Wednesday, February 11, 2015

Mac OS X Extras: Using Centrify and AD GPOs to Manage Portable Home Directories

Background

In OS X it is possible to set up a mobile user account that provides synchronized home folders, one on your Mac and one on the network account server. With Centrify, these "portable home directories" can leverage the user's existing Windows home directory to consolidate information.  Centrify allows the use of AD Group Policy to manage Portable Home Directories.

Assuming you have a Centrified MacOS X system:

Planning

At a high level, these things need to be thought out:
  • Windows home directories:  There are countless resources on this topic.  Home folders have to be created, and then assigned to users.  Keep in mind permissioning as well.
  • Understand the version(s) of OS X in your environment and the mobility settings behavior:  Apple has modified the implementation of mobile accounts over several versions.  The advantage is that Centrify provides a GPO that considers multiple versions of the OS:
  • Correct GPO scoping:  In this example we use loopback processing, however, based on your deployment, you may have multiple GPOs that apply to different AD principals.

Implementation
  1. Open GPMC and edit the Centrify GPO for OS X systems.
  2. On the left pane, navigate to "Computer Configuration > Policies > Centrify Settings > Adclient Settings" and in the right pane double click the "Enable Auto Zone user home directory (Mac OS X)"  and enable it.  This GPO modifies the auto.schema.use.adhomedir parameter in the /etc/centrifydc/centrifydc.conf file.
  3. Navigate to "User Configuration > Policies > Centrify Settings > OS X Settings >   Mobility settings" and in the right pane double click the "Use version specific settings" GPO and enable it.
  4. Based on the version of OS X that you have (in my example Mavericks 10.9) go to the corresponding folder (e.g. Mac OS X 10.8/9 settings) and enable the "Configure mobile account creation" - set it to enabled and check the "Create mobile account when user logs into the network"  check-box.
  5. To make sure the GPO is refreshed on the Mac OS X client, just run the adgpupdate command.
Verify
  1. On a Windows system with Active Directory Users and Computers (ADUC), open your test user account's properties and go to the Profile tab.  Make sure the home folder is set up appropriately for your environment.
  2. Sign-in to your Centrified OS X system, you'll see the following:
    Upon login, the user is prompted to create their portable home directory.
Adjust

Adjustments will be based on your environment.  Here are some general items:
- What happens when accounts expire?  (should mobile home directories be deleted?)
- Home folders:  what items will be skipped? What items will be explicitly synchronized?
- Synchronization settings:  By default every 20 minutes automatically.
- Preference Sync rules, etc.


Lab Video

2 comments:

  1. Does Centrify support synchronized folders from a DFS path? Does it support DirectAccess?

    Thank you,
    Andrew

    ReplyDelete
  2. Andrew,
    Thanks for your question.
    On DFS Shares/Portable drives: All the robust AD infrastructure needed for DFS (name resolution, Kerberos, AD sites and services) is provided by Centrify to support DFS. However, in this scenario, I'd test the performance of synchronization. It's all about Apple's SMB client performance. The good thing is that Centrify also offers a set of GPOs that provide a lot of flexibility to centrally control when/what/quotas of what gets synchronized.

    On DirectAccess

    Microsoft invested a lot in the architecture of Win7/8 Win2008/2012 to make DirectAccess work. Things like Certs, Network location awareness, Virtual Interfaces for IPv6, etc. Unfortunately that infrastructure is not available on OS X. However it looks like with Centrify we are very close. We can provision certs with GPOs to the Mac; also DirectSecure is able to manipulate Racoon using GPOs to enforce IPSec tunneling, however, it's on Apple to partner with Microsoft to make this happen.

    ReplyDelete