I'm struggling with how directory services and local Mac accounts interact. I'm hoping to not have to specifically assign the 'Windows File Sharing' option to each user individually or Network Directory group access.

Is it possible to share files to Windows clients who have a Local Network Directory (Open Directory) account in macOS Mojave?

  • There may be two questions here - how you want to set up a user and why SMB sharing fails for those (might be twiddling the settings on the Mac - might be an incompatibility). Second question might be to document what versions of SMB sharing Mojave allows and the tradeoff for supporting groups on that version of SMB
    – bmike
    Oct 27, 2018 at 14:17
  • Let's see if this clarification can move to chat.
    – bmike
    Oct 27, 2018 at 14:18
  • I believe macOS Mojave supports SMB major versions 1, 2 and 3. Sorry, chat doesn't work for me due to reputation requirements.
    – hgv
    Oct 27, 2018 at 14:26

2 Answers 2


Think of macOS like a unix server. It runs it's own directory service and unless / until you bind it to another directory (like LDAP or NIS or AD) - you get any local account / password only when a SMB share tries to authenticate. It typically allocates user id number 501 to the first user so when a lot of Macs share files, the file server will see all the initial Mac accounts as the "same 501 account"

If you're OK setting up one Mac server - then I would go with Server.app to set up your small number of accounts but this gets unwieldy after a dozen to a few hundred accounts and you'll want to set the Mac to join an external domain. Then you could have people sign in to the shares using that scheme to issue unique ID numbers and accounts to each person to keep things straight.

For the Mac running LDAP/OpenDirectory there are several posts here that apply:

So - to address the two main points:

  1. You don't need to do anything specific to allow SMB sharing permissions - if the account exists on the Mac due to being a local account or part of a directory it subscribes to - shares that allow all users will just work when a correct user/pass is presented from windows SMB clients (or any SMB client for that matter)
  2. You can have multiple directories of accounts - the Mac will order them in most preferred to last checked - as long as one user is found in one directory - that user can potentially log in.

Start small with this - you can set up two or three users and test easily. Once you figure out if you want server app or just normal sharing (you might not need server.app) you can find the log files that log errors and quickly suss out when there's a problem in most cases.

  • If this was true, why is there a separate option named 'Windows File Sharing' under System Preferences > Sharing > File Sharing? Furthermore, why can't I access a SMB share from a Windows client *unless I specifically enable a user account from under that option?
    – hgv
    Oct 27, 2018 at 13:48
  • Up until Sierra it is possible to install Server.app and set up File Sharing to cater for both macOS and Windows clients using Local Network Accounts. Starting from High Sierra, File Sharing functionality has been migrated from Server.app to System Preferences. There appears to no longer be a possibility to enable Windows clients (using SMB) unless specifically enabling it on a per-user basis. The list of users under System Preferences > Sharing > File Sharing > Options > Windows File Sharing doesn't include Local Network Accounts by default. Only Local Accounts.
    – hgv
    Oct 27, 2018 at 13:54
  • OK @hgv - Excellent. I tried to reopen your question to get the discussions going. The difference between network accounts and non network accounts is one key obstacle to clarify for what you want. The second is the additional share step. I'll put up an image that hopefully illuminates. In the end, you'll need to figure out if you need older legacy SMB authentication (which is what I would need to research to be sure) might do by storing a NTLM authentication version of the password hash / key. I'm wrecking this and waving my hands at it. Let's meet in Ask Different Chat to clarify.
    – bmike
    Oct 27, 2018 at 14:14
  • Argh - you're probably pretty new so getting you rep to get into chat might be a challenge. Worst case - ask a second question please - explain exactly how you set up a network account or drop a screen shot of the screen where you make a user. Better if you can show it in terminal. I'll work on getting you a chat room where we can talk.
    – bmike
    Oct 27, 2018 at 14:16
  • The key issue here is sharing files to Windows clients. As I wrote in my previous comment, there's a separate option to enable Windows File Sharing in High Sierra and Mojave. Authentication for an SMB connection doesn't work (for a Windows client) unless you select the specific users you wish to enable it for. And, to repeat myself, you can only enable it for Local Accounts by default. Not Local Groups, not Local Network Accounts, not Local Network Groups.
    – hgv
    Oct 27, 2018 at 14:35

It is indeed possible to enable Windows File Sharing for a network directory account. You'll need to do the following:

  1. Run sudo pwpolicy -u <shortname> -sethashtypes SMB-NT on in a Terminal; authenticate for sudo.
  2. Have the user you just modified in step 1 set their password. This does not mean they have to change it; if you run passwd <shortname>, they can enter the same password in both the Old Password and New Password prompts. This is enough to get the Mac to re-hash the password for the SMB-NT type required for Windows file sharing.

Unfortunately, there does not seem to be a way for the admin to do this for someone, without the admin needing to reset their password to something else. Hope this helps!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .