Using OS X Lion Server as a Home Server (Part 7 – Users and Groups Configuration)

Download the Using Apple OS X Lion Server at Home eBook Now

If you’ve been enjoying our Using Apple OS X Lion Server as a Home Server series, then make sure you pick up a copy of the accompanying eBook. You’ll find additional chapters and information on using OS X Lion Server to power your digital home that won’t be available here on the site, and with all of our walkthroughs available in one convenient document (ePub or PDF), it’s far easier to install and configure your server without having to click backward and forwards to the website.

Buy Using OS X Lion Server at Home – £14.99


[box type=”info” style=”rounded” border=”full”]Articles in this series… [/box]

Well, that last part was quite the walkthrough, wasn’t it? Certificates, networking, port forwarding and all for a rather bland default remote access web page and a green tick next to some security certificate! In truth, whilst we haven’t got a huge amount to show for our work on Lion Server so far, importantly, the configuration we’ve done so far means (in theory) we’ll be saved a lot of trouble when we start configuring the fun stuff.

Talking of which, it’s time to get our users set up on the server. OS X Lion Server allows configuration of both local and network accounts – local accounts are restricted to the server, whilst network accounts can be used on all Mac clients connected to the server as well as the server itself. As you’d expect, we’re looking for centralised control of our family’s user accounts from the server itself, making administration a lot easier. Well, that’s what I expected going in to this part of the series. Let’s walk through Lion Server’s user account creation steps.

1. Configure the Server to Manage Network Accounts

There’s not a lot of fun restricting our user accounts to local server access, so the first thing we want to set up is the ability to host network accounts on the server. To do so, open up your Server app, and head up to the top menu. Select Manage > Manage Network Accounts.

The image above shows the menu position you’re looking for (our example here has a different menu option as I took the screenshot after setting up our Network Accounts).

The Configure Network Users and Groups assistant will appear, with an introductory message. The gist here is that to get Network Accounts working, we need to set up something called a Directory Service. You may have heard of Active Directory on Windows Server, which looks after user accounts, user groups and security settings across a business network. We’re going to set up a similar feature here on OS X Lion Server, albeit at a smaller scale for the home. The Mac equivalent to Active Directory is called Open Directory, trivia fans. Click Next to get going.

Rule one of Network Accounts on OS X Lion Server – you have to set up a separate administrator account for managing network users and groups. This is a different account to the primary administrator account you’ve previously set up. An account name (diradmin) is pre-configured for you, but can be changed (and indeed, should from a security perspective). Drop in a password (which can be the same as your main administrator password if you wish, again, the security policy advise against that), verify and select Next.

The next step is primarily for business use – you’re asked for an Organisation Name (go for your family name, or other identifying name) and an email address. Confirm the details, and your server will be configured for Network User management.

2. Add Your Accounts

OK, with Network User management set up, it’s time to start setting up the user accounts for your family. In the Server app, click on Users in the left hand pane and you’ll most likely see a lone account set up there, which will be your server administrator account. To add an account, click the plus (+) button at the bottom of the window.

Adding a user is pretty straightforward – complete the form with the user’s full name, account name, email address and password, then click the check box if you’d like that user to have administration rights on the server (the answer to this question is generally no!) Hit the key icon next to the password field for a little help with password generation if it’s needed – a nice touch. Finally, click the silhouette graphic at the top of the page and you can drop in a photograph of the family member, or an avatar.

Note the blue globe resting at the bottom of the photo allocated to each user – that denotes the user account is a network account.

3. Set Up Permissions

For each user, you can set permissions for allowing/denying access to specific services hosted on the server. To do so, highlight the user, and clock the Action icon, then select Edit access to services. The following window will appear, and you simply uncheck the features to which you wish to deny access.



  1. Great posts you have here on the new Lion Server. I'm currently thinking of upgrading to one from my old Mac server. Just a question or two though (which I hope the author or someone else can help me with).
    I have quite a few Macs in the house (including a MacBook).
    I will be upgrading my Mac Pro to Lion Server, and the whole idea of having everything in a central place is great, I would like to (like you) connect my Macs to the server and log into accounts on the server (with their home directory on the server), this will work fine for my Desktop Macs at home, but what about my MacBook when I'm out and about. I was thinking of connection via a VPN connection but then will this not confuse the MacBook when it first logs in (when offsite), as it will not know where the home directory is (as the VPN connection has not started yet)? I understand that there use to be a thing called mobile accounts which allowed users offsite to log into the server account (with data cashed on the mobile Mac) then when back on site sync the Macs unto the server and update any changes? Anyone got any ideas?
    Thanks in Advance 🙂

    1. Hi Adam

      Yep, you’ve answered your own question there. You can set an account to be a mobile account, which means the data will synchronise with the server (when it has a connection) every x minutes as you determine. I’ll be showing how to configure this in Profile Manager in the next part of the series.


      1. Thanks for the Advice, I was sure I had heard something about Mobile Accounts in OS X SL Server, but wasn’t sure if they had removed it in Lion.

        So with Mobile Accounts, the Account is on the server and is a network account, but data is cached on the Macs you choose to (as I only need it to cache on the MacBook, not my iMac etc. as that is always in the house and will always have a local connection). If I was out and about on the MacBook (on the Mobile Account) and then established a VPN connection, would this then start syncing over to the server, but as soon as the VPN is disconnected it would start caching data to the MacBooks HDD. Is all the data in the Home Folder cached (as I only have a SSD for the MacBook, thus not vast amounts of space as on the Mac Pro).

        Secondly, Would it not also work to set up a Network user on the Server allow it access to services (e.g. File Sharing and VPN) then also set up a local account on the MacBook, and then VPN into the Server when out and if the home folder (of the networked account) is set up for sharing in the File Sharing settings, access it through the VPN tunnel (via local AFP)?

        Sorry for all the questions, just trying to get my head around some areas, Thanks in advance again! 🙂

        1. Hi Adam

          Check out the Mobility section of Profile Manager – particularly the Rules tab, and you'll see you can configure the folders that are synced and when they're synced.

          I've read your second suggestion a few times, but still can't get my head around it, so i reckon it's too complicated to manage! 🙂

  2. Hi Terry…your series is excellent. I purchased Lion Server without any prior knowledge or understanding of servers but am waiting to roll it out until I've been able to read all of your posts. My goals are to have a iTunes and iCal server at the end of this.

    I have one question…what happens to my local user profiles on my client computers if I want to use the same username/email to set up a network user account? Should I just move all of this data directly over or is their a special 'process' that needs to be done?



  3. From what I can see, you’ll need to copy the data over to the new network account and delete the local account, but I may have missed something – thoughts anyone?

  4. Creating a user on the server with the same user name and password as a local user will present the local user an option to convert their local account to a network account on their next login (as long as their on the same network) doing this should pull down all the setting from the server and if the option has been chosen to convert it to a mobile account and it will begin transferring all the data, just as it would if the mobile user as been online for a number of weeks and amassed a lot of new data.

    1. I’ve created networked users on the server w/ same credentials as my local users, and my local machine is connected to the Open Directory, but however I login I can only access my local profile.  Any ideas how to get it to merge the two accounts?

    2. When i tried to setup an identical network account it said I needed a unique name and wouldnt let me setup the user.  How did you get to the option to convert local to network?

  5. Terry,
    I really wanted to thank you for a fantastic walk through, personally I've found it very supportive.

    Question, when setting up the open directory and getting your clients logged in, have you then tried for example turning off the wifi or any access to the server/internet. I've done a couple of tests as wanted to see what the outcome would be as I need a sync solution when not on either my local network or the internet.

    My findings so far are a little disappointing. Each time the finder has crashed no apps or servics are available and I have to go for a restart by pressing the power key on a MacBook Air.

    Any thoughts or advice on this one matter would be gratefully appreciated.

    I look forward to the next edition from you Terry.



    1. Hi Mark

      Appreciate I haven’t covered this yet (watch out for the next part) but have you configured these accounts to be mobile accounts? If not, that may resolve your issue.


  6. “Before we dive into the Apple OS X Lion Server software, it’s worth pausing to consider your hardware setup,” Terry Walsh reports for WeGotServed.

    “You should carefully consider whether you wish to fully dedicate a new Mac to acting as your home server, or whether you’re happy to load OS X Lion Server on an existing machine,” Walsh reports. “Now that Lion Server is available as an add-on download from the App Store, the latter is most definitely the more cost effective option.”

  7. Hi Terry…

    Could I ask a little advice…I'm set to run Lion Server on my main iMac at home, but I have some funds set aside for a dedicated server and I was wondering if you would recommend this over running off my main iMac. I was thinking of a headless Mac Mini (via screen sharing) to do it…

    Thanks for your advice!


    1. Hi Evan

      If you have the funds available and prefer a standalone machine then that’s certainly the traditional route. But the ability to dual purpose a machine as a server with access to standard client apps is one of the big new features of Lion Server and will certainly save you some money – that what I’m doing in this series with an iMac and it’s been fine so far.


  8. Terry – Amazing Article! Just what I was looking for!

    I'm a few steps ahead of you and think I have found some bugs….

    1. SMB doesn't work so well. I have a hard time connecting my Windows 7 desktops to my Lion Server even though I'm doing everything by the book. Windows 7 users names/passwords are not accepted by the server some times. (Sometimes they are strangely enough)

    Also, my WDTV can't see my SMB shares (although I understand this is an admitted bug as Lion Server only supports some flavours of SMB) Any fixes for this?

    2. VNC from a Windows Box will hang the login page after a time. I get the beachball (spinning or otherwise) after several hours. Again, I believe this bug is with older versions of VNC and is not encountered using Apple's Desktop Sharing feature. Hopefully this gets fixed by Apple.

    If you could touch on the following I would be very happy:

    a) How can you set up Lion shares (SMB/AFP) using ACLs to force new files in a Shared Directory to inherit the permissions of the folder? I still struggle on a Group folder where everyone has read/write access – someone drops in a Movie, and no other user can play it because the 'owner' is the guy who drops it in. My Windows Brain doesn't work so well in this department. As a Media server, I'd like to be able to copy all sorts of videos, audio to the Server and have any user access it.

    b) Any suggestions on backing up from a Lion Server to a SMB NAS? (ReadyNas or Windows 7 box?).

    c) Alternatives to a Drobo S for (more) storage?

    d) How to convert Local Users on individual Macs to Open Directory Users on the Server?

    e) How to set up a WebDav server for my iToys

    Thanks very much Terry!

    1. Hi Peter

      That’s quite a shopping list ! 🙂 some of your questions I can answer now, others with some investigation.

      1. Apple updated some of it’s file sharing bits which has required most network device manufacturers to update their firmware. Check with WD on what their schedule is.

      With regard to Windows 7, the server is accepting Windows 7 user accounts? Shouldn’t you be using your server login details to access the server from these desktops?

      A. Group Folder permissions – go to File Sharing on the server app and you can set granular permissions (read/read/write) for individulal users, groups and “everyone else”.

      B. Any NAS that supports Time Machine is fine – check out Synology, QNAP, and LaCie.

      C. There are a lot of drive enclosures on the Market today – again check out LaCie, Icy Dock for some options. Make sure FireWire 800 is supported.

      D. Will need to investigate. Thoughts anyone?

      E. Will cover later.

      1. Thanks very much Terry-

        I should have clarified, I have a hard time connecting to the Lion Server from Windows 7 using credentials of (local) users on that Lion Server. I'd be interested to know if others have the same problems, or if it just me.

        Much appreciated on the other info – I'm going to keep reading your series with interest.

        Peter S

  9. Hi Terry,
    I am currently using an iMac for itunes serving and WHS version 1 for storage of music, films, photos, etc and running squeezebox server. Looking to move to 100% apple so your series of articles couldn't be better timed – thank you.

    Thinking of purchasing a 2011 mac mini server version with single SSD and using attached storage, such as drobo or even a promise pegasus! In this set up would it be better to have the actual user accounts on the attached storage keeping the mac mini SSD free for just the operating system?

    Best Regards

      1. Hi Terry,
        Think what I meant to ask is – would there be a performance hit if all user home folders are on attached rather than internal storage?

        Had thought about getting mini server with both ssd+750gb platter drive but that would mean having data / home folders split between both attached and internal storage. Would that matter performance or administration wise?

        Any thoughts?


  10. If you are using Mail service with Mac OS X Server v10.6 and are performing the upgrade to Lion Server, make sure your mail data partitions and the mail database are accessible during the upgrade process. This automates the mail migration process and requires you to have no interaction.

  11. Hi Terry, Thank you for the excellent post. When I added the network user account while on the local network using the myname.local for the network account server, the OD server responded. When I'm travelling however, the server is not working. I tried loading in the domain name server while on the road (I'm using dyndns to manage our home's dynamic dns), but it gives the error: "Unable to add server. Connection failed to the directory server. (2100). Please advise.

        1. OK, this may be a hangover from the Apple SSL Trust Bug I mentioned in the article – are you able to use a .private or Internet hostname rather than the .local host for the network account server? I was blocked due to the bug, so had to switch to .local so I could get the network account server to be accessed on the home network.

          Try switching it when you're back on local network, and see if that helps.

          1. I’m having the same problem. All apple says is update to 10.7.2 on both client and server but it still doesn’t work over the Internet. Get the 2100 error. Any tips?

  12. Hi Terry, Fantastic series by the way!

    Due to your brain I have been able to get a MBP to connect using a network account I setup on my iMac server, and on the first login it was nice to see that all the home files had been created automatically back on the server for my dummy user. The MBP is running Snow Leopard, and when I login the process of actually logging in takes about 2 minutes. I was wondering if this is expected, and if any other user had experienced it?

    I'm not running anything other than this, and therefore am not using SSL. When I joined the Network Access Server it resolved the name of my Server fine.

    Thanks again for the guide!

      1. Thanks, I was always going to upgrade the clients, just not yet, but I loaded a partition with Lion to test and the login was pretty quick. I guess i'll just have to persist until then. Now to get playing with profiles

  13. Hello Terry,

    Thank you for the great article, we have had many issues from the upgrade from 10.6. With Part 7 Network users and groups, we can't find "Manage network users and groups" from the Manage menu in
    We seem to be missing something.

    Can you please let us know what we have not done to get the drop down menu, to manage the network users and groups. we don't want to start from scratch again.



    1. Rebecca,


      Just thought I’d add that I have the same issue. When I
      follow Terry’s instructions to open Server app “and head up to the top
      menu. Select Manage > Manage Network Accounts”, this option is not
      available to me either.


      Any thoughts Terry? Thanks again for the time you have
      put into this most impressive walk-through.


      1. Hi Dunstan/Rebecca

        Thanks for the comment – apologies I missed Rebecca’s original request. By top menu, I actually mean the menu at the very top of the screen. See the attached image for the position – as my Directory Server is already set up, the language shown here is different to what you’ll see if you’re yet to set up Open Directory –

        Hope that helps!

        1. Terry, thanks for the reply, but I was looking at the right menu, and that it was providing me with the same options your screenshot lists i.e. no Manage Network Accounts. Any thoughts? Thanks in advance.

  14. First off, I would like to say that your series has been a great help to me personally, and it looks like it has helped many other people judging by the comments below. Thank-you sincerely for the obvious time and effort you have put into these articles.

    Now,  I have my server as a 2009 Macbook pro that is a little sluggish, as I wanted to test out the capabilities of the lion server and see what it could do in terms of a home network. I’ve decided to buy one of the new 2011 mac mini servers, as they are extremely energy efficient so I could leave it running while I was at work or such.

    Is there a simple way to migrate my server over to the new machine or will I have to manually reconfigure everything on the mac mini?


  15. Terry, thanks for this excellent guide. This was the only way I got Lion Server working for me.

    I have my server now setup for 4 network users allowing login to 2 iMacs and 2 MacBooks in my house. All logins are working and users get their network shares mounted from the server. Overall this is all good but I have found the following issues with such a setup:
    1) Desktop background changes randomly back to default for some users
    2) Keychain is getting confused requesting to be reset several times
    3) iTunes and App Store getting confused. Saying computer not authorised to play purchased content. Need to reauthorise when changing to another computer.
    4) Permission issues happen easily, e.g. iPhoto complains about not being able to open library
    5) Time Machine backup is not working for users. The backup runs on the server, where the data is, so when a user open Time Machine on client there is no backup. If Admin opens on server can’t see users directories. So that’s defeats the purpose of Time Machine.
    6) Trash is not working. When deleting a file it’s deleted straight away as it sits on the server and it’s not moved into the local trash bin.

    I think many of the above happen due to the ~/Library folder being centrally mounted and each Mac puts slightly different settings in there, e.g. the Keychain issues and background.

    A main concern is iTunes and App Store. It doesn’t seem to go nicely with network accounts. I can see how this works for universities and companies that do not have purchased content on their network share but for home users this seems to be a no-go.

    Last but not least Time Machine backups a made useless.

    If anybody has any experience advise with this please help but in my opinion I’ll be going to have network users account but local directories on my Macs and provide each user a share back to the server for content they want available on all Macs.

    1.  Yep..they are going to have to make sure that iTunes accounts and all other personal preferences are only searched back to the user’s home folder on the server. I just wish the home folder on the server…acted just as a home folder should. Apple really needs to lock that down…disregard Windows users..just get it working Mac to Mac at least. WIndows people have their own issue to deal with. Let’s get this pupply simplified and locked down!

  16. Great column, Terry… these instructions are a life-saver!  The one thing I would still love to see addressed is how to migrate data and preferences from the local account on my macbook to a network account?  Lion Server was marketed to home users, most of whom will clearly have local user profiles and not existing network accounts, so I’m surprised there does not seem to be an easy way to turn an existing local account into a network account.  I’ve found a couple websites that mention there may be a quick way to do this using terminal commands, any advice would be appreciated!

  17. It seems the problem is that the SSL cert files need to be .pem files not .crt files. When you download the SSL files from there is not an option for OS X 10.7, and thus, the files are downloaded in an incompatible format. The proposed solution is to use a converter to get the .crt file converted into a .pem file. There are several converters available online that will do this. One option is the tool at You will need to convert it to DER than to PEM. Can anyone with more knowledge share some opinions on this.

  18. Configure The Server to Manage Network Accounts. 

    I am having trouble progressing with this.  I am not able to set up Network Accounts. When I look at Manage, .. in the upper menu, Network accounts is not there.  When I look at the Apple Help Centre information it says “If Manage Network Accounts isn’t listed, your server already hosts network accounts.” if that is the case, how do I find them.  I have had a look at the Server preferences and Network Preferences does not seem to be there either. So where do I look?
    Your instructions /help file has been great so far, I am hoping that you will have an answer.

    Thanks for your time.

  19. Hey there. These are the BEST instructions, which I followed to a tee… and it keeps giving me an error when I try to log into the network accounts. Simply saying “You are unable to log in to the user account “name” at this time. Logging in to the account failed because an error occurred.” And that’s it. Any ideas?

  20. Hey Terry, just wondering, is there any way to see who is connected to there shared folder? For example, person x connects through say, afp, is there a way i can see that person x is connected?

      1. Thanks, also another thing I’m trying to figure out, I enabled ftp to the server hoping to allow windows users to log into there share mounts (file transfer only) and when they use there given username ad password, its logs them into my personal hard drive to the share mounts, any ideas?

  21. Hi Terry, fantastic series and I’ve bought the ebook too.  Thanks for taking the time to write it all down.

    I’ve got as far as this step and am pretty pleased with myself – domain, SSL, dynamic DNS etc all working.  But I can’t log in from my client machines.  

    I’ve created a ‘testuser’ account which I can log into fine on the server.  On the client machine I get ‘You are unable to log in to the user account testuser” at this time.   Logging in to the account failed because an error occurred”.

    Any ideas?


    1. Haven’t seen this one, but check that the testuser account has been configured as a network account (should show a glowing green orb in and try switching network account access off and on again.

      1. OK, not sure what the issue was but I deleted testuser and created a new one, which works fine.  Onward!

        Thanks (and Merry Christmas)

  22. Hi Terry.  Great book and it has saved me a good deal of headache and time.  However, I continue to be stumped by a problem which seems to be consistent with two Lion Server instillations.  When using network accounts and home folders on the Lion Server, folders that are created are moved to Trash, emptying Trash will not remove these folders.  Individual files are emptied but not a Folder or its contents.  I assume this is a ACL permission issue, but out of the box new Lion Server instillations and configuration by the book yield the same results.  This does not happen if the user home directory resides on the Mac client.  All clients are running Lion.  Any thoughts?

  23. Can I install the Server Admin app on the Lion client, and then use it to set up security in Web Sharing? I want a password prompt to appear when someone comes to look at my Web Sharing files. I have tried to do this manually in Snow Leopard and Lion, and am considering buying Lion Server just for this one purpose, if I cannot get the Server Admin app to do this. If I buy Lion Server, does
    the admin GUI in Lion Server have a GUI option that allows you to set up a
    password prompt for folks that look at my Web Sharing files? Thanks. Paul

  24. When I log in remotely as a network user I create a Mobile account..worked great. I logged recognized the home folder on the server… until I created a document in the users/documents  folder..which is supposed to sync back to the server users/home folder. Didn’t work. I don’t know why this shouldn’t work. Also doesn’t syn the desktop items or background image.

  25. Hi Terry,

    great series on OSX server. I started setting up my osx lion server a couple of days ago and this turned out to be a bit of a challenge.

    After reading your posts here I also purchased your e-book for more of the necessary details.

    Now, at this point I am about to throw my iMac, that I configured as a server, out of the window. I set up everything pretty much according to your standards; except for the ssl certificate is not signed yet. So I need to tell the clients to trust it all the time, no problem there, I’ll fix that in a couple of days.

    When I log on on, using the server itself, with one of the user accounts, no problem there. But trying to get this working from my mac book or my other iMac as clients… no chance. Now to the technical stuff:
    – Users are defined in server with home dir set to a folder on the server.
    – clients (both of them) are bound to the server successfully.

    As soon as I try to log on as one of the users, the client tells me that logging on is not possible at this time, an error occurred. No other information…

    It does not matter whether I connected over WiFi or Ethernet.

    I have been looking at DNS-server settings, ssl certificate problems, read/write problems on the hdd…. I am pretty much out of possible solutions.

    Do you have any idea. I know it’s hard to tell from a distance without being able to look into the details, but maybe you have an idea of what it could be.


    1. Found the problem. File sharing was switched of in the port configuration of my airport. So much for not having to look at these settings if you have an airport extreme. Some how OSX Lion Server failed to change the setting in my airport…. It is like you say in your posts, Terry, one has to jump back and forward to get it done the right way.


Leave a Reply