#Deploystudio server not visible Pc
#Deploystudio server not visible mac
#Deploystudio server not visible windows

This may or may not be desirable behaviour, but itвЂ™s easy to control if you know how. Secondly, remember the UNC Path checkbox on macOS bindings will, often, mount the parent folder of your network homes in addition to the userвЂ™s home folder itself (depending on your specific AD setup). If you struggle to get the permissions and inheritance formula right, you probably need to consider restructuring your folders to make your job easier. DonвЂ™t rely on Group Policy to manage access restrictions in a mixed environment.

#Deploystudio server not visible windows

Firstly, make sure if youвЂ™re in a mixed macOS and Windows environment that your Windows file server permissions are kosher and set correctly. But the Windows-centric IT provider was using Group Policy to prevent unauthorised access, rather than getting the core permissions right in the first place, thus masking an underlying problem. In our case, the permissions were being inherited very erratically such that most students could access each othersвЂ™ folders due to a very open read/write permission on the parent folder. You might reasonably expect a student to own their home folder and its contents, with staff members able to read/write, but nobody else able to access it. However, GPO does not apply to macOS workstations and this was masking an underlying issue where the user home folders were not having the correct permissions set on them. This was working quite effectively on Windows.

#Deploystudio server not visible Pc

So, what was going on? Further investigationДЄfter some investigation it transpired that the IT company who managed the Active Directory infrastructure was using Group Policy restrictions to disallow Windows PC users from browsing each othersвЂ™ home folders. If a student happened to know the network path to type in, not too difficult, they could in theory still access other studentsвЂ™ folders if they have permission. It occurred to us that really, even if the student couldnвЂ™t see their peersвЂ™ home folders, there must still be a permissions issue. However, this wasnвЂ™t the end of the story. Simply unticking this box on each of the macOS client machines stopped this behaviour from happening. As such, any student could easily browse to other studentвЂ™s home folders. With this box checked, the macOS client was retrieving a path to the student home folder parent directory, which was being defined by the AD server, and automatically mounting it. The checkbox says вЂњUse UNC path from Active Directory to derive network home locationвЂќ.

Active Directory bindingДЄfter some rummaging around, we noticed that the DeployStudio image being used had a checkbox relating to the Active Directory binding, which would usually only be visible in the Directory Utility app, if you were to interrogate the settings of the AD binding. It didnвЂ™t take long to notice that a given student could access those other studentsвЂ™ home folders.

#Deploystudio server not visible mac

When a student logged into the Mac with their Active Directory credentials, they would see not only their network home folder mounted on the desktop (this was auto-mounted using a login script) but would ALSO see the parent folder, containing all the other studentsвЂ™ home folders. The Macs were bound to Active Directory in the usual way though System Preferences > Users and Group > Login Options (which essentially is a quick setup that might otherwise require the Directory Utility app for more complex environments).

It turns out that all the student home folders were kept inside a single shared folder on the Windows server, which is fairly typical. Knowing very well that a group of teenagers would very quickly find 1000 practical jokes of varying degrees of offensiveness, taking advantage of this permissions problem, we were asked to fix the issue as quickly as possible. The client called us because, after a recent re-image of their base macOS system, they noticed that students could suddenly access each otherвЂ™s files on the main server. This left the client without a solution provider to manage ongoing upgrades and Mac system maintenance. We recently had a call from a school running a suite of iMacs on macOS Mojave 10.14.6.ДЄs is often the case, the previous Mac consultant had retired or disappeared for some other reason.