Re: [Fed-Talk] NetBoot with Active Directory Accounts
Re: [Fed-Talk] NetBoot with Active Directory Accounts
- Subject: Re: [Fed-Talk] NetBoot with Active Directory Accounts
- From: "Simon, Gary" <email@hidden>
- Date: Thu, 9 Oct 2008 12:02:09 -0600
- Acceptlanguage: en-US
- Thread-topic: [Fed-Talk] NetBoot with Active Directory Accounts
Title: Re: [Fed-Talk] NetBoot with Active Directory Accounts
Hi Joel,
That’s kind of what I figured. Both options have their drawbacks, but option 2 seems more plausable. I wonder if we could unbind the machine with a logout hook to keep down the number of orphaned accounts?
Gary
On 10/9/08 10:56 AM, "Joel Rennich" <email@hidden> wrote:
On Oct 9, 2008, at 9:46 AM, Simon, Gary wrote:
> Has anyone tried to configure a NetBoot image so that it could use
> Active Directory accounts? I can’t seem to find any documentation
> on how this could be done.
The tricky thing here is the machine account.
Two options:
1. bind the machine and then image. Use dsconfigad to change the
password change time to something very very long. All machines will
use the same machine account. If any one of them changes it... all the
others will stop working.
2. Image the machine unbound. Have a launchd item to bind after boot.
Each machine uses it's own machine account. However, you'll probably
have a boatload of orphaned accounts after doing this for a while.
Plus on first boot you'll have a bit of a delay as the machine binds
to AD before the users can login. This might not be noticeable.
Joel
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden