Open Directory Binding doesn't want to activate

Hi all,
I have the following problem with binding computers to Open Directory. My setup is as follows: Master on one server, slave on the other, clients running in the network, no firewalls or anything. I took over from another guy and he didn't have binding enabled, I would like to set up a Software Update Service and push the SUS server to the computers using OD.
When I try to enable binding in the server config tool, it doesn't work (the box unchecks itself) the error message in slapconfig.log is the same as on terminal (running as root) where I have the following:
# slapconfig -setmacosxodpolicy -binding enabled
command: /usr/bin/ldapadd -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
modifying entry "cn=macosxodpolicy,cn=config,dc=try,dc=tohide,dc=this"
ldapadd command output:
ldap_modify: No such object (32)
matched DN: cn=config,dc=try,dc=tohide,dc=this
ldapadd command failed with status 32
Does anybody have an idea what this is or where the problem is?
The ou macosxodpolicy and container config are in the correct location (I think) and seem readable:
dn: cn=config,dc=try,dc=tohide,dc=this
cn: config
objectClass: container
entryUUID: 0c305f06-85a6-1028-9911-993fd9058318
creatorsName: uid=root,cn=users,dc=try,dc=tohide,dc=this
createTimestamp: 20040818210515Z
entryCSN: 2004081821:05:15Z#0x0002#0#0000
modifiersName: uid=root,cn=users,dc=try,dc=tohide,dc=this
modifyTimestamp: 20040818210515Z
dn: ou=macosxodconfig,cn=config,dc=try,dc=tohide,dc=this
ou: macosxodconfig
objectClass: top
objectClass: organizationalUnit
entryUUID: 0c335882-85a6-1028-9912-993fd9058318
creatorsName: uid=root,cn=users,dc=try,dc=tohide,dc=this
createTimestamp: 20040818210515Z
...

Just a couple thoughts and basic questions:
Is DNS properly configured? Can you do forward and reverse lookups? If you rin changeip checkhostname, what happens? And finally, how have you configured DirectoryAccess on the clients?
By your post, you've got a handle on this, but just want to cover all the bases.
I'm guessing it's possible your predecessor didn't have everything setup quite right to begin with. If you've setup a server before, then you know you need to setup DNS while the server is set as a standalone, then promote it to an OD master. If this was not done to begin with, you may be pounding your head against a wall to make it work. If possible, consider re-installing the server to get it right from the get go. You may be able to make a mis-configured server work (if that is the case) but you may see different issues down the road.
good luck and post back with more info - maybe someone smarter than me can help...
Jeff

Similar Messages

  • HT2240 I purchase my QuickTime 7 Pro registration key via a friend in USA as it was not available to residents in South Africa. I now have a new iMac and the registration code doesn't want to activate PRO. It works fine on my MacBook Pro.

    I purchase my QuickTime 7 Pro registration key via a friend in USA as it was not available to residents in South Africa. I now have a new iMac and the registration code doesn't want to activate PRO. It works fine on my MacBook Pro. Do I have to buy a new registration code for my newiMac?

    i'm in SA and it say Apple Support not available at the moment or something like that.
    Just got the new iMac.
    Still using MacBook Pro.
    Files are on a external drive shared between these 2 mac platforms and I need to be able to
    edit in QT 7 Pro on both as well.
    The code was bought in August 2011.

  • New open directory account doesn't create mail account

    Hi All
         I have a Mac Mini with lion server, Fresh out of the box i messed with it a few times to learn and then i did a clean (internet) install and started with the settings i wanted (hostname, etc) with no mistakes. (It seems Lion doesn't like applhying most changes)
    When i set it up i created one local admin user that won't be in the open directory.
    Anyway, I've set up the following :
    * Address Book
    * File Sharing
    * iCal
    * Mail
    * Profile Manager
    * and VPN
    The first open directory user i added was myself and that user managed to get assigned an email account.
    Susiquent users i've added have not been registered with the mail subsystem.
    I've checked this using the "Server Admin" additional download management tool. (Mail service on the left, Maintenance up the top and then accounts uder that)
    There is only one mail account and thats the first one i've added.
    I havn't played with the settings so other than switching things on it should "just work" but it doesn't.
    I've prevously setup vmail servers using mysql to store the accounts with postfix and courioer imap but that was in some ways simpler as nothing was under the covers. I havn't dug too much into the dovecot config files, etc as i believe there is an all knowing server configuration engine at work here that isn't doing its job (which i havn't dug into)
    Has anyone had this issue of the mail accounts not being created?
    Or can anyone point me to a fix?

    It seems to have something to do with profile manager.
    I get stack traces in the "system messages" logs for the "Server" application, grrrr.
    I'll get that info and attempt to submit a but report tonight.

  • My iPhone doesn't want to activate when start it on again

    When I restarted my iPhone it dosen't want to activate the iPhone. It says that i could use iTunes but it dosen't work either. What can I do to make it work again?

    If it says to connect to itunes on your computer be sure you have iTunes 11.1 or later on your computer.

  • Open Directory Binding Issues

    I have an issue where I can only bind one of my 2 machines to OD. All should be setup correctly as one machine has no problem binding. The second machine tells me that the credentials i supplied are incorrect. The first machine will bind with no problems, have remove and bound more than once on the first machine. Used the same credentials. Both machines were bound to my old setup, still 10.6 server. Reinstalled 10.6 server this morning because of Kerberos issues.
    First machine has zero issues with binding, kerberos, etc. 2nd one will not bind.
    I am out of ideas. All network settings are the same. DNS is correct, etc. as it works on the 1st one.
    Someone help me get my sanity back please!

    Are both client machines running 10.6?

  • HT4623 I updated my iphone to the newest update but now it doesn't want to read my SIM card. Help!

    I updated my iphone to the newest update but now it doesn't want to activate. It says the sim card I have it's not valid and that I need to insert the som card that came with my phone. Problem is my phone was given to me by a friend of mom's and he just gave me the phone I had to buy a new sim card. It has been working all right until now. Should I go buy a new sim card? Help!

    Your phone is locked to a carrier.  Only a SIM from that carrier can be used to activate the phone.  Ask the "friend of your mom's" to which carrier the phone is locked.  You'll then need to contact that carrier and see if you are eligible to have the phone unlocked.  If not, the phone is useless to you.

  • Open directory administrator's password to manage

    hi.
    i have a mac os x server 10.4 with Open Directory.
    Now I want to add some new users and some new Computer to my domain. When I login into Open Directory I enable to see the tree of my ldap domain but I unable to add new user or computer.
    Why this problem? I see the user that there are. I have just try to login and unlock the Open directory with some other user, but i can't solve. I can't see enable the bottom for "add user" and the "add computer".
    can you help me?
    thanks

    Hi
    have a mac os x server 10.4 with Open Directory
    You should really post this in the relevant Forum as this is for 10.5 Server:
    http://discussions.apple.com/forum.jspa?forumID=713
    Having said that I have to ask the obvious. If you want to add/delete/amend - amongst other things - users to the /LDAPv3/127.0.0.1 node you have to click the lock on the right hand side and authenticate using the Directory Administrator (diradmin) account name and password. Once you've done that you should be able to work within that node.
    Tony

  • My facetime suddenly doesn't want to work... :(

    Hi, I've been using facetime for how many times already but when i wished to use it again, it doesn't want to activate. what could possibly the reason? should i contact my network?

    I was able to use FaceTime before, and some "glitch" happened and I was unable to so I did do the restore. I even went to the Apple Store to figure it out and that's all the guy told me to do was to restore it. Actually he did it for me, but I believe a restore will help. 
    You can always download your apps again for free.  But make sure you get off playlists/video/photos, use iCloud if you have the room for other stuff too.

  • Directory Binding Script (Active and Open Directory) 10.7

    Hi everyone
    I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
    The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
    Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
    #!/bin/sh
    #Uncomment the following line to abort the script on errors
    #trap exit ERR
    ## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
    ## Script written by Marc Horat, URZ Basel, 11.6.2010
    ## Updated: 12.08.2011
    # With the use of the following sources as inspiration:
    # http://www.howtomac.co.uk/?p=247
    #Created by Ross Hamilton
    #Clock restart / Remove existing settings
    #Join to Open Directory and Active Directory
    # Bombich's AD-Bind Script:
    # This script binds to AD and configures advanced options of the AD plugin
    # As this scripts contains a password, be sure to take appropriate security
    # precautions
    # A good way to run this script is to set it as a login hook on your master machine
    # Because it only needs to be run once, the last thing this script does is to delete
    # itself. If you have another login script that you typically run, include the
    # script on your master machine, and indicate its path in the "newLoginScript"
    # variable.
    # If running this as a one-time login hook to bind to AD after imaging,
    # be sure to enable auto-login (for any local user) before creating your master image
    #################CONFIGURATION##########################
    #OD
    # These variables need to be configured for your env
    odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
    odPassword="YOURODPW"  # Enter your OD admin password between the quotes
    oddomain="YOURODDOMAIN" # FQDN of your OD domain
    computerGroup="YOURNEWODCOMPGROUP"  # Add appropriate computer group you want machines to be added to, case sensitive
    oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
    #AD
    # Standard parameters
    domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
    domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
    udn="YOURADADMIN"                              # username of a privileged network user
    password="YOURADPW"                                                  # password of a privileged network user
    ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
    # Advanced options AD Plugin
    alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
    localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
    protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
    mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
    mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
    useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
    user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
    preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
    # (e.g. "-nopreferred" or "-preferred ad.server.edu")
    admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
    packetsign="allow"                              # allow | disable | require
    packetencrypt="allow"                    # allow | disable | require
    passinterval="14"                              # number of days
    namespace="domain"                              # forest | domain
    # Login hook setting -- specify the path to a login hook that you want to run instead of this script
    newLoginHook=""                    # e.g., "/Library/Management/login.sh"
    ################################# End of configuration
    ############ Begin of Script
    # Host-specific parameters
    # computerid should be set dynamically, this value must be machine-specific
    # This value may be restricted to 19 characters! The only error you'll receive upon entering
    # an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
    #computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
    #computerid=`hostname | sed 's/.unibas.ch//'`
    #computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
    #computerid=`/usr/sbin/scutil --get LocalHostName`
    computerid=`scutil --get ComputerName`
    adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
    # These variables probably don't need to be changed
    # Determing if any directory binding exists
    nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
              check4OD=${check4ODtmp//[[:space:]]/}
              echo "Found LDAP: "$check4ODtmp
              check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
              check4ODacct=${check4ODaccttmp//[[:space:]]/}
              echo "Found LDAP-Computer-Account: "$check4ODacct
    else
              check4OD=""
              check4ODacct=""
              echo "No bound LDAP Server found"
    fi
    if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
              check4ODgroupMembership=$check4ODgroupMembershiptmp
              echo "LDAP Group Membership in Group: "$oldComputerGroup
    else
              check4ODgroupMembership=""
              echo "No LDAP Group Membership defined or not bound to a server"
    fi
    if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
    then
              check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//'  | sed 's/=//'`
              check4AD=${check4ADtmp//[[:space:]]/}
              echo "Found AD: "$check4AD
              check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
              check4ADacct=${check4ADaccttmp//[[:space:]]/}
              echo "Found AD-Account: "$check4ADacct
    else
              check4AD=""
              check4ADacct=""
              echo "No AD-Account found"
    fi
    osversionlong=`sw_vers -productVersion`
    osvers=${osversionlong:3:1}
    #Time Sync
    #Restart ntpdate
    StartService ()
    if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
              CheckForNetwork
    if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
              touch /var/run/NetworkTime.StartupItem
              echo "Starting network time synchronization"
    # Synchronize our clock to the network’s time,
    # then fire off ntpd to keep the clock in sync.
              ntpdate -bvs
              ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
    fi
    echo ""
    echo ""
    sleep 5
    #### Removing any existing directory bindings
    #Clear OD Computer Account and delete entry from Computer group
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              echo "This computer is bound to the following Open Directory Services:"
              dscl localhost -list /LDAPv3
              echo "With the Search Path entries:"
              dscl /Search -read / CSPSearchPath | grep /LDAP
              sleep 5
              if [ "${check4ODacct}" == "${computerid}" ]
              then
                        echo "This machine already has a computer account on $oddomain."
                        # Set the GUID
                        GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                        echo "Found GUID: "$GUID
                        if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                        then
                                  echo "Removing entry from group $oldComputerGroup"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                        fi
                        echo "Removing Computer entry $computerid in OD"
                        dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
              fi
              #List existing Directories
              echo "Removing OD-Binding to "$check4OD
              dsconfigldap -r "$check4OD"
              echo "Removing Search Path entries"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
              dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
              sleep 5
    else
              echo "No LDAP or OD Binding present.";
    fi
    echo ""
    # Check a second time in order to delete any remaining LDAP-Bindings
    echo "Scanning for further LDAP servers"
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              echo "Found:"
              dscl localhost -list /LDAPv3
              echo "Removing OD-Binding to "$check4ODtmp
              dsconfigldap -r "$check4ODtmp"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              sleep 5
    else
              echo "No further LDAP or OD Binding present."
    fi
    echo ""
    echo ""
    #Remove the Active Directory binding
    if [ "$check4AD" != "" ]
    then
              echo "This computer is bound to the following Active Directory Services:"
              dscl localhost -list "/Active Directory"
              echo "With the Search Path entries:"
              dscl /Search -read / CSPSearchPath | grep /Active
              sleep 5
              echo "Removing any existing AD-Binding to "$check4AD
        dsconfigad -f -remove -username "$udn" -password "$password"
        echo "Removing Search Path entries"
              if [ "$preferred" != "-nopreferred" ]
              then
                        dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                        dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                        dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
              fi
              dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
              dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
    #remove search path entries from 10.6
        if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
        then
            dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
            dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        fi
              sleep 5
    else
              echo "No Active Directory Binding present."
    fi
    echo ""
    #Remove Existing Directory Services Config
    echo "Removing existing DS Config"
    if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
    then
              rm -R /Library/Preferences/edu.mit.Kerberos
    fi
    if [ -d "/etc/krb5.keytab" ]
    then
              rm -R /etc/krb5.keytab
    fi
    # Clean up the DirectoryService configuration files
    rm -Rfv /Library/Preferences/DirectoryService/*
    #OD
    echo ""
    echo ""
    echo "Binding to OD-Damin "$oddomain
    sleep 5
    dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
    echo "Killing opendirectoryd"
    killall opendirectoryd
    sleep 5
    echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
    # Set the GUID
    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
    # Add computer to ComputerList and ComputerGroup
    if [ $computerGroup != "" ]
    then
              echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
    fi
    echo "Finished OD Binding."
    sleep 5 # Give DS a chance to catch up
    echo ""
    echo ""
    echo "Performing the AD Binding"
    #AD
    # Activate the AD plugin
    defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
    plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
    #Use the existing AD-Computername or generate a new one
    computeridtmp="default"
    if [ "$check4ADacct" == "" ]
    then
              LEN=$(echo ${#adcomputerid})
              if [ $LEN -lt 15 ]; then
                      echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                      computeridtmp=$adcomputerid
              else
                      echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                        echo "Removing any -"
                      computeridtmp=${adcomputerid//-/}
                                  LEN=$(echo ${#computeridtmp})
                                  if [ $LEN -lt 15 ]; then
                                            echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                                  else
                                            echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                            computeridtmp=${computeridtmp:(-15)}
                                  fi
                      echo "Cropped Computername to "$computeridtmp
              fi
    else
        computeridtmp=${check4ADacct//$/}
        echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
    fi
    echo ""
    # Bind to AD
    echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
    dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
    echo ""
    echo "Setting the Advanced AD Plugin options"
    # Configure advanced AD plugin options
    if [ "$admingroups" = "" ]
    then
              dsconfigad -nogroups
    else
              dsconfigad -groups "$admingroups"
    fi
    dsconfigad -alldomains "$alldomains"
    dsconfigad -localhome "$localhome"
    dsconfigad -protocol "$protocol"
    dsconfigad -mobile "$mobile"
    dsconfigad -mobileconfirm "$mobileconfirm"
    dsconfigad -useuncpath "$useuncpath"
    dsconfigad -shell "$user_shell"
    dsconfigad "$preferred"
    dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
    dsconfigad -namespace "$namespace"
    sleep 5
    echo ""
    echo ""
    # Add the OD & AD node to the search path
    if [ "$alldomains" = "enable" ]
    then
              csp="/Active Directory/$domainname/All Domains"
    else
              csp="/Active Directory/$domainname"
    fi
    echo "Finished AD Binding."
    echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
    dscl /Search -create / SearchPolicy CSPSearchPath
    dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
    echo "Adding OD.."
    dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
    dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
    echo "Adding AD.."
    #Adding all Domains first to improve reliability under 10.7
    if [ "$alldomains" != "enable" ]
    then
        cspadall="/Active Directory/$domainname/All Domains"
        dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
        dscl /Search -append / CSPSearchPath "$cspadall"
    fi
    dscl /Search/Contacts -append / CSPSearchPath "$csp"
    dscl /Search -append / CSPSearchPath "$csp"
    echo "Finished Updating Search Paths."
    echo ""
    echo ""
    # Restart DirectoryService (necessary to reload AD plugin activation settings)
    killall opendirectoryd
    # Destroy the login hook (or change it)
    if [ "${newLoginHook}" == "" ]
    then
              defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
    else
              defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
    fi
    sleep 5
    # Customizing the login-Window
    #defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
    #defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
    #defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
    # This works in a pinch if the above code does not
    #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
    #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
    #plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
    #killall opendirectoryd
    # Disable autologin
    defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
    srm /etc/kcpassword
    echo ""
    echo ""
    echo ""
    echo "Now bound to OD Domain:"
    dscl localhost -list /LDAPv3
    echo "With Search Path entries:"
    dscl /Search -read / CSPSearchPath | grep /LDAP
    echo "Now bound to AD Domain:"
    dscl localhost -list "/Active Directory"
    echo "With Search Path entries:"
    dscl /Search -read / CSPSearchPath | grep /Active
    exit 0                    ## Success
    exit 1                    ## Failure
    Any inputs, questions and improvement suggestions are, of course, most welcome!
    Cheers
    See

    Hi everyone
    I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
    The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
    Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
    #!/bin/sh
    #Uncomment the following line to abort the script on errors
    #trap exit ERR
    ## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
    ## Script written by Marc Horat, URZ Basel, 11.6.2010
    ## Updated: 12.08.2011
    # With the use of the following sources as inspiration:
    # http://www.howtomac.co.uk/?p=247
    #Created by Ross Hamilton
    #Clock restart / Remove existing settings
    #Join to Open Directory and Active Directory
    # Bombich's AD-Bind Script:
    # This script binds to AD and configures advanced options of the AD plugin
    # As this scripts contains a password, be sure to take appropriate security
    # precautions
    # A good way to run this script is to set it as a login hook on your master machine
    # Because it only needs to be run once, the last thing this script does is to delete
    # itself. If you have another login script that you typically run, include the
    # script on your master machine, and indicate its path in the "newLoginScript"
    # variable.
    # If running this as a one-time login hook to bind to AD after imaging,
    # be sure to enable auto-login (for any local user) before creating your master image
    #################CONFIGURATION##########################
    #OD
    # These variables need to be configured for your env
    odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
    odPassword="YOURODPW"  # Enter your OD admin password between the quotes
    oddomain="YOURODDOMAIN" # FQDN of your OD domain
    computerGroup="YOURNEWODCOMPGROUP"  # Add appropriate computer group you want machines to be added to, case sensitive
    oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
    #AD
    # Standard parameters
    domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
    domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
    udn="YOURADADMIN"                              # username of a privileged network user
    password="YOURADPW"                                                  # password of a privileged network user
    ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
    # Advanced options AD Plugin
    alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
    localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
    protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
    mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
    mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
    useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
    user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
    preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
    # (e.g. "-nopreferred" or "-preferred ad.server.edu")
    admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
    packetsign="allow"                              # allow | disable | require
    packetencrypt="allow"                    # allow | disable | require
    passinterval="14"                              # number of days
    namespace="domain"                              # forest | domain
    # Login hook setting -- specify the path to a login hook that you want to run instead of this script
    newLoginHook=""                    # e.g., "/Library/Management/login.sh"
    ################################# End of configuration
    ############ Begin of Script
    # Host-specific parameters
    # computerid should be set dynamically, this value must be machine-specific
    # This value may be restricted to 19 characters! The only error you'll receive upon entering
    # an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
    #computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
    #computerid=`hostname | sed 's/.unibas.ch//'`
    #computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
    #computerid=`/usr/sbin/scutil --get LocalHostName`
    computerid=`scutil --get ComputerName`
    adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
    # These variables probably don't need to be changed
    # Determing if any directory binding exists
    nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
              check4OD=${check4ODtmp//[[:space:]]/}
              echo "Found LDAP: "$check4ODtmp
              check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
              check4ODacct=${check4ODaccttmp//[[:space:]]/}
              echo "Found LDAP-Computer-Account: "$check4ODacct
    else
              check4OD=""
              check4ODacct=""
              echo "No bound LDAP Server found"
    fi
    if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
              check4ODgroupMembership=$check4ODgroupMembershiptmp
              echo "LDAP Group Membership in Group: "$oldComputerGroup
    else
              check4ODgroupMembership=""
              echo "No LDAP Group Membership defined or not bound to a server"
    fi
    if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
    then
              check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//'  | sed 's/=//'`
              check4AD=${check4ADtmp//[[:space:]]/}
              echo "Found AD: "$check4AD
              check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
              check4ADacct=${check4ADaccttmp//[[:space:]]/}
              echo "Found AD-Account: "$check4ADacct
    else
              check4AD=""
              check4ADacct=""
              echo "No AD-Account found"
    fi
    osversionlong=`sw_vers -productVersion`
    osvers=${osversionlong:3:1}
    #Time Sync
    #Restart ntpdate
    StartService ()
    if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
              CheckForNetwork
    if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
              touch /var/run/NetworkTime.StartupItem
              echo "Starting network time synchronization"
    # Synchronize our clock to the network’s time,
    # then fire off ntpd to keep the clock in sync.
              ntpdate -bvs
              ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
    fi
    echo ""
    echo ""
    sleep 5
    #### Removing any existing directory bindings
    #Clear OD Computer Account and delete entry from Computer group
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              echo "This computer is bound to the following Open Directory Services:"
              dscl localhost -list /LDAPv3
              echo "With the Search Path entries:"
              dscl /Search -read / CSPSearchPath | grep /LDAP
              sleep 5
              if [ "${check4ODacct}" == "${computerid}" ]
              then
                        echo "This machine already has a computer account on $oddomain."
                        # Set the GUID
                        GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                        echo "Found GUID: "$GUID
                        if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                        then
                                  echo "Removing entry from group $oldComputerGroup"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                                  dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                        fi
                        echo "Removing Computer entry $computerid in OD"
                        dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
              fi
              #List existing Directories
              echo "Removing OD-Binding to "$check4OD
              dsconfigldap -r "$check4OD"
              echo "Removing Search Path entries"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
              dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
              sleep 5
    else
              echo "No LDAP or OD Binding present.";
    fi
    echo ""
    # Check a second time in order to delete any remaining LDAP-Bindings
    echo "Scanning for further LDAP servers"
    if dscl localhost -list /LDAPv3 | grep . > /dev/null
    then
              echo "Found:"
              dscl localhost -list /LDAPv3
              echo "Removing OD-Binding to "$check4ODtmp
              dsconfigldap -r "$check4ODtmp"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
              sleep 5
    else
              echo "No further LDAP or OD Binding present."
    fi
    echo ""
    echo ""
    #Remove the Active Directory binding
    if [ "$check4AD" != "" ]
    then
              echo "This computer is bound to the following Active Directory Services:"
              dscl localhost -list "/Active Directory"
              echo "With the Search Path entries:"
              dscl /Search -read / CSPSearchPath | grep /Active
              sleep 5
              echo "Removing any existing AD-Binding to "$check4AD
        dsconfigad -f -remove -username "$udn" -password "$password"
        echo "Removing Search Path entries"
              if [ "$preferred" != "-nopreferred" ]
              then
                        dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                        dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                        dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
              fi
              dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
              dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
    #remove search path entries from 10.6
        if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
        then
            dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
            dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        fi
              sleep 5
    else
              echo "No Active Directory Binding present."
    fi
    echo ""
    #Remove Existing Directory Services Config
    echo "Removing existing DS Config"
    if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
    then
              rm -R /Library/Preferences/edu.mit.Kerberos
    fi
    if [ -d "/etc/krb5.keytab" ]
    then
              rm -R /etc/krb5.keytab
    fi
    # Clean up the DirectoryService configuration files
    rm -Rfv /Library/Preferences/DirectoryService/*
    #OD
    echo ""
    echo ""
    echo "Binding to OD-Damin "$oddomain
    sleep 5
    dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
    echo "Killing opendirectoryd"
    killall opendirectoryd
    sleep 5
    echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
    # Set the GUID
    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
    # Add computer to ComputerList and ComputerGroup
    if [ $computerGroup != "" ]
    then
              echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
    fi
    echo "Finished OD Binding."
    sleep 5 # Give DS a chance to catch up
    echo ""
    echo ""
    echo "Performing the AD Binding"
    #AD
    # Activate the AD plugin
    defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
    plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
    #Use the existing AD-Computername or generate a new one
    computeridtmp="default"
    if [ "$check4ADacct" == "" ]
    then
              LEN=$(echo ${#adcomputerid})
              if [ $LEN -lt 15 ]; then
                      echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                      computeridtmp=$adcomputerid
              else
                      echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                        echo "Removing any -"
                      computeridtmp=${adcomputerid//-/}
                                  LEN=$(echo ${#computeridtmp})
                                  if [ $LEN -lt 15 ]; then
                                            echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                                  else
                                            echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                            computeridtmp=${computeridtmp:(-15)}
                                  fi
                      echo "Cropped Computername to "$computeridtmp
              fi
    else
        computeridtmp=${check4ADacct//$/}
        echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
    fi
    echo ""
    # Bind to AD
    echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
    dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
    echo ""
    echo "Setting the Advanced AD Plugin options"
    # Configure advanced AD plugin options
    if [ "$admingroups" = "" ]
    then
              dsconfigad -nogroups
    else
              dsconfigad -groups "$admingroups"
    fi
    dsconfigad -alldomains "$alldomains"
    dsconfigad -localhome "$localhome"
    dsconfigad -protocol "$protocol"
    dsconfigad -mobile "$mobile"
    dsconfigad -mobileconfirm "$mobileconfirm"
    dsconfigad -useuncpath "$useuncpath"
    dsconfigad -shell "$user_shell"
    dsconfigad "$preferred"
    dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
    dsconfigad -namespace "$namespace"
    sleep 5
    echo ""
    echo ""
    # Add the OD & AD node to the search path
    if [ "$alldomains" = "enable" ]
    then
              csp="/Active Directory/$domainname/All Domains"
    else
              csp="/Active Directory/$domainname"
    fi
    echo "Finished AD Binding."
    echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
    dscl /Search -create / SearchPolicy CSPSearchPath
    dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
    echo "Adding OD.."
    dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
    dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
    echo "Adding AD.."
    #Adding all Domains first to improve reliability under 10.7
    if [ "$alldomains" != "enable" ]
    then
        cspadall="/Active Directory/$domainname/All Domains"
        dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
        dscl /Search -append / CSPSearchPath "$cspadall"
    fi
    dscl /Search/Contacts -append / CSPSearchPath "$csp"
    dscl /Search -append / CSPSearchPath "$csp"
    echo "Finished Updating Search Paths."
    echo ""
    echo ""
    # Restart DirectoryService (necessary to reload AD plugin activation settings)
    killall opendirectoryd
    # Destroy the login hook (or change it)
    if [ "${newLoginHook}" == "" ]
    then
              defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
    else
              defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
    fi
    sleep 5
    # Customizing the login-Window
    #defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
    #defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
    #defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
    # This works in a pinch if the above code does not
    #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
    #defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
    #plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
    #killall opendirectoryd
    # Disable autologin
    defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
    srm /etc/kcpassword
    echo ""
    echo ""
    echo ""
    echo "Now bound to OD Domain:"
    dscl localhost -list /LDAPv3
    echo "With Search Path entries:"
    dscl /Search -read / CSPSearchPath | grep /LDAP
    echo "Now bound to AD Domain:"
    dscl localhost -list "/Active Directory"
    echo "With Search Path entries:"
    dscl /Search -read / CSPSearchPath | grep /Active
    exit 0                    ## Success
    exit 1                    ## Failure
    Any inputs, questions and improvement suggestions are, of course, most welcome!
    Cheers
    See

  • Open Directory Active Directory users want to know Is there a method?

    Help
    Open Directory Active Directory users want to know Is there a method?
    Or can I make the Active Directory users to share on the Open Directory.
    My goal is to use our school Mac computers with SSO

    If I understand your question correctly, using Active Directory with OSX, there are a few ways this can be accomplished.
    One way is by joining each Mac directly to Active Directory. This doesn't take advantage of the additional managed preference available to OSX, but does allow AD users to authenticate on OSX. On each machine, one would open System Preferences > Accounts > Login Options > Click Join next to Network Account Server. Follow the prompts and provide the domain name of your Active Directory deployment to join the system.
    Another method is to follow the steps above, but only after extending the Active Directory Schema to support the OSX-specific managed preferences. It's a mostly harmless operation and means that you'll have a single administration interface for both OSX and Windows systems. The AD Schema information is available from Apple Support, but may also be readily available on the Internet.
    Because our Windows team preferred to not change our AD schema any more than we already had, we used a different method. We created an Open Directory Master on one of our OSX servers, then we joined it as a member server to Active Directory. Next, we join all of our OSX workstations and laptops as members to the Open Directory domain instead of to Active Directory.  This way, SSO still works.  New user accounts are added to Active Directory and all managed preferences for OSX can be managed through the native OSX Workgroup Manager tool.
    I think there are some instructions in the User Management PDF (Mac OS X Server, User Management, Version 10.6 Snow Leopard) or in the Advanced Server Admin PDF (Mac OS X Server, Advanced Server Administration, Version 10.6 Snow Leopard) but not completely certain. This page might have the docs.

  • Binding Exchange server to Open Directory

    So I am setting up an exchange 2010 sandbox machine to see how feasible the install and usage of the software is within the company. When running through the installation it wants the exchange server machine to be bound to an active directory. Well I dont have any active directory servers all I have is our open directory. How can I tie in the exchange binding to the open directory? I have heard about integrating between OD and AD but it seems like it requires yet another AD machine.
    Any thoughts? Success Stories?

    The answer is to remove the local KDC on the 10.5 clients. 10.5 uses the LKDC for personal file sharing - not needed for networked clients.
    Run the following commands to kill LKDC before binding the machine to Open Directory:
    sudo dscl /Local/Default delete /Config/KerberosKDC
    sudo rm -rf /var/db/dslocal/nodes/Default/config/KerberosKDC.plist
    See: http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc

  • My Iphone doesn't want to open because its disabled, what can I do to open it?

    My Iphone doesn't want to work because its disabled by making the passowrd wrong to many times. It tells me to connect it to Itunes. I did I connected it to Itunes but it tells me that please respond on your Iphone. I can't open my Iphone so I can't respond. Any Ideas on how I might open it?

    http://support.apple.com/kb/ht1212

  • Lenvo User Guide doesn't want open the pdf file. Why!?

    Lenvo User Guide application doesn't want open the pdf file after selecting my language. I have Adobe Reader installed on my laptop and application is from oryginal Lenovo cd with drivers. I don't know why. Earlier it worked perfectly. I installed and reinstalled it many times but the problem still exist. Does anybody know the solution?

    hi tora117,
    Welcome to Lenovo Community Forums!
    Can you try right clicking the User guide file and go to General tab  and check if the "open with" settings is set to Adobe Reader.
    If still won't work download a new User guide from www.support.lenovo.com
    Home this helps
    Cheers!
    Did someone help you today? Press the star on the left to thank them with a Kudo!
    If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
    Follow @LenovoForums on Twitter!

  • My upgrade to Photoshop Elements 12 was deleted by accident. The 2nd download doesn't want to open?

    In Aug I upgraded to Photoshop Elements 12. It worked fine but this week someone worked on my PC and deleted it by accident. Now I downloaded it again but it doesn't want to open?

    Alan
    If your program is Photoshop Elements 12, you have posted in the wrong forum. Somehow you thread got posted in the Adobe Premiere Elements Forum.
    Please re-post your thread in the Adobe Photoshop Elements Forum or wait for a moderator here to see your thread here and move it from here to there.
    Photoshop Elements
    While you do that something to think about....putting on my Photoshop Elements 12 hat for the moment...
    If you have Photoshop Elements 12 and are in its Elements Organizer 12 and you want to edit of of the Elements Organizer 12 photos in the Photoshop Elements 12 Editor, I do not
    find any right clicks in that maneuver. Have you tried...
    1. Select the Elements Organizer 12 thumbnail for the photo
    2. Look to the bottom of the workspace to where it shows an Editor button. Click on the tiny triangle to the right of the work Editor in the button.
    You should then get a pop up menu with choices of External Editor, Photoshop, Video Editor. click Photoshop. Does that work to get
    you into the Photoshop Elements 12 Editor workspace to edit that photo?
    ATR

  • Local Admin Doesn't Authenticate on Open Directory 10.9

    Running 10.9.4.  I exported my open directory database from my old 10.6 server and imported into my new 10.9.4 server.  Everything worked without a hitch, except that the local admin can't administer the database, only the old directory admin (which works, but after every action, it tells me I'm not authenticated... even though it still works).
    I double checked, and sure enough, all the admins are in the directory administer group:
    GroupMembership: root diradmin rfinn
    Member: root diradmin rfinn
    NestedGroups: 9B953861-B2D1-43A2-BC57-F53C0C33F236
    PrimaryGroupID: 80
    RealName:
    Open Directory Administrators
    RecordName: admin
    RecordType: dsRecTypeStandard:Groups
    But... it still doesn't authenticate in Workgroup Manager.  Just to be sure, I re-added the LDAP admin GUID to the local admin's nested group list, but that didn't fix the issue either.  Suggestions?
    Thanks,
    -Rob

    Running 10.9.4.  I exported my open directory database from my old 10.6 server and imported into my new 10.9.4 server.  Everything worked without a hitch, except that the local admin can't administer the database, only the old directory admin (which works, but after every action, it tells me I'm not authenticated... even though it still works).
    I double checked, and sure enough, all the admins are in the directory administer group:
    GroupMembership: root diradmin rfinn
    Member: root diradmin rfinn
    NestedGroups: 9B953861-B2D1-43A2-BC57-F53C0C33F236
    PrimaryGroupID: 80
    RealName:
    Open Directory Administrators
    RecordName: admin
    RecordType: dsRecTypeStandard:Groups
    But... it still doesn't authenticate in Workgroup Manager.  Just to be sure, I re-added the LDAP admin GUID to the local admin's nested group list, but that didn't fix the issue either.  Suggestions?
    Thanks,
    -Rob

Maybe you are looking for