Posted on 02-15-2017 03:46 AM
Hi,
Was wondering if there is a way to prevent same simultaneous login of the same user account to many machines.
It used to be there in OD.
Can this be done in AD with mobile homes?
How are others doing this?
Thanks,
Phil
Posted on 02-15-2017 06:50 AM
It is not quite clear what you want to achieve or avoid. Do you want to make sure that the same account can not log in to several machines, or are you worried about files being modified on several nodes?
If the user has its homedir centrally in SMB, a login to a second node while he already is logged in with the same account elsewhere will give rise to problems since Apple does not use file locking in a systematic manner and the Macs will happily try to modify plenty of files (caches, preferences,...) that are already open by another Mac. Some apps appear to use file locking, and that will make the login of the second session very slow. The state of the files touched by apps that don't use file locking is undefined. Another potential issue is ~/Library living on SMB and logging in from Macs with different OS versions. No need to be logged in to several nodes at the same time to have problems with incompatible versions of files and databases in ~/Library. Been there, tried that. Gave up on using SMB home dirs.
Portable home dirs are not supported any more, so no need to discuss that scenario.
For local home dirs it doesn't really matter on how many Macs a user logs in as all files are local - except if you have invented some way to sync back changes to a central place. I am not aware of any way to prevent logging in to several nodes at the same time.
Hope this helps.
Posted on 02-15-2017 07:29 AM
You can limit concurrent logins in AD.
Posted on 02-15-2017 09:09 AM
@ryanstayloradobe can you share how exactly to do this in AD.
Posted on 02-15-2017 09:13 AM
@mschroder sorry if my post is unclear. I am talking about the same AD account should not be able to log in to several machines.
Posted on 02-15-2017 02:17 PM
This isn't a feature of AD, but there are third party tools out there. The best of them seems to be UserLock.