Mavericks - AD Integration - Shared User Account / Document Folders

[KM-TechServices]

Hello -

 

We are currently in the process of trying to get our 10.7, 10.8, or 10.9 clients bound to AD. We can successfully get them bound to AD, but we're having issues with the user profiles. We need the independent user accounts for correct identification on our Internet filter, but we would like to do some sort of Folder Redirection so all users are forced to save in the same location. For example, when any user logs in, we want it to pull a common Documents folder, rather than make a new documents folder for each user who signs in. Our Apple systems are all in shared environments, so we're not concerned about the security of the data.

 

In 10.6, I experimented with putting symlink'd folders inside of the default profile (the profile is located under /System/Library/User\ Template/English.lproj). For example, I symlink'd the Documents folder to a shared location /users/data/documents. The shared folders obviously had permissions for everyone to be able to access the files located in those folders. It worked in 10.6. I can't seem to get the same setup working on anything newer, however. When you sign in, you just end up with a corrupted profile - the symlinks seem to mess up the copy process. If I remove the symlinks, it works fine.

 

So, basically what I'm looking for is:

1) Is there another alternative to this type of setup? For example, is it possible to simply make every user grab the same user profile on sign-in? I've experimented with loginhooks and LaunchDaemons, without any success.

2) Is there another way to make a shared setup like this work

 

Thank you,

KM-TechServices

[furby]

Is there a particular reason you don't want users to use their (individual) AD home folders?

 

I wonder if a mix of http://www.edugeek.net/forums/mac/72443-how-create-os-x-default-profile-template-bind-ad-10-5-10-8-a.html and changing the home folder location

might do it

[KM-TechServices]

Thanks for the response. As mentioned in the original post, we would like the folders to be shared because the computers are shared.

For an example, let's say User1, User2, User3, and User4 are all part of a group in a classroom.

On day 1, User1 starts a video project for the group. On day 2, User1 is sick and now User2, User3, and User4 have no way to access the project.

With the desired setup, it wouldn't matter because every user can access the same Documents, Videos, and other folders.

 

Right now, it is basically the same setup because every system automatically signs into a shared "macuser" account. We just need to take the setup into the AD world so our Internet filter can identify who signed into a machine.

 

As for the proposed solution of moving the home folder location, that unfortunately isn't exactly what is required. That would allow us to move the entire home folder, but we need to move individual folders inside of the home folder - similar to Folder Redirection on a Windows environment.

 

Thank you.

[furby]

Oh, ok I think I read that as more complicated that it needed to be. Perhaps a simple shared folder that's in everyone's Finder? Doesn't force everyone to save there though.

 

I've gotten people to navigate to the shared folder and then add it to their sidebar "cmd+t". Has to be a folder within the initial share (if that makes sense).

Nothing fancy, will see if I can add the "add to sidebar" to it

 

set MyName to do shell script "whoami"
tell application "Finder"
mount volume "smb://Server/Share" & MyName & ";" & MyName & ":password"
end tell

 

This won't change the default save location. How do you have the home folder location set for the AD/Windows?

Edited March 10, 2014 by furby

[seawolf]

I don't understand why you don't just use a shared network drive for them to save their work. If the reason is that people keep forgetting where to save things (or being too lazy about doing it), then this is a good introduction to the real world of "follow my instructions carefully or you will receive a zero for your assignment". People that can't do that won't hang on to jobs too long, so better to learn this in the safety of a school environment where the consequences aren't so severe (a zero is better than a severed limb or being fired because of failing to listen and do as instructed).

 

What you are wanting to do isn't a good idea anyway because the permissions on that folder would have to be set to allow all users rather than the creator/owner, etc. and I'm sure that not ALL work needs to be accessed by everyone, or is it all project-based work?

[woody]

I don't understand why you don't just use a shared network drive for them to save their work.

 

I'm guessing the reason for not doing this is because storing lots of video to a shared network drive would require:

 

1) A large amount of disk space over time

2) A very fast SAN to cope with the amount of I/O

3) A very fast and possibly dedicated network attaching it all together.

 

It's the same problem for most schools who can't afford a dedicated network and storage solution to making video editing on many Macs work at a reasonable speed.

 

Much easier to use local storage and back this up to a NAS or something on a regular basis.

[seawolf]

I'm guessing the reason for not doing this is because storing lots of video to a shared network drive would require:

 

1) A large amount of disk space over time

2) A very fast SAN to cope with the amount of I/O

3) A very fast and possibly dedicated network attaching it all together.

 

It's the same problem for most schools who can't afford a dedicated network and storage solution to making video editing on many Macs work at a reasonable speed.

 

Much easier to use local storage and back this up to a NAS or something on a regular basis.

 

I guess I misunderstood that the original query was regarding how to redirect to a shared location on the local computer, thought they wanted to do this to a network home.

 

In any case, most of this is achievable using a FreeNAS server with decent drives and a gigabit network. Isolated networks would only be necessary if the school were producing and rendering very large and complex video files.

 

And, if that won't do, then use an external Thunderbolt drive as the storage location.