[bradprice]

Thanks for your comments and suggestions.

Interesting yes, but I find it hard to believe that I’m “off the charts” in wanting to do this. I mean, there have got to be a lot of Windows-centric places (especially universities) using a big central Active Directory, and that need to set up some Mac labs leveraging that same directory for user accounts (who wants to create 3000+ accounts on their XServe if they don’t have to?) The AD plugin in Tiger, while certainly much nicer than what one had to attempt in Panther, really doesn’t help that much. Local homes? Blech. Homes specified in the AD?! Most Windows places won’t want this on their Windows server because they don’t do it for PCs (usually just a mapped H: drive.) To me it demonstrates a real lack of understanding on Apple’s part of how Windows and AD infrastructures are typically deployed in the enterprise.

I agree with your assessment that the static mapping on the client would probably not work… unless there would be a way to script it dynamically, as a loginhook or something. I’ll be the first to admit such a method would be way beyond my capabilties, and would definitely fall into the category of a major “hack”, if it’s even possible.

So your suggestion to static NFS mount /Users, would mean that even local accounts on the client would ALSO have their home dirs on the server… a wrinkle, but I might be able to live with that. (I’m thinking it might be a problem for local admin-ing the client Macs…)

I think probably the way Apple would say to do it is with LDAP to AD, like the old way in 10.2 and 10.3.

Here’s one more thought… Since the server is joined to AD, and I have AD users in OD groups, could I remove AD on the client Macs and just use LDAP to the server OD? From the client side it would be just the same as if they were authenticating to an OD account on the server and AD didn’t exist, only the server doesn’t have the user accounts, but groups of AD users. Would this even work? What are the ramifications for single signon? I also fear my too-shallow understanding of Kerberos may be clouding my thinking here, but I’m happy to be enlightned!

This is a real sticking point for us, especially in one lab that’s used mostly for Final Cut. User files are HUGE. Also, users have a hard time with being forced to come back to the same computer each time they visit the lab. We have a fast network and tons of space on the XRAID, thus the desire for home folders to be located there. There would still be local scratch space on the client Macs, but it would be easier for them to understand where to put files, etc (and user data would be safer on the RAID.)

Thanks… will be an interesting project for over break.
Will you be at Macworld?
Brad

[Author]

Posts