Macs drive mapping

[fil_b]

We are changing how the macs are binding to the windows system.

 

we are using the built in apple features

 

can we map windows drives (home directories) and/or shared drives for a user when they log in

 

we are having issue with the mapping atm but the logging in is working.

 

tar

 

 

feebs

[sted]

ive written a script compiled it as an executable and placed it in applications and set it so when any user logs in it runs

 

set MyName to do shell script "whoami"
tell application "Finder"
try
mount volume "smb://server.school.local/" & MyName & "$"
do shell script "ln -s /Volumes/" & MyName & "$ ~/Desktop"
end try
try
mount volume "smb://server.school.local/" & "resources$"
do shell script "ln -s /Volumes/" & "resources$" & " ~/Desktop"
end try
try
mount volume "smb://server.school.local/" & "multimedia$"
do shell script "ln -s /Volumes/" & "resources$" & " ~/Desktop"
end try
end tell 

[tommccann]

Networking Windows with Mac OS X - Mac Guides

 

Helped me out with the new mac installs

[ceebster]

Hi Sted

 

Quick question - do you use the macs with your windows AD?

 

If so, doyou mount their windows home drive into the Mac?

 

Thanks

 

 

Chris

[sted]

Hi Sted

 

Quick question - do you use the macs with your windows AD?

 

If so, do you mount their windows home drive into the Mac?

 

Thanks

 

 

Chris

 

yup 2003 r2 ad domain (no mac servers)

 

yup their homedrive maps to their ad specified user area i just use the script to add it as a desktop icon as well as the dock bar. Id like to get it using their network space as default on the mac but so far have not gotten that working but atm im still really testing the system the school in question have 4 imacs and have dished out 3 of them for teachers/pupils to test and give feedback

[ceebster]

Hi Sted

 

I do have an X serv, and i am able to login to our macs with windows credential, and it works. I need to modify some permissions on the \\%nameofserver%\studentshome\year2009 folder structure to allow the mac to see their home drive and sync correctly.

 

What permssions to you have on your windows side for the students.

 

we have worked out we need to add the local users group with special access on List and read files only

 

 

Curious

 

 

Thanks

 

 

Chris

[sted]

i gave up using \\server\users$\2009\username home areas as i couldnt get it to work and converted them to \\server\username$ shares

 

permissions wise kids have modify (or full control depends when the account was created) to their own area and nowt to the rest of the users$ share

[ceebster]

i assume your students access their shares from the windows side? when on the macs?

[DMcCoy]

i gave up using \\server\users$\2009\username home areas as i couldnt get it to work and converted them to \\server\username$ shares

 

permissions wise kids have modify (or full control depends when the account was created) to their own area and nowt to the rest of the users$ share

 

I have found OS X won't map to a sub folder for user homes.

 

\\server\share\folder works

\\server\share\sub\folder does not.

 

In the end I had to redo my entire windows side to accommodate the macs (setting up a share per year group where it was a single share before). I do however modify the hosts file on the mac clients so that while they map to the same path as windows, the folder is actually on a completely different server (so as not to get all those messy mac files in their home folders on windows). That and I also use afp on the mac file server.

[fil_b]

I have found OS X won't map to a sub folder for user homes.

 

\\server\share\folder works

\\server\share\sub\folder does not.

 

In the end I had to redo my entire windows side to accommodate the macs (setting up a share per year group where it was a single share before). I do however modify the hosts file on the mac clients so that while they map to the same path as windows, the folder is actually on a completely different server (so as not to get all those messy mac files in their home folders on windows). That and I also use afp on the mac file server.

 

so for example

 

\\server\share\folder works would this be \\server\share\%username%

 

\\server\share\sub\folder does not. is \\server\students\year2009\%username%

 

are all the students home directories in the one folder?? how much pain was it moving all these?? and did you modify any permissions when you did move them??

 

thanks

 

Feebs

[DMcCoy]

so for example

 

\\server\share\folder works would this be \\server\share\%username%

 

\\server\share\sub\folder does not. is \\server\students\year2009\%username%

 

are all the students home directories in the one folder?? how much pain was it moving all these?? and did you modify any permissions when you did move them??

 

thanks

 

Feebs

 

User folders are still divided by year group. That is the same setup we had. Now I have a share per year group.

 

d:\users\students\09\%username%

 

Everything stayed where it was, along with permissions staying the same. All I did was add new shares for each year group (09 etc). I did have to change the home folder path to reflect this but that's all. You will need read (this folder only) on the share root (09) for users, but access based enumeration will continue to hide the other folders.

 

So it's not too bad here, changing from 3 shares (staff, student, admin) to a few more (staff, admin, year groups) and then updating the user home drive path in bulk.

[ceebster]

which one is your share - 09?

 

or students?

 

 

Chris

[DMcCoy]

which one is your share - 09?

 

or students?

 

 

Chris

 

09, it was students before the Macs.

[ceebster]

and just to confirm you kept the same permmissions on the users folders but just had to change the profile path in AD?

 

Sorry for lots of questions - doing our head in here

 

 

Cheers

 

 

Chris

[DMcCoy]

and just to confirm you kept the same permmissions on the users folders but just had to change the profile path in AD?

 

Sorry for lots of questions - doing our head in here

 

 

Cheers

 

 

Chris

 

Yes permissions remained the same, as long as users have read (this folder only) on the (new year specific) share root to traverse to their folder it should work. I already had this in place on each folder anyway as while you don't need it on windows to map the folder it can break things like office when it starts are the root of the share.

 

Should anyone be using MS office on Mac there are other folders that need to be created to allow it to save and overwrite files. I can provide these details if anyone needs them

[fil_b]

Yes permissions remained the same, as long as users have read (this folder only) on the (new year specific) share root to traverse to their folder it should work. I already had this in place on each folder anyway as while you don't need it on windows to map the folder it can break things like office when it starts are the root of the share.

 

Should anyone be using MS office on Mac there are other folders that need to be created to allow it to save and overwrite files. I can provide these details if anyone needs them

 

Yes permissions remained the same, as long as users have read (this folder only) Which folder, the users home folder? or something else?

 

on the (new year specific) share root to traverse to their folder it should work. is this where the share for the students year is?? ie \year9\

 

we just want to clear up what this means

 

thanks

[DMcCoy]

Yes permissions remained the same, as long as users have read (this folder only) Which folder, the users home folder? or something else?

 

on the (new year specific) share root to traverse to their folder it should work. is this where the share for the students year is?? ie \year9\

 

we just want to clear up what this means

 

thanks

 

Yes, the Year9 folder. Students will already have correct permissions on their home folder. If they can already see the Year 9 folder from windows then you won't need to do anything.

[sted]

i just gave in and went to \\server\%username% shares as its quick to change in ad (about 1 min per year) and wrote a quick and dirty script that shaed the individual folders again couple of mins per year

 

using command prompt on the server with your user shares go to a year group say 2008 type

dir /b>users.txt

 

then edit the following batch file and run from the 2008 folder

 

for /f %%u in (users.txt) do net share %%u$="d:\users\2008\%%u" /grant:everyone,full /cache:none

 

works on 03/08 doubt it on 2000

[sted]

tested win 2003 r2 and osx 10.5.8

 

download the zip file below

 

http://www.stedscarpics.net/files/apple%20schema.zip

(bear in mind this has non necessary data as it was made for me so contains all the steps i used to get the final version and the pdf detailing how)

 

extract the osx schema add.ldif to servers c drive and rename osx.ldif

 

open up a command prompt and navigate to c: and enter the following (exactly as below except changing DC=school,DC=local to the appropriate domain name (it goes through the file and changes all dc=x to dc=school.local when the command is run))

 

Code:

 

ldifde /j . /k /i /f osx.ldif /v /c “DC=X” “DC=school,DC=local”

 

 

that adds the necessary info to the ad schema to support managing apples

 

next you need to add the schema management mmc (if its not already there run)

 

Code:

 

regsvr32 shhmmgmt.dll

 

 

check for various attributes called apple-whatever

 

while in there find the mac address attribute double click it and select index this attribute. close the mmc down

 

Open up gpmc and edit the default domain policy. computer config-windows settings-security settings-account policies-passwords policies and set Store passwords using reversible encryption to enabled

 

thats it on the pc side of things everything else is mac based.

 

set up a mac and install all the software on it you want (so remote desktop, smartboard, open office, scratch etc)

 

now you need a few admin/cloning programs

server admin tools from apple (run system update after installing this to get the most up to date version)

carbon copy cloner (ccc for short)Carbon Copy Cloner - Home allows you to clone one mac to another (images are NOT hardware dependant so one image works on macbooks imacs mini macs etc)

if you want to clone bootcamp then you need winclone Download Winclone 2.2 - Easily backup and restore a bootable Windows partition on Mac OS X - Softpedia and some other small file it will ask for when you run it and link to the download

 

(i will cover winclone later when ive finished testing it)

 

ccc after you are happy with your mac and before you domain it you want to clone it. Now you can dump an image to a network drive (usually 10-20gb) but you cant restore from one needs to be a mac formatted drive (fat32 might work). The software is fairly obvious what you want to do is clone macintosh hdd to a read only image file.

 

once the mac is cloned its time to network it. First make sure the clock is the same on both as its quite fussy. Then go to accounts in system preferences and logon options and set it to type username and password and untick autologon . Now go to sharing and give the pc its mac name this wants to be different to the windows name (i usually call the mac name mac001 and pc name mac01). Now load finder and go to utilities directory utility click the show advanced settings button go to services (if the padlock is closed click it and insert password). Double click active directory click the administrative tab and tick allow administration by. There should be a box that says enterprise admins/domain admins add any other admin users you need so teachers etc. in active directory domain fill in domain name and click bind. Fill in username / password for domain. Click the ok box then lock the padlock. if you go back to the directory servers tab your domain should now be listed and have a green light. You can now log on as whoever you choose but unless the users have $ shares their userareas wont work and atm no setting are applied.

 

you should of installed workgroup manager now and be a part of the domain if not do that.

 

log on as a domain admin and load finder and go to applications then server. Drag workgroup manager to the dock bar then load it. When it pops up about authentication ignore that and go to the top bar and server view directories. it will complain that "you are working with a local configuration database . . . " tick the do not show again box and ok. In the top right hand corner is a padlock, click this and fill in domain credentials at the top of the window is should now say authenticated as username to directory: /active directory/all domains. Now in the left window select the user group icon (looks like 3 people) then select staff or pupils (it helps a lot if you create a pupil group that contains 2003/4/5...... unless you need to manage them individually) then at the very top click preferences. The right hand pane will now show the options you can change. So for instance go into system preferences select manage always and lock them out of the system preferences by clicking show none (which dosent actually show no options but when they log in greys them out) cllick done then save. Now just go through the other options restricting the dock bar etc and making sure to set the proxy settings for EVERY protocol as there is no blanket setting.

 

most of the workgroup manager setting are fairly obvious so its just ba matter of playing till you get it how you want it. and im still not 100% happy with my setup but im waiting for feedback and at least the system is now usable.

 

notes (i posted this elsewhere on a private forum so language is a bit slack in places sorry)

i haven't tried this on 08 but i see no reason why it shouldnt work but if anyone uses the ldif file DONT DO IT ON A LIVE ENVIRONMENT first try it on a vm/testrig, As mentioned im still leasring the mac biy myself at the end of the day im a pc man (and windows at that) i can get by in osx/linux environments but they arnt my forte so again if you follow these instructions and it all goes wrong (its not happened to me on the 3vms/test systems and 2 live systems ive tried it on but never say never) on your own head be it

[ceebster]

Yes, the Year9 folder. Students will already have correct permissions on their home folder. If they can already see the Year 9 folder from windows then you won't need to do anything.

 

sorry to ask - which permmsions will your users have and the share?

[KilpatrickG]

This script works great for me in terms of mapping drives. I was even able to map down to subdirectories (running Mavericks). I can access the shared subdirectory from Finder > Computer. The challenge I'm having is the alias created on the desktop is broken for the volume mapped to a subdirectory in the share:

 

ell application "Finder"

try

mount volume "SMB://chico.vanguard.vashonsd.org" & "/" & "staff" & "/" & loggedInUser & "/"

do shell script "ln -s /Volumes/" & "home" & " ~/Desktop" ---- this is not successful in creating the alias --> error number -10004

end try

try

mount volume "smb://flab-server/pickup/"

do shell script "ln -s /Volumes/" & "Pickup" & " ~/Desktop"

end try

end tell

 

The icon created for the Pickup share is the shared drive icon. I get just a blank page icon for the other share. Any ideas?