Student Profile

[215HAN]

Hi,

 

Hoping you can assist.

 

We have about 80+ Macs at our school and have an issue where whenever a student logs in onto 1 machine, saves their work on os desktop and then the following week this same student then decides to use a different machine, his work is not on the desktop but on the actual machine he used the previous week so it does not follow the student regardless of which machine he uses.

 

Is there a simple fix for this so students can use whichever machine they require and their work will follow and not create a fresh profile. They do have their own user area but you do get students who just save on the desktop.

 

Hope this makes sense.

 

Thanks

[215HAN]

It is and you right they should be doing where they have their own user folders but you get the few that save to the desktop and by the off chance say that machine is out of use or not available, then any other machine they log onto, their work is not there and creates a fresh student profile.

[2ilent8cho]

We use AD joined Macs with forced local homes, then use sym links to redirect the documents, desktop, movies, pictures folder to their network home drive. We also have some scripts load using launchd that give the user the desktop config we want after every reboot and settings are all reset. I can try and post them tomorrow if you want.

[215HAN]

That would be great if you can and I can experiment.

 

Thanks

[2ilent8cho]

That would be great if you can and I can experiment.

 

Thanks

 

Its a long post, no idea how skilled you are with OS X/Unix so tried to make it as simple as possible, and i hopefully have not missed anything out.

 

So the general experience this makes is user logs in and gets a defined desktop layout and config by me and the user folders are redirected to their home folder. When the Mac is restarted it deletes all the local user profiles to stop the hard disk getting full, and checks for any changes to the desktop layout and modifies them on the local default user template. User logs in and gets a fresh clean experience again but with user data still there.

 

I made a folder in /System called Scripts. This is where i keep all my scripts.

I also made a local user called profile this is the user i customise how i want for the user experience.

The root account i have enabled for doing most of this in. You can enable it in the Directory Utility under the edit menu (Turn it back off before finishing your Mac image)

 

Each Mac has 'Force local home directory on startupdisk' and 'Use UNC path from Active Directory to derive network home location' ticked

 

This is all done on a fresh image that i will then use deploy studio to deploy. Putting all this manually on lots of Macs would not be a fun job.

 

So first script is the deleting of local user profiles. I called this one delprof.sh . So its /System/Scripts/delprof.sh

 

I nabbed this from https://jamfnation.jamfsoftware.com/discussion.html?id=9522 as it did a better job that my original script

 

#!/bin/shusername1="localadmin"
username2="profile"
username3="student"
username4="temp"
RESULT=""
for U in /Users/*; do 
   if [ -d "$U" ]; then
       if [ "$U" == "/Users/Shared" ] || [ "$U" == "/Users/Guest" ]; then
           /bin/echo "Found $U, ignored"
           USERNAME=`/bin/echo $U | tr '/' ' ' | awk '{print $NF}'`
           RESULT=`echo "$RESULT$USERNAME-IGNORED "`
       else
           /bin/echo "Found $U, continuing..."
           USERNAME=`/bin/echo $U | tr '/' ' ' | awk '{print $NF}'`
           /bin/echo "Parsed username as: $USERNAME"
           ADMINCHECK=`/usr/bin/dsmemberutil checkmembership -U $USERNAME -G admin | awk '{print $3}'`
           if [ "$ADMINCHECK" == "not" ]; then
               if [ "$USERNAME" == "$username1" ] || [ "$USERNAME" == "$username2" ] || [ "$USERNAME" == "$username3" ] || [ "$USERNAME" == "$username4" ]; then
                   /bin/echo "$USERNAME is on the exempt list, ignoring..."
                   RESULT=`echo "$RESULT$USERNAME-EXEMPT "`
               else    
                   /bin/echo "$USERNAME not an Admin nor exempt, taking action..."
                   RESULT=`echo "$RESULT$USERNAME-Action Taken "`
                   /bin/echo "Forcing the removal of $U" && /bin/rm -rf $U
               fi
           else
               /bin/echo "$USERNAME was found to be a Local Admin, ignoring"
               RESULT=`echo "$RESULT$USERNAME-ADMIN "`
           fi
       fi
   fi
done
echo ""
echo "============================================================"
echo "Summary: $RESULT"
echo "============================================================"

 

Need to make this executable so from the terminal chmod +x /System/Scripts/delprof.sh

 

Next we need to make this script launch automatically when the Mac boots so it needs to be a launchd job.

 

So the following is code is saved in /Library/LaunchDaemons/com.delprof.plist

 

Label
com.delprof
ProgramArguments

	sh
	/System/Scripts/delprof.sh

RunAtLoad

 

So thats the tidy process sorted.

 

Next its the customising the default user profile. So if you have made a user account called profile login as it and make all the modifications you want to how all the apps and desktop feels. Then logout and go back in as root . Then go to /Users/Library/Keychains and delete all the files in that folder . THAT BIT IS VERY IMPORTANT.

 

It will be hidden in which case you need to show all files so from terminal type defaults write com.apple.finder AppleShowAllFiles true (press enter) then killall Finder (press enter)

 

On my server called munki i created a share called Templates. I then have a folder for each suite of PCs, i.e. ICT , Music , Technology . Within that folder i have another one for each version of Mac OS we may have i.e. 10.9 or 10.10 . So the profile will end up kept in the example below /ICT/10.9 . You just need to modify the username ,password, server and folder structure to what ever you are going to use.

 

I then use the following script to upload it to one of my servers. I called it updateprof.sh in /System/Scripts and made it executable with chmod +x /System/Scripts/updateprof.sh

 

I then run the following command from terminal sh /System/Scripts/updateprof.sh

 

mkdir /Volumes/Templatesmount -t smbfs smb://username:password@munki/Templates /Volumes/Templates
rsync -a /Users/profile/ /Volumes/Templates/ICT/10.9 --delete-during
umount /Volumes/Templates
rm -rf /Volumes/Templates

 

So that should be the nice profile uploaded to the server.

 

So next we need a script to on boot to sync that network template with the local default user template .

 

So this one i called profsync.sh in /System/Scripts again make it executable so from terminal sh /System/Scripts/profsync.sh

 

sleep 30mkdir /Volumes/Templates
mount -t smbfs smb://username:password@munki/Templates /Volumes/Templates
rsync -a /Volumes/Templates/ICT/10.9/ /System/Library/User\ Template/English.lproj --delete-during
umount /Volumes/Templates
rm -rf /Volumes/Templates

 

It waits 30 seconds to make sure the network is up and connected. Again you need to modify this to match your server and login details. This one is for our IT Suite image hence called ICT, but if it was for the Music suite i would change ICT to Music so i can have a different profile for that room.

 

Next this needs to be told to run at the login screen with launchd so copy the following and save as /Library/LaunchDaemons/com.profsync.plist

 

Label
com.profsync
ProgramArguments

	sh
	/System/Scripts/profsync.sh

RunAtLoad

 

Next is the redirecting of user folders. This one i do slightly differently. I use a program called platypus that makes a script into an app. Platypus | Sveinbjorn Thordarson Then i copy that app to /Applications/Utilities and tell Profile Manager to run the App at user login.

 

The script i make first is this

 

chmod -R -N ~/Documentschmod -R -N ~/Desktop
chmod -R -N ~/Movies
chmod -R -N ~/Music
chmod -R -N ~/Pictures
rm -rf ~/Documents
rm -rf ~/Desktop
rm -rf ~/Movies
rm -rf ~/Music
rm -rf ~/Pictures
mkdir "/Volumes/Homes/$USER/My Documents"
ln -s "/Volumes/Homes/$USER/My Documents" ~/Documents
mkdir "/Volumes/Homes/$USER/Desktop"
ln -s "/Volumes/Homes/$USER/Desktop" ~/Desktop
mkdir "/Volumes/Homes/$USER/My Documents/My Music"
ln -s "/Volumes/Homes/$USER/My Documents/My Music" ~/Music
mkdir "/Volumes/Homes/$USER/My Documents/My Pictures"
ln -s "/Volumes/Homes/$USER/My Documents/My Pictures" ~/Pictures
mkdir "/Volumes/Homes/$USER/My Documents/My Videos"
ln -s "/Volumes/Homes/$USER/My Documents/My Videos" ~/Movies
killall Finder
osascript -e "set Volume 0"

 

The first part changes the permissions (chmod) so the users local folders can be deleted. Next it deletes them (rm -rf) Then for each folder it tries to make the folder just incase its the users first time ever logging in (mkdir). Then it creates the symlink to it (ln -s). After that it kills Finder or the desktop redirection does not work for the user then the final one just mutes the sound on the Mac.

 

You may have to do a bit of tweaking on the user profile redirect with the /Volumes/Homes part as the share is always called Homes for us, we have 1 server per year group so its SMB://UFS-2012/Homes , SMB://UFS-2013/Homes, or SMB://UFS-Staff/Homes . If you have 1 share with sub folders for each year group that script as is won't work.

 

Thats it!

[215HAN]

Fantastic! Thank you so much. I will be giving this a go and let you know outcome.

 

May take a while though but will certainly try and implement and report back results.

[2ilent8cho]

Forgot to say i've not tested this on the latest OS X yet, as we always stay 1 year behind. So i only know it works for sure on 10.9 and 10.10 Edited May 26, 2016 by 2ilent8cho

[abillybob]

There are quite a few apple experts on here that can help ..... im sure @abillybob knows a few who knows.

 

Sorry only just seen this. Pretty much what @2ilent8cho is the method I'd advise though I don't personally bother. Here we just use a mapped Mac Share and make the children save to that. If they save to the desktop they'll loose their work yet they know this so they don't!