folder is added to the Network Home folder? or must the account be started from scratch?
Lastly, What if we did not want all that data synched to the Network Home because there is simply too much of it. Can we still enjoy the benefits of Network login while certain files are local (I assume this is what the synching prefs are all about?!?) Users use same machine for 99% of their work. only occasionally would it be nice to provide them access to their mail, etc from a different client
PowerMac G4 Mac OS X (10.4.4)

I'll take some broad swipes at this and let the smarter people come fill in the details.
We have a true 1:1 setup in our office and have moved to PHDs as a means of protecting against downtime. The thinking is that we will have a spare machine lying around with our base installation ready to go. If a user's machine fails we'll replace it with the spare machine, let it sync the user directory from the server, and we're back in business. It's no substitute for a real backup system, but it potentially avoids having to run a restore from your backups. It also reduces network traffic compared to plain networked homes, and still lets your users work if the server goes down, but provides the benefits of centralized management. John DeTroye wrote a nice article about this.
If you've already got data on your "client" Mac you will need to move it onto the server. PHDs will download data from the server to the client on the first sync, but will not upload a complete home directory from the client to an empty directory on the server. You'll find some posts in this forum discussing how people have gone about migrating data prior to that first sync.
WGM allows you to establish exclusions for stuff you don't want to sync.
One thing to watch out for in the scenario you describe is the so-called "rabbit effect." Assume Bob uses Mac1 as his primary machine. If one day he logs into Mac2 his home directory will be downloaded to Mac2. Once he returns to Mac1 he'll still be cluttering up Mac2 with his data. If he logs into Mac3 the next day and Tom and Sue are also periodically logging into different machines, you can see how you'll end up with a mess pretty quickly.
Hope this helps.

Login.keychain and mobile user accounts

After removing a corrupt login.keychain file in a mobile user account, the user could no longer log in to their account when off site. What account login information is kept in the keychain file of a mobile account?

I don't have problems syncing other files that are also system packages, like iPhoto ones... although I have a terrible suspicion that again the sync agent only sees a single file, not a bundle.
I assume that the OS doesn't have any problem with packages since they are used pretty much elsewhere and they are basically a folder with a specific file inside that "forces" the OS to show us as a single file, instead of letting us see directly the content.
Even the new disk image format that Apple recommends to be used in order to speed up Time Machine backups (.sparcebundle) is based in package (or bundles, whatever you prefer to call them)
The main issue here might be the folder structure inside.
If you do a "show package content" and, for instance, check the thumbnails folder, I can easily see some chars that might create some confusion if not properly escaped during the sync, like on this example:
My Aperture.aplibrary/Thumbnails/%pARYo%fT52I77jmdf8mqQ/AP.Thumbnails
(Those "%" are so prone to errors if not properly handled)
Time Machine doesn't have any problem with both packages and those chars, so I truly hope that they use TM tech and improve the way that the syncing agent work.
Anyways, Aperture seemed a nice app.
I'm really sad that I can't use it because of this... specially when I'm considering getting a new digital camera.
I understand that it was recently released so let's hope that Apple can figure out what's happening and release an update (to either Aperture or Mac OS X Server) in the next few months.
Take care.
Pedro Fardilha

Migrating current mobile user accounts from one OS X Server to another

I have not been able to find ANY answers to my situlaton.
I have a small office that currently has a Mac Server 10.4.11 server running that has many "mobile user" accounts setup. This was done because we have so many mobile users coming in and out of the office. When the user comes back they sync their home directory witht th server here. Works great.
We recently purchased a new Mac Server running 10.7.4. Set it up as the Open Directory Master. I unbind from the old server and bind to the new server. Everything seems to be working just fine except when I go and add a current mobile user to the new server it creates a new user account on the client device (MacBooks) as if the previous user settings didn't exsist. Since they need to be mobile users and not just network users I haven't been able to find a solution to this problem any where.
Is there a way on the client to tell it to use the old user account stored on the MacBook to use with new mobile user connected to the new server?
Or is there an easier way of doing this that I don't know about?
Thanks,
TK

If I understand what you wrote, no. The reason is this. If memory serves... In 10.4.11 accounts were assigned a UID. In 10.7.x, accounts are assigned a UID and a GUID. Most everything relies on the GUID at this point. So, what you have is an account named marysue on the workstation and it is assigned a UID like 1045. Now you created marysue on the Lion server, but you likely did not recreate the UID to match the old server. And thus, the UID value is different but more importantly you now have a GUID value like EC0F9357-8EF2-4D3B-B6F3-2E3016400114, that is associated with the account. So, the user, despite having the same shortname, is different.
In addition, you are working with two different directory systems. 10.4 still used NetInfo (ah, I miss you so). 10.5 and above use DS local flat files, even when bound to an LDAP system.
So, probably the easiest way to do this, provided I understand what you are seeing is the following. Let's assume the following:
You have a mobile account on a workstation for the user maryjoe with a UID of 1034 that came from the 10.4.11 system. You have this account cached. You have a home folder in /Users/maryjoe. You have now bound to the new server which contains a user named maryjoe likely with a UID of something other than 1034 and with a GUID value that likely did not exist in the old directory system, also with the shortname of maryjoe and a home path of /Users/maryjoe.
So when you log in, you are likely being pathed to /Users/maryjoe, but you are seeing a default Dock and no documents because of permissions. My guess is that if you used Terminal to view the Users directory you would see something like this (open Terminal and issue the command ls -l /Users/:
drwxrwxrwt   4 root       wheel 136 Apr 18 21:35 Shared
drwxr-xr-x+ 14 locadmin staff 476 Jan 21 7:42 locadmin
drwxr-xr-x+ 14 1034 staff 476 Mar 21 10:42 maryjoe
Note the folder maryjoe is not owned by maryjoe, it is owned by the UID of maryjoe from the old server.
Ok, so long story short (sorry for the log explanation, especially if you are experiencing something else that I did not get from the post), all you need to do is update the permissions of the home folder. Do this:
1: Log in as the local admin
2: Open Terminal
3: Issue this command:
     sudo chown -R maryjoe /Users/maryjoe
Even with a lot of data in the home folder, this should not take more than a few minutes to complete.
When the command completes, run this command again: ls -l /Users/
You should now see
drwxrwxrwt   4 root       wheel 136 Apr 18 21:35 Shared
drwxr-xr-x+ 14 locadmin staff 476 Jan 21 7:42 locadmin
drwxr-xr-x+ 14 maryjoe staff 476 Mar 21 10:42 maryjoe
Now try logging in as the user. With a little luck I divined the issue and this will have you up and running. Now, I normally will also purge the cached account in /var/db/dslocal/nodes/Default/users/ but that might be a bit daunting. So let's start with the simple process first of ensuring home folder permissions are correct.

HT202213 I have 3 users on one computer with 3 unique user accounts. Each have unique ITunes accounts. How do we share our music libraries using home sharing?

I have 3 users on one computer with 3 unique user accounts. Each of us have separate and unique ITunes accounts. How do we share our music libraries using Home Sharing? Everything that I can find talks about sharing between networked computers, but this is all on the same computer. I just want to share between ITunes accounts. Thanks!

Hi b noir, I also have two users on one pc with two different iTunes libraries. But I also want to put them onto an external hard drive so that I can free up some memory on the pc. So I figure I need to consolidate the two users iTunes libraries first before moving to hard drive? But not quite sure how to do that on the iTunes 11? Thanking you in advance!!

How do i set the proxy user in FF 3.6.13, this entry was existing earlier its gone now. using IE with entries in user account pwds works while FF doesn't.

How do i set the proxy user in FF 3.6.13.
previous versions had an entry for proxy user.
its gone now.
using IE with entries in user account pwds works while FF doesn't.
too bad have to change back to IE :-(

You can find the connection settings in Tools > Options > Advanced : Network : Connection
See "Firefox connection settings":
*[[Firefox cannot load websites but other programs can]]

Can I chat between 2 computers with one mobile me account?

Hi everyone-I have one mobile me account. I want to video chat with a computer at home from my MacBook Pro while out of town. Can I do this with one mobile me account? If so how? Or do I need to buy another mobile me account?
Thanks-Ray

You will need another account.
Free one here
Or a free AIM screen name here http://dashboard.aim.com/aim click on free screen name top right.

Types and graphics displayed incorrect in Safari with a second User account

With my own user account (Admin) Safari works very well. With the second user account I have problems to display Websites correctly. They are only displayed in capital letters and graphics are not loaded. At first I was thinking it depends on the administration authorization or a Java Update. But either doesn't change anything.
In the meantime I install Firefox 3.0 and the same problem...
Please help me - it is such %*#
Thank you very much!

Place this folder with Word documents located in your Home folder/directory in the Shared folder for your user account at Home > Shared and this employee can do the same when wanting to share a folder or documents with you.
After doing so, this folder with Word documents will be available in this user's Shared folder when the user logs in to their account.
The Shared and Public folders let you share files with other people.
The Shared folder is located in the Users folder on your hard disk. You can use it to share files with other users on your computer. The Shared folder is set up with Read & Write permissions so that all users can open the files in this folder and copy files to the folder.
Use your personal Public folder inside your home folder to share files with other people on the network. To share information in your Public folder, you must turn on Personal File Sharing in the Sharing pane of System Preferences. Your Public folder is set up with "Read only" permissions that allow others to see and copy its contents, but not change the content.
Your Public folder also contains a Drop Box folder, which is set up so other people can copy files to your Drop Box, but they cannot see its contents.

E-pub books: when I click on a book to read it, this message appears: "This item was originally downloaded with a different user account or Adobe ID. To continue, please add that account."

I incorrectly replaced the backup for my iPad2 by accident when I tried to retrieve it to my new iPad Air. It now no longer exists.
I can still see the icons of the books on Kalahari's reader. (Kalahari is an e-pub bookshop in South Africa.
When I click on a book to read it, this message appears: "This item was originally downloaded with a different user account or Adobe ID. To continue, please add that account."
I know for certain that the Adobe ID (e-mail address) is still correct. See below. The password seems to be the problem. This appears to have been changed a few times over the past two and a half years. Which one? Was hoping Adobe could help. (case number: 0214089318)
Can anyone please assist me to get back on track, what should I do to open and read my e-pub books again?
Much appreciated.
Leon Fisher
Johannesburg
South Africa
[email protected]

Hi I have the exact same issue.
Someone please post a solution...

TC with Access via User Accounts

Hi all folks,
I start using a new TC (2TB with 7.5.1) with access via User Accounts switched on, but it confuses me a little. In general I'm interesting in storing some more data to the TC, also I'm interesting in using seperate folder/mountpoints.
I add some User Accounts (I used the short names from my Mac, for example lutz, test, work, gast and admin) and every User can logon/connect to the TC, with a User Folder and a "Data" Folder, but admin can't connect to the User Folder.
All the time I try to logon/connect with the admin User, I can mount the "Data" Folder, but I can't mount the "admin" Folder (but the folder is shown).
In the Mac Syslog I find,
/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder[111]:
NetworkNode::handleMountCallBack returned -6602
I got a box with,
The operation cannot be completed because the original item for "admin" cannot be found.
And in the TC Syslog I find,
Syslog Protocol 6 - All Information
Nov 18 00:16:54 Gewichtung: 5 AFP login OK from [email protected].
Nov 18 00:16:57 Gewichtung: 5 AFP session from [email protected] closing.
Nov 18 00:16:58 Gewichtung: 5 AFP login OK from [email protected].
Nov 18 00:18:03 Gewichtung: 3 No Address for NTP server time.euro.apple.com.
I got folders like this, "lutz" and "Data" and both are empty.
From the admin Point of view the "Data" Folder looks like this and the "admin" folder can't connect too.
"Data"
"Data/Shared"
"Data/Users"
"Data/Users/lutz"
"Data/Users/test"
"Data/Users/gast"
"Data/Users/work"
"Data/MacBook.sparesbundle"
"Data/PowerBook.sparesbundle"
My question, is "admin" an TC internal User too?
What's the reason I can't mount the "admin" Folder and why I got a complete view to the TC filesystem with the "admin" User only?
It's nice to see this, but what's the reason!
How to add some more Shared folder for data exchange?!
Any idea what's happend,
thanks for any help, I can't find any information about this behavior,
Lutz
p.s.
The password from the User Account definitions are ignored for the "admin" user, the TC Password is used all the time.
p.s.
I read "http://web.me.com/pondini/Time_Machine/FAQ.html", too.

Hi all folks,
anyone who spend some time to add an User Account named "admin" to a TC and try to logon/connect to the TC with this user.
If someone try to do this, don't use the same password for "admin" and the TC itself, but try to logon/connect with "admin" to the TC with the defined passwords, both. I can connect "admin" to the TC with the TC password only, not with the password defined via User Account.
Thanks for any help,
Lutz

When I click on a book to read it, this message appears: "This item was originally downloaded with a different user account or Adobe ID. To continue, please add that account."

I incorrectly replaced the backup for my iPad2 by accident when I tried to retrieve it to my new iPad Air. It now no longer exists.
I can still see the icons of the books on Kalahari's reader. (Kalahari is an e-pub bookshop in South Africa.
When I click on a book to read it, this message appears: "This item was originally downloaded with a different user account or Adobe ID. To continue, please add that account."
I know for certain that the Adobe ID (e-mail address) is still correct. See below. The password seems to be the problem. This appears to have been changed a few times over the past two and a half years. Which one? Was hoping Adobe could help. (case number: 0214089318)
Can anyone please assist me to get back on track, what should I do to open and read my e-pub books again?
Much appreciated.
Leon Fisher
Johannesburg
South Africa
[email protected]

Hi I have the exact same issue.
Someone please post a solution...

HT1386 synced with a another user account

When I tried to re-sync my iPhone 4S in iTunes and I click the boxes to sync contacts and calendar I get a message saying that this is synced with a another user account. I only know about one account I have which I used to sync this up before any help please

This issue has been around for literally years and apple unfortunately seems to be doing nothing about it. The only way to solve it is literally to back up all of the information on your iphone. Wipe it and start again. If anyone at apple would like to give us a better way to do it please do!

Problems with Adobe CS5 on mobile user accounts

Hello Everyone,
I'm a high school web design teacher and I’m having trouble getting Adobe CS5 to run on my student workstations when they are logged in as a “mobile” user.
Workstation 10.5.8
Server 10.4.9
Workgroup manager 10.5.3
Students can browse the web, use Microsoft products and everything else. They are only having trouble with CS5. If I log into the workstation as “administrator” I can use any Adobe product without problems.
Any Ideas?
Thanks,
Todd

First thing I would suggest is to upgrade your server OS to a newer version if possible. Secondly try removing the apps out of the allowable apps list and instead change it so that you allow the apps that are within the specific application folder, ex: Applications/Adobe Photoshop CS5
I had similar problems with CS5 apps and by adding the apps by allowable folder instead it corrected my problem. Granted, if you have savvy users, there is the potential to open a can of worms here but it was the only way I could get it to work for "standard" non-admin user types.

How to create Mobile User Account

Hi all,
I have a dumb question but it makes me crazy !!!
I'm new in CRM 5.2 and in mobile as weel.
My question is : How to create a user acount into my mobile infrastructure ?
I've followed the following explanation but I don't find the solution :
[help|http://help.sap.com/saphelp_crm60/helpdata/de/c8/2ae1a3c73245c8aef8c4b69c2ff072/content.htm]
In there, it tells me to go thought User Management tool of Mobile Application Studio ( is it Microsoft Visual Studio ?) but in there i do not find any tools.
Thanks for your future help
Regards

hi,
Creation of User Accounts
Purpose
This process describes the steps required to create user accounts for secured and controlled access to the Mobile Application Repository (MAR). User accounts are created for consultants, who intend to customize mobile client applications using Mobile Application Studio (MAS). User account allows a consultant to log on to MAS.
Process Flow
       1.      During the installation of MAR, the system enables the User Management feature.
If MAR is upgraded from a release prior to 3.0 to the current release, the User Management feature must be enabled manually by system administrator. This is done by changing the umfrc parameter value to YES in the ARS_SYSTABLE.
       2.      The CRM technical administrator creates a DSN to access MAR by using the default internal login arsdb with password arsdb.
       3.      The CRM technical administrator carries out the following tasks using the User Manager tool of MAS:
                            a.      Creates user accounts.
                            b.      Associates each user account with a standard MAR profile. For more information, see Profiles of the Mobile Application Repository.
                            c.      Specifies a password for each user account.
Login IDs of the Mobile Application Repository
Definition
A login ID is a source through which users log on to Mobile Application Studio, and connect to the Mobile Application Repository (MAR). When MAR is installed, standard login IDs are available by default. While creating user accounts, the system administrator associates a standard login ID with the profile of each user account.
Structure
Login ID
Allows you to:
ARSAdmin
·        Perform administrative activities in MAR.
·        Create and modify development objects in MAR.
·        Modify the password of a user account.
ARSDeveloper
·        Create and modify development objects in MAR.
·        Modify your own password.
ARSUser
·        View development objects in MAR.
·        Modify your own password.
ARSSys
·        Get information about the MAR.
·        Validate MAR users.
ARSdb
Create a DSN for MAR. The default password for this login is arsdb.
Profiles of the Mobile Application Repository
Definition
A profile of the Mobile Application Repository (MAR) is a collection of access rights defined for:
·        Development objects, like tiles, tile sets and business objects of mobile client applications
·        Services of MAR like change lists and namespaces
Structure
The standard profiles that are available are listed below.
Profile name
Associated login ID
Allows you to:
Administrator
ARSAdmin
·        Perform administrative activities like creating and maintaining users.
·        Read and write repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Release and revert a change list.
·        Transfer the ownership of objects to another MAR.
·        Create link objects to integrate tile set help.
·        Create and modify framework objects in MAR.
ROGuest
ARSUser
·        View development objects in MAR.
·        Modify your own password.
Developer
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Release change lists that have been created only by you.
·        Modify your own password.
·        Transfer the ownership of objects to another MAR.
SPDeveloper
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Modify your own password.
·        Create and modify development objects in MAR.
This profile does not allow you to release change lists.
QMResponsible
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Modify your own password.
·        Transfer the ownership of objects to another MAR.
·        Release and revert change lists.
This profile does not allow you to create a change list.
Coordinator
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Release and revert change lists.
·        Modify your own password.
·        Transfer the ownership of objects to another MAR.
Frwkuser
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Release the change list you have created.
·        Transfer the ownership of objects to another MAR.
·        Create and modify framework objects in MAR.
Infodeveloper
ARSDeveloper
·        Read repository specific information (ARS_SYSTABLE).
·        Create and modify development objects in MAR.
·        Release the change list you have created.
·        Create link objects to integrate tile set help.
thanks
karthik
ifhelpfull reward me some points

One iTunes account with 2 separate user accounts?

I'm trying to figure out how to set up my daughter since we're upgrading her from an iPod Touch to an iPhone minus the phone (my hubby got a new iPhone 4S and she's getting his 3GS but it's got no phone contract so it works like a larger, more souped up iPod Touch!)
I initially wanted to start her on her own iTunes account from now on to make it clean and get her going on iCloud with her own stuff. But, from what I've read, there may be an advantage to keeping her on my iTunes account for now since she won't really be making any independent purchases without my approval. That said, I'm not exactly crazy about her syncing to my iTunes library all the time - and I definitely don't want her photo stream!
Is there a way to establish TWO user accounts on my iMac which would lead to TWO iTunes and iPhoto libraries (I think?) but use ONE iTunes account for both of them?
I've read through the help but most seems to be going the other direction - (2 itunes accounts, 1 library).
Thanks for the help -
Alexa

You can't split the accounts. Purchased items stay authorized with the account it was purchased on. Really, the only thing you can do is keep your libraries separate and use them that way, or create an account for her, put your purchases in her account and authorize her device(s) to use your apple ID. I've done that with my library; my boyfriend and I share the same library with two different accounts and each of our devices are authorized to play one anothers purchases.
Sorry there's no better way I can think of. I'd like to split our libraries.... I wish Apple would create a feature keeping in mind that people buy new PCs and that family members move and get old enough for their own account, etc. :/

10.7.2 with AD Mobile User Accounts

Similar Messages

Maybe you are looking for