Ubuntu OpenLDAP and Mac OS X Roaming Profiles

Using Folder Redirection to get the "My Documents", "Desktop", and potentially "Application Data" folders out of the user's roaming user profile will help matters tremendously.

I'd review this document from Microsoft: "Managing Roaming User Data Deployment Guide". It's dauntingly in-depth, but it's filled with very good information.

Some people only use Folder Redirection and don't use roaming user profiles. I tend to disagree with that strategy because, to me, the user's profile is user data, too, and needs to be backed-up with the same degree of stewardship as their "overtly" data items. Roaming user profiles makes moving the user to a new PC a lot easier, too.

Whether you use "Offline Files" to cache data client-side is dependent on your environment. Windows XP doesn't handle Offline Files well when the user's redirected folders get larger than 2GB in size. Windows Vista and Windows 7 have a much-improved caching engine and do a better job. To my mind, if the user's computer isn't portable there isn't a "win" in using "Offline Files". Others' views may vary.

Finally, I tend not to use the default security paradigm that Microsoft "recommends". I set the permissions on the root of a shared folder hosting user redirected folders to something like: SYSTEM/Full Control, Administrators/Full Control, Authenticated Users/List Folder Contents-This folder only. Then, I pre-create each user's folder and add a That-User/Full Control permission. I change the default settings in "Folder Redirection" to prevent granting the user "exclusive access" (which really means "mess up my folder permission hierarchy and turn off inheritance"). I also set the group policy setting to "Do not check for ownership of Roaming Profile Folders" to enabled to allow me to set the security on my roaming profile folders the same as above.

I do all this w/ permissions for two reasons. Microsoft's defaults "break" the permission inheritance hierarchy on my filesystem, and I find that both irritating and an obstacle that I'll invariably have to fight with at some point in the future. Secondly, the "Microsoft way" invovles setting the share-root folder to allow users to create subfolders. At best, this is just lax security. At worst, one user could launch a denial-of-service attack against a new user by pre-creating the folders for that user before they logon and setting the permissions to deny the new user access.

I would recommend looking in the event logs on the computer and seeing if there are any relevant events. You can also turn on user environment logging as per this article:

http://support.microsoft.com/kb/221833