Lion Server: Workgroup Manager may be unable to create a computer list in Active Directory
An Active Directory server with an extended schema to support managed clients settings on OS X clients may encounter an issue when attempting to create computer lists in Workgroup Manager.
You can use one of these workarounds. You will need to first make changes to the search policy on the Lion system that will be used to modify the computer list, as described in each workaround.
Workaround: Use ADSI Edit to create the computer list
Run the following Terminal command to modify the Active Directory plugin--to disable authentication from all domains in the forest:
dsconfigad-alldomains disable
Open Directory Utility.
Click the Search Policy tab.
Remove the Active Directory entry for "All Domains" (for example, /Active Directory/EXAMPLE/All Domains).
Click the "+" icon and add the Active Directory entry that ends with your domain name (for example, /Active Directory/EXAMPLE/example.com).
Apply the changes.
Use ADSI Edit on the Windows Server to create the computer list.
Use Workgroup Manager on a Lion system to edit the computer list when you need to add computers to the list or manage MCX settings.
Workaround: Use Directory Utility in Lion to create the computer list
Run the following Terminal command to modify the Active Directory plugin--to disable authentication from all domains in the forest:
dsconfigad -alldomains disable
Open Directory Utility.
Click the Search Policy tab.
Remove the Active Directory entry for "All Domains" (for example, /Active Directory/EXAMPLE/All Domains).
Click the plus icon and add the Active Directory entry that ends with your domain name (for example, /Active Directory/EXAMPLE/example.com).
Apply the changes.
Open Directory Utility.
Click the Directory Editor tab.
Select "Computer List" next to "viewing", and the appropriate Active Directory Node next to "in node".
Click the lock and authenticate as a domain administrator or as an account that has delegate permission to create a computer list.
Click the "+"icon to create a new computer list and give it a name.
Save the changes.
Use Workgroup Manager on a Lion system to edit the computer list when you need to add computers to the list or manage MCX settings.
Learn more
In order for Lion clients to receive MCX settings from these computer lists, the Search Policy on the clients must be changed as described above.
