Mountain Lion 10.8.2 performance issues within windows networked environment

[Dharma_Dork]

Hi Everyone,

 

I work in a school that is predominantly in a windows environment. However we do have 2 media classrooms that have imacs in them. These macs are bound to the schools AD server so that the pupils can log in with their own windows profiles. We've recently upgraded these macs to mountain lion and are experiencing some issues.

 

Here are some of the issues we're facing:

 

 

• There's often trouble with the accounts authenticating at log on.
  
• If users do manage to get past the authentication stage, the log on process takes at least five minutes to complete.
  
• When users are logged in performance in general is very poor.
  
• Applications (especially office 2011) take an age to open.
  

 

As you can understand in an hour long lesson this is very frustrating for both the teachers and the students, as half the lesson is spent just getting logged in and getting work open. It becomes even more frustrating when we throw user error into the equation. For example one student typed his password incorrectly, he knew he had, but he had to wait for the authentication process to complete and throw up the incorrect password "shake". It's become that bad that I'm now having to attend each lesson that the macs are in use just to try and prevent and troubleshoot some of the issues.

 

We have a small classroom with 8 older generation white imacs running Snow Leopard, and have had no problems at all with their integration to a windows network. I'm seriously considering a roll back to snow leopard at the minute, just for the students sake. This is obviously quite a drastic step backwards, and my line manager will need some convincing!

 

So I just wanted to see if there was anyone else having the same problems, or if anyone can recommend some actions to take.

 

Thanks in advance for any help you can give. its greatly appreciated!

 

Dharma_Dork

[Sean-OC04]

First question would be;

 

Does your internal domain end in .local?

[Dharma_Dork]

Thanks for the reply, we're on a .pri domain.

[Sean-OC04]

..and the server is running ML ?

[marekbrad]

Hi I recently went on a mountain lion server course. The upshot is that in Mountain lion the whole AD / Profile /My DOcuments Sync is not really recommended. The instructor (keeping tying to a minimum) basically said that the best way was to happliy have users authenticate to AD but to make sure they had a local mac profile and then at the end of a lesson they uploaded their work back to a share (ie mount their windows homedrive if you have to) The preferred option is to almost keep mac and windows networks separate and create users storage on a mac server, but again do not have profiles copying back and forth.

[truebluesteve]

Hi I recently went on a mountain lion server course. The upshot is that in Mountain lion the whole AD / Profile /My DOcuments Sync is not really recommended. The instructor (keeping tying to a minimum) basically said that the best way was to happliy have users authenticate to AD but to make sure they had a local mac profile and then at the end of a lesson they uploaded their work back to a share (ie mount their windows homedrive if you have to) The preferred option is to almost keep mac and windows networks separate and create users storage on a mac server, but again do not have profiles copying back and forth.

 

We've had similar issues and have resorted to the above. Looking on Mac forums and it seems the issues are very well known. For some reason the Macs will randomly refuse to authenticate users against AD even though if you looked in the directory services it shows the connection to the DC being fine. If we remove the AD server from the services, leave it a while and then add it back, it all works again. A right PITA

 

Given the cost of a new iMac against a PC I won't be replacing them unless there is an overwhelming academic need - not, "they use them in the graphics and art industries". What they mean is they use Photoshop and Premier on Macs, but of course the software works equally as well on PCs!

 

Ps for the record I have an iMac at home!

[seawolf]

I have not experienced performance issues with 10.8.2 on a Windows network, either with logins, file share access, or printing. We have had no issues with the in-built AD bindings (e.g. We are not using any 3rd party solutions that would mitigate these sort of issues you're seeing).

 

Just so you know how we are setup - Our AD and file servers are running Windows Server 2008 R2 SP1 and we have HP ProCurve Gigabit switches throughout with 12 buildings connected with a mix of fibre and CAT6. We have 170 Macs, 135 PCs and around 150 iPads and iPhones on the network. We use a non .local domain (we previously had a .local domain and DID experience the issues you refer to). We also map the Windows 7 and 10.8 user accounts to the same network home. We modified the Win7 folder redirection to match the folder names used by OSX as our users may log onto a Mac in one class and a PC the next(works perfectly).

 

That's our setup, so what are the results?

 

1. Average login times are under 10 seconds after initial account creation (upto ne minute for initial creation of user account). This s better than the Win7 clients on average.

 

2. We see fewer problems with PHD once setup (sync errors) than in 10.6. However, we did have some initial problems getting the managed settings for mobile sync to take. Sync is also faster than before.

 

3.File,sharing services over SMB are quick and work well. However we do use ExtremeZ-IP to provide AFP and Windows print services, so use of SMB was limited to testing and not everyday use under load.

 

My point is that I think something else is going on in your environment, possibly DNS issues. If you were using a .local domain I would definitely peg the blame on that. But you aren't, so the next place I would look is DNS. I would also look at the logs (console) to see what is happening during these failed logins or long login delays - you should find some answers there.