Network user permissions and security

We seem to have a permissions issue using the DIR
command.
We have a process that runs in SQL Server which executes a DIR command on the local network using a UNC path to check that the files generated by another system are all there, as part of an audit report.
Until this morning all was fine and dandy, we had no issues.
Last night the IT guys tightened up some permissions on the target directories for security.
Now a dir \\server\shared\dir_name fails with an
Access is denied error.
We can run this command against the local drive or alternate network UNC paths with
no problems.
We have the same issue whether we run from within SQL Server using xp_cmdShell or from the Command Prompt (after logging in to the server with the SQL Server account).
When logged into the server with the account in question, it is possible to browse the network, so Explorer permissions are ok
So it is not related to the SQL Server, nor is it related to the SQL Server Agent account.
It is specific to the rights of one network directory.
Thing is the sql server agent account is part of a domain group that DOES have Dir permissions on the target network directory.
We also can no longer use Dir against that network share from our own accounts, even though we are in a domain group that has Full Permissions on the directory!
So what is going on here - is it possible that somehow the Dir command has been blocked on that one directory share for just the SQL Server agent user?

I was a bit puzzled ab about the proper location to ask this question, but I think this forum would be the best location to ask:
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/home?forum=sqlkjmanageability
Kind regards,
Margriet Bruggeman
Lois & Clark IT Services
web site: http://www.loisandclark.eu
blog: http://www.sharepointdragons.com

Similar Messages

Network user ID and Domain in HR infotypes

Hi,
I have an requirement to retrive network user id and domain based on SAP user id from HR infotypes. Does anyone knows in which infotype can i find these fields.
Regards
Hema

Hi Hema,
1.
Infotype :0105.
Database table for that IT :PA0105.
2.
Write Select query like this .
SELECT pernr
from PA0105
into l_pernr
where subty = '0001'
and usrid = SAP user ID
and begda le sy-datum
and endda ge sy-datum.
SELECT usrid
from PA0105
into l_usrid
where Pernr = l_pernr
and subty = '9NWI'
and begda le sy-datum
and endda ge sy-datum.
I hope that u will do it .
Thanks,
Venkat.O

Difference between Share Permissions and Security NTFS Folder Permissions

What is the main difference between share and security in
1. 2003 server and above:
2. How in Organisations share data folder for users
AS per me i Have following conclusion
1.
Yes - Always open up Share permissions to Everyone-Full and the ACL (apply permissions) to the actual data
folders (must be NTFS). With NT4 and W2000 you can leave the Share permissions at default when you create them and just ACL the NTFS data structures.
With W2003, the default Share permission is locked down to Read, and as Share permissions over-ride NTFS permissions,
even if you have Write access in the data folders, accessing via the Share will restrict to Read-Only, so you must open up the Share permissions on all new W2003 Shares that you create.
2.
Yes you can. Share the top level directory of your data. Open up the Share permissions to Everyone - Full,
and then ACL the sub-folders appropriately for you different user access requirements. Don't permission (ACL) any data with 'Everyone' always use Groups (or users if you must...e.g. Home Directories), and at minimum for 'public' data use 'Authenticated Users'.
Users will all be able to access the share, but only access folders and data that you allow via the NTFS permissions (ACLs).
The only other way is to create separate shares for each different access requirement - a pain and none too
flexible. Also if with W2K3 you leave the default Share permission (Read), even though you grant 'Write' NTFS permissions on the data, your users won't be able to write new data or make changes if they access via the Share, as Share permissions over-ride the
NTFS permissions.
If You have any other options so please suggest me or otherwise mark it as Answer

Sounds good. :)
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Administration Menu Localization of User Permissions and Titles of DataGrids into the Roles and Users screens.

Hey LightSwitch Team,
I have a LightSwitch Web Application, that is already localized (en-EN and de-DE). Now I have the requirement to localize the names of the User Permissions into the Administration Screen (this is built-in functionality). How can I achieved
this?
Another Task is to translate the Titles of the DataGrid into the Users Screen and Roles Screen (Administration Menu), because they are in english language, instead of german (i.e. 'User and Groups', instead of 'Benuter und Gruppen' or 'Users
and Groups in this Role', instead of 'Benutzer und Gruppen dieser Rolle').
In addition of this the User Permissions are in the english language too. How can I translate all of them?
Note: Another texts are already localized (e.g. 'Rolle von Gruppe geerbt').
Many thanks. Any help would be greatly appreciated.

Hi AndySta,
Welcome to lightswitch forum.
According to your description above, if you want to localize your lightswitch application, you need add a localized resource file, add a Resources File, and then name it Client.de-DE.resx, then call a resource from code. Check out
https://msdn.microsoft.com/en-us/library/xx130603.aspx
for further information.
Best regards,
Angie
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

User Authorizations and security

Hi,
 I need to know that , is it required to give SAP_ALL to functional consultants and ABAP developers user id created , or there are some different set of roles to be created. where do I find these security best practices , so that I can implement them.
Regards
Puneet

Sathi,
Yes, you can in fact do this...it is a fairly involved process but once done it works very well.
Remove ALL authorization objects pertaining to BUKRS (in this particular example you only want to limit users to a company code) from your role. We'll call this first role ZT_role. You will have your transaction codes in here.
You will have a number of other authorization objects that you could do this same thing with. We are currently not only doing this with company code, but cost center/profit center, plant and several more. The process is the same. If you don't want to allow certain users access to a company code, plant...etc. pull the auth obj out of the transaction role.
Next, create a brand new role WITHOUT T-CODES in it and name it something like ZD_Locking_role (whatever you want to call it...but in a sense you are locking users down with this role).
In this 2nd role you will need to manually enter each Authorization Object that uses BUKRS from your 1st role and then add in the company code(s) you want to allow people to see (again...manually add those auth objects needed as mentioned above for cost center/plant etc.).
Now, you shoudl be able to assign the 1st AND 2nd role to a person. Now, they will will only be able to see the company codes you placed in the locking role.
If you only assign the 1st role, they will not be able to view/change by company codes. By adding the second role, the SAP system checks the auth object against their entire profile in their master record and should allow them work fine.
Good luck!
For those that care...
We not only do the above, we took it many steps further. We created derived roles broke those down to display only and create/change roles. In other words, the locking role would read something like Z_DISPLAY_XXX or Z_CRT_CHG_XXX (where XXX is the company).
User roles assigned to associate Joe Smith - As an AR Manager this person needs access to ALL AR function for creation/display and change but only allowed to display all AP documents and not change all within company code XXX:
 Transaction roles:
ZT_AP_DISPLAY role (AP needs to run XK03 or XK04...any and all t-codes are locked down to display only! [03 or 08...etc.])
ZT_AR_MANAGER role (AR Manager needs to display (only) AP stuff but not be able to change. They also need to be able to perform all other functions (create/change) as an AR Manager)
 Locking Roles:
ZD_DIS_BUK_XXX (XXX is company code) [display only]
ZD_CRT_CHG_BUK_XXX (XXX is company code) [create change]
With a thoroughly thought out system you can have a very sight system while being able to allow user the versatility to see only certain information.
Good luck!

File Permissions and security - sharing with FW externally booted Linux

I want to be able to access my Music folder and others on my Powerbook's internal HD from my Linux OS (Kubuntu 9.04) which boots from an external Firewire drive.
It worked fine when I changed the permissions in "Others:" to "Read Only", but I am afraid that this makes me vulnerable to having files stolen so I changed it back... Am I correct in assuming this?
Is there a way that I can add Read/Write permissions to my Linux user account?
Thanks ahead of time.

I did this with NFS, but I haven't tried it from a shared harddrive.
how should I do if I want the permissions to work in both OSes?
You can change the permissions of files and directories in either OS.
I suggest that you make a complete backup of your system. You should create a second administrator account from which you use to change your original account. You should log out your original account before proceeding.
Mac OS X ... harddrive -> Applications -> Utilities -> terminal
Ubuntu ... Applications > Accessories > Terminal
Your current user is:
echo $USER
Let's assume myuser
To find out your UID and GID do:
ls -ln
ls -l
Or, you can use the id command.
id
compare the output and write down what you find.
You best use the numeric value for your userid. In this case it is 500. To list all the files owned by a userid do:
sudo find / -user 500 -exec ls {} \;
# adding a -x before the / limits the search to the current file system.
Mac OS X ... harddrive -> Applications -> Utilities -> NetInfo Manager
In the middle column is the function. Pick users then select your user. Click on the lock at the bottom of the panel. Go into the property list and change UID and GID.
In the Ubuntu terminal,
man 5 passwd
... will give you the format of the passwd file.
sudo nano /etc/passwd
... the format is user-name, password, uid, gid, ...
control-o
... to save
control-x
... to quit
The groups are defined in /etc/group
cat /etc/group
Now change the UID and GID of all files:
You best use the numeric value for your userid. In this case it is 500.
sudo find / -user 500 -exec chown 1100:211 {} \;
/* Where chown has the format of chown uid:gid file-name */
/* adding -print before -exec lists the files that will be changed. */
/* You may want to leave off :211 if your uid & gid are not paired. */
/* Notice the -exec runs another command on the found file. */
sudo find / -group 20 -exec chgrp 211 {} \;
On the Mac you get into single user mode by holding down command-s when you poweron your machine. Just in case you run into problems.
On Mac OS, there are a few files that have the old uid as part of their names. The .Trashes file will be only removal media and maybe everywhere.
/.Trashes/501
/Library/Caches/com.apple.IntlDataCache.501
/Library/Caches/com.apple.IntlDataCache.sbdl.501
/Library/Caches/com.apple.user501pictureCache.tiff
On Linux, there are a few files that have the old user name as part of their file and folder names:
Here is another explaination of the procedure. ( It misses some file because the auther checks only the most likely places.
http://lissot.net/netinfo/change_user.html
Robert

Network User ID and User Password

When I try to connect to the IMAC on my Windows network, I can find the IMAC but I cannot log in to it. I have tried all the Users set up on the IMAC but nothing seems to work.
What do I need to do?

Hello and Welcome to Apple Discussions.
Have a read of the instructions that iFelix provides on his web site. Last time I had to network with a Windows PC they had me up and working in a couple of minutes.
Let us now how you get on.
cheers
mrtotes

User Audit and Security log

Hello Experts,
We are using an ECC 6.0 systems. My question is apart form SM19 is there any other t_code to trace the user action that is a more detail trace on user action.
As you know SM19 settings will offer us the basic action of user that is what t_code or reports are being used by user. But I want to know what are they doing there that is they are trying to access some infortype in t_code like PA30 or they made in table definition change in SE16 like that.
Please let me know about this.
Thanks in advance.
Regards,
Partha

Hi Partha,
You can use the following TCodes also.
1. STAD
2. STAT
STAD and STAT can also be navigated from ST03N. If you want to log a particular TCode (for e.g. PA30), then please follow the below steps:
Go to ST03N -> Expert user mode -> Collector & Performance DB -> Workload collector -> Parameters.
Enter the transaction codes for the transactions to be analyzed in detail in the Create transaction detail profiles for group box. Save your changes. (please read the message carefully in this screen).
3. STATTRACE
4. SM21
If you are in SM21, then please select all the options in "Settings" radio button. After getting the display of Log screen, you can further analyze a message in more details by double clicking it.
Still SM20 is really a good choice to view user actions.
Please re-check (in SM19) that all the Audit Classes are selected for the current filter you are analyzing. Before reading the audit log make sure to include all Instances (telling this, just to be sure).
Mark all in "Events" and "Statistic" tabs. Now display the data selecting the particular user and tcode.
Hope this discussion may help you to some extent. Please let me know for any more query.
Regards,
Dipanjan

Mavericks (10.9.5) time machine and server 3.2.1 user permissions conflict

We are using a Mac mini Server (mid 2010) 2.66 GHz Intel Core 2 Duo, 4GB 1067MHz DDR3, NVIDIA GeForce 320M 256MB machine. There are 2 500GB hard disks which have each been partitioned into 2 separate logical disks of 250GB each (in total 4 logical 250GB disks).
We having been using this server to file share on the local network for years using Snow Leopard, Lion and Mountain Lion (although there were teething problems with Mountain Lion using the new Server app).
After experiencing some issues with an iCloud password change and App Store failing to load, we decided to try updating to Mavericks. Upon update we were prompted to update the Server app to Mavericks version (Server app 3.2.1), this seemed to work to begin with, preserving file sharing and network user records and permissions, however we soon started to experience issues with permissions and Time Machine. We noticed that the Open Directory set up to store our network users was no longer available in the Server app and so decided to erase one of the alternate partitions and perform a clean install of Mavericks and Server app 3.2.1. This proved to produce the same issues with Time Machine permissions and also difficulties with the shared folder permissions.
Any help with this would be greatly appreciated.
Thanks

Hi Linc,
Thanks for the reply.
The Time Machine folders shown are from the Server app Storage tab which shows all connected hard drives. I haven't set TM drives up to be shared and hopefully the following screenshots will illustrate the current setup. This setup was created from a clean install of all involved software i.e. drives were erased and setup from scratch and the TM drives were simply connected and TM took control from there.
As you can see from these screenshots, when viewing the permissions through the Server app, there appears to be an extra user when compared to the OS Get Info window.
After leaving TM to its own devices over the weekend, I was greeted with a 'preparing backup' message this morning(Mon 13th October), with a last backup completed on Sat 11th October at 15:19:16. Stopping this backup and starting a manual backup has now resulted in a new, never before experienced error message stating that the backup disks can not be found:
Console reports:
I must re-iterate, the disk was erased and simply connected and Time Machine did its thing. Now as 'admin' it is clear that the folders created by TM do not have permissions so that I can simply view them in Finder, but does this directly affect TMs ability to access folders it has created itself?
One useful bit of information I seem to have neglected is that the erased TM drive is encrypted, however the password was entered when the drive was connected to the machine and there has been no prompt thereafter.
Please help. Only other comment I can make is that before the update to Mavericks and Server app 3.2.1, none of this was a problem.

Issue in User Management and Permissions

Hi,
There is an issue found while working on user management and security. When an asset is uploaded to the DAM, even with create and modify permission it is not able to edit.
While analyzing, it was due to the following reasons.
When given “MODIFY” permission to the root folder, it is not applying to all the asset in that folder and sub-folders.
We have to provide “MODIFY” permission for each asset, in this case it won’t apply for newly added asset.
When given “DELETE” permission to the root folder, “MODIFY” permission is applying automatically to all the asset in that folder and sub-folders.
But “myRole” only should modify the asset but not delete.
Is it CQ functionality or an issue.?
Note: Using CQ5.5 version
Regards,
Fazz

In CQ5.4 "MODIFY" permission at folder level is enough for modifying the assets under that folder. But in CQ5.5 "MODIFY" permission is necessary for every asset for editing.
Regards,
Fazz

Network Health and Security Check

Are there any good tools to run and test Network health check and Security weaknesses? The customer has mixed vendor environment.
Thanks,

Have a look at nessus:
http://www.tenable.com/products/nessus/nessus-download-agreement
Regards
Farrukh

Network users can not read Applications or Library

Not sure exactly where to post this but I think the server section will have more expertise than the desktop section.
We have 10.5.4 clients authenticating against a 10.4 Open Directory master. Prior to upgrading the clients to 10.5.5 everything was working fine. After upgrading the clients network users could no longer read the Applications or Library folders. When logging in all the icons in the dock would be replaced with the generic application icon and when trying to launch one the system reports the application could not be opened because it may be damaged or incomplete.
Viewing the iMac hard drive in a Finder window the Applications and Library folders have the do not enter sign on them. Viewing Sharing & Permissions under the Get Info window as the local admin user shows Read & Write for system and admin and Read only for everyone. This looks correct.
An `ls -l` on the root directory in Terminal as a network user reports that Applications and Library do not exist (no such file or directory). When running `ls -l` as the local admin the two folders appear and have a + sign after their permission strings which indicates extended security attributes (an ACL). I cannot find a command line tool to display or manipulate ACLs (such as getfacl and setfacl in Solaris) other than fsaclctl which enables and disables ACLs for an entire filesystem.
I disabled ACLs for the root fileystem (sudo fsaclctl -p / -d) and then network users could read the Applications and Library folders without problem. So there must be something in the ACL for those two folders that is restricting network users.
One other thing I noticed was that I tried to add a network user to Sharing & Permissions under the Get Info window, I could search for network users in the pop-up window but they would not get added to the list when I clicked select. So perhaps the problem is not with the ACL on Applications and Library but with 10.5.5 somehow not recognizing network users.
Installing Security Update 2008-007 does not resolve the issue. In fact it re-eanbles ACLs and they have to be disabled again in order for network users to work properly.

I eventually managed to fix it again - don't know exactly what broke it and what resulted in a fix.
Check what groups your network users are in, in a terminal enter the command:
groups <username>
My machine was only reporting the primary group of the user - none of the secondary groups were listed. This machine has a Open Directory custom mapping to force local home folders (a special case, we generally use NFS homes), and when I removed and re-added this mapping (rebooting in between changes) the groups command began to work correctly again and access to these folders was restored.
I was able to confirm that the ACL was the problem, removing it allowed the network users to gain access, restoring it broke it again.
BTW, the error messages you got when you ran the ACL removal chmod command are nothing to worry about, these are just device special files (representing hardware devices in the filesystem), I doubt that ACLs can be setup for these.

Problem resetting user permissions- CMD R not working

Hi,
Thanks in advance to those willing to lend some help!
GEAR:
2.53 GZ Core 2 Duo Mini running 10.8.5 All updates done.
I believe I have a current Time Capusle backup at my disposal.
New Macbook Air available to help.
ISSUE:
In the last couple of days I seem to be losing permissions to do things in my user profile which is the admin. Can't dump anything to trash without a password, mail will not open as it doesn't have permission anymore, can't move files around from folder to folder, Excel won't save as it is now read only, Firefox won't open as it thinks there is already an open version...Messages won't sync properly anymore or access address book to bring up peoples names to match the phone numbers... etc..etc.
Research showed the problem is likely user permissions and the cure is resetting. Knowing this has to be done via terminal after a COMMAND R boot into recovery mode I have tried everything to make this happen. No go! Apparently the partition required to boot into recovery never happened during install as the computer insists it is not there. Worse it will not default to internet recovery either. When I hold OPTION and boot I have only the HD visible and no recovery option to choose from.
I have created a 10.8 USB recovery stick (on my mac air) and can boot to that on the mini but there is no terminal option (as far as I can see) to allow me to reset the permissions. I also tried to boot to an old Leopard CD hoping that might work.. nada.
I have done a verify disk and repair disk permissions. All good. The computer works 100% fast and proper if I login under a new user profile so my issue appears not to be hardware related at all.
Given that I can't CMD R into any recovery is there any other way to reset these permissions?
Anyone know what would cause this to happen?
Thanks!!
Dave.

In light of the fact there are other things Etre noted as issues I posted the lot. Sorry it's longer but thought I may lead you in the correct direction.
EtreCheck version: 1.9.13 (49)
Report generated 13 August, 2014 11:05:31 PM EDT
Hardware Information: ?
Mac mini (Late 2009) (Verified)
Mac mini - model: Macmini3,1
1 2.53 GHz Intel Core 2 Duo CPU: 2 cores
8 GB RAM
Video Information: ?
NVIDIA GeForce 9400 - VRAM: 256 MB
Acer H233H 1920 x 1080 @ 60 Hz
Acer H233H 1920 x 1080 @ 60 Hz
System Software: ?
OS X 10.8.5 (12F45) - Uptime: 0 days 1:45:51
Disk Information: ?
ST750LX003-1AC154 disk0 : (750.16 GB)
S.M.A.R.T. Status: Verified
disk0s1 (disk0s1) <not mounted>: 209.7 MB
Mac Mini HD (disk0s2) / [Startup]: 749.81 GB (467.41 GB free)
PIONEER DVD-RW DVRTS08
USB Information: ?
LEXAR ImageMate RW022 Reader 15.93 GB
S.M.A.R.T. Status: Verified
disk1s1 (disk1s1) <not mounted>: 209.7 MB
Untitled 1 (disk1s2) /Volumes/Untitled 1: 7.97 GB (7.93 GB free)
Recovery HD (disk1s3) <not mounted>: 650 MB
Apple, Inc. Keyboard Hub
Apple Inc. Apple Keyboard
Apple Computer, Inc. IR Receiver
AKM AK5370
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Gatekeeper: ?
Anywhere
Kernel Extensions: ?
[loaded] com.iospirit.driver.rbiokithelper (1.7.2) Support
Problem System Launch Agents: ?
[failed] com.apple.CalendarAgent.plist
[failed] com.apple.tccd.plist
Launch Daemons: ?
[loaded] com.adobe.fpsaud.plist Support
[loaded] com.bombich.ccc.plist Support
[loaded] com.microsoft.office.licensing.helper.plist Support
[loaded] com.oracle.java.Helper-Tool.plist Support
[loaded] com.oracle.java.JavaUpdateHelper.plist Support
Launch Agents: ?
[loaded] com.oracle.java.Java-Updater.plist Support
User Launch Agents: ?
[loaded] com.citrixonline.GoToMeeting.G2MUpdate.plist Support
User Login Items: ?
Dropbox
Internet Plug-ins: ?
Flip4Mac WMV Plugin: Version: 3.0.0.126 - SDK 10.8 Support
FlashPlayer-10.6: Version: 14.0.0.145 - SDK 10.6 Support
JavaAppletPlugin: Version: Java 7 Update 65 Check version
Flash Player: Version: 14.0.0.145 - SDK 10.6 Outdated! Update
RogersOneNumber_68286: Version: 1.0.68286 - SDK 10.5 Support
QuickTime Plugin: Version: 7.7.1
SharePointBrowserPlugin: Version: 14.4.1 - SDK 10.6 Support
Silverlight: Version: 5.1.20125.0 - SDK 10.6 Support
iPhotoPhotocast: Version: 7.0 - SDK 10.8
Audio Plug-ins: ?
AirPlay: Version: 1.7 - SDK 10.8
iSightAudio: Version: 7.7.1 - SDK 10.8
iTunes Plug-ins: ?
TuneUp Visualizer: Version: (null) Support
Quartz Composer Visualizer: Version: 1.4 - SDK 10.8
User Internet Plug-ins ?
CitrixOnlineWebDeploymentPlugin: Version: 1.0.105 Support
3rd Party Preference Panes: ?
Candelair Support
Flash Player Support
Flip4Mac WMV Support
Java Support
MacFUSE Support
Tuxera NTFS Support
Time Machine: ?
Skip System Files: NO
Mobile backups: OFF
Auto backup: YES
Volumes being backed up:
Mac Mini HD: Disk size: 698.32 GB Disk used: 263.01 GB
Destinations:
Data [Network] (Last used)
Total size: 2
Total number of backups: 162
Oldest backup: 2012-01-06 09:53:34 +0000
Last backup: 2014-08-14 02:24:59 +0000
Size of backup disk: Adequate
Backup size 2 > (Disk used 263.01 GB X 3)
Time Machine details may not be accurate.
All volumes being backed up may not be listed.
Top Processes by CPU: ?
 51% CalendarAgent
 4% WindowServer
 4% syslogd
 3% Dropbox
 1% activitymonitord
Top Processes by Memory: ?
434 MB WebProcess
156 MB PluginProcess
115 MB mds
90 MB ReportCrash
90 MB Finder
Virtual Memory Information: ?
5.08 GB Free RAM
1.76 GB Active RAM
103 MB Inactive RAM
822 MB Wired RAM
561 MB Page-ins
0 B Page-outs

User Name and Password screen

We are currently trying to access an application but receive a pop-up window prompting for the Network user name and password. I don't want this to occur for the application. Can you please tell me where I have set this up and how to remedy this problem. I am using WebLogic 5.1 sp 5 and accessing the server via a NSAPI plug-in on a iPlanet 4.1 sp 7 server. Thanks,Stephanie Lester

Do you have a LDAP server? or did you activate the security on Weblogic?
Does your I-planet has activated the security?
Stephanie <[email protected]> wrote:
We are currently trying to access an application but receive a pop-up
window prompting for the Network user name and password. I don't want
this to occur for the application. Can you please tell me where I have
set this up and how to remedy this problem. I am using WebLogic 5.1
sp 5 and accessing the server via a NSAPI plug-in on a iPlanet 4.1 sp
7 server. Thanks,Stephanie Lester

Network Users with network homes not really working for me

I have with great pain setup a OS X Lion server on a Mac Mini that was supposed to be my central server to have 4 network users accounts and all the users data is stored on an external disk array with mounted network homes to the 2 iMacs and 2 Macbooks I have in my home.
I have gotten it all working and all my Macs are joined to the Open Directory and each User can login as a network users on any of the Macs and get their files via mounted home directory from the server. The home directories on the server are backed up with Time Machine.
I have found the following items that do not work proberly:
1) Desktop backgrounds settings are just lost sometimes for whatever reason. Desktop background goes to default and you need to manually set back to the one you have selected. This happen mostly if users have their own desktop pictures.
2) Keychain get's screwed up. The user often get the "Keychain doesn't exist to store ..." message and need to select to reset the keychain. Anything I have tried from "Keychain First Aid" to removing and have a new one created doesn't fix the problem. It keeps on coming back.
3) iTunes Storage and AppStore are getting confused about authorized computers. This is because a user logs in from another computer and then iTunes store would tell the user this computer hasn't been authorized to play the purchase music. Same happens with iPhone apps from the AppStore. Apparently those two stores are not setup to hanlde network users proberly.
4) Permission issues happen sometimes in Application like iPhoto where it would complain not being able to see photos or cannot add new photos to the library. Need to run a permission repair on the Iphoto Library to fix this.
5) One critical one is that it's not really possible to restore files from Time Machine. The Time Machine backup is done on the server by an administrator account directly backing up the user directories. When you go into Time Machine on the server even the admin can drill down into the user directories so no restore possible. The individual users have no idea that there was ever a Time Machine backup done as Time Machine is not setup in their accounts on the individual Macs. This prevents any possible restore.
I reckon that many of the problems are related to having only one location for ~/Library as the individual Macs are writing their user related settings into this directory in a central location. So what happens is when something on iMac 1 and then I log in on iMac 2 that might not exactly match this Macs config and it get's confused throwing one of the above erors.
Trouble is witth central network home directory the way they mounted i can't exclude the ~/Library folder. The only option I can see is mobile account because I have seen in the preferences that when they sync the handle Library items differently.
Does anybody have any experience out there with this sort of thing and can advise what's the best way forward?
If i can't resolve this I'll go back to have network users with local home directories on each Mac and just setup for each user a network share to which they copy files if they want them available on other Macs. Not as nice but at least it works!
As a said note I did this to make things easier but it has up to now cost me trouble then i had before!

Haven't heard anything from anybody so probably to daunting a topic ...
I have now moved on to try Portable Home Directories (PHD) and syncing ... what a disaster!
First it took me ages to get this right as the way the home directores are mounted on the clients from the server it's just weired which has to do with how AFP mounts are implemented. Since one AFP mount can't be mounted by several users on the same system they use a workaround of mounting it to a temp directory and then linking it back to where it should be. Of course this causes major problems.
Okay it kind of worked so let's move on to syncing PHD. First of all on initial creation it only sync a small portion of the directory that should be okay but on some of my accounts it never went passed this stage. It said it's all synced but it only had synced the first 10% or so of the data. I wasn't able to make it sync anymore.
On other accounts it correctly synced all the data down, or so I thought. Apparently a few sync session back and forth and 50-60% of the data was gone. On further investigation it turned out to be iTunes and iPhoto libraries. Turns out does don't sync probably via Home Sync!!!
Apple product is not able to probably syncing Apple specific library files!!!!
So here my warning to everybody: DO NOT USE PHD and HOME SYNC to sync your data as you will lose stuff if you have iTunes and/or iPhoto libraries with Lion OS X Server!!!
The whole Lion Server experience has been a disaster for me. Now I have a server that does file sharing and time machine backup sharing. I can do the same thing with a standard Mac using those services. What's the point of Lion Sever for Home if nothing works proberly?

Network user permissions and security

Similar Messages

Maybe you are looking for