 |
 |
 |
 |
 |
|
|
|
|
|
|
Last updated June 9, 2008
Mac OS X 10.4 (US $129) and Mac OS X Server 10.4 (US $499 for 10 clients, $999 unlimited) include cross-platform features not found in previous versions. The client version includes these new features:
Tiger Server includes support for Access Control Lists (ACLs), a more flexible method of handling permissions than the native Unix permissions. Apple says the ACLs used on Mac OS X Server 10.4 are compatible with the native file permissions of Windows 2003 and Windows XP. Additionally, all user-based services in Tiger Server support service access control lists (SACLs).
As of Tiger, Mac OS X no longer supports AFP over AppleTalk. AFP over IP is still supported. This means that Tiger will not be able to access old Mac file servers that don't support AFP over IP.
Tiger 10.4.11 update improves VMware compatibility, AFP file sharing. Monday, November 19, 2007 -- On the same day last week that Apple released its first Leopard update (10.5.1), the company also released what may be the last Tiger update, Mac OS X 10.4.11, for Intel and PowerPC Macs. The update improves reliability when running VMware Fusion for Intel Macs. (A previous reader report described crashing with VMware Fusion on Mac OS X 10.4.11.) The update installs Safari to version 3, the same version shipping with Leopard, and improves some networking features on Intel and PowerPC Macs, including:
Many readers found the previous release, Mac OS X 10.4.10, had networking problems that previous versions did not. These were slow network access, probably due to DNS issues, as well as problems with AirPort wireless networking.
If you've installed the Mac OS X 10.4.11 update if it fixes any of these problems.
Apple 10.4.7 update addresses known cross-platform problems. June 30, 2006 – Earlier this week, Apple released Mac OS X 10.4.7 for PowerPC and Intel Macs. Apple said that the update fixes a number of cross-platform problems, including problems with AFP file sharing, Active Directory, and uninstalling Virtual PC. The update also includes new security updates for the client and server versions of Mac OS X.
The 10.4.7 update includes several fixes to the AFP protocol. It fixes the 10.4.6 problem of Adobe Photoshop and Quark apps crashing (unexpectedly quitting) when saving files to an AFP server. The problem occurred on non-apple AFP servers, such as Microsoft’s Services for Macintosh for Windows servers.
The update also fixes a problem that deletes files on a mounted AFP volume when duplicating them in the Finder. Another AFP fix prevents a "Bad file descriptor" error when accessing an AFP volume in Terminal, copying a file using the cp command to copy a file to the server.
Apple also said that the 10.4.7 update has a few Active Directory fixes:
The built-in VPN client now supports group membership on Cisco VPN servers.
On PowerPC Macs, the upgrade fixes a problem with uninstalling Microsoft Virtual PC. Apple says the VPC installer will no longer unexpectedly quit during an uninstall.
Apple said that Mail now supports connecting to mail servers through a SOCKS proxy. It also improves the retrieval of IMAP messages with attachments over unreliable connections.
Apple article number 303771 lists the fixes since version 10.4.6.
Tiger 10.4.6 fixes problems with SMB, AFP
Tiger 10.4.5 update addresses Cisco VPN; Server update lists SMB fix. February 16, 2006 -- On Tuesday, Apple released the Mac OS X 10.4.5 update. There are updates for PowerPC Macs, Intel Macs, and Mac OS X Server.
Apple mentions a couple of cross-platform fixes in the update. The company said that the Mac OS X built-in “IPSec VPN client now works with Cisco servers whether or not NAT is used.”
Apple's IPSec VPN client now works with Cisco servers whether or not NAT is used.
Last week we reported that a Cisco readme file reported that the Cisco VPN Client causing kernel panics with AFP. Apple didn't mention if this problem was addressed.
For the Mac OS X Server update, Apple lists this cross-platform improvement: “SMB: Addresses an issue with using and mounting Windows-formatted storage devices.”
Apple’s support page also lists this improvement:
Files copied across a network via Portable Home Directories are now copied as temporary files until the transfer is complete, in case the network connection is interrupted before the transfer finished.
The update also contains “operating system fixes.”
Mac OS X 10.4.4 update. January 11, 2006 -- Apple's description of what is new in 10.4.4 since changed since 10.4.3 makes no specific references to fixes of cross-platform problems, but one improvement could address some Tiger problems on Windows networks:
Improves stability when third-party networking kernel extensions are installed
When 10.4.0 was released, developers of network software, including virtual private network clients, blamed incompatibles with problems in the Mac OS X kernel.
Long list of cross-platform fixes in OS X 10.4.3 Update; bugs still remain. November 3, 2005 -- The long-awaited Mac OS X 10.4.3 Update that Apple released this week has a long list of dozens of bug fixes and improvements, including several related to cross-platform issues. Apple's bug fix list includes these cross-platform topics:
Readers are reporting that while some problems are fixed, others remain, including some problems that began with Mac OS X 10.4.0.
Apple says Tiger 10.4.2 update fixes AD, SMB problems. July 18, 2005 -- Apple says that the long-awaited Mac OS X 10.4.2 update it release last week fixes a number of problems with Active Directory integration and with SMB/CIFS file sharing. Several of the bugs are those that we have been covering.
Active Directory fixes
SMB/CIFS File Sharing
Mac OS X 10.4.1 Upgrade: Bug fixes for third-party VPN software and networking. May 18, 2005 -- Less than a month after shipping Tiger, Apple released the first patch, the Mac OS X 10.4.1 Update. Apple says that among a long list of bug fixes, the update deals with problems regarding SMB/CIFS filesharing, logon to Active Directory and LDAP servers, as well as incompatibilities with third-party software and hardware. Some developers of virtual private network clients are saying that Apple's patch will work with new updates to their own software. Some MacWindows readers, however, report that the new update does not solve their problems with Tiger in these areas. (See stories below.)
Apple said that AFP file sharing and using DHCP in wireless networks were also improved.
Mac OS X 10.4.0: incompatibilities
Released on April 29, 2005, the first version of Tiger has numerous incompatibilities with third-party cross-platform applications, most notibly networking software, as well as widely reported (though not universal) problems with SMB networking and Active Directory integration. (Reports of these problems are below.) Part of the problem are extensive changes to the OS X kernel, though some developers claim that there are bugs in Tiger that Apple will have to fix before they can make their software compatible. The most notable problems:
Some of Mac OS X 10.4.0's own features are having problems (though not universally):
Active Directory/Open Directory problems with Tiger 10.4.0.
May 2, 2005 -- Santino Rizzo reported Tiger problems with Active Directory and Open Directory:
I'd like to know if anyone using the AD plug-in can reproduce my problems with Tiger.1. Mobile AD accounts cannot login when disconnected from the network. Major problem for laptop users. Account info is there in NetInfo, and you can do a Terminal login to that account, but no login from Login Window.
2. Open Directory printing does not properly authenticate resulting in NT_STATUS_ACCESS_DENIED. Printer setups using OD though AD work beautifully, but is completely useless if you can't actually print.
(See also our Active Directory page for more AD/Tiger problems)
Tiger 10.4.0 incompatible with third-party VPN software
Most developers of virtual private network clients reported that Mac OS X 10.4.0 had compatibilitie problems with their software. Several pointed to a bug in Apple's kernel. This was apparently fixe in the 10.4.1 release, which also require new versions of the VPN clients.
April 28, 2005 -- eWeek reported that Mac OS X 10.4.0 (Tiger) will not support the Cisco virtual private network client. The story quotes a Cisco product line manager as saying that Cisco has been working with Apple on the incompatibility, but were unable to resolve it. eWeek reports that Cisco will fix the problem in May.
IPSecuritas
May 2, 2005 -- Lobotomo Software is reporting problems with its IPSecuritas VPN client at a user discussion forum. Lobotomo Software seems to agree with Thursby that there is a bug in the Mac OS X 10.4 that Apple needs to fix:
a. Tunnel establishes normal, but throughput is very bad, packet round-trip times (ping) between 500 and 1000 ms (on connections with approximately 50 ms before). This seems to be a bug in the MacOS kernel.b. DNS replacement does not work anymore - the settings are ignored.
c. In one case, the tunnel could not be established at all.
We are working on problems b. and c., while only Apple can resolve a. At the moment we don't recommend to update to Tiger if you rely on VPN connectivity.
Lee Unks reported to MacWindows that he is seeing the first two of these problems:
Since upgrading to Tiger, IPSecuritas is extremely sluggish 40 ms pings have now turned into 1000 ms. Also, the DNS Replace function is broke as well.
Apani (Netlock) Network Contivity Client
May 2, 2005
Mark Alexander reports that the Apani support page reports an incompatibility with Tiger:
I am a customer of Apani/Nortel Contivity VPN Client for Nortel Networks. I found the following statement on the Apani Website in regards to Tiger Support:The currently released version of the Contivity VPN Client, v3.1.1, will not support the use of Mac OS 10.4. There are changes at the kernel level that cause the Contivity VPN Client to no longer work.We will be releasing a version of the Contivity VPN Client to add support for Mac OS 10.4. All customers with current maintenance contracts will be notified via email as soon as the release is available.
May 2, 2005
Dave Scott in Singapore received an email message from Apani:
Confirmation from Apani that their VPN client won't work either , which is a bummer since I use it for "working from home"Apani, at the moment does not have support for the Tiger (Mac OS X 10.4). We will be adding support for this in a later version, but we do not currently have an estimated release date. We will add your e-mail address on our "Feature Request" and will be the first to know once it becomes available.
May 2, 2005
A reader in Japan describes the symptoms:
I am a Mac user in Japan and I found the crash of Apani Contivity VPN Client post OS X upgrade from 10.3.9 to 10.4 Tiger. In contrast to your case, my Safari works well with Apani client with 10.3.9, however, Tiger completely denied start up to my VPN. Safari says "page http://... can not be opened".This reader also sent a note to Apani, and received the same message as Dave Scott.
VPN-1 SecureClient from Check Point
May 2, 2005
Nordine Vandezande reports that Tiger has the same bug with the Check Point VPN SecureClient found in Mac OS X 10.3.9. The fix that we reported for 10.3.9 doesn't work for Tiger, however:
I would just like to report that I have the same problem with VPN-1 SecuRemote on Tiger as already mentioned for 10.3.9.Unfortunately the fix which seems to work for 10.3.9 does not work for Tiger.
May 2, 2005
Marcel Lammerse discovered the same thing:
I upgraded to OS X 10.4 (Tiger) today and found that the SecuRemote client no longer starts up. I've followed the steps in Michael's workaround, but couldn't get it to work.
May 2, 2005
Morten Hersson of Norway also has the problem:
I bought the OS X 10.4 this morning and rushed home to try it all out. I experienced the problems with 10.3.9 so I wasn't too surprised when after doing a fresh install of Tiger that the Secureclient would have a few issues. I expected that it would go through the install like on 10.3.9 and then maybe not work, but it won't go through the install at all. It just quits and gives you no error message, and tells you to try install again.I don't know what happens if you just do a OS X update.
I think it´s the latest from Check Point, SecureClient_B558000178_1.pkg
May 2, 2005
Richard Little:
Tiger also broke the Checkpoint Secure Client.
May 2, 2005
Guillaume Fiastre:
I installed Tiger. I had uninstalled Secureclient first. After upgrading to Tiger, I'm totally unable to reinstall Secureclient: installation stops with an error. That's bad...Check Point incompatibility confirmed
May 3, 2005 -- Check Point verified our reader reports that the VPN-1 SecureClient is incompatible with Tiger. Check Point expects to have a fix in May.
Tiger not compatible with earlier ADmitMac and DAVE
Versions of ADmitMac before version 3 and DAVE before version 6 are not compatible with Tiger. Thursby described the changes in networking that started with Mac OS X 10.4.0:
The vastness of Apple's enhancements to critical parts of the system (both the kernel dealing with network transports and the file system) are requiring a major effort to obtain compatibility.
Thursby reports that when upgrading to Tiger when ADmitMac is installed, the Mac can fail to boot. Thursby provides a workaround at it's web site.
Thursby said that part of the problem was a bug that Apple has acknowledged. Lobotomo Software, makers of the IPSecuretas VPN client, also says that there is a bug in the Tiger kernel. (See the story directly below.) These kernel bugs seemed to have been worked out by 10.4.2.
We have three categories of reports problems with Tiger and File sharing:
There are several SMB access problems described here. The fix for the error -36 problem is given in an Apple Support document, described below.
The problem
May 3, 2005
Brad Price says SMB mounting is broken in Tiger:
We have Windows Server 2003 with Active Directory here and departments share space on the LAN. We wrote a little AppleScript to mount the server volume using essentially the Finder "Connect to Server" functionality, with smb://server.domain/share. Clients must authenticate at mount time with their AD username and password.This was working fine in Panther through 10.3.9, but in Tiger it's broken. I have no idea where to begin. We're not doing anything complicated like AD binding or really ANYTHING on the Mac side of things.
I wonder if Apple changed something with the way SMB authenticates? Perhaps something to do with adding NTLM2 support?
Suggestion: clear your keychain
May 5, 2005
Chris Millet connected to SMB after he cleared Keychain:
I too am having problems connecting to machines running Windows Server 2003 and Active Directory. There's nothing special about our setup. I didn't have any problems up to OS X 10.3.x.I believe I have a fix... Fortunately it's very simple. Once I cleared my Keychain of any references to the shares I was having problems connecting to, I was suddenly able to connect again. I found the fix on Apple's support boards.
May 5, 2005
Gilles Pelletier can access SMB from Terminal:
I can't connect anymore from the desktop (using the Connect to Server option) to a Windows server. However, I found that I can connect from the Terminal using the smbclient command. In a nutshell, the command is:
smbclient //server/drive -W workgroup -U username. More info on the man page.
May 5, 2005
Eventually I dove into the console logs and found this:
skye:/Library/Logs/Console/501 root# tail console.log
mount_smbfs: session setup phase failed: syserr = Authentication error
mount_smbfs: session setup phase failed: syserr = Socket is not connectedmount_smbfs: could not login to server COLONSAY: syserr = Socket is not connected
Also from before the workgroup disappeared, was getting a lot of:
May 2 23:12:24 skye automount[220]: Cannot mount URL 'smb://MARTIN;abc-TEGGB123456' for /Network/Martin/abc-Teggb1235456 (UI not allowed).which is me trying to mount a share on my work XP lappie (details obfuscated for not getting fired reasons).
May 5, 2005
Dallas Hockley:
I can confirm that mounting an SMB share from Tiger seems to have gone kaput vs. 10.3.x. I continually and consistently get the following error:
The Finder cannot complete the operation because some data in "smb:// foo.company.internal.corp" could not be read or written. (Error code -36).
May 5, 2005
Robert Froom had an interesting experience:
I installed Tiger on a dual 1.8 G5 and I am not able to connect to the office Linux server. It presents an authentication screen. I type in the password without effect. After many many tries I have gotten through to another screen which claims that some of the data is unreadable.Total waste of time. No help from Apple. Help line claimed that it must be a problem with the server and suggested that I reformat my hard drive. Great, even I know that reformatting is the LAST THING TO TRY.
May 5, 2005
Dana Pero tried and AppleScript, without success:
I used to be able to connect to Windows servers and workstations either via the GUI interface "connect to server" or through an AppleScript I wrote. Neither works now with Tiger. I get two different error messages - either an error code -36 or could not connect to the server because the name or password is incorrect. The errors seem to vary based upon the machine I'm trying to connect to.Funny thing is I've been able to connect to one server - one that I know is very old and probably hasn't been updated in quite awhile...
May 5, 2005
Santino Rizzo is one reader who is NOT having a problem with accessing SMB servers:
While there seems to big major problems with Directory Services, I have absolutely no problems connecting to SMB servers on W2K and W2K3, in fact I would say file transfer speeds are much faster, though I have not done any real benchmarks yet. I've done nothing special to the servers other than the usual encryption modification in Group Policy.
Suggestion: Access SMB from Terminal
May 5, 2005
Bobby Gaza can also access from Terminal:
Samba is broken in Tiger also (i.e., connect to server smb://yadda). While cmdline smbclient works, mount_smbfs (connect to server) does not work. I've tried mounting Windows servers (2000) and Samba servers (2.2 - 3.0) all with the dreaded error code 36.
May 5, 2005
Martin Burns reports some details of the log:
So, Tiger won't act as an SMB client to SAMBA or real Win XP shares. I was getting error code -36 (the I/O error) whenever I tried to connect. I could see the workgroup in the network browser (although now that seems to have gone too). Ethereal suggested that there was no SMB or NetBIOS traffic at all.Workaround: Tiger SMB mounting problem linked to password encryption
Readers have reported that this works with both Mac OS X 10.4.0 and 10.4.1. The first report puts forth the theory; the next describe how to change the encryption method.
May 12, 2005
Ronald Jore believes that the Tiger's problems with mounting SMB volumes is caused by an inability to send unencrypted passwords:
I do have the SMB-mounting problem as well, and it goes away when I reconfigure the server to use encrypted passwords.
So it seems that SMB smb client in Tiger is unable to send unencrypted passwords for SMB authentication.
I could not find much information on the software involved but as I understand it mount_smbfs uses NSMB, for which password encryption seems to be a compile-time option.
I have filed a bug (#4108992) with Apple at the 5th of May which is still marked as open.
P.S.: I noticed another bug. Try dragging a text selection into an open mail.app message window: doesn't work. I've logged this one on the 6th (#4110490) and it has been marked "Duplicate" which I take to mean that they know about it.
May 23, 2005
Matt Harrigan verifies the workaround:
Ronald Jore's tip on encrypted SMB passwords was very helpful. I had just got done telling everyone how happy I was that everything in Tiger "just worked," when I came across the issue of having to integrate the Mac with a Windows/Linux environment. I thought I was going to toss the mac through the window.
May 23, 2005
Glenn Lebumfacil gives some more detail:
Just wanted to let you know that I was able to get 10.4.1 to talk to a Samba v2 server that was giving me the exact same errors that have been listed in so many web sites. It was a little bit confusing because I didn't even have Active Directory turned on in my Directory Access Utility. Anyways, I was able to finally connect to my Samba server by adding the following to my smb.conf:
encrypt passwords = yesThis is an old fix from back in my Linux days when Win2k started forcing encryption of passwords. Apparently, the Finder SMB access is now being forced to encrypted mode. Found the info on macosx.com.
Reports for 10.4.1
June 14, 2005
John H Fallavollita reports that he can connect by using the NETBIOS name:
My SMB issue was resolved based on how I put the name in. If I fully qualified the DNS name it did NOT work. However if I use the NETBIOS name it works fine. For example SMB://server.domain.com/share wouldn't work but SMB://server/share works fine. This is after clearing the keychain (though I had nothing stored in the keychain.)I've only tested this in 10.4.1.
June 14, 2005
Pedro Gelabert found the problem with Win 2003 Server:
Well, I have followed your site's workaround to get SMB mounting on Tiger. I have found that using 10.4.1, the drives I can connect are all in Windows 2000 servers. The drives I cannot connect are in Windows 2003 servers. The failure lies in the authentication of the password:> spnego_parse_auth_response failed at 9
> Failed to parse auth response
> SPNEGO login failed: Unexpected information received
> session setup failed: SUCCESS - 0
Apparently a bug in Windows 2003 servers prevents the correct handling the request of spnego encrypted passwords, and defaults to kerberos. .Use the command:
smbclient //shared/directory -W workgroup -U username -d4
The -d4 prints logs of the steps of the connectionIn one case, I was able to mount on the terminal using smbclient to a Windows 2000 server shared drive, but not in the Finder. I am not sure if this drive is in a Windows 2003 server but with a flag of Windows 2000 server compatibility.
A co-worker in the Windows 2000 server workgroup can mount the same drives that I cannot mount. So this problem must be dependent on the version of the server (2003 vs 2000) and the encryption method.
Do I have to build kerberos and add this to my settings? I spent quite some time with AppleCare. They were very nice and tried to help, but it was way beyond their scope. They even pointed me to that samba.org web site and this problem.
I have unsucessfully tried
smb://WORKGROUP;USERID@server/share
smb://WORKGROUP@server/share
smb://server/share
What's weird is that some mount on terminal, but not on Finder, and vice-versa. Sometimes, one will mount one day, but not another day.
June 16, 2005
Amelia Lacenski tried the password workaround for Tiger's SMB problem but was only partially successful.
I am one of many who can no longer connect to a Windows server via Samba. I tried the Apple Knowledge Base 301580 fix and read the advice of many MacWindows readers. I'm writing in response to Travis MacDonald's question: we have had some partial success getting to my school department's file server, but haven't successfully logged in yet.Previously I connected to the server by getting onto the department's VPN and connecting to smb://share.server.domainname.edu, then supplying the username and password.
After "upgrading" to 10.4.1, I took the following steps:
- Set up the /etc/nsmb.conf file as in the knowledge base article
- Log on to the VPN as usual
- Connect to smb://server.domainname.edu/share via the Finder's Connect to Server window
This gets me as far as the SMB/CIFS File System Authentication dialog box, which is a big improvement over the infamous "Error code -36." The correct domain was already supplied in the Workgroup/Domain field. I then tried supplying the usual username and password, and the error returned is "Could not connect to the server because the name or password is not correct." I tried it several times to rule out typos, but it still insists that the username/pass are incorrect.
Hopefully someone who reads MacWindows knows the problem behind this new behavior.
If you are one of them
April 16, 2007
Edward Moy said that fix at Apple Support article 301580 mentioned above does fix the error -36 problem, which occurs after upgrading a Mac from Mac OS X 10.3 to 10.4.
The problem is that while Mac OS X 10.3 defaults to unencrypted passwords, Mac OS X 10.4 defaults to encrypted passwords. If the Samba or Windows (SMB/CIFS) server only supports plain text passwords, you need to use Terminal to tell the Mac to use plain text passwords. This Apple article describes how to do this.
Moy says that this does the trick:
I just updated to 10.3.x Macs up to 10.4.9 and encountered the "can't access SMB server" problem. I tried the steps at the Apple article and when I was done and rebooted, voila, I was able to connect to my SMB server with no problem.
Our Tiger Special Reports page has a long list of suggestions and workarounds, some of which point to the encryption issue. One reader reported in 2005 that the fix only partial worked.
Windows clients can't connect to Tiger
May 3, 2005
Tim Koss
I just installed Tiger on my file server in my mixed environment office. The network access on my Windows machines went from excellent in 10.3.x to BRUTAL in Tiger.A suggestion: create a template
May 5, 2005
Mike Goggin:
I've had problems with using SMB in Tiger since I upgraded the other day. I can connect to SMB shares on Windows boxes but that those same Windows machines can't connect to my Tiger box and access the shares on my Mac. I've also not had a problem with shared SMB printers (connecting to a shared printer on a Windows box).I was able to restore SMB functionality on my network to 100 percent. I reverted to using the default Tiger smb.conf template. Once I verified that the template worked, I tailored it to suit my needs on my network. Below is my smb.conf that works:
=========
; Template configuration file for smbd.
=========
; For the format of this file and comprehensive descriptions of all the
; configuration option, please refer to the man page for smb.conf(5).
;
; The following configuration should suit most systems for basic usage and
; initial testing. It gives all clients access to their home directories and
; allows access to all printers specified in /etc/printcap. It also provides
; a public share point for generally exporting stuff.
;
; Some things to check out:
;
; 1: Make sure that the user specified in "guest account" exists. Typically
; this will be a user that cannot log in and has minimal privileges.
; Often the "nobody" account doesn't work (very system dependent).
;
; 2: You should consider the "security =" option. See a full description
; in the main documentation and the smb.conf(5) manual page
;
; 3: Look at the "hosts allow" option, unless you want everyone on the Internet
; to be able to access the shares you export here.
;
; 4: If you want to support printers, add/uncomment the relevant entries.
;
[global]
guest account = unknown
encrypt passwords = yes
auth methods = guest opendirectory
passdb backend = opendirectorysam guest
printer admin = @admin, @staff
server string = Mac OS X
unix charset = UTF-8-MAC
display charset = UTF-8-MAC
dos charset = 437
use spnego = yes
client ntlmv2 auth = no
os level = 8
defer sharing violations = no
vfs objects = darwin_acls
brlm = yes
[homes]
comment = User Home Directories
browseable = no
read only = no
;[public]
; path = /tmp
; public = yes
; only guest = yes
; writable = yes
; printable = no
[printers]
path = /tmp
printable = yes
[root]
path = /
browseable = yes
writeable = yes
valid users = @admin
Samba printing problem with Tiger
May 3, 2005
Robert Kuhling, Jr., reported a problem connecting to a printer attached to a Unix machine:
After installing Tiger update to Panther, printing broke to an HP8400 (Network connection)Entourage almost unusable due to spinning "beach ball."
May 5, 2005
Jay Gibb:
With Panther, I had my EPSON Stylus C84 mounted via Samba. The printer is plugged into a Windows 2000 machine (via USB) and shared normally. It was working fine with Panther with the smb://username:password@group/server/sharename syntax. Immediately after upgrading to Tiger it stopped working.Workaround
May 12, 2005
A reader who wishes to be anonymous has discovered a workaround to the problem of SMB printing with Mac OS X 10.4:
Tiger clients "clean installed" (ie not upgraded from an already configured 10.3 client) are not able to print on a Windows printer if:
- Users are on one domain
- Printer belong to another domain
You can declare the printer OK, but ...when you try to print to a printer connected to Windows, you get the following error message:
Connection Failed with error
Nt_Status_Logon_Failure
Samba unable to connect to hostI have found out that this issue is specific to a printer you create in 10.4. It does not happen for printer created first in 10.3.x if you selected to upgrade over your existing system.
It looks like there might be a problem with the way 10.4 is building the smb:// access string to your printer when following the screen flow process.
Creating a printer in advance more (holding Alt before clicking on "Adding more printer") and typing in the smb:// string yourself does the trick.
More workarounds for Tiger/AD/SMB printing problem ("NT_STATUS_ACCESS_DENIED")
June 21, 2005
Dirk Maas found another workaround for the Mac OS X 10.4 problems printing to SMB printers on Active Directory.
We have several Tiger 10.4.1 Macs in our SBS 2003 Windows 2000 Domain using Kyocera KM2030 and JetDirect attached HP LaserJet 6P.Following the "SBSMacDoc" guidline helped a lot successfully joining the domain and accessing Exchange Server with Mail.
We too, have an "NT_STATUS_ACCESS_DENIED" Error. I tried setting up Domain Printers manually (holding Alt before clicking on "Adding more printer") using the Authentication that works for SMB Shares:
smb://DOMAIN\User:Password@Servername/Printqueuename
The job now leave the clients and printers even wake from sleep, but still, they do not print.
I'm not sure, what did the trick. We installed Unix Printing Services on the Server and set up Windows Printing on the Mac Clients, which brings up the Authentication Box after choosing the PC. One then can access the list of installed Printers on that Box. This is still not AD Printing, but it is a workaround until Apple fixes the problem.
June 21, 2005
Chuck White verified the above solution and provided some clarification:
Your article today called One more workaround for Tiger/AD/SMB printing problem has finally solved my Tiger printing problem! I have a dual G5 running Tiger and I’ve been trying to print to a Xerox 8160 large format printer which is being shared on a workstation running Win XP Pro. I re-added the printer using the suggested smb://DOMAIN\User:Password@Servername/Printqueuename and the print job worked fine.A couple of small clarifications on the instructions: My Mac doesn’t have an Alt key, I held down the Option key when clicking the Add button and then also Option clicked the More Printers.... button on the next screen. The posted instructions omitted that next you need to pull down the top menu to Advanced, set the Device menu to Windows Printer via SAMBA, I set the Device Name: to 8160 and entered the Device URL: as instructed by your article and finally specify the Printer Model. This worked well and should eliminate my need to boot on a 10.3 partition.
May 24, 2006
Daniel Williams verified a fix we reported two years ago with Mac OS X Panther and Windows printers, but Williams has Mac OS X 10.4.5:
Mark Edwards' solution dated March 30, 2004 definitely works. Using 10.4.5 and was able to enter smb://username:password@server.domain/printername using the CUPS webmin at http://localhost:631/admin (if prompted for password try your Mac login or root login). I setup the printer first in System Preferences. Then using the CUPS webin, I clicked this series of links: Administration -->Manage Printers-->select Modify Printer for the respective printer-->Configure-->choose Windows Printer via Samba, and Enter this: smb://username:password@server.domain/printername
For the username, I used a user my user name from the XP box, but when I was looking at the printer que on the actual XP box it showed guest---so you could probably use anything. Leave password blank (eg., smb://johnny:@server). I have a domain setup on my network but I assume you could use smb://johnny:@server/printername
We've had many reports of 10.4.1 not fixing the problem of mounting SMB volumes in Tiger. However, the workaround of turning off password encryption works for 10.4.1 as well as 10.4.0.
May 18, 2005
Travis MacDonald reports that Mac OS X 10.4.1 does not fix the problem:
Just inquiring if anyone you are in contact with has had any luck with the just released 10.4.1 in regards to the SMB issues?I did the 10.4.1 update in the past half hour and am still unable to connect to several boxes. I had such high hopes when I saw 10.4.1 listed SMB and network fixes as one of its first point.
If you've tried SMB access with the 10.4.1 update please
May 3, 2005 -- Microsoft verified that Virtual PC 7's Virtual Switch option not working in Tiger. A spokesperson said that it would be fixed in a free patch from Microsoft in 2-to-3 months.
Readers also report that this also is the case with Virtual PC 6. A fix for VPC 6 is not expected.
Dozens of readers have reported that after upgrading to Tiger, Microsoft Entourage becomes locked up with the "spinning beachball." Some have recommended telling Spotlight not to index the Entourage mail database. For others, this did not work. Some reades report that they are not seeing the problem.
The problem
May 3, 2005
Robert Kuhling, Jr.
Entourage almost unusable due to spinning "beach ball."
May 5, 2005
John Orwin
I upgraded to Tiger 5/1, and have found that Entourage locks up: spinning ball. Requires force quit. This appears to be random.
May 5, 2005
Mark Allen: "I'm getting the same annoying beach-ball spins in Entourage."
May 5, 2005
Daniel Golding: "Having very slow, spinning beach ball issues with Entourage and Tiger."
May 5, 2005
Sean Spicer: Entourage unstable using WebDAV under Tiger...beachballin' it.
Workaround #1: tell Spotlight not to index Entourage database
May 5, 2005
Joe Selvaggi blames it on Spotlight and has a suggestion:
I am experiencing the spinning ball problem in Entourage since upgrading to Tiger. There a corresponding sound (like frantic memory/ disk swapping activity) coming from my PowerBook.Apparently it's Spotlight trying to index the Entourage Mail DB. Tell Spotlight to ignore the Microsoft User Data folder (Users > Documents > Microsoft User Data) should do the trick, or at least it appears to work.
May 16, 2005
Bill Vader
I put my Microsoft User Date folder (Home > Documents > Microsoft User Data) in the Privacy area in the Spotlight preference pane and I immediately noticed Entourage started running much better. Before I had done that, I had the previously mentioned spinning beach balls every minute or two while using Entourage.
May 16, 2005
Martin Kelly found an improvement with Tiger after the fix:
I followed Joe’s advice and excluded the folder from the spotlight search parameters and found it resolved the spinning ball problem. Strangely, I have found an big improvement in Entourage's search times since loading Tiger.
May 16, 2005
Greg Pinelo also saw an improvement:
The Spotlight/Entourage fix seems to have helped a lot for me. A lot less drive activity, better response from Entourage.
May 16, 2005
Pastor Steve Bauer
Just wanted to thank you for your tip about adding the Microsoft database to the spotlight private folders. My slowdown instantly stopped.
May 16, 2005
Ed Bascom
I upgraded to Tiger on 5/9 and the Selvaggi solution to the Spotlight/Entourage problem seems to work.I use my Mac (G4) in a corporate environment (MS Office) and the only issue I still have is the hot sync function no longer works with Entourage -> Palm. I have not tried re-installing the Palm software yet. (Love the Widgets.)
May 16, 2005
Steven Pipes
Joe Selvaggi’s solution seems to have worked for me. I found that it occurred whenever Entourage was updating information from the Exchange server.
May 16, 2005
Guido van Nispen
I've done exactly as described and suggested by Joe Selvaggi and indeed the beach ball of death is gone!Reports of failure of the Spotlight tip
May 16, 2005
Philip Hack
I've tried the fix of not having Spotlight index the mail database but it doesn't seem to help. Entourage does not finish downloading messages. I don't get the beach ball, it just stops trying.Another workaround: junk mail filter
March 20, 2006
I had a user experiencing consistent, several minute long beach ball interruptions when starting entourage. He set Entourage's junk email protection to none and it stopped.
Yet another workaround: Norton Antivirus, exclude the Main Identity folder
March 23, 2006
Guillaume Brocard
I have OSX 10.4 and Office 2004 SP2 installed. After I installed Norton Antivirus 10.1 Entourage started to pinwheel when it synchronizes with the Exchange server. If you are excluding the Main Identity folder from being scanned by Symantec. You will have resolved your issue. You can find it in Documents/Microsoft User Data. And Set up the exclusion within Symantec's preferences.
Readers who are not seeing the problem
May 16, 2005
Jeremy Matthews
I've had no problems among our test Macs with Tiger and Entourage (v 11.1.1/2004 with all updates).However, I did a "clean install" instead of upgrading our machines; personal policy. Originally, the Macs we "upgraded" from 10.3 to 10.4 experienced some odd problems, especially with Office 2004 and v. X.
May 16, 2005
Myron Jones
I use Entourage everyday. I did an Archive and Install of Mac OS X. I've not had any difficulty with Entourage. I did notice sluggish behavior of my entire system on Day 1 (during the initial indexing), but after letting my PowerBook G4 sit overnight everything was fine on Day 2. My database is about 1.3 GB.I know however MS apps can be problematic at times. I have all the latest updates installed. Early versions of Entourage gave me more problems than this version has.
May 16, 2005
David Lockwood
No issues with Entourage (Office 2004) and Tiger. I have 45,000 archived emails and haven't had one spinning ball issue or notice a slow down.
May 16, 2005
Michael Holve
No problem here, running the latest of Entourage on two machines.
May 16, 2005
DL Byron had success, but reports another problem:
Telling Spotlight to not index Entourage helped, but the rules in Entourage no longer work, which is just absolutely terrible.
May 18, 2005
Theo Nicolakis verified our prevous report (below) that Entourage's rules are lost when running Entourage:
Can’t tell you why, but yes, my Rules are working only sporadically in Entourage.
DL Byron, who first reported the problem, fixed it:
I got those to work again, by installing the Entourage Spam update. I'm not sure what that did at all, if it was permissions or what. It's still slow.
May 18, 2005
Kenneth J. Gorelick describes how it's done:
I went to the System Prefs/spotlight, then to privacy, and added my Entourage users (it wouldn't just let me lock out the database). Since then it reads mail just like it used to!
Active Directory/Open Directory problems with mobile accounts
(See also our Active Directory page for more AD/Tiger problems)
May 2, 2005
Santino Rizzo
I'd like to know if anyone using the AD plug-in can reproduce my problems with Tiger.
1. Mobile AD accounts cannot login when disconnected from the network. Major problem for laptop users. Account info is there in NetInfo, and you can do a Terminal login to that account, but no login from Login Window.
2. Open Directory printing does not properly authenticate resulting in NT_STATUS_ACCESS_DENIED. Printer setups using OD though AD work beautifully, but is completely useless if you can't actually print.
Mac OS X 10.4.1 Update doesn't fix the problem
May 18, 2005
Santino Rizzo
The 10.4.1 update has not resolved my problems. AD users cannot login when not attached to the network. In fact Apple has made the problems worse. In 10.4, I could at least open a login shell or su to my AD account in Terminal from a local account. Now that no longer works.
May 18, 2005
Sean Lynch thought 10.4.1 made matters worse, but has a suggestion to fix it:
I get the same "unknown error" during stage 5 of the Bind with Active Directory 1.5.1. The correct computer object is created in our mixed-mode AD with a PDC and multiple BDCs.I did a fresh load of 10.4.0 on a G3-400MHz and the bind worked OK. A new iMac G5 10.4.0 and 10.4.1 has the problem
Now I've GOT IT!1. Trash all files in the /Library/Preferences/DirectoryService (then restart).
2. Config SMB to have your domain name (not FQDN) in the workgroup section (PRINTCORP in my case). I also added this to my WINS server.
This is the only combo I tried, maybe just trashing the files would do it. (The G3 Mac still had Workgroup and a blank for WINS.)
May 18, 2005
Don Wolff
I can confirm that creating Mobile User Accounts in Tiger does not correctly cache the users password and will not allow login when disconnected from the AD domain.This is a huge bummer, and would love to find a fix for it. Apple is saying that the just-released 10.4.1 update is supposed to fix issues with the Active Directory plugin. Does it help in your situation? Not at all. Upgraded first thing this AM and tried to connect with the new install, no go.
Funny thing about all of this, I contact Apple support after my testing and the guy on the phone sounded completely unaware of the issue at all. I suggested that he go and take a look at their discussion boards.
In this section, we have several different topics on different versions of the Cisco VPN Client in Tiger.
The first version of the Cisco VPN Client to be compatibile with Tiger is v. 4.6.03 (.0160) which the company says is at least compatible with Tiger on single-processor Macs, but not on dual-processor Macs. The company says that the new version will run on dual-processor Macs with Mac OS X 10.2.x and 10.3.x. On dual-processor Macs with Tiger, the new client can cause a kernel panic. Users with a password can download the new version at the Cisco web site.
There is now also Cisco Client version 7.0.
A suggested fix is offered below. One reader verified that this fix also solves a problem with "Error 51 Could Not Connect" messages, and with a more recent version of the Client.
May 18, 2005
Howard Moftich said the Cisco VPN client 4.6.03 worked:
Cisco released a Tiger-compatible VPN client, version 4.6.03. I've already installed and tested it, and it seems to work fine. Also, they decided to put everything in either /opt or /etc/opt.
May 18, 2005
Tony Sze said it worked with the new Apple patch:
I'm using Cisco Systems VPN client 4.6.03 (0160) and Mac OS X 10.4.1. After reinstalling the VPN client on Tiger, I can now connect to the network successfully.
May 18, 2005
Alexander Kohr, however, said that the new version didn't work on either 10.4.0 or 10.4.1:
Just thought i would update you with the information that the update for tiger of the Cisco VPN for 10.4 software is not working for any of 4 tiger systems that we have tested it with. However it works just fine in 10.3.Two were tested with just 10.4.0 and three of the systems were tested with 10.4.1. It seems to be some kind of DNS issue. It claims it can't resolve the host names under 10.4.1 however if you put in the machines numerical IP address, that doesn't work either.
May 23, 2005
anonymous
I've installed 4.6.3 (0160) on both 10.4 and 10.4.1 and it still has issues (no previous VPN installs). It installs ok and appears to connect BUT a) it will not disconnect (( have to force quit) and b) when it appears to be connect I can't connect to my host; it just times out after a period of time.
May 23, 2005
Lee Calamaio has a different sort of problem with printing:
It also appears that if you do get Citrix Client on the Mac [Tiger] working (version 7.0.XXX) the printing system hangs up and completely locks up the Citrix session. No workaround yet that I’ve found except save my work and access from my Powerbook G4 running 10.3.9.
June 2, 2005
Laurent Taupin of France
I had the same problem after an upgrade to 10.4.1 from MacOS 10.3.9.After a call to Cisco support, a workaround is available with this command (in this case, PIX firewall is tunnel terminating):
vpngroup <group_name> default-domain <domain_name>With this command, all it's okay.
November 17, 2005
Clinton Fisher describes how he got around a problem with the Cisco VPN client in Tiger:
After installing the Cisco VPN client 4.6.03 and getting it to work twice, again it failed to start by clicking the GUI. I get the same messages about kernel module not loaded, similar to other reports.I ran these two commands in Mac OS X 10.4.1:
sudo /System/Library/StartupItems/CiscoVPN/CiscoVPN restart
sudo /usr/local/bin/vpnclient autoinit
After that, I was able to click the VPN GUI in my Applications folder and connect successfully again.
Fix for Cisco VPN 3000 verified for later version of Tiger, Client
February 23, 2007
Divyesh Shah reports success with a fix we reported in 2005 for the above problem with the Cisco VPN 3000 client and Tiger:
My VPN 3000 was giving error "error 51 could not connect to VPN subsystem" when trying to connect using USB modem.
I tried your commands:
sudo /System/Library/StartupItems/CiscoVPN/CiscoVPN restart
sudo /usr/local/bin/vpnclient autoinit
Bravo! It all worked. I have Tiger 10.4.6 and VPN 3000 4.9.0
The fix was originally offered to fix a problem with kernel panics and earlier versions of Tiger and the Cisco Client.
If you've tried this
Cisco VPN Client 4.6.04 update for Tiger: problem switching network
June 16, 2005 -- Cisco has release it's second post-Tiger client, version 4.6.04. The update address these issues:
There are still some problems:
Fix for Cisco VPN Tiger switching networks problem
July 1, 2005
Gibbons Burke
I have been running into a known issue with the Cisco VPN client Version 4.6.04 (0061) as reported on your site:• CSCei00630 unity Mac switching networks prevents client connect 10.4.
I think I may have a relatively painless workaround: Re-installing the Client application fixes the problem. I suppose it works by reloading the kext (kernel extension) from scratch. It works until the next time I hop to a new network.
The problem: When I wake the system from sleep when connected to a wireless network, or switch networks, the VPN client will not connect. If I quit it and try to reload, it will not even let the client application launch. If I try the command line I get this :
Could not attach to driver. Is kernel module loaded?
The application was unable to communicate with the VPN sub-system.
July 9, 2005
Gibbons Burke sent us another fix:
There's an easier way to deal with the issue from the Terminal without having to re-install the VPN client, which can be accomplished in two different ways:sudo /System/Library/StartupItems/CiscoVPN/CiscoVPN restart
sudo SystemStarter restart CiscoVPNThe 'restart' command unloads and reloads the kernel extension.
These commands are documented in the Cisco VPN client user manual.
AppleScript for Cisco VPN Tiger switching networks problem
July 28, 2005
Vincent Philion of Québec offers an AppleScript to deal with the Cisco virtual private network client for Mac OS X:
Hi, in reference to the CISCO client misbehaving after location switch:This short AppleScript can avoid the hassle of typing Terminal commands. Compile and save and enjoy. (Just make sure "open application" is pointing at your client app.)
do shell script "SystemStarter restart CiscoVPN" with administrator privileges
tell application "Finder"
open application file "VPNClient.app" of folder "Applications"
of startup disk
end tell
DNS issue with Cisco VPN Client 4.7
Note: a reader reports that this issue was fixed with version 4.8 of the Cisco Client.
November 21, 2005
A reader named Colomb is having trouble with DNS with the new Cisco VPN Client:
I'm having some DNS resolution issues using 10.4 and version 4.7 of the Cisco VPN client. Everything works fine when using the fully qualified server name, but as soon I try and use other names, I get a host not found error. I've read through a lot of the literature regarding this on your site and I've tried turning hardware checksum off and UDP checksums off, but it still doesn't work correctly.
November 28, 2005
Anonymous
I too have seen DNS issues with 4.7 under Tiger, but it is not consistent. Some times I get a connection and local DNS services for Safari seem to work.Remote DNS usually needs fully qualified names but this is not consistent either.
Can't really explain what conditions cause the failure but I can totally understand how beta testing could miss this because I've had some connections to the same firewall that works like a charm.
November 28, 2005
Michael Murphy has seen it:
Yep, I see this as well. I am running 10.4.3 with Cisco VPN client 4.7.00 Build 0510. I have tried changing the settings for the DNS server in networking but it does not seem to help.Workaround
November 28, 2005
Stephen Gilardi has a workaround:
I'm seeing the same issue. As a workaround, I added an explicit DNS server and search domain (for my work network) to my "System Preferences/Network/AirPort/TCP/IP" configuration. The previous versions of the VPN client that I've used haven't required this workaround.
December 12, 2005
Stephen Gilardi provided what he says is a superior workaround:
I have some more info on the VPN 4.7 DNS problem and a method of debugging it.The domain name resolver's operation is based on entries in the configuration file "/etc/resolv.conf". It's useful to view the contents of that file both before and after connecting to the VPN.
The contents of that file are normally controlled by Apple's "Network" System Preference (under the TCP/IP tab for the interface in question). If "Configure IPv4: Using DHCP" is selected there, the contents of the configuration file are a combination of static entries in Network System Preference UI and information gathered by DHCP.
The configuration file is changed by the VPN software when it makes a connection and restored when it disconnects. Specifically, the VPN replaces the "DNS Servers" with those appropriate for the remote network and adds the "Search Domains" for the remote network to the static entries in the System Preference.
There appears to be a bug in the addition of Search Domains in Cisco VPN 4.7: If the "Search Domains" entry in the Network System Preference is empty, there will be no search domains listed in "/etc/resolv.conf" after connecting to the VPN. Only fully qualified domain names will be resolved. If "Search Domains" entry is not empty, the VPN client correctly changes the configuration file to add the search domains appropriate for the remote network.
The workaround is to make sure the "Search Domains" entry is not blank. I believe that entering "local" as a "Search Domain" is harmless and correct both for the VPN and non-VPN case. In my case, after adding "local" to "Search Domains", the VPN client software correctly adds the search domain for the remote network to /etc/resolv.conf when it connects and I am able to work with simple machine names on the remote network as I have with prior versions of the VPN client.
This workaround is an improvement on the one I gave previously because it doesn't include any static nameservers or search domains for the remote network in the local network configuration. I had noticed delays in resolving names when using the previous workaround because the name resolver was trying (and failing) to reach the remote network's nameservers before trying the correct one that was now third on the list. The combination of two timeouts led to noticeable delays in resolving.
December 20, 2005
Adam Grant said:
I added "local" to the "search domains" field in networking and now my DNS works on Cisco VPN ver 7.0.
December 12, 2005
Micah Cox
On your site there is a post concerning name resolution with Cisco's VPN client version 4.7. The problem is fixed in Cisco's client version 4.8 released December 9, 2005. I have tested it and it fixes the problem.
December 28, 2005
Duncan Crawford
I see no improvement from the 4.8 client. Home machine is a new dual-core 2.3 GHz G5, Mac OS X 10.4.3, no Airport/Bluetooth, on a DSL connection serviced by a Westell 2200 modem that NATs and provides a 192.168.x address to the Mac. A Cisco 4.7.x client on this machine would connect to a Cisco 3000-series concentrator properly, but would not provide any DNS, regardless of 'local' or explicit server IP entries in the name server/domain fields of the Network control panel.The 4.8 client exhibits exactly the same behavior-- I can authenticate to the concentrator, then get no visibility into the remote network. A previous machine, a G4 2002 Quicksilver with assorted mods and CPU upgrade, same OS version and network connection, worked just fine with the 4.6.x and 4.7.x clients. Can't test it with the 4.8 client as the logic board failed (hence new machine).
Cisco VPN Client causes kernel panic with Tiger AFP
February 9, 2006 -- A Cisco VPN Client readme file for version 4.8 says that the client causes a kernel panic in Mac OS X Server 10.4 when the Apple File Protocol (AFP) is used.
A source described when Cisco would issue a fix:
I was also told by another person Cisco support explained to them that v4.8 was the last of the 4.x series so that the fix would come in a v5.x under development for both Macintosh and Windows.
Tiger AFP case sensitivity: a feature, not a bug
July 9, 2005
Todd Barber noticed that when he logged into an AFP file server using Tiger's Connect to Server command in the Go menu, his clients had trouble logging on. The problem did not occur before Tiger. With further investigation, he discovered that the path (afp://server_name/share_name) is now case-sensitive, where it was not with clients before Tiger. Baber contacted Apple about the problem:
...I have received a response back via our SE from Apple engineering that this change was intentional. This is the AFP engineer's response:URLs have always been defined to be case sensitive. Previous AppleShare clients just were not enforcing that correct behavior until Tiger.So it was an AFP change in Tiger related to the ability for case-sensitive shares.
This only happens when you put the full path in the URL to the share. When you don't use the proper syntax you get an error.
Tiger freezes when copying large files from Windows XP Pro
July 1, 2005 -- Doug Stringham reports that Tiger freezes when copying very large files from a Windows workstation:
We are experiencing consistent hangs when copying large files from a Windows XP Pro SP 2 box to a G5 box with Tiger 10.4.1 installed. We have been trying to move a project containing 40GB of video/animation files from one of our PC's drives.... it varies, but it usually hangs when it is anywhere from 1/4 to 1/2 the way through the task. Finder no longer responds and everything gets sluggish. It requires a reboot to get back in action. We have moved files under 10GB around in the past without any problems... but this is our first move of this size cross-platform.Our Switch is an 8-port D-Link DGS-1008D Gigabit.
July 9, 2005
Marc Goodman
We have found that transferring anything larger then 1.25Gb cannot be done when the transfer is initiated via the Mac workstation. You can setup Sharing for Windows and pull the file from the Windows workstation.
Tiger can't save Excel files on Windows Server 2003
March 29, 2005 -- Brian Steigauf is another reader reporting problems saving Excel to SMB shares. Several readers have pointed to Virux as the cause. Steigauf thinks the problem is in OS X SMB:
We have an issue with Mac OS X and Samba that is preventing files (specifically Microsoft Excel files) from being saved on a share. We have two different servers with different versions of Samba that we can reproduce the issue. Server A is running Red Hat Enterprise Linux AS release 3 kernel 2.4.21 using Samba 3.0.9-1. Server B is Red Hat 7.3 kernel 2.4.20 with Samba 2.2.7. Clients are variants of Mac OS 10.3, but in our testing the clients were both 10.3.8.
The issue can be reproduced consistently by performing the following:
User A opens an Excel file titled "testdocument.xls" on the server. User A can work fine, save multiple times, even close the file and reopen it. User A closes the file and quits Excel, but stays logged onto the server. User B opens "testdocument.xls" and starts to work on it. When User B goes to save the file, they get the following error after a pause, "Save not complete. File rename failed. Retry?" User B has the choice of Cancel or Retry. Pressing Retry puts them in a loop that the file cannot be saved. Clicking Cancel give you another message, "Your changes could not be saved to 'testdocument.xls', but were saved to a temporary document named 'the temp name of the file (an alphanumeric string).' Close the existing document, then open the temporary document and save it under a new name." The only option is OK. Clicking OK writes a file to the share with the temporary alphanumeric name and deletes the original "testdocument.xls."
The problem can be traced back to the ._testdocument.xls that is created with the testdocument.xls when it is copied with SMB. If a smbstatus is performed on the server to show which files are locked, .._testdocument.xls shows it is locked by User A, even though the parent file is closed. If User A logs off the server, then User B can will not have the problem, because the lock on ._testdocument.xls is released.
We really believe it is an issue with OS X SMB client because we have reproduced the issue on Linux with Samba, Windows 2000, and EVEN OS X Server (if you connect through SMB).
March 20, 2006
Rob Campbell says this is a know bug:
Apple has confirmed that Word and Excel files have issues on a Tiger Server, unless you run Access Control Lists (ACLs) on the volume (with proper ACEs).
ACL lists not cascading in Tiger
Note: a reader reported below that the Tiger 10.4.3 update fixes this problem.
July 19, 2005
Michael O'Lear reports a problem with Access Control Lists (ACL) not cascading with Tiger. Apple told him that the 10.4.2 update was supposed to have fixed the problem, but may not have.
We found a strange problem in Mac OS X Tiger 10.4.1 with ACL not cascading when the ACL membership is from a Windows Domain.
When a domain user (call him "cray”) and the Domain Administrator’s account are assigned full explicit permissions on the Access Control List, the permissions are cascaded down through the “cray” folder.
When the user “cray” (who is also in the “domain admin” group) copies the “Stuff” folder to the “cray” foldler, just the “Stuff” folder know has altered “Group” and “Everyone” standard permissions. They have changed to “Read Only.”
When a “domain admin” navigates to inside the “Stuff” folder, the “domain admin” know has READ ONLY rights as well. It looks like it is getting the permissions now from the standard permissions and not the Access Control List. (Our domain admin account is identical to our XServe’s local Administrator account.)
(We are trying to use a XServe/XRaid combo to provide Windows share points for our Windows client PCs. The XServe is bound to our Active Directory Windows 2000 domain).
We also found that the share points will on occasion, map to the wrong level--ie. instead of the U: drive mapping to \\XServe\userdata\cray it will map to \\XServe\userdata sometimes for the Windows clients. The share point will also periodically log the user off and on again.
Apple has escalated my issue with ACL not cascading (when the ACL membership is from a Windows Domain). So far they believe that the 10.4.2 update, which was supposed to address this, may not have.
July 25, 2005
Michael O'Lear reports that Apple has confirmed the problem:
I got a response from Apple. They have confirmed the issue. Realistically, they don't anticipate a fix until the next software update.Update 10.4.3 fixes problem
November 17, 2005
Michael O'Lear
Back when 10.4.2 was released, I reported to your site that our XServe (acting as a member server attached to a Windows 2000 Active Directory Domain) was not cascading permissions from the ACLs on its SMB shares.I am happy to report that on updating to 10.4.3, ACLs now work for our Windows users accessing the XServe's SMB shares. I am also happy to report that the network services no longer go unresponsive every 24 hours. The XServe has stayed up since Saturday. My hope has returned.
July 21, 2005 -- Users at Apple Discussion forums are reporting a problem with Tiger 10.4.2 and Adobe InDesign CS on Windows networks. (See also here.) Users report that InDesign crashes on Mac OS X 10.4.2 when one tries to open files on SMB servers from the application.
Apple locked the original discussion at its forums, but users created a new thread here. There is also a thread at Adobe's discussion forum (login required.) The problem does not occur with Tiger 10.4.1 or earlier. No workarounds are known at this time.
The Mac OS X 10.4.3 update fixed the problem.
AdMitMac 3 cures the problem
Thursby Software says that it's AdMitMac 3 software for Active Directory and file sharing integration fixes this problem. A reader, Micah Tremain, verified this (October 27, 2005).
October 27, 2005
Micah Tremain verified that the current version of ADmitMac from Thursby software fixes the problem.
10.4.3 Update fixes the problem
November 3, 2005
A reader who wishes to remain anonymous reports that Tiger incompatibility with Adobe InDesign has been fixed:
The InDesign crash problem (when using SMB/CIFS) seems to be fixed in the upcoming 10.4.3 update of Tiger. At least it works OK in the recent beta.
November 7, 2005
Luis Menoyo
The problem in OS-X 10.4.2, of InDesign crashing when opening a file on an SMB server, have been resolved in OS-X 10.4.3. Now I can work on InDesign files residing on a Windows server.
July 28, 2005 -- Nati Elinson in Israel reports that using Mac OS X Tiger 10.4.2 to copy a file to an SMB volume will crash the Finder. This is not a problem that is being widely reported, but it is interesting in that it bears a resemblance to the problem with Adobe InDesign, described above.
Elinson writes:
Try this to simulate Finder crash:
- Create shared folder on Win2000 (P4 1.8GHz, 512MB, Win2000 5.0.2195 + SP4).
- Use "Connect to server..." on the Mac (G4, OS X 10.4.2) to connect to this folder: "smb://myWin2000"...
- Drag any file from the Mac to this SMB share.
- Delete this file from this folder using the Win2000 machine.
- Now, if you copy using the Mac the same file again to the SMB share BEFORE the folder contents is being updated with the result of the delete action from the Win2000 machine, then when the copy will end, Finder will crash!
Note 1: This error could not be simulated using OS X 10.3.x.
Note 2: No crash will happen if you use the Terminal to copy the file.
If you've seen this
November 17, 2005
Manuel Hernandez from Spain recommends using the Panther's Classic to run Outlook 2001 in Tiger:
I had the same reported problem when I attempt run Outlook 2001 over iMacs G5 with Tiger.My solution: Install again Tiger erasing the disk, and install the version of Classic from Panther, Mac OS X 10.3.x.It was not necessary to do with the last version of Tiger (10.4.2) is not necesary that.
November 7, 2005
Hory Fabien is still seeing a problem with SMB file coping from the Finder, but not from, Terminal with Active Directory users, and only in some logon conditions:
The 10.4.3 version still doesn't solve the following problem for us. With an Active Directory user logged on the Mac and a Windows 2003 share mounted via SMB, if I try to a Finder copy of files to the SMB share, only the first file is copied. A message says there are not enough permissions to write the file. (The permissions on the Windows 2003 server are read/write and not 'total control' for the user.) If I copy files with the Terminal, there are no problems.If I login with the local administrator of the Mac and mount the Windows 2003 share with the active directory user, I can copy files with the Finder.
November 28, 2005
James Robertson
You wanted to know if others had seen this - Yes, we have. Assorted Linux servers running Samba 3. Same symptoms as the original poster, copies using terminal work fine, etc.One of our clients is actually a Mac shop, and they have not been able to give any help either.
This occurs with OS X 10.3 and 10.4, but does not fail all the time. It does seem to be dependant on the files/filenames though.
And in 10.4.4
January 16, 2006
Jay Christianson
10.4.4 does not solve problems with AD-bound computers and Windows SMB shares. Confirmed this morning that 10.4.4 has not addressed the problem with Apples AD plugin and connecting to SMB shares on Windows servers. You still have to open the share to full share-level control to get the Macs operating correctly.
NOTE: Apple says that it fixed this problem in the 10.4.6 update.
December 16, 2005
Dan Ball
Logging in as an Active Directory user and saving to an SMB Windows share on Windows Server 2003 has a bug.When trying to copy a folder with files in it, the folder is created on the file server, but it is empty.
When trying to copy multiple files, only the first one is copied and you get the permission denied error again.
You get a permission denied error: "The operation cannot be completed because you do not have sufficient privileges for some of the items."
The issue isn't a permissions issue, well with Security Permissions anyway. The problem is the Share Level Permissions.
We have our shares setup with the groups that should have access to the shares, but with only Change and Read access, which should be enough access. Works fine with Windows and 10.3 clients.
With 10.4 you have to give the group or everyone Full Control, then everything works as expected. So I think its a bug in Mac OS X10.4.
But that seems to be the problem is the share level permissions on the Windows share.
NOTE: A reader reports that Apple fixed this in the 10.4.8 Update.
February 20, 2006 -- Fernando found that after upgrading a Mac to Mac OS X 10.4.5, he is having problems accessing files on the Mac via SMB from Windows clients. He is using the workstation version of Tiger but is using it as a small server.
His first problem sounds like the problem of Windows clients being locked out of Tiger Server, which we’ve previously reported for earlier versions of Tiger Server:
Although I'm not an expert, I have experienced problems with file sharing from my Mac mini via SMB protocol since Apple's 10.4.5 release. I have a Mac Mini acting as file server via SMB/CIFS protocol.
Keeping my old /etc/smb.conf file unchanged, I'm no longer able to browse these files from external clients (neither Windows nor Linux clients).
With Ethernet, I have checked the negotiation and I can see a NEGOTIATION_REQUEST arriving to the server from the client (either Linux or Windows). Then the server keeps in silence until the client times out with a "protocol negotiation error" message (Linux client).
From the logs in the server I can see the actual version of Samba installed is 3.0.10 (with file /usr/sbin/smbd dated from 01/04/2006).
He also reports seeing the previously reported problem of hundreds of processes running in Tiger Server:
The bigger problem arrives from the fact that each new connection attempt from the clients, leaves a new instance of the SMBD process running on the server (I've been able to count 250 simultaneous instances in my 512 MB Mac mini), leaving the way opened for possible security issues.
I have tried to install a newer version of samba3, but it doesn't work, either. I think the problem is located further into the operating system.
February 23, 2006
Margarita Gonzalez
I would to confirm what Fernando reported about not being able to access Mac files via SMB/CIFS from Windows or Linux station since the upgrade to 10.4.5.
Windows clients are unable to browse the Mac files, although the Mac server does appear in Windows. 10.4.5 does not answer to "smbclient -L" or smbmount requests from Linux client.
10.4.5 does not answer to its own "smbclient -L" requests either.
February 23, 2006
Andrew Kaufman sees the problem with an Intel Mac:
After updating to latest version of Mac OS X 10.4.5, I can no longer access my iMac Intel Duo from a Windows computer over home network. It was previously working fine.
March 9, 2006
Michel Burte
Since the update (done late, but not enough late it seems), I'm unable to access any folder containing over a hundred of files (number is approximative) from XP clients on a 10.4.5 server. All the smaller folders work fine.
It runs smoothly between Macs when using samba. Strangely I don't have this problem when the XP clients connect to a regular 10.4.5 Mac, even if the folder contain several thousands of picts or other folders.
March 20, 2006
Brian Cohen
I am seeing this as well: I cannot connect to Mac mini 10.4.5 from Windows XP.
March 20, 2006
Corey Klass
With regard to "Readers verify problem with Tiger 10.4.5 denying Win client SMB access," I just wanted to report that I've been using the 10.4.5 update and haven't had any problems with accessing my Titanium PowerBook from Windows XP and Windows Server 2003.
10.4.8 Update solves the problem
October 9, 2006
Olivier Marty
Regarding the "Tiger 10.4 denies Win client SMB access" problem, I would like to report that after months of trying to solve this problem (which seemed to appear when upgrading to 10.4.5) the easy way, I decided yesterday to reinstall Mac OS X 10.4 and let it upgrade itself to 10.4.8. This took about one hour, and did not break any application, except that I had to reinstall PalmOne Hotsync Manager. After 8 months of troubles, all is working perfectly again.
March 7, 2006 – Several readers reported problems accessing SMB servers with Mac OS X 10.4.5. Bob Gobeille was trying to access a Linux Samba server:
I can also not connect to a Linux server with the OS X 10.4.5 Finder (or cmd K).
The server’s Samba error log reports:
[2006/03/04 14:48:28, 0] rpc_parse/parse_prs.c:prs_mem_get(537)
prs_mem_get: reading data of size 2 would overrun buffer.
[2006/03/04 14:48:28, 0] rpc_server/srv_pipe.c:api_pipe_bind_req(919)
api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.
Jeffrey Maass sees this on only some of his Macs:
We're having a similar problem in trying to mount Windows shares on OS X 10.4.5, via SMB. The shares mount but appear as being empty. We just bought 3 identical G5 Quads, and this happens on two of them but not the third.
Erik Tittle:
I too am having the same problems with the 10.4.5 update from Apple. I cannot access my shared folders on any of my PC's but I can access the shared folders through SMB on my iMac G3.
Matt Rosenberg has reported it to Apple:
We've had that problem with permissions on Windows shares too. This is mostly definitely a known issue by Apple. I filed a bug report (# 4412392) and it was almost immediately marked a duplicate.
If you’ve seen this problem
June 19, 2006 -- Marek Wawrzyniak saw the problem of slow Mac OS X 10.4 performance with Windows file sharing clients logged on, caused by hundreds of SMBD processes on Tiger. While previous users saw this on Tiger server, Wawrzyniak had the problem on the Tiger client. The fix for the server also worked on the client
Tiger 10.4.6 client (not server) starting in Terminal: smbclient -L localhost -U% and I have 500 smbd processes. The solution from Nouhaud fixed all problems (adding -F parameter).
April 20, 2006 -- Group Logic has released ExtremeZ-IP File Server 4.2.2, an update to the AFP server for Windows hosts, serving Mac clients. The update addresses an incompatibility between Mac OS X 10.4.6 and Adobe Photoshop, according to Group Logic.
User forums at Apple and around the web have been reporting problems with Photoshop and Apple’s 10.4.6 update. Photoshop can crash when a Mac OS X 10.4.6 user tries to save a file from within Photoshop to an AFP server.
Group Logic said that although only Adobe or Apple can only fix the incompatibility, the ExtremeZ-IP 4.2.2 update enables users to prevent the Photoshop crash using a workaround posted at Group Logic’s web site.
NOTE: The Mac OS X 10.4.7 update fixes this problem, according to Apple.
April 20, 2006
Mark van Gaalen:
I also experience problems trying to connect 10.4.6 to a Linux Samba server. The server runs with password encryption = yes. The Finder sees the server, but hangs on browsing the shares.
Command-K works though using smb://server/share
I also experience verrrrry slow logoffs and shutdowns when the connected shares are not disconnected before logoff/shutdown.
April 20, 2006
RC Poirier:
Version 3.0.14a-2 of SMB on Linux is known to fail with some versions of Max OS X 10.4.x.
For example on our net, a MacBook Pro (Intel-Duo) running 10.4.5 connects with no problems; a Power Mac G4 running 10.3.9 connects with no problems; but a Mac G5 Dual (Power PC) running 10.4.6 fails; and the same machine connect ok when running 10.3.9.
A Fix
May 25, 2006
Mark van Gaalen
On April 20 I reported 10.4.6 having problems trying to connect to a Linux Samba server 3.014. I upgraded Samba to 3.022-1 and the problem seems to be solved. Browsing the server shares works.
Caveat: I'm running Samba on Debian Sarge stable. This release uses Samba 3.014a as default. I had to 'trick' the Debian package manager into installing this 'testing' version. Doing this could cause problems with keeping up security updates in the future. Not sure, though.
June 8, 2006
Tony verfied the fix:
Yep, this solved my problem on a company production server.
The Windows clients had no problems mounting SMB after the upgrade I did from woody to sarge, but the Macs wouldn't do it. Installing the "testing" version of samba (3.0.22) solved it for me.
April 18, 2006
Gary in the United Kingdom describes how he fixed his Macs' problems with SMB connections to Windows servers:
I don't know if this is still an issue for many Tiger users, but I've had recent experience of attempting to connect 10.4.6 machines to MS Server 2003 shares.