Home » Tech » Advanced Mac Configuration Topics

Advanced Mac Configuration Topics

Originally Stolen from here


Mac Deployment, Management and Packaging

See Mac Deployment and Mac System Management Tools

Packaging Mac Software and Other Files

System, disks, users

Mount the PC portion (ISO 9660) of a hybrid disk on a Mac

This may be useful if you need to extract documentation or other files for the PC side of a hybrid disk, but all you have is a Mac.

  1. Unmount the mac cd volume via disk utility (don’t eject just dismount). Find the disk ID of the CD/DVD drive by selecting the CD/DVD device in disk utility and clicking the Info icon.
  2. Open terminal and type:
    sudo mkdir /Volumes/myisodisk
    sudo mount -t cd9660 /dev/diskID /Volumes/myisodisk
    replace the diskID above with the disk ID you got in step 1.
  3. That’s it. Browse the cd via the Finder.

Scripting Adding and Removing Network Interfaces

See man networksetup

Why your Mac might not sleep


Also: Sleep delayed if print job is in progress or printer isn’t available (http://support.apple.com/kb/TS3216)

Refresh disk arbitration

Note: This may force disks that haven’t mounted to mount.

disktool -r

Enable Journaling

diskutil enableJournal /

Matching Mac Model Name with Model Identifier, Mac OS X Build, production date, and Apple Hardware Test version

  1. Get Model IDENTIFIER from System profiler (it will look like Model Identifier: MacBookPro2,2)
  2. Visit http://mactracker.dreamhosters.com/iphone/#_modelWindow and find the model with that identifier
  3. Done

More useful resources:

Programatically Delete Cached User Accounts

From http://developer.apple.com/releasenotes/MacOSXServer/RN-DirectoryServices/index.html

# Script to remove cached accounts in the local DS node
# This should work in both Tiger and Leopard
# Run this script as root or with sudo

# dscl searching only does exact matches.  So we list the records and pipe them through to grep to find the list of records we want.
# The first column will be the username and we get that using awk.
# We also remove the line endings with tr to make it one long string.

for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser                    # now we delete the record using dscl

More resources: http://www.macosxhints.com/article.php?story=20080127172157404

Enabling Directory Service debug logging

sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Disabling Directory Service debug logging

sudo rm /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo sudo killall -USR1 DirectoryService

Resetting Mac OS X Machine Account Domain Password

See http://www.afp548.com/article.php?story=20061217110502523

Forcefully remove a Mac from the domain

sudo dsconfigad -r -f -u username -p password

Where “username” is the username that was used to add the machine to the domain, and “password” is this username’s password.

Resetting Directory Service Settings

This is useful in cases where removing/adding the computer from/to the domain does not work using the standard method (Manually Add a Mac to the Domain). The instructions below forcefully remove (unbind) the mac from the domain:

  1. Login with a local account.
  2. Open the Terminal application
  3. Enter each of the lines below, followed by pressing enter:
sudo rm -rdfv /Library/Preferences/DirectoryService
sudo rm -rdfv /var/db/dslocal/nodes/Default/config
sudo sudo killall -USR1 DirectoryService
  1. Open Macintosh HD => Applications => Utilities => MIDD => Midd1stBootConfig.
  2. Follow the on-screen instructions. When the “Update User Template” application opens, click “Quit”.
  3. Reboot and try logging in again with your domain account. If that fails Manually Add a Mac to the Domain.

Lookup Certificates from Active Directory


Force the Generation or Creation of a Kerberos Ticket



edit /etc/authorization and under <key>system.login.console</key> add:

Slow SMB Access – Possible Fix

sudo sysctl -w net.inet.tcp.delayed_ack=0

Macs Randomly Unbinding from Domain

  • The other fix is to delete the kerberos.mydomain.plist and restarting the DirectoryService.
  • “change the passinterval on the clients. I ran the following script via Apple Remote Desktop as root and haven’t had any problems since:
    dsconfigad -f -r -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword
    sleep 10
    dsconfigad -lu localadminusername -lp localadminpassword -passinterval 0
    sleep 10
    computerid=`/usr/sbin/scutil –get LocalHostName`
    dsconfigad -f -a $computerid -domain yourdomain -u ADadminusername -p ADadminpassword -lu localadminusername -lp localadminpassword -ou ou=yourOU,DC=yourDC,DC=yourDC -status

Cannot Login with Domain Account

  • Mac is properly bound to AD
  • Logging in with local account works
  • Cannot login with Domain Account


Slow Authentication at Login Screen

As a troubleshooting step, try specifying the domain name along with the username at the login screen. Other options include editing the LDAP timeout in the Directory Service plist. Source: http://www.macwindows.com/snowleopardAD.html#051810d&nbsp;

GSSAPI Error – Kerberos


Reset Mac user or admin password

Can require install disks to reset if you have forgotten the old password. Help here

Give admin (administrator) privileges to a user using the Terminal

Open Terminal, type the line below, hit enter:

sudo dscl . -append /Groups/admin GroupMembership usernamegoeshere

To check who’s an admin currently:

dscl . -read /Groups/admin | grep GroupMembership

The above can also be used in ARD commands or in shell scripts.

Upgrade groups to the new UID format

This allows nested group (i.e. a domain group to be a member of a local group).

dseditgroup -o edit -t group -f n groupnamegoes here


Make the admin group a member of the _lpadmin group

  • Easy solution: Connect to Middfiles and open Software => Software Macintosh => Quick-Fixes. Double-click Add Printer – Permissions Problem Fix (lpadmin).app
  • The harder solution (run commands below): This converts the _lpadmin and the admin group to the new format, adds the key NestedGroups to the _lpadmin group and populates it with the GUID of the admin group. Finally, the admin account is made a member of the _lpadmin group.

dseditgroup -o edit -t group -f n admin
dseditgroup -o edit -t group -f n _lpadmin
dseditgroup -o edit -a admin -t group _lpadmin
dscl localhost -create /Local/Default/Groups/_lpadmin NestedGroups ABCDEFAB-CDEF-ABCD-EFAB-CDEF-00000050
dseditgroup -o edit -a admin -t group _lpadmin

Add an application to the dock using a script

  • Add for current user:
defaults write com.apple.dock persistent-apps -array-add "<dict><key>tile-data</key><dict>\
<key>file-data</key><dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
  • Add for default user template:
defaults write /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.dock \
persistent-apps -array-add "<dict><key>tile-data</key><dict><key>file-data</key>\
<dict><key>_CFURLString</key><string>/Applications/Final Cut Express.app</string>\
  • Add for all users (current and future):
for folder in /Users/*
defaults write $folder/Library/Preferences/com.apple.dock persistent-apps -array-add \
<string>/Applications/Final Cut Express.app</string><key>_CFURLStringType</key>\
currentuser=`basename $folder`
chown $currentuser $folder/Library/Preferences/com.apple.dock.plist

Run a command for each user

for folder in /Users/* echo “Doing a command for $folder” done

For example, this command sets the default printer to LIB242K:

for folder in /Users/*
echo Default LIB242K > $folder/.cups/lpoptions
chmod 777 $folder/.cups/lpoptions


Distribute a file to each user’s home dir

E.g. distribute custom print settings to each user

for folder in /Users/*
ditto -V $folder/Library/Preferences/com.apple.print.custompresets.plist \
ditto -V /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.print.custompresets.plist \
chmod 777 $folder/Library/Preferences/com.apple.print.custompresets.plist

ARD techniques

Sharing ARD Preferences with other users

See http://www.versiontracker.com/dyn/moreinfo/macosx/10907697 (Seize the ARD).

ARD – Limit the number of simultaneous authentication requests


ARD – Disable build_hd_index


Known ARD Issues

See Known ARD Issues.

Desirable ARD commands

  • Set disk permissions. Ignore permissions.
  • Add ACLS for folders
  • Run login permission script
  • unbind/rename/rebind/rescan/apply proper admin privs.
  • login items fix

Installing (Pushing) Adobe CS via ARD

Note: This assumes you’ve created a disk image with the applications (from /Applications), and a disk image with the settings (in /Library/Application Support, as well as /Library/Preferences).

hdiutil attach /adobepro.dmg
ditto -V /Volumes/adobepro /Applications
hdiutil detach /Volumes/adobepro
rm -rdfv /adobepro.dmg

hdiutil attach /settings.dmg
ditto -V /Volumes/settings /Library
hdiutil detach /Volumes/settings
rm -rdfv /settings.dmg

Installing LabStats via ARD

  • Requirements: If the client computers are running Mac OS X Leopard, you need LabStats version 4.4.x (at least).
  1. On your ARD computer, visit the labstats admin page and download the Mac installer.
  2. Unzip it the package, and you will get two files (one ending in tar.gz, one ending in conf)
  3. Unpack the tar file (double-clicking should suffice) until you see the install package (ends with pkg).
  4. Open ARD, select the client computers (the ones that need labstats), then click “Copy”
  5. Drag the pkg file and the conf file to the upper portion of the copy window (you can also use the + button), under “Place Item In” specify the full destination to “/tmp” (without the quotes), then click Copy.
  6. When the copy process finishes, select the same computers again and click the Unix command button. In the window that appears, paste these lines in the upper portion:
    installer -package /tmp/labstats_mac_client_installer.pkg -target /
    rm -rdfv /tmp/labstats*
  7. Under “Run the command as” enter the user “root” and click “Send”

Mute or set volume via ARD

osascript -e "set volume 0"

Change the zero to another number to set the volume to a higher value. Zero is mute. This seems to be system wide. It also mutes the startup chime. Good for classrooms. If headphones are plugged in, they have a separate volume setting.

Make Macs Speak via ARD

say "I hate Macs"

Set the Open Firmware password via ARD

Note: You need our Open Firmware package for this! It should be on our Mac server.

sudo ofpassword set blahblah123

Enable SSH via ARD

This seems to work:

systemsetup -setremotelogin on

If you get saclutil you can restrict ssh login to a single user or group:

saclutil -s ssh -a -u jsmith

group: saclutil -s ssh -a -g admin

To undo SACLs for ssh:

saclutil -s ssh -d

Some other ideas:

echo yes | /System/Library/CoreServices/RemoteManagment/ARDAgent.app/Contents/Support/systemsetup -setremotelogin on
/sbin/service ssh start
echo "AdminsPassHere" | sudo service ssh start

This seems to work until reboot:


Enable ARD remotely

e.g. via SSH

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users admin -privs -all

If nothing’s been enabled, the full line should look like: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu

Mount AFP volume via applescript via ARD

osascript -e 'mount volume "afp://user:password@computername/Macintosh HD"'

Check if a process is running via ARD

E.g. Check if AFP server is running

ps -axww | grep -i "AppleFileServer"

Start AFP sharing remotely

  1. Change /etc/hostconfig so that AFPSERVER=-YES=
  2. Send unix script
    sudo AppleFileServer


Get folder size via ARD

du -d 1 -h /Users/Shared/editingclass

Set power management on Macs via ARD

Can be done using the pmset command. Remember to always execute this command as user “root” in ARD. Examples:

  • Instructor stationsthat need to remain awake for the duration the class:
    pmset -a sleep 0 disksleep 10 displaysleep 75

    The sleep parameter tells the computer never to sleep, disksleep makes the hard disk spin down in 10 minutes, displaysleep makes the monitor remain awake for 75 minutes.

  • Regular workstationsthat need to remain awake for management purposes can turn off the screen (e.g. after 35 mins) and spin down the hard disk to save power:
    pmset -a sleep 0 disksleep 10 displaysleep 35
  • Alternatively, the machines can be turned off / set to sleep whenever and you designate a “remote management” time period (say, every day after 3:00am). The Mac OS X power management allows you to set the computer to wake up or power on at a specific day and time. This way if a machine was turned off or set to sleep, it can become available for updates, etc. Here’s an example:
    pmset repeat wakeorpoweron MTWRF 03:00:00

    This wakes the machine (if it’s asleep) or powers it on (if it’s turned off), every weekday at 3am.

Get Link Speed

ioreg -l | grep "IOLinkSpeed"

Divide by 1000000 to get “human readable”.

Application tips

Pushing LabStats via ARD

Labstats can be pushed via ARD. There are two methods, both start with the same process:

  1. On a machine with ARD, grab the Mac labstats installer from http://labserver:8080/admin
  2. Unpack it, you’ll get two files – a pkg package and a “conf” file.

Method 1: Copy the labstats.conf file INSIDE the installer (ctrl+click on the installer, open Contents => Resources => drag the conf file in here). Open the file named “postflight”, delete everything in it and replace it with:


ditto "$1/Contents/Resources/labstats.conf" /private/etc/labstats.conf
chown root:wheel /private/etc/labstats.conf
SystemStarter start LabstatsClient

Method 2: Push the default config file AFTER pushing labstats: Use the ARD “copy” button to copy the conf file to a custom destination: /etc

Reset Spotlight

sudo mdutil -i off /
sudo mdutil -E /
sudo mdutil -i on /

Update Symantec AntiVirus

LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

LiveUpdate tends to be in the root library support folder: /Library/Application\ Support/Norton\ Solutions\ Support/LiveUpdate/LiveUpdate.app/Contents/MacOS/LiveUpdate -update LUal -liveupdatequiet YES -liveupdateautoquit YES

Check when an application was last opened

mdls -name kMDItemLastUsedDate /Application/Application.app

Check an entire folder:

mdls -name kMDItemLastUsedDate /Application/*

Filter applications from an entire folder:

mdls /Applications/Adobe\ Photoshop\ CS/* | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemLastUsedDate)|(app)'

Batch checking

mdls "/Applications/Macromedia Dreamweaver MX 2004/Dreamweaver MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Flash MX 2004/Flash MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Macromedia Fireworks MX 2004/Fireworks MX 2004" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/Adobe Photoshop CS/Adobe Photoshop CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe InDesign CS/InDesign CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'
mdls "/Applications/Adobe Illustrator CS/Illustrator CS.app" \
| egrep '(kMDItemLastUsedDate|kMDItemDisplayName)'  | egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

mdls "/Applications/GarageBand.app" | egrep '(kMDItemLastUsedDate|kMDItemDisplayName)' \
| egrep '(kMDItemDisplayName|2008-10*|2008-11*)'

X11 and the PATH variable in Leopard and Snowleopard

There seems to be no way to directly set the X11 PATH variable. However, if you correctly set your PATH variable in the Terminal (check the command path_helper), you can then launch xterm (X11) from Terminal.app and it will inherit the PATH variable.

A massive X11 FAQ is available here: http://forums.macosxhints.com/showthread.php?t=80171

Network & Printers

Get MAC Address

/sbin/ifconfig en0 | grep ether | cut -d' ' -f 2

Set computer name

sudo scutil --set LocalHostName NEWCOMPUTERNAME
sudo scutil --set ComputerName NEWCOMPUTERNAME

Printers: Install, delete, set as default

List installed printers

lpstat -p


lpadmin -p printer_name -E -v lpd://server/printer -P path-to-ppd.gz
  • An example with a compressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.gz

  • Or an uncompressed ppd:

lpadmin -p printer_name -E -v lpd://server/printer -P /Library/Printers/PPDs/Contents/Resources/HP\ LaserJet\ 4050\ Series.ppd

Must be followed by

cupsenable printer_name


lpadmin -x printer_name


lpadmin -x AdobePDF7

Set as default

lpadmin -d printer_name

Install but disable sharing and add description

lpadmin -p printer_name -E -v lpd://server/printer -D "Room AB123" -P ppdpath -o printer-is-shared=false

Enabling Duplexing

On HP printers this should suffice:

lpadmin -p prntr -E -v lpd://srv/prnt -D "rmnr" -P "ppdpath" -o "HPOption_Duplexer=True" -o Duplex=DuplexNoTumble

On other models you can try listing the available printer options, then pass the appropriate option to lpadmin using the “-o” parameter. To list all available printer options, install the printer on any one workstation and then run:

lpoptions -p printer_name -l

For an HP laserjet the above command gives two options related to duplexing: HPOption_Duplexer and Duplex — so those are the parameters passed using “-o” in the example above.



List of Mac SMC and EFI Firmware Updates


It may be possible to automate the installation of these by using the -y switch:
sudo ./Contents/Resources/RemoteEFIUpdater -y -shutdown

Remedying and preventing duplicate DDNS registrations in Mac OS X

NOTE: You may need to combine these fixes with the suggestions outlined in he next section Advanced_Mac_Configuration_Topics#Macs losing AD bind connection or unable to login to a domain account on a Mac.

  1. remove computer from domain
  2. Run these commands
sudo /usr/sbin/systemkeychain -k /Library/Keychains/System.keychain -C -f
sudo rm -rf /var/db/krb5kdc
sudo /usr/libexec/configureLocalKDC
(this ensures uniqueness of local kerberos db)
  1. Optionally, if he system is having SMB authentication issues, follow these instructions: http://support.apple.com/kb/HT3169
  2. Rename computer as desired under System Preferences => Sharing, then run these commands:
sudo scutil --set ComputerName NEWCOMPUTERNAME
sudo scutil --set LocalHostName NEWCOMPUTERNAME
sudo scutil --set HostName NEWCOMPUTERNAME
(this ensures all possible host names are the same - don't ask why there are 4 different places)
  1. Open Directory Utility, AD plugin, rename computer as desired there, then bind to domain (adding to correct OU)
  2. If the computers are connected to an XSan, you may need to re-enter username/password in Xsan admin app. May need to remove computer from Xsan database and re-add.

Macs losing AD bind connection or unable to login to a domain account on a Mac

NOTE: You may need to combine these fixes with the suggestions outlined in he previous section Advanced Mac Configuration Topics#Remedying_and_preventing_duplicate_DDNS_registrations_in_Mac_OS_X. More information here: http://www.macwindows.com/leopardAD.html (search for “losing” or look under http://www.macwindows.com/leopardAD.html#012209e)

Proposed fixes: http://www.macwindows.com/Kerberos-workarounds-for-Macs-losing-AD-binding.html



Proposed cause for the issue: Then one of our staff went to an Apple Integration seminar at Cambridge (UK) where the little known fact emerged that Leopard has a persistent Kerberos certificate which can cause problems with just such things as binding to AD. This is a particular problem if using an image to build multiple machines which are then bound to AD – it is the equivalent of having identical machine accounts on windows.

Apple’s take on the issue: http://support.apple.com/kb/TS1245

Also, verify the correct date, time, and time zone information in System Preferences.  If system is bound to domain, also verify in Directory Utility that the Search Policy includes an entry for “/Active Directory/All Domains”.

Connect to an AFP server from the command line

sudo mkdir /Volumes/myserver
mount_afp afp://username:password@servername/sharename /Volumes/myserver

Reimage a mac from an image using the command line asr

sudo asr restore --source /Volumes/Source/Image.dmg --target /Volumes/Destination --erase --noverify

Note: This ERASES the destination drive. It also skips verification (which Disk Utility forces you to do, thus adding 10-15 minutes to the imaging process). Verification is GOOD, but sometimes, when you’re sure that the image is healthy and your destination drive is healthy, it can be a waste of time.

Manipulating and modifying ACL permissions from the command line terminal

Read ACL

ls -le /path/to/dir

Write ACL

chmod -R +a "group:admin allow read write delete" /path/to/dir

Delete ACL

chmod -R -a# 0 /path/to/dir

Run an ASR server

GUI: Protonpack

sudo asr -source /Volumes/Images/image.dmg -server /path/to/config.plist

Restore a client from an ASR server

GUI: NetRestore

sudo asr -source asr://serverip -targer /Volumes/Volume -erase -noverify

Set expanded windows for save and print

defaults write -g PMPrintingExpandedStateForPrint -bool TRUE

defaults write /Library/Preferences/.GlobalPreferences NSNavPanelExpandedStateForSaveMode -string 1


Pre-populate the username field in the Connect to Server window


defaults write /Library/Preferences/com.apple.NetworkAuthorization UseShortName -bool YES

Make the help window and the add printer (addprinter.app) window act normal

This makes the help window and addprinter.app window accessible to the Dock and command-tab.

sudo defaults write “${i%.plist}” LSUIElement 0
sudo chmod 644 “$i”

i=/System/Library/CoreServices/Help\ Viewer.app/Contents/Info.plist
sudo defaults write “${i%.plist}” LSUIElement 0
sudo chmod 644 “$i”

Variables available to shell scripts in Installer packages

  • $1: Full path to the installation package the Installer application is processing.
  • $2: Full path to the installation destination
  • $3: Installation volume (or mountpoint) to receive the payload
  • $4: The root directory for the system:
  • $SCRIPT_NAME: Filename of the operation executable
  • $PACKAGE_PATH: Full path to the installation package
  • $INSTALLER_TEMP: Scratch directory used by Installer to place its temporary work files
  • $RECEIPT_PATH: Full path to a temporary directory containing the operation executable


Slipstreaming Office 2008 for Mac

See: Slipstreaming Office 2008 for Mac

Apple System Image Utility Tips

  • When creating a workflow, “Define Image Source” needs to be on top and “Create Image” on the bottom of the workflow. The rest of the actions may have any order (or so it appears).

Archiving user accounts from a previous semester

cd /Users/
mkdir zz_PreviousSememsters
for cfolder in /Users/*
echo $cfolder
echo "$cfolder" | grep -x zz_PreviousSememsters
if [[ $? > 0 ]]
echo "absent"
mkdir "$cfolder"
mv -f "$cfolder" "/Users/zz_PreviousSememsters/"
echo "present"
return 0


Deleting ALL cached domain user accounts

You can also delete all accounts from the entire semester:

# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
dscl . -delete /Users/$cuser
rm -rdfv /Users/$cuser

# Deleting the Shared files
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*

Deleting ALL cached domain accounts except those on a custom list

#Set the warning flag to off (case sensitive) if you want to start the deletion of accounts.

#Set this flag to true if you want /Users/Shared to be deleted, as well.

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
ls -a /Users/
#Accounts listed here will not be deleted. Local accounts are not deleted by default.
# Deleting cached domain accounts (this means local accounts will remain untouched)
for cuser in `dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}' | tr '\n' ' '`; do
echo $MIDD_DONTDELETE | grep -i "$cuser"
if [ $? == 1 ]
echo "Deleting $cuser"
dscl . -delete /Users/$cuser
rm -rdf /Users/$cuser
echo "$cuser in exclusions list, not deleting"

if [[ "$MIDD_DELETESHARED" == "true" ]]
# Deleting the Shared files
echo Deleting "/Users/Shared"
rm -rdfv /Users/Shared/*
rm -rdfv /Users/Shared/.*
echo "MIDD_DELETESHARED is set to false so I'm not deleting any files in /Users/Shared"

Erasing a volume entirely and setting permissions

#Set the warning flag to off (case sensitive) if you want to start the deletion.

if [[ "$MIDD_WARNINGFLAG" == "on" ]]
echo "MIDD_WARNINGFLAG is enabled so I can't delete stuff."
echo "Look at the template/script that you just used and set the MIDD_WARNINGFLAG to off (case sensitive)."
echo Permissions status before erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"

echo Erasing Save Here volumes
diskutil eraseVolume "HFS+" "Save Here" "/Volumes/Save Here"
diskutil eraseVolume "HFS+" "Save Here" /Volumes/SaveHere

echo Ensuring proper permissions status after erasing
vsdbutil -d /Volumes/SaveHere
vsdbutil -d "/Volumes/Save Here"

echo Reporting permissions status after erasing
vsdbutil -c /Volumes/SaveHere
vsdbutil -c "/Volumes/Save Here"
  • Alternatively, you can replace the “diskutil eraseVolume…” lines with something like rm -rdf “/Volumes/path/to/specific folder to clear”==

Kerberos Issues

Kerberos KDC location specified in krb5.conf is not respected: http://support.apple.com/kb/TS3265

Mac OS X v10.6 Clients bound to Active Directory may not be able to dismiss screen saver using Active Directory credentials

From the Go menu choose Go to Folder.
Type etc , then click Go.
Open the file named “authorization” in a text editor.
Find the following text in the “system.login.screensaver” entry:
<string>The owner or any administrator can unlock the screensaver.</string>

Change it to this:
<string>(Use SecurityAgent.) The owner or any administrator can unlock the screensaver.</string>
Save the file.


Mac OS X Server and Xserve Administration

NetBoot Across Subnets


Configuring service principals in Active Directory when using a disjoint namespace

See: http://support.apple.com/kb/HT3795

AFP users unable to authenticate with Kerberos after upgrading

sudo sso_util configure -r REALM_NAME -a diradmin afp
See: http://support.apple.com/kb/TS2938

Cannot authenticate to SMB shares when bound to Windows Server 2008 Active Directory

See: http://support.apple.com/kb/TS2967

Cannot configure Lights-Out Management after installing Remote Desktop

Reinstall the latest combo update.

Slapd Daemon Crashing – org.openldap.slapd Throttling respawn

You may notice through system logs or crashes that the Slapd daemon (launched by launchd) is crashing. If you don’t use OpenDirectory, or LDAP/OpenLDAP, or if you don’t mind reverting the slapd settings to default, there are two solutions:

Solution 1 (RECOMMENDED):

sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist

Solution 2: Restore the default slapd settings:

sudo mv /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak

sudo ditto /etc/openldap/slapd.conf.default /etc/openldap/slapd.conf

Solution 3 (not recommended): Disable org.openldap.slapd — you can use Lingon for this.

Seek out more info using this search: http://www.google.com/search?hl=en&q=site:apple.com+org.openldap.slapd+Throttling+respawn – one of the more valuable results is a discussion post here: http://discussions.info.apple.com/thread.jspa?threadID=2171224