Open directory rebound, profiles not working

open-directoryosx-server

Our Open Directory server messed up last week and it resulted in the whole thing having to be rebuilt over the weekend. Most of it went smoothly however as the Open Directory Host Name was changed things got a bit funny.

User mappings were all different so I unbound from the old OD/rebound to the new OD, chown-ed the home folder to the new user and deleted the old certificates from the keychain. It seems to have worked but the only problem is that user profiles aren't doing what they're supposed to. I've added in some mail accounts to a user profile and, if that user logs in to a machine that they previously have, no mail accounts are being created. If the user logs into a machine they have never logged into before – the accounts create automatically via the user profile.

I know there must be something I'm missing here as deleting the user's home directory and logging in fresh doesn't work (the profiles are pulled from the server but the mail accounts aren't added). Is there some other place that OS X stores user account information or previously logged in users (like mobile users or similar)?

In short I've effectively switched binding Open Directory, trying to keep the home directory. Strangely settings like Dock/Finder being configured via the profile manager are read and accepted by the user's machine so it seems to be just mail (so far) that's not working.

Best Answer

Okay I've managed a solution. Note this only works if the open directory hasn't been corrupted like ours was, you'll need to chown the home directory again after a rebind. Here's the steps:

  1. Login to the machine as the network user
  2. Go to https://your.server.com/mydevices and un-enroll
  3. Log out
  4. Log in as local admin user, not network user
  5. Delete all keychain entries for old Open Directory server and MDM
  6. Open Users & Groups
  7. Delete network user, keep home directory
  8. Delete /library/configuration profiles/username (network user)
  9. Reboot
  10. Log in as network user
  11. Create mobile account
  12. Go to profile manager/my devices and enroll the machine
  13. Reboot
  14. Log back in as network user
    1. Transfer old documents/etc from /users/old user (deleted)/ to new user.