I have been using @bentoms Applescript to mount network shares with mixed results for about two years. I have had intermittent issues with shares not mounting, but I haven't had the time to do any in-depth diagnosis. Due to some ongoing organizational changes I have retired that script and I have written a bash script that performs a similar function but with different logic and lots more logging.
The logging has directed me to what I believe is the reason why I have been having intermittent issues with the share mounting: when a device has been off our LAN and has returned to the LAN without being shut down, it appears unable to completely browse AD using dscl. This occurs despite having a valid kerberos ticket and being able to access network resources without manual authentication. Since the script cannot query AD, it does not perform as expected.
The script tries to read Active Directory/mycompany/mycompany.org. On an affected device, if I open a terminal window and enter dscl in interactive mode, I can browse using cd and ls, but I can only browse to the Active Directory/mycompany/ level. I can see All Domains with an ls command, but I can't progress past this point. I receive this error:
/Active Directory/XXXX > ls All Domains /Active Directory/XXXX > cd All\ Domains cd: Invalid Path <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName) /Active Directory/XXXX > cd mycompany.org cd: Invalid Path <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)
If I restart the machine then I am able to browse AD successfully.
I suspected that this had to do with the account losing some component of their domain privileges during the off-LAN period, however, if I log in as a non-domain user I am able to browse using dscl.
My options at this point are to:
a.) test for a null result from the dscl lookup and notify the user that they must reboot in order to mount network shares
b.) figure out why AD is not browseable in that situation and take some action to remediate
I would rather not force users to restart in these situations. Has anyone else experienced this? Any ideas how to get past this issue? FWIW I am also unable to auth into AD while on an affected device.