Tag Archives: Macintosh

Mac – Unmounting Windows (or any other) volume at startup

To umount a Macintosh volume at start-up (for example the windows bootcamp volume) you can create a startup item …

In:

/Library/StartupItems

Create a directory “Unmount”  in that directory you want to put 2 files:

Unmount

and

StartupParameters.plist

 

Unmount file is a shell script with the following contents:

#!/bin/sh
. /etc/rc.common
if [ “$1” == “start” ]
then
/usr/sbin/diskutil unmount /dev/diskXXX
fi

The /dev/diskXXX in this file you need to change.  My unmount command is actually …

/usr/sbin/diskutil unmount /dev/disk0s3

To find the correct information for your system run the command:

“diskutil  info /Volumes/Windows/”     —- or whatever the volume name is …

in the output you need to look for the “Device Node” .  Whatever it says for that Device Node is what you should put in the Unmount command in the shell script above.

 

StartupParameters.plist is a plist file that contains:

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN”
“http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<key>Description</key>
<string>Try to unmount the old disk</string>
<key>Provides</key>
<array>
<string>Unmount</string>
</array>
</dict>
</plist>

 

 

After creating the files, chmod them so that they are:

-rw-r–r–     StartupParameters.plist
-rwxr-xr-x   Unmount

Also, I set the owner and group to “root” and “wheel” respectively to match the other items in the /Library/StartupItems directory … (“chown -R root /Library/StartupItems/Unmount/” and “chgrp -R wheel /Library/StartupItems/Unmount/”)

 

For additional details see:

http://hints.macworld.com/article.php?story=2005052804075538

 

Mac – AD Authentication to non-primary domain controllers details

Here are some details on how to make sure your non-primary AD authentication servers are available to macs running snow leopard …

This comes from the MACENTERPRISE list which always provides a wealth of information for people who support Macs …

======================================

Subject: Re: Mac Login issue
From: Tim Perfitt
Reply-To: Mac OS X enterprise deployment project
Date: Wed, 23 Feb 2011 20:14:28 -0600
Content-Type: text/plain
Parts/Attachments:

text/plain (64 lines)

There is no way to manually enter in the DCs, as this information is based on site. The important thing to check is that the SRV records for the DCs that are in your site are advertised at the top level of AD DNS as well. You can see which DCs are available by turning on verbose DS logging and looking at the logs:

sudo defaults write /Library/Preferences/DirectoryService/DirectoryServiceDebug “Debug Logging Priority Level” -integer 7
sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo killall DirectoryService

open Console and filter on “tory:” for this log: /Library/Logs/DirectoryService/DirectoryService.debug.log

You should see some lines like these:

2011-02-23 19:26:38 CST – T[0x0000000101981000] – Active Directory: Processing Site Search with found IP
2011-02-23 19:26:47 CST – T[0x0000000101981000] – Active Directory: Site found of – Default-First-Site-Name
2011-02-23 19:26:47 CST – T[0x0000000101981000] – Active Directory: Adding Server –

In order for a DC to be used, it must :

1. Have ldap and kerberos service records in the site specific DNS service records (_ldap._tcp.sitename._sites.dc._msdcs.domain.name and _kerberos._tcp.sitename._sites.dc._msdcs.domain.name)
2. Have its kpassword service records in the top level dns records (_kpasswd._tcp.domain.name)

If a DC fails either of those tests, it is not used. If you see “Adding Server – “, you know that it passed those tests and would be used in case of a failure and for load balancing.

The rules for GC are a bit different, since it doesn’t care about _kerberos or _kpassword (GCs aren’t used to to authenticate users or change passwords). The important thing for GCs is that the _ldap records are in the site specific DNS entries (_ldap._tcp.sitename._sites.gc._msdcs.domain.name). Again, if you see “Adding Server” in the GC section:

2011-02-23 19:26:51 CST – T[0x0000000101C10000] – Active Directory: Global Catalogs – Start checking servers for site “Default-First-Site-Name”

then you know it passed that test.

HTH,

tim

On Feb 23, 2011, at 11:15 AM, Logston, Alan wrote:

> When I came into work this morning and got a call that an entire Mac instructional lab would not allow domain/Student logins. Soon I got three more calls complaining of the dame situation all over campus. There was a very small handful of Macs able to authenticate and all the PCs were still logging in just fine.
>
> I dug into the problem and discovered that the Domain controller DC-1 was down. The PCs were falling back to other servers to authenticate but the Macs were only trying to authenticate to DC-1
>
> In the “Directory Utility” I have “Prefer this domain server” Blank. I thought this would make it so the Mac would auto discover the other authentication servers like the PCs.
>
>
> Is there any way I can manually enter these severs so this problem will not happen again?
>
>
>
> Thanks,
>
>
> Alan
> ITS
>
>

Mac – DVD region code

It seems that it isn’t possible to set the DVD region code in mass on newly deployed mac hardware. What you can do however is change an authorization file to allow unprivileged users to set the region code initially. (Changing the region code after the initial setting is another matter and will continue to require admin privs)

To allow non-privileged user accounts to set the region code initially edit:
/etc/authorization

Look for “DVD” and edit that section so that it reads “allow”
(you can edit a copy of this file with textedit or with a plist editor, then copy the new version into place …)

Here is a sample of what you are looking to do …

    <key>system.device.dvd.setregion.initial</key>
<dict>
<key>class</key>
<string>allow</string>
<key>comment</key>
<string>Used by the DVD player to set the region code the first time.  Note that changing the region code after it has been set requires a different right (system.device.dvd.setregion.change).</string>
<key>group</key>
<string>admin</string>
<key>shared</key>
<true/>
</dict>

Mac – Symbol Font

There seems to be a corrupted symbol font that keeps coming back on our mac images. It ends up in /Library/Fonts in a file called “Symbol”. In July 2012 this appeared after installing MathType …

I have found that too allow microsoft office apps like powerpoint to correctly display Greek characters in mathematical equations, I have to delete the file:

/Library/Fonts/Symbol

Mac – DeployStudio and AD join

Deploying a Mac OS image and adding the computer to the AD can all be accomplished using DeployStudio. I suggest that you set up your AD environment to use “OUs” (organizational units) for your computers rather than have them all in the one default “computers” OU. I have two production OUs of “Labs” and “Labs-Macs”. I’ll explain the “Labs” OU structure for windows in a different post …. For now, just add computer accounts for all your macs to an OU. The computer accounts should match exactly the host names you are using just like you would do for windows.

Then in DeployStudio –
Add the computers and set their “Local Hostname” and “Computer Name” to the same thing you entered in the AD for their computer accounts. Your workflow for the deployment should include a step to rename the mac and after that step the AD binding. In that AD binding window be sure to set the fields for the domain to join and the computers node. Here is a screen shot of my set-up …

Mac – DeployStudio and windows volume

When creating a workflow for taking a DeployStudio image of a windows NTFS volume — it is important to uncheck the box for use “mac tools for multicast” which then allows you to check the box for “try to shrink the NTFS volume before taking image”. If you do not shrink the volume the imaging process will fail with an error about not being able to change the partition size.

Watch for this setting since it can revert back to the default “multicast” setting, which does not work, when you upgrade the DeployStudio software

For more details see:
http://deploystudio.wikispaces.com/Creating+a+NTFS+Master+Image+on+Bootcamp+2.x

Bootcamp – Hiding Mac volume from Windows

Reports are that since Bootcamp version 3 or so you can now read and write to the macintosh partition from your windows environment. This is less than ideal in a shared computer lab.

Renaming the file:
c:\windows\system32\drivers\applemnt.sys
and then restarting should disable the mount of the macintosh partition in windows …

For more discussion and details see:
https://discussions.apple.com/message/11226479?messageID=11226479#11226479?messageID=11226479