Hey all,
This may be a bit of a mouthful, but I'm sure some people out there have experience that can help in this "issue"...
So, I work for a major publishing company. We have an all PC network running W2K Advanced Server on mostly Compaq hardware. Our clients are about 45% Mac/55% PC, depending on the day of the week and how a department feels.
We have two domain controllers, both with complete replicated Active Directory, DNS, etc. I am right at the end of my Panther testing, as I'm hoping we can evolve from OS 9 to OS X. I'm sure I don't have to explain why this is in our plans!
So, my Macs are doing all types of neat-o tricks. They get their authentication from Active Directory and are bound to the Active Directory domain. This is good. We have single sign on via Kerberos "working". This is one issue we're experiencing. I can use the Network part of the Finder to navigate around our network *until* I try to connect to a share that was shared out to Macintosh users, which has the Microsoft UAM share on it. Now, we did try removing the UAM share, but the share still asks for username and password. Its pretty ironic, if you think about it, all the shares we don't intend Mac users to get into, they *could*, but the ones we want them to use, they can't, possibly due to the UAM.
Now, that isn't a huge issue, as the OS 9 users are used to having to log into all of their shares. The other small issue is Entourage X for the Mac users. Ok, it now has Exchange support, which is good, though group calendars are still not supported, we can deal. Has anyone found a way to get that application to simply get its settings and login information from the Active Directory plugin? If you read the contents of the plugin, all of the directory information is in there, as is the user information, and the Exchange server information as well. The issue is in the fact that the Entourage X application continually tries to set up your password into a local Keychain, which is all well and good for the time being, but the second the users use their new Active Directory integration to change their password, as they need to, the Keychain is out of date and becomes an issue.
Now here's the big one!
Ok, so for years, all of the OS 9 users have connected to the Windows 2000 Server using File Services for Macintosh. No problems, besides for the service crashing and the slow transfer speeds. Well, most, if not all, Mac users never put extension types on the ends of their files. Never been a problem. From what I've read, that implementation of AppleTalk, isn't a true AppleTalk and actually changes the file to a Windows/Microsoft file. This isn't a big problem, if the Mac connects back using the same File Services for Macintosh, but the problem is the resource fork isn't supported in any other connection type. Mac OS X logs in using CIFS or SMB and all of a sudden, any document that was uploaded using the File Services for Macintosh on Mac OS 9 without file extension becomes viewed as a UNIX Executable that cannot be run on OS X properly.
One solution is leaving our OS X clients using AppleTalk, which we rather not do, because of the speed limiations and instability of the service on the Windows server. Also, since they are logging in via AD, they get their user share with a SMB connection, which, of course, doesn't support the resource fork either, but does seem to move faster than the File Services for Macintosh. Another suggested solution is to download all the files using the File Services for Macintosh to a Mac OS X machine and then uploading them again using CIFS/SMB. That, of course, would take forever and a day, as its the better portion of a full TB right now.
That leads me into my next question. Beyond soloving this on the current server platform, does anyone here have experience with XServe/OS X Server? I have experience with the software, but that was on a primarily Linux network supporting both Macs and PCs, so there wasn't much issue there. Now, on my test OS X Server, I have it bound to Active Directory and I'm able to read all the users and groups. I've had relative success deploying images from it, though Adobe CS doesn't seem to transfer quite right. I'd love to be able to set up Mac Computer Accounts on my OS X Server and start managing desktops that way. (Anyone know what type of Directory Node I want to use for that? The only directory services we have are Active Directory, which won't quite cut it with Macintosh Computer accounts, as far as I know). Now, I'm guessing we wouldn't have this file problem moving all user accounts, Mac and PC onto an XServe. The PC users can still connect via SMB/CIFS as they normally would and the Macs could use AFP. Is this a good idea? I mean, instead of downloading a TB of data and then uploading it again, we could just download it and keep it on that hardware and share it back out. I don't know of any issue of OS X (UNIX) supporting both Macs and PCs off the top of my head.
So, now that I've gone on and on, does anyone out there have anything constructive to add? Any help is greatly appreciated!
Thank you!
This may be a bit of a mouthful, but I'm sure some people out there have experience that can help in this "issue"...
So, I work for a major publishing company. We have an all PC network running W2K Advanced Server on mostly Compaq hardware. Our clients are about 45% Mac/55% PC, depending on the day of the week and how a department feels.
We have two domain controllers, both with complete replicated Active Directory, DNS, etc. I am right at the end of my Panther testing, as I'm hoping we can evolve from OS 9 to OS X. I'm sure I don't have to explain why this is in our plans!
So, my Macs are doing all types of neat-o tricks. They get their authentication from Active Directory and are bound to the Active Directory domain. This is good. We have single sign on via Kerberos "working". This is one issue we're experiencing. I can use the Network part of the Finder to navigate around our network *until* I try to connect to a share that was shared out to Macintosh users, which has the Microsoft UAM share on it. Now, we did try removing the UAM share, but the share still asks for username and password. Its pretty ironic, if you think about it, all the shares we don't intend Mac users to get into, they *could*, but the ones we want them to use, they can't, possibly due to the UAM.
Now, that isn't a huge issue, as the OS 9 users are used to having to log into all of their shares. The other small issue is Entourage X for the Mac users. Ok, it now has Exchange support, which is good, though group calendars are still not supported, we can deal. Has anyone found a way to get that application to simply get its settings and login information from the Active Directory plugin? If you read the contents of the plugin, all of the directory information is in there, as is the user information, and the Exchange server information as well. The issue is in the fact that the Entourage X application continually tries to set up your password into a local Keychain, which is all well and good for the time being, but the second the users use their new Active Directory integration to change their password, as they need to, the Keychain is out of date and becomes an issue.
Now here's the big one!
Ok, so for years, all of the OS 9 users have connected to the Windows 2000 Server using File Services for Macintosh. No problems, besides for the service crashing and the slow transfer speeds. Well, most, if not all, Mac users never put extension types on the ends of their files. Never been a problem. From what I've read, that implementation of AppleTalk, isn't a true AppleTalk and actually changes the file to a Windows/Microsoft file. This isn't a big problem, if the Mac connects back using the same File Services for Macintosh, but the problem is the resource fork isn't supported in any other connection type. Mac OS X logs in using CIFS or SMB and all of a sudden, any document that was uploaded using the File Services for Macintosh on Mac OS 9 without file extension becomes viewed as a UNIX Executable that cannot be run on OS X properly.
One solution is leaving our OS X clients using AppleTalk, which we rather not do, because of the speed limiations and instability of the service on the Windows server. Also, since they are logging in via AD, they get their user share with a SMB connection, which, of course, doesn't support the resource fork either, but does seem to move faster than the File Services for Macintosh. Another suggested solution is to download all the files using the File Services for Macintosh to a Mac OS X machine and then uploading them again using CIFS/SMB. That, of course, would take forever and a day, as its the better portion of a full TB right now.
That leads me into my next question. Beyond soloving this on the current server platform, does anyone here have experience with XServe/OS X Server? I have experience with the software, but that was on a primarily Linux network supporting both Macs and PCs, so there wasn't much issue there. Now, on my test OS X Server, I have it bound to Active Directory and I'm able to read all the users and groups. I've had relative success deploying images from it, though Adobe CS doesn't seem to transfer quite right. I'd love to be able to set up Mac Computer Accounts on my OS X Server and start managing desktops that way. (Anyone know what type of Directory Node I want to use for that? The only directory services we have are Active Directory, which won't quite cut it with Macintosh Computer accounts, as far as I know). Now, I'm guessing we wouldn't have this file problem moving all user accounts, Mac and PC onto an XServe. The PC users can still connect via SMB/CIFS as they normally would and the Macs could use AFP. Is this a good idea? I mean, instead of downloading a TB of data and then uploading it again, we could just download it and keep it on that hardware and share it back out. I don't know of any issue of OS X (UNIX) supporting both Macs and PCs off the top of my head.
So, now that I've gone on and on, does anyone out there have anything constructive to add? Any help is greatly appreciated!
Thank you!