[thomasb]

Hi @eekaboig,

How is your DFS setup? What are you trying to achieve? Are you dealing with DFS based home folders, or just general shared storage in a DFS configuration?

At work, we ended up using ExtremeZ-IP and their Zidget for our general shared storage. Works great, and easy for users to locate and mount shares with a solid and fast AFP connection. For home folders we extended our schema (which we were doing anyway) and added two extra attributes, “apple-user-homeurl” and “apple-user-homeDirectory”, which we populate with full paths using a script on the Windows side that at intervals reads the full path from DFS and updates the values mentioned. This way, the Windows clients get DFS based home folders, and the Mac users get the full path. This is kind of a hidden feature of the Apple AD plugin.

[b]man dsconfigad[/b]
[b]-useuncpath[/b] This flag determines whether the plugin uses the UNC specified in the Active Directory when mounting the network home. [b]If this is disabled, the plugin will look for Apple schema extensions to mount the home directory.[/b]

We are not trying to do portable home folders, but we do mobile accounts and would like the home folder to automount on login with AFP. Our setup works pretty good, but we still have some minor issues. I would be happy to tell you how we did it, once we are happy with the setup. I have already outlined a “howto” for it.

[thomasb]

I think I found a solution to this. Software Update has at least stopped nagging about that iLife Support 9.0.4 update.

If you run “sudo softwareupdate -d -a”, the iLife Support 9.0.4 update is actually split up into two packages.

Have a look inside [b]/Library/Updates[/b], and you should find these two packages.

[color=Blue]iLifeMediaBrowser_215.pkg
iLifeSlideshow_11.pkg[/color]

Put them into your InstaDMG BaseUpdates, and you should be good to go 🙂

[thomasb]

Still evaluating both products actually. Both have bugs at the moment, but DAVE works best in terms of DFS in the environment we have at work.

STAY AWAY from DFS if you possibly can. It is at the moment a really painful experience in Snow Leopard, as there are no rock solid solutions for the Mac yet.

In your case, I would much rather go for GroupLogic’s ExtremeZ-IP to get proper AFP sharing, than DAVE to get a better CIFS-client.

Here are some benifits: [url]http://www.grouplogic.com/products/extremeZ-IP/?fa=smb-cifs-comparison[/url]

DAVE does support ACLs, but does not currently display ACLs in Finder or in the Terminal (there is also an annoying bug caused by Finder if you use DAVE for DFS: [url]http://www.thursby.com/support/faq/?id=602[/url]).

You might find this information interesting:

Will ExtremeZ-IP work with a NAS or a SAN?
[url]http://support.grouplogic.com/?p=1687[/url]

Maintaining Native Mac File Sharing in an Enterprise Storage Environment
[url]http://www.grouplogic.com/resource-center/pdfs/Maintaining-Native-Mac-File-Sharing-in-an-Enterprise-Storage-Environment-A-Technical-Best-Practices-White-Paper.pdf[/url]

[thomasb]

@alantrewartha Note the “initial login” part of this KB tip. The first (initial) login of an AD user account on a freshly installed Mac does not get its kerberos ticket. That is what modifying the “/etc/authorization” file fixes. Subsequent logins of the same account on the same Mac will give you a kerberos ticket, even without modifying “/etc/authorization”, but it really should work at the initial login 🙂

[thomasb]

A little followup. Here is the script I use to rename byhost files for User Template and the root user at first boot (launched by a LaunchDaemon).

[code]#!/bin/sh
#
# This script will rename ByHost files
#
# Thomas Berglund, 09.12.08
# Thanks to hostdog74 at the unix.com forum for the directory traversing pseudocode 🙂

# Make sure script is run by root user
if [ “$(id -u)” != “0” ] ; then
echo “This script must be run by root user.” 1>&2
exit 1
fi

# Get the Universally Unique Identifier (UUID)
# ioreg commands found in a comment at https://www.afp548.com/article.php?story=leopard_byhost_changes
#
# Check if hardware is PPC or early Intel
if [[ `ioreg -rd1 -c IOPlatformExpertDevice | grep -i “UUID” | cut -c27-50` == “00000000-0000-1000-8000-” ]]; then
LEOUUID=`ioreg -rd1 -c IOPlatformExpertDevice | grep -i “UUID” | cut -c51-62 | awk {‘print tolower()’}`

# Check if hardware is new Intel
elif [[ `ioreg -rd1 -c IOPlatformExpertDevice | grep -i “UUID” | cut -c27-50` != “00000000-0000-1000-8000-” ]]; then
LEOUUID=`ioreg -rd1 -c IOPlatformExpertDevice | grep -i “UUID” | cut -c27-62`
fi

# Path to localized home directories
dirPath=”/System/Library/User Template”

# Find all ByHost direcotries
find “${dirPath}” -name “ByHost” | while read BYHOST
do
# Find all .plist files in ByHost directories
find “${BYHOST}” -type f -name “*.plist” | while read file
do
# Make new filename with new UUID
newName=”`echo ${file} | sed “s/\(.*\)\.[^\.]*.plist/\1.${LEOUUID}.plist/”`”

# Rename files
mv “${file}” “${newName}”
done
done

# Path to root directory
dirPath2=”/private/var/root”

# Find all ByHost direcotries
find “${dirPath2}” -name “ByHost” | while read BYHOST
do
# Find all .plist files in ByHost directories
find “${BYHOST}” -type f -name “*.plist” | while read file
do
# Make new filename with new UUID
newName=”`echo ${file} | sed “s/\(.*\)\.[^\.]*.plist/\1.${LEOUUID}.plist/”`”

# Rename files
mv “${file}” “${newName}”
done
done[/code]

[thomasb]

I see.

Regarding compatability, you still need to look at the files 10.5.x and 10.6.x create to be able to script them correctly. A script made for 10.5.x wont necessarily work for 10.6.x 🙂

I always compare preferences files created by the current OS version with the the ones I have in my package installers. If there are any differences, I make sure to update the package installers with the most recent files created by the OS. That way I avoid any scripting errors or compatability issues.

The ideal thing would maybe be to be able to make your own Setup Assistant, simliar to Apple’s MacBuddy, where the user can choose i.e. language and keyboard layout the first time they start their custom installed Mac.

[thomasb]

Be aware of this though.

[url=http://discussions.apple.com/thread.jspa?threadID=2170684]http://discussions.apple.com/thread.jspa?threadID=2170684[/url]

[thomasb]

Why script this when you can make Mac OS X do all the work of creating those xml plist files for you? All you have to do then, is to create a package of those plist files and put that into your InstaDMG build train.

[thomasb]

Yes, you need to rename the ByHost files. If you are using DeployStudio, the checkbox for renaming ByHost files is checked by default.

If you want to make your own script to run on first boot with a LaunchDaemon, you can easily do that too.

[thomasb]

Here is the [url=http://thomasberglund.no/misc/Localization-100210.zip]Localization[/url] package example, for those of you waiting.

[thomasb]

I find it safer and easier to just set all the initial settings the way I want them by hand, clean/modify the plist files with [b]Property List Editor[/b] and then install them with package installers. Scripting plist files with PlistBuddy/defaults can be a pain in the neck, and you will need to create the plist-files first anyway to be able to figure out how to create them with scripts.

I just uploaded an example package (Localization-100210) to the [url=https://www.afp548.com/filemgmt/viewcat.php?cid=12][b]User submitted[/b][/url] category here at AFP548.com – I guess it will show up soon. It should help you get the desired language and keyboard layout over the login window and for every new user account.

This tip will come in handy for editing those annoying .GlobalPreferences files: [url=http://www.macosxhints.com/article.php?story=20090915152215383]http://www.macosxhints.com/article.php?story=20090915152215383[/url]

I have a separate package for setting the NTP server(s) and timezone, which I guess I could have included in my localization package, but not this time. See this thread for more info on how to make an NTP/timezone package: [url=https://www.afp548.com/forum/viewtopic.php?forum=45&showtopic=21477]https://www.afp548.com/forum/viewtopic.php?forum=45&showtopic=21477[/url]

A lot of settings can be set using Local MCX too, which is an other interesting approach, but I feel Apple is lagging behind in terms of keeping Workgroup Manager up to date with new settings in Snow Leopard (i.e. Finder preferences). Since this localization package requires you to modify and install plist-files for both root, global Library and home Library, I find it easier to make a separate package for that purpose alone.

Good luck!

[thomasb]

The Norwegian Broadcasting Corporation (NRK) is using InstaDMG and DeployStudio for image creation and deployment. Feel free to mention us.

I wonder how many that use Apple’s tools for image creation for lagre scale deployment. You should ask the audience 🙂

Good luck at Macworld, Karl!

[thomasb]

We had smiliar experiences with ExtremeZ-IP and DFS at work. It looked promising on paper, but it did unfortunatly not work as expected for us either. After hours of troubleshooting, we decided to go an other route this time. We might use ExtremeZ-IP just for sharing out SMB as AFP, to get both better speed and lightning fast Spotlight searches on some SMB shares – we’ll see.

The way it looks now, we will go for Thursby DAVE for DFS support, until something better comes along. I really wish Apple and Microsoft could include built-in support for it in Mac OS X. The way it is now, as far as I understand, Finder makes it really hard for third party companies to give reliable DFS support. Thursby also have some issues http://www.thursby.com/support/faq/?id=602 but it still works better than ExtremeZ-IP for us at the moment.

We have used ADmitMac earlier, but since there are way more resources and documentation for Apple’s AD plugin, we will make the switch with Snow Leopard. Together with MCX via an extended AD schema, it looks like a killer combo. With Apple’s AD plugin you can also easily change the local admin groups for each client using the dsconfigad command – something which is not possible with ADmitMac (according to the support guy from Thursby I talked to on the phone). This makes it super easy to i.e. control/change what groups that should be allowed to be local admin and have remote access (ARD), with authentication via Active Directory (or Open Directory).

In addition we see issues with migrating from ADmitMac to Apple’s AD plugin + ExtremeZ-IP at a later time. Uninstalling ADmitMac must be done manually, and getting rid of all the ADmitMac cruft seems harder than expected.

Going with Apple’s AD plugin and Thursby DAVE, we are free and open to switch to any other/better solutions when ever they appear.

Just wanted to share some of my thoughts.

[thomasb]

I agree. MCX would be the best way to go.

If that is not an option and you do not want to use [b]/Library/loginwindow.plist[/b], you could make a LaunchAgent and put it in [b]/Library/LaunchAgents[/b]. That will work for local and network accounts.

[b]/Library/LaunchAgents/com.company.KeychainMinder.plist[/b] – with the permissions root:wheel 644 (-rw-r-r)
[code]

Label
com.company.KeychainMinder
ProgramArguments

/Applications/Keychain Minder/Keychain Minder.app/Contents/MacOS/Keychain Minder

RunAtLoad
[/code]
(Note: It seems like escaped spaces is not supported in launchd plists)

[thomasb]

Yes. Have a look at the two packages called [url=https://www.afp548.com/filemgmt/index.php?id=71]clearReg[/url] and [url=https://www.afp548.com/filemgmt/index.php?id=70]createUser[/url], found in the InstaDMG user submitted packages section here at AFP548.

I would recommend reading through the threads here in the InstaDMG forum category.

[Author]

Posts