Hello all,

The following is an issue affecting Mac OS Siera, High Siera, and Mojave in our environment. I would greatly appreciate any help in resolving it from the community :)

Historically, binding our Macs to AD (with force local home directory on startup and use UNC path from Active Directory to derive network home location) would create a Globe icon on end users' docks that would mount their network folder and open it on their desktop.

Since Apple Security updates starting a month ago, clicking on the Globe now opens a prompt asking users to authenticate to connect to the server where the network shares are located. After entering the credentials, the root level opens in a new window--our network shares are hidden, so they are not visible).

If users go to Go/Connect to Server and enter the full path they can connect without any authentication prompts.

Ideally, I would like to fix the issue with the Globe icon on the dock, but I'd settle for some way to have users' network home shares accessible without them having to navigate through several folders or having to enter the share path.

I have tried using the following script by @Look It's a great script, the problem is that after adding it as a login policy it mounts the share but not the individual users home folder. So users need to navigate through all the home folders within the share to find theirs.

A further complication when vetting possible alternatives is that we have different share directories for different users--Students, Teachers, Staff--so entering a static share won't work in the format smb://SERVER/SHARE/username.

#!/bin/sh
#2017 Version Samuel Look
#All care no responsibility
#Mounts the requested share if it doesn't already exist if left blank it will attempt to mount AD SMBhome
#Accepts shares in the form smb://server/share
#Intended to be run as a Login policy from Casper on AD bound machines only and has only been tested in this context.

##### Start seperate process #####
(

##### SUBROUTINES #####

Share_Path_Valid() {
if [[ -z "$Share_Path" ]]; then
Machine_Domain=$(dscl /Active Directory/ -read . SubNodes | awk '{print $2}')
Share_Path="$(dscl "/Active Directory/$Machine_Domain/All Domains" -read /Users/$Current_User SMBHome | awk '!/is not valid/' | sed -e 's/SMBHome: /smb:/g' -e 's/\\///g')"
fi
if [[ "$Share_Path" ]]; then
logger "Sharemount:$Share_Name Path check PASS $Share_Path"
return 0
else
logger "Sharemount:$Share_Name Path check FAIL"
return 1
fi
}

#####

User_Ready() {
Loop_End=$((SECONDS + 60))
Current_User=$(stat -f%Su /dev/console | awk '!/root/')
while [[ -z "$Current_User" ]] && [[ $SECONDS -lt $Loop_End ]]; do
sleep 10
Current_User=$(stat -f%Su /dev/console | awk '!/root/')
done
if [[ "$Current_User" ]]; then
logger "Sharemount:$Share_Name User check PASS $Current_User"
return 0
else
logger "Sharemount:$Share_Name User check FAIL"
return 1
fi
}

#####

Finder_Ready() {
Loop_End=$((SECONDS + 60))
while [[ -z "$(ps -c -u $Current_User | awk /CoreServicesUIAgent/)" ]] && [[ $SECONDS -lt $Loop_End ]]; do
sleep 10
done
if [[ "$(ps -c -u $Current_User | awk /Finder/)" ]]; then
logger "Sharemount:$Share_Name Finder check PASS"
return 0
else
logger "Sharemount:$Share_Name Finder check FAIL"
return 1
fi
}

#####

Not_Mounted() {
if [[ -z "$(mount | awk '/'$Current_User'/ && //'$Share_Name' /')" ]]; then
logger "Sharemount:$Share_Name Mount check PASS $Share_Name"
return 0
else
logger "Sharemount:$Share_Name Mount check FAIL already mounted"
return 1
fi
}

#####

Mount_Drive() {
True_Path=$(echo $Share_Path | sed 's//////'$Current_User'@/g')
logger "Sharemount:$Share_Name Attempting to mount $True_Path"
sudo -u $Current_User osascript -e 'mount volume "'$True_Path'"'
}

##### START #####

Share_Path=$4
Share_Name="$(echo $Share_Path | awk -F"/" '{print $NF}')"

if User_Ready && Finder_Ready && Share_Path_Valid && Not_Mounted; then
sleep 4
Mount_Drive
else
logger "Sharemount:$Share_Name Conditions not met to attempt drive mounting $Share_Path"
fi

##### End seperate process #####
) &

##### FIN #####