Spec alternate local home folder under AD. Seems to work, but HOW? it’s too easy!?

Hi, I’m just beginning to dip my toe into the world of AD after many years with the rarefied luxury of only having to deal with OD. I’ve reached the point where I *must* be doing something very terrible and it’s time to ask for help

We have one of those (print) clients where Macs are a “necessary evil”, and there is zero enthusiasm for integrating anything OS X server into their sterile Dell forest of a server room. However, they’re quite keen to set up some NetBoot/NetRestore action and get themselves a proper SOE, if it’s all stand-alone.

Which begs the question: is there any simple, reliable way we could get user’s home folders onto some other local volume? User data is not meant to be mission critical, but it probably quite often is, and you just save loads o’ time if you can wipe a machine without having to chase the five previous users to ensure nothing critical was holidaying on their desktop. (Yes, they’ve used SMB home folders in the past, and they just might be able to start with AFP homes, but I think it’s pretty unlikely).

I did some very quick testing with 10.5.5 and using both fstab and a symlink (separately, not at the same time) to make /Users point to a separate volume and pretty reliably got “your home folder cannot be found” messages. No dice. Tried a few other iterations with AD/OD triangles and the like, but then the following, which actually works, but the question is: HOW?? and is there any chance that this is safe, and likely to keep working across anyone’s software updates?

* Bind an OSXserver machine to AD. Use WGM, pointing to that Mac server and the AD directory inside it, and simply specify the users’ home location as if you were talking to an OD server (in this case /Volumes/UsersPartition)
* (logged in as a local admin) Bind workstation to AD. Only. Go into the AD plugin settings and uncheck all the home directory options (create mobile, force local and use UNC path). Log out
* Log in as the AD user with the alternate local home and it works

Looking on the AD server (wayyy outside my core expertise) the schema appears to be untouched, the “profile” path settings are empty, can’t see any obvious place where this info is stored at all.

What’s happening? Did it modify the schema on the sly? This will obviously work pretty well for the client, but I don’t think I can recommend it if it appears to use magic