Changelog

Fixed

• Minor bug fix for how auto-update (Sparkle) behaves Starting with Version 4.1.2, SUEnableAutomaticChecks is set to true by default. If this should be disabled via MDM, disableAutoUpdateFramework = true must be set

What’s new

• Shares with %USERNAME% now use the username from authentication instead of the local macOS username

Fixed

• Fixed a regression where Kerberos shares using externalKerberosManagement were never mounted because the app skipped them when it found no app-managed Kerberos ticket. Such shares are now mounted directly, letting the external ticket source or macOS handle authentication.
• Fixed a “Realm conflict” error that could appear right after entering credentials when an MDM-configured kerberosRealm was set: the app created an automatic placeholder profile for the realm that then collided with the profile created from the entered credentials. The placeholder is now skipped while credential onboarding is pending.
• Fixed several issues with externalKerberosManagement shares (tickets managed by Jamf Connect, Apple SSO Extension, or AD binding): the credential prompt no longer appears at startup when all Kerberos shares are externally managed; the externally managed authentication profile now correctly shows the live ticket status read from the system instead of “No Ticket”; and it no longer offers a (non-functional) “Refresh ticket” action, since renewal is handled by the external tool.

What’s new

• In macOS 26.5, Apple finally fixed a bug introduced in macOS 25.4. The Network Share Mounter now works as it used to, but full disk access is now required. The app now guides users through granting the required Full Disk Access permission
• New per-share MDM key externalKerberosManagement: marks individual Kerberos shares as using ticket management provided by an external tool (AD binding, Jamf Connect, Apple SSO Extension). Network Share Mounter mounts the share without interfering with Kerberos tickets, and no “profile required” warning appears in the menu bar
• New per-share autoMount MDM key (default: true): when set to false, the share is shown in the menu bar but is never mounted automatically. Users can still mount it manually by clicking the menu item. This is useful for optional shares that should be available on demand without cluttering the auto-mount cycle
  • Also available in the user interface: the “Mount automatically” toggle in the Add/Edit share sheet
  • Menu bar icon uses an outline symbol for autoMount = false shares (vs. filled for auto-mounted shares) to visually distinguish them
• Password expiration warnings for Active Directory/Kerberos environments: users are notified when their AD password is about to expire
  • Configurable warning threshold via MDM (ExpirationCountdownStartDay, ExpirationNotificationStartDay, both default to 14 days)
  • Optional passwordChangeURL MDM key: configures a web URL (SSPR portal) opened when the user clicks “Change Password”
  • In-app password change via kpasswd: when no passwordChangeURL is configured, a “Change Password” sheet allows changing the AD password directly within the app — the new password is automatically saved to the correct Keychain entry
  • Menu bar countdown item showing days remaining (aligned with Apple Kerberos SSO Extension and Jamf Connect behaviour)
  • Automatic once-per-day dialog within the notification threshold
  • Respects the Active Directory “password never expires” account flag (UAC 0x10000)
• New MDM key kerberosProfileDisplayName: sets the display name of the automatically created Kerberos authentication profile. If not set, the realm name (e.g. INT.MOZ.AC.AT) is used as the profile name
• Optional allowPasswordChange MDM key (default: false): when enabled, a permanent “Change Password…” item is shown in the menu bar at all times — transforms into the standard expiry countdown when the threshold is reached
• Debug log collection now includes system-level SMB and authentication agent logs (requires Full Disk Access), making support diagnosis significantly faster

Fixed

• Fixed: autostart deployed as a locked MDM key was only applied on first launch and then ignored — it is now enforced on every app launch as intended
• Fixed handling of wrong AuthType String value:
  • In older docs we documented the string value “password” for the username/password authentication stored in AuthType, but the actual raw value in code is “pwd”.
  • To keep backward compatibility (and avoid crashes/decoding failures), we map the legacy value “password” to .pwd
• The behavior when editing a profile has changed: Entering a username no longer assumes it is a Kerberos account when an “@” is entered. Previously, in this case, the profile was created as a Kerberos profile.
• Fixed a regression where adding a new property to AuthProfile caused all existing authentication profiles to be silently discarded on app launch, resetting credentials for all users
• Fixed: externally managed Kerberos shares (using externalKerberosManagement) no longer incorrectly trigger internal Kerberos re-authentication when a mount fails

Fixed

• Fixed a bug where, under certain circumstances, the app icon does not appear in the menu bar
• Revisited the workaround for the macOS 26.4 bug: the defined share names now appear correctly in the menu
• Fixed a bug that prevented the newly created entry in Sparkle’s appcast file from being signed
• Changed a few minor flaws in the text and documentation

Fixed

• Fix SwiftUI stack overflow in profile views (#307)
• Fix stack overflow in App scene body (EXC_BAD_ACCESS) (#308)
• Workaround for the issue where the Settings window displayed an icon in the Dock that wouldn’t go away (#264)
• Fix for an issue where shares were not always saved correctly (#315)
• Fix for mounting multiple network shares under /Volumes from different servers but with the same share name (#310)

What’s new

Modern SwiftUI Interface

Version 4 features a completely redesigned user interface built with SwiftUI:

• Clean, modern settings window with tabbed navigation
• Better organization of shares and authentication profiles

Authentication Profiles - Reusable Credentials

Instead of storing credentials separately for each share, you can now create reusable authentication profiles.

• Fewer duplicates: Credentials stored once in Keychain instead of multiple times
• Easier management: Update passwords centrally, not per-share
• Clear overview: See which shares use which profiles
• Flexible: Reassign shares to different profiles anytime

Custom Mount Point Names

You can now choose custom local names for your network shares, solving the duplicate share name problem:

• Previously, mounting shares with identical names from different servers would cause conflicts
• Now you can assign individual local names to each share
• Note:
  • Shares are mounted with your chosen name, Applications and scripts see the correct path
  • For macOS systems, due to a limitation on mounts, Finder still displays the original share name from the server.

Additional Improvements

• Active Directory binding: - Can differentiate between Macs bound to Active Directory and those that use Kerberos authentication
• Native autostart: Uses macOS 13+ SMAppService API instead of using an external library
• Better error messages: Clear, actionable error descriptions
• Modern Swift architecture: Full async/await and Actor implementation
• Comprehensive testing: Unit tests for critical components

System Requirements

• macOS 13.5 (Ventura) or later
• Optional: Kerberos configuration for Active Directory

Fixed

• Force Kerberos re-auth on mount retry + improved error handling
• Preserve case-sensitive Kerberos principals in keychain

Fixed

• Kerberos authentication failures caused by case-sensitive principal name mismatches. The app now retrieves and uses the actual principal name from the Kerberos credential cache instead of reconstructing it, preventing kswitch failures when username case differs between stored accounts and Kerberos tickets.

Added

• If a Kerberos-authenticated mount fails, an attempt will be made to re-authenticate, followed by a second mount attempt before an error occurs.
• After macOS wakes up, the internal mount structures will be fully reinitialized, which includes rereading the MDM profile and user configurations, as well as resetting the mount statuses and a few more things.

Fixed

• Fixed a regression that prevented mounts from occurring at app startup (#252, #246).

Fixed

• Fixed a regression where the Sparkle framework was accidentally rolled back to an older version.

Fixed

• Fixed a bug where the shares did not mount after the app was started (#242).

Fixed

• Fixed a few UI regressions.
• Fixed a race condition in Preferences view.

Changed

• Some minor improvements in responsiveness.

Fixed

• Resolved “App hanging” reported by Sentry (#232).

Fixed

• Ignore spaces at the beginning and end of shares in profiles (#223).
• Fixed the timing for reading SMBHome: now SMBHome will be read each time a network change occurs (#224).
• Fixed a race condition and a system attribute check for directories where directories in a share could potentially be deleted (#255).

Changed

• Clarification in the README: Using SMBHome as users’ home share only works if the Mac is bound to Active Directory.

Fixed

• Fixed a race condition during app startup that caused issues with obtaining Kerberos tickets.

Fixed

• Fixed a bug where shares mounted at various levels could result in the removal of directories.
• Removed a race condition that resulted in recursive notification calls, causing high load and constantly rebuilding the app menu.
• Minor fix in displaying authentication errors by changing the menu app icon color.

Fixed

• Fixed a race condition.

Changed

• Improved directory and file handling (using FileManager instead of calling shell commands).

Added

• Added more logging output to enhance bug detection.

Fixed

• Fixed several minor bugs, including one related to hidden shares.

Fixed

• Fixed a few problems reported by Sentry (#179, #180, #181, #182, #186, #188).
• Backported custom user variable (%USERNAME%) from new branch for NSM-4 (#175).
• Hopefully fixed a bug with mounting a subdirectory of a hidden share (#189).

Changed

• Added a few more useful logging points for debugging.

Fixed

• Fixed a problem where shares ended with the special character $ (aka hidden share) (#165).
• Resolved several bugs that caused exceptions (#156, #172, #173).
• Corrected a type issue (#162).
• Made improvements in keychain handling (#151).
• Fixed an issue where the menu-bar object fails to open if no shares are configured (#163).
• Addressed a Kerberos ticket management issue (#171).
• Fixed problems with disabling the auto-update functionality (enableAutoUpdater) (#152).

Changed

• Created and enhanced XCTest functions.
• Improved the core mounter class.

Fixed

• Various runtime bugs and crashes found and fixed via Sentry (#144, #145, #146, #147, #148).

Added

• List mounted/unmounted shares in menu bar; clicking a mounted share opens its directory (#46, #122). Configurable via MDM using boolean showMountsInMenu (default: true).
• Every individual menu item can now be configured as hidden or disabled via MDM (#122):
  • menuAbout
  • menuConnectShares
  • menuDisconnectShares
  • menuCheckUpdates
  • menuShowSharesMountDir
  • menuShowShares
  • menuSettings
  • Values: disabled (grayed out) or hidden (not visible).
• Local override of %USERNAME% (#130): if the local username does not match the account name of a network share, an alternative username can be used instead (usernameOverride).
• Integrated Sentry for issue and crash report collection (#131, #135, #138). Uses a locally hosted instance — data never leaves local servers. Collection can be disabled by the user via a dedicated switch (not configurable via MDM).

Fixed

• Fixed a bug where Finder could crash (#134).
• Fixed a bug where custom network shares were not editable (#137).
• Fixed two race conditions (one in the DogeAD library).
• Fixed a possible memory management crash in PreferenceManager.setADUserInfo (#142).

Added

• Mount and unmount can now be triggered via UNIX signals: kill -SIGUSR1 <PID> unmounts all shares, kill -SIGUSR2 <PID> mounts all shares (#106).
• Mount status display enhanced with SF Symbols.
• Integrated the Sparkle framework for in-app updates. Controlled via enableAutoUpdater (default: true) (#116).
• Increased menu icon size.

Fixed

• Fixed two race conditions (one in the DogeAD library) (#123, #125).
• Fixed a bug where the menu bar icon color did not reflect the Kerberos ticket status.
• Fixed a crash caused by a bug in the DogeAD Kerberos authentication library.
• Fixed a bug in the external DogeAD Kerberos authentication library causing crashes after some time (#113).
• Workaround for Finder showing already disconnected drives after wakeup (#109).

Fixed

• Fixed a bug where mounts under /Volumes as the default mount path generated sharename-1 etc. directories:
  • If a directory with the same name as the share already exists under /Volumes, the mount will be aborted.
  • Since /Volumes is read-only for regular users, zombie mount directories cannot be deleted automatically. Network Share Mounter is unable to resolve stale directories under /Volumes.
  • Users with root privileges can delete these manually; admins can use scripts. Directories are also removed after a macOS reboot.
• Fixed a bug where the menu bar icon color did not reflect the Kerberos ticket status.

Fixed

• Fixed a crash that occurred when the Mac wakes up from sleep.

Changed

• User-triggered “mount all shares” will also re-authenticate/renew Kerberos tickets when Kerberos is enabled (Beta).

Fixed

• Fixed migration of FAU Prefix Assistant account to NSM’s keychain.

For usage and configuration examples please consult the documentation.

Added

• Transition from Grand Central Dispatch (GCD) to Swift Concurrency for improved asynchronous task management.
• Mount operations are now executed in parallel (#36).
• New internal data structure for shares, recording the current mount state (pending, queued, mounted, error) and supporting explicit mount points per share (#60).
• Managed shares now support username/password authentication (#54, #34).
• Users can choose between username/password or Kerberos authentication.
• User-defined share credentials are now stored in the macOS Keychain.
• Support for afp:// and WebDAV (https://) protocols.
• Kerberos SSO support via new authentication library — potential alternative to Apple Enterprise Connect, Jamf Connect, or NoMAD. Supports obtaining and renewing Kerberos tickets via configured realm. Menu icon reflects credential status via color coding.
• If the user disconnects drives via the menu, they remain disconnected until a network change occurs or the user remounts them manually.
• Shares can be mounted/unmounted during specific system events (network changes, sleep, shutdown, app quit).
• Detailed and clear logging for all crucial operations.

Changed

• The occurrence of multiple mount directories (SHARE-1, SHARE-2, …) has been eliminated (#48, #53, #66).
• MDM-defined network shares can now be handled in a more flexible manner.
• The app now consistently reflects changes made to the MDM profile (#71).

Fixed

• The issue of mounts “overtaking” themselves has been resolved.
• Numerous further bug fixes.

System Requirements

• macOS 11 Big Sur or later.