Mosyle School Manager MDM, Catalina and SMB Shares Issue

[_techie_]

Hi.

 

I am testing Mosyle MDM School for use with our Music Mac suite, experiencing issues with mapping Server 2016 Shares mapping consistently, when using MacOS Catalina 10.15.3 or 10.15.2

I am using Authenticated Network Mounts going to Windows SMB Shares on Server 2016 VM's.

Mac is bound to the domain, although local accounts seem to experience intermittent issues when running the MDM profile (sometimes getting prompted, sometimes not for the SMB Share.

 

Home drives always map for AD users, but the Authenticated or Normal Network mounts from Mosyle MDM never work for AD users.

Mapping the share manually as the AD User works perfectly every time. Added in the Item for the SMB share as well (following Mosyle's Support team advice) but again hit and miss on Catalina for local admin acocunts. Nothing happens at all for AD Users when logging in.

 

High Sierra and Mojave work perfectly every time!!!

 

Even tried enabling NetBIOS following a forum post online elsewhere, but no joy to the /etc/nsmb.conf file

 

Wonder if its something to do with our environment, but no joy. I can't even get NoMAD to work for Shares on Catalina. Might go back and try NoMAD Shares on Mojave and see what gives...

Anyone else experiencing said issue?

[free780]

Intresting. I can not get them to work with Mojave and Jamf. I'm not going to Catalina due to the cert requirements. I think you have to script it.

 

I was looking at this but it looks like I need to sign the pkg.

[_techie_]

Mosyle support have provided me with a script, but I am testing it tommorow, I'll let you know!

[mitchell1981]

Mosyle support have provided me with a script, but I am testing it tommorow, I'll let you know!

 

Did you get anywhere with the script as we've just run into exactly the same problem? If it worked would you be able to share it? I've logged it with Mosyle, but still awaiting a response.

 

Thank you.

[_techie_]

Yes, it does work. It basically puts a small wait on the mounting of the drive. You only really need to adjust the last line of the script to point to your internal SMB share. You still get the prompt to put in your AD credentials, but this does work. I'm not sure if the problem exists on a wired connection, as I've only got an Air to test on.

I can PM you the script if you don't hear back from Mosyle. Seems like this might be a known issue with Catalina and their MDM at present, but this is a guess. However speaking to other vendors in the industry, playing catch up is common with Catalina.

Cheers

Mark

 

Did you get anywhere with the script as we've just run into exactly the same problem? If it worked would you be able to share it? I've logged it with Mosyle, but still awaiting a response.

 

Thank you.

[mitchell1981]

I just posted another thread asking a similar questions, but I think the problem isn't just with Mosyle. Tried with Profile Manager and the same problem. Drives don't mount.

 

I did get the script from Mosyle. It did work, but as you say, it prompts for credentials, which never happened before.

 

Also, it doesn't fix the problem that the users home folder isn't being mapped to the Mac home folder which I think is the most important bit, otherwise kids just end up saving files locally.

 

Did you work out a way to do that?

[_techie_]

Hi.

You can do this as part of the AD Bind, if you are using AD accounts, think its the option to mount a users home share at the bind screen (check advanced options). This seems to work regardless, and very consistently!

I did find that using NoMAD (if you are) seems to break mounting any drives drives apart from users home, even using the script from Mosyle, so you have been warned!

Thanks

Mark

[mrnoisy]

We just use a logon script wrapped up in an app and then a separate script to run a login hook so when the users login it mounts their home drive and the student share, it’s works and is quite simple to push out via ARD. Works on Catalina.

[coalis]

I also am now battling with Mosyle and trying to get our home drive and student shares to work. So far no luck, have run into the same issues described on Catalina and also with Big Sur. We signed on to Mosyle Auth and are using that to connect to our local AD for now. Will move to Azure or something else soon. In the meantime I'm trying to get a Login Items setup to work for the Authenticated Network Mounts config. Can map the smb path fine with a local connection while authenticated to the AD. No luck checking the box to get home shares to mount off ad group setup or with any path in the mounts config. Anyone else get these to work or have advice? mrnoisy, you willing to share what you did with your login script?

[Face-Man]

I couldn't get this to work with Big Sur so ended up adding the shares to all users dock then they click on them and mount the drives. Not ideal but does work

[5tu]

I couldn't get this to work with Big Sur so ended up adding the shares to all users dock then they click on them and mount the drives. Not ideal but does work

 

We're currently doing the same. I've found that a Mosyle "Login Items" profile containing any settings (e.g. launch app on login - not just mount shares) works for local user accounts but not AD accounts. I have remote session booked with Mosyle next week to investigate further.

Edited October 12, 2021 by gybe78

[Arthur]

I couldn't get this to work with Big Sur

Could it be this issue?

 

My network shares won't mount and/or printers prompt for a username and password after upgrading to macOS 11 Big Sur

 

There is currently an issue with macOS 11 Big Sur where Active Directory users are not issued with a Kerberos Ticket-Granting Ticket (TGT) when they log in. As a result, you may see network shares managed by NoMAD failing to mount and other Kerberised services/websites prompting for username and password authentication.

 

The issue is caused by the user's pre-Windows 2000 logon name (sAMAccountName attribute) containing uppercase characters. Change this to use all-lowercase characters and Kerberos tickets will be issued at login as usual.

[5tu]

Thanks @Arthur for your post. I was feeling very hopeful when I saw it last night, but testing this morning I still can't get a "Login Items" Mosyle profile to have any effect even after making AD sAMAccountNames all lowercase and confirming kerberos tickets are being issued with klist.

 

I have enabled the "Users/Groups" setting in System Prefs for all users so that I can check the "Login Items" list for a logged on user - but it's always empty.

[5tu]

Just to update this thread.....

 

I worked on a support case with Mosyle for this issue and they suggested using a "Custom Commands" profile to deliver a script at logon to mount network shares, which works fine. They couldn't explain why the "Login Items" profile doesn't work.

 

Script as follows...

 

sudo -u $(stat -f "%Su" /dev/console) /bin/sh <<'END' #Detect the logged username

HOST="your_server_name"; #smb hostname
PATH="/your_share_name"; #the path of a folder in the smb (optional)

/usr/bin/open smb://"$HOST$PATH"

 

Replace your_server_name and your_share_name as required.

 

On the "Execution Settings" tab of the "Custom Commands" profile, select "Every user sign-in".

 

Hope this helps.