Help with active directory

Joined
Mar 4, 2011
Messages
3
Reaction score
0
Points
1
I am very new to MAC's and dont use them much but we do have one on our network and its been working fine for the most part to get to the necessary shares. Lately we have been having Keychain issues and it seamed like every day we had to reset the local keychain on the computer. I was requested to check into the possibly of making it so the MAC domain user has to log onto the MAC computer instead of the local MAC user logging in every time. If someone could please help me with that it would be great. The MAC is iMAC OS X 10.4
 
Joined
Dec 9, 2010
Messages
844
Reaction score
49
Points
28
Location
Virginia
Your Mac's Specs
Currently 13" Late 2010 MBA, 4GB/128GB; Early 2011 13" MBP, dual core i7 2.7ghz, 4gb ram, 500gb hd
First of all, join the Mac to the domain. We add it as a computer to a Mac OU, so we don't inherit policies from other OUs. Once the Mac has been pre-added to the domain through your management console or UMC, enter the credentials to join the Mac to your domain. That's done through Accounts->Login Options->Join. Click the Open Directory Utility button. Enter password if prompted. Double click Active Directory. Under Advanced settings, we enable "Create Mobile Account at Login" and disable "Require confirmation..." and Use UNC path...." Click OK, click Apply and close the window. You should have a green light next to your domain name on the Accounts window.

Once that is complete, we use two command line utilities to join a user to the domain. Open Terminal and type the following:

cd /System/Library/CoreServices/ManagedClient.app/Contents/Resources
sudo ./createmobileaccount -n username
(enter password)
sudo createhomedir -c -u username

This will reach out to the domain, find the user name, add the mobile account to the system, and create a home directory for the user.

At this point, open Accounts again (might have to close and reopen it) and you should see the new account you've created. It's going to be managed, so if you want to give it administrative rights, you'll have to change that manually by clicking the checkbox. We turn off Parental Controls, because it can block things like adding printers or changing system preferences.

Here's the thing... when a Mac user changes his password at the login prompt, it will also change the keychain password, but NOT the passwords stored in the keychain, nor will it change application passwords, like Outlook or chat clients. Those will have to be changed as part of the whatever password change process you have in place. Gotchas are old services saved in the keychain (delete them and recreate them if needed), 802.1x profiles if you use it... those services can send multiple bad password requests to the AD server and lock out an account.

Hope this helps!
 
OP
C
Joined
Mar 4, 2011
Messages
3
Reaction score
0
Points
1
Alright, I tried adding the computer to the domain and that worked just fine. When I try going through accounts- login options thats where I get stuck in that window there is no Join button and or option. The version is 10.4.11. I also need to know when I add the user to the domain how to save all the files on the local user so they will be on the domain user account? Any help would be great! thanks!
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top