Mapping AD network user homes through OD

martin_hannah · September 20, 2012

Our macs here used to be set up so users got their AD network home drives mapped when they login in when the path was in the following format in AD;

\\fileserver\username$

However to make adding new users easier for ourselves we changed the AD accounts so the home directory path is now as follows;

\\fileserver\users$\Students\YearGroup\username

This works fine in windows but on the macs it just maps users$ which they don't have permission to so..

Is there an easy way of fixing this?

I've written this applescript which ejects the users$ share, queries AD for the current users home directory, converts the \\ into / and maps that as an SMB share.

However i'm hoping there's an easier way of doing this that i've missed as i've got to apply this to around 100 macs..

set diskName to "users$"
tell application "Finder"
if disk diskName exists then
	eject disk diskName
else
	
end if

end tell

set homedir to (do shell script "dscl /Active\\ Directory/domainname.org.uk -read /Users/$USER SMBHome | grep \\\\\\\\.* -o")

set x to SaR(homedir, "\\", "/")

on SaR(sourceText, findText, replaceText)
set {atid, AppleScript's text item delimiters} to {AppleScript's text item delimiters, findText}
set tempText to text items of sourceText
set AppleScript's text item delimiters to replaceText
set sourceText to tempText as string
set AppleScript's text item delimiters to atid
return sourceText
end SaR

set networkhomedir to the result

mount volume "smb:" & networkhomedir as text

Any suggestions would be greatly appreciated.

Many thanks,

Martin

kirchie · September 20, 2012

The amount of people I've seen with fancy scripts for mapping AD network drives is starting to make me think that I've done something wrong!

All I've done for our AD/OD is set the macs to use the path in AD to map the user's home drive (Directory Utility -> Services -> AD -> Advanced -> Use UNC path from AD), and that seems to do the trick.

martin_hannah · September 21, 2012

The amount of people I've seen with fancy scripts for mapping AD network drives is starting to make me think that I've done something wrong!
All I've done for our AD/OD is set the macs to use the path in AD to map the user's home drive (Directory Utility -> Services -> AD -> Advanced -> Use UNC path from AD), and that seems to do the trick.

Kirchie,

This worked previously before the student's UNC paths were changed, it seems that the macs weren't too happy with the home directory being a subfolder within a share. The staff here still have their home directories UNC paths shared out like \\server\username$ and that works fine it's just the students who have had their UNC paths changed to \\server\user$\Students\Yeargroup\Username

Spent a while checking through everything in directory utility to no avail so I went down the scripting route..

How are your UNC paths inputted in AD out of interest?

Cheers,

Martin

kirchie · September 21, 2012

We have \\studentFS\student home$\year entered\Student name Staff have a simmilar structure, only it's grouped by deparment rather than year.

I don't envy you at all with the blasted things. I'm fed up with them, and they're going to be bootcamped with Win7 next week. Should make things so much easier to manage!

dayzd · September 21, 2012

Can you not give students 'Traverse folder' permissions on the fileserver so they can see through the users$ folder to their own folder below?

I vaguely remember having to do this once and I don't think I needed a companion script to get it to work...

apeman · September 22, 2012

What are you hosting the user accounts on??

Posted September 22, 2012 · September 22, 2012

'Traverse folder' permissions

Id suggest its this too

apeman · September 24, 2012

Yes if this is a windows box setup like this \\server1\users\username

your share permissions should be authenticated users full control

your NTFS permissions on the users folder should be System full, Local/Domain admins full and authenticated users read/list. Also remember to turn off inheritance/propagate permissions

your NTFS permissions on the username folder should be System Full, Local/Domain admins full and username read/list/execute/write/modify

Also if this is a windows box you can turn on Access Based Enumeration and this will hide any folders the users don't have access too.

martin_hannah · October 12, 2012

Thanks apeman,

The network home drives are all on a server 2003 box, the macs connect

using SMB.

I tried applying all permissions suggested by yourself and it is still mapping

the root of the share as a drive which is 3 levels up from the users

folder ie;

\\server\users$\ADSync\Student\YearGroup\Username

Is there anything else I can try?

On another note the script that I am using for mapping the drives is now failing..

I copied the script locally and set it to run on log in through WGM. This was fine for a while but it's now corrupted the script .app file.

Is there a better way to run log in scripts in an open directory environment, the script is written in applescript.

Many thanks,

Martin

dayzd · October 16, 2012

I've used bash whenever I've done login scripts. Never had them not run or become corrupt once.

I actually had a slightly more complicated login script arrangement, that kind of mimicked the 'netlogon' method of Windows systems. Each machine had a short script installed locally which ran on login. This script would mount a share on the server, copy the 'real' login script to the local machine and then run it.

This way I only had to make changes to the one copy on the server, and at next login the machines would run that instead. Saved loads of effort in deploying changes! It also kept the local version on disk, so that if the remote share could not be mounted, it ran the last version it had, making sure any environment settings or drive mountings would still be applied.

apeman · October 16, 2012

What version of 2003 is it?? 2003 or 2003 R2??

What are the permissions on ADSync, Students, YearGroup and Username??

I would also try and move away from login scripts they aren't supported in 10.7 and above.

martin_hannah · October 22, 2012

Yes I would much prefer not not have to rely on login scripts but at the moment it's the only way of getting the student's home drives mapped for them. (however flaky it's being)

The permissions need sorting out over the half term as students currently have the ability to write directly to the users$ share which is occasionally getting mapped for them on both mac and windows. To sort this i'm going to remove all 'Local users' write permissions, not sure how this got there in the first place..

Permissions are as follows;

Highest Level;

E:\Users - Shared as users$

Share Permissions - Everyone Full Control

NTFS - Auth Users - Read/List/Transverse

- Creator/Owner - Full

- System - Full

- Local Administrators - Full