Magic triangle with mavericks destroying windows permissions?

[stoney101]

OK, So I am attempting to upgrade our mountain lion imacs to mavericks over the summer holidays. I have run into an issue, after upgrading and re installing mavericks (10.9.4) onto one of the imacs joining it up to AD and OD all seems to be going fine however once I log in with an AD users profile a message pops up immediately saying 'mac os x needs to repair library to run applications' and asks for admin credentials, even after putting in the requested information the message will pop up again after around 30 seconds and will not go away no matter how many times I enter the admin details. I have also noticed that as soon as an AD user logs into this mac they will no longer be able to access their documents back on a windows PC, not even a domain admin can access their documents without first resetting the permissions, luckily I was only logging in using a test account so it didn't cause any damage. Does anyone know if there is any known fix or workaround for this?

[3s-gtech]

This is a known bug with Mavericks connecting to Windows shares - we have completely avoided 10.9 on client machines as a result! There was a thread on here about it quite recently.

 

http://www.edugeek.net/forums/mac/138852-mavericks-permissions.html

Edited August 5, 2014 by 3s-gtech

[Brimstone]

OK, So I am attempting to upgrade our mountain lion imacs to mavericks over the summer holidays. I have run into an issue, after upgrading and re installing mavericks (10.9.4) onto one of the imacs joining it up to AD and OD all seems to be going fine however once I log in with an AD users profile a message pops up immediately saying 'mac os x needs to repair library to run applications' and asks for admin credentials, even after putting in the requested information the message will pop up again after around 30 seconds and will not go away no matter how many times I enter the admin details. I have also noticed that as soon as an AD user logs into this mac they will no longer be able to access their documents back on a windows PC, not even a domain admin can access their documents without first resetting the permissions, luckily I was only logging in using a test account so it didn't cause any damage. Does anyone know if there is any known fix or workaround for this?

 

This is major known issue with Mavericks and Macs bound to AD, permissions are essentially broken, my only advice would be to look at the following solution to use some software on your Windows Server that enables AFP rather than SMB see below...

 

Mac Windows File Sharing - Connect Mac to Windows Server - GroupLogic

 

Apple discussions have loads of posts on the issue..

 

https://discussions.apple.com/search.jspa?q=smb+mavericks*&resultTypes=message&showOnlyAnswered=true

[stoney101]

OK Thanks guys I was hoping that since we are on 10.9.4 they may have got their act together and fixed it by now. Oh well I guess we won't be upgrading to mavericks anytime soon.

[Marci]

Try mounting using cifs:// instead of smb://

[slancaster]

Force SMB 1 on mac clients and it seems ok.

We had this problem with 10.9 and Samba 2 - permissions went mental!

 

From Macworld.com

 

---

There's also a possibility to change all connections to use SMB1 system-wide (for all users) by entering this command in Terminal:

 

sudo sh -c "echo '[default]' >> /etc/nsmb.conf; echo 'smb_neg=smb1_only' >> /etc/nsmb.conf"

 

 

To restore the default SMB2 you simply need to delete the newly created configuration file (nsmb.conf) with the command:

 

sudo rm /etc/nsmb.conf

 

---

[HodgeHi]

Just bear in mind that CIFS / SMB1 was notoriously slow when navigating SMB shares. SMB 2 and 3 are better at browsing but also introduce the issue that you are seeing.

[slancaster]

yeah we had to take a performance hit to fix the corrupt files bug. Do we know if SMB2 / 3 is ok now on 10.9 and 10.10 machines?

[Wolverine-911]

We are running Windows 8.1 and Mavericks 10.9.5 side-by-side now without issues using SMB. We had a very similar issue, every time a user logged onto an iMac it would give them a permission in Windows for "Everyone" set to deny, so users could not access their own desktop and we couldn't even edit it without powershell. We noticed the issue occurred as soon as the Library & Spotlight folders were created during logon on the iMac.

 

To fix it we just ticked "Force local home directory on startup disk" when binding to AD and now users can log on without this permission being set.

[slancaster]

Thanks for the reply Wolverine, in our establishment however ticking the local home directory box would cause more issues as we mount network homes at login.

Currently we are using SMB 1, 10.9.5 clients and a Windows AD and things seem ok with acceptable speeds.

I'd like to enable SMB 2 / 3 but I'm a bit scared of the Library folders going crazy again!

[Wolverine-911]

I don't really understand how the home mapping works properly so please forgive me if this sounds ridiculous but the only difference we noticed by ticking that option was that instead of all files appearing on the desktop of the Mac, they appeared in a folder accessible in the dock that can then open in finder. Everything was still accessible and worked as before, just without the permission issue.

[slancaster]

From my understanding, if "force local home directory" is ticked, this means any files saved to this area will only be saved locally to that Mac, so when they move machine, their files will not move with them. This is a problem if personal user areas are mapped on login.

[Wolverine-911]

Ah, yes that's correct. Thankfully we hadn't rolled that out site wide yet!

 

In that case I've tried to help you and you've ended up helping me!

[slancaster]

no problemo!

The local account tick box can be handy for 1:1 Mac books to act a bit like a roaming profile, but we just map network shares or auto map home drives on login for domain users.

[ass17]

10.10 suppose to have fixed this issue of permissions. Not noticed an issue as yet