Mac and AD Integration

[NewBoy]

Hey Guys,

 

has anyone out there actually got there Mac clients successfully connected to a windows DC and AD ?? in a way that it provides a logon box that interrogates AD for the correct credentials then after logon maps the appropriate drives etc ??

 

I ask this as a few of our schools are very much Mac within a windows environment and at the moment seem to store everything locally rather than connect to any network, on top of this if they are not around at the time of looking at their Mac 9 times out of 10 they dont leave a password so the the job goes uncompleted.

 

I find it hard to believe in this day and age its not possible but when I have tried to connect to a windows domain it just seem to really slow the machine down and I'm not sure why.

 

Any help would be great thanks.

[3s-gtech]

Yes, many of us do. Our students can log on to any Mac in the school with their AD credentials, they then get access to the shares and their home area. They can save locally - this is more a quirk of the last couple of versions of OS X where Finder has been 'tidied up'- but they know to save files in their home area if they want to see them again!

[NewBoy]

I don't suppose you have any links to guides or tutorials do you that may give me an idea on how to do this properly.

[3s-gtech]

I don't have any guides that I trust to hand - when I did all of mine it was back in the days of the 'Magic Triangle' using Workgroup Manager on the Mac server. Now it's all about Profile Manager for configuring the machines and the user experience - build and configure a profile on the server and roll it out to the Macs by adding them in to PM. This is done by installing the Trust Profile that PM creates onto each Mac.

 

To get the AD credentials to work, you just add the Mac to AD in Settings/Users & Groups - Network Account Server/Join. It pays to set the following tickboxes:

 

Create a local home area (logons may not work otherwise)

Don't create a mobile account

Allow administration from your domain admins

Set read permission for your users to the root of your home area (so students can see the root home area share - not the contents of each area though) - without this you will find https://welsheduit.wordpress.com/2014/11/07/os-x-10-10-yosemite-and-ad-home-directories-via-smb-fixed/

and above all test repeatedly!

[NewBoy]

Thanks for that I am in the office on Friday so will set up a test environment and give it a go.

[Ryan_Romeo_]

A question on this, we have some iMac's which are linked into our AD environment using a mac server and profile manager but sometimes when a student tries to log on it will just sit and spin for ever and never log them on, not really sure what the issue is and we seem to get different issues all the time! and help would be greatly appreciated