Binding to OD (10.5.2) adds Computer accounts with client realm names

After applying “security Update 2008-002 v1.1 Server (leopard)” to a server running 10.5.2, clients were bumped from binding.
When I re-bind to OD, 2 new entries show up in computer accounts, one is the FQDN,( e.g., labtable6.physicslabs.uri.edu), the other is a Realm name (e.g. LKDC:SHA1.03344892C418CB16C250B59EAA7F93FEF79EF257.
Not only that, but in the list of principles in the Kerberos database, 2 entries for each machine are added to each service (e.g.,
afpserver/[email protected]
and
afpserver/LKDC:[email protected] ABS.URI.EDU.
Everything runs OK but I have to connect again to get AFP shares, but I cannot reconnect from the sidebar in finder, only from the Go menu, or a command.
All names in the DNS and Reverse IP lookups Resolve OK.
Has this happened to anyone else? I can fix the double entry in the computer accounts by just deleting the realm name, but I’m a bit worried about the double entry in the KDC.

Follow up
I used:
sso_util to remove the KDC on clients and
Kadmin to remove multiple entries in the KDC of the server.
Broke the bind (or whatever you call it) and bind again, no second entry in either Workgroup Manager’s Computer Accounts and no multiple service principles on the server’s KDC.
The following sight were helpful on this issue
http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc
http://www.netmojo.ca/blog/2008/01/30/tiger-to-leopard-server-migration-part-fou r/
http://web.mit.edu/macdev/KfM/KerberosClients/KerberosApp/Documentation/using-os x.html#startup
I guess when I was installing Leopard LDAP I was using Tiger manuals and didn’t know about the “Back to My Mac” stuff.
My mistake:,the other issue with the finder sidebar is something different see:
http://discussions.apple.com/thread.jspa?messageID=5698233
Onward through the fog.

Similar Messages

SCCM 2007 OSD to add computer account to domain

Running SCCM 2007 R2 OSD to add computer account to domain has always been working, until recently after I added Intel 217/218 NIC drivers to the PE boot image.
The task sequence "Apply Network Settings" runs successfully though. It broke other TS steps too, such as enabling BitLocker, because, I guess, if the computer is not domain-joined, it won't be able to write recovery key to AD. I can use the same
network account to manually add the computer to domain. This doesn't seem to be a network issue, because the NIC drivers are applied, and software installation in the TS runs with no issue.
Here's the deployment log:
==============================[ OSDNetSettings.exe ]===========================
Command line: "osdnetsettings.exe" configure Setting %SystemRoot% to "D:\Windows"
Loading existing answer file "D:\Windows\panther\unattend\unattend.xml"
Configuring global network settings
Join type: 0 Joining domain: MyDomainName
Getting namespace "Microsoft-Windows-UnattendedJoin" for architecture "amd64"
DNS domain: DNS domain search order: IP filter sec enabled: false
No adapters found in environment.
Performing global configuration only.
Writing configuration information to D:\Windows\panther\unattend\unattend.xml
Successfully saved configuration information to D:\Windows\panther\unattend\unattend.xml
Configuring "OSDNetSettings.exe finalize" to run on first boot OSDNetSettings
finished: 0x00000000
Thanks and regards.

Running SCCM 2007 R2 OSD to add computer account to domain has always been working, until recently after I added Intel 217/218 NIC drivers to the PE boot image.
The task sequence "Apply Network Settings" runs successfully though. It broke other TS steps too, such as enabling BitLocker, because, I guess, if the computer is not domain-joined, it won't be able to write recovery key to AD. I can use the same
network account to manually add the computer to domain. This doesn't seem to be a network issue, because the NIC drivers are applied, and software installation in the TS runs with no issue.
Here's the deployment log:
==============================[ OSDNetSettings.exe ]===========================
Command line: "osdnetsettings.exe" configure Setting %SystemRoot% to "D:\Windows"
Loading existing answer file "D:\Windows\panther\unattend\unattend.xml"
Configuring global network settings
Join type: 0 Joining domain: MyDomainName
Getting namespace "Microsoft-Windows-UnattendedJoin" for architecture "amd64"
DNS domain: DNS domain search order: IP filter sec enabled: false
No adapters found in environment.
Performing global configuration only.
Writing configuration information to D:\Windows\panther\unattend\unattend.xml
Successfully saved configuration information to D:\Windows\panther\unattend\unattend.xml
Configuring "OSDNetSettings.exe finalize" to run on first boot OSDNetSettings
finished: 0x00000000
Thanks and regards.

Add computer account

I'm trying to add a computer account in workgroup manager but everything is grayed out.
Yes, I'm authenticated (as diradmin)
If I try to add it with the network view, it says that I'm not authorized to perform the operation.
What should I do ?

It would help to know which directory you were attempting to add the computer account to -- you can't add it to /NetInfo/DefaultLocalNode as far as I know. It should have been greyed out in that case.
If you had the LDAP directory selected and were authenticated as diradmin, then Workgroup Manager should have allowed you to create a machine account.

WPC: unable to add different resources with the same name into a WPC page

Hi,
I got a WPC problem when adding different KM resources with the same name into a WPC page. Only one KM resource is able to be added in WPC.
For example:
There two "article.html" with different content and RID:
1. /company_a/article.html
2. /company_b/article.html
when adding these two html pages into a WPC page, only one page will be shown.
This means that a WPC page is not able to contain resources with same file names. I think the problem might lie on the resource-linking mechanism of WPC. WPC will add a resource link in the page folder, when a new resource is drag&dropped into WPC.
Anyone has some good ideas to solve my problem? Thanks a lot.
Regards
Lei NING
Edited by: Lei NING on Apr 15, 2008 4:16 PM

As this is not possible and double entries cause this problem, why not just pu both napes in the contact details on the same number. IE John Smith & Peter Jones all in the first name, by doing this if you search your contacts either by searching for john, peter, smith or jones the number will show up and if either calls the number will show John Smith & Peter Jones, it may not be perfect but will work. As the phone only recognises a number if two seperate entries of the number exist with different names it cannot possibly know who is calling ?
If I have helped at all, a click on the White Star is always appreciated :
you can also help others by marking 'accept as solution'

Add Gmail account with custom domain to mail

Hi there,
I've added my standard Gmail account to the Mail app on my macbook air 2013 but i also have a school email from Google that I would like to add as well. This email uses a custom domain name so instead of [email protected] it would be [email protected] I've tried to add it in as a google account and as 'other' but i can't seem to make it work. Would be much appreciated if someone could walk me through the steps.
If you have any questions let me know!

I finally figured out my workaround (I'm using Mavericks).
Go into Mail and Add Account. Then do what wubie317 says, select "Add other account" DO NOT select Google / Gmail.
You will then be asked to enter the mail server addresses for Gmail. The info is below. Good luck!
Incoming Mail (IMAP) Server - Requires SSL
imap.gmail.com
Port: 993
Requires SSL:Yes
Incoming Mail (POP3) Server - Requires SSL:
pop.gmail.com
Use SSL: Yes
Port: 995
Outgoing Mail (SMTP) Server - Requires TLS or SSL
smtp.gmail.com
Port: 465 or 587
Requires SSL: Yes
Requires authentication: Yes
Use same settings as incoming mail server
Full Name or Display Name: [your name]
Account Name or User Name: your full Gmail address ([email protected]). Google Apps users, please enter user...@your_domain.com
Email address: your full Gmail address ([email protected]) Google Apps users, please enter user...@your_domain.com
Password: your Gmail password

Add Gmail account with custom domain to mail, please show step by step instructions

a

I finally figured out my workaround (I'm using Mavericks).
Go into Mail and Add Account. Then do what wubie317 says, select "Add other account" DO NOT select Google / Gmail.
You will then be asked to enter the mail server addresses for Gmail. The info is below. Good luck!
Incoming Mail (IMAP) Server - Requires SSL
imap.gmail.com
Port: 993
Requires SSL:Yes
Incoming Mail (POP3) Server - Requires SSL:
pop.gmail.com
Use SSL: Yes
Port: 995
Outgoing Mail (SMTP) Server - Requires TLS or SSL
smtp.gmail.com
Port: 465 or 587
Requires SSL: Yes
Requires authentication: Yes
Use same settings as incoming mail server
Full Name or Display Name: [your name]
Account Name or User Name: your full Gmail address ([email protected]). Google Apps users, please enter user...@your_domain.com
Email address: your full Gmail address ([email protected]) Google Apps users, please enter user...@your_domain.com
Password: your Gmail password

How do I share a computer account with a network account?

So I've had my Macbook for about two years now, and up until now the only account I've had is the one I initially set up for myself. This year for school I had to set up my computer so that I could log into it via a network account. This required me to rename the computer, install an approved school antivirus (kinda unnecessary on a Mac, but whatever), and then set up a new account on my computer, which when connected to the college network, I would be able to log in to. So my problem is that even though I set up that new account as an administrator account, I cannot access any of the files on my original account. So when, for example, I want to run Parallels because the college's printer drivers are not Mac compatible and I want to be able to run the Virtual Machine I already have set up on my other account so that I can install them... It doesn't have access to that virtual machine. I can't find my original Window's OS disk, so I would much rather just port over the Virtual Machine I already have than to buy it again. Does anyone know how to access my original account from a network account?

There are instructions for setting up home sharing on this page : http://support.apple.com/kb/HT4620
If you want to copy your content onto another computer then see this page : http://support.apple.com/kb/HT4527

You cannot add a job with a duplicate name, as a web service already exists with name ... please rename the job and try again

We are attempting to add a web service job and getting a duplicate name issue. I believe we have a caching issue where this job name may already exist but we are unable to see it on the web services status page.
Is there a data services repository database table where I can find these web services jobs listed and clean it up from the backend?

There is no option there that shows me if it is being used as a web service. Here is my issue with some screen shots.
I look at my current web service enabled jobs looking for B_JOB_CP_MDR_to_GW_EMP but it is not in the list.
I attempt to add it from repository DWXDS9
It throws an error and tells me there is already a web service with this name...
Now there has got to be an internal data services table somewhere that has this job listed as a web service. I am just trying to figure out what that table may be to determine if we can do some type of cleanup on it so we can add this job again as a web service (so it is visible to us).

AD Powershell Create Computer objects with space in name

Hi
I noticed this when som hardware technician added a new computer for deployment in my MDT/SCCM frontend application.
They by mistake entered a space character after the computername. The GUI way through DSA this does not work but in powershell it does.
Should it be like this?
New-ADComputer -Name "Testcomp3 " -SAMAccountName "Testcomp3 "

No need to be rude.
I've replicated this behavior and agree that this shouldn't be happening. You can always post a bug report on Connect:
https://connect.microsoft.com/
Don't retire TechNet! -
(Don't give up yet - 12,830+ strong and growing)

Unable to add Flickr account with facebook login

Hi,
rMBP upgraded yesterday to Mountain Lion...trying to add Flickr connection, using Facebook dropdown and I get a blank screen...is this working for anyone?
thanks!

Still no resolution on this but I stopped by an Apple Store and confirmed that the same happens on all their Retina MBP's with Mountain Lion installed but does work correctly on the regular MBP's.
I filed feedback with Apple and even called tech support but the call wasn't exactly fruitful. I assume we will have to wait until 10.8.1 for this to be fixed (hopefully not longer).
In the meantime I figured out how to disconnect my Facebook account from Flickr (although I'm not positive that I really had to) and log in with my Yahoo ID instead. I successfully setup Flickr in Mountain Lion using just my Yahoo ID.
The trickiest part for me was figuring out what my Yahoo ID and password were. Turns out it was just my Facebook login email and password.

CUOM - How to add IP address with hostname (device name)

Hello all,
I have a quick question regarding CUOM(Operation Manager).
How I could add devices' hostname to CUOM for monitoring?
I could add IP address as below , if I only add IP address, then it looks NO "device name' field which I could add.
Devices ->Device Management->Add Devices
Thank you for your help in advance.
Howard

It is resolved by updating host file on CUOM server.

Add second account with different apple ID to match

Hi All
I am the main household user and have a large libary of tracks that also synronise with a home server and contant is pulled onto windows media centre.
(before anyone asks about changing to apple tv, i would if it supported live tv from a freeview tuner)
Anyway my wife is now the proud owner of both a ipad and my old iphone
Now the questions start as she wants access to music
I would like to keep her away from a pc (itunes) just to manage tracks
1. As it slightly combersum to manage two libaries using 1 pool of data from the server
2. Manage 2 pools of data and 2 libaries so to avoid she will delete or modify something and keeping these pools in sync
I thought that the answer would be to upload everythig to match and then she would be stream everthing in the libary or download selected tracks when she is away from wifi. I have now done this and all my content is on match
She is a new user, so she has a different apple ID to my own
I read a bit and now totally confused with the method to allow this
We share bank accounts so i not worried that she will use my id or something like that
Do i just have to replace her apple id in the icloud setting on ios device to mine or is there more to do?
She has almost no paid for content so i dont care about losing a few tracks she has purchased
I slightly worried as i keep hearing about the 90 day lockout if you change id again
Thanks and if someone can post some idiot proof guidlines i woujld be grateful
Ads

Hi plonk
Thanks for the reply
Not really. Our music selections is ours not locked to the individual. I should be able to share my music like home sharing locked to my house. This would mean I would have to buy tracks more ore than once.
I could share my tracks if I connected to my iTunes account with a pc but don't due to the above.
So if my two children grow up they have to also buy the same track?
I could understand the music companies wanting this but it's never going to happen in a million years
Did I just blow £25 on something that sort of works but not really
I could understand if I gave my id to a friend but would you give your id when they could purchase a ton of stuff on your account. Flawed logic is this is really the case.
As I said before I don't really want to just try what happens as I be locked out for 90 days swapping back
Mail is not on in cloud but others things like contacts etc are
Anyone?
Am I the only one asking for this?

When trying to add email account it says "user name or imap password are incorrect"

Username is correct, what is the imap password? How do I solve this?

The problem is that either your user ID or password is incorrect. You may be entering the username without the domain (@domain.com) and it requires it, or you have included it ([email protected]) and it doesn't permit it. If it's IMAP it's possible that the outgoing mail server has a different password from the incoming. BTW, did you enter the userid and password for BOTH the incoming and outgoing servers? The outgoing is usually required also, even though the iphone says "optional". It's only optional to the phone itself, usually not to the email provider.

2008 Failover cluster unable to create computer account

Hello,
I have created a 2008 R2 Failover cluster and I am trying to add a Fail over File server to this.
I get the dreaded
Cluster network name resource 'OfMaClusterFS' failed to create its associated computer object in domain 'xxx.domain' for the following reason: Unable to create computer account.
The text for the associated error code is: Access is denied.
Please work with your domain administrator to ensure that:
- The cluster identity 'OFMACLUSTER$' can create computer objects. By default all computer objects are created in the 'Computers' container; consult the domain administrator if this location has been changed.
- The quota for computer objects has not been reached.
- If there is an existing computer object, verify the Cluster Identity 'OFMACLUSTER$' has 'Full Control' permission to that computer object using the Active Directory Users and Computers tool.
I have created clusters frequently in the past, on my own Domains that I am a domain admin of. Now I am trying to make one on our larger corporate domain that I am not a domain admin of and get this error.
By default, domain users can not add computer accounts to our domain. I do however have an limited account that can add computers to the domain... but I have tried all the tricks I can think of to try and add the Network name to AD and no luck.#
I have tried running the cluster service with this account, but it is still trying to use the OFMACLUSTER$ identity to create the Network name. I have tried manually creating the network name using my limited account, but that doesn't work either,
same error. I don't have the ability to change permissions on the computer name I added for the network name to AD.
I have raised a ticket to our wintel team to try and get them to help, but they aren't exactly the most responsive bunch. I'm just wondering what the best way around this problem is if I am not a domain admin and I can't make the changes I need, or
what concise instructions I can give to the domain admins so that they can help me out without saying that it is a security breach etc.
I would appreciate any advice on this as it's now urgent and also something I will have to do in the future fairly regularly and don't want to get caught in the situation in the future.

Hi jogdial,
To create a cluster, the minimum permission is: Requires administrative permissions on the servers that will become cluster nodes. Also requires
Create Computer objects and Read All Properties permissions in the container that is used for computer accounts in the domain.
If you create the cluster name account (cluster name object) before creating the cluster—that is, prestage the account—you must give it the
Create Computer objects and Read All Properties permissions in the container that is used for computer accounts in the domain. You must also disable the account, and give
Full Control of it to the account that will be used by the administrator who installs the cluster.
The related KB:
Failover Cluster Step-by-Step Guide: Configuring Accounts in Active Directory
http://technet.microsoft.com/en-us/library/cc731002(v=ws.10).aspx
More information:
How to Create a Cluster in a Restrictive Active Directory Environment
http://blogs.msdn.com/b/clustering/archive/2012/03/30/10289577.aspx
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Many UnApproved and Duplicated Computer Accounts

Hello everybody,
I wish that everything is great for you!
I have a client with a problematic ConfigMgr 2012 R2 RTM environment, among the different problems the two big ones (and the ones that I think if resolved the resolving of the remaining would be easy) are:
1- Most of the computer accounts that had the client installed and were working probably, suddenly become Unapproved. the customer deployed Symantec EndPoint Protection since two weeks, the Symantec policy has no changes to the firewall and he didn't change
any firewall rules since.
today, while troubleshooting the agent still exist on the machine but with only two actions and the status on the ConfigMgr Console differ from Active and unapproved to No Client. the only solution that worked for me is to manually approve the computer then
push the agent to it. this method worked on two test computers, before I go further I just wanted to know why this happen.
Note: the manual approve then push the agent happened while Symantec inplace and the agent installed successfully.
I tried the clientlocation, locationservices, clientstartupIDmanager, and CCMEXEC log files and they all clear.
2- the second problem is that the customer have about 30 duplicated computer (names), I tried the different solution s I've found on the internet, and no one worked for me, even the delete of all records regenerate 2 accounts with the same name, also tried
to delete the one with the old discovery date, or the one with no client and also the deleted record comes back again
3- the third issue wich i think is related to the second one is that computer accounts that exist on the ConfigMgr but have been deleted from the AD and DNS, after manully deleting those records from the ConfigMgr they appear again
thanks in advanced.

Check that from Symantec you've excluded the proper ConfigMgr client directories, registry keys and services.
Another test, un-manage a few clients from Symantec and see if the problem persists.
Regarding the duplicate computer names, and DNS, check that you've got DNS scavenging enabled for DNS. For some background on that: https://stevethompsonmvp.wordpress.com/2015/02/25/configmgr-why-you-need-to-implement-dns-scavenging/

Binding to OD (10.5.2) adds Computer accounts with client realm names

Similar Messages

Maybe you are looking for