Keychain Issues with built-in AD Bind

[DBrowning]

Since imaging with 10.9.5 and binding via the Apple Built-in AD Bind, when i login in as a new user, I get the following message: "A Keychain cannot be found to store "username"". Has anyone else seen this?

[gfarabaugh]

I had the same problem. I couldn't get it fixed so I created a new image with Yosemite and I haven't seen the issue since.

[dpertschi]

How do you generate your OS image? Are you meddling with the /System/Library/User Template?

[DBrowning]

not touching the user template folder. I take a brand new machine from Apple and just create an image without setting anything up. It worked fine on my original test machine (machine i use now) and had no issue.

[DBrowning]

@dpertschi Let me rephrase that. I have nothing touching the user temp folder that would be using Keychains. I have setup a couple packages for settings such as dock, menu items, etc.

[ptrondsen]

You should be able to customize the User Template, when you create a test account keep the password blank.
Once you are done customizing, and copy the Library folder of your test account into the User Template.
Repair permissions.
After imaging and binding, you will be prompted to create a new keychain when logging to your AD Account.

[DBrowning · Accepted solution]

I ended up going through and adding in package by package to find out what was causing issues. some how one app got set to fill user template that was causing the issue. seems to be resolved now.

[Jstiesi12683]

Just wondering if anyone has permanent solution for this issue yet having to revisit accounts once sometimes even twice a month is tying up time that could be better spent for other tickets. So far I have blown away the keychain forcing a creation of a new one and yet even with it blown away and a machine restart it still shows up and wants the old password

[bentoms]

@Jstiesi12683 Are they being prompted for the login keychain or the local items keychain as detailed here?

[Jstiesi12683]

@bentoms they are being prompted for the local one which no longer exist yet it still wants the old password that the user can not remember

[hsekiv]

New to Casper, have imaged 30 MacBook Airs (shared machines at a primary school in a computer lab) with Casper Imaging but received the "keychain cannot be found to store" error but only when logging in with an AD account. Using one of the local accounts works fine.

I've used FUT and FEU for Firefox, Chrome, and Office 2016.

I know someone mentioned the solution is to go through package by package, but how exactly? Does this involve having to re-image the machines? I used FUT and FEU to customise the settings for the apps, mainly Firefox.

Thanks

[mpermann]

@Wheelspinning I would suggest taking a test machine and image it using the same configuration you used on the 30 MacBook Air computers but leave out any installations that have FEU/FUT set on the package. If you don't get the keychain error then you can add back one package at a time and test to see if you can figure out which package is causing your issue. Otherwise you could try posting screen shots of the Composer packages for Firefox, Chrome and Office and maybe we can figure out from those what might be causing your issue.

[hsekiv]

Thanks @mpermann

I imaged a machine with just the base OS and AD binding and the error went away. I will try loading the other apps one by one and see which app is the problem, but for now happy without the error on the test machine. Won't be using AD until the start of school next year (Australian school year is calendar year)