OSX on Windows network - User Profiles & User Experience

[karlr]

We are looking to fully integrate a set of iMacs into our network, with a user experience that is as smooth as possible. Thus we are seeking feedback from anyone already successfully running OSX clients that behave themselves in a mainly Windows environment. Any knowledge or rundowns on how you have your OSX clients set up would be appreciated.

 

Below is an overview of the set up we have and what we are trying to achieve and the problems we have encountered with doing so.

 

We have a mac server with the latest server components, and both server and clients will be running Yosemite 10.10.4 (or newer). We have profile manager set up and working on the server.

 

The clients are bound to both AD and Open Directory, and the profile deployment seems to work as expect, similarly to group policy (within reason). The bit we are now looking at is how to get the user experience to be consistent and at least attempt to have some familiarity with our Windows desktop experience.

 

The first thing of note is user profiles; where/how should these be stored for OSX? We have attempted the network home directory method, which seems to run the user's profile directly from the network. To some extent this conflicts with our Windows folder redirection - for example we redirect Documents to the root of a user's home directory, whereas OSX would create a Documents subfolder under the root. More worryingly, some of the ACLs that OSX sets (e.g. the ones that prevent "Documents" from being deleted) seem to result in bizarre NTFS permissions being set on the file server, preventing anyone from getting into these folders, whether it be a domain admin or the owner of the home directory (and this is the case on OSX or Windows).

 

With this behaviour I would be tempted to force the profile to be saved to the local hard disk, and simply create a symbolic link (or "alias" ?) for the Documents, Pictures, Music, Desktop folders to appropriate locations on the user's network home directory. This would likely be achieved with a logon script that would remove the protective ACLs from the special folders, and then simply run a ln -s. A benefit of this would be that all of the miscellaneous OSX profile data would not be stored on the network and at worst would persist on individual workstations. A problem I can see with this is if the user saves files directly to their local home folder - at this point they would not be stored on the network and could thus be lost.

 

The second aspect is how to give the user's a consistent experience; On windows we use mandatory profiles (that get erased at log-off on desktop machines) and a set of group policies and logon scripts so the user gets a fresh experience each time they log on. We set the desktop background, push a set of desktop icons, set the contents of the start menu, set the pinned items on taskbar, map appropriate network drives etc. We would like to do something similar for the OSX clients, ideally using profile manager as much as possible to keep things simple.

 

With profile manager it looks like we can mount network shares, so that should be covered. We can also manage the contents of the dock, although we currently push down shortcuts based on group membership and PM doesn't seem to like multiple profiles controlling the dock (one "dock" might overwrite the other etc.). The other major thing we would want to get right is exposing the mounted network shares cleanly to users; creating a dock icon for the shares seems to be a non-started as they are just icons and expose the actual share name (e.g. staff-share$) rather than a friendly name like "Staff Share" or "T: (Staff Share)". The finder seems show network shares on the per server level which is also not very friendly for our users. Another option would be to push down desktop shortcuts, but I do not believe we can do this using profile manager and would thus need to write logon scripts.

[ass17]

Force connections over SMB1 instead of the default SMB3, this should stop permission issues. You can force connections to default to SMB1 via an nsmb.conf file placed in /etc

 

sudo echo "[default]" >> /etc/nsmb.conf

sudo echo "smb_neg=smb1_only" >> /etc/nsmb.conf

 

restart in order for this to take effect.

[ass17]

Also if you are using server 2012 might want to turn off access based enumeration on the share.