Remount Help — daveco

The Problem

macOS has no built-in way to persistently map network shares. When your Mac sleeps, changes networks, or the server reboots, your mounted shares silently disconnect. For anyone working from shared storage — edit suites, VFX pipelines, post houses — a dropped mount means stopped work, broken media links, and lost time.

Finder's "Connect to Server" is a manual, one-shot action. Login items can mount shares at startup, but they won't reconnect after an interruption. And macOS hides the SMB configuration options that matter most for performance and compatibility — protocol version, packet signing, multichannel, and port selection — behind a config file (nsmb.conf) that most users don't know exists.

Remount solves both problems: it keeps your shares connected automatically, and it exposes the advanced SMB settings that macOS buries — all from a lightweight menu bar interface.

Getting Started

After installation, Remount lives in your menu bar. Click the icon to see your shares and their connection status at a glance.

Remount menu bar popover showing mounted shares

The menu bar popover shows all configured shares, their mount status, uptime, and automount state.

Click + to add a share. Enter the server hostname or IP address, share name, and credentials. Enable Automount to have Remount reconnect the share automatically whenever it becomes available — on login, on wake from sleep, or when the network returns.

Most controls in Remount have tooltips and info popovers. Hover over any icon or setting to learn what it does.

Getting the Best Performance

SMB Signing and Throughput

SMB signing adds a cryptographic signature to every packet exchanged between your Mac and the file server. It protects against tampering on untrusted networks, but it comes at a significant performance cost — often 30–50% lower throughput on high-speed connections.

Since macOS 10.13.4 (High Sierra), Apple has disabled SMB signing on the client by default. But SMB signing is a negotiation: if your file server requires signing, the client must comply regardless of its own setting. This means disabling signing in Remount (or in nsmb.conf) will have no effect if the server still demands it.

How to Check if Your Server Requires Signing

Mount the share, then open the Share Info tab in Remount's info dialog. Look at the three signing fields:

Server requires signing

SIGNING_ON: true and SIGNING_REQUIRED: true — the server is enforcing signing. Disabling it in Remount won't help. Contact your server administrator about disabling the signing requirement.

SMB Share Info showing signing not required

Signing disabled

SIGNING_ON: false and SIGNING_REQUIRED: false — signing is off. This connection has the best possible throughput for the negotiated SMB version.

Talking to your server administrator: If your server requires signing and your network is trusted (e.g., a dedicated storage VLAN in a production facility), ask your administrator to disable the signing requirement on the server. On Windows Server this is a Group Policy setting; on most NAS appliances (Synology, QNAP, TrueNAS) it's a checkbox in the SMB service configuration. The server can still support signing without requiring it, letting each client decide.

Expected Throughput

Your maximum file transfer speed is limited by the slowest link in the chain: your Mac's network interface, the cable or switch, and the server's interface and disk subsystem. Here are the theoretical maximums for common interface speeds:

Network Interface	Link Speed	Theoretical Max	Realistic SMB
Wi-Fi 6 (802.11ax)	1.2 Gbps	~150 MB/s	60–100 MB/s
1 GbE (Gigabit Ethernet)	1 Gbps	125 MB/s	100–112 MB/s
2.5 GbE	2.5 Gbps	312 MB/s	250–290 MB/s
5 GbE	5 Gbps	625 MB/s	500–580 MB/s
10 GbE	10 Gbps	1,250 MB/s	900–1,100 MB/s
25 GbE	25 Gbps	3,125 MB/s	2,000–2,800 MB/s

How to check your link speed: Open System Settings > Network, select your interface, and look for the link speed. Alternatively, click the Network tab in Remount's share info dialog to see the interface and speed for each mounted share.

If your measured throughput is significantly below the "Realistic SMB" column, check for SMB signing (above), switch from Wi-Fi to wired Ethernet, and verify your server's disk subsystem isn't the bottleneck.

For rigorous performance testing, use ShareBench — our multi-stream benchmarking tool designed specifically for network storage in media workflows.

Other Performance Tips

Disable .DS_Store on network shares

In Settings, enable "Don't read/write .DS_Store files on network shares." This prevents Finder from writing metadata to every folder you browse, reducing unnecessary round-trips. Requires logout or restart to take effect.

SMB Multichannel

Multichannel can improve throughput when your Mac has multiple network paths to the server (e.g., two Ethernet NICs). If you only have one path, or one path is Wi-Fi, multichannel may actually hurt performance. Disable it in Settings if you're seeing inconsistent speeds.

Prefer wired connections

When multichannel is enabled, macOS may use Wi-Fi as a secondary channel. Enable "Prefer wired connections" in Settings to prevent this.

SMB Protocol version

Restricting to SMB 2/3 or SMB 3 only improves security and can avoid fallback to older, slower protocol versions. Most modern NAS devices support SMB 3.

Features Overview

Automatic Reconnection

Remount monitors your configured shares and reconnects them silently whenever they become available — on login, on wake, or when the network comes back. By default, Remount runs as a menu bar app and must be running to maintain mounts. Enable "Start at login" in Settings to keep Remount resident across restarts.

Secure Credential Storage

Credentials are stored using AES-256 encryption with a per-installation key, or optionally in the macOS Keychain. You can export your encryption key for backup. Per-share authentication supports domain accounts (DOMAIN\username), Kerberos, and guest access.

Connection Monitoring

Each share has an info dialog with four tabs:

Share Info — SMB version, signing status, encryption, and detailed connection metadata
Network — the network interface, link speed, and IP address used for this connection
Processes — apps and system services currently accessing the share (useful for diagnosing why a share won't unmount)
Logs — mount, remount, and failure events with timestamps and error details

Processes tab showing apps using a share

The Processes tab identifies which apps are holding a share open.

The Logs tab shows connection history, remount attempts, and failures.

Stale Mount Detection

Remount detects shares that macOS reports as mounted but are actually disconnected (stale mounts). These ghost mounts cause Finder hangs and broken file references. Remount can automatically clean them up and reconnect.

Configuration Import & Export

Export your full share configuration as an encrypted file for backup or deployment across machines. Supports MDM-compatible profiles for enterprise deployment.

Wake-on-LAN

Send a Wake-on-LAN magic packet to power on a sleeping NAS before attempting to mount.

Authentication

Authentication Types

Each share can use one of four authentication methods:

Automatic (default) — tries credentials saved in Remount first. If missing or rejected, hands off to macOS, which will check the system keychain and Kerberos tickets before prompting you to log in. This is the recommended default
Kerberos — uses Kerberos ticket-based authentication. Requires an Active Directory or LDAP environment
Username/Password — uses only the credentials stored in Remount. Will not prompt or fall back to system keychain
Guest — connects anonymously. Will fail if the server does not allow guest access

Automatic Authentication Cascade

When set to Automatic, Remount tries its own stored credentials first. If no credentials are stored (or they are rejected), Remount hands off to macOS, which controls the remaining credential priority:

Credentials stored in Remount (if you entered a username and password in the share configuration)
If Remount has no stored credentials, or they are rejected, macOS takes over:

Kerberos tickets in the system ticket cache (preferred when available — e.g., if the Mac is bound to Active Directory)
Credentials in the macOS system keychain (e.g., passwords saved previously in Finder via "Connect to Server")
If none of the above succeed, macOS displays the standard Finder authentication dialog

This is why leaving the username and password fields empty in Remount often "just works" — if you've previously connected to the same server in Finder and saved the password, macOS will use those stored credentials automatically. Similarly, if your Mac has valid Kerberos tickets (from Active Directory or MDM SSO), macOS will use those without any credentials needing to be stored.

System Keychain vs. Remount Credentials

There are two separate credential stores that can supply passwords for network shares:

macOS System Keychain

Passwords saved by Finder or other apps (e.g., when you check "Remember this password" in the Connect to Server dialog). Remount cannot read or manage these directly, but macOS will use them when Automatic auth is selected and Remount doesn't supply its own credentials.

Remount Encrypted Storage

Credentials entered in Remount's share configuration are encrypted with AES-256-GCM using a per-installation key stored in the macOS Keychain (with Secure Enclave protection on Apple Silicon). These are completely separate from the system keychain and are only accessible to Remount.

When to use which: If you need centralized credential management (e.g., deploying the same shares to multiple machines via MDM), store credentials in Remount and export the configuration. If you prefer macOS to manage passwords alongside your other saved credentials, leave the fields empty and let the system keychain handle it via Automatic auth. You can also export Remount's encryption key and import it on other machines to share encrypted configurations.

Explicit Auth: Fail Behavior

When using Username/Password or Guest mode (as opposed to Automatic), authentication is explicit — Remount will not fall back to the system keychain or show a login prompt:

Username/Password — uses only the credentials stored in Remount. If they are wrong or missing, the mount fails immediately with an authentication error. No Finder dialog will appear
Guest — sends no credentials. If the server rejects anonymous access, the mount fails. No fallback to stored passwords

This deterministic behavior is useful in automated environments where you want mounts to either succeed with specific credentials or fail cleanly without interactive prompts.

Kerberos Authentication

Kerberos provides single sign-on (SSO) for environments with Active Directory or LDAP servers. Instead of sending passwords over the network, Kerberos uses time-limited tickets issued by a Key Distribution Center (KDC).

Requirements

An Active Directory or LDAP server acting as a Kerberos KDC
A network-authenticated user account (the Mac must be bound to the directory, or the user must have a valid Kerberos ticket)
For automatic ticket renewal at login: a modern MDM that handles SSO at the login window (see MDM Kerberos Integration)

How It Works in Remount

When a Kerberos share is mounted, Remount attempts to acquire a Ticket-Granting Ticket (TGT) using the stored username and password
Remount then requests a service ticket for the specific file server
If a valid ticket exists in the system cache, the mount proceeds without sending any password
If no valid ticket is available, the mount fails with a clear error

Ticket Renewal

Remount monitors Kerberos tickets every 15 minutes and attempts automatic renewal when a ticket is within 60 minutes of expiry. However, there are limitations:

Renewable lifetime — tickets can only be renewed up to the server's renewable lifetime limit (typically 7 days, set by your AD/KDC administrator). After this window closes, a new TGT must be acquired with a password
Non-renewable tickets — if the KDC issues non-renewable tickets, Remount cannot extend their lifetime. You'll be notified when expiry approaches
No stored credentials — if you don't store a username and password in Remount, it cannot acquire a new TGT when the renewable lifetime expires. The Mac must obtain a fresh ticket through another mechanism (e.g., SSO at the login window via MDM, or manual kinit)

Best practice for Kerberos: Store the username and password in Remount so it can acquire fresh tickets when needed. For environments where password storage is prohibited, deploy a modern MDM with Platform SSO or Kerberos SSO extension to handle ticket acquisition at the login window (see MDM Kerberos Integration).

Advanced Per-Share Options

Each share has an Advanced Options panel accessible from the share edit dialog. These settings are applied per-share and override global defaults.

Advanced options for SMB shares

Advanced options for NFS shares

Common Options (SMB & NFS)

Read Only — mount the share as read-only, preventing accidental writes
Hide from Finder — the share is mounted but won't appear in Finder's sidebar or on the Desktop
Ignore Ownership — treat all files as owned by the current user, useful when UID/GID mapping doesn't match
Custom Port — connect on a non-standard port (useful for tunneled or non-default server configurations)

SMB-Specific Options

Soft Mount — if the server becomes unreachable, I/O operations fail immediately instead of hanging. Prevents Finder freezes when a server goes down
Disable Streams — disables named streams (NTFS alternate data streams). Can resolve compatibility issues with certain NAS devices

NFS-Specific Options

Soft Mount — same as SMB: fail I/O immediately when the server is unreachable instead of hanging indefinitely
Interruptible — allows NFS operations to be interrupted by signals. Recommended for interactive use
Async I/O — enables asynchronous writes for better performance. The server confirms the write before data is flushed to disk

Global SMB Settings

Remount provides a GUI for macOS's nsmb.conf file, which controls system-wide SMB behavior. Changes require shares to be remounted to take effect.

SMB configuration, encryption key management, and MDM export in Settings.

Apply settings to all users — stores nsmb.conf globally instead of per-user. Requires administrator access
Enable SMB Multichannel — uses multiple network paths when available. See performance tips
Prefer wired connections — prevents Wi-Fi from being used as a secondary multichannel path
Disable SMB signing — disables signing on the client side. See SMB Signing and Throughput
SMB Protocol version — restrict which SMB versions are allowed during negotiation
Custom SMB Settings — direct editor for nsmb.conf. External changes are detected automatically

Supported Protocols

SMB (Server Message Block) — full read/write with advanced configuration. The recommended protocol for most environments
NFS (Network File System) — full read/write, commonly used in Linux/Unix environments
WebDAV — full read/write with optional SSL/TLS
AFP (Apple Filing Protocol) — deprecated by Apple. Experimental support for legacy servers
FTP — read-only, no TLS. Experimental. For reliable FTP, use a dedicated client

MDM Integration

Remount supports enterprise deployment through standard macOS MDM configuration profiles. You can export a complete configuration, push it to managed Macs, and optionally lock settings to prevent user modification.

Exporting an MDM Profile

Open Settings in Remount
Scroll to the MDM Configuration section
Choose whether to Include Passwords — if enabled, encrypted credentials are included in the profile. The receiving Mac must have the same encryption key imported to decrypt them
Choose whether to Enforce Settings — if enabled, users cannot modify any settings or shares on the managed Mac
Click Export Config to save a .mobileconfig file

The exported profile uses the standard com.apple.ManagedClient.preferences payload type with a Forced management level, ensuring it reapplies on every MDM sync.

Restricting User Editing

When a profile is deployed with Enforce Settings enabled (allowUserEditing: false), Remount locks its UI:

All settings fields become read-only
Users cannot add, remove, or edit shares
Users cannot change mount location, SMB options, or appearance
Manual mount/unmount actions remain available
If the MDM profile is removed, the UI unlocks automatically

Configuration Profile Keys

For administrators who need to manually edit profile keys or build profiles with a profile creation tool, here are the supported keys inside the preferences dictionary:

Key	Type	Description
`allowUserEditing`	Bool	Lock all settings when `false`
`networkShares`	Array	Configured shares (hostname, protocol, shareName, username, encryptedPassword, automount, advancedOptions)
`defaultMountBase`	String	Mount point base directory (default: `/Volumes`)
`startAtLogin`	Bool	Launch Remount at system login
`dontWriteDSStore`	Bool	Prevent .DS_Store on network volumes
`smbProtocolVersion`	String	`"7"` (SMB 1/2/3), `"6"` (SMB 2/3), `"4"` (SMB 3 only)
`useGlobalSmbConfig`	Bool	Use global vs. per-user `nsmb.conf`
`smbCustomSettings`	String	Raw `nsmb.conf` content
`overrideSystemParameters`	Bool	Enforce nsmb.conf and DS_Store settings over system defaults
`interfaceMode`	String	`"menuBar"` or `"window"`
`appearanceMode`	String	Light, Dark, or Auto
`fixMountPaths`	Bool	Auto-detect and fix stale mount points
`autoAddMountedShares`	Bool	Detect externally mounted shares
`kerberosRenewableEnabled`	Bool	Enable automatic Kerberos ticket renewal
`kerberosRenewLifetimeDays`	Int	Maximum renewable lifetime for Kerberos tickets (days)

Password portability: Encrypted passwords in the profile are encrypted with Remount's per-installation key. To deploy credentials across machines, export the encryption key from the source Mac (Settings > Encryption > Export Key) and import it on each target Mac before installing the MDM profile. Without the matching key, shares will be created but credentials will be empty.

Auto-Update Keys

Remount uses the Sparkle framework for automatic updates. Sparkle's update behaviour can be controlled via MDM using standard keys at the app domain level (app.daveco.remount), separate from the preferences dictionary above:

Key	Type	Default	Description
`SUEnableAutomaticChecks`	Bool	`true`	Periodically check for updates in the background
`SUAutomaticallyUpdate`	Bool	`false`	Install updates automatically without prompting the user
`SUScheduledCheckInterval`	Int	`86400`	Seconds between automatic update checks (default: 24 hours)
`SUAllowsAutomaticUpdates`	Bool	`true`	Set to `false` to prevent users from enabling automatic updates

Example: To disable all automatic update checks across managed Macs, deploy a configuration profile targeting app.daveco.remount with SUEnableAutomaticChecks set to false. Users will still be able to check manually via the menu.

MDM Kerberos Integration

For Kerberos authentication to work seamlessly with Remount in a managed environment, the Mac needs a valid Kerberos ticket before Remount attempts to mount shares. The most reliable way to achieve this is with a modern MDM that handles SSO at the macOS login window:

Jamf Pro — Kerberos SSO extension or Jamf Connect
Kandji — Passport / Platform SSO
Addigy — Kerberos SSO extension profile
Mosyle — Platform SSO configuration

These MDM solutions acquire a Kerberos TGT during user login, which is then available in the system ticket cache for Remount and other apps. This eliminates the need to store passwords in Remount for Kerberos shares.

Without MDM-managed SSO, a Mac bound to Active Directory will still receive Kerberos tickets automatically at login — but only while the Mac can reach the domain controller on the local network. This approach works for desktops on a corporate LAN but is not suited for laptops that travel outside that network, as tickets cannot be renewed once the KDC is unreachable.

For machines without AD binding or MDM SSO, Kerberos tickets must be acquired manually (kinit user@REALM in Terminal) or by storing the username and password in Remount so it can run kinit on your behalf.

Tips

Leave username and password empty to use the macOS system keychain
Changes to .DS_Store settings require logout or restart to take effect
Changes to SMB settings require remounting affected shares
If a share won't unmount, disable automounting first, then close all files on the share. Use the Processes tab to find what's holding it open

Troubleshooting

Share fails to mount

Check credentials — verify your username and password by testing with Finder (Go > Connect to Server) or Terminal
Check network reachability — ensure the server is online. Try ping hostname in Terminal
Check the share path — for SMB, this is the share name (e.g., Media). For NFS, this is the export path (e.g., /volume1/shared)
Check the Remount log — open the Logs tab in the share info dialog for detailed error messages

Share mounts but disconnects frequently

Ensure automounting is enabled for the share
For SMB shares, try enabling Soft Mount in Advanced Options to prevent Finder hangs during reconnection
Prefer wired Ethernet over Wi-Fi for reliability

Share won't unmount

Disable automounting for the share first
Use the Processes tab to identify which apps are holding the share open, then close them

Getting Help

If you're stuck, email hello@daveco.app with:

Your macOS version (Apple menu > About This Mac)
The protocol you're using (SMB, NFS, etc.)
The error message from Remount's log viewer