Tiger and Active Directory - Page 18

russelldd · 10-18-2007, 12:49 PM

I am trying to integrate a Mac Book Pro into an existing Windows Small Business Server 2003 AD network. I can not seem to connect to any share on the server. Yes, this has been covered in this thread quite a bit. I have tried every solution offered so far and have had zero success. This is a brand new Mac Book Pro, fresh out of the box. I have updated the software and that's it. I haven't loaded Adobe creative suite yet because if I can't share files, there won't be much use for this machine.

So here is a list of everything I have tried along with the printout of relevant console entries:

Straight connect using the finder window.

mount_smbfs: error from NetrShareEnum call: exception = 382312522
mount_smbfs: tree connect phase failed: syserr = Permission denied
mount_smbfs: could not login to server (ServerNameHere): syserr = Permission denied

Using domain\username instead of username results in the identical failure and console entry.

------------------------

Using Command-K and

cifs://(domain); (ServerIP)/(sharename)
smb://(domain); (ServerIP)/(sharename)
cifs://(ServerIP)/(sharename)
smb://(ServerIP)/(sharename)
cifs://(domain); (ServerName)/(sharename)
smb://(domain); (ServerName)/(sharename)
cifs://(ServerName)/(sharename)
smb://(ServeName)/(sharename)

All of these cause the following in the console:
mount_smbfs: tree connect phase failed: syserr = Permission denied

------------------------

I have created and set the IRPStackSize to 15, 18, and now 20 on the server.

I have tried these when bound or unbound to AD.

I even changed it so the Mac stopped sending the password encrypted. That did not work. (I've since changed it back)

Nothing seems to work. I am simply trying to mount a share. It seems that this should be simple enough. If I had hair longer than a 1/4" it'd be gone.

yellow · 10-18-2007, 05:01 PM

Are you putting the domain and whatnot in parenthasis, or is that just to illustrate your point?

smb://DOMAIN;username@fqdnofserver/sharepoint

russelldd · 10-18-2007, 10:37 PM

Quote:

Originally Posted by yellow


	Are you putting the domain and whatnot in parenthasis, or is that just to illustrate your point? smb://DOMAIN;username@fqdnofserver/sharepoint

That was to illustrate my point.

Naturally, I found an answer to the problem after posting here by attacking it as a windows issue, rather than a Mac problem.

I found this http://www.macosxhints.com/article.p...50302023720578

That ended up solving the problem.

Raven · 10-30-2007, 10:16 AM

A question to all who participate in this thread... Should we continue with Leopard here or create a new sticky thread for AD on 10.5... as it seems there will be lots to talk about on that one too... We've tried it here where 10.4 works beautifully and now with 10.5 we can bind stations but can't authenticate afterwards...
Personally I'd go with creating another sticky as this one became almost a support forum by itself ! and it should be kept to 10.4 only.

PS: Guess the choice is up to you yellow ! loll

Good to be back !

yellow · 10-30-2007, 01:28 PM

There's a locked sticky for Leopard already.

Which has now been opened:

http://forums.macosxhints.com/showthread.php?t=66101

Raven · 11-02-2007, 10:19 PM

All fine by me ! I hope we'll all enjoy less headaches with this one !

cgroves · 01-02-2008, 08:12 PM

I stumbled on this thread recently as I have been trying to troubleshoot an issue I have with our Macs that started a little over 3 weeks ago.

The Macs in questions are running Tiger and still on the PowerPC architecture. They were previously able to login properly with a network login, print, file share... everything that was needed.

Something happend though where they can no longer login without having the user setup locally. Once the user is setup you can ping all of the servers/computers on the domain - however when browsing for shares it will show around 1/4th of the domain itself.

I have tried to bind/unbind each of the workstations as well as trashed the /Library/Preferences/DirectoryServices without much success.

We have one other Intel-based Mac that is setup exactly the same way and is not having any issues for the time being.

Could there be some update that went out on the PowerPC Macs? Any other thoughts on the matter?

Thanks in advance and no rush either! Keep up the great thread.

mathew_archuleta · 01-17-2008, 09:28 PM

I'm new to using Mac with AD so I don't really know where to go with this. I have 6 users that are using Macs and approximately every 10 to 15 minutes there accounts will get locked out. Are policy is 3 bad attempts to login will cause a lock out and every 90 days users are required to set a new password. So far I have tried to delete all the keychain Logins, I deleted the entourage exchange account, made sure the time matched the server exactly and have had no success. The department that is using Macs is in advertisement so they really do not have any applications that need credentials aside from entourage and accessing a share drive. Has anyone else experienced this or does anyone else have any ideas of what might be causing these lock outs.

SLDaG · 05-07-2008, 05:49 PM

Quote:

Originally Posted by yellow


	No need to use NetInfo Manager. Just use chown and chmod to apply their new UID to their existing files/folders. Here's how I moved existing users: Log in as root, rename their home directory in /Users, logout root, log in with their AD crudentials, logout, log in as root, remove the newly created home directory, rename their old home directory to their new AD username, open Terminal, do: chown -R newusername:group /Users/newhomedirectory and chmod -R ug+wrX /Users/newhomedirectory Logout of root. That's all there is to it.

Is it possible to automate this process yellow? I have about 200 Macs, all of which I fell into managing.

They do not log in via any directory service and they will all be migration / transitioning to AD in about 2 months. They all login to a local account.

I do not want to have to touch 200 Macs and know there must be some type of way to keep them on their existing home folders when they migrate to AD.

Any help is greatly appreciated.

tlarkin · 05-07-2008, 07:21 PM

Quote:

Originally Posted by SLDaG


	Is it possible to automate this process yellow? I have about 200 Macs, all of which I fell into managing. They do not log in via any directory service and they will all be migration / transitioning to AD in about 2 months. They all login to a local account. I do not want to have to touch 200 Macs and know there must be some type of way to keep them on their existing home folders when they migrate to AD. Any help is greatly appreciated.

Can you afford the possibility of also buying an OD xserve to bind to the AD server for home directories? If so, you can sync the home directory from the local machine to the server.

In all honesty, it is best to practice the golden triangle (or magic triangle - whatever you want to call it) with a mixed environment. I know not everyone can afford it, but if you can scrap a few extra grand, just buy an Apple server and bind an OD server to the AD and a lot of your problems will go away, and you can use the AD for authentication.

yellow · 05-08-2008, 11:17 AM

Quote:

Originally Posted by SLDaG


	Is it possible to automate this process yellow?

Unfortunately no, as it requires the user to be present to login with their new AD credentials.

Or I should say, I have not attempted to automate the process as I could not trust the outcome.

Though Apple Remote Desktop should help a lot.

bobchavez · 08-23-2008, 01:23 AM

We are implementing the Golden Triangle in our school district with 2500+ PCs and 2000+ Macs running XP and 10.4 clients, respectively. We are also running Win 2003 and Apple 10.5 server. We have been testing this and all worked well, binding, home directories, logging in, etc. in a completely separate test environment.

Today, we started implementing in a production environment with our existing AD and are having problems binding our Apple 10.4.11 clients. When we try to bind, we get an error that the container (Computers - as defined in AD) doesn't exist BUT we can bind a MacBook running 10.5 client to the production (existing) AD.

One thing I did notice is that our test AD is running/configured in a Windows 2003 mixed functional level as opposed to the production where it is running/configured in a Windows 2003 Native functional level. I'm not an AD person. Could this difference cause this problem? Can anyone shed some light on the problem?

We need to get this fixed as school starts in a 10 days. Thanks from Bob in Illinois.

yellow · 08-31-2009, 08:17 AM

10.6 = http://forums.macosxhints.com/showthread.php?t=104825
10.5 = http://forums.macosxhints.com/showthread.php?t=66101

I'm going to unstick this in favor of the two newer OS' linked above.

10-18-2007, 12:49 PM	#341
russelldd Prospect Join Date: Oct 2007 Posts: 2	Mac Book Pro to Windows SBS 2003 I am trying to integrate a Mac Book Pro into an existing Windows Small Business Server 2003 AD network. I can not seem to connect to any share on the server. Yes, this has been covered in this thread quite a bit. I have tried every solution offered so far and have had zero success. This is a brand new Mac Book Pro, fresh out of the box. I have updated the software and that's it. I haven't loaded Adobe creative suite yet because if I can't share files, there won't be much use for this machine. So here is a list of everything I have tried along with the printout of relevant console entries: Straight connect using the finder window. mount_smbfs: error from NetrShareEnum call: exception = 382312522 mount_smbfs: tree connect phase failed: syserr = Permission denied mount_smbfs: could not login to server (ServerNameHere): syserr = Permission denied Using domain\username instead of username results in the identical failure and console entry. ------------------------ Using Command-K and cifs://(domain); (ServerIP)/(sharename) smb://(domain); (ServerIP)/(sharename) cifs://(ServerIP)/(sharename) smb://(ServerIP)/(sharename) cifs://(domain); (ServerName)/(sharename) smb://(domain); (ServerName)/(sharename) cifs://(ServerName)/(sharename) smb://(ServeName)/(sharename) All of these cause the following in the console: mount_smbfs: tree connect phase failed: syserr = Permission denied ------------------------ I have created and set the IRPStackSize to 15, 18, and now 20 on the server. I have tried these when bound or unbound to AD. I even changed it so the Mac stopped sending the password encrypted. That did not work. (I've since changed it back) Nothing seems to work. I am simply trying to mount a share. It seems that this should be simple enough. If I had hair longer than a 1/4" it'd be gone.

10-30-2007, 10:16 AM	#344
Raven Hall of Famer Join Date: Jul 2003 Location: Montreal Posts: 4,782	A question to all who participate in this thread... Should we continue with Leopard here or create a new sticky thread for AD on 10.5... as it seems there will be lots to talk about on that one too... We've tried it here where 10.4 works beautifully and now with 10.5 we can bind stations but can't authenticate afterwards... Personally I'd go with creating another sticky as this one became almost a support forum by itself ! and it should be kept to 10.4 only. PS: Guess the choice is up to you yellow ! loll Good to be back ! __________________ Waffled foreheads are a symptom of broken keyboards and inexperienced users

10-30-2007, 01:28 PM	#345
yellow Moderator Join Date: Jan 2002 Posts: 10,677	There's a locked sticky for Leopard already. Which has now been opened: http://forums.macosxhints.com/showthread.php?t=66101 Last edited by yellow; 10-31-2007 at 11:07 AM.

11-02-2007, 10:19 PM	#346
Raven Hall of Famer Join Date: Jul 2003 Location: Montreal Posts: 4,782	All fine by me ! I hope we'll all enjoy less headaches with this one ! __________________ Waffled foreheads are a symptom of broken keyboards and inexperienced users

01-17-2008, 09:28 PM	#348
mathew_archuleta Registered User Join Date: Jan 2008 Posts: 1	Several User getting locked out of AD I'm new to using Mac with AD so I don't really know where to go with this. I have 6 users that are using Macs and approximately every 10 to 15 minutes there accounts will get locked out. Are policy is 3 bad attempts to login will cause a lock out and every 90 days users are required to set a new password. So far I have tried to delete all the keychain Logins, I deleted the entourage exchange account, made sure the time matched the server exactly and have had no success. The department that is using Macs is in advertisement so they really do not have any applications that need credentials aside from entourage and accessing a share drive. Has anyone else experienced this or does anyone else have any ideas of what might be causing these lock outs.

10-18-2007, 05:01 PM	#342
yellow Moderator Join Date: Jan 2002 Posts: 10,677	Are you putting the domain and whatnot in parenthasis, or is that just to illustrate your point? smb://DOMAIN;username@fqdnofserver/sharepoint

01-02-2008, 08:12 PM	#347
cgroves Registered User Join Date: Jan 2008 Posts: 1	I stumbled on this thread recently as I have been trying to troubleshoot an issue I have with our Macs that started a little over 3 weeks ago. The Macs in questions are running Tiger and still on the PowerPC architecture. They were previously able to login properly with a network login, print, file share... everything that was needed. Something happend though where they can no longer login without having the user setup locally. Once the user is setup you can ping all of the servers/computers on the domain - however when browsing for shares it will show around 1/4th of the domain itself. I have tried to bind/unbind each of the workstations as well as trashed the /Library/Preferences/DirectoryServices without much success. We have one other Intel-based Mac that is setup exactly the same way and is not having any issues for the time being. Could there be some update that went out on the PowerPC Macs? Any other thoughts on the matter? Thanks in advance and no rush either! Keep up the great thread.

08-23-2008, 01:23 AM	#352
bobchavez Prospect Join Date: Aug 2008 Location: Algonquin, Illinis Posts: 4	Can't find container We are implementing the Golden Triangle in our school district with 2500+ PCs and 2000+ Macs running XP and 10.4 clients, respectively. We are also running Win 2003 and Apple 10.5 server. We have been testing this and all worked well, binding, home directories, logging in, etc. in a completely separate test environment. Today, we started implementing in a production environment with our existing AD and are having problems binding our Apple 10.4.11 clients. When we try to bind, we get an error that the container (Computers - as defined in AD) doesn't exist BUT we can bind a MacBook running 10.5 client to the production (existing) AD. One thing I did notice is that our test AD is running/configured in a Windows 2003 mixed functional level as opposed to the production where it is running/configured in a Windows 2003 Native functional level. I'm not an AD person. Could this difference cause this problem? Can anyone shed some light on the problem? We need to get this fixed as school starts in a 10 days. Thanks from Bob in Illinois.

08-31-2009, 08:17 AM	#353
yellow Moderator Join Date: Jan 2002 Posts: 10,677	10.6 = http://forums.macosxhints.com/showthread.php?t=104825 10.5 = http://forums.macosxhints.com/showthread.php?t=66101 I'm going to unstick this in favor of the two newer OS' linked above.