Directory Access and Permissions

Question

Hi,
I work at a company that's having a problem setting up the new macs (Core 2 Duo iMac 24") our marketing department just ordered.
The rest of our network uses windows, so we have active directory logins for everyone. We've setup the Directory Access on the new iMacs so that marketing users log in using their AD username and pw. The local user account that 10.4 generates is set to be a local admin, but the users are just normal users in AD.
The problem we're having is with setting permissions for some Apps that require changes from the default settings. When I go to set permissions in the Info pane of a folder or app, I open the pull down menu for 'Owner' and go to 'Other...' at the bottom to grab the user from AD (because the user is not available in the top portion where local users can normally be selected). This is where the problem occurs. This opens up the "User Listing" box, which contains a long list of AD usernames, but does not have any AD usernames that were created less than 10 months ago. I checked with my Network Admin, and virtually no settings in terms of creating AD users have changed in the last two years.
I don't know if this is a problem with settings on the AD side or the Mac side, but here's the Mac settings in Directory Access:
+Services: AD is checked+
+Authentication: Custom path selected, our domain is in the list+
+Contacts: Same as Authentication+
+Under AD:+
+Forest and Domain are correct, computer is bound correctly.+
+User Experience:+
+Create mobile account is not selected.+
+Force local home directory on startup is selected.+
+Use UNC path from AD... is selected, smb: is selected as Network protocol.+
+Default user shell is selected as '/bin/bash'+
+Mappings: Nothing selected.+
Administrative:
+Prefer this domain server is checked and correct for our network+
+Allow administration by is checked, domain admins and enterprise admins+
+Allow authentication from any domain in the forest is selected+
Is there anything in these settings that might cause the problem described above, or is the problem something else entirely, maybe on the AD side?
I'm also wondering if anyone knows how to find out where Directory Access is grabbing this list of users from. Perhaps our Network Admin can find out what the problem is given that info.
Thanks,
Gabe
Message was edited by: Gabe Stein

Answer 1

I have exactly the same problem and ProtectHome wasn't the solution. "sudo minidlnad" works fine -- TV shows root and /home/blah/blah is accessible. However, I'm not able to make the daemon run as root. Just for testing purposes, I've made all the settings as loose as possible, but TV stills shows minidlna as username and the folder is not available (systemctl status reveals permission denied).
minidlna.service:
[Unit]
Description=minidlna server
After=network.target
[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/bin/minidlnad -S
ProtectSystem=off
ProtectHome=off
PrivateDevices=on
NoNewPrivileges=off
[Install]
WantedBy=multi-user.target
minidlna.conf:
user=root
media_dir=/home/blah/blah
What am I missing here? No possibility to run minidlna as root after the last update any more?
Edit:
Never mind. During all this testing I had forgotten "User=minidlna" to /etc/systemd/system/minidlna.service.d/override.conf. Daemon as root works after removing that line.
Last edited by riivo (2015-03-19 14:38:18)