Blog Home > Dynamic Analysis > OS X Active Directory Integration – How to Bind a Mac to AD

OS X Active Directory Integration – How to Bind a Mac to AD

| 7 Comments

OS X Active Directory IntegrationAre you tasked with establishing appropriate OS X Active Directory Integration in your environment? Are we talking apples and oranges here or what? Most IT professionals are efficient with the Mac OS X or Windows Active Directory (AD) but not both. I’m sure you’ve had plenty of good fun harassing one or the other on either platform. Is it really possible to allow a Macintosh Computer to become a law abiding citizen of an AD Domain? If so, how much Pepto Bismol am I going to need to get through it? Sorry for the drama, but I wanted to get your attention.

As it turns out, the Mac natively supports OS X Active Directory Integration for their loyal followers that apparently are being coerced into joining a Windows domain.

Why would an organization find itself needing OS X Active Directory Integration (migrate Mac computers into their AD structure)? Most shops decide at conception if they are going to be Mac or PC based companies. But what happens if Company A (PC Based) purchases Company B (Mac based)? Are they really going to want to replace possibly hundreds or thousands of Macs from Company B with new PCs. Of course not. Being able to join all those Macs to the AD domain is invaluable from that point of view. On the other hand, perhaps new hires are Mac experts and know nothing about PCs. In that situation, A computer needs to be purchased either way, so why not be able to get them a computer they are already proficient at and let them hit the ground running?

Enough with the intro and necessary explanations… You probably already know you need to join a Mac to an AD Domain.

For starters, the first thing to understand is that Macs bind to an AD domain while PCs join an AD Domain. It’s just terminology, but it needs to be understood.

Below is an outline for accomplishing OS X Active Directory Integration. I have also included more in-depth referential links to provide you with all of the detail you would need to complete the bind.

OS X Active Directory Integration – The Process

Minimum Requirements:

  • Server hardware running Windows Server 2000-2012 Standard
  • Active Directory Domain Services (ADDS) setup and configured
  • Domain Administrator-level account
  • Apple desktop or laptop running OS X 10.5 or newer

Step 1: Bind OS X to a Windows Domain

  1. Login to the Mac as an Administrator
  2. Open ‘System Preferences’ and select ‘Users & Groups’
  3. Select the ‘Login Options’ menu in the sidebar and use the “Join” button
  4. Enter the fully-qualified domain name of the AD domain being bound
  5. AD Domain level credentials will be needed

Step 2: Modify Directory Services Settings

  1. From the ‘Login Options’ menu again, edit the ‘Network Account Server’ settings
  2. Configure the “Force Local home directory on startup” option
  3. Configure the “Use UNC path from Active Directory to derive network home location”
  4. Select ‘Mapping’ which specifies unique IDs for certain attributes that server to identify a computer account
  5. Finally, there will be three optional settings to choose from, “Prefer this domain server”, “Allow administration by” and “Allow authentication from any domain in the forest.” Select whichever option is most applicable.

Now for the good news. Once your Mac clients have been joined to your AD domain, other software services that rely on AD will be able to perform necessary functions for both security and convenience.  For example, with a Mac that is bound to an AD domain, the PortalGuard Desktop Client can be installed and your end users will be able to enjoy the same Self-service Password Reset and Recovery feature that Windows users appreciate.

Check out this article for more details on the PG Desktop for Mac: PortalGuard Boosts Apple Macintosh Productivity with PG Desktop for Mac .

 

References:

http://www.techrepublic.com/blog/apple-in-the-enterprise/integrate-macs-into-a-windows-active-directory-domain/

http://training.apple.com/pdf/wp_integrating_active_directory_yosemite.pdf

http://accc.uic.edu/answer/how-do-i-bind-os-x-mavericks-active-directory

 

 

Please follow and like us:
0
Larry Conroy

Author: Larry Conroy

Larry is a Technical Support/Developer here at PistolStar. With a Master’s Degree in Computer Science, he has worked for Raytheon, and then moved on to other corporations, such as Kronos, Axent, and Applied Microsystems. Over the last ten years Larry has specialized in improving and growing the support process, previously and within PistolStar Inc.

7 Comments

  1. Hi Larry,

    how did you manage roaming profiles and keychain updates ?
    We used JAMF but didnot succeed.

    Regards,
    Jac

  2. The items listed in Step 2 are nowhere to be found on the Mac OS version that I am using which is on a brand new iMac?

    • I would assume this is only possible via the PortalGuard SSO product. I don’t believe this is a native feature of OS X.

    • Step 2: Configure the “Force Local home directory on startup” option

      This step exists on my macOS Sierra machine – when you try to bind, before clicking bing, click the down arrow at the left (easy to miss) and the options are down there.

      • Ok, that option doesn’t show when doing this from the Join option in System Preferences. If you launch Directory Utility and do it from there, you’ll have those options.

    • It was a bit obscured, but I found how to show that option. From within the directory utility, select the ‘services’ category. Choose active directory and edit it. You’ll see a right pointed triangle of which you click to expand more advanced options. You can proceed with step 2 now.

  3. Hi , i’m asking you about join AD on Mac . It will lost data when it replace profile right ?

Leave a Reply

Required fields are marked *.


Main menu