Re: [Rockies-Edu] AD and 10.10

Subject: Re: [Rockies-Edu] AD and 10.10
From: Zachary Miller <email@hidden>
Date: Thu, 22 Jan 2015 08:30:29 -0700

Thank you Don! I am so grateful that you have found this article. I am embarrassed I didn't find it. Thank you for all your help and support Rockies Edu!

Zach

On Wed, Jan 21, 2015 at 3:42 PM, Michael T. Scott <email@hidden> wrote:

Thanks all for the great discussion and grounding real world experiences.

If I’m looking at the boot progress bar hanging behavior that Andy describes, then the JAMF Nation thread that Don points to appears to be a functional workaround in multiple environments:

> Posted 1/14/15 at 11:59 AM by chris.hotte
>
> I've tried all of the above suggestions which did not provide a consistent fix. But this does.
>
> On the client only, you may hijack the unused /etc/rc.server bash hook, eg single user boot:
>
> bash-3.2# mount -uw /
> bash-3.2# /usr/bin/nano /etc/rc.server
>
> #!/bin/sh
> /bin/echo BootCacheKludge Beta 1.0 - Chris Hotte 2015 - No rights/blame reserved.
> /usr/sbin/BootCacheControl jettison
>
>
> Boots are now completing 0 of the time.
>
> Edit: We are now beta testing this workaround on ~50 machines.

How does this work for you folks?

-Mike


Michael Scott, Systems Engineer
Apple Education
Apple Inc.
(720) 346-3871
www.apple.com/education

> On Jan 21, 2015, at 2:21 PM, Jonathan Ender <email@hidden> wrote:
>
> Andy,
>
> I understand updating the OS for parity in general, but I’m surprised you put everyone on Yosemite vs. having iOS devices just export files to PDF or another compatible form to be opened in MS Word or what not.
>
> We have multiple macbooks (also about 800 iPads) and have also had our share of numerous issues on Yosemite which has resulted in telling people to NOT update to it because it’s a FAR CRY from an “upgrade” to say the least; even with the release of 10.10.1 thus far. If only apple understood and applied the concept of “backwards compatibility.”
>
> We have had some issues with macbooks booting up that are bound to AD, but not a ton. In one case we booted in single user mode and then re-started, but we can’t guarantee that was the exact fix as this happened about a month back and my boss doesn’t fully recall what he did. Most of our issues with Yosemite have been regarding wireless connectivity and multiple issues with apple mail where it automatically changes accounts over to google.
>
> -Jonathan
>
> From: rockies-edu-bounces+jonathan.ender=email@hidden [mailto:rockies-edu-bounces+jonathan.ender=email@hidden] On Behalf Of Don Cochran
> Sent: Wednesday, January 21, 2015 1:18 PM
> To: email@hidden
> Subject: Re: [Rockies-Edu] AD and 10.10
>
> Here is a thread on Jamf Nation discussing the same problem. If you go toward the end of the thread, it appears one of the folks has found a work around that appears to be working.
>
> https://jamfnation.jamfsoftware.com/discussion.html?id=12589
>
> On Wed, Jan 21, 2015 at 1:04 PM, Andy Gerhard <email@hidden> wrote:
> Michael,
>
>
> Let me add my experience to Zach's, and see if we can agree on a different perspective.
>
>
> I've been managing an Active Directory environment for several years with Mac's bound to AD. There was very little mystery to setting up this environment, and we marched steady forward through all the cats in the Mac OS land with little changing in the AD connector. Mavericks brought us additional happiness with a more usable SMB, and Microsoft DFS became less flaky with Mac clients.
>
>
> My world is complicated by 700 students carrying iPads. As we move forward with iOS releases, we are forced into a unpleasant challenge with iWork applications being unable to play well with different versions, so our inclination was to move to Yosemite to achieve platform/software parity. The dsconfigad/Active Directory binding experience was identical to previous releases... there are very few bells and whistles to making this work.
>
>
> We moved the bulk of our school to OS X 10.10.1 (because of wi-fi problems with 10.10). We immediately ran into the problem of boot progress bar hanging. I have found I can reproduce the hang much more readily than recovering from it. The easiest way is to force-shutdown. If AD bound, the subsequent boot has a high probability of failing. I have unbound my test machine, and yanked the power cord as well as force-shutdown multiple times, and the boot hang does not re-occur. As soon as I re-bind to AD, the boot hang can be reproduced with a force-shutdown.
>
>
> So here is my single, specific goal: Have an OS X 10.10.1 machine consistently and reliably boot while bound to AD, exactly as it did in previous releases of the OS.
>
>
> "Out of the box, OS X seamlessly integrates with a variety of directory service technologies, including Active Directory, Microsoft's implementation of directory services." (From "Best Practices for Integrating OS X with Active Directory", OS X Yosemite v10.10, December 2014.) From my perspective, the seams are clearly coming apart.
>
>
> I accept the complexity and challenge of AD integration. In my case, I've had an integrated environment that has worked fairly well for a long while. This integration has been compromised by an Apple software update. In the wild, we have machines experiencing the boot hang without having performed a force-shutdown, so our pain is not simply eliminated by removing some unwanted behavior. With our classroom instruction environment becoming increasingly dependent on computing resources, being unable to boot is forcing many teachers into their "plan B," taking the promise of technology assisted learning down a notch. Our support staff is living the movie "Groundhog Day" as they repeatedly deal with hung-boot machines. We are now actively moving clients back to Mavericks and taking iWork apps out of the picture in an effort to avoid this crippling failure.
>
>
> We have opened case # 728023624, and have been told our experience is shared by others and that there is no work around or resolution other than to unbind from AD, once you can get the machine to boot. I will continue my investigation, taking an out-of-box imaged computer and repeating my AD/no-AD testing, but the first question of troubleshooting usually is "What has changed?", which in this case is the version of the OS. There are more than a few of us that have been significantly impacted by this bug, and we are eagerly awaiting some relief from Apple.
>
>
> Regards,
>
>
> Andy Gerhard
>
> Sr. Network and Systems Administrator
> Cherry Hills Community Church
> Cherry Hills Christian Schools
> 303-325-8207 (Anytime)

> This e-mail is intended only for the person or entity to which it is addressed . It may contain information that is privileged and confidential. This information is delivered to you with the trust that it will not be shared with others without permission. Any disclosure, copying, further distribution or use thereof is prohibited. If you have received this communication in error, please advise me by return email and delete it. Remember, e-mail sent through the internet is not secure, so please do not send sensitive material through unencrypted e-mail. Thank you.
>

> From: rockies-edu-bounces+agerhard=email@hidden <rockies-edu-bounces+agerhard=email@hidden> on behalf of Michael T. Scott <email@hidden>
> Sent: Tuesday, January 20, 2015 4:22 PM
> To: email@hidden
> Subject: Re: [Rockies-Edu] AD and 10.10
>
> Hi Zach!
>
> With the complexity inherent in an AD integration project, it can be a formidable challenge to understand where to begin the troubleshooting process. I am of the belief that complex technology integration projects benefit heavily from investment in experienced, expert assistance. Paid training and support goes a long way to condensing the time and effort you describe having already invested.
>
> Can you begin by describing a single, specific goal? For example - “I have a goal for AD user authentication at the OS X login window in order to provide students with a single set of credentials to support shared desktop computer access.” With that goal in mind, I would then ask you to describe a specific configuration and failure you are experiencing, such as “The computer is bound to AD using Directory Utility. After entering a correct username and password, the login window ‘shakes’ and does not allow the user access to the computer.”
>
> With a specific goal articulated, and a failure being replicated, we can begin troubleshooting. I know you are already pretty far down the development road, but for the sake of the public email list, let’s start at the top.
>
> If you are able to put you efforts and my questions into the context of Apple’s best practices, even better. More here on our current recommendation for AD integration:
>
> http://training.apple.com/pdf/wp_integrating_active_directory_yosemite.pdf
>
> Thanks,
>
> -Mike
>
> 
> Michael Scott, Systems Engineer
> Apple Education
> Apple Inc.
> (720) 346-3871
> www.apple.com/education
>
>
>
>
>> On Jan 19, 2015, at 8:23 PM, Zachary Miller <email@hidden> wrote:
>>
>> Hello and thank you for your time! I have spent lots of time with Apple enterprise support, on Google looking for information as well as reaching out to providers and associates. I am having trouble with machines that are on Yosemite and bound to AD. I have tried some things I found in articles surrounding FQDN's to no avail. If you have experienced this issue and found any band-aid type fixes or resolutions would you send them my way? I greatly appreciate your time!
>> Zach
>>
>> --
>> Zachary Miller
>> District Tech
>> Manitou Springs School District
>> Office Phone: (719)685-2667
>> Cell Phone: (719)352-8544
>> _______________________________________________
>> Do not post admin requests to the list. They will be ignored.
>> Rockies-edu mailing list (email@hidden)
>> Help/Unsubscribe/Update your Subscription:
>>
>> This email sent to email@hidden
>
>
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Rockies-edu mailing list (email@hidden)
> Help/Unsubscribe/Update your Subscription:
>
> This email sent to email@hidden
>
>
>
>
> --
> Don Cochran
> ISTS Technician
> Thompson R2J School District
> 2890 N Monroe
> Loveland, CO 80538
> 970 613-5164
> email@hidden
> Twitter: @macdcsound
>
> “Education is the kindling of a flame, not the filling of a vessel.” - Socrates
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Rockies-edu mailing list (email@hidden)
> Help/Unsubscribe/Update your Subscription:
>
> This email sent to email@hidden

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Rockies-edu mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

Zachary Miller
District Tech
Manitou Springs School District

Office Phone: (719)685-2667

Cell Phone: (719)352-8544

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Rockies-edu mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

Follow-Ups:
- Re: [Rockies-Edu] AD and 10.10
  - From: Andy Gerhard <email@hidden>

References:
	>[Rockies-Edu] AD and 10.10 (From: Zachary Miller <email@hidden>)
	>Re: [Rockies-Edu] AD and 10.10 (From: "Michael T. Scott" <email@hidden>)
	>Re: [Rockies-Edu] AD and 10.10 (From: Andy Gerhard <email@hidden>)
	>Re: [Rockies-Edu] AD and 10.10 (From: Don Cochran <email@hidden>)
	>Re: [Rockies-Edu] AD and 10.10 (From: Jonathan Ender <email@hidden>)
	>Re: [Rockies-Edu] AD and 10.10 (From: "Michael T. Scott" <email@hidden>)

Prev by Date: Re: [Rockies-Edu] AD and 10.10
Next by Date: Re: [Rockies-Edu] AD and 10.10
Previous by thread: Re: [Rockies-Edu] AD and 10.10
Next by thread: Re: [Rockies-Edu] AD and 10.10
Index(es):
- Date
- Thread