bwestlake Posted June 12, 2014 Posted June 12, 2014 Hi all! We are looking at what it would take for a suite of macs to be joined properly to our windows domain, We would like it so the students can log on using their ad usernames and passwords and they can see and save to there home drive like they can on windows. What would we need to accomplish this? Can someone explain the magic triangle and what is required? And would we need more hardware than just a mac server? Many thanks as always guys and gals!!
snagrat Posted June 12, 2014 Posted June 12, 2014 We do this with no Mac server. Bind to AD and set the Windows server as the time source and away you go. We have had no issues.
Mustang Posted June 12, 2014 Posted June 12, 2014 If you already have the macs you don't need anything else you just join them to the domain like you would with a windows box. The Magic triangle setup is where you join your mac to Active directory for authentication and also join the mac to open directory so you can apply settings/lockdown to the AD user/group.
Stuclark Posted June 13, 2014 Posted June 13, 2014 The issues you're going to have doing it natively are that you can't administer the macs on the domain (GPOs etc won't work) and if you've got users who log on to macs and Windows machines using the same AD credentials, you will run into permission issues with their home / shared drives; especially if you're storing that stuff on a file server somewhere (i.e. not a local profile) We use Centrify to help manage the macs centrally and have 2 sets of folders set up with some fancy scripting so that the Windows & mac specific file resources don't get in the way of each other. Doing it properly (3 sites of which 1 uses both macs & PCs; 3 networks all linked but with different IP ranges; 4 sets of servers (6 mac servers and 20 Windows servers); Wireless with multiple "open" SSIDs) took us 6 months planning and 3 months implementation and FULL testing. We work on the theory that one error is one too many!
bwestlake Posted June 13, 2014 Author Posted June 13, 2014 so to configure the macs i.e. lock them down (similar to gpo) it would require the mac server. is this correct?... is it only the server that is required or do you require storage for the home drives even if they are on the windows domain?
Norphy Posted June 13, 2014 Posted June 13, 2014 You don't necessarily need a Mac server to deploy profiles to Macs (you could just as easily use a third party solution) but you need something to generate them. I use a plugin for SCCM to manage our Macs. The plugin has the facility to generate the mobileconfig files required but it is basic compared to Profile Manager. I use the SCCM plugin to deploy the profiles but Profile Manager to generate them.
robjduk Posted June 13, 2014 Posted June 13, 2014 We use a mac server as it makes nice little profiles to lock them down and makes software deployment quite easy and think its a great option if you don't have SCCM.
3s-gtech Posted June 13, 2014 Posted June 13, 2014 There are software solutions for your DCs that allow them to manage Macs - they're neat but no cheaper than a Mac Mini server. Home drives will pick up the AD attribute (if you tell the clients to use that) so they will use their normal network storage.
Pashers Posted June 13, 2014 Posted June 13, 2014 (edited) If you are thinking of using a mac server and plan to use profile manager (for the preferences of the machines) then here are a few things to think about: - Mac server - Profile Manager (Similar to GPO for Windows), Workgroup Manager and is becoming out dated. - Deploy Studio (to deploy a base image of the Mac) - Apple Remote Desktop (to push application installs) - Firewall settings configured to allow required ports for Apple - NTLM does not work on Macs so you can use ident for the authentication to Internet. Or use no authentication on the Macs. - Time on the Macs are same as the domain server A basic list of things to think about. When you join the Mac to AD you can specify to use the user's home drive on your Windows file server. The magic triangle uses the authentication from AD to connect to Windows Shares, then the Mac Server is used just for the management of the profiles, locking down the Macs as required. Edited June 13, 2014 by Pashers
Mustang Posted June 13, 2014 Posted June 13, 2014 For 3 clients i wouldn't bother with a mac server. You can use a process called local mcx. + you download a free program called workgroup manager from apple. + run workgroup manager and point it at the local machine. + apply settings as needed (note some newer settings can't be controlled) + repeat process on remaining macs As for connecting to your windows storage, this shouldn't be a problem at all, the mac will mount the users home directory path that you have under the user account in AD. i don't know what the permission issue is that is listed above but i have ran macs connected to AD and SMB shares for 9 years and never seen this, but everyones network is different.
seawolf Posted July 4, 2014 Posted July 4, 2014 Hi all! We are looking at what it would take for a suite of macs to be joined properly to our windows domain, We would like it so the students can log on using their ad usernames and passwords and they can see and save to there home drive like they can on windows. What would we need to accomplish this? Can someone explain the magic triangle and what is required? And would we need more hardware than just a mac server? Many thanks as always guys and gals!! 1. As previously stated just bind them to AD. User Authentication solved. 2. If you want Mac server, you can use Profile Manager (using AD groups) to lockdown and configure Macs. Any Mac can run Server app, so unless you have a lot of Macs you don't need a high spec server. 3. If you don't want to bother with a server, you can install Server app on a desktop, create configuration profiles, export them then install them as part of your standard image to do the lockdown. You could also use WGM in the same way, but WGM is going the way of the dodo. Other suggestions are to consider solutions like Casper Suite or Puppet/Munki. DeployStudio is a no brainer as it's free and easy if you have a spare Mac Mini to act as a server.
seawolf Posted July 4, 2014 Posted July 4, 2014 The issues you're going to have doing it natively are that you can't administer the macs on the domain (GPOs etc won't work) and if you've got users who log on to macs and Windows machines using the same AD credentials, you will run into permission issues with their home / shared drives; especially if you're storing that stuff on a file server somewhere (i.e. not a local profile) We don't see any permissions issues and we map the same network home for Mac and PCs (folder redirection for Win7 set to replicate Mac home folder names). What problems do you have?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now