Keychain doesn't exist

[LVISDJShip]

We've just deployed new iMacs and a package must have caused an issue with keychain. The issue is this ...

At first login with an Active Directory account the keychain states that it can't create a login keychain; when we select Restore Defaults and enter the AD account password the dialog box goes away. In Keychain Access the login keychain was never created and one cannot be created.
Is there a script to restore keychain defaults?

Thanks all,

[mm2270]

Are you certain this isn't a permissions issue? Perhaps you manipulated the user template home directory in some way that users don't have permissions to their own folders in ~/Library, such as the "Keychains" directory?
Are the users Standard or Admin level?

[jmercier]

have the same problem... and its not a manipulation on the template... must be a package...

[thanzig]

Just started experiencing this problem. I noticed the "Keychain" folder is not in the newly logged in AD user /Library. When I create the folder the issue seems to go away. Do think it is an issue with my image but will investigate.

[nigelg]

I have recently experienced similar problems.

Our user template folder has the Library/Keychains folder removed. We have 2 sites, one has enrolled using network scans and the other has enrolled using quickadd package. The site with the quick add package has no login keychain created when they log in for the first time or subsequent times. You can choose to reset to defaults but a login keychain isn't created in keychain access. I have unenrolled the machine and reenrolled using remote enrolment and on subsequent logins the keychain is created as per expected behaviour. This is the experience in our first site. The only difference is the method of enrolment. I am waiting to find a machine that has the problem on our first site and all machines on the second site have the issue.

[agurley]

This is also happening to me and I'm using the workaround mentioned at https://jamfnation.jamfsoftware.com/discussion.html?id=6211 - which you've probably already discovered. Log in as root, make a Keychains folder in the user template library, capture with Composer then deploy via policy. I hate putting bandaids on little problems like this but it's been working.

[agurley]

update: Upgraded to Casper 9.24, upgraded OS X to 10.9.2, made new base image and now all folders in user library are being created properly.

Just want to clarify this was only happening for our AD user accounts. We're not using the built-in AD bind script (another problem for another day) and are joining machines manually. The "fix" that I mentioned in my previous post was sufficient for lab users who weren't personalizing the machines, however what I also noticed & chose to ignore at the time was that a few other folders also weren't getting properly created in the user library: Calendars, Dictionaries, Mail. Those directories (including Keychains) appear as a blank page icon. Also within ~/Library are some other corrupted directories that shouldn't exist in the user library anyway, such as Component, KeyBindings and QuickLook. Don't know what that's about. Anyway, a big problem I had with this is that you can't open the iCloud preference pane if the Mail & Calendar folders aren't in the user library, and same thing with the Internet Accounts pane. I went into the user library and deleted the Mail & Calendar folders, recreated them, and then I could open the iCloud & Internet Accounts panes again. I'm hoping this is a dead issue b/c who knows what other weird side effects would have come to the surface.

[johnklimeck]

Seeing the exact same thing, in 10.9.2 (13C64), JSS 9.2.1.

Keychain folder workaround is working great. Will have to update JSS to 9.24 and see if it fixes the issue permanently.

[Lincoln]

I'm seeing this issue too. Currently using JSS 9.25 and have been seeing this issue with 10.9. I've just made a fresh 10.9.2 image and am still seeing the same behaviour. I could apply the band aid but I'd rather fix the issue properly. :)

[johnklimeck]

lincoln,

for sure JAMF binary / JSS 9.3 fixes this issue. I do not have to include the Keychain patch / pkg in my Casper Imaging process. we went directly from 9.21 to 9.3. I feel you, this keychain issue was annoying, but not seeing it in any longer in 9.3

[Lincoln]

OK well I've updated to 9.31, created a new NetBoot image using Caper Imaging 9.31 and taken my keychain patch out of the Config....

And I still have the keychain issue. So 9.31 hasn't sorted this for me. So at this point due to time pressures I'm going to have to use the keychain patch. :( I just can't afford to waste any more time on this.

Frustrated

Lincoln

[Lincoln]

I thought I should post a final comment on this. I decided to do a bit more testing and found that the issue was indeed fixed in 9.3x. When I laid down just my base image I had no keychain issue, but when I ran a full nuke and pave with a config with all the packages in it the issue returned. After more testing I found that I had one particular Composer built DMG which was causing the problem when FUT and FEU were enabled.

So with that fixed I am all sorted. :)

Lincoln