12 Replies Latest reply: Nov 29, 2007 4:33 AM by Southron
rcmarson Level 1 Level 1 (0 points)
I am authenticating against an active directory domain, so I show up in Accounts as an Admin, Network. After I click on the lock to make changes, I am able to check the box "Allow user to administer this computer" so I am an admin on the local machine. I am able to change my password, change my picture, and click on the Parental Controls tab. But, when I click on the Login Items tab, it never refreshes the screen and freezes. I was able to do this only one time and set up network shares to mount at login. Since then, it freezes System Preferences. I am still able to do an apple+Q key and it quits. I clicked on Login Items last night and left it till this AM. When I got to work, the list of login items was visible, but the "+" and "-" signs were not there, so I could not add or subtract items(it looked like the window hadn't refreshed completely). The only way that I can move on is to quit System Prefs. I have one other machine that is logging in to the AD domain and it is doing the same thing. I was able to open this once, but since that time, I have had the same problem. All other machines where a local user is logged on, this problem has never happened. I am running 10.4.10.
Any ideas or has anyone heard of this before?

PowerMac G5, Mac OS X (10.4.10)
  • 1. Re: Active Directory and Login Items.
    AKG8R Level 1 Level 1 (15 points)
    I am glad that you were able to see the Login Items because I am not able to do it. I actually tried the follwing that someone sent to me. It did worked for the individual that sent it to me but did not work for me because of other problems.


    Script Editor found in /Applications/AppleScript. For each server share you want to connect to enter

    mount volume "smb://WORKGROUP;userID:password@servername.domain.com/share"

    Replace these parts of the string with the appropriate information:
    WORKGROUP (or domain)
    userID
    password
    servername.domain.com (or you can use the IP address)
    share

    Please let me know if this works for you.
  • 2. Re: Active Directory and Login Items.
    rcmarson Level 1 Level 1 (0 points)
    The problem is not the mounting issue, I can do that with no problem. I was able to set them to mount at login even, but getting back in to the login items screen is the problem. Since I have joined it to the domain and the user is a network user with a local profile, the login items tab does not work in the accounts pane.
    Thanks very much for the try though. I hope that your "other problems" problem gets worked out. If I can help let me know.
  • 3. Re: Active Directory and Login Items.
    AKG8R Level 1 Level 1 (15 points)
    Someone actually mentioned to me once that when you connect your Mac to AD then you can no longer view the log-in items. That's why I was a little shocked to hear that once upon a time you were able to do that.

    Maybe you can help me with my problem: Mac 1 cannot connect to some servers; whereas, Mac 2 can connect to the servers in which Mac 1 cannot. Any solution.

    Message was edited by: AKG8R
  • 4. Re: Active Directory and Login Items.
    rcmarson Level 1 Level 1 (0 points)
    Have you tried via IP? At times, this has failed but I have rebooted and tried again. It usually works after that.
  • 5. Re: Active Directory and Login Items.
    RPallansch Level 1 Level 1 (0 points)
    I just ran into this problem (unable to access Login Items after connecting a Mac to Active Directory) as well, and while I don't know what the answer is, I can point you in the right direction. We have been using active directory for a while, and I can assure you that we retain the ability to manage our login items.

    Yesterday I was setting up a new iMac, and had to bind it to the network by hand because the image that we had been using (which we got from our IT group with all of the settings pre-set) had become corrupted . The new computer experienced the exact same symptoms you describe. I knew that the Mac on my desk worked fine, so I copied all of my Directory Access settings, and put them into the new machine. I logged out and logged back in, and it works fine.

    Trouble is, I don't know which of the things I changed did the trick. I changed the following under Advanced Options: Under User Experience, I checked 'Create mobile account at login' ('Require confirmation...' is unchecked); I unchecked 'Use UNC path...'; and 'Default user shell' remained checked and unchanged. Under Administrative, I added our domain server and 'Allow authentication...' is unchecked. I also added a Workgroup and WINS Server in the SMB/CIFS settings, but I think the Active Directory stuff was what solved the problem. Hope this helps - good luck.
  • 6. Re: Active Directory and Login Items.
    rcmarson Level 1 Level 1 (0 points)
    I would like to know if you map drives for any user that logs on from the domain? If so, can you let me know where and how you set that up? We are very new to AD and even newer to setting up Macs to work with it. So far I have a couple of machines that authenticate, but in the Win environment, we have several windows shares that mount at login for any user. This occurs when a login script runs. How do I do this on a mac when a network user logs on? I have tried doing the Workgroup Manager thing, and, for whatever reason, it doesn't hold the settings for the local machine. This may change when I have time to sit down and look at it for a while. Any help would be appreciated.
    Thanks,
  • 7. Re: Active Directory and Login Items.
    RPallansch Level 1 Level 1 (0 points)
    I'm not familiar with the 'Workgroup Manager' thing that you refer to, but we have several network volumes that we access at login. I access the volume initially from the Finder by clicking on 'Go / Connect to Server...'. There sometimes are issues with apple's default protocol (AFP), so you usually have to add 'smb://' before the address. Also, Mac wants forward slashes where Windows uses backslashes. I have had trouble coming up with the exact right server address, but trial and error usually gets me there. Once the volume has been accessed (which is often seamless within AD - most of the time I don't have to type my username or password), I drag the icon from the desktop to the Login Items menu, bringing us back to the original problem. It's why I was looking for this answer to begin with, in order to mount network volumes. I was pleased that you drew the connection between the Login Items problem and Active Directory, that really set me on the path to fixing the problem. Thanks for that.

    Our IT guys advocated an AppleScript for mounting the login volumes, but even then, the script has to be put in the Login Items list. Just dropping the volume from the desktop to the list eliminates the middleman. If the user does have to input their username and password when the volume is accessed, the system will prompt for that when it attempts to mount the volume.

    I'm afraid I'm just an average Mac Geek, and not a network tech-- I don't really know a lot about Active Directory, or even if my answers are of the depth or nature you are seeking, but I hope this helps. Good luck.
  • 8. Re: Active Directory and Login Items.
    OLAUser Level 1 Level 1 (0 points)
    I've had the same issue on Tiger and Leopard. I think the issue may be related to the fact that when an AD user logs onto the Mac, their account shows up as Managed. This implies that certain user preferences such as logon items are managed centrally by a directory server. I've seen other information on the web that supports this, along with steps on how to set up Open Directory to manage login items. I've also noticed that AD users don't appear in the account list when that user isn't logged on (i.e when you log on as a different user, the Network or AD user doesn't appear in the list), unless the account is also a mobile account.

    Having said all of this, I did have login items available in the past. The issue cropped up before I upgraded to Leopard, but I'm not sure what happened to disable them.

    I have one theory that I want to test. If the user account is created locally, prior to binding the machine to the domain, the login items would be available. It's possible that the login items will remain available to the user after the machine is bound to the domain. I haven't had a chance to test this yet.
  • 9. Re: Active Directory and Login Items.
    cbroome Level 1 Level 1 (0 points)
    I've had this issue under both Tiger and Leopard as well. I initially ran into it a year ago when first returning to working on the Mac, and happened to Google this article which explains the issue rather well:

    http://www.macworld.co.uk/forums/msgs.cfm?msg=69993&forum=4

    I then hoped that it would be resolved under Leopard, but unfortunately it wasn't.

    I don't know whether anyone has submitted this as a bug to Apple, but it's really infuriating when trying to set Login Items for users. What I've resorted to doing as a workaround is to have a user drag the application into the dock, then Control-clicking the icon and selecting "Open at Login" in order to set the login item.

    While we're on the subject, is there a way to set login items that run in the user's context at login? I'm thinking about something like a login hook (like http://docs.info.apple.com/article.html?artnum=301446), but I want it to run as the user -- not as root.

    Thanks!
  • 10. Re: Active Directory and Login Items.
    Ginger_Kid Level 1 Level 1 (0 points)
    I had this same issue with a 20" Intel iMac. I found that the issue lied with the Work group management on the AD account. To solve the problem log out of the computer at the login window type in your user name and password, then hold down option when logging in. This will bring you the managed settings and you can disable the settings. I have also shut off "Use UNC path from Active Directory....." in the Directory Utility 10.5 (formally know as Directory Access 10.4). Let me know if this works for anyone else.
  • 11. Re: Active Directory and Login Items.
    OLAUser Level 1 Level 1 (0 points)
    Thanks. Now that you mention it, I did this before, it totally slipped my mind. It doesn't seem to remember my choice though. Oh well, I don't make changes that often. It's better than buying OSX server just for this.
  • 12. Re: Active Directory and Login Items.
    Southron Level 1 Level 1 (0 points)
    Thanks a million Ginger_Kid! This worked for me! What a relief.