Mac: Kerberos time-outs and locked screen saver

This is an interesting little glitch.

On AD bound Macs if a user has their screen-saver set to require a password to deactivate and the user leaves their computer on for more than 10 hours, they will not be able to unlock the screen-saver. Apple has confirmed that this is a problem and advises that the user should enter their user name and password and then wait for one minute before they press “OK.”

This affects all versions of OS X through 10.5.7. The latest 10.5.8 patch is supposed to fix the issue.

The default time-out for a Kerberos ticket is 10 hours but with the screen-saver password lock enabled the Mac doesn’t auto renew the ticket properly. Normally every time you unlock your screen-saver it refreshes the Kerberos ticket back to 10 hours but this simply doesn’t happen if they machine has been sitting on and idle for over 10 hours.

Creating a mobile account after the fact: Mac

If you need to enable a mobile account after you have already set up a user's network account (and didn't create the mobile account at first log in) do the following:

On the client, log in as the local Administrator, and in Terminal
issue the command:

sudo /System/Library/CoreServices/ManagedClient.app/Contents/
Resources/createmobileaccount -vsn myusername /my/homedirectory

The variables "myusername" and "/my/homedirectory" are specific to
the account you are working with.

If you don't want syncing enabled, the argument is -vSn

Shaky login on Mac

Normally shaky logins are caused by missing or corrupt edu.mit.kerberos files so always check that first but you might also want to look at the user's e-mail address in AD too.

We had a user who couldn’t log into any bound Mac using his AD account however he could log into a PC. On the Macs, he would get a shaky login box and a cryptic error saying “you can’t log in at this time”.

Checking his AD account I noticed that he didn’t have a secondary SMTP of @corp.ipgnetwork.com. I added the SMTP, waited for replication and then he was able to log in.

Outlook 2007 command line tools

Great set of Outlook 2007 command line tools:

http://office.microsoft.com/en-gb/outlook/HP012185891033.aspx