Push settings to AD users does not work / OD users works well

Hi,

I still have problems to push settings to users from Microsoft ActiveDirectory with Profile Manager. I can't see an error message...

What I did so far:

- Domain-Name (I can't rename): dudel.local

- Mac mini with Mavericks 10.9 and Server 3.0.1, IP 172.30.200.1/16, norad.dudel.local

- iMac with Mavericks 10.9, IP 172.30.220.19/16, a220019.dudel.local

- 2 Windows DNS Server on server daedalus.dudel.local (172.30.200.9) and prometheus.dudel.local (172.30.200.15)

- 3 Windows Domain Controller on server daedalus.dudel.local (172.30.200.9), prometheus.dudel.local (172.30.200.15) and aurora.dudel.local (172.30.200.16)

- Windows Domain Controller daedalus.dudel.local (172.30.200.9) acts as ntp server

- Opened and forwarded ports tcp/2195, tcp/2196, tcp/5223 and tcp/1640 to 172.30.200.1 (norad.dudel.local). Since the web interface of profile manager is only accessable from inside, I do not forward tcp/80 and tcp/443 from outside.

Mac mini:

1. After a clean install of Mavericks and Server 3, I set LocalHostName, ComputerName and HostName:

scutil --set HostName norad.dudel.local

scutil --set ComputerName norad.dudel.local

scutil --set LocalHostName norad

2. Set in preferrences date/time server to 172.30.200.9 (daedalus.dudel.local)

3. With Server 3 I requested a APNS certificate

4. Checked DNS A and PTR with "changeip -checkhostname". changeip reports "success, there is nothing to change".

5. Activated/Setup OpenDirectory with the standard self-signed certificate in Server 3

6. Activated Web Server in Server 3

7. Configured Profile Manager (http://krypted.com/iphone/setting-up-profile-manager-in-lion-server/)

8. Bound norad.dudel.local (172.30.200.1) to ActiveDirectory:

dsconfigad -add dudel.local -username administrator -password secret

9. Installed Workgroup Manager for Mavericks to set permission for users from ActiveDirectory (http://krypted.com/mac-security/integrating-mac-os-x-lion-servers-profile-manage r-with-active-directory/). After adding AD user 'marcus' to group com.apple.access_devicemanagement, I can add settings to the user with Profile Manager on https://norad.dudel.local/profilemanager

For testing I set the magnifying effect for the dock.

iMac:

1. After a cleant install of Mavericks I set LocalHostName, ComputerName and HostName:

scutil --set HostName norad.dudel.local

scutil --set ComputerName norad.dudel.local

scutil --set LocalHostName norad

2. Set in preferrences date/time server to 172.30.200.9 (daedalus.dudel.local)

3. Bound to OpenDirectory norad.dudel.local

4. Bound norad.dudel.local (172.30.200.1) to ActiveDirectory:

dsconfigad -add dudel.local -username administrator -password secret

3. With the local user 'admin' I accessed https://norad.dudel.local/mydevices and installed the "Trust Profile for DUDEL" and then registered the device. In Profile Manager the device is there, after clicking to "Devices" on the left pane. The Device is associated to user 'admin'. I changed it, by clicking in Profile Manager on "Users/marcus" and then added the device with the plus-sign on the right pane.

After logging in with user 'marcus' on the iMac, there is no setting pushed to the user. The setting I did is still "pending". Logging of and loggin in as user 'admin' makes it happen... the pending task is successful... But now, the setting to the Dock is now at the user 'admin' and not at user 'marcus'

This only happens to AD users. I tried an OD user. All settings are applied successful to the specified OD user....

What am I doing wrong?

Kind regards,

Marcus