OS X network and local homes for Active Directory users

Hi,

Currently I'm in the process of setting up a new ML (10.8.4) Mac Pro to act as an OD server in our College. I have successfully bound it to Active Directory, and any AD user can log in to the test Mac I have also bound. So far so good.

What I want, is for all users to have local home folders on whichever Mac they log in to. This is working. What I also want is to mount a Network home folder located on the Mac server, on user login, so all preferences for software etc will be stored locally, but any files can be saved to a network location and accessed from any Mac.

I have read various set up guides, white papers etc and I have reached a stumbling block. I checked both 'Force local home directory on startup disk' and 'Use UNC path from Active Directory to derive network home location'. The problem comes when defining the home folder in the AD user's profile. I input \\server\share\%username% and when I click 'Apply' I get an error, 'The home folder could not be created because: the request is not supported.' However, if I check on the server, it has actually created the folder. When I click 'Apply' again, I get a message saying the folder already exists, do I want the user to be granted full control. I click 'Yes', BUT, and this is where I'm coming unstuck, when I check the permissions of the folder created, I get access to the folder, and everyone gets no Access. The user of the folder has no rights therefore when I log in as that user to test, it doesn't work. If I manually add rights for that user to the folder, then that works, but this is impractical as I'd have to do this individually for a large number of students.

As an aside, if I use the Attribute Editor in AD to add a homeDirectory and homeDrive, and Apply this, I get no error, but also no user folder created. It doesn't create the folder on login either. This is an issue, as the user creation process is automated, and I intend to get this field updated as part of the creation process for those students who will be using Macs.

Both Domain Admins and Enterprise Admins have administrative rights to the ML Server. I am a Domain Admin. The Users sharepoint has R+W access for System Administrator, Administrators group and Everyone Else. I also tried adding Domain Admins and a local group called MacStudents, that contains an AD group (done in WGM) that the above users are members of.

My next step is to update the AD Schema to include Apple specific attributes and see if I can get it work that way, though I have no guarantee it will work this way either.

If there was a way to query a group, automatically create server based home folders with appropriate user names and grant the proper rights then this would be acceptable, however my scripting ability and knowledge is fairly non-existent.

Any help would be hugely appreciated as I've spent a long time trawling through google and various forums to no avail.

rlkarren - Thanks for your reply.

That does make sense - I've got it to a point now that when I specify the home folder in AD, and check the permissions after creation, there is one unspecified user that has R&W access that just says 'Fetching' for however long I've tried leaving it.

I've given Domain Admins and Users access to the share, as well as local Mac admin, though I've unticked inheritance for Domain Users. I've also enabled File Sharing for Domain Admins and Users (previously it was just for a specific security group in AD)

Somewhere it seems there is almost definitely a permissions error, I just can't pin it down! Anything else you can recall would by much appreciated!

You're right - it doesn't help me! Actually that might be premature, as I have yet to investigate augmented records properly. It does seem like you're trying to do it slightly differently to me. Our current set up has all users hosted on 10.6 with no integration, but the network traffic caused by all the home directories on the server was too much for the server to cope with, and resulted in lots of beachballing. Hence trying to do it with local home directories and auto-mounting individual network homes too - we don't have the storage capacity on the windows side of things for all the graphics intensive work done on the Macs and students will have to learn that if they save to the desktop, that's where it stays. This is how the PCs have been for years, so it's no biggy.

Have you read Apple's white paper on the topic?
http://training.apple.com/pdf/wp_integrating_active_directory_ml.pdf

There might be some pointers in there to help you...

John

Update

Ok, having failed to get this to work, I've decided to resort to resetting permissions on the home folders. Luckily we have a licensed version of Passenger and I've discovered that it's possible to batch process user folder permissions and you can also export a script to do it for you, so this is what I will be doing.

Someone on another forum suggested using ADmitMac or similar 3rd party solution....

Here's what I've got in place now:

AD users (Students) get created automatically.
Those on courses that will use Macs are flagged and details exported to csv.
A powershell script runs to populate the home directory attribute in AD, add the users to a security group and create a user home folder on the Mac server, and a subfolder within that folder.
As it's the start of term, new users are appearing daily, so this process runs daily.
I have a script created in Passenger to correct permissions on the user folders.
I have a plist file that lauches this script daily, after the user creation process, to correct the permissions on the user folders (took a while to get this working!)

On the windows side, using Group Policy folder redirection, the Documents folder is set to redirect to the subfolder within the user folder on the Mac server, created in the above process. This way, the students can access files on Macs and PCs.

The client Macs are bound to AD and OD. They are set to use UNC path from AD via SMB (AFP would be better but I think there are issues to do with passwords not being sent in plain text, so authentication fails) and also to force local home folder on startup disk. The user folder then mounts in the dock, although it isn't a default file location for saving unfortunately, which would be useful.

It's long winded, but it works, and fortunately I have access to people with scripting skills!

John