Understanding Network User's Home Folder Location

Question

Level 1

46 points

Understanding Network User's Home Folder Location

I am somewhat confused as to the difference between setting a network user's home folder location as "Local Only" or as a shared folder. I researched this and found a number of documents including https://help.apple.com/advancedserveradmin/mac/3.1/#apd973935ea-5ca3-43fa-9962-1 ba4d343d730 but am still confused.

I currently understand this situation to be as follows:

1. If a network user's home folder location is specified as "Local Only" then the home folders a)will be located on the server b) will be available to the user only the user logs into the server from the server and c) will not be available to be synced to the client [because they are not available when logging into the server from a client].

2. If a network user's home folder location is specified as a shared folder then the home folders a) will be located on the server b) will be available to the user when they log into the server from any client and c) will be available to be synced to client. When the home folder location is specified as a shared folder whether they are or are not synced to the client is controlled in Profile Manager's OS X's "mobility" settings.

3. With respect to the above:

i) Am I correct in my understanding and, if not, then please correct it.

ii) Can a users //Server/Users/User Name folder be configured as a shared folder that can be "made available for home directories"?

iii) Can the "standard" share folders [i.e. Documents, Music, etc,] be configured as shared folders that can be "made available for home directories"?

iv) For security purposes is it better to a) have a different shared folder for each users' home folder or b) one shared folder for all users' home folder. The confusing / issue is whether one shared folder for all users' home folders creates a security issue in that it enables all users access to see what other users have in their home folders[which, as an aside, I think it would].

Thanks in advance for your help!

Joel

MacBook Air (13-inch Mid 2012), OS X Mavericks (10.9.1)

Posted on Aug 10, 2014 10:35 AM

Reply

Answer 1

Linc Davis

Level 10

209,535 points

Aug 10, 2014 3:17 PM in response to JoelcYYZ

"Local only" means that the user's login credentials are stored on the server, but the home folder is stored locally on the clients (not the server.)

Reply

Answer 2

JoelcYYZ Author

Level 1

46 points

Aug 10, 2014 5:21 PM in response to Linc Davis

Linc, appreciate the response...one follow up, are you aware of any documentation or references on this.

Thanks,

Joel

Reply

Answer 3

Linc Davis

Level 10

209,535 points

Aug 10, 2014 5:39 PM in response to JoelcYYZ

No, not really.

Reply

Answer 4

Aug 10, 2014 6:15 PM in response to JoelcYYZ

"Shared Home folder" means that each user's Strictly Private Home folder will be placed in a special folder on the Server, under their user-Short_name and next to other users' Stricly Private Home folders on the Server. It will be stored in a Directory ("Users" on the Boot Drive by default, but VERY frequently re-assigned to another Drive ) which is shared ONLY in the sense that lots of different Users' Home folders are stuffed in there. By design, there is no access to the files of one user from another user. Different mechanisms are provided to facilitate large-scale Sharing in the sense of Workgroups using shared files.

The single-station (no Server) example is similar. The Home folder for each user in a folder under their User-Short_name in "Users", but there is no talk of this being a shared folder, because only one user logs in at a time.

LOCAL:

The Admin on your Server is the best example of a local account. That ID is no good on any other Workstation on the Network, and the Admin's files are ONLY on the Server, and never available anywhere else.

Reply

Answer 5

JoelcYYZ Author

Level 1

46 points

Aug 10, 2014 6:24 PM in response to Grant Bennet-Alder

Grant, appreciate the response noting that I need to think it through a bot but it is getting me closer.

Joel

Reply

Answer 6

Aug 10, 2014 6:39 PM in response to JoelcYYZ

When it feels most baffling... you almost got it!

I moved my Network Users' Homes to another drive, and called that folder "NetUsers" so that I could be certain things were not being stored on the Boot Drive in "Users". It is a much easier concept to see the special treatment of "NetUsers" (I suppose you could call it a Shared folder) such as the system mounting it early for a newly logged-in user. Older documentation called it a "Share Point".

Network Users on older versions of Server were great for computer clusters. Any Users walks up to the cluster, logs in on any computer, and their files are instantly available. As an Admin, any computer from the cluster goes out for service with no worries about backups -- it has no User data on it! A hard drive dies? just install a new one with a new copy of Mac OS X.

The problem that is already here is that the computer cluster model is dated. Maybe even History. So the traditional way of doing it MUST expand.

The first expansion was to Mobile Users, where the users stuff was on their laptop, and it could be synced to the Server often -- except it took WAY too long to do that syncing, and it didn't always work perfectly.

The next big step seems to be Profile Manager, to put some controls on Bring-your-own devices in-exchange-for access to resources on the Network, such as Printing and Shared files.

Reply

Answer 7

Aug 10, 2014 6:56 PM in response to Grant Bennet-Alder

LOCAL:

If the current Server documentation is using the term LOCAL to refer to Users' home folder stored only on their own computers, that is VERY confusing, and clashes with the traditional meaning of the term, i.e, the Sever Admin is a LOCAL user account.

Reply

Answer 8

JoelcYYZ Author

Level 1

46 points

Aug 10, 2014 8:17 PM in response to Grant Bennet-Alder

Grant:

Appreciate the help, truly...love the comment "When it feels most baffling you almost got it"...love the NetUsers name for the shared folder that holds the users home folders to be certain things are not being stored on the Boot Drive in "Users".

RE: My current understanding, here goes:

There are three types of network users where the user type is based on the placement of the network users home folder. The three network user types are as follows:

1. Services Only: The network user has no home folders on either the OS X Server or the OS X device that is used to log onto the OS X Server.

2. Local Only: The network user’s home folders are created and stored on the OS X device that is used to log onto the network. The network user must therefore always use the same OS X device to log onto the OS X Server to avoid having different and multiple home folders created on different OS X devices [i.e. keep everything in sync].

This network user type results in the need to port / replicate the users’ applications, configuration settings, data, virtual machines, etc. [hereinafter collectively referred to as “desktop”] from their OS X device to the OS X Server. This can be accomplished per this document; or

3. Shared Folder: The network user’s home folders are created and stored in a shared folder on the OS X Server. The home folders are therefore i) available to the user when the user logs onto the OS X Server from any OS X device and ii) available to be synced / replicated to the OS X device [i.e. the syncing capability is configured in Profile Manager / OS X / Mobility].

The shared folder that is created for the creation and storage of unser’s home folders should be on a separate drive or partition from the OS X Server’s operating system. The shared folders that initially exist should be deleted.

The shared folder that is created for the creation and storage of users’ home folders is special. Though the users have read/write access to the shared folder the users’ home folders [which are sub folders to the share point] are “automatically permissioned” such that no user has access to other users hoe folders.

This network user type results in the need to port / replicate the users’ OS X device’s desktop to the OS X Server’s desktop as noted above.

Grant, am I still baffled or do I get it?

Reply

Answer 9

JoelcYYZ Author

Level 1

46 points

Aug 10, 2014 8:25 PM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

LOCAL:

If the current Server documentation is using the term LOCAL to refer to Users' home folder stored only on their own computers, that is VERY confusing, and clashes with the traditional meaning of the term, i.e, the Sever Admin is a LOCAL user account.

Grant:

And hence the VERY source of my confusion and frustration for the day....I spoke to Apple's Enterprise Support group who confirmed that the term LOCAL vis-a-vis the placement of a network users home folder means local to the OS X device that is bound to the OS X Server rather local to the OS X Server and accessible on from logon from the OS X Server...this explains my above description / response of the different network user types.

Thanks,

Joel

Reply

Answer 10

Aug 10, 2014 8:32 PM in response to JoelcYYZ

It sounds like you get it. My experience is with Network users, and that matches your #3. As Networks change, the stuff I spent time learning is no longer particularly applicable, except as a base for digging in again to understand the newer variants.

"Mobile users"/"Portable Home Directories" (where there is a User environment on the portable device, the portable device can leave the Network and still be managed, and it can be re-sync-ed with a copy on the Server from time-to-time) seems to be disappearing fast.

Reply

Answer 11

JoelcYYZ Author

Level 1

46 points

Aug 10, 2014 8:57 PM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

It sounds like you get it. My experience is with Network users, and that matches your #3. As Networks change, the stuff I spent time learning is no longer particularly applicable, except as a base for digging in again to understand the newer variants.

Great, it has been a confusing and long day...as non-IT professional the documentation needs to be better [i.e. there is no user manual for OS X] and the nomenclature needs to be note consistently used...and hopefully my initial configuration and install will go smoothly...all users will be setup as "Shared Folder" users [i.e. # 3 above].

Grant Bennet-Alder wrote:

"Mobile users"/"Portable Home Directories" (where there is a User environment on the portable device, the portable device can leave the Network and still be managed, and it can be re-sync-ed with a copy on the Server from time-to-time) seems to be disappearing fast.

Interesting to learn...and replaced by what paradigm and why?

PS. I am apply guys like you spent time larding the old stuff, learning the new stuff and spending the time to help hobbyist such as myself, I am truly thankful for your help.

PPS. The one other capability / thing that would be very helpful would be to combine the local login to an OS X device and a network login to an OS X Server...it would be great to be able to AUTOMATICALLY have the same applications, data, desktop configurations, virtual machines, etc. I suppose one would argue that i) this already exist through a network user login when not connected to the network and ii) the real issue is that I have / started with a local desktop setup that I spent a lot of time and effort configuring and I want it AUTOMATICALLY moved / ported to my network desktop to avoid the need to rebuild and iii) although an issue to me it is not an issue to most as most do not start with a local desktop.

Reply

Answer 12

JoelcYYZ Author

Level 1

46 points

Aug 11, 2014 5:51 PM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

"Mobile users"/"Portable Home Directories" (where there is a User environment on the portable device, the portable device can leave the Network and still be managed, and it can be re-sync-ed with a copy on the Server from time-to-time) seems to be disappearing fast.

Grant:

One more thing that popped into my head that I would appreciate your feedback on...the situation for which I will be setting up a network is one on which "most" users will be only be using their personal OS X device...this got be reconsidering / thinking about whether such users should have their home folders setup as "Local Only" [i.e. stored on their personal OS X device] as opposed to "Mobile / Portable Home Directories" [i.e. stored on the OS X Server but also replicated / synced to their personal OS X device] for performance purpose...this leads to the questions, when a "Mobile / Portable Home Directories" user is connected to the OS X Server then:

1. Is the OS X Server's Home Folder used or is the OS X Device's replicated / synced Home Folder used?

2. Is the user able to differentiate / tell which Home Folder is being used?

Thanks in advance,

Joel

Reply

Answer 13

Aug 11, 2014 7:04 PM in response to JoelcYYZ

The local folder is used. (I think because its always faster to access it.)

But any controls you put on the User are still enforced.

Reply

Answer 14

JoelcYYZ Author

Level 1

46 points

Aug 11, 2014 6:58 PM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

The local folder is used. (I think because its always faster to access it.)

But any controls you put on the device are still enforced.

Grant, thanks, very much appreciated...

Reply

Answer 15

Aug 11, 2014 7:06 PM in response to JoelcYYZ

The unusual case is when that same Portable-Home User connects to the Server, not with their own devices but with a clustered computer. They were then presented with a dialog (by default) that asked whether they would like to create a local Home folder on this device as well, using their account on the Server as the source to sync from. One choice was NOT to create a local copy, but to operate as a Network user, using the Home on the Server. If they did much more than checked their email or surfed the Web, then their Server Home could potentially be out-of-sync with the Home on their own device.

Reply