Bind Using A Configuration Profile
The directory payload in a configuration profile can configure a single Mac, or automate hundreds of Mac computers, to bind to Active Directory. As with other configuration profile payloads, you can deploy the directory payload manually, using a script, as part of an MDM enrollment, or by using a client-management solution.
Payloads are part of configuration profiles and allow administrators to manage specific parts of macOS. You select the same features in Profile Manager that you would in Directory Utility. Then you choose how the Mac computers get the configuration profile.
In the Server app on your Mac, do the following:
-
To configure Profile Manager, see Start Profile Manager in the macOS Server User Guide.
-
To create an Active Directory payload, see Directory MDM payload settings for Apple devices in Mobile Device Management Settings for IT Administrators.
If you dont have the Server app, you can
Living With Directory Extensions
Simply put, directory extensions extend directories. They are often layered on top of AD on-prem to extend AD functionality to non-Windows IT resources, such as Mac systems or cloud-based resources. Directory extensions emerged to bridge these gaps and have been popular AD add-ons. So, at first glance, it would appear that IT admins need only to leverage directory extension technology to join a Mac to a Windows domain.
This is true. However, at a higher level, Macs represent but one of many identity management challenges in modern IT organizations. In fact, cross platform system environments , web and on-prem applications, physical and virtual data storage solutions, and remote networks spanning multiple locations are commonall of which are difficult to manage with AD. Thus, a directory extension for Macs is but one of many identity federation services required to manage the complexity of modern networks, via AD.
Further, modern IT organizations would rather shift the majority, if not all of their on-prem identity management infrastructure to the cloud. Yet, AD is an on-prem solution that requires heavy investment into on-prem identity management infrastructure. Thus, any solution layered on top of AD will share the same foundation, further cementing IT organizations on-prem. Even Azure® Active Directory , which many thought would be a cloud replacement for AD on-prem, requires AD on-premand Microsoft still requires that you purchase Azure AD Connect to bridge the two.
How To Join A Windows Domain With Mac 10
Our community of experts have been thoroughly vetted for their expertise and industry experience.
Learn from the best
Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.
The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.
-Mike Kapnisakis, Warner Bros
Also Check: How Can I Own My Domain Name
How To Join Or Bind Mac To A Windows Domain
Last week I received a Mac laptop and before I could install SCCM client on it, I wanted to join or bind Mac to a Windows Domain or AD Domain. To bind a Mac to active directory, you can use the steps covered in this post.
After a long time I was using Mac and honestly, I found it bit difficult to use it. Coming from Windows OS, it takes some time to understand the Mac OS but once you start exploring it, you will find it easy.
Lets consider an example where your boss calls you into his office and says he got a new laptop. You notice that its a Mac and now you have to join this Mac to a Windows domain.
So what do you do now ?. Not to worry, you can join a Mac to your AD domain and I will show you how its done. I am currently using Mac OS 10.14 and using this article you can find out your macOS.
Before you Bind or Join a Mac to Active Directory Domain, ensure the Mac is connected to the network. You can either set a static IP address on your Mac or let DHCP assign the IP address to Mac. If your Mac is unable to communicate with domain controller, the domain join will fail.
Also There Are Some Options That You Can Set To Make Management Easier
Create mobile account at login allows each user who logs in to create a cached account that can be used without access to the AD domain controllers. As the name implies, this is a good option to set for MacBooks. If you dont want every account to automatically become a mobile account at login, check require confirmation underneath that option.
You also have the option to automatically mount the users home path from Active Directory when they log in to the Mac. If you use home paths in your environment, feel free to leave this option checked.
On the Administrative tab, you have the option to set AD groups whose members automatically become local admins on the Mac. If you use a group other than domain admins for workstation admins , enter it here:
Finally, click the Bind button. Youll be prompted to enter the credentials for an account that has rights to join computers to the domain. If all goes well, youll receive a confirmation. Reboot the Mac, and then log in with a network account to verify.
Read Also: How Can I Get A Domain Name For Free
Enable Ad Domain Authentication For Macs
If youre using a Microsoft Active Directory domain, joining your Macs to the domain is a simple process. It will allow your users to enter the same credentials on Macs and Windows, and provide them with single sign-on for various network resources.
To join a Mac to an AD DS domain, follow these steps:
Open System Preferences > Users & Groups. Click Login Options. Click the Join button next to Network Account Server.
Next to Active Directory Domain: enter the FQDN of your AD DS domain. Then enter the computer name that you would like the Mac to use.
Set Up Network User Account
- At the logon screen, click Other and log in as the user whos going to use the computer, using your AD credentials
- When youve logged in successfully, and worked through all the introductory windows, open System Preferences& select Users & Groups
- You should see your network username in the list of current users. Click on your username & tick the box to Allow user to administer this computer followed by Yes
- Click Create beside Mobile account: followed by two clicks on Create and then enter the password for your AD user account. A mobile account means that youll be able to log on to the Mac with your network user account even when youre not connected to the corporate network.
- Click on the next screen about a SecureToken administrators name and password
- You will now be logged out and you should log back in to your user account and close the Users & Groups window
Also Check: How To Search For A Domain Name On Google
Create Configuration Profile With Directory Payload Using Profile Manager
Open MacOS Server and select Profile Manager on the left side menu.
Create Configuration Profile with Directory payload
Click on Open in Safari button beside Profile Manager. In Safari, from the left side menu of Profile Manager select Devices. There should be only one Mac here which is the one you are using. Select the Settings tab and then click on Edit button.
Create Configuration Profile with Directory payload
You can leave the General settings as is. On the left bar, scroll and find Directory under MacOS. Click on Configure.
Create Configuration Profile with Directory payload
Select Directory Type as Active Directory and from there its pretty straightforward. Fill up the details as per your environment. Once done, click on OK.
Create Configuration Profile with Directory payload
You will be returned to the initial screen. Click on Save and then you would get the option to enabled.
Create Configuration Profile with Directory payload
Click on and you now have the Configuration Profile that is required.
The next step is to test it on a standalone Mac device by installing it manually to check if it installs successfully. This is because if the configuration profile as created fails to install manually, there is no way that Microsoft Intune would be able to deploy it successfully. As such, it is always a good idea to test the profile manually before deploying it from Intune to save yourself from troubleshooting afterward.
Adding A Macbook To A Windows Domain
Enabling access to the Windows domain allows you to configure your MacBook to work on your network so that you can share folders, files and connected printers. Mac computers use a file sharing technology called Apple File Protocol, while Windows computers use Server Message Block. The AFP and SMB file systems don’t work together, but you can get around this lack of compatibility by setting your Mac to recognize the Active Directory used by Windows computers. To access the Directory Utility and connect your MacBook to a Windows domain, first enable the root user.
1
2
3
4
5
6
Select “Active Directory,” and then click the Pencil icon.
7
Enter the domain for the Windows computer in the Active Directory Domain field. The domain format should look similar to “ad.domain.com.” If you don’t know the domain name, point your mouse at the upper-right corner of the screen and move down. Click “Search,” type “System” into the Search box, select “Settings,” and then click “System.” The domain name is listed in the “Computer Name, Domain, and Workgroup Settings” section.
8
Enter a computer name in the Computer ID field, and then click the “Bind…” button.
9
Enter an administrator username and password in the Username and Password field. If you don’t know this information, ask your system administrator.
10
References
Read Also: How To Recover A Domain Name
Join Windows 10 To Domain From Windows 10 Settings
You can also join Windows 10 to domain from Windows 10 Settings. This is the new Windows 10 way
Here are the steps:
- Right-click start menu. Then click Settings.
- When Windows Settings, scroll down to and click Accounts.
- At your account info details, click Access work or school.
- Then click Connect and wait for the details to load
- When Set up work or school account screen loads, beneath Alternative actions click Join this device to a local Active Directory Domain.
- Then enter the domain name and click Next. The computer will take a while to process the request.
- It will then request for the credentials with permission to join the device to the domain. It the username and password in the format shown. You could also use the DomainName\UserName format. Then type the password and click OK.
- You will then be prompted to enter the name of the person that will be using this computer. Click Skip.
- Finally, click Restart now.
- When your PC is restarted it will be a member of the AD domain.
I Bind Os X To A Windows Domain
Follow these steps to bind OS X to a Windows domain:
Note**: By default, Windows will automatically create thecomputer object account in ADDS if one does not already exist. However, domainor enterprise admins may restrict this as a security feature tocurb random nodes from being joined to the domain. Additionally, Organizational Units may be created as a form to compartmentalize ADDS objects by one or more classifications or departments.Many enterprises will utilize OUs as a means to organize objects and accounts separately from the items created by default when a domain controlleris promoted and ADDS is created.
Read Also: How Much Is It For A Domain Name
Create Custom Profile For Mac In Intune
In MEM Admin Center, navigate to Devices > MacOS > Configuration profiles and click on Create Profile. Choose Profile Type as Custom and click on the Create button at the bottom of the page.
Create Custom Profile for Mac in Intune
Create Custom Profile for Mac in Intune
When you are done with the above, you can review what has been configured till now and if all seems fine, click on Create. Thats all.
Connect Mac To Active Directory Domain
- Open System Preferences& double-click Users & Groups
- Click Login Options& then the button Join beside Network Account Server:
- Enter the name of your Active Directory Domain Server & click OK
- You will be prompted for AD Admin User and AD Admin Password. You should enter the credentials for a network administrator log-in and click OK.
- Enter the password for the local administrator account again and click Modify Configuration
- When the Users & Groups window reappears, close the window and log out of the computer
Read Also: Can Someone Take My Domain Name
Test The Configuration Profile As Created
Transfer the COnfiguration Profile file to a standalone Mac device, double-click on it and you would have the profile available to install from System Preferences > Profiles. Click on the Install button.
Test the Configuration Profile as created
The system will prompt to provide Admin credentials to proceed with the profile installation.
Test the Configuration Profile as created
The profile installation proceeds once the admin credentials are entered.
Test the Configuration Profile as created
Provided that the configuration profile is good and the installation did not encounter any errors, the profile install will complete and you will have the profile installed on the Mac.
Test the Configuration Profile as created
Only if the profile gets installed succesfully, we can repurpose it to be deployed to managed Mac devices using an MDM solution like Microsoft Intune.
However, if you do get an error like this, wait for my next blog on the same to help you troubleshoot!
What will you do if the profile installation fails while testing? Wait for my next blog.