Get APLawrence.com by RSS

• Home
• FAQ
  • All FAQ's
  • About
  • Contact
  • Copyrights
  • Guest Posts
• Kerio Products
  • Articles
  • Resources
  • Pricing
• Categories
  • All Categories
  • Linux
  • Mac OS X
  • SCO Unix
  • Blogging
  • Self Employment
• My Services & Rates
  • On-Site Rates, Contracts
  • Quick Help NOW
  • Other Consultants

Best of the Newsgroups: join mac os x to win 2003 active directory

What is this stuff?

Main Index

From: "Matthew X. Economou" <xenophon+usenet@irtnog.org>
Subject: Re: AD-2k3 & SSO in Mac Rich Environment
Date: 16 Aug 2005 12:32:12 -0400
Message-ID: <uiry5sv03.fsf@irtnog.org> 
References: <1124131565.358509.81530@o13g2000cwo.googlegroups.com> <3md7dlF16d658U1@individual.net> 

>>>>> "Scott" == Scott Lowe <me@privacy.net> writes:

    Scott> Have you looked at having the Macs bind to Active
    Scott> Directory?

I've done this.  I couldn't find a documented procedure, but this
process works for me:

    1. Open '/Applications/Utilities/Directory Access.app.

    2. Enable the Active Directory service.

    3. Configure the Active Directory service as follows:

        Active Directory forest -- 'example.com'

        Active Directory domain -- 'example.com' or
         'childdomain.example.com'

Macworld Mac Basics Superguide $12.95
Macworld Mac Basics Superguide, Leopard Edition $12.95
Macworld Mac Gems Superguide $12.95
Macworld Mac OS X Hints Superguide, Leopard Edition $12.95

        Computer ID -- Enter the host name of the computer.

        Cache last user logon for offline operation -- Checked.

        Authenticate in multiple domains -- Depends on whether you
         want to allow cross-domain authentication.

        Prefer this domain server -- Unfortunately, until the computer
         account has time to replicate to all domain controllers in
         the domain, configure the client to only communicate with one
         of the domain controllers, e.g. 'dc1.example.com'.

        Map UID to attribute -- NOT checked.  I haven't figured out
         how to make this work without extending the Active Directory
         schema.  If you already use Services for Unix, you can map
         the UID to the 'uid' attribute (created by SFU's NIS
         component).

        Allow administration by -- For example, 'EXAMPLE\Domain Admins'.

    4. Click the Bind button, enter the user name and password of
       someone who has rights to create computer accounts in Active
       Directory, and change the OU to where you want the account
       created,
       e.g. OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=example,DC=com
       (for those of us running Windows Small Business Server 2003).

    5. Change the authentication search path to 'Custom path' and add
       '/Active Directory/example.com'.

    6. Restart the computer.

    Scott> heard from others that it works reasonably well and can
    Scott> even cache the domain credentials for logons while they are
    Scott> away from the office (just like a Windows box).  It is also
    Scott> my understanding that one you do have the Macs bind to AD,
    Scott> they can take advantage of the AD Kerberos Key Distribution
    Scott> Center (KDC) for automatic access to file servers in the
    Scott> domain (with no additional passwords).

This is indeed the case, although I think it only caches 1 logon (nor
does it obey the corresponding Group Policy setting).  I haven't quite
figured out how to automagically map user's home directories and such,
but I'm sure that it is possible.

There is one glitch, however.  If you create SMB shares on the
Macintosh, e.g. the built in user file sharing mechanism
"\\mac\username", your domain users will be unable to authenticate.
For some reason, Samba and Directory Access aren't tied together, and
I haven't bothered to figure out which lines added to smb.conf will
fix this issue.

Best wishes,
Matthew

-- 
jsoffron: I'm generally pretty high on national defense...
Mr. Bad Example: Careful...it's a gateway policy. Before you know it,
 you'll be mainlining the hard stuff like trade agreements.
jsoffron: Too late...I've been freebasing Nafta all day... Sweet,
 sweet NAFTA.
    - As seen on Slashdot