Apple IOS 10.6 logon scripts

In a windows active directory enterprise environment logon scripts are critical to delivering services to users as they log on.

Unfortunately the login hook method that has worked so well in previous IOS versions is not working in 10.6, but don't fear, there is a new method based on the launch daemon that we can utilize.

In my environment I want to deliver a smbfs based network drive hosted on a windows file server and create some directories as the user logs in, this is the method I used.

1. Create a launchd plist that contains the path of the login script I plan to use. I do this by creating a .plist file in the /System/Library/LaunchAgents directory. My configuration file was called logonscript.plist and read as follows.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>logonscript</string>

<key>LaunchOnlyOnce</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>open</string>

<string>/usr/bin/logonscript</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>ServiceDescription</key>

<string>logonscript</string>

</dict>

</plist>

In short all my configuration file does is launch /usr/bin/logonscript on user login, you can change that

<string>/usr/bin/logonscript</string> to anything you want.

2. Next I simply create my logonscript, my script read as follows.

echo Logging you on..
echo -

echo Connecting public drive..
mkdir ~/Desktop/public
/sbin/mount_smbfs //fileserver.blah.internal/public ~/Desktop/public
echo done..
echo -

echo Logon complete... You can now close this window..

 

While my script is very simple, the power of bash scripting would allow you to do a large number of operatings during this logon.

3. Of course lastly we need to modify the file to be executable

chmod +x /usr/bin/logonscript

You are all set, now your users can logon and automatically map the required network drives as long as you have already binded the system to active directory.