Wow, nice to FINALLY hear that someone else out there has the same issue.
Unfortunately, I have some bad news. I ended up working with Apple Enterprise Support on this issue for the better part of 3 weeks. I was preparing images for a large scale deployment and we had to make the call to go Snow Leopard before we were able to work things out.
In the end, after MANY emails, screenshots, and configs sent back and forth to this enterprise support technician I was working with, I was ultimately told they couldn't reproduce my issue "in the lab," so for continued work with this problem I was going to have to open an official case with Enterprise Engineering and work directly with them, however this had/has a HUGE price tag per incident. By this point, I had already made the call that our deployment would go SL for now, and to our dismay, I'll have to migrate people to Lion once we can make it work.
I've run all the Lion updates, have 10.7.1, nothing. No matter what, if I have Mount Network Home checked in WGM, the user gets prompted with a "select this share" window, and regardless, it still never mounts the real network home. I even tried making a new 10.7 server and seeing if that would work, but that was actually a disaster attempting to upgrade our config from 10.6 (and... in the end, it didn't work either). It shouldn't matter though as I was told by Enterprise Support that 10.7 clients should work "just fine" with 10.6 server. Again, in the end, nothing has made Lion work so far in our environment.
What version of Windows Server are you running? Since there seems to be so few people having this issue, I'm afraid it has something to do with Server 2003 which we are still running. Apple claims it's still supported (and it's working great with SL), but regardless, our "golden triangle" setup still doesn't work properly with Lion.
If you get anywhere, or anyone else out there has any ideas, please feel free to chime in. MANY hours have already been spent on this issue I'm dreading tackling this one when the time finally comes to make Lion really work.
Hmm, bad news indeed. It happens with ever lion client I've got. Only thing new in my environment is 10.7, so I clearly point the finger at it, but if they can't reproduce it sounds like it is not magically going to get fixed in 10.7.2
I've been looking around for info for weeks on it & yours was the fisrt post I saw matching my problem.
I don't control the AD in my environment, but I think we are 2008 R2 of some sort, not sure on its details at this time, We ran 2003 for the longest time & might still have it at that level
Yeah, I feel like it should be a more common issue, but like you said to me, you are the first person "out there" I've found with this problem (which worries me).
We have a rather substantial managed (OD/AD) Mac setup here and I have had relatively few issues the last 2 years with Snow Leopard and our OD (10.6 server) and AD (Win 2k3) servers and client integration/management. I started Lion testing as soon as it was available, and honestly, everything else (WGM wise) worked fine, but the network homes (and in-turn this login selection screen thing) were a mess. Use of our network drives was too crucial to press forward with out them auto-mounting.
I too fear the same fate that since they "haven't seen it" and "couldn't reproduce it" it's not going to just dissapear with 10.7.2, although I hear buzz that that will be a rather substantial update. If you (or anyone out there) finds anything please do share.
Same issue here.
We have the same sort of configuration:
* AD (2008R2) + OD (SL Server) triangle
* Clients provisioned via Deploystudio
* home folders are individually shared with the "$" sign at the back
* SL clients works perfectly ok
* Lion clients got the popup "Select the volumes you want to mount" thing every time the domain user logs in. (**** those new Macbook Airs, they can only runs on Lion !)
If the home folder shares are not hidden, the "select volumn" window still popup, but since the share is visible now, user can pick it from the list and mount it. then, the question mark on the dock replaced by the mounted home folder, as it should in the first place.
Well neoseele, that is pretty much exactly what I see, and that is very similar to our setup. We too use DeployStudio to deploy all the images, so there's another common thread. It's interesting that it's now confirmed that it can happen with Server 2k8 and 2k3 (as you've mentioned you're on 2k8). I have also done the exact same experiment with unhidden homes, and know the exact scenario you are describing. I feel then it is something in the way Lion is calling the drives.
I also hear you on the new hardware... While we aren't running any Airs, we just installed a bunch of new Mini's in a whole bunch of classrooms here. There was some promising info about people putting 10.6.8 on the new Apple Mini's (downgrading from Lion), but when I experimented with it (and succeeded), it just totally sucked to be frank. Really slow, buggy, and had some really weird quirks. In the end, even though as you may have read, I went with SL for our mass deployment this summer, I have been forced in this past week actually to make Lion work.
While I haven't made the exact issue of this thread work (again, welcome anyone's suggestions on real network homes), I did come up with a clunky but functional workaround (since we were forced to make Lion work... now). I noticed that if you mounted a SMB share via the "Items" in "Login" under WGM, it would work fine (none of this "select a volume" junk at login). Now, this has to be a static path, it cannot pull/generate a direct path to an individual user's network home, however, I "went up the tree" to the closest static path that contained the users network homes. In other words, by creating a share, that has ALL the hidden shares in in, you can mount that one share. THEN, if your permissions are correct, it is setup so they login to lion, this one static SMB share is mounted, and when they open it, there is one folder (that the users can see) that is their network home. Now, there are some side effects, for example, if your permissions are not correct, someone could view or access someone else's network home (again, cannot emphasize proper permissions using this method, I had to do a lot of auditing to make sure things were more-or-less secure). Or, if you are an administrator and you log in, you see everyone's network home, since you have permission to. So, like I said, clunky, but, our users can access their network homes on Lion now.
Let me know if you want any other details, it can be hard to describe well someone's exact setup. Glad to hear there are more out there with this issue. It is clearly a Lion bug.
Agree, my friend. Its a nasty bug for sure !
I've tried the workaround you mentioned, but can't quite achieve the same result. The "select volume" thing still pops at login. Maybe our configuration is slightly different?
I've got the impretion the anonying popup comes from AD. If you go to WGM on the SL Server, switch the directory to "/Active Directory/All Domains", pick any user, go to preferences >> login >> items, the "add network home share point" option is ticked, which puts the 'Network Home Share Point' volume in the list. Unfortunately I can't change anything here since our AD's schema can't handle Macs.
So I switch to "/LDAPv3/***", add the dummy AD user to a test group, go to the test group's preferences and add the smb share of the parent folder (where all the user's home folders physically located) to the login items. (I notice that the smb share can only be added as kind: "URL" instead of "Volume", but it seems to be mounted correctly when I test it.) Then try login as dummy user on a Lion, "select a volume blah blah blah", no luck.
I just wondering how did you mount the smb share via WGM, are we doing things differently? Since the "add network home share point" cannot be unticked under "/Active Directory/All Domain", did you guys found a way to override it or some sort?
Neoseele, it appears we have something different because we have nothing ticked under the AD side of the users. So you are saying if you go to AD/All Domains, and set preferences at the user level it will attempt to enact those preferences? I guess that makes sense at a user level. My training had me never do any sort of preference setting in AD, instead doing it all with LDAP/OD. So for us, the network homes are mounted at the OD group level.
First, I make an LDAP/OD user group, and add all the AD users and groups I want to it. Then I manage their preferences all via LDAP/OD and never touch anything on the AD side. So, I go to the same place you mentioned (Preferences > Login > Items) but under LDAP, and when I UNcheck the add a network home, I don't get the annoying pop-up "select a volume" at login. This means, to make it work right, I had to completely restructure how network homes were mounted.
I initially had them mounted by OD group, so when an AD user (in an OD group) logged in on a managed mac, it mounted the network home. Now I have it mounting homes by computer group. So, when a user logs into a specific computer, if it has SL, it uses the nice network home feature and looks great. I made a new container for the Lion machines and have that UNchecked, and instead use the method I previously described. This also assumes that you have your computers managed in WGM, and that you have them organized in some way (say, by type, location, etc). It is more work, but it allows us to get very specific with our different macs, labs, locations etc.
You are correct that you have to use it as a URL and NOT a volume... for some reason, but it works.
So, to answer your question about "overriding" the AD, I don't have that because we have no preferences at all on the AD side of things, only LDAP. I went and looked again just now and all the preference settings on AD are just blank/default for me. So, I'm not sure how you would go about unchecking that, but ours are unchecked by default(?).
All that said, again, when we were setting up our whole golden triangle and I was being trained by Apple etc, the methodology was never to touch AD for specifics, but to utilize OD groups, populated with AD users. I am SURE there are many ways to do it though, and mine may not be the best, but it's basically all we/I've known since we started two and half years ago.
I hope some of this helps, but, let me know if I can clarify more.
Let me clarify. Changing user's preferences directly in "AD/All Domains" directory is impossible unless the required attributes are added into the AD's schema, which we didn't do. WGM, by default, at lease in our case, "thinks" some preferences for the AD's user are managed by "AD/All Domains".
Pick any AD user in the AD/All Domains directory, click "Preferences", in the "Overview" tab, 3 preferences are appeared to be "Managed":
* Dock (add network home to the dock)
* Login (add network home share)
* Mobility (require confirmation before creating mobile account)
All of these are "managed" by default and cannot be "unmanaged"...
However, these managed preferences do match the default behaviour when a AD user log into a Mac that joined to the AD: mount the home drive and place it in the dock.
I have no idea why you guys can't see anything in the "AD/All Domains", maybe its the 2008R2 thing, after all this is the biggest difference between yours and ours.
Great discussion, did you get anywhere with this issue? I'm running Server 2003 AD with home directories pointing to a samba share for each user, which is hidden from the other users and am continually getting the "select the volumes you want to mount" at login and also during sync which is pretty annoying as if you select the wrong share on the latter it breaks the sync.
Snow Leopard clients working perfectly fine.
The problem, as far as I can see, it the way this new implementation of samba mounts volumes.
If the home directory is under //server/someplace/homedirs/$username$ and your share happens to be //server/someplace/ then the client is unble to mount the subdir as a separate volume, hence the homedir mapping fails. According to Apple while the mount of a smb/cifs resource is now working this way using "Connect to server" it still work the olr way using mount_smbfs from Terminal. However the login process with AD seems to prefer this new way and I haven't figured out yet a way to automate the homedir mount using mount_smbfs.
Read this on MacWindows: The issue incompatibility arises from Apple dropping support for most authentication types, including the widely used DHX (DHCAST128) and clear text. Lion now uses only DHX2 authentication. Apple's workaround is to use the command line in Terminal to turn on other authentication methods. (More specifically, to remove the older authentication methods from a disabled list.)
I've not found this successful as yet, but others seem to. It affects both SMB and AFP.
Do you mean this Kirk?
It seems to only apply to AFP shares, unless you can repalce all AFP references with SMB?
On another note I seem to have resovled my problems, I'll try to summarize my scenario and resoloution below for anyone still looknig for help.
Scenario: Fedora server running Samba, (not sure ver, but same problem with latest ver on a test box), Snow Leopard Mac's able to work fine. Lion Mac's refuse to mount correctly when AD user accounts are configured as thus-
Profile path = \\servername\usersshare\profile
mount home directory to Z:\ = \\servername\usersshare
Resoloution: This seems so stupidly easy, change the 'mount home directory' path to a subfolder of the share e.g. \\servername\usersshare\newfolder
Like to confirm this is the case in 10.8.2 as well. Looking at it they, Apple, have changed the way network home works too. This now mounts the /home folder as a hidden share and maps the users home into this area, which seems to hide as part of the parent folder.
We have two sites where this is happening one is a 2003 AD server with Mountain Lion OD server for management, and one is a 2008 R2 AD server with a Mountain Lion OD server for management. The issue occurs in both locations, except for when you enamle mobile home then it will map the share correclty but point all folders to the local created folder.