Mobile Account Creation and old topic

http://discussions.apple.com/thread.jspa?threadID=1786733&tstart=1 -- This was never successfully answered and has been archived and marked as so?
The problem it turns out, is that Leopard doesn't seemingly like the AD user's home folder location. I've verified this still as an issue today, on 10.5.7. I tried to create a mobile account for a user on a new laptop i got -- it would prompt me for the password three times, saying it's incorrect each time before the account creation is canceled.
If in Server 03 AD tools you first switch that user's "Home Directory" to local (or a mac server), this issue will not persist. On the AD Binding/Directory utility un-check "Require Confirmation" before creating a mobile account.
Then you should be able to log out and login as the user (may have to first delete the user's local directory if one has been created under "Users"), so long as the Home folder is set in AD to a location that is seemingly 'agreeable' with the mac os.
Message was edited by: Oh4Sh0

The usual approach with Open Directory is to either use Workgroup Manager to define a managed login preference for a computer group to define that those member computers should cause the use of mobile accounts on those computers, or to do the same thing via Profile Manager.
Note: If you are using Mavericks you must use Profile Manager as it does not support this via Workgroup Manager managed preferences.
This will not require users to need admin authorisation.

Similar Messages

Windows 8 Sysprep - Can't skip local account creation and autologon fails, wrong admin password.

Using Windows 8 x64 Enterprise, Sysprep pauses to ask me to create a local user, which I don't want.
If I enable SkipSystemOOBE and SkipUserOOBE in OOBE under Microsoft-Windows-Shell-Setup sysprep (in oobe mode) will skip user creation and autologon works. But it only works correctly once. If I run sysprep again, when it tries to autologon
it will say that I have the wrong password for the local account. After I type in the password manually it works. If I use the same password for the local administrator account as for the autologon account, it looks to have the encrypted password
twice with an equal sign after it.
What I need to know:
How to skip local user account creation (we run on a domain but I have it connect through scripts later)
How to fix the autologon issue
Do I need the local administrator account enabled for this to work?
I have my unattend.xml file attached.
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="oobeSystem">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<AutoLogon>
<Password>
<Value>[removed]</Value>
<PlainText>false</PlainText>
</Password>
<Username>[removed]</Username>
<LogonCount>2</LogonCount>
<Enabled>true</Enabled>
</AutoLogon>
<FirstLogonCommands>
<SynchronousCommand wcm:action="add">
<Order>1</Order>
<CommandLine>c:\folder\abatchfile.bat</CommandLine>
<RequiresUserInput>false</RequiresUserInput>
</SynchronousCommand>
</FirstLogonCommands>
<OOBE>
<HideEULAPage>true</HideEULAPage>
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<NetworkLocation>Work</NetworkLocation>
<HideLocalAccountScreen>true</HideLocalAccountScreen>
<ProtectYourPC>3</ProtectYourPC>
</OOBE>
<TimeZone>Eastern Standard Time</TimeZone>
<DisableAutoDaylightTimeSet>false</DisableAutoDaylightTimeSet>
<RegisteredOrganization>Company Name</RegisteredOrganization>
<RegisteredOwner>CompanyName</RegisteredOwner>
</component>
<component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<UserLocale>en-US</UserLocale>
<UILanguage>en-US</UILanguage>
<SystemLocale>en-US</SystemLocale>
<InputLocale>en-US</InputLocale>
</component>
</settings>
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ComputerName>*</ComputerName>
</component>
</settings>
<cpi:offlineImage cpi:source="wim:[removed]/sources/install.wim#Windows 8 Enterprise" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

The user accounts-creation page in Windows Welcome is suppressed if a user or a group is added to a local security group. Add a user or a group to a local security group by doing one of the following:
Create a local user.
Add a domain user to a local security group with the Microsoft-Windows-Shell-Setup | UserAccounts unattended installation setting.
To suppress the user accounts-creation page in Windows Welcome, without creating a local user, use one of the following workarounds:
Workaround 1
If the computer is already joined to a domain, use the following XML example to add the Domain Users security group to the Local Users security group.
<DomainAccounts>
<DomainAccountList wcm:action="add">
<DomainAccount wcm:action="add">
<Group>Users</Group>
<Name>Domain Users</Name>
</DomainAccount>
<Domain>FabrikamDomain</Domain>
</DomainAccountList>
</DomainAccounts>
Because joining a domain automatically adds the Domain Users security group to the Local Users security group, the DomainAccounts command does not affect the membership of the Local Users group. However, using this XML example to join a domain will also suppress
the user accounts-creation page in Windows Welcome.
Workaround 2
Use the Sysprep/Quit command to set the following registry value to 1:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE\UnattendCreatedUser
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Mobile account creation has different result...

Created managed preference group:
- Finder: Show connected servers on Desktop
- Mobility: Set to create Mobile account, synching off, HomeFolder on startup volume.
- Login: Maps three SMB paths to Windows Server folders
- Active Directory: UNC path set in user's Active Directory profile to Home Folder on Windows Server
There are two different conditions that give different results:
(1) User logs on to a particular Mac once (using AD network account), prior to applying managed preferences. User is not member of preference group. Mac creates full set of User Account folders in user's home. Then user's name is applied to preference group, and user logs on.
(2) User's name applied to preference group, prior to logging on to a particular Mac. User logs in using AD network account.
Results: With condition (1), User gets a full set of typical folders in local home folder, UNC network home folder is mapped to dock - the two Home folders (local and network) are kept separated, all works as anticipated.
With condition (2), user does not consistently get full set of folders in local home folder, UNC network home folder is mapped to dock - and local "Library/Preferences" and "Downloads" is copied into network home. Occasionally, user's AD account gets locked out due to too many failures while attempting to access folders.
I would greatly appreciate anyone who can lead me to understand this.
Thank you...David

The usual approach with Open Directory is to either use Workgroup Manager to define a managed login preference for a computer group to define that those member computers should cause the use of mobile accounts on those computers, or to do the same thing via Profile Manager.
Note: If you are using Mavericks you must use Profile Manager as it does not support this via Workgroup Manager managed preferences.
This will not require users to need admin authorisation.

Difference between General Ledger Accounting (New) and Old

Hello All,
Please help me with the below:
1)Could any one please explain the difference between General Ledger Accounting (New) and General Ledger Accounting (Old).
After going through the help document I understood that the BI 7 version came up with General Ledger Accounting (New), If this is true then can we still use 0FI_GL_04 in Ecc and BI7.0?
2)what is the difference between 0FI_GL_04 and 0FI_GL_14?
3) Is there any material or link or pdf that explains more clearly about FI - GL implementation in BI.
Thanks in advance.Your help will be much appreciated.

Hi Kiran,
Pl check SDN before Posting
Diff. Between old and New GL :
Using new oEhP3 FI or old FI datasources
Extraction and Reporting of FI-CA: Open Items Data In SAP-BI:
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a9996115-0b01-0010-b2b2-d9de0170a425?QuickLink=index&overridelayout=true
Financial Accounting: Procedure for Delta Extraction of Transaction Figures:
http://help.sap.com/saphelp_sm32/helpdata/en/41/4b73415fb9157de10000000a155106/content.htm
Complete FI-GL Information :
http://help.sap.com/printdocu/core/Print46c/en/data/pdf/FigL/FigL.pdf
Regards
Ram
Edited by: Ramakanth Deepak Gandepalli on Jan 29, 2010 5:14 AM

Changed account name and old music files no longer can play

I changed my account name to an e-mail address that I currently use. since I moved the old one I could no longer access any longer. Well they have a feature to do that so I took it so it would be easier to remember the account and password. thing is since I changed none of the songs that I purchased with the old account name can be played any longer. they need to be Reauthorized.
No biggie right just type in the old account name and password and I'll be on my way. Wrong :P
According to the music store the old account does not exist. Well of course not that is because I changed it. I check to see my account history under the NEW account and it has all the files I ever downloaded since I first installed iTunes! If this is the case why on earth can I not play the files purchased under my old account under the new accounts name! did I make a mistake by not deauthroizing my computer before changing account? because it is not mentioned in the instructions to do so! Grrr... normally I'd just say oh well but it's most of my iTunes library!
Pleas help!

Problem Resolved!
I was sent back an e-mail stating that I did not make a second account but changed my account name from (accounts will be withheld for security) one to the other. Problem?
Files downloaded from the other account name would not work with the one that I was currently using.
Issues further complicating the matter. My computer recently was having Power supply issues and I reformated my computer several times. Not realizing that this left iTunes Music store saying that I had 5 computers authorized on my account because I had not deauthorized any of the computers each time. Couldn't really, windows crashed out and I couldn't get to it. So when I got everything ironed out on my computer. I couldn't play any of my songs becaus I had reached maximum authorizations! even Deauthorizing and reauthorizing didn't work.
Solution:: Login to your (working) account and go to your account summary. Click on the button that says "Deauthorize ALL computers" This will wipe all computers that you had associated with your account to play your songs. Not that big of deal because all you have to do is log back in. (BIG deal to ppl that don't know your password, which they shouldn't be playing yoru songs anyway!)
Once I resetted my authorization on all computers and logged back in everything was fine.
Now I think the tech that sent me the e-mail did do one thing for me. He must have enabled my old account I used to have and linked it to my current one. Because instead of my old account saying it does not exist it says it works now! yet I still login to and access my account with my new e-mail account!
So even though I would like to say everything was within my power to do myself the whole time. That is not the case. The tech did help me associate the two accounts from withing iTunes. So I can now listen to my songs at anytime I want and not be told I have 5+ computers when I only own 2 LOL

Account creation and use...

I created a skype account from Arizona, US for my mother that lives in San Diego, US... The account has been created correctly, I can login from my computer...
But, my mother cannot login from her computer in another state...
Should this be happeneing? or is my mom inputing the wrong name and pass?
Thanks in advance,
Kyle

The problem is at your mother's end, either with your computer or how she's trying to login. There's no restriction anywhere in the world to where you can signon to aSkype account, with the possible exception of a few countries where the government blocks Skype access.
Are you sure that your mom has the Skype program installed on her PC, and that she's not trying to logon through the Skype website?
Please note: I do not respond to requests for help via Private Message.

Account Creation and home folders

Ok. I am more than frustrated at this point so any hep would be appreciated. I work in a school environment that uses Windows server to manage accounts and files. I am setting up a colleagues room which uses iMacs and a PowerMac running Snow Leopard server; the clients use Snow Leopard. I have set-up the new server and bound it to the AD. I have also set-up one of the new iMacs with all programs installed and installed the server tools, ie WG manager, Server Admin, etc., to manage the privileges for the accounts.
My problem is this. When the students log into the clients, i want their home folders to be located on the server and not on the client machine. This way, they have their files no matter what computer they log into. I am tried many different ways to do this, none of which has worked. Any help would be appreciated.

Hi rhahn and welcome to Apple Discussions!
I think you may be confused on one point. PowerMacs (that is a Macintosh with a PowerPC processor) will not run Snow Leopard Server. It requires an Intel processor. Perhaps you have a Mac Pro?
Best of luck.

ICal Problem with Mobile Account/Home and where are the calendars stored

I am using MacMinis in an office with my MacPro SnowLeopard Server running LDAP with NetworkHome accounts. Almost everything works except this ical is driving me nuts.
The problem is iCals don't sync with the NetworkHome. When I look in usr/library/calendars a new calendar appears there but it won't sync on to a different machine.
What is even more frusterating, if I disconnect the server so I am just logging in locally, I can delete all the calanders in usr/library/calendars, but when I log back in the calendars just re-appear. So where else is ical storing calendar information?
thanks
jake

where else is ical storing calendar information?
in a folder in usr/library/syncservices/local. You will have to look in the clientname.txt file in each of the folders to find which one is for iCal.
AK

Mixing mobile account and network account.

Is it possible to have mobile account on some computers and network account on others and having the same user logging in (only one login at a time) without sync issues ?
I have tested it with account preferences set on computers and it is working nice until I have been logged in on a computer with networked account, then I experience sync issues. Every time I log in mobile account I got a dialog window asking me to select "Sync Later" , "Mobile" or "Networked". It does not matter what I select, the dialog comes back everytime I log off and on with the mobile account. I have only managed get rid of it by deleting mobile account and sync it again.
Message was edited by: kenguru

Again, thanks for taking your time explaining this for me.
After been reading the User Management documentation from apple about Managing Portable Computers (Chapter 8), I got the opposite impression about running Mobile Account on multiple computers. From this text, as I read it, it is a common thing to do, as long as we are aware of sync issues that might occur and know how we shall deal with it.
So I'm a little confused about this topics, as it seem to make sense what you are saying, but the documentation says something different.
I have tried setting sync preferences on the user instead, so that every login is made with a mobile account on every computer. That seems to work ok. Off course sync issues may arise, but here the the file sync can be fixed through the dialogs windows that pops up. Unlike under the mix of network logins and mobile account logins where it doesn't matter which location I set to be the place containing the most recent files. This only occurs after a network account login. If I have been logged on another computer set up with mobile account everything syncs nicely. I think
So for now, I think I will stick with setting up users with mobile account preferences and skip the networked account.
Does this make any sense or am I still mistaking here?
Ok, thanks for all you help.
Bernt

Mobile account can't login when connected to network

I have a 10.6.3 mobile account set up on a laptop that's bound to an AD domain. The mobile account creation worked great, as expected, and the user was fine for a few days.
Then the user reported that he was no longer able to log in to his mobile account. After troubleshooting a bit, I noticed that if he's NOT connected to the company LAN where the AD domain is located, he can login fine. But if I connect him to the company LAN, the machine complains that his password is wrong (and we've reset the password in AD, so we know it's correct). So if I flip him back off the network, his login works again.
There are many other mobile accounts working on this same LAN that aren't having this problem.
Anyone seen this or know what I might try?
Thanks.

Trying turning on DirectoryServices debugging and see if you can scare up any more data:
sudo killall -USR1 DirectoryService
Then monitor
/Library/Logs/DirectoryService/DirectoryService.debug.log
Even without debugging, you might want to look at
/Library/Logs/DirectoryService/DirectoryService.error.log
and
/Library/Logs/DirectoryService/DirectoryService.server.log

10.5.3: Can't Create Mobile Account

I have a MacBook Pro that authenticates to Active Directory.
When I try to create a Mobile Account
[ System Preferences --> Accounts --> Mobile Accounts:Create ]
I get prompted to
"*Enter your password to create a mobile account*"
However, it does not accept the password, responding with
"*Incorrect password*"
After three attempts, I get
"*Mobile account creation canceled*"
and then logged off.
I've tried both my Active Directory account password, and the local administrator password. Neither work.
At least I can get that far; in 10.5.2, the Mobile Account:Create button was greyed out.
Is anyone else having the same problem? Is there a fix for this?
I'm going to be out of the office next week for a conference, and would really like to get this working before then.
UPDATE: When trying to enable FileVault for my A.D. account, I get the following message:
*You cannot turn on FileVault for this account.*
*This account is either a network account or the home folder is on a server. You cannot turn on FileVault for these types of accounts.*
This makes this problem more than a minor annoyance, as my company policy -- and plain common sense -- requires encryption enabled for laptops.
Message was edited by: Robert Racansky

Hi Robert
On the Active Directory Server SMB Digital Signing Requirements (there are two: Server and Client) need to be disabled. It's not enough to leave them undefined. Once that has been done make sure client clocks are within 5 minutes of the server's time clock. In the Network Preferences Pane make sure the mac is using the AD DC for resolving internal DNS Services and the Search Domain field is filled in with the appropriate AD Domain Name. It's also advisable to fill in the WINS Tab with the relevant information for the AD..
Launch Directory Utility and select the Services Icon (click Show Advanced Options to see this). Select the Active Directory plug-in and click the disclosure triangle to show Advanced Options. Leave everything as the default and select 'Create Mobile Account at Login'. Fill in the Active Directory Domain field with the relevant information. For example if the AD's FQDN is adserver.addomain.com then the information should be addomain.com. Now click Bind. In the resulting window key in authentication details for an account that has authority for the AD Domain. Typically this would be the AD admin account name and password. What follows next will be a 5 step process. Depending on how well the AD has been configured this should take anything from 5-10 seconds and possibly 1-2 minutes. If it takes a short time this will be a good sign as to the 'health' of internal DNS Services as well as the AD configuration. The longer it takes the more the likelihood of problems.
By the way there is no magic fix for integrating/binding mac clients to an AD Server. Over 90% of how well this goes will rest with how well the AD is configured.
If the bind has been successful you should see a Kerberos TGT (ticket granting ticket) has been created in /Library/Preferences. It will be a file called edu.mit.Kerberos. You can inspect this and it should show the relevant details regarding the KDC (Kerberos Distribution Center). If you now log out you should see the Log in window display the local admin user as well 'Other'. It should look like a shadowed head and shoulders in front of a star field. Select this and supply your AD name and password. Provided the AD admin has defined a UNC path in the Profiles tab for your account on the AD Server for home folder creation and that you have full read/write privileges for that folder then you should be logging into your locally created home folder that also gets created at the same time on the AD.
Its best if you sync when logging out as there have been problems syncing at other times. Mileage may vary.
Hope this helps, Tony

Unable to activate mobile account

Hi, I am in a dead end.
I am trying to settup mobile account on 10.8 Server, with 10.8 clients.
So far, I got my Open Directory seted up server.name.private
I created a new user in the Users tab, named test
The Home Folder is setted up for my Homes folder, which is on a secondary hard drive.
This file is shared with File Sharing, and have read/write permission for the group of my user.
If I check the folder permission in the Finder, it is strange, but I don't know how to clean them. Each group is there two times, and they have Custom privilege
With Workgroup Manager, I selected my user, went to the Preferences tab, and setted up the Mobility section.
The options for Account Creation are Manage: Always, Account Expiry are Manage: Never and under Rules, Home Sync, I selected Once.
On the client side, I activated the mobile account option, and entered the Open Directory adress.
And when I log in, I put my info test/password, and the message You are unable to log in to the user account "test" at this time. Logging in to the account failed because an error occured.
And here is the log from the server
CFPreferences: user home directory for user kCFPreferencesCurrentUser at /var/teamsserver is unavailable. User domains will be volatile
Does someone have a clue for me?
Thanks!

Can you wipe the sytems and migrate the data? With my experience in Mobile Users this will probably be quicker than trying to troubleshoot MObility problems.

Email Set up and Old owner problems

My brother gave me his old storm. I put my t mobil account chip and bought the data plan and most of the features seem to work (I think).
My brother's email is still in the email button and blackberry can't connect to the email server so that I can delect his email and put mine.
Also when I make a call the 'My number' is showing my brother's number.
Is there a way to correct this. Does he need to unregister somewhere. Does he need to go to his carrier Version to change something?
Solved!
Go to Solution.

Hi and Welcome to the Community!
Stop, go back, and start over with this:
KB05099 Steps to take before selling or after buying a previously owned BlackBerry smartphone
Make 100% sure that your brother has completed all of his steps before trying any of yours.
Good luck!
Occam's Razor nearly always applies when troubleshooting technology issues!
If anyone has been helpful to you, please show your appreciation by clicking the button inside of their post. Please click here and read, along with the threads to which it links, for helpful information to guide you as you proceed. I always recommend that you treat your BlackBerry like any other computing device, including using a regular backup schedule...click here for an article with instructions.
Join our BBM Channels
BSCF General Channel
PIN: C0001B7B4 Display/Scan Bar Code
Knowledge Base Updates
PIN: C0005A9AA Display/Scan Bar Code

Active directory mobile accounts

Hi,
Just did a clean install of Lion, joined it to my active directory (Windows SBS 2003). No issues with this part...
But when I log in as a domain user, I get:
the home folder for user is not located in the usual place or cannot be accessed
Strangely enough, if I turn off mobile account creation, it works, and /Users/domainuser is created. If I then turn back on mobile account creation I get the error again.
Anybody else experience this? Any pointers on how to troubleshoot?

WORKAROUND for "Error: The home folder for user "ActiveDirectoryUser" isn't located in the usual place or can't be accessed. The home or Users folder may have been moved or deleted. If the home...."
I was able to "Fix" the Mobile Account issue above in Lion -for now. (Valid as of 8/18/11 on Lion 10.7.1)
- In Directory Utility -> Active Directory -> Advanced Options, I unchecked "Create mobile account at login" and left "Force local home directory on startup disk" checked
- Log out then back in as a networked user, -A local home directory will be created under /Users but will not be accessible if network is offline (non-mobile)
- Open Terminal
--- Type: cd /System/Library/CoreServices/ManagedClient.app/Contents/Resources/
--- Type: ./createmobileaccount -n username
The username you specify with the createmobileaccount command will turn it from a standard account into a mobile account.
This fixes Active Directory mobile accounts for the time being so now its on to Open Directory which refuses to stay bound after a reboot.

Mobile account working but home folder is named incorrectly ('99')?

Hi,
Both server and clients running 10.4.5 with a mixture of local and network accounts. All works fine. Wanting to migrate all users to mobile accounts (which we have achieved successfully in many other places). It works (i.e. log in first time, say 'yes' to creating the account, syncing options are set as in WGM) but the home dir that is created is called '99' (which isn't the user name!) Does anyone know why this is?
Thanks very much..
Rob

I believe that the 99 refers to a network login where
the network user has no network home folder on the
network (or server). The 99 is a generic username
for this situation on the machine that is being
logged into, but each account needs a home somewhere.
That sounds strange, but I have it deliberately on
some lab machines. Let me explain. I have users
with Mobile Accounts on laptops. To prevent them
from logging in to a lab machine, I have set up
Workgroup Manager to not give the lab account user a
network home (I don't need Gigs worth of video on my
server). Therefore, when a lab account logs in, it
has no network home and is forced to create a local
home on the lab machine. That works great-I don't
fill my server with unedited video. Workgroup
Manager covers the apps and privileges on the lab
machine. To prevent a Mobile Account user from
logging in to the lab machine and filling that up
with their home directory, I have a workgroup that
the lab account belongs to, but not the Mobile
Account user. In that workgroup, I have limited who
can login (only lab accounts). And finally, I have
limited the access to the lab machines by entering
in the lab machine's ethernet address in the
computer (don't remember its name right this
second-it is the 2 squares to the right of the
workgroups in WGM) list so that a lab account can't
log in to a laptop and a Mobile Account can't log
into the lab machine.
After all of that explanation of what I have done,
you probably have some part of that set on your
Workgroup Manager like mine. I would think most
likely the no home directory setting in the user's
account.
Hope that sheds some light for you.
Wayne
Wayne, with your lab accounts - do they auto-create with '99' or their proper short name? Additionally, does another folder '99' get created at the root level of the hard drive as mine still do?
I have tried everything that I can think of but regardless, mobile account creation does not want to work as seamlessly and effortlessly as it does with 10.3.9. All I want is to continue to have managed user accounts on my (10.4.x) server, no network home, mobile accounts created on each (10.4.x) Mac in the lab. That isn't happening. I'm at the point of giving up and fogetting about an OS upgrade for 2 labs.

Mobile Account Creation and old topic

Similar Messages

Maybe you are looking for