KM-TechServices

Hello - I am actually playing with SharedPC mode right now too. I have a local admin account added with my Sysprep file and it seems to maintain its admin qualities, but it's still locked down with the SharedPC settings. I also found that using the runas command will let you invoke certain things that you might be blocked from otherwise. Like, if you do runas /noprofile /user:%computername%\adminaccountname cmd.exe - you can get an elevated command prompt. I'm not sure there should be anything that you should have to do admin wise on these systems. They're so locked down that any management should be done through SCCM. You have SCCM - why not manage all admin stuff from there? You could probably use psexec -i -s cmd.exe (sysinternals command) to get yourself into a System level command prompt too. That being said, from reading about it, it sounds like if the account is created prior to SharedPC mode being enabled, it shouldn't remove it. So, possibly moving the SharedPC DISM step to later in the Task Sequence might help - after the account is created. The only thing I'm trying to figure out is how to modify which folders are locked down. I have some folders on the Public desktop that don't show up because of all the Folder restriction policies and I'm trying to find a way to exempt certain folders from the policies. I hope this helps.

Thanks for the response. As mentioned in the original post, we would like the folders to be shared because the computers are shared. For an example, let's say User1, User2, User3, and User4 are all part of a group in a classroom. On day 1, User1 starts a video project for the group. On day 2, User1 is sick and now User2, User3, and User4 have no way to access the project. With the desired setup, it wouldn't matter because every user can access the same Documents, Videos, and other folders. Right now, it is basically the same setup because every system automatically signs into a shared "macuser" account. We just need to take the setup into the AD world so our Internet filter can identify who signed into a machine. As for the proposed solution of moving the home folder location, that unfortunately isn't exactly what is required. That would allow us to move the entire home folder, but we need to move individual folders inside of the home folder - similar to Folder Redirection on a Windows environment. Thank you.

Hello - We are currently in the process of trying to get our 10.7, 10.8, or 10.9 clients bound to AD. We can successfully get them bound to AD, but we're having issues with the user profiles. We need the independent user accounts for correct identification on our Internet filter, but we would like to do some sort of Folder Redirection so all users are forced to save in the same location. For example, when any user logs in, we want it to pull a common Documents folder, rather than make a new documents folder for each user who signs in. Our Apple systems are all in shared environments, so we're not concerned about the security of the data. In 10.6, I experimented with putting symlink'd folders inside of the default profile (the profile is located under /System/Library/User\ Template/English.lproj). For example, I symlink'd the Documents folder to a shared location /users/data/documents. The shared folders obviously had permissions for everyone to be able to access the files located in those folders. It worked in 10.6. I can't seem to get the same setup working on anything newer, however. When you sign in, you just end up with a corrupted profile - the symlinks seem to mess up the copy process. If I remove the symlinks, it works fine. So, basically what I'm looking for is: 1) Is there another alternative to this type of setup? For example, is it possible to simply make every user grab the same user profile on sign-in? I've experimented with loginhooks and LaunchDaemons, without any success. 2) Is there another way to make a shared setup like this work Thank you, KM-TechServices