Apple have detailed the fix in http://support.apple.com/kb/HT4100. A fix is also listed at http://www.afp548.com/forum/viewtopic.php?showtopic=26509.

Follow the steps below to force the creation of the Kerberos TGT on initial login. The is taken from the Apple Knowledgebase:-

1. Make a backup copy of the authorization file with this Terminal command:

   sudo cp /etc/authorization /etc/authorization.bak

2. Open the /etc/authorization file in a text editor or plist editing application.
3. Locate this key:

   <key>system.login.console</key>

4. Under mechanisms, add the string:

   <string>builtin:krb5store,privileged</string>

5. Save the file to /etc

Basically, I needed it to allow Active Directory domain users to logon via the Podcast Producer website or logon directly to Mac OS X Server running the Podcast Composer.

The following steps are taken from http://podcastproducer.org/article.php/20100429001851465.

Step 1 - Install your Mac OS X 10.6 Server for the install DVD
Setup your IP and use your active directory domain as your search base, i.e myorganization.org.
DO NOT setup either a bind to Active Directory  or to setup Open Directory as a master server.
Click custom setup and uncheck binding to Active Directory  or setting up an Open Directory master server. Instead, just select “Manually Setup Users and Groups”. Finally, run Software Update and apply all available patches.

Step 2 - Make sure you have the DNS record is correct by running

sudo changeip -checkhostname 

You should see something similar to the following:

podcast (192.168.1.2)

Primary address = 192.168.1.2

Current HostName = podcast.myorganization.org

DNS HostName = podcast.myorganization.org

The names match. There is nothing to change.
dirserv:success = "success"

Fix any errors before proceeding.

Step 3 - Bind to AD.
Next, in the Terminal run following command to enable sign-sign on.

sudo dsconfigad -enablesso

Next, run the command to allows clear text authentication to Active Directory . This is done because of a limitation in the authentication of Podcast Producer 2 to Active Directory (It’s a good idea to login to the server with your an Active Directory account)

serveradmin settings teams:enableClearTextAuth = yes

Step 4 - Enable the require server services.
You will need NFS, Open Directory, Podcast Producer 2 and XGrid.

Step 5 - Setup Open Directory.
Set it up as a Open Directory master while connected to Active Directory
Set your LDAP admin name to be the same as your local Admin account.
The LDAP search base is the AD record of the machine i.e. – dc=podcast,dc=myorganization, dc=edu
Once setup, ensure that Kerberos is not running. It shouldn’t be running because it is using Active Directory Kerberos realm.

Step 6 - Setup NFS
Share Library/PodcastProducer - (This directory does not exist until you click on the podcast producer service, then click configure. Doing this will create the directory. Do not do anything more than merely start the config process to invoke the creation of the directory)
- Hit share
- Enable Automount
- Use LDAP domain
- Share over NFS
- Map to Shared Library folder (use the LDAP admin account to bind)
- Protocol options – Make sure afp, smb and ftp are off.
- NFS on: Select Export this item to a virtual interface/NIC
- Export to a particular subnet that what to have access.
- Map root to root
Start NFS

Step 7 - Configure XGrid
Run setup assistant
Host a grid
Bind with an AD account. This should be a regular domain account with no special privileges.

Step 8 - Setup the Podcast Producer service.
DO NOT click Configure Podcast Producer . Instead, click on Settings and change Podcast Library to /Library/PodcastProducer/Shared
Use the Standard Domain user as the Xgrid username. This should be the same as the one used in the XGrid section of this document.
Change Admin shortname to the short name of your admin account
Start the Podcast Producer Service

Trouble Shooting - Podcast Producer 2 is highly dependent on XGrid. XGrid seems to be the Achilles Heel of Podcast Producer. If you are submitting jobs successfully and find that that XGrid is failing, you can try deleting the following file and then restarting the Podcast Producer server.

/var/pcast/serve/krb_cc

Getting back to the upgrade. The aim was to un-install CS3 and then install CS4 with updates silently. After many hours I conceded as it isn’t possible to do all of this. Using the Adobe CS4 deployment guide I was able to un-install CS3 and create a customised CS4 install and do updates silently. However, it all falls apart with Acrobat. Acrobat requires user interaction with administrator access to complete the install. Also, Acrobat updates will not install silently.

There are various works around for update Acrobat, but I couldn’t get any of them to work successfully.  For this project I had to live with this problem.  Basically the command (see below) will always ask for user interaction when updating Acrobat in contrast to what Adobe say in there technote.

PATH - /Acrobat\ 910\ Pro\ Patch.app/Contents/MacOS/Acrobat\ 9\ Pro\ Patch --mode=silent

Moving on, the final part of the install was to remove the old CS3 dock icons and all the CS4 dock icons for all users on each Mac. This was achieved using a great utility called dockutil.

dockutil --add '/Applications/Adobe Acrobat 9 Pro/Acrobat Distiller.app' --allhomes
dockutil --remove 'Adobe Illustrator CS3' --allhomes

The only thing it doesn’t do is update the default dock.

1: Stop SUS

2: Download http://swscan.apple.com/content/meta/mirror-config-1.plist and copy it to /usr/share/swupd/html/content/meta/mirror-config-1.plist

3: Change it to look like this:

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<key>PrimaryCatalog</key>
<string>http://swscan.apple.com/content/catalogs/index.sucatalog</string>
<key>CatalogsList</key>
<array>
<string>http://swscan.apple.com/content/catalogs/index.sucatalog</string>
<string>http://swscan.apple.com/content/catalogs/others/index-leopard.merged-1.sucatalog</string>
<string>http://swscan.apple.com/content/catalogs/others/index-leopard-snowleopard.merged-1.sucatalog</string>
</array>
</dict>
</plist>

4: Edit /etc/swupd/swupd.plist and change the metaIndexURL entry to look like this:

<key>metaIndexURL</key>
<string>http://myserver.com:8088/content/meta/mirror-config-1.plist</string>
<key>portToUse</key>

5: Start SUS and wait for it to download the catalog files and to generate the local versions thereof.

6: Once it has generated the local catalog files add some symlinks like this:

cd /usr/share/swupd/html
ln -s /usr/share/swupd/html/content/catalogs/index.sucatalog .
ln -s /usr/share/swupd/html/content/catalogs/others/index-leopard.merged-1.sucatalog .
ln -s /usr/share/swupd/html/content/catalogs/others/index-leopard-snowleopard.merged-1.sucatalog .

7: Just in case restart SUS

8: Wait for SUS to download all the updates

9: On your 10.6 client go in the Finder to /Library/Preferences and open com.apple.SoftwareUpdate.plist. Change the CatalogURL entry to point to http://myserver.com:8088/index-leopard-snowleopard.merged-1.sucatalog

10: Launch Software Update on your 10.6 client and be happy

It should behave like a 10.6 server now as it is serving the catalog files according to the 10.6 server documentation as described on page 89 here: http://images.apple.com/server/macosx/docs/System_Imaging_and_SW_Update_Admin_v10.6.pdf

The Exchange improvements are well overdue as the current Entourage is a disaster with slow synchronisation, corrupting databases, inability to save custom distribution group, etc… Bringing back Visual Basic for Applications will also resolve the headache of not being able to use macro enabled Excel spreadsheets in a mixed Mac/PC workgroup.

As a network administrator, I welcome this but it may have repercussions. For example, you have a bunch of Quark files without extension names on an SMB share in the AppleDouble format created by a 10.4 client. By default a 10.6 client wouldn’t be able to read the Quark files because it doesn’t read the AppleDouble dot underscore file and there are no extension names. Therefore, Apple have made it easy to re-enable the feature. This is possible be editing the nsmb.conf file.

To disable named streams as a default for your Mac OS X client user account

Execute these two commands in Terminal:

echo "[default]" >>  ~/Library/Preferences/nsmb.conf
echo "streams=no" >> ~/Library/Preferences/nsmb.conf

To disable named streams as a default for all Mac OS X client user accounts on a Mac

Log in to Mac OS X with an admin user account if you aren’t already logged in as an admin, then execute these two commands in Terminal:

echo "[default]" | sudo tee -a /etc/nsmb.conf
echo "streams=no" | sudo tee -a /etc/nsmb.conf

See the man page on nsmb.conf for more details about how to configure it.

To re-enable streams on 10.6 or to enable it on 10.5 change streams=no to streams=yes

Quark Xpress 7 crashes when printing with 10.6 and is generally unstable. Quark doesn’t like printing documents using the binary data format. If prefers using ASCII. See http://forums.quark.com/t/22523.aspx. The best fix for this problem is to change the picture data option to ASCII. You may get the error message: “Page could contain EPS pictures which include binary data. OK to continue?” but it does work and Quark is more stable. However, Quark still crashes randomly so users need to save their work regularly. Unfortunately, the only real solution available for Quark running on 10.6 is to use Quark 8. See http://forums.quark.com/t/21811.aspx.

Canon has only updated a few of their printer drivers to fully work with 10.6. They have updated all of the PPDs, but these only give limited printing functionally. See http://www.canon.co.uk/Operating_System_Drivers/mac_os_compatibility_office.asp. The older 10.5 compatible drivers will install but they won’t work, an error message occurs “The printer software was installed incorrectly. Please reinstall the printer’s software or contact the manufacturer for assistance.”. Using a PPD will work, but there no secure printing option and limited ability for proper tray selection, double printing etc… Fortunately, I discovered a work around for the fiery RIP enabled devices. EFI have released a printer driver update which modifies the CUPS permissions on Mac OS X 10.6.

Microsoft Powerpoint 2008 with SP2 is unusable on 10.6. Typing and keystrokes lag behind about of 5 seconds before appearing on screen. Moving between slides is very slow and Powerpoint often freezes. There currently isn’t any solution for this problem. I’m hoping that the next Microsoft Office update will fix this, or possibly the new Apple update 10.6.3.