Uncheck 'Force local home directory..' causes serious delays

[Sheridan]

Our Macs (10.6.8) are working nicely with AD - authenticating users and get preferences from our Mac server. But we still have the Directory Utility option 'Force local home directory on startup disk' checked, because when we uncheck this, it causes random and severe system hangs. You get the spinning wheel for anything from 30 seconds to 2 minutes and the whole system is hung - and won't respond to anything.

 

Now, as we want to force our users to save their files to their AD home folder this is the only way we can do it. However I have tried everything I can think of and have run out of ideas. I've been trying to sort this since we got the Macs in over a year ago, running 10.6.5. We have also upgraded the Windows servers from 2003 to 2008 so thats also changed!

 

So it points to OSX being the problem - question is, how can I find out what is causing these hangs? It happens on all of the Macs when this option is unchecked and renders them unusable until the option is rechecked as the 'hangs' can happen at any time, running any (or no) application and several times during a login session, there is no real pattern!

 

A 4 pack of EduBeer for anyone who cracks this, I'm stuck now!

Edited May 15, 2012 by Sheridan

[JR-PCS]

Does your domain name end with .local?

 

Could you try creating a home folder that is stored on a different device/server? What do you store your home folders on at the moment?

 

What switches and network cabling do you have in place from the core to the mac clients?

[Sheridan]

No its a .org domain. I've tried with home folders on several servers now (2003/2008)

 

Theres a variety of switchs between the macs and the servers - but they do the same thing even when moved onto the same switch as the server (i.e in our office!)

[JR-PCS]

Who created the mac images on the macs, yourself or third party company? and how were they created? Have you tried creating a completely clean build of 10.6.8 and then binding to AD with force local unticked?

[kernewek-sam]

Theres a variety of switchs between the macs and the servers - but they do the same thing even when moved onto the same switch as the server (i.e in our office!)

 

Are they on the same VLAN as the server?

[Sheridan]

Yes we created the images and I also tried a brand new image. All macs are on same vlan as servers.

 

I tried a blank image with no applications and also a fully loaded one - both the same!

[kernewek-sam]

Have tried putting a mac on a Gb port to see if it's the amount of traffic generated by the mac.

[Sheridan]

Its connected to a gigabit port now. When I look at the open files on the server it only seems to have half a dozen or so files open for read/write.

 

I've tried using the process monitor on the mac but it hangs when the mac hangs!

[JR-PCS]

I have set up thousands of macs in over a hundred schools but only come across an issue like this when there was something wrong with one of the following:

 

-how the AD domain was configured

-how the image was created

-a dns issue

-permissions

-cheap/old switches.

 

If you don't think it is any of them then I don't have a clue what it could be, and to be honest I don't think anyone one here will be able to help. You might need to get a consultant (like myself) to help diagnose the issue and check how everything is setup in more detail.

[kernewek-sam]

@AntonioRocco is really good with these sort of problems.

[Sheridan]

I appreciate all the responses!

 

What sort of problems have you seen with the AD or dns config?

 

I can probably dismiss the image as I've tried several and the switches as its been tested on various ones. Permissions also seem less likely as it happens to all users,including admins.

 

Very frustrating though!

[JR-PCS]

It's hard to explain The AD and DNS stuff, and ultimately I have a living to make out of this type of expert advice. I'm sure you can appreciate the difference from a couple of one liners to a full detailed bit of info or documentation.

 

One thing I would say about your other tests.

Are all your switches the same brand, and configured by the same person?

Equally it could still be a permissions issue, and all users have a permissions issue that windows clients are ignoring.

You mentioned using several images but have you wiped a mac clean and then installed 10.6.8 and tested it?

[mac_shinobi]

When you join the macs to the both open directory ( OS X Server ) and AD, I presume you are placing the AD domain first and the OS X ( open directory server ) 2nd in the list ( on both a mac connected to the same switch as the server and on a mac in the classroom or wherever they are )

 

DNS Wise can you ping / nslookup / trace route to the server both by hostname and ip address without any issues

 

Also on each mac if you flush dns ( sudo dscacheutil -flushcache ) --> http://kitara.nl/2011/06/14/how-to-flush-dns-cache-in-mac-os-x-snow-leopard/

 

Then try the resolution of a few of the servers ( AD, OD ) both by name and ip address ?

 

Also on a test AD standard user account ( on the home path , what is the UNC path like exactly ) ? Not sure how much difference this will make if any but I remember having worked at one school and the unc path was something along the lines of

 

\\Server\users$\students\year_group\%username%

 

Going from memory I think I shortened this to something like

 

\\Server\users$\students\%username%

 

OR

 

\\Server\users$\%username%

 

Also on both macs ( one from the classroom and one on the same switch as the server ) I presume

 

* Date / Time and Time Zone are correct ( within aprox 10 or 15 mins max of the NTP Server or in comparison to your other servers )

* DNS Servers are configured and in the search domain you at least have the relevant FQDN of your AD Domain ?

 

As above though either @AntonioRocco or @Rozzer

Edited May 16, 2012 by mac_shinobi

[Rozzer]

I would look at how you are caching. I have enabled caching in a school to the local machine and it made it worse than caching to the network drive. But as JR mentioned above maybe down to a large factor of things. It maybe worth setting up your image again from scratch. If all else fails get a consultant in. If you spend several days on fixing the issue and its still not done then get someone in. PM me if you want any info on help.

 

Ross

[Sheridan]

When you join the macs to the both open directory ( OS X Server ) and AD, I presume you are placing the AD domain first and the OS X ( open directory server ) 2nd in the list ( on both a mac connected to the same switch as the server and on a mac in the classroom or wherever they are )

 

Yes - thats how we have them set up

 

DNS Wise can you ping / nslookup / trace route to the server both by hostname and ip address without any issues

 

DNS is working fine - checked using ping and dig both ways

 

Also on each mac if you flush dns ( sudo dscacheutil -flushcache ) --> How to flush DNS cache in Mac OS X (Snow) Leopard « Marius van Witzenburg

 

Then try the resolution of a few of the servers ( AD, OD ) both by name and ip address ?

 

I've tried the flush as well - and resolution still working OK

 

Also on a test AD standard user account ( on the home path , what is the UNC path like exactly ) ? Not sure how much difference this will make if any but I remember having worked at one school and the unc path was something along the lines of

 

\\Server\users$\students\year_group\%username%

 

Going from memory I think I shortened this to something like

 

\\Server\users$\students\%username%

 

OR

 

\\Server\users$\%username%

 

Our home directories are mapped very similar to your, ie. \\server\folder\username

 

Also on both macs ( one from the classroom and one on the same switch as the server ) I presume

 

* Date / Time and Time Zone are correct ( within aprox 10 or 15 mins max of the NTP Server or in comparison to your other servers )

* DNS Servers are configured and in the search domain you at least have the relevant FQDN of your AD Domain ?

 

All the Macs use our DC as their time server, which in itself is the time server for the domain so the clocks match exactly.

 

Also, we only locally cache the tmp folder - which I understand is best for application performance.

[mac_shinobi]

I would look at how you are caching. I have enabled caching in a school to the local machine and it made it worse than caching to the network drive. But as JR mentioned above maybe down to a large factor of things. It maybe worth setting up your image again from scratch. If all else fails get a consultant in. If you spend several days on fixing the issue and its still not done then get someone in. PM me if you want any info on help.

 

Ross

 

Any chance you have a guide on common things you do with issues like the one Sheridan has that you could pm me as well as pm'ing me what was done to resolve his issue if you manage to fix it ?

 

Thanks @Rozzer !!!

[Rozzer]

I will try and produce something and put it on my blog

[Rozzer]

Just curious but I would remove the folder redirect with the manifest preferences and see if you see an improvement. I am working on a site Friday with a slowness issue with logins and general performance. I am going to setup a fresh image on them to see if it cures the issue they are having.

 

Ross

 

When you join the macs to the both open directory ( OS X Server ) and AD, I presume you are placing the AD domain first and the OS X ( open directory server ) 2nd in the list ( on both a mac connected to the same switch as the server and on a mac in the classroom or wherever they are )

 

Yes - thats how we have them set up

 

DNS Wise can you ping / nslookup / trace route to the server both by hostname and ip address without any issues

 

DNS is working fine - checked using ping and dig both ways

 

Also on each mac if you flush dns ( sudo dscacheutil -flushcache ) --> How to flush DNS cache in Mac OS X (Snow) Leopard « Marius van Witzenburg

 

Then try the resolution of a few of the servers ( AD, OD ) both by name and ip address ?

 

I've tried the flush as well - and resolution still working OK

 

Also on a test AD standard user account ( on the home path , what is the UNC path like exactly ) ? Not sure how much difference this will make if any but I remember having worked at one school and the unc path was something along the lines of

 

\\Server\users$\students\year_group\%username%

 

Going from memory I think I shortened this to something like

 

\\Server\users$\students\%username%

 

OR

 

\\Server\users$\%username%

 

Our home directories are mapped very similar to your, ie. \\server\folder\username

 

Also on both macs ( one from the classroom and one on the same switch as the server ) I presume

 

* Date / Time and Time Zone are correct ( within aprox 10 or 15 mins max of the NTP Server or in comparison to your other servers )

* DNS Servers are configured and in the search domain you at least have the relevant FQDN of your AD Domain ?

 

All the Macs use our DC as their time server, which in itself is the time server for the domain so the clocks match exactly.

 

Also, we only locally cache the tmp folder - which I understand is best for application performance.

[Sheridan]

The odd thing is its not slow logins or any kind of performance issue - everything works perfectly, apart from a random complete system hang (when even cmd+alt+esc won't even bring up the task manager)

 

Once the 'hang' is over, everything works perfectly until the next time! I've had videos streaming whilst editing videos in Premiere with no performance issues, but I can have the system hang even with nothing running!

Edited May 16, 2012 by Sheridan

[Mediocer]

Our Macs (10.6.8) are working nicely with AD - authenticating users and get preferences from our Mac server. But we still have the Directory Utility option 'Force local home directory on startup disk' checked, because when we uncheck this, it causes random and severe system hangs. You get the spinning wheel for anything from 30 seconds to 2 minutes and the whole system is hung - and won't respond to anything.

 

Now, as we want to force our users to save their files to their AD home folder this is the only way we can do it. However I have tried everything I can think of and have run out of ideas. I've been trying to sort this since we got the Macs in over a year ago, running 10.6.5. We have also upgraded the Windows servers from 2003 to 2008 so thats also changed!

 

So it points to OSX being the problem - question is, how can I find out what is causing these hangs? It happens on all of the Macs when this option is unchecked and renders them unusable until the option is rechecked as the 'hangs' can happen at any time, running any (or no) application and several times during a login session, there is no real pattern!

 

A 4 pack of EduBeer for anyone who cracks this, I'm stuck now!

 

We have been doing this for a couple of years now. For performance issues, we ended up going with the ExtremeZip solution.

But before that and currently, we use the golden triangle setup AD for authentication and profile paths and OD for configurations settings for Mobile Sync accounts.

For our setup on the AD side, we set their local account location, for windows roaming profiles and then set the drive mapping, for Mobile sync account location.

\\server\share\%username%\Windows

H: \\server\share\%username%

On the mac client, we bind to AD with these settings:

important to bind AD first as it is for authentication.

User Experience tab, check use UNC path, set your protocol and check Default user shell (default setting)

The rest is default. If we did not have an OD server to tell the apple computers to log in with a mobile sync account settings, all users would be a network account and create havok on our network.

We then bind to our open directory master for the preferences that are set, such as sync rules.

 

We set these up by using our AD groups.

 

We have been using this method for a few years with great ease.

[Sheridan]

I wonder if its something to do with the share permissions on the servers. Currently each user accesses their home folder via the share \\server\yeargroup\username and the Yeargroup is the Shared folder. They then have Modify rights on their own folder and subfolders.

 

Its difficult to pin down as it happens so randomly - you can have 3 in a row,none for an hour and so on!

[mac_shinobi]

I wonder if its something to do with the share permissions on the servers. Currently each user accesses their home folder via the share \\server\yeargroup\username and the Yeargroup is the Shared folder. They then have Modify rights on their own folder and subfolders.

 

Its difficult to pin down as it happens so randomly - you can have 3 in a row,none for an hour and so on!

 

So if you create a dummy AD account with a dummy user area ( and give the dummy user area full access rights ) does that make any difference??

[JR-PCS]

My suggestion, and just to clarify I make a living out of fixing AD integration issues like this every day of the week for the past 8 years, would be to work off my earlier list. I would be totally shocked if it isn't one of them.

[HodgeHi]

Is the domain name pushed out via dhcp and entered in the Search Domains? If so is it also listed in the proxy exceptions list? I have seen this when someone was using a .local domain and if the domain name was not listed under the exceptions then the client would keep trying to go outbound to the web.

 

Also what version of Server are you running. I had massive issues with 10.5.8 and AFP shares. The service was maxing out at 100%. After upgrading to 10.6 the service never got past 65% under the same load. There was an issue with the threads being held open in 10.5.8 server causing the cpu to max out and causing slow down.

 

If you haven't, move the Safari cache to a tmp location (although 5.1.7 seems to handle this better now), and any other areas that hit the network home dir regularly, such as the logs. These can get written to constantly. Also check the logs to see if there is any software writing to the logs repeatedly in short space of time. This coupled with the logs being stored in the networked home dirs could cause an issue.

 

Also forwarding DNS address. I had login issues as I was using an incorrect DNS forwarding address. Everything worked as expected, just really slowly.

[Sheridan]

I've tried with a 'blank' account and it does the same thing. All the Macs are 10.6.8 and so is the server, although the users don't have and afp shares on the server as they use their smb shares on the Windows server.

 

Its a fundamental issue with osx for us - no matter what misconfiguration there is (and I'm yet to find it!) the fact the system locks out completely is a pretty poor showing - you can't even get the Force Quit dialogue up or run Activity monitor.

 

Its also quite tricky to go through this - I've been checking suggestions posted on here (thanks to all!) but as its so random whenever I think it may be working I get a lock out all of a sudden...grrrrrrr