Macs into Active Directory home folder denied access

[alfatec]

Hi, Looking for a bit of advice with the wonderful Mac Golden triangle. Am trying to integrate our Macs into Active Directory. Have done all the things

that are recommended: i.e. Joined the Mac into Active Directory with Directory Utility. Put a tick in advanced settings for 'Force local home directory

on startup disk' and 'Use UNC path from Active Directory to derive network home location' etc but when you login I keep getting 'There was a problem

connecting to the server 'file-server', You do not have permission to access this server'.

Anybody got any advice or ideas would be much appreciated.

[AntonioRocco]

Sounds like you have a policy/ACL denying access to parent containers? You must allow at least read/list/traverse rights to containers (folders/shares) containing home folders.

 

However this may cause you a problem if you've not configured your AD home structure in a logical and locked down way? For example by doing the above you may inadvertently give a student access to every other students home folder contents when they log in. Usually if things have been configured with macs in mind all that should happen is students simply 'see' ever other students home folder but not the contents of that folder.

 

I would test this first so you don't inadvertently provide students with a free for all access to everything else. If this does happen I would re-think your structure, policies and ACLs so these things don't happen.

 

Antonio Rocco (ACSA)

[alfatec]

Hi,

Thanks for that. So if my students home folders are mapped to \\file-server\students\studentname do I need to allow all year groups read/list etc access at the students level and not

on the individual folder level?

[AntonioRocco]

The share is "students" and individual student home folders would all be floating loose inside it. If you're denying list/read rights to that share you've effectively denied students the right to 'view' their home folder. This will cause the problems you're seeing and give your students an unhappy 'mac' experience. I would look at what ACLs and/or policies you have applied to that share and at least assign list/read rights to that share. They should be able to login and access their home folders after that if you've done it correctly.

 

Permissions for student's home folders should be set to allow individual students read/write rights to their own home folder and at the very least read only rights to everyone else. Ideally everyone else should be denied even that, except administrators of course.

 

OS X is UNIX underneath and anyone logging into a mac must have the ability to mount their home folder and have read/write access to the contained folders. Especially the Desktop and Library folders. If access is hampered to both those two folders, login will be incomplete or fail.

 

Antonio Rocco (ACSA)

[alfatec]

Hi,

 

Many thanks for that. Have applied the read/list permissions and now have full home drive access for the students. Just setting up my OSX OD server to control the preferences

so should be all good to go after that. Many thanks for your assistance.

[alfatec]

Hi, One thing I have noticed is that when I remove the tick from 'Force local home directory on startup disk' then it does not put the windows home drive on

the dock but if I put it back in then the home drive shows again. I have got a tick in 'Use UNC path from Active Directory etc'.

[furby]

You don't need it in the dock if you untick it, the home folders will appear in Finder, Documents will be \\file-server\students\studentname\Documents etc.

 

You can though assign it back to the dock if you're using Profile Manager

[alfatec]

Many thanks for that. Can you also hide the 'Network' icon from being displayed so that students cannot browse the Network??

[furby]

Pesky kids! Hard to keep them at bay.

 

My server is on 10.9, so someone else will have to say if it's possible on 10.10 but, no, the options to restrict the Finder are fairly limited. With the right sharing/security permissions that shouldn't be too much of a worry though.