Hi,

We are having issues that just started about two weeks ago with our AD user accounts in our Mac labs. We have it set to:

-NO mobile Account Creation
-Force local Home Directory on Startup disk
-Use UNC path from Active Directory to Derive network home location
-SMB protocol
-default user shell bin/bash

Everything has been working great for months, but now we were starting to get keychain errors for some users. I figured out that they were users who had moved to a new machine (probably happens all the time all year). So basically if they had logged into a machine before two weeks ago, they are fine. Now in the last two weeks if anybody goes to a different machine, you can log in, but you get a keychain error because you don't have right to the locally created Home directory on the startup disk. So when you click on Desktop, Documents, etc. you get the "You don't have permission to see the contents of this folder", hence the keychain issues. If they go back to their old machine they logged in at the beginning of the year, they are great. This goes for Mobile account now too....I found out.

So what happened two weeks ago? I am not sure. My system admin changed the AD password for the domain. He upgraded to JSS 8.63. Maybe he changed the permissions on the server groups. It is up to me to figure this out, even though I don't have control over the above mentioned services.

Any ideas anybody?

Thanks!