019-0938/2007-09-01 | Apple 10.5 Leapard specification

K Apple Inc.

©2007 Apple Inc. All rights reserved.

The owner or authorized user of a valid copy of Mac OS X Server software may reproduce this publication for the purpose of learning to use such software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this publication or for providing paid-for support services.

Every effort has been made to ensure that the information in this manual is accurate. Apple Inc. is not responsible for printing or clerical errors.

Apple

1 Infinite Loop Cupertino, CA 95014-2084 408-996-1010 www.apple.com

Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws.

Apple, the Apple logo, AirPort, AppleShare, Bonjour, FireWire, iCal, iTunes, Mac, Mac OS, MacBook, Macintosh, QuickTime, SuperDrive, Xgrid, Xsan, and Xserve are trademarks of Apple Inc., registered in the U.S. and other countries. Apple Remote Desktop, Extensions Manager, Finder, iWork, and Safari are trademarks of Apple Inc. Mac is a service mark of Apple Inc.

Adobe and PostScript are trademarks of Adobe Systems Incorporated.

The Bluetooth® word mark and logos are registered trademarks owned by the Bluetooth SIG, Inc. and any use of such marks by Apple is under license.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries.

UNIX is a registered trademark of The Open Group.

Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the performance of these products.

019-0938/2007-09-01

Image 2

Apple 10.5 Leapard manual 019-0938/2007-09-01

Contents

Mac OS X Server 019-0938/2007-09-01 Contents Creating a Domain Administrator Account Configuring the Administrator’s Computer and AccountSetting Up an Administrator Computer Using Workgroup Manager Contents Administering Group Accounts Setting Up Group AccountsWhere Group Accounts Are Stored Creating a Preset for Group Accounts 118 Chapter Contents Contents If You Can‘t Change a User’s Password Type to Open Directory 257 267 About This Guide What’s New in Workgroup Manager What’s in This Guide To see the most recent server help topics Using Onscreen HelpTo get help for an advanced configuration of Leopard Server Mac OS X Server Administration Guides This guide Tells you how to User Management Getting Documentation Updates Getting Additional Information Tools for User Management Workgroup Manager Server Admin See this document Server Preferences NetBootNetInstall Command-Line Tools Accounts Administrator Accounts Server Administration User Accounts Guest Account Group Accounts Computer Accounts Computer Groups Authentication and Identity ValidationUser Experience Information Access Control Folder and File Owner Access ACLs and Posix Permissions User Management Overview Setup Overview Getting Started with User Management Set up an administrator computer Create user accounts and home folders Planning Strategies for User Management Analyzing Your Environment Identifying Directory Services Requirements Determining Server and Storage Requirements Choosing a Home Folder Structure Users with local accounts typically have local home folders Devising a Home Folder Distribution Strategy Determining Administrator Requirements Identifying Groups Getting Started with User Management Getting Started with User Management To set up an administrator computer Configuring the Administrator’s Computer and AccountSetting Up an Administrator Computer To create a domain administrator account Using Workgroup ManagerCreating a Domain Administrator Account To connect and authenticate to directory domains Major Workgroup Manager Tasks Preference Description Modifying Workgroup Manager PreferencesTo set Workgroup Manager preferences Listing Accounts in the Local Directory Domain Finding and Listing AccountsWorking with Account Lists in Workgroup Manager Listing Accounts in Search Policy Directory Domains To list accounts in a server’s local directory domain Finding Specific Accounts in a List Listing Accounts in Available Directory DomainsRefreshing Account Lists To do this Do this Using Advanced SearchTo filter items in the list of accounts Sorting Users and Groups Using PresetsShortcuts for Working with Accounts Editing Multiple Accounts Simultaneously Interface element Mixed-state appearance To batch-edit accounts that match specific criteria Importing and Exporting Account Information Getting Started with Workgroup Manager Where User Accounts Are Stored About User Accounts Predefined User Accounts User ID To create a user account Administering User AccountsCreating User Accounts Editing User Account Information To make changes to a user account To work with a read-only user account Working with Read-Only User AccountsWorking with Guest Users Deleting a User Account To delete a user account using Workgroup ManagerWorking with Windows User Accounts Disabling a User Account To create a preset for user accounts Working with PresetsCreating a Preset for User Accounts Editing Presets Using Presets to Create AccountsRenaming Presets To create an account using a preset To edit a preset Working with Basic SettingsDeleting a Preset To delete a preset To work with the user name using Workgroup Manager Modifying Short Names To work with a user short name using Workgroup Manager Choosing Stable Short Names Avoiding Duplicate Names Modifying User IDs To change a user ID in Workgroup Manager To assign a password Assigning a Password to a UserAssigning Administrator Privileges for a Server To set server administrator privileges in Workgroup Manager Choosing a User’s Login Picture To change a user’s login picture To remove a user’s administrative privileges Removing Administrative Privileges from a UserGiving a User Limited Administrative Capabilities Working with Privileges To add limited administrative capabilities Task Description To change a user’s administrative privileges Working with Advanced SettingsGiving a User Full Administrative Capabilities To enable a user’s calendar Choosing a Default Shell To choose a default shell Choosing a Password Type and Setting Password Options To choose a user password type and set password options To edit the master keyword list Creating a Master List of KeywordsApplying Keywords to User Accounts To work with keywords for a user account To work with a comment using Workgroup ManagerEditing Comments Choosing a User’s Primary Group Working with Group SettingsTo set a primary group ID using Workgroup Manager Adding a User to a Group To review group memberships using Workgroup ManagerReviewing a User’s Group Memberships To remove a user from a group using Workgroup Manager Working with Home SettingsTo add a user to a group using Workgroup Manager Removing a User from a Group Working with Mail Settings Enabling Mail Service Account Options To disable a user’s mail service using Workgroup Manager Working with Print Quota SettingsDisabling a User’s Mail Service To forward a user’s mail using Workgroup Manager Enabling a User’s Access to All Available Print Queues Enabling a User’s Access to Specific Print Queues To restart a user’s print quota using Workgroup Manager Resetting a User’s Print QuotaTo delete a user’s print quota using Workgroup Manager Removing a Print Quota For a Queue Working with Info Settings To disable a user’s access to print queues enforcing quotas To change a user’s info Working with Windows SettingsChanging a Windows User’s Profile Location Changing a Windows User’s Login Script Location Changing a Windows User’s Home Folder Location Working with GUIDsChanging a Windows User’s Home Folder Drive Letter Viewing GUIDs To view a user or group Guid About Group Accounts How Group Accounts Track Membership Predefined Group name Group ID Use Where Group Accounts Are StoredPredefined Group Accounts To create a group account Administering Group AccountsCreating Group Accounts Editing Group Account Information Creating a Preset for Group AccountsTo create a preset for group accounts To make changes to a group account Creating Hierarchical Groups To create a hierarchical group Working with Read-Only Groups To convert a legacy group to an upgraded group accountUpgrading Legacy Groups Deleting a Group Working with Basic Settings for GroupsTo delete a group using Workgroup Manager Naming a Group To work with group names using Workgroup Manager Defining a Group ID To choose a group’s login picture Choosing a Group’s Login PictureTo work with a group ID using Workgroup Manager Enabling a Group’s Web Services To enable a group’s web services Working with Member Settings for Groups Adding Users or Groups to a Group To remove group members Working with Group Folder SettingsRemoving Group Members To specify no group folder Specifying No Group FolderCreating a Group Folder 102 Designating a Group Folder for Use by Multiple Groups 104 Setting Up Computers Computer Groups About Computer Accounts Creating Computer Accounts To create a computer account Working with Windows Computers To set up the guest computer accountWorking with Guest Computers Differences Between Computer Groups and Computer Lists Administering Computer GroupsAbout Computer Groups Creating a Computer Group Creating a Preset for Computer Groups To set up a computer group To use a preset for computer groups Using a Computer Group PresetTo set up a preset for computer groups Adding Computers or Computer Groups to a Computer Group To add computers or computer groups to a computer group Upgrading Computer Lists to Computer Groups To upgrade computer lists to computer groupsDeleting a Computer Group To delete a computer group Setting Up Home Folders About Home Folders Hosting Home Folders for Mac OS X Clients Hosting Home Folders for Other Clients Distributing Home Folders Across Multiple Servers To set up a share point Administering Share PointsSetting Up a Share Point Unix Class Name Permission Setting Up an Automountable AFP Share Point for Home Folders To set up an automountable AFP share point for home folders Setting Up an Automountable NFS Share Point for Home Folders To set up an automountable NFS share point for home folders Setting Up an SMB Share Point To create an SMB share point and set permissions To define no home folder Administering Home FoldersSpecifying No Home Folder Creating a Home Folder for a Local User To create a home folder for a local user Creating a Network Home Folder To create a network home folder for AFP or NFS share points Creating a Custom Location for Home Folders To create a custom home folder using Workgroup Manager Element Do this Setting Up a Home Folder for a Windows User To set up a home folder in an existing share point \\servername\usershortname Setting Disk Quotas Moving Home Folders Setting Disk Quotas for Windows Users to Avoid Data LossUsing Presets to Choose Default Home Folders Deleting Home Folders Managing Portable Computers About Mobile Accounts About Portable Home Directories Logging In to Mobile Accounts About External Accounts Resolving Sync Conflicts Logging In to External Accounts Applications locally cache temporary files Advantages of Using Mobile AccountsConsiderations and Strategies for Deploying Mobile Accounts Considerations for Using Mobile Accounts You can manage individual mobile accounts 138 Strategies for Syncing Content Mobile accounts can’t restore deleted files through syncing To set up portable computers for use on your network Setting Up Mobile Accounts for Use on Portable ComputersConfiguring Portable Computers Managing Mobile Clients Without Using Mobile Accounts Unknown Mac OS X Portable Computers Using Mac OS X Portable Computers with Multiple Users 143 Securing Mobile Clients Optimizing the File Server for Mobile Accounts To optimize the file server for mobile accounts 146 Client Management Overview Using Network-Visible Resources There are several key network-visible resources Customizing the User Experience Power of PreferencesLimits access Environment Control By letting you manage Environment Desired effect Designing the Login ExperienceKey login settings Choosing a Workgroup Working with Synced Homes Improving Workflow 153 154 Using Workgroup Manager to Manage Preferences Preference pane What you can manage Understanding Managed Preference Interactions 157 158 Setting the Permanence of Management Understanding Hierarchical Preference Management Preference Management Basics Caching Preferences Managing User Preferences To manage user preferences To manage group preferences Managing Group PreferencesManaging Computer Preferences To manage computer preferences To manage computer group preferences Managing Computer Group PreferencesDisabling Management for Specific Preferences Managing Access to Applications To selectively disable preference management What you can control Icon Indicates the application has this type of signature To allow users to open specific applications and folders Allowing Specific Dashboard Widgets To allow specific Dashboard widgets To disable Front Row Disabling Front Row To set up a list of accessible applications Managing Classic Preferences Classic preference pane What you can control Selecting Classic Startup OptionsTo work with various startup options for Classic To choose a specific Classic System Folder Choosing a Classic System FolderAllowing Special Actions During Restart To hide or show items in the Apple menu Controlling Access to Classic Apple Menu ItemsTo allow special actions during restart Adjusting Classic Sleep Settings To adjust Classic sleep settings Maintaining Consistent User Preferences for Classic To choose where Classic user preferences are storedManaging Dock Preferences Controlling the User’s Dock Providing Easy Access to Group Folders To add a Dock item for a group folder Adding Items to a User’s Dock To add items to a user’s Dock To prevent users from adding items to their Docks Managing Energy Saver PreferencesPreventing Users from Adding or Deleting Dock Items Using Sleep and Wake Settings for Desktop Computers To set sleep and wake settings Setting Energy Saver Settings for Portable Computers To manage portable computer settings Displaying Battery Status to Users To schedule automatic actions To show battery status in the menu barScheduling Automatic Startup, Shutdown, or Sleep Finder preference pane What you can control Setting Up Simple FinderManaging Finder Preferences To hide disk and server icons on the desktop Controlling the Behavior of Finder WindowsTo turn on Simple Finder To set Finder window preferences To hide the Trash warning message Hiding the Alert Message When a User Empties the TrashMaking Filename Extensions Visible To make filename extensions visible Preventing Users from Ejecting Discs Controlling User Access to Remote ServersControlling User Access to an iDisk To hide the Burn Disc command Hiding the Burn Disc Command in the FinderControlling User Access to Folders To hide the Go to Folder command Removing Restart and Shut Down from the Apple Menu Adjusting the Appearance and Arrangement of Desktop ItemsTo hide the Restart and Shut Down commands To set preferences for the desktop view Adjusting the Appearance of Finder Window Contents Login preference pane What you can control Managing Login PreferencesChanging the Appearance of the Login Window List setting Mac OS X version Effect To change the appearance of the Login Window Configuring Miscellaneous Login Options Option What this does when enabled To configure miscellaneous login options Choosing Who Can Log Customizing the Workgroups Displayed at Login To choose who can log Enabling the Use of Login and Logout Scripts To customize the workgroups displayed at login To enable the use of login or logout scripts Trust value name Requirements Choosing a Login or Logout Script Click Edit To set an item to open automatically To choose login or logout scriptsAutomatically Opening Items After a User Logs Providing Access to a User’s Network Home Folder To automatically mount the Network Home Providing Easy Access to the Group Share PointTo add a login item for the group share point To control access to disc media Managing Media Access PreferencesControlling Access to CDs, DVDs, and Recordable Discs To restrict access to internal and external disks Controlling Access to Hard Drives, Disks, and Disk ImagesEjecting Removable Media Automatically When a User Logs Out To automatically eject removable media Mobility preference pane What you can control Managing Mobility PreferencesCreating a Mobile Account To create a mobile account using Workgroup Manager Preventing the Creation of a Mobile Account To remove a mobile account Manually Removing Mobile Accounts from ComputersTo prevent the creation of mobile accounts Enabling FileVault for Mobile Accounts OptionEffect To enable FileVault for mobile accounts Home folder location Description Selecting the Location of a Mobile AccountTo select the location of a mobile account Type Name Privilege Creating External Accounts To create an external account Setting Expiration Periods for Mobile Accounts To set an expiration period Stopping Files from Syncing for a Mobile Account To stop files from syncing To set the frequency for syncing background folders Setting the Background Sync FrequencyShowing Mobile Account Status in the User’s Menu Bar To show mobile account status in the user’s menu bar Configuring Proxy Servers by PortManaging Network Preferences Network preference pane What you can control Allowing Users to Bypass Proxy Servers for Specific Domains To configure proxy servers for a user or a groupTo choose the domains that users can access directly To disable Internet Sharing Enabling Passive FTP ModeTo enable passive FTP mode Disabling Internet Sharing To disable Bluetooth Disabling BluetoothTo disable AirPort Disabling AirPort Managing Parental Controls Preferences Preventing Access to Adult WebsitesTo prevent access to specific websites Hiding Profanity in Dictionary Allowing Access Only to Specific Websites To allow access only to specific websites Setting Time Limits and Curfews on Computer Usage Printing preference pane What you can control Managing Printing PreferencesTo set time limits and curfews Preventing Users from Modifying the Printer List To restrict access to the printer listMaking Printers Available to Users To create a printer list for users To set the default printer Restricting Access to Printers Connected to a ComputerSetting a Default Printer Adding a Page Footer to All Printouts Restricting Access to PrintersTo restrict access to a specific printer To add a footer to all printouts To manage access to Software Update servers Managing Software Update PreferencesManaging Access to System Preferences To manage access to System Preferences Managing Time Machine Preferences To manage Time Machine preferences Universal Access Preference pane What you can control Managing Universal Access PreferencesAdjusting the User’s Display Settings To adjust screen appearance Setting a Visual AlertAdjusting Keyboard Accessibility Options To set a flashing alert To set the way the keyboard responds to keystrokes Option Effect To control mouse and pointer settings Adjusting Mouse and Pointer ResponsivenessEnabling Universal Access Shortcuts Allowing Devices for Users with Special Needs Using the Preference Editor with Preference ManifestsTo allow Universal Access Shortcuts To allow assistive devices Adding to the Preference Editor’s List To add to the preference editor’s list Frequency Description Editing Application Preferences with the Preference Editor To edit application preferences To disable management of an application’s preferences Using the Preference Editor to Manage Core Services Manifest Examples of things you can change Using the Preference Editor to Manage Safari To add Safari to the preference editor list 238 Diagnosing Common Network Issues Testing Your Network’s Time and Time Zones Testing Your DNS Service To test your network’s DNS service on a single computer Testing Your Dhcp Service To test your network’s Dhcp service on a single computer If Users Can’t See Their Names in the Login Window Solving Account ProblemsIf You Can’t Edit an Account Using Workgroup Manager If You Want to Use Earlier Versions of Workgroup Manager If Users Can’t Log In or Authenticate If You Can’t Modify a User’s Open Directory PasswordIf You Can’t Assign Server Administrator Privileges If Users Relying on a Password Server Can’t Log If Users Can’t Change Their Passwords Problems with a Primary or Backup Domain ControllerIf Users Can’t Access Their Home Folders If a Windows User Can’t Log in to the Windows Domain If a Windows User’s Profile Settings Revert to Defaults If a Windows User Has No Home Folder If Users Don’t See a List of Workgroups at Login Solving Preference Management ProblemsTesting Your Managed Client Settings To view managed client settings in System Profiler If Login Items Added by a User Don’t Open If Users Can’t Add Printers to a Printer List If Users See a Question Mark in the Dock If Items Placed in the Dock by a User Are MissingIf a User’s Dock Has Duplicate Items If Users See a Message About an Unexpected Error If You Can’t Manage Network Views Importing and Exporting Account Information Understanding What You Can Import and Export Limitations for Importing and Exporting Passwords Archiving the Open Directory Master Using Workgroup Manager to Import AccountsTo import accounts using Workgroup Manager Using Workgroup Manager to Export Accounts To export accounts using Workgroup Manager Using XML Files Created with AppleShare IP Access control list See ACL Apple Filing Protocol See AFP See also computer list Directory node See directory domain Full name See long name Globally unique identifier See Guid Home directory See home folder Local home directory See local home folder 262 Primary domain controller See PDC Search path See search policy Security identifier See SID Weblog See blog 266 Index 268 269 270 271 272 273 274 275