TweetFollow Us on Twitter

MacEnterprise: Integrating with Active Directory

Volume Number: 25
Issue Number: 04
Column Tag: MacEnterprise

MacEnterprise: Integrating with Active Directory

A look at third-party tools for leveraging your AD infrastructure

By Greg Neagle, MacEnterprise.org

Introduction

In enterprise environments, Microsoft's Active Directory is possibly the single-most common directory service. It's well suited to large companies with geographically separated locations, and scales very well to tens and even hundreds of thousands of users. In any organization that has many Windows computers, or any company that uses Exchange, it is the obvious and maybe unavoidable choice for a directory service. For these reasons and more, Active Directory is the 500-pound gorilla of directory services. Questions about integrating Mac OS X with Active Directory are among the most common questions on the MacEnterprise mailing list (http://www.macenterprise.org/mailing-list).

Given the ubiquity of Active Directory in enterprise environments, it's not surprising that Apple offers a solution for AD integration: the Active Directory plug-in for Directory Services. This plug-in has been covered well here and elsewhere: Michael Bartosh wrote an excellent article for the November 2004 issue of MacTech covering the AD plug-in that shipped with Panther. You can find it in MacTech's online archives - much of what it covers is still relevant. In October 2007, Philip Reinhart covered a few more tricks with using the AD plug-in and the dsconfigad command-line tool. And of this writing, Apple has an excellent whitepaper on integrating Mac OS X with Active Directory available here: http://images.apple.com/business/solutions/it/docs/Best_Practices_Active_Directory.pdf

Still, Apple's built-in solution does not meet every possible need you might have when integrating Macs into an existing Active Directory infrastructure. Fortunately, there are third-party tools that can be used to supplement or even replace Apple's tools. We'll look at a few in this article. While not intended to be a in-depth examination, we'll briefly touch on the main features of some of the third-party solutions.

What's missing?

Before we look at third-party tools, it makes sense to talk about some of the "missing features" from Apple's offerings. Get ready for some three-letter acronyms:

GPO

GPOs, or Group Policy Objects, are used by Active Directory administrators to help manage their Windows clients. They can be used to manage security policies, software installation, login scripts, folder redirection, and some application settings. They are similar in concept to MCX settings in managed OS X environments. Some organizations would like to be able to define GPO settings to manage Macs along with their Windows machines. Apple's AD plug-in doesn't support Active Directory GPOs.

MCX

MCX is Apple's client management framework. Out-of-the box, there is no support for MCX settings in Active Directory. Some MCX options include extending the AD schema to include MCX attributes, deploying a dual-directory infrastructure where MCX records are stored in a secondary directory, or using a third-party replacement for Apple's AD plug-in.

DFS

DFS, or Microsoft's Distributed File System (sometimes written "Dfs") is a method of making shared filesystems available via a network. This is typically used to provide fault-tolerance and/or redundancy, and to insulate users from having to know on which fileserver a given resource is located. It is roughly equivalent to automounted NFS shares where a resource can be accessed by a specific path, no matter which actual fileserver hosts it. While this is not really a function of the AD plug-in, Apple's built in SMB/CIFS client does not support Microsoft's DFS.

This is not an exhaustive list - certainly there are other features of Active Directory and Windows file services that are not supported by Apple's tools, or with which Apple's tools have difficulty.

Select Third-party tools

ADmitMac

Thursby Software has been providing tools to help Macs connect to Windows for many years. ADmitMac, currently at version 4, is a complete replacement for both Apple's AD plugin and the built-in SMB client. Some key features:

Requires no Active Directory schema changes

Supports DFS, even for home directories

Support for Active Directory shared printers

Support for MCX client management

More information is available at http://www.thursby.com/products/admitmac.html

DAVE

Another product from Thursby Software is DAVE. It implements a subset of the features in ADmitMac. It operates as a replacement for Apple's SMB client, but provides less integration with Active Directory. See http://www.thursby.com/products/dave.html to learn more.

DirectControl

DirectControl from Centrify is also an Active Directory plug-in replacement. Besides the obligatory support for Active Directory authentication, a major feature of interest is support for GPOs: Windows administrators can use standard Windows tools to define GPOs for Mac clients that can specify certain management settings for user and computers. The ability to use a single set of tools to manage users, groups, and manage computers, no matter the OS is an important one for some organizations. Centrify also offers DirectControl for Linux and UNIX, which offers the possibility of using Active Directory to authenticate and manage all your platforms. More information on the Mac product is available at http://www.centrify.com/directcontrol/mac_os_x.asp

Likewise Enterprise

Likewise Enterprise is yet another replacement for Apple's Active Directory plug-in. A unique feature of this product is the ability to store MCX data in Active Directory without extending the schema. This is similar in concept to what Centrify's DirectControl does, but with two important differences:

Administrators can not only define Group Policy Objects using the Microsoft Management Console, but they can also use Apple's Workgroup Manager application to define Mac-specific management settings

Because actual MCX data can be stored in AD, a wider range of management settings are supported.

Likewise Enterprise is also available for Linux and UNIX, again making it possible to use a single directory service for all your platforms. Additionally, Likewise offers an Active Directory management console that runs on Mac OS X and Linux. Visit http://www.likewise.com/products/likewise_enterprise/ for more information on this product.

ExtremeZ-IP

ExtremeZ-IP is a product from GroupLogic that provides Apple File Protocol services and printing services from Windows servers. Implementing ExtremeZ-IP on your Windows file servers allows Mac clients to connect via the native AFP client instead of the SMB/CIFS client. Since this is a server-based file sharing solution, it might seem odd to include it in this list of third-party tools. But GroupLogic has announced that Extreme-IP 6, due this year, will provide support for Microsoft DFS. With ExtremeZ-IP 6, Leopard (and later) clients will be able to use AFP to connect to Microsoft DFS shares. As a server-based solution, it can be used in conjunction with many of the client-based solutions mentioned above. You can find out more about ExtremeZ-IP at http://www.grouplogic.com/products/extremeZ-IP/

Active Directory Integration Cheat Sheet

To wrap things up for this overview, the table below lists the solutions mentioned in this article with a matrix of some of the features not directly supported by Apple's built-in tools. If Apple's bundled solutions for Active Directory and Windows file server integration don't meet all your needs, you have some additional options to explore!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Affinity Designer 2.2.0 - Vector graphic...
Affinity Designer is an incredibly accurate vector illustrator that feels fast and at home in the hands of creative professionals. It intuitively combines rock solid and crisp vector art with... Read more
Pinegrow 7.71 - Mockup and design web pa...
Pinegrow (was Pinegrow Web Designer) is desktop app that lets you mockup and design webpages faster with multi-page editing, CSS and LESS styling, and smart components for Bootstrap, Foundation,... Read more
MacFamilyTree 10.2.1 - Create and explor...
MacFamilyTree gives genealogy a facelift: modern, interactive, convenient and fast. Explore your family tree and your family history in a way generations of chroniclers before you would have loved.... Read more
Printopia 3.0.22 - Share Mac printers wi...
Run Printopia on your Mac to share its printers to any capable iPhone, iPad, or iPod Touch. Printopia will also add virtual printers, allowing you to save print-outs to your Mac and send to apps.... Read more
iStat Menus 6.72 - Monitor your system r...
iStat Menus lets you monitor your system right from the menubar. Included are 8 menu extras that let you monitor every aspect of your system. Features: CPU - Monitor cpu usage. 7 display modes,... Read more
Xcode 15.0 - Integrated development envi...
Xcode includes everything developers need to create great applications for Mac, iPhone, iPad, and Apple Watch. Xcode provides developers a unified workflow for user interface design, coding, testing... Read more
Transmit 5.10.0 - Excellent FTP/SFTP cli...
Transmit is an excellent FTP (file transfer protocol), SFTP, S3 (Amazon.com file hosting) and iDisk/WebDAV client that allows you to upload, download, and delete files over the internet. With the... Read more
Minecraft 1.20.2 - Popular sandbox build...
Minecraft allows players to build constructions out of textured cubes in a 3D procedurally generated world. Other activities in the game include exploration, gathering resources, crafting, and combat... Read more
HoudahSpot 6.4.1 - Advanced file-search...
HoudahSpot is a versatile desktop search tool. Use HoudahSpot to locate hard-to-find files and keep frequently used files within reach. HoudahSpot is a productivity tool. It is the hub where all the... Read more
Evernote 10.62.2 - Create searchable not...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more

Latest Forum Discussions

See All

Vampire Survivors-Like 20 Minutes Till D...
Back in June, Vampire Survivors-like 20 Minutes Till Dawn ($2.99) on mobile was supposed to hit 1.0 alongside the PC version. If you’ve not followed it, since launch, 20 Minutes Till Dawn remains one of the best games of its kind, and it had been... | Read more »
SwitchArcade Round-Up: Reviews Featuring...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for September 25th, 2023. In today’s Monday edition, we’ve got a pair of reviews for you to enjoy. I take a look at the first part of the Pokemon Scarlet & Violet DLC, The Teal Mask... | Read more »
TGS 2023: Koei Tecmo Shows Off Fate/Samu...
Koei Tecmo is an interesting company when it comes to mobile gaming. I dare say that it’s rather active on the App Store in Japan, but it hasn’t put out a whole lot outside of the country. That makes visiting its Tokyo Game Show booth feel a bit... | Read more »
TGS 2023: HoYoverse Makes a Big Splash a...
It’s been a long while since I’ve seen a mobile-focused game company take up one of the major booth areas at the Tokyo Game Show. Not since the ostentatious flexes of DeNA and CyGames at the height of their respective powers, come to think of it.... | Read more »
TGS 2023: Konami and Bandai Namco Rely O...
If there’s one pattern that was clear at this year’s Tokyo Game Show, it’s that the major Japanese game publishers have swung back around to console gaming in a very big way. While we’re still seeing plenty of support for existing free-to-play... | Read more »
TGS 2023: SEGA & Atlus Bring a Full...
Between Atlus and SEGA’s offerings, the House of ‘Hog was shining brighter than ever at Tokyo Game Show this year. With Sonic Superstars, a pair of Like A Dragon games, some Persona titles, Vanillaware’s latest, and Football Manager 2024 among other... | Read more »
TGS 2023: Capcom’s Mobile Offerings Incl...
Capcom always makes a big splash at the Tokyo Game Show, and this year was certainly no different. With a large booth that had something cool on every side of it, there’s a reason why crowds were flocking to play what the venerated publisher had to... | Read more »
Best iPhone Game Updates: ‘Diablo Immort...
Hello everyone, and welcome to the week! It’s time once again for our look back at the noteworthy updates of the last seven days. Maybe I just wasn’t looking carefully enough or maybe it was just a slow week, but I really had to dig to find some... | Read more »
Time-Travel RPG ‘Reverse: 1999’ Releases...
Reverse: 1999 from developer Bluepoch was just announced for an October worldwide release on iOS, Android, and PC platforms. While there are loads of free to play games announced daily, the aesthetic, trailer, and music in Reverse: 1999 has been... | Read more »
‘Genshin Impact’ Version 4.1 Anniversary...
The next major Genshin Impact (Free) update is arriving this week as the anniversary update bringing the expansion of Fontaine to the North, add two new playable characters, a poetry festival, the continuation of Fontaine’s Archon Quests, and more. | Read more »

Price Scanner via MacPrices.net

Apple has the iPad mini 6 in stock today for...
Apple has the 8.3″ WiFi iPad mini 6 in stock and available for $80-$100 off MSRP, Certified Refurbished, each including free shipping. Prices start at $419. Each iPad features a new outer case and... Read more
Apple has restocked M2 Mac minis starting at...
Apple has M2-powered Mac minis available again in their Certified Refurbished section starting at $509 and ranging up to $200 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is... Read more
New promo at AT&T: $300 off any Apple Wat...
AT&T is offering Apple Watch Series 9 and Ultra 2 models for $300 off MSRP when you purchase two Watches with AT&T service and add at least one new line. The fine print: “Enjoy $300 off Apple... Read more
Introducing AppleSurfer at MacPrices: All you...
Scan all the headlines from Apple and over a dozen major Apple websites each day on our new page, AppleSurfer. Paying homage to the now defunct MacSurfer website, we update AppleSurfer hourly, 24/7,... Read more
Get a new 15″ M2 MacBook Air for $200 off MSR...
Amazon has Apple’s new 15″ MacBook Airs with M2 CPUs (8GB RAM/256GB SSD) in stock today and on sale today for $1099 in Space Gray, Silver, Starlight, and Midnight colors, each including free delivery... Read more
10th generation Apple iPads on sale for $60 o...
Amazon has Apple’s 9th generation 10.2″ iPads on sale for $60 off MSRP with prices available starting at $269. Their prices are the lowest new prices available for iPads anywhere: – 10″ 64GB WiFi... Read more
Apple iPad Airs back on sale for $100 off MSR...
Amazon has 10.9″ M1 WiFi iPad Airs on sale again for $100 off Apple’s MSRP, with prices starting at $499. Each includes free shipping. Their prices are the lowest available among the Apple retailers... Read more
New low price: 13″ M2 MacBook Pro for $1049,...
Amazon has the Space Gray 13″ MacBook Pro with an Apple M2 CPU and 256GB of storage in stock and on sale today for $250 off MSRP. Their price is the lowest we’ve seen for this configuration from any... Read more
Apple AirPods 2 with USB-C now in stock and o...
Amazon has Apple’s 2023 AirPods Pro with USB-C now in stock and on sale for $199.99 including free shipping. Their price is $50 off MSRP, and it’s currently the lowest price available for new AirPods... Read more
New low prices: Apple’s 15″ M2 MacBook Airs w...
Amazon has 15″ MacBook Airs with M2 CPUs and 512GB of storage in stock and on sale for $1249 shipped. That’s $250 off Apple’s MSRP, and it’s the lowest price available for these M2-powered MacBook... Read more

Jobs Board

Optometrist- *Apple* Valley, CA- Target Opt...
Optometrist- Apple Valley, CA- Target Optical Date: Sep 23, 2023 Brand: Target Optical Location: Apple Valley, CA, US, 92308 **Requisition ID:** 796045 At Target Read more
Housekeeper, *Apple* Valley Villa - Cassia...
Apple Valley Villa, part of a 4-star senior living community, is hiring entry-level Full-Time Housekeepers to join our team! We will train you for this position and Read more
Housekeeper, *Apple* Valley Village - Cassi...
Apple Valley Village Health Care Center, a 4-star rated senior care campus, is hiring a Part-Time Housekeeper to join our team! We will train you for this position! Read more
Optometrist- *Apple* Valley, CA- Target Opt...
Optometrist- Apple Valley, CA- Target Optical Date: Sep 23, 2023 Brand: Target Optical Location: Apple Valley, CA, US, 92308 **Requisition ID:** 796045 At Target Read more
Senior *Apple* iOS CNO Developer (Onsite) -...
…Offense and Defense Experts (CODEX) is in need of smart, motivated and self-driven Apple iOS CNO Developers to join our team to solve real-time cyber challenges. Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.