TweetFollow Us on Twitter

MacEnterprise: Integrating with Active Directory

Volume Number: 25
Issue Number: 04
Column Tag: MacEnterprise

MacEnterprise: Integrating with Active Directory

A look at third-party tools for leveraging your AD infrastructure

By Greg Neagle, MacEnterprise.org

Introduction

In enterprise environments, Microsoft's Active Directory is possibly the single-most common directory service. It's well suited to large companies with geographically separated locations, and scales very well to tens and even hundreds of thousands of users. In any organization that has many Windows computers, or any company that uses Exchange, it is the obvious and maybe unavoidable choice for a directory service. For these reasons and more, Active Directory is the 500-pound gorilla of directory services. Questions about integrating Mac OS X with Active Directory are among the most common questions on the MacEnterprise mailing list (http://www.macenterprise.org/mailing-list).

Given the ubiquity of Active Directory in enterprise environments, it's not surprising that Apple offers a solution for AD integration: the Active Directory plug-in for Directory Services. This plug-in has been covered well here and elsewhere: Michael Bartosh wrote an excellent article for the November 2004 issue of MacTech covering the AD plug-in that shipped with Panther. You can find it in MacTech's online archives - much of what it covers is still relevant. In October 2007, Philip Reinhart covered a few more tricks with using the AD plug-in and the dsconfigad command-line tool. And of this writing, Apple has an excellent whitepaper on integrating Mac OS X with Active Directory available here: http://images.apple.com/business/solutions/it/docs/Best_Practices_Active_Directory.pdf

Still, Apple's built-in solution does not meet every possible need you might have when integrating Macs into an existing Active Directory infrastructure. Fortunately, there are third-party tools that can be used to supplement or even replace Apple's tools. We'll look at a few in this article. While not intended to be a in-depth examination, we'll briefly touch on the main features of some of the third-party solutions.

What's missing?

Before we look at third-party tools, it makes sense to talk about some of the "missing features" from Apple's offerings. Get ready for some three-letter acronyms:

GPO

GPOs, or Group Policy Objects, are used by Active Directory administrators to help manage their Windows clients. They can be used to manage security policies, software installation, login scripts, folder redirection, and some application settings. They are similar in concept to MCX settings in managed OS X environments. Some organizations would like to be able to define GPO settings to manage Macs along with their Windows machines. Apple's AD plug-in doesn't support Active Directory GPOs.

MCX

MCX is Apple's client management framework. Out-of-the box, there is no support for MCX settings in Active Directory. Some MCX options include extending the AD schema to include MCX attributes, deploying a dual-directory infrastructure where MCX records are stored in a secondary directory, or using a third-party replacement for Apple's AD plug-in.

DFS

DFS, or Microsoft's Distributed File System (sometimes written "Dfs") is a method of making shared filesystems available via a network. This is typically used to provide fault-tolerance and/or redundancy, and to insulate users from having to know on which fileserver a given resource is located. It is roughly equivalent to automounted NFS shares where a resource can be accessed by a specific path, no matter which actual fileserver hosts it. While this is not really a function of the AD plug-in, Apple's built in SMB/CIFS client does not support Microsoft's DFS.

This is not an exhaustive list - certainly there are other features of Active Directory and Windows file services that are not supported by Apple's tools, or with which Apple's tools have difficulty.

Select Third-party tools

ADmitMac

Thursby Software has been providing tools to help Macs connect to Windows for many years. ADmitMac, currently at version 4, is a complete replacement for both Apple's AD plugin and the built-in SMB client. Some key features:

Requires no Active Directory schema changes

Supports DFS, even for home directories

Support for Active Directory shared printers

Support for MCX client management

More information is available at http://www.thursby.com/products/admitmac.html

DAVE

Another product from Thursby Software is DAVE. It implements a subset of the features in ADmitMac. It operates as a replacement for Apple's SMB client, but provides less integration with Active Directory. See http://www.thursby.com/products/dave.html to learn more.

DirectControl

DirectControl from Centrify is also an Active Directory plug-in replacement. Besides the obligatory support for Active Directory authentication, a major feature of interest is support for GPOs: Windows administrators can use standard Windows tools to define GPOs for Mac clients that can specify certain management settings for user and computers. The ability to use a single set of tools to manage users, groups, and manage computers, no matter the OS is an important one for some organizations. Centrify also offers DirectControl for Linux and UNIX, which offers the possibility of using Active Directory to authenticate and manage all your platforms. More information on the Mac product is available at http://www.centrify.com/directcontrol/mac_os_x.asp

Likewise Enterprise

Likewise Enterprise is yet another replacement for Apple's Active Directory plug-in. A unique feature of this product is the ability to store MCX data in Active Directory without extending the schema. This is similar in concept to what Centrify's DirectControl does, but with two important differences:

Administrators can not only define Group Policy Objects using the Microsoft Management Console, but they can also use Apple's Workgroup Manager application to define Mac-specific management settings

Because actual MCX data can be stored in AD, a wider range of management settings are supported.

Likewise Enterprise is also available for Linux and UNIX, again making it possible to use a single directory service for all your platforms. Additionally, Likewise offers an Active Directory management console that runs on Mac OS X and Linux. Visit http://www.likewise.com/products/likewise_enterprise/ for more information on this product.

ExtremeZ-IP

ExtremeZ-IP is a product from GroupLogic that provides Apple File Protocol services and printing services from Windows servers. Implementing ExtremeZ-IP on your Windows file servers allows Mac clients to connect via the native AFP client instead of the SMB/CIFS client. Since this is a server-based file sharing solution, it might seem odd to include it in this list of third-party tools. But GroupLogic has announced that Extreme-IP 6, due this year, will provide support for Microsoft DFS. With ExtremeZ-IP 6, Leopard (and later) clients will be able to use AFP to connect to Microsoft DFS shares. As a server-based solution, it can be used in conjunction with many of the client-based solutions mentioned above. You can find out more about ExtremeZ-IP at http://www.grouplogic.com/products/extremeZ-IP/

Active Directory Integration Cheat Sheet

To wrap things up for this overview, the table below lists the solutions mentioned in this article with a matrix of some of the features not directly supported by Apple's built-in tools. If Apple's bundled solutions for Active Directory and Windows file server integration don't meet all your needs, you have some additional options to explore!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 
AAPL
$119.00
Apple Inc.
+1.40
MSFT
$47.75
Microsoft Corpora
+0.28
GOOG
$540.37
Google Inc.
-0.71

MacTech Search:
Community Search:

Software Updates via MacUpdate

HoudahSpot 3.9.6 - Advanced file search...
HoudahSpot is a powerful file search tool built upon MacOS X Spotlight. Spotlight unleashed Create detailed queries to locate the exact file you need Narrow down searches. Zero in on files Save... Read more
RapidWeaver 6.0.3 - Create template-base...
RapidWeaver is a next-generation Web design application to help you easily create professional-looking Web sites in minutes. No knowledge of complex code is required, RapidWeaver will take care of... Read more
iPhoto Library Manager 4.1.10 - Manage m...
iPhoto Library Manager lets you organize your photos into multiple iPhoto libraries. Separate your high school and college photos from your latest summer vacation pictures. Or keep some photo... Read more
iExplorer 3.5.1.9 - View and transfer al...
iExplorer is an iPhone browser for Mac lets you view the files on your iOS device. By using a drag and drop interface, you can quickly copy files and folders between your Mac and your iPhone or... Read more
MacUpdate Desktop 6.0.3 - Discover and i...
MacUpdate Desktop 6 brings seamless 1-click installs and version updates to your Mac. With a free MacUpdate account and MacUpdate Desktop 6, Mac users can now install almost any Mac app on macupdate.... Read more
SteerMouse 4.2.2 - Powerful third-party...
SteerMouse is an advanced driver for USB and Bluetooth mice. It also supports Apple Mighty Mouse very well. SteerMouse can assign various functions to buttons that Apple's software does not allow,... Read more
iMazing 1.1 - Complete iOS device manage...
iMazing (was DiskAid) is the ultimate iOS device manager with capabilities far beyond what iTunes offers. With iMazing and your iOS device (iPhone, iPad, or iPod), you can: Copy music to and from... Read more
PopChar X 7.0 - Floating window shows av...
PopChar X helps you get the most out of your font collection. With its crystal-clear interface, PopChar X provides a frustration-free way to access any font's special characters. Expanded... Read more
Carbon Copy Cloner 4.0.3 - Easy-to-use b...
Carbon Copy Cloner backups are better than ordinary backups. Suppose the unthinkable happens while you're under deadline to finish a project: your Mac is unresponsive and all you hear is an ominous,... Read more
ForeverSave 2.1.3 - Universal auto-save...
ForeverSave auto-saves all documents you're working on while simultaneously doing backup versioning in the background. Lost data can be quickly restored at any time. Losing data, caused by... Read more

Latest Forum Discussions

See All

Make Way for Fat Chicken, from the Maker...
Make Way for Fat Chicken, from the Makers of Scrap Squad Posted by Jessica Fisher on November 26th, 2014 [ permalink ] Relevant Games has announced they will be releasing their reverse tower defense game, | Read more »
Tripnary Review
Tripnary Review By Jennifer Allen on November 26th, 2014 Our Rating: :: TRAVEL BUCKET LISTiPhone App - Designed for the iPhone, compatible with the iPad Want to create a travel bucket list? Tripnary is a fun way to do exactly that... | Read more »
Ossian Studios’ RPG, The Shadow Sun, is...
Ossian Studios’ RPG, The Shadow Sun, is Now Available for $4.99 Posted by Jessica Fisher on November 26th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Mmmm, Tasty – Having the Angry Birds for...
The very first Angry Birds debuted on iOS back in 2009. When you sit back and tally up the number of Angry Birds games out there and the impact they’ve had on pop culture as a whole, you just need to ask yourself: “How would the birds taste... | Read more »
Rescue Quest Review
Rescue Quest Review By Jennifer Allen on November 26th, 2014 Our Rating: :: PATH BASED MATCH-3Universal App - Designed for iPhone and iPad Guide a wizard to safety by matching gems. Rescue Quest might not be an entirely original... | Read more »
You Can Play the Final Chapter of Lone W...
You Can Play the Final Chapter of Lone Wolf: Dawn Over V’taag Right Now Posted by Jessica Fisher on November 26th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Swords of Anima (Games)
Swords of Anima 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: A new tactical turn-based RPG experience. Command the Savior Rex Squad in an epic journey of courage and deception. Can you... | Read more »
Audio Defence: Zombie Arena
Audio Defence: Zombie Arena By Lee Hamlet on November 26th, 2014 Our Rating: :: DRAGS ITS FEETUniversal App - Designed for iPhone and iPad From the makers of Papa Sangre comes a defense game that forces players to listen carefully... | Read more »
Tales from the Borderland​s Will be Comi...
Tales from the Borderland​s Will be Coming to iOS by the End of the Year Posted by Jessica Fisher on November 26th, 2014 [ permalink ] Telltale Games has announced | Read more »
Sunburn! Review
Sunburn! Review By Campbell Bird on November 26th, 2014 Our Rating: :: DON'T DIE ALONEUniversal App - Designed for iPhone and iPad Platform through the depths of space to make sure your entire crew dies together in this satisfying... | Read more »

Price Scanner via MacPrices.net

2014 1.4GHz Mac mini on sale for $449, save $...
 B&H Photo has the new 1.4GHz Mac mini on sale for $449.99 including free shipping plus NY tax only. Their price is $50 off MSRP, and it’s the lowest price available for this new model. Adorama... Read more
Early Black Friday pricing on 27-inch 5K iMac...
 B&H Photo continues to offer Black Friday sale prices on the 27″ 3.5GHz 5K iMac, in stock today and on sale for $2299 including free shipping plus NY sales tax only. Their price is $200 off MSRP... Read more
Early Black Friday sale prices on iPad Air 2,...
 MacMall is discounting iPad Air 2s by up to $75 off MSRP as part of their Black Friday sale. Shipping is free: - 16GB iPad Air WiFi: $459 $40 off - 64GB iPad Air WiFi: $559 $40 off - 128GB iPad Air... Read more
Early Black Friday MacBook Air sale prices, $...
 MacMall has posted early Black Friday MacBook Air sale prices. Save $101 on all models for a limited time: - 11″ 1.4GHz/128GB MacBook Air: $798 - 11″ 1.4GHz/256GB MacBook Air: $998 - 13″ 1.4GHz/... Read more
Why iPhone 6 Tablet/Laptop Cannibalization Is...
247wallst.com blogger Douglas A. McIntyre noted last week that according to research posted on the Applovin blog site the iPhone 6 is outselling the iPhone 6 Plus by a wide margin . Hardly a surprise... Read more
Worldwide Tablet Growth Expected to Slow to 7...
The global tablet market is expected to record massive deceleration in 2014 with year-over-year growth slowing to 7.2%, down from 52.5% in 2013, according to a new forecast from International Data... Read more
Touchscreen Glove Company Announces New Produ...
Surrey, United Kingdom based TouchAbility specializes in design and manufacture of a wide variety of products compatible with touchscreen devices including smartphones, tablets and computers. Their... Read more
OtterBox Alpha Glass Screen Protectors for iP...
To complement the bigger, sharper displays on the latest Apple devices, OtterBox has introduced Alpha Glass screen protectors to the iPhone 6 and iPhone 6 Plus. The fortified glass screen protectors... Read more
Early Black Friday Mac Pro sale, 6-Core 3.5GH...
 B&H Photo has the 6-Core 3.5GHz Mac Pro on sale today for $3499 including free shipping plus NY sales tax. Their price is $500 off MSRP, and it’s the lowest price available for this model from... Read more
Early Black Friday sale price: 15-inch 2.2GHz...
 B&H Photo has the 2014 15″ 2.2GHz Retina MacBook Pro on sale today for $1699.99. Shipping is free, and B&H charges NY sales tax only. Their price is $300 off MSRP, equalling Best Buy’s price... Read more

Jobs Board

*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Senior Event Manager, *Apple* Retail Market...
…This senior level position is responsible for leading and imagining the Apple Retail Team's global event strategy. Delivering an overarching brand story; in-store, Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.