Wanna learn how you can manage your corporate Macs with Hexnode?
Read all about it here!
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
Aug 27, 2021
17 min read
With over 95% of Fortune 1000 companies making use of Active Directory services to organize their business, and around 73% of devices using the Windows operating system, Windows devices are comfortably equipped with the clear-cut option of going for Mircrosoft’s Active Directory services to manage user accounts and their access. But what happens when a macOS device is introduced in the enterprise?
As an IT admin, you might have asked – is it possible to integrate a Mac with Microsoft’s Active Directory services? The answer is, yes.
In this blog, we’ll cover the essentials of macOS Active Directory binding, learn how to troubleshoot binding issues, and understand how you can use a UEM solution to remotely bind Macs to the AD domain.
macOS Active Directory binding is the term associated with binding a macOS device to the Active Directory domain. So how does this process work? To find out, let’s look at it through a series of simple steps.
The primary purpose of macOS Active Directory binding is to equip network users with the ability to login to a connected Mac, and access the data stored in the Active Directory right from the macOS device itself. What’s more, with the help of Active Directory, you can also control their access privileges within the company network. In other words, Active Directory services enable you to authorize the network users to access just the data and resources they’re permitted to use, and grants them access only after successful authentication.
Okay, now that we know a little bit about the Active Directory, I think it’s time we begin binding our Mac to the Active Directory database.
Integrating Macs to the AD domain is quite an easy process – Since directory services operate pretty much the same across Windows and macOS systems.
To enforce macOS Active Directory binding, follow these steps.
Open System preferences, and navigate to Users and groups > Login options > Network account server, and click on Join. A pop-up will open, asking you to enter the server name.
Once you enter the server name, macOS automatically detects the AD server. Next, enter the computer ID, username and password of an Active Directory user who has authorization to create user accounts within the specified AD domain.
Now, click on OK. Upon successful binding, a green dot will appear next to the ‘network account server’ button.
To ensure the best possible level of reliability between the macOS device and the network resources within the Active Directory server, you must make specific changes to the Active Directory settings using the Directory Utility.
We shall explain each of the settings within these three tabs in detail.
Check this option to enable users to log in to their macOS device with their AD credentials even when they are not connected to the AD server. If checked, the user’s data is stored locally on the Mac device.
Check this option to require the Active Directory users to confirm the creation of a mobile account on the macOS device.
This option forces the local home directory to be created on the start-up disk of the Mac, thereby enabling the AD users to access their network user accounts remotely.
When selecting SMB, a user’s Windows network home folder is mounted as the macOS home folder when the user logs in. When selecting AFP, the AD user is given a local macOS home folder on the start-up disk. What’s more, the user’s network home folder is also mounted as an additional share point. This enables the user to copy files between their network volume and the local home folder.
A shell is a computer program that provides you with an interface to the device’s operating system. It gathers input from you and executes operations (and displays the output) based on the input. macOS supports Bourne Again SHell (bash) as the default user shell.
You can specify AD attributes to map to the group ID, primary/user group ID, and unique user ID (UID) attributes in macOS. However, by default, these are derived from the domain server. It is also important to note that, if you change these attributes later, your users might lose access to their previously created files.
A domain controller (domain server) refers to a server that manages authentication and security within a network, effectively functioning as the gatekeeper within a domain. It is used to authenticate user identities that attempt to access the Active Directory network and its resources. You can specify a domain controller for authentication here. If none is specified, macOS uses site information and domain controller responsiveness to determine which domain controller to use.
Check this option and add groups to the list. Members listed in the AD groups you specify here are granted administrative privileges on the macOS device. You should also specify the display name of the required security groups. However, if If Allow Administration by is enabled and on AD groups are specified, all the domain and enterprise admins are granted administrative privileges by default.
By default, after you’ve entered the DNS name of the AD domain, macOS permits users within the Active Directory forest to authenticate from all domains. By unchecking this option, you can restrict authentication to users from just the specified domains.
So now you know how to bind your Macs to your organization’s Active Directory server. That’s great! However, before the celebrations begin, there’s just one more small hurdle to clear. Especially if you’re the IT administrator of a company that uses hundreds of macOS devices.
I think you might’ve grasped the issue by now, but here it is. Binding hundreds of Macs to your organization’s AD server one-by-one just takes too much time to be considered feasible. This is where UEM solution like Hexnode can help you.
With Hexnode’s AD asset binding policy, all you have to do is configure the settings once. You can then streamline the process of binding your corporate Macs to the company’s Active Directory server, and save yourselves lots of precious time.
Although Macs can be bound to the Active Directory domain using the above-mentioned policies and configurations, it is important to note that Microsoft’s AD services do not provide the same level of desktop management capabilities that they provide to their native Windows devices.
Corporate Macs cannot be managed by Active Directory domain services (AD DS) using their group policy objects (GPOs). This could turn out to be a pretty big dealbreaker for many businesses.
However, if you require to monitor and manage your corporate macOS devices, you can make use of a UEM solution like Hexnode to streamline Mac management in the enterprise.