Local Kerberos realm while bound to AD

I installed 10.5.7 on a year old Xserve (on a freshly initialized disk) and set it up as a stand alone server. Following Bombich's guide, I then bound it to our local AD domain and made sure AD accounts could log in. This went just fine. I then promoted it to a OD Master. This also appeared to go fine. But according to the Open Directory overview in Server Admin, kerberos is still running and the kerberos realm is the FQDN of my Xserve. It was my impression that when a server, already bound to AD, was made an OD Master the KDC from the local AD domain was used. Somehow the system "just knows" to do that.
klist shows the proper AD KDC. Any tickets that get issued reflect the proper AD KDC, I don't see my Xserve realm listed anywhere. I've run dsconfigad -enableSSO and it appears to be successful. When I run:
defaults read /Library/Preferences/com.apple.AppleFileServer kerberosPrincipal
it returns:
afpserver/[email protected]
But the results from klist -ke confuse me. I see 3 entries per service in 2 distinct sections. the first section of entries look like, for example:
afpserver/[email protected]
but then there's another section with 3 entries per service that read:
afpserver/[email protected]
So does this mean my Xserve is actually functioning as a kerberos server? Is Server Admin correct? Why would it report that kerberos is running and my server is in it's own kerberos realm if it wasn't? Do I need to unbind, revert back to standalone and start over?
Apologies for the long post. Hopefully this made sense.
Thanks,
Phen

This is normal behavior. You should bind some Macs to AD and OD and then setup some WGM groups to test things out. From what you reported, you should be okay.

Similar Messages

How do you use an external MIT Kerberos realm for authentication in 10.4?

Does anyone have experience with OS X Server 10.4.x Open Directory and using a "third-party" KDCs for authentication?
I have four 10.4.5 XServes that form a SAN (Xsan). I am using a common Open Directory domain that consists of about 100 users to manage access to the SAN file space. I have one of the servers set up as OD master and a second as a failover.
My university has a kerberos realm that includes all university staff and students. I would like to use that KDC for authentication, not create my own KDC on the OD Master.
The SAN is only being used to support network file services, not as work stations. The users are going to mount file space on their local machines through AFP, Samba, or via ssh at the command line.
All of the users' short names are identical to their principle names in the University kerberos realm.
All of the Apple documentation assumes that in the OD Master will be the KDC for the OD, and part of the setup involves starting up the Kerberos KDC on the OD master system. There is mention of using any MIT Kerberos KDC, but I cannot for the life of me find where that is documented.
I have tried using the Server Admin interface and the "Join Kerberos . . . " tool, but when I enter the principle and password, the realm name and the DNS of the KDC it always fails with "error creating the keytab file."
I have also tried just putting a valid edu.mit.kerberos file /Library/ Preferences and creating a keytab file in the realm I want to join, and putting that at /etc/krb5.keytab in each of the servers in OD domain, but that doesn't seem to work, either.
Has anyone else been successful doing this with OS X Server 10.4.x?

Leland,
Thanks for your suggestions. I need a little more
guidance though. Can you explain how to do step one?
1) on your OD Master, using workgroup manager edit
the KerberosClient record and add the correct kdc
info to the XMLPlist attribute.
Is this done on the "Inspector" tab of the Work Group
manager for the user record for the principle that is
in the KDC? Exactly which key value pair do I need to
edit?
No, use the "Inspector" tab to look at config records, you will find the KerberosClient & KerberosKDC records in that list.
Select the XMLPlist attribute and edit it.
Look for the realms dictionary and either replace the existing entry with the correct realm info or add a new entry for the realm.
The important keys are KADM_List & KDC_List.
You should also look at the domain_realm dictionary and make sure that
also has the correct info.
Look at the kerberos admin guide at
<http://web.mit.edu/kerberos/www/krb5-1.4/krb5-1.4.3/doc/krb5-admin/krb5.conf.ht ml#krb5.conf>
for an idea of what the sections mean.
2) from the command line on a server run (as
root):
sso_util configure -r FOO.EDU -a kdcadmin -p
kdcadmin_pw -v 4 all
I would do this on each server in the OD, correct?
yes, this step creates the service principals for the servers in the kdc, exports the info to the local keytab, and configures the services to use kerberos (so that they know their service principals)
you might need to modify the
AuthenticationAuthority
entry for each user to point at the proper realm.
Is this also done in the "Inspector" tab for each
user's record in Work Group Manager?
yes
Thanks again for the suggestions.
Glad to be able to help
- Leland
DP G4 Mac OS X (10.4.2)

Kinit: Client not found in Kerberos database while getting initial credentials

Hi all,
I am trying to configure application which uses Kerberos authentication.
Error message:
kinit: Client not found in Kerberos database while getting initial credentials
I use Windows Server 2003 domain controller as LDAP server, Tomcat application (on Linux) and IIS application as client, and apache load balancer.
There is multidomain environment: russia.domain.net, europa.domain.net, asia.domain.net;
Tomcat and IIS servers works behind a proxy server (Apache on Linux).
For applications created two DNS records type A. all DNS use IP address of Apache proxy server:
application-sandbox.russia.domain.net
applicationweb-sandbox.russia.domain.net
To confiure kerberos authentication i have performed the following steps:
1. Create user account in EUROPA domain and configure delegation for this:
EUROPE\application_sandbox
2. Register SPN for this account:
setspn -A HTTP/application-sandbox.russia.domain.net EUROPE\application_sandbox
setspn -A HTTP/application-sandbox EUROPE\application_sandbox
3. After i verified registered SPN for this account:
setspn.exe -L EUROPE\application_sandbox
Registered ServicePrincipalNames for CN=kxxb999,OU=Users,DC=europe,DC=domain,DC=net:
HTTP/application-sandbox
HTTP/application-sandbox.russia.domain.net
3. After i generate a keytab file:
ktpass /princ HTTP/application-sandbox.russia.domain.net:@RUSSIA.DOMAIN.NET /ptype krb5_nt_principal /crypto rc4-hmac-nt /mapuser EUROPE\application_sandbox /out application_sandbox.keytab -kvno 0 /pass Pa$$w0rd
4. Properties of account looks like the following:
Get-ADUser -Identity appication_sandbox -Properties CN, ServicePrincipalNames, UserPrincipalName
CN : kxxb999
DistinguishedName : CN=kxxb999,OU=Users,DC=europe,DC=domain,DC=net
Enabled : True
GivenName :
Name : kxxb999
ObjectClass : user
SamAccountName : application_sandbox
ServicePrincipalNames : {HTTP/application-sandbox, HTTP/application-sandbox.russia.domain.net}
Surname : application_sandbox
UserPrincipalName : HTTP/[email protected]
4.Note that CN and User logon name are different. SPN registered for DNS record.
There are no computer in domain with name application-sandbox.russia.domain.net. this is a DNS record for application.
5. Then i copy keytab file to Linux machine, configure krb5.conf file and trying to get TGT for registered principal name.
krb5.conf file:
[libdefaults]
default_realm = EUROPE.DOMAIN.NET
dns_lookup_realm = false
dns_lookup_kdc = false
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[realms]
RUSSIA.DOMAIN.NET = {
kdc = dc01.russia.domain.net
admin_server = dc01.russia.domain.net
default_domain = russia.domain.net
EUROPE.DOMAIN.NET = {
kdc = dc01.europe.domain.net
admin_server = dc01.europe.domain.net
default_domain = europe.domain.net
[domain_realm]
europe.domain.net = EUROPE.DOMAIN.NET
.europe.domain.net = EUROPE.DOMAIN.NET
russia.domain.net = RUSSIA.DOMAIN.NET
.russia.domain.net = RUSSIA.DOMAIN.NET
[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true
Then i verified created keytab file:
klist -e -k -t application_sandbox.keytab
Keytab name: FILE:application_sandbox.keytab
KVNO Timestamp Principal
0 01/01/70 01:00:00 HTTP/[email protected] (arcfour-hmac)
And trying to get TGT ticket:
kinit -V -k -t application_sandbox.keytab HTTP/[email protected]
Using default cache: /tmp/krb5cc_0
Using principal: HTTP/[email protected]
Using keytab: application_sandbox.keytab
kinit: Client not found in Kerberos database while getting initial credentials
But if i use SamAccountName name with kinit commant then i can aquire TGT ticket:
[root@localhost security]# kinit application_sandbox
Password for [email protected]:
[root@localhost security]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
06/30/14 16:37:41 07/01/14 02:37:38 krbtgt/[email protected]
renew until 07/01/14 16:37:41
I'm in trouble. can anyone faced this problem?
Thank you

Hi all,
according to Amy answer I thought, how user principal could not be found in Kerberos database, e.g AD domain.
My HTTP service works in RUSSIA domain, but user principal created in EUROPE domain.
Next, i have checked my ktpass command:
ktpass /princ HTTP/[email protected] /ptype krb5_nt_principal /crypto rc4-hmac-nt /mapuser EUROPE\application_sandbox /out application_sandbox.keytab -kvno 0 /pass
Pa$$w0rd
especially the following parameters:
/princ HTTP/[email protected]
/mapuser EUROPE\application_sandbox
When generating keytab it changes userlogon name to HTTP/application-sandbox.russia.domain.net and set domain domain to RUSSIA.DOMAIN.NET
But no user principal with name application_sandbox in RUSSIA.DOMAIN.NET domain (e.g. Kerberos realm)
So solution is change RUSSIA.DOMAIN.NET to EUROPE.DOMAIN.NAME in ktpass command.
After that i am able to get TGT and authenticate in domain.

Kerberos Realm - OD Master or AD server?

Hi,
When implementing a dual directory or golden triangle does it matter which server is the Kerberos Realm? some docs I have read say the OD master kerberos should be stopped and the AD domain handle Kerberos.
Please advise as I am confused with this.
OSX server 10.6.7 Mac clients 10.6.7 and 2008 domain
diradmin and local admin are only users IN OD. all other users are from AD using the AD plugin.
TIA

Thanks for the reply. I have inherited a system whereby the OD master is the kerberos realm. What puzzles me is that everything works fine. Ad users log in, get their AD mounted home dir. They also have access to several AFP share points, wiki and blogs work, and macs are locked down using WGM. So I'm interested to learn what you actually achieve by setting AD as the Kerberos realm.
I have also yet to find a manual or diocumentation that explains the pros and cons, so I would be grateful if you can tell me which manual you are referring to.

Windows 8 - user login and Kerberos Realm problems.

Hi,
Just installed Windows 8 Enterprise x64 from our MDT into our production enviroment for some final testing. I have done this with both Consumer and the Release Preview just to make sure our infrastructure can support user that want to run Windows 8 (Win
7 Enterprise will still be the default OS for our client desktops).
The problem I reported here with the Consumer Preview
http://social.technet.microsoft.com/Forums/en-US/W8ITProPreRel/thread/069f59be-b89c-4005-8cd2-ff5fd756825a is still alive and kicking.
Logon after fresh reboot. (Windows 8)
Username: XWYZ
Password: *********
Sign in to: "OURKERBEROSREALM.SE"
We authenticate all our users with our Kerberos Realm and in our AD's all user passwords are random dummy placeholders, and are linked to the Kerberos realm.
When a user lock their computer, or put it in sleep mode, they should see this at their login.
XWYZ (their full name)
"OURKERBEROSREALM.SE\XWYZ(their username)
Locked
Password: ********
But it does not show this… it shows:
XWYZ (their full name)
WINDOWS DOMAIN NAME\XWYZ(their username)
Locked
Password: ********
This meens that when they want to unlock their desktop, or login after sleep, it will try and authenticate their login on the domain AD and not the Kerberos realm. Howver if you choose to go back and select "other user" it defaults back to using "OURKERBEROSREALM.se"
as "Sign in to:" domain.
This worked flawlessly in XP, Vista and Windows 7, but not in Windows 8. Not having our Kerberos realm as default login in every scenario is kind of a bummer.

I had some brief time looking into this, and my awesome workbuddy found that you can poke about the keys found in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1
With the LastLoggedONSAMUser and LastLoggedOnUser values I changed from from "domain"\username to "kerberosrealm"\user, and when locking my computer or restating, I now have no need to choose "other user" every time I want to login again.
Atleast somewhere to start.

Chaning the OD Domain name (kerberos realm)

Hey folks,
Currently our OD domain is nsnet.com - we don't own that publically, but we use it internally. ... in retrospect, not a wise move.
It hasn't created any DNS issues, or any real problems for that matter ... except one. Its very very hard to get a commercial SSL certificate when you don't own the email address for the domain you want to secure.
I've been toying with the idea of changing the domain and kerberos realm to a domain name that I can buy...but I am curious how (if it all) I can change the OD Domain and Realm in Leopard server?
One thought is to blow away the OD domain and start from scratch - we are only talking about 15 macs, a few linux boxes and about 5 users ... but if I can change it easily then I'd like to try that first.
thanks!
-N

Hi
The Kerberos Realm Name is derived from what is configured in the DNS Service so you would have to change that first. This could have major repercussions (inevitably it always does) if you have any other Service running dependent on DNS; Web, iCal, SUS etc.
Demotion to Standalone, re-configuring the DNS Service and re-promotion is certainly the way I would go if you have the amount of users you currently have. In a funny way its probably quicker. One avenue you can explore is to change the DNS Service to reflect the change and then issue changeip:
sudo changeip /LDAPv3/127.0.0.1 oldIPAddress newIPAddress oldHostName newHostname
man changeip for usage.
If the IP address is not changing then leave it the same. As an example your server's FQDN could be myserver.mydomain.com yielding a Kerberos Realm of MYSERVER.MYDOMAIN.COM and an IP address of 172.16.16.254, in which case the command would look like this:
sudo changeip /LDAPv3/127.0.0.1 172.16.16.254 172.16.16.254 myserver.mydomain.com myserver.mynewdomain.com
You'll be prompted first for the System Admin name and password as well as the Directory Admin name and password (diradmin). A couple of restarts and possibly you might be on track. If this does not work - sometimes it does not - go for demotion and proceed from there.
Hope this helps, Tony

User Name and Password in weblogic realm while invoking a web service

Hi,
I deployed a rpc web service using WLS 7.0 SP2 in HP-UX 11 environment. When I
invoke the web service through my browser (IE 6.0) using the web services url,
it brings my service method correctly. From there, if I click the invoke button
it asks me for a network user name and password under "weblogic" realm??? If I
provide the admin user credentials (which I supplied while creating my domain)
it is not accepting that it keeps popping up this network user password window
over and over. Not sure which username/password I have to provide here to see
the result of my service.
If I try to invoke the web service through my client (static) I am getting a connection
refused exception. I guess either way, I am not able to access my web service.
In the attached file, I have cut and pasted the client stack trace as well as
the server log trace from weblogic.
Any ideas would be highly appreciated.
Thanks,
Ganesh
[errorstacktrace.txt]

I think the client is not able to do a HTTP POST
to the WLS server but it can do a HTTP GET.
I dont know why.
http://manojc.com
"Ganesh" <[email protected]> wrote in message
news:3eba91bc$[email protected]..
>
Hi,
I deployed a rpc web service using WLS 7.0 SP2 in HP-UX 11 environment.When I
invoke the web service through my browser (IE 6.0) using the web servicesurl,
it brings my service method correctly. From there, if I click the invokebutton
it asks me for a network user name and password under "weblogic" realm???If I
provide the admin user credentials (which I supplied while creating mydomain)
it is not accepting that it keeps popping up this network user passwordwindow
over and over. Not sure which username/password I have to provide here tosee
the result of my service.
If I try to invoke the web service through my client (static) I am gettinga connection
refused exception. I guess either way, I am not able to access my webservice.
In the attached file, I have cut and pasted the client stack trace as wellas
the server log trace from weblogic.
Any ideas would be highly appreciated.
Thanks,
Ganesh

Why is Lightroom taking up local disk space while publishing?

I have a relatively large photo catalog (200k photos +) that I am in the process of paring down with the help of Lightroom 5. Along the way I have kept certain groups of photos published to Flickr using Smart Photosets so that if I eliminate a duplicate photo from the catalog I will be able to "re-publish" and eliminate that duplicate from the published collection.
My Catalog Files, My Backups, and the actual image files that are referenced in the catalog are all located on an external drive. I did this so that I could have everything on one drive for the time being while I eliminate a ton of photos from the catalog.
The issue that I am running into is that while a collection is being published to Flickr I get a message popping up telling me that I am low on disk space on my local (C) drive and that I need to free up some space. This is odd because everything is located on the external drive (catalog and image files) and I am publishing to Flickr.
I am just trying to figure out if there is a default somewhere that is causing Lightroom to create new thumbnails or previews somewhere on my C drive while I am publishing images to Flickr or something like that. Any idea what sort of data might be accumulating in the process here? And is there anyway to move it all or eliminate it for the time being while I am finishing the elimination of duplicate files from my catalog?
Thanks!

woodyardae wrote:
If this is a temp file issue I would love to know where I can find these and get rid of them or perhaps a setting that I could change so that they are dumped more frequently automatically.
Temp files created by Lightroom are cleaned up by Lightroom, or should be anyway.
Is your C: drive short of space? If so, that should definitely be remedied pronto.
If not, then you got some other issue...
Rob

Some DCs are not available locally - NWDS error while importing Track confg

Hi,
We have configured NWDI in our landscape.
As per the requirement of the developers, we have created a new product and software component (SC) in SLD, as they don't want to use any standard components.
The same has been synced with CMS using update CMS.
Now a new track is created (in landscape configurator) and the new SC has been added to the track. Track creation was successfull....given the sdm passwords for all 3 systems.
While saving a pop-up came saying that as the SC is New (i did not select the developed option), I need to Check-in and Import into DEV manually.....I GOT STUCK HERE.
What files needs to be checked-in in Transport studio?
Also when developers are trying to import the configuration in their respoective NWDS...they are getting "Some DCs are not available locally" error.
Also updated the patch of their NWDS but still no use.
Could any one help me out.
Regards,
Siv

Dear Satya,
As per your advise. I have maintianed the 3 dependencies for the SC.
However, the error "Some DCs are not available locally" is still recurring in NWDS.
Below is few line from log,
Jul 14, 2009 6:49:13 PM /userOut/Development Component (com.sap.ide.eclipse.component.provider.listener.DevConfListener) [Thread[ModalContext,5,main]] ERROR: RIB_SAPPS: Build failed for sap.com/RIB_SAPPS(arg_PRIMAVERACUSTOMIZATION_1) in variant "default": Used component not found: sap.com/tc/bi/bp/webDynpro
Jul 14, 2009 6:49:13 PM /userOut/Development Component (com.sap.ide.eclipse.component.provider.listener.DevConfListener) [Thread[ModalContext,5,main]] ERROR: RIB_SAPPS: Build failed for sap.com/RIB_SAPPS(arg_PRIMAVERACUSTOMIZATION_1) in variant "default": Check for used DCs failed: Used component not found: sap.com/tc/bi/bp/webDynpro. DC not found in DC syncdb.
Build log -
Development Component Build (2009-07-14 18:49:13)
Component name: RIB_SAPPS
Component vendor: sap.com
SC compartment: arg_PRIMAVERACUSTOMIZATION_1
Configuration: EPD_ARG_D
Location: EPD_ARG_D
Source code location: http://den2:50100/dtr/ws/ARG/arg_PRIMAVERACUSTOMIZATION/dev/inactive/DCs/sap.com/RIB_SAPPS/_comp/
DC root folder: C:\Documents and Settings\sa45572\.dtc\1\DCs\sap.com\RIB_SAPPS\_comp\
DC type: Web Dynpro
Host: CMR-2FL0565
DC Model check:
   All used DCs are available locally
   ERROR: Check for used DCs failed: Used component not found: sap.com/tc/bi/bp/webDynpro. DC not found in DC syncdb.
   Build failed with errors.
Jul 14, 2009 6:48:50 PM /userOut/Development Component (com.sap.ide.eclipse.component.provider.actions.dc.UsedDCFoundHandlerBase) [Thread[main,5,main]] ERROR: failed to resolve reference "sap.com/tc/wdp/metamodel/content" for DC "arg_PRIMAVERACUSTOMIZATION_1:sap.com/RIB_SAPPS":Cannot find compartment of used component: sap.com:tc/wdp/metamodel/content
Regards,
Siv

How to handle local bank charges while our customer payment in USD

Hi All Expert,
How we handle customer payment with local bank charges rm5 at incoming payment?
Examples :
Customer invoice in USD 1000, while payment USD1000 by bank transfer with local bank will charges rm5 for each transaction.
May i know how does the B1 handle this bank charges in local currency?

Hello Eric,
I presume that the bank charge will not be paid by the customer. In this case, the actual Invoice of USD 1000 is considered fully paid.
I think the only way to proceed is to create a manual journal entry to Debit the Bank Charges and Credit the Bank Account. Or you can take it up when you post other bank reconciliation items at month end.
Hope this helps.
Regards,
Lorna

Joining Kerberos Realm from a distance

Hi,
I have a computer that is remote from the KDC (10.4.6).
It connects by VPN (MS-CHAP Authentication).
I entered the realm in the edu-mit-kerberos file by hand and managed to get a ticket.
However everytime I try to access a Group folder, I get a kernel panic.
Any ideas why ? Is there another file to modify ?
Ludo

Error stopped appearing after Mac OS X Update...

Additional local iPad Calendar while using MobileMe

Hi out there,
I use only MobileMe to sync all the data. Since a few days my iPad (and even my iPhone), added a local calendar to there iOS. How can I delete that one permanently – it *****…
Thanks, Chris.

To make your user library visible, hold down the option key while using the Finder “Go To Folder” command. Enter ~/Library.
If you prefer to make your user library permanently visible, use the Terminal command found below.
http://osxdaily.com/2011/07/04/show-library-directory-in-mac-os-x-lion/
You might want to bookmark the command. I had to use it again after I installed 10.8.2. I have also been informed that if you drag the user library to Finder it will remain visible.
You can try using iCloud to sync calendars.
iCloud
On the iPad try deselecting WiFi sync and then reselecting it. Sort of a reset.

Cannot access local DFS shares while VPN is active

Hi
We use Windows Server 2008 Standard as a domain controller. It also hosts DFS. Although the namespaces are hosted on the server, the data is stored on a Windows 2008 Storage Server. We do not use DFS replication.
I have several DFS shares mapped on my Windows 7 client, which has just replaced my XP client, and can access them without any problems.
However, as soon as I connect to a remote network (located on a different domain - it has nothing to do with our network at all), I am unable to access our DFS shares. If I try to access a DFS share an error message pops up stating:
Location is not available
Logon failure: unknown user name or bad password.
The first time I connected the VPN a network dialog popped up asking what type of network it was and I chose Work. After connecting via the VPN I use remote desktop to carry out daily maintenance on a server on the remote network.
Other local resources are available. I can ping machines via IP, name and FQDN. I can access the same DFS shares using UNC paths. So, although I receive the error message described above when accessing AD-name.local-backslash-share-name1 I have no trouble
accessing server-name-backslash-share-name1
As soon as I close the VPN connection normal functionality is restored and I can again access the DFS shares without any problems.
Can someone help me fix this, please? When this was setup on my XP machine I never experienced this problem.
Also, is there a way of typing LAN addresses without the forum software converting them to a customised hyperlink? Thanks!

Thank you, fupin
Sabrina's suggestion to edit the pbk file worked. I changed the setting from 1 to 0 and connected to the remote network via the VPN and am still able to access the local DFS shares.
As per the OPs comments, the username and password I am using for the remote network are both different from the credentials I am using on the local network.
... take the steps in the KB 822707 to resolve it:
1). Locate the .pbk file that contains the entry that you dial. To do so, click Start, click Search, type *.pbk in the All or part of the file name box, and then
click Search.
2). Open the file in Notepad.
3). Locate the following entry: UseRasCredentials=1
4). Modify the entry to the following: UseRasCredentials=0
5). On the File menu, click Save, and the click Exit.
Cheers!

Getting null object loaded from local variable error while trying to drag any field

Hi,
I am getting the below error while I am trying to drag any field in webi reports. Error message is attached below.
Can anyone help me on this. Webi is based on two different universe.
Thanks
Snehasish

Thanks Sathish for the reply.
BO Version is 4.0
reporting database is oracle 11.2.0.3.0
I am getting this error when I am trying to drag any field(dimension, measure, variable everything) in the report.
Universe has been created on top of Bex query. Now the webi is built on top of universe.
Thanks
Snehasish

Keep Local Machine Locked While Working Remotely

I originated from the PC-way of doing things, so this feature kinda seems like a no-brainer, but not sure how to go about it...
I access my iMac remotely all the time, but I want to keep my screen locked so everyone can't view it while I'm working. How do I go about this? I'm not using a VPN/VNC client or anything like that, just using the built-in screen sharing feature via iCloud.
Can anyone help?

Anyone?

Local Kerberos realm while bound to AD

Similar Messages

Maybe you are looking for