Apple have detailed the fix in http://support.apple.com/kb/HT4100. A fix is also listed at http://www.afp548.com/forum/viewtopic.php?showtopic=26509.

Follow the steps below to force the creation of the Kerberos TGT on initial login. The is taken from the Apple Knowledgebase:-

1. Make a backup copy of the authorization file with this Terminal command:

   sudo cp /etc/authorization /etc/authorization.bak

2. Open the /etc/authorization file in a text editor or plist editing application.
3. Locate this key:

   <key>system.login.console</key>

4. Under mechanisms, add the string:

   <string>builtin:krb5store,privileged</string>

5. Save the file to /etc

Getting back to the upgrade. The aim was to un-install CS3 and then install CS4 with updates silently. After many hours I conceded as it isn’t possible to do all of this. Using the Adobe CS4 deployment guide I was able to un-install CS3 and create a customised CS4 install and do updates silently. However, it all falls apart with Acrobat. Acrobat requires user interaction with administrator access to complete the install. Also, Acrobat updates will not install silently.

There are various works around for update Acrobat, but I couldn’t get any of them to work successfully.  For this project I had to live with this problem.  Basically the command (see below) will always ask for user interaction when updating Acrobat in contrast to what Adobe say in there technote.

PATH - /Acrobat\ 910\ Pro\ Patch.app/Contents/MacOS/Acrobat\ 9\ Pro\ Patch --mode=silent

Moving on, the final part of the install was to remove the old CS3 dock icons and all the CS4 dock icons for all users on each Mac. This was achieved using a great utility called dockutil.

dockutil --add '/Applications/Adobe Acrobat 9 Pro/Acrobat Distiller.app' --allhomes
dockutil --remove 'Adobe Illustrator CS3' --allhomes

The only thing it doesn’t do is update the default dock.

1: Stop SUS

2: Download http://swscan.apple.com/content/meta/mirror-config-1.plist and copy it to /usr/share/swupd/html/content/meta/mirror-config-1.plist

3: Change it to look like this:

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<key>PrimaryCatalog</key>
<string>http://swscan.apple.com/content/catalogs/index.sucatalog</string>
<key>CatalogsList</key>
<array>
<string>http://swscan.apple.com/content/catalogs/index.sucatalog</string>
<string>http://swscan.apple.com/content/catalogs/others/index-leopard.merged-1.sucatalog</string>
<string>http://swscan.apple.com/content/catalogs/others/index-leopard-snowleopard.merged-1.sucatalog</string>
</array>
</dict>
</plist>

4: Edit /etc/swupd/swupd.plist and change the metaIndexURL entry to look like this:

<key>metaIndexURL</key>
<string>http://myserver.com:8088/content/meta/mirror-config-1.plist</string>
<key>portToUse</key>

5: Start SUS and wait for it to download the catalog files and to generate the local versions thereof.

6: Once it has generated the local catalog files add some symlinks like this:

cd /usr/share/swupd/html
ln -s /usr/share/swupd/html/content/catalogs/index.sucatalog .
ln -s /usr/share/swupd/html/content/catalogs/others/index-leopard.merged-1.sucatalog .
ln -s /usr/share/swupd/html/content/catalogs/others/index-leopard-snowleopard.merged-1.sucatalog .

7: Just in case restart SUS

8: Wait for SUS to download all the updates

9: On your 10.6 client go in the Finder to /Library/Preferences and open com.apple.SoftwareUpdate.plist. Change the CatalogURL entry to point to http://myserver.com:8088/index-leopard-snowleopard.merged-1.sucatalog

10: Launch Software Update on your 10.6 client and be happy

It should behave like a 10.6 server now as it is serving the catalog files according to the 10.6 server documentation as described on page 89 here: http://images.apple.com/server/macosx/docs/System_Imaging_and_SW_Update_Admin_v10.6.pdf

The Exchange improvements are well overdue as the current Entourage is a disaster with slow synchronisation, corrupting databases, inability to save custom distribution group, etc… Bringing back Visual Basic for Applications will also resolve the headache of not being able to use macro enabled Excel spreadsheets in a mixed Mac/PC workgroup.

As a network administrator, I welcome this but it may have repercussions. For example, you have a bunch of Quark files without extension names on an SMB share in the AppleDouble format created by a 10.4 client. By default a 10.6 client wouldn’t be able to read the Quark files because it doesn’t read the AppleDouble dot underscore file and there are no extension names. Therefore, Apple have made it easy to re-enable the feature. This is possible be editing the nsmb.conf file.

To disable named streams as a default for your Mac OS X client user account

Execute these two commands in Terminal:

echo "[default]" >>  ~/Library/Preferences/nsmb.conf
echo "streams=no" >> ~/Library/Preferences/nsmb.conf

To disable named streams as a default for all Mac OS X client user accounts on a Mac

Log in to Mac OS X with an admin user account if you aren’t already logged in as an admin, then execute these two commands in Terminal:

echo "[default]" | sudo tee -a /etc/nsmb.conf
echo "streams=no" | sudo tee -a /etc/nsmb.conf

See the man page on nsmb.conf for more details about how to configure it.

To re-enable streams on 10.6 or to enable it on 10.5 change streams=no to streams=yes

Quark Xpress 7 crashes when printing with 10.6 and is generally unstable. Quark doesn’t like printing documents using the binary data format. If prefers using ASCII. See http://forums.quark.com/t/22523.aspx. The best fix for this problem is to change the picture data option to ASCII. You may get the error message: “Page could contain EPS pictures which include binary data. OK to continue?” but it does work and Quark is more stable. However, Quark still crashes randomly so users need to save their work regularly. Unfortunately, the only real solution available for Quark running on 10.6 is to use Quark 8. See http://forums.quark.com/t/21811.aspx.

Canon has only updated a few of their printer drivers to fully work with 10.6. They have updated all of the PPDs, but these only give limited printing functionally. See http://www.canon.co.uk/Operating_System_Drivers/mac_os_compatibility_office.asp. The older 10.5 compatible drivers will install but they won’t work, an error message occurs “The printer software was installed incorrectly. Please reinstall the printer’s software or contact the manufacturer for assistance.”. Using a PPD will work, but there no secure printing option and limited ability for proper tray selection, double printing etc… Fortunately, I discovered a work around for the fiery RIP enabled devices. EFI have released a printer driver update which modifies the CUPS permissions on Mac OS X 10.6.

Microsoft Powerpoint 2008 with SP2 is unusable on 10.6. Typing and keystrokes lag behind about of 5 seconds before appearing on screen. Moving between slides is very slow and Powerpoint often freezes. There currently isn’t any solution for this problem. I’m hoping that the next Microsoft Office update will fix this, or possibly the new Apple update 10.6.3.

The report focuses on various Trojan horse attacks, malware found in Torrent application downloads, attacks on jailbroken iPhones, Mac OS X vulnerabilities and third party vulnerabilities.

The following excerpt is taken from the report: -

Many of these operating system vulnerabilities pave the way for unseen malware attacks. Some of them are such that merely visiting a booby-trapped web page can compromise a Mac. This underscores the importance of security software that protects not only from malware but also from web threats and the many other kinds of menaces that target Macs. It also highlights the need to keep software up-to-date. Both for Mac OS X and for third-party software, users should make sure that they have the latest versions of their software, since some programs—such as Adobe Reader, commonly used to view PDF files—are easy to attack with known exploits circulating in the wild.

The report is available from http://blog.intego.com/2010/01/25/the-year-in-mac-security-2009/

To disable support for ADS for all shares in a cluster, edit the file /etc/mcp/override/smbd.xml and add the following text to the file immediately after any line that begins </add-tag>:

This has to be done via the command line so you will need to SSH into the isilon cluster. Once you have made this change, wait 60 seconds for it to propagate to all nodes in your cluster, then run following command to restart all SMB connections to the cluster, in order to take advantage of this change:

If the change made to the global smbd.xml file doesn’t work, edit the file /etc/mcp/override/smbd_shares.xml and add the following entry <field name=”ignore named streams” value=”yes”></field> into the individual share. See the example below: -

Once again when you have made this change, wait 60 seconds for it to propagate to all nodes in your cluster, then run following command to restart all SMB connections to the cluster, in order to take advantage of this change:

Please DO NOT atempt this if you are not familar with the command line environment.