[TimSnoots]

I have been looking for a similar solution for a while now so I’ll restate it here. Here is the specific and very simple setup what I want and I think some others on this thread want as well:

– I want my Macs to use the AD for authentication
– I do not need to manage them with either AD or OD
– I want them to only have local home folders (no network homes, everything stored locally just as a local account would)
– I don’t want to ever be prompted to “sync” with a network home
– I want them to be able to log on when disconnected from the network

To summarize another way, I simply want my Macs to use the AD for authentication, yet otherwise behave just like non-AD Macs with local user accounts.

So, how do I set up the AD settings in Directory Access to achieve what should be the most basic setup of all? This would seem easy until you try and realize that the dialog prevents the enabling of “Create mobile account at login” and the “Force local home directory on startup” at the same time. Also, I assume that I should disable the “Use UNC path from AD to derive network home location”. And then what exactly does the “Require confirmation before creating a mobile account” do?

With those settings in place (minus the fact that the “Force local home directory on startup” is dimmed), I can successfully bind to the AD, authenticate to the AD, a local home folder is created, and things seem to work as expected.

The things that worry me are the prompts to “Sync” home folder (I am greatly concerned that a user may somehow try to sync with a nonexistent network home and end up blowing away their local home). Because I am not using a network home, why is syncing even an option and how do I tell it to never attempt to sync and never ask?

And lastly, at login, I get a dialog asking if I want to “Enable Workgroup Manager”. Why is it asking this and what affect does a yes or no responce have? Remember, I do not need to manage these Macs via OD or WGM.

Thanks for any assistance in clarifying the AD Directory Access settings required for what should be a very simple use of AD to authenticate users, but nothing more.

Tim

[Author]

Posts