Network Users - Can't login without home folder

Hey everyone,
Got a problem. We upgraded our lab from 10.6.8 to 10.9.3. Preserving our settings and bootcamp by simply upgrading. After getting nearly all machines sorted out with active directory we are still having a problem with 2-3 machines with network user accounts being able to login. If no local home folder has been created prior to upgrading to 10.9.3 then the user cannot login, the login prompt dissapears then re-appears. Any way to fix this?
Here is a run down of the set-up.
Our settings force network users to have a local home folder on the local mac that they are logging into.
Mac OS X server is 10.6.8.
Active directory server is 2012 R2.
Network users without a pre-created home folder on the local mac prior to upgrade cannot login. The login prompt dissapears, then re-appears. No login.
Computers are managed with workgroup manager, as well as apple remote desktop. But no settings are applied, and no login scripts are being run.
Also I have noticed something concerning Mac OS X 10.8.5 and up. And that is in the active directory settings, if you bind to a domain (using active directory and not LDAP), lets say for example:
mydistrict.maindistrict.net
And you go to add your local active directory district to the Authentication/Contacts search policy eg: Active Directory/mydistrict.maindistrict.net
it will only show: Active Directory/mydistrict/alldomains.maindistrict.net.
It shows a list of all domains for the forest. But it also adds the district that you bound to as the search directory?
Let me use a precise example using actual names.
Bind to local district: pineville.ketsds.net
Now in search policy on 10.8.5 up to 10.9.3 it displays possible search domains like this:
Active Directory/PINEVILLE/pineville.ketsds.net <- The domain we want.
Active Directory/PINEVILLE/all-other-domains-in-forest.ketsds.net <--Which is fine.
Which is all fine, but when we select the local domain for authentication, and contacts search it adds it, but in the overview it says that it is not in our search policy even though it is.
On Mac OS X versions below this (10.6.8 and down, cannot verify for 10.7 as we do not have systems with it) it displays the search domains as:
Active Directory/pineville.ketsds.net
as compared to this on 10.8.5 and above:
Active Directory/PINEVILLE/pineville.ketsds.net
as well as all the other domains, and when you add the local to the search policy it does not give the error that it is not in your search policy. Is there anyway to make this happen on 10.8.5 and above? We have tried everything. Network accounts will login even though it says this, it is just annoying.
Last question is on one computer that we upgraded, we had a problem with the network accounts. Tried deleting the .plist for network preferences, and the Directory services folder as well as the Open directory folder and now it create the open directory folder as locked and any changes made with the directory utility in the search policy is immediatley reverted once we hit apply.
Summary of questions:
1.) Network users cannot login without local folder created prior to upgrade.
2.) Mac OS X 10.8.5 and above does not correctly add Authentication/Contact search policy domains as it does in 10.6.8 and below.
3.) Active Directory/Open Directory Authentication/Contact search policy settings keey reverting after applying. (Happened prior to deleting .plist files and AD/OD folders in /Library/Preferences)
Thanks guys, sorry if thi post is so long! :/

-BUMP
Not sure what the bump policy is but my post is fadiing fast. Third page already.
Kind of an urgent situation guys, any help or insight at all would be greatly appreciated!!

Similar Messages

A particular network user can't login to a mac in a classrom but other network users can. Then the network user can login to other identical macs in same classroom. Anyone seen this before?

A particular network user can't login to a mac in a classrom but other network users can. Then the network user can login to other identical macs in same classroom. Anyone seen this before? It has happen twice. Two different teachers in two different classrooms entering the correct user name and passwords and computer won't allow them to login. Then they try in different computers in same classroom and have no problem login.

Yes. I can login with a test user. And any other network user can login as well to this particular mac. Actually the mac has bootcamp and boots into either mac or windows. The same user entering the same login username and password can login into the windows side, but not the mac side.
I had this same issue last semester in another classroom, another mac and a different teacher. This summer I reformatted and imaged that mac and I asked that teacher to login today to that reimagened mac and she had no problem today doing so.

Network users can't move file to folder

Hello,
I'm working with a fresh lion server installation.
Users have their home folder on the server.
I filled default folders (desktop, documents, music...) with files and folder from snow leopard server
Checked and double checked posix and ACL permissions on the default folder created by lion server and then propagate
Permissions set up by lion server are :
Everyone - Delete, apply to this folder & descendants
Spotlight - list & traverse folder + inheritance
User name - read & write
staff - none
Others - none
They can login from any mac in the lan but when they try to move a file to a folder they are asked to identify as administrator.
ie move a picture file from desktop to desktop folder => type an administrator's name and password to allow finder to make change ??????
Lion server up to date. Permissions repaired by disk utility.
Any suggestion ?
Thanks,
Harold

I had a similar experience the other day. Try the following:
Quit all applications.
Go to the Apple menu and select Force Quit Applications.
Click on Finder and then click the button Force Quit. (Your desktop should refresh.)
Select the files and move them to the trash.
If the above does not work, reboot your computer and then try moving those files to the trash again.
HTH

Network user can't login

Hi,
just updated osx server to Mavericks with osx server app in version 3.
W are using Active Directory for our Users. ML machines can login without any problem.
Mavericks users have no access. The Login is just shaking, thats it..
Any ideas whats the problem ?

Hi everyone,
we found a solution:
- check dns
(our hostname is osxserver.local )
$ nslookup osxserver.local
$ sudo chnageip -checkhostname
Both should always return success and no errors
If you have some errors
possible options:
1. go to server app > dns > new > enter hostname and ip of your server
2. server app > dns > show all entries > search the bottom smth like xxx.in-addr.arpa anch check if it show your server ip
if not try to repair host name ( server app > change hostname ), and repeat step 1
3. system settings > network > check if the dns is ip of your server or just set it to 127.0.0.1
4. wipe your open directory ( create a backup ) a set a new one
i hope this helped some someone. This fixed our issue with login. Its still not perfext as it with mountainlion was BUT its working ...

Network user can't see local home directory

Hi there,
I have a Mac Mini running Lion Server with Directory Services turned on. I've been using this to allow network users to log into Lion clients, as well as set up mobile accounts. This has been working fine.
Now I've just created a new network user for use with a Mountain Lion client and have experienced some strangeness with this new user's home directory. The binding to the directory was fine, and the credentials for the network user were fine. However, when logged in, this new user has his home drive mapped to /Network/Servers/<servername>/Users/<username> rather than the expected /Users/<username>. This has bad side-effects. For instance, Chrome tries to save downloads to the server instead of locally.
What I can't work out is why the home directory isn't pointing to a local location. The other users (on Lion) have the same home directories defined in their Open Directory profiles. The only difference is the new user is on Mountain Lion, but I don't think this has any bearing to the problem.
Can anyone offer some advice?
Benjamin

So I took my Mac Mini running OS X 10.8 Server, along with two client laptops: one exhibiting the problem I described, and the other where network logins and home directories worked as intended.
Long story short, the guys at the Bar couldn't figure it out. The user definitions in Open Directory seemed ok, but they still couldn't work out why no local home directories were being created. Not sure if this helps, but in trouble-shooting, we also discovered that trying to login with a network user on the problematic laptop didn't work when the server wasn't on the network. It's as if the server is required to be present.
Anyway, the case has been referred to the business team, which is supposed to have more expertise with OS X Server.

Creating a user without home folder ?

Hi
Can i create a new "User " programatically(iam using to do this) without having a home folder for that user ? Let me explain what iam doing basically.MY application tracks complex deals,financial transactions between corporate firms.Any valid user(called as Member) to this system can create what is known as a "DEAL" for which associated documents have to be managed among other things.For this i start off by creating a new user in the IFS with user name as the deal itself(DealCode which is the DEAL's code is the User name ).(this account will have a home folder and will be /home/<DealCode>).This account will hold all documents pertaining to that DEAL .Now can i create users(rather Members) who can access this account for Deal ?I do not want the Members to have a home folder but when they login their home folder should automatically be the Deal's home folder for which they are authorised.So what is the best way of doing this ?and is this the right approach ?
thanks
Sampige
null

I'm trying to understand your model.
I think I understand this much.
Each Deal is has it's own folder.
Members create Deals.
A Deal will be accessed by Many Members.
What I'm not sure about is can a member access many deals, but I would expect this to be the case.
My gut feeling is that you do not represent each deal as user with a home folder. When a new deal is created I would create a folder for that deal and a new group which will be used to control who has access to that folder.
The group will be used to control which members have access to the folder containing the deal. If a member has access to the deal they should be added to the group which has access permissions on the folder.
When a member has access to deal their home folder will contain a link to the folder that contains the information for the deal
When a member logs in they will see one folder for each deal that they have access to in their home folder.
Does this help

How can I share the home folder with different accounts on the same mac?

Hi, here's a question:
How can I share the home folder with different accounts on the same mac?
The whole point being not to have to install all my apps, and move all my files each time between users.
The second thing would be to be able to modify one document on one account, and have it changed on the other account without having to copy it.
I would like to have a pro and a private account on my mac.
Thanks for you answers,
Doug

Your apps should not be installed in your home folder--they should be in /Applications where every user can access them.
If you want to share things between users on the same Mac, use the /Users/Shared folder. Keep your home folder private. Trying to defeat the protections on the home folder subfolders just gets messy. I've never bothered to figure out all of the problems associated with it so I can't explain how to do it.
Even with using Shared, you would need to alter the ACLs on the shared folder in order to allow both users to modify the documents.
You must create a Group in Users & Groups and put each user in that group. Then create a folder inside /Users/Shared where you want to share the various files.
Then, add an ACL to the shared folder that gives the group special permissions. on that folder.
sudo chmod -R +a "<sharinggroup> allow delete,chown,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" /Users/Shared/<sharing folder>
Replace <sharinggroup> and <sharingfolder> with the name of your group and your folder. Then, run the command in the Terminal.
With that ACL, each user in <sharinggroup> will be able to alter the files created by any user in the group in that <sharingfolder>.
Essentially, the client OS is not designed for true file sharing among the individual users. It is designed to isolate each user account from the others.

How I Solved My "Can't Import My Home Folder" Problem While Staying Sane

This may be a well-known work-around for Time Machine and Migration Assistant, but I didn't find any reference to it in searching in Google (which included some threads here), so I thought I'd post it in case anyone else is experiencing similar problems.
I was having problems with some program install permissions and tried fixing them in more traditional ways without success, so I decided it was a good day for an Erase and Reinstall of Leopard.
I didn't want to copy my entire Home directory's contents and I have 6 HDs (four internal and two external) totaling about 1.5TBs. So, to prepare for the reinstall, rather than use Backup, I copied all important files to my other drives and then I copied my Home directory to another drive in the machine. Satisfied that everything was backed-up, I reinstalled Leopard using the Erase and Install option and soon had a good system, fully updated.
However, when I went to copy the Home Directory I kept getting errors saying that I can't alter these files and folders, even when I drilled down into the subdirectories. I didn't try copying individual files, but then I had no desire to do so given the amount of time that would take.
I looked around but could find no good solution. However, I did come up with a workaround and this is what I did:
First, I moved my Home Folder designation to the one on the backup hard drive by:
1) Go to System Preferences
2) Click the lock to make changes and enter your user password
3) Right-Click on your User Account and select "Advanced Options"
4) From the drop-down window, to the right of the "Home Directory" box select "Choose..."
5) Navigate to the backup User Account home folder and select it and click "OK
6) Relock the Accounts pane
7) Now you can delete the "old" Home Folder under your OS drive: Users/user account
8) Now just copy the backed-up Home Folder (that is now your real Home Folder) to the OS drive: Users/user account
9) Repeat steps2, 3 and 4, this time selecting your now moved Home Folder in the OS drive: Users/user account
10) Now you can delete the backup or keep it AS a backup.
I know this is a kludgey, wrong way to do backup and that Backup is the way to go, but for those out there who don't do it or have some problem restoring it, this is a possible way around so that you don't end up having to restore everything by hand.
This workaround may have already been discussed and well-known, but I had not seen it and am posting this in the hopes that it will help someone in trouble.
JoeL

joeldm,
There is a "proper" way to do what you have done. First, one must create an account within the new installation using the exact same username and short name that was used in the old installation. Then, one enables the "root" account and logs in as root.
Within the root account, the local HOME folder that was created for the user is placed in the trash, then replaced with a (same-named) copy from the backup. THat HOME folder copy will be onwed by root, so this command must be run in Terminal:
<pre style="overflow:auto; font-family: 'Monaco'; font-size: 10px">chown -R username:staff /Users/username</pre>
In the above command, all instances of "username" are replaced with the user's short name. For example, if the user's name is "fred," the command would be typed exactly like this:
<pre style="overflow:auto; font-family: 'Monaco'; font-size: 10px">chown -R fred:staff /Users/fred</pre>
The command is executed when <RETURN> is pressed. NOTE: The specific command listed above applies only to 10.5.
One would then log out of the "root" account, and into the account in question. If all seems well, one would log back into the root account, empty the trash, then log out of and disable the root account.
Alternatively, if there is a Time Machine backup that can be used, the Time Machine interface can be used in the root account to replace the trashed HOME folder, instead of copying manually in the Finder. This would generally be a better method to use, if possible.
Scott
EDIT: If one wishes to replace/restore only certain portions of a HOME folder, this is possible. The same methods would apply to only limited segments within a HOME folder. -s

HT202233 If I made the mobile account for a network user, can this user unlock the FileVault2-disk?

My Mac is connected to Microsoft Active Directory. Every time I schould unlock the disk with the local admin, then login as network user.
If I made the mobile account for a network user, can this user unlock the FileVault2-disk?
Thanks.

Yes, but the FileVault password won't be updated automatically if the login password changes.

Lync 2013 disabled user can still login.

Ok. so we have this weird behavior and it's been driving us crazy for over a week. We have a lync 2013 deployment on a forest with several child domains.<o:p></o:p>
In the middle of the deployment, we noticed that our changes to the user characteristics were not being updated. Eg: we enable or disable
enterprise voice, no changes. We change the sip URI, log out, login, nothing, no changes. And we noticed that if we disable the user from Lync server (from the lync controlpanel), the user can still login. We assumed some lag on AD replication, but no, a user
can still login after a week!<o:p></o:p>
The deployment is a standard Lync 2013, single FE, with a single Edge server. We have enabled Enterprise voice, changes to the enterprise voice routes are
working, if we enable or disable a route we can see it on the client, but changes on the dialplan are not reflected.<o:p></o:p>
I can’t find any reference to this behavior. I know if I disable a user from the AD he can still signing into Lync, but this is different, we are disabling
the user from Lync server. We even removed the user completely from Lync and he can still use it as normal.<o:p></o:p>
We checked the user using adsiedit and the msrtcsip-userenabled is set to false, we even voided the certificate via lync console. Still able to use it.
Suggestions?
Thanks in advance.
Fabio Ricci.

Hi,
Please check if there is any error message on FE Server when the issue happen.
It seems to be the issue of CMS replication.
Please check CMS replication status by running Get-CsManagementStoreReplicationStatus.
If CMS replication not update to the latest version, run Invoke-CsManagementStoreReplication.
If the issue persists, please check Lync Server update, make sure Lync Server update to the latest version, and then test again.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

The same user can only login once

Hello,
I have a problem with my system. I made a system where you must login.
I use the following code:
boolean login = false;
String username= request.getParameter("username");
String password= request.getParameter("password");
User user= Usermutations.makeviaUsername(username);
if (user.getPassword().equals(password) && !password.equals("")) login= true;
if (login) ReqD = getServletContext().getRequestDispatcher("/Overview.jsp");
else ReqD = getServletContext().getRequestDispatcher("/False.jsp");
request.getSession().setAttribute("user",user);
request.getSession().setAttribute("username",username);
request.getSession().setAttribute("password",password);
if (ReqD != null) ReqD.forward(request,response);
//Clean up resources
public void destroy()
Now I want that the same user can only login once. So when a user login with his username and password, no one else can login with that user name and password.
I don't wan't to put the username in the database and then validate if the user is already logged in, because then the user must logout and not close the webbrowser else the user stays in the system.
Does anyone knows a solution top this problem.
Thanks in advance,
Henk

So I wan't the database and when the user is logged in
the name is set in the database. But when the user
clicks on the X (close button in the browser his
username must be deleted from the database)You can't tell when the user does that (or perhaps you can sometimes, with difficulty). But even if you could it doesn't solve your problem. Many people keep their browsers open all day, and -- you may find this shocking -- they go to sites other than yours.
So basically, if you don't provide them with a logout button you can't tell when they "leave" your site. And even if you do provide them with a logout button, they won't necessarily bother to use it. So you're left with waiting until the session expires, and then logging them out. This also means that if they come back to your site while the session is still active, then they are still logged in. This is not an error and you should not treat it as one.
PC²

I'm administrator of Macbook Pro. Can't get a home folder? Previous owner is off User list but still had a home folder on side bar. How do I get rid of hers and get a home folder of my own? Thanks for any help.

Hi: Bought a MacBook Pro age circa 2011,works great, except I understand I need to have a Home Folder. I am listed as administrator in the User accounts pref, in fact I'm the only user there. Still in the sidebar when starting up the Mac, there is the former owners Home Folder and not one for me. I want to delete her Home Folder and get one in the sidebar for me. I've tried all the things I could think of the delete her folder, but can't seem to do it as there isn't a button or prompt that I can click on to delete her folder and create one for me as the adminstrator. I'd really appreciate any help with this problem that someone might give me. Carol

Welcome to the Apple Support Communities
If I have understood you properly, to do that, you have to create a new administrator user with your name and for your uses. Follow these steps:
1. Open System Preferences > Users & Groups, and press the + button to create a new administrator account.
2. When you have finished creating that user, open  > Log Out, and log in your new user.
3. Open System Preferences > Users & Groups, select the old user and press the - button to remove the user. If you want, you can select the option to remove the Home folder of this user, so you will only have the Home folder for your account

Can I change the Home Folder of users with Group Policy (or in another centralized way)?

I know how to change the Home folder of users from AD Users & Computers -> their Properties -> Profile tab. But this is not very practical when one has users spread across many OUs, and with users being added and removed often.
So I am wondering whether there is a way to do the same with a GPO. The closest thing I found was Folder Redirection, with which I can change the location of particular profile folders for each user, but not the location of the whole profile.
Is there a way to redirect the entire location of users in a centralized way, using a GPO or some other mean?

I would recommend reading that about the management of roaming profiles: http://technet.microsoft.com/en-us/library/cc784961(v=ws.10).aspx
You can involve the use of Powershell scripts for the management of roaming profiles:
http://social.technet.microsoft.com/wiki/contents/articles/12460.powershell-automate-roaming-profile-folder-permissions.aspx
http://gallery.technet.microsoft.com/scriptcenter/Check-if-an-AD-user-has-a-45ed5d1c
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

User can not login? Error comes up - only happens on mac pro

Hi. I have just set up a server system and users can login fine on all the imacs. However, When a user comes to login on a mac pro, they get this message:
The home folder of this user account is on a afp or smb server. Please contact the system administrator. This happens as soon as they press login.
We are running Mac OSX SERVER 10.4.10
Thanks,

Hi
On the MacPro what is in the DNS Servers field in Network Preferences? Compare what is there with what is in the same area on the iMacs that can successfully log in. Where are they getting their IP addresses from?
Tony

Network users can't log on to client computers

Hi,
This is my first OSX server install, so bear with me if I am missing something!
I have searched for a solution, but cant find one similar maybe I am doing something drastically wrong?
The Problem Summarised;
New Mac OSX Snow Leopards Mac Mini server, clean install.
New iMac OSX Snow Leopard Client.
Can not log in using the network users. I have joined to the open directory, I get a green dot saying network available and all network users listed.
When I try to login, the OSX Login screen shakes as if incorrect password is being used.
In a bit more detail
Ok, I have installed a new Mac Mini Snow Leopard Server, created a handful of user accounts and then bound my iMac snow leopard client to the server (using the open directory utility under the accounts login preferences).
I have also added the computer as a client computer under the servers workgroup manager app.
I have also (using the workgroup manager on server) selected the client computer, selected preferences and added the users to the access part.
The client now shows the OSX login box with a green dot saying network accounts available. The network accounts all appear.
However, when I try to login as one of the network users, the login box just shakes and wont let me login.
Any ideas? If there is a known bit of documentation, could someone point me to it?
* saw this posted in a different secretion and I HAVE THE SAME ISSUE.

My guess is:
Have you created or pointed their home directories to a specific location?
Each network user in WGM user needs to have their home directories defined to a folder on the local machine or a folder/location on the server. Here is an example... my user has it's Home defined as being within the /Users folder.
http://i42.tinypic.com/dyoupu.jpg
If this is not done, you will see the results you've described so far... the appearance of a successful login, then the shaking login window.

Network Users - Can't login without home folder

Similar Messages

Maybe you are looking for