http://www.techrepublic.com/blog/apple-in-the-enterprise/integrate-macs-into-a-windows-active-directory-domain/
Jesus Vigo takes a look at how to setup and configure Apple hardware running a modern version of OS X and get it communicating with a Windows Active Directory environment.
Market share in the enterprise is largely dominated by Microsoft -- specifically, the reliance on the Windows Server family line to manage network resources, align desktops with corporate security policies, and maintain the flow of production amongst all the employees at a given organization. The process of administering all these systems -- desktops and servers alike -- are relatively straight-forward in a homogeneous environment, but what happens when OS X is introduced to the enterprise in the form of a sleek, shiny new MacBook Air or iMac?
Apple hasn’t made great inroads in this segment. However, comparing its paltry 7% market share in the desktop market to its almost 93% in the mobile device market, there's only a matter of time before more companies begin to choose Apple products for its mobile and desktop computing duties in lieu of the generic, stalwart PCs they’ve been cycling in and out every three to five years. So, I ask you again, what do you do when your organization decides to upgrade to iMacs? How do you manage those nodes in addition to the existing Windows domain that's already established?
Integrating Macs will initially be easier than you think! Even with little to no prior OS X knowledge, Macs will bind* to the domain with relative ease, since directory services -- the underlying “file structure” of the network resources -- are standards-based and operate more or less about the same across operating systems.
Note*: Binding is the term associated with joining OS X to a domain. It’s virtually identical to joining a Windows PC to a domain, complete with checking domain credentials to verify the end user has the necessary rights to add the computer to the domain.
Minimum requirements:
- Server hardware running Windows Server 2000-2012 Standard
- Active Directory Domain Services (ADDS) setup and configured
- Domain Administrator-level account
- Apple desktop or laptop running OS X 10.5+
- Switched network
I. Bind OS X to a Windows domain (10.5-10.9)
Follow these steps to bind OS X to a Windows domain:
- On the Mac, go to System Preferences, and click on the padlock to authenticate as an Administrator (Figure A)
Figure A
- Enter your admin-level credentials to authenticate when prompted
- Next, select Login Options, and then click the Join… button next to Network Account Server (Figure B)
Figure B
- In the Server drop-down menu, enter the fully-qualified domain name (ex. domain.com) of the Windows domain you wish to bind to the Mac, and click OK (Figure C)
Figure C
- Next, you'll need to enter your domain-level credentials in order to proceed with the binding process (make sure that the computer name is unique and formatted properly, because this is the name that will be created** for the computer object in ADDS), and then click OK to process the enrollment (Figure D)
Figure D
- Upon successful binding, the window will close and the Users & Groups preference will remain open, but a small green dot (along with the domain name) will appear next to Network Account Server to indicate connectivity to the domain (Figure E)
Figure E
Note**: By default, Windows will automatically create the computer object account in ADDS if one does not already exist. However, domain or enterprise admins may (and often do) restrict this as a security feature to curb random nodes from being joined to the domain. Additionally, Organizational Units (OU) may be created as a form to compartmentalize ADDS objects by one or more classifications or departments. Many enterprises will utilize OUs as a means to organize objects and accounts separately from the items created by default when a domain controller is promoted and ADDS is created.
II. Modify Directory Services settings
Your next steps will be to modify the Directory Services settings. Here's how:
- To ensure the highest level of compatibility between OS X and the network resources on the Windows network, certain changes must be made to the Active Directory service with the Directory Utility -- so, go to System Preferences | Users & Groups, and click Login Options
- Click the Edit… button next to Network Account Server, then click Open Directory Utility… (Figure F)
Figure F
- The Directory Utility lists various services associated with network account directories (Figure G), and it allows you to modify settings as needed
Figure G
- Double-click Active Directory to edit its configuration (Figure H)
Figure H
- Click on the arrow to unhide the Advanced Options, select User Experience, and check the following boxes:
a. Check Force local home directory on startup disk (Figure I), which will force the creation of a profile on the local HDD for all users that logon to the node (if you plan to serve profiles remotely from a server, leave this setting unchecked)
Figure I
b. Check Use UNC path from Active Directory to derive network home location (Figure J), and select the network protocol to be used: smb: (Note: This setting will switch the default protocol for network resource paths from Apple’s afp: to the Windows' friendly smb: -- also known as Common Internet File System, or CIFS).
Figure J
- Next, select Mappings (Figure K), which pertains to specifying unique GUIDs for certain attributes used within ADDS to identify a computer object account. OS X will generate these at random by default when bound to the domain; however, you may wish to use a particular set as generated by your enterprise admin.
Figure K
- Finally, select Administrative (Figure L), and configure the following three optional settings based on the ADDS schema setup of the organization:
Figure L
a. Checking Prefer this domain server will perform two-way communication to/from the domain controller of your choosing
b. Checking Allow administration by will allow nodes to be managed by the administrator(s) who's responsible for overseeing systems, based on security group membership or user account(s)
c. Checking Allow authentication from any domain in the forest may or may not be necessary to ensure that the OS X computers authenticate to the proper domain, as configured by the domain/enterprise admin.
There you have it -- a basic look at how to setup and configure Apple hardware running a modern version of OS X and get it communicating with a Windows Active Directory environment. I also threw in a few extra tips to help make a smooth transition and minimize errors.
One additional tip (and common best practice) is to host an Open Directory domain along with the Active Directory service. Multiple directory services will add to the burden of managing two distinct operating systems, but you’ll be surprised to find out that it may actually make administration of these systems easier! This dual-directory environment will allow Windows PCs to be maintained and managed solely through the Active Directory side, while Open Directory -- when setup with OS X Server -- can be used to maintain and manage the Apple computers.
Giving the Apple hardware the second directory binding to ADDS will allow them to seamlessly communicate with the Windows desktops and share file and printer resources from Windows servers and nodes, and vice-versa. This eliminates the need for costly 3rd-party software plugins. The Macs will receive much of their management directly from the domain controller hosting the Active Directory service, but it must “translate” the processes into commands that OS X will understand. Even then, it does introduce another variable when troubleshooting. And let’s be honest, the newly released OS X Server 3.0, which is only $20 in the Mac App Store, is a full-fledged server OS that’s as simplified and easy to use as OS X.