Show Network Users (as List) not working consistently (10.5 server/client)

Question

I am running an Xserve with 10.5.5 Server as an Open Directory Master. When I go to the Computer Group the clients are listed in and set the preference to show network users as list on the loginwindow, the clients are not constantly displaying the list. Network Accounts are available on the client and typing the username in Other is also logging in.
What I think is strange is that my custom heading always displays, so I know I'm getting at least some of the mcx settings on the client. This was not a problem with 10.5.4 client/server combo. If only local accounts are listed, you can restart and 50% of the time the network users show up in the list. You can also log in as a local user and log out, this will sometimes refresh the list to display network users. However, whether or not the users are displayed in the list, network accounts are always available and can login via Other.
Does anybody know what I can do to fix the problem? It is an elementary school environment, so it is not feasible to have kindergarten students to type out their names every single time.
One possible solution I came up with is to replace the 10.5.5 loginwindow on the client with the 10.5.4 version, but 10.5.5 supposedly fixes a lot of problems with it. Are there any negative consequences that could occur from doing this besides the fact that I lose the security fixes to the 10.5.5 version? I know that my 10.4.11 clients do not experience this problem, so I'm guessing that the 10.5.4 loginwindow might just work, but wanted to see if anyone knew of any issues in doing this.
I have also written a program that manages our clients for automated naming, image OS version assignment with NetRestore, and generate import files that create computer and computer list records for Workgroup Manager. This information is stored in a MySQL database and the program I wrote generates files that are imported into Workgroup Manager for list assignment. The computer lists are generated by room number, and computers are assigned names with their corresponding room number and placed in the appropriate computer list. In 10.5, I see that there is a push for Computer Groups rather than Computer Lists. However my program assigns computers to lists using the computer record name rather than the generated uid of the computer record like the computer group expects. From what I understand, the only benefit to Computer Groups is that you can include other Computer Groups within Computer Groups. Does this create any issues for mcx management? I have tried both groups and lists and have the same problem with loginwindow network user lists on 10.5.5.
Another question I have is how do you change the Cache settings now in WGM? In 10.4.11, there was a "Cache" tab where you could force clients to refresh the MCX cache after x amount of time, but the tab has been removed in 10.5. Can I add that mcx flag to Open Directory and have my 10.5 clients respect the policy, or has this been outdated in 10.5?
Thanks,
Chris Bethel
Hamilton County Dept. of Education
Chattanooga, TN
[email protected]

Answer 1

Thanks for your reply, it gave me an idea that seems to be working so far:
This is not feasible for anything other than an elementary school with network homes. It is extremely insecure but when you need a working product, you pretty much gotta do what you gotta do. Here's what I've done:
1. I created a local administrator user with the name "@ Refresh List" with short name "refreshlist" with no password.
2. Launch Script Editor (in /Applications/AppleScript/Script Editor) and paste this code:
do shell script "rm -Rf '/Library/Managed Preferences'" password "" with administrator privileges
do shell script "killall loginwindow" password "" with administrator privileges
3. Save with file format set to Application, check "Run Only" and uncheck all other boxes to somewhere the user home folder.
4. In the Accounts pane of System Preferences, select the "@ Refresh List" user and go to the Login Items tab.
5. Drag in the application you just saved.
6. Quit System Preferences and log out.
This is EXTREMELY bad for security, but since its elementary school students and network home folders, there's not much for them to mess up. It provides a 1-click process to updating the much needed list.
Also -- I've tried swapping out loginwindow with 10.5.4 and experienced the exact same result.
My fix is quick and dirty, but gets the job done.
Does anyone else have any suggestions?
Message was edited by: WollarinTJ