Migration to 10.6 server from 10.5.8 - Kerberos issue

Question

Hello,
I'm trying to migrate a 10.5.8 PPC Server on to a new 10.6 Intel server. The machine looks after our managed preferences for our Macs, so it's an Open Directory master.
The new 10.6 machine has a fresh install of 10.6 server. It has been joined to our Active Directory and I am promoting it to an OD master. I was going down the road of using the OD backup/archive from the old 10.5.8 machine, and importing/restoring this on to the 10.6 machine using the 'Merge' option. If I do this, all of my computers and groups appear and clients are managed, however in the Kerberos section of Server Admin it lists the Kerberos realm as the name of the old machine. I had found some instructions online which say you can destroy the Kerberos settings then re Kerberise the server by clicking "Kerberise" in server admin, but this option is not there once I trash the old Kerberos settings.
So, is there a way to use the backup archive from the old server and somehow replace/make it forget the old hostname?
or
Is there a better way to do this?
Any advice welcome

Answer 1

Hi Stephen
I've not seen a problem exporting from 10.5 to 10.6 . . . yet. I've had problems in the past going from 10.4 to 10.5 and 10.4 to 10.6 especially with Groups but not always. It seems 10.6 'handles' GUIDs and/or UIDs slightly differently to previous iterations of the server. I've also seen problems with imported Groups and ACLs. Whenever I delve deeper though I never see anything obvious. The 'cure' is to recreate the Groups. I would not be surprised if you had to do the same for Computer Groups? Not that much hassle as typically in an AD-OD Integrated environment there are not that many OD Groups nesting AD Users/Groups. The Computer Groups is the 'biggy' I suppose although again in most AD-OD Integrated environments there's generally only one or two, possibly three. Mostly there's just one. In my experience macs are usually outnumbered 10 or 20 to 1 anyway. From my point of view exporting Computer Groups is not something I generally do. Although this does depend on the environment.
Apart from the slight problem with MCX at hardware is login successful?
Some questions for you:
Was the 10.5 Server itself an update of a previous version of the Server?
Have the clients been updated to 10.6 or are they a new build?
If they were updated did you remove any bindings prior to running the update?
Did you strip out any Managed Preferences beforehand?
In an environment like yours updating the server OS in my experience is generally not the problem. If there are problems it invariably turns out to be with the client OS or the Windows environment due to a recent update/upgrade. With that in mind I've always tried to start with a clean client OS that has no 'knowledge' of what went before. That way there's less likelihood of anything 'hanging' around that may cause a problem. Generally I would plan to do this during the summer break when there's plenty of time to test and test again. However if you're under pressure to get this done quickly then you can't really wait.
HTH?
Tony