TweetFollow Us on Twitter

MacEnterprise: Integrating with Active Directory

Volume Number: 25
Issue Number: 04
Column Tag: MacEnterprise

MacEnterprise: Integrating with Active Directory

A look at third-party tools for leveraging your AD infrastructure

By Greg Neagle, MacEnterprise.org

Introduction

In enterprise environments, Microsoft's Active Directory is possibly the single-most common directory service. It's well suited to large companies with geographically separated locations, and scales very well to tens and even hundreds of thousands of users. In any organization that has many Windows computers, or any company that uses Exchange, it is the obvious and maybe unavoidable choice for a directory service. For these reasons and more, Active Directory is the 500-pound gorilla of directory services. Questions about integrating Mac OS X with Active Directory are among the most common questions on the MacEnterprise mailing list (http://www.macenterprise.org/mailing-list).

Given the ubiquity of Active Directory in enterprise environments, it's not surprising that Apple offers a solution for AD integration: the Active Directory plug-in for Directory Services. This plug-in has been covered well here and elsewhere: Michael Bartosh wrote an excellent article for the November 2004 issue of MacTech covering the AD plug-in that shipped with Panther. You can find it in MacTech's online archives - much of what it covers is still relevant. In October 2007, Philip Reinhart covered a few more tricks with using the AD plug-in and the dsconfigad command-line tool. And of this writing, Apple has an excellent whitepaper on integrating Mac OS X with Active Directory available here: http://images.apple.com/business/solutions/it/docs/Best_Practices_Active_Directory.pdf

Still, Apple's built-in solution does not meet every possible need you might have when integrating Macs into an existing Active Directory infrastructure. Fortunately, there are third-party tools that can be used to supplement or even replace Apple's tools. We'll look at a few in this article. While not intended to be a in-depth examination, we'll briefly touch on the main features of some of the third-party solutions.

What's missing?

Before we look at third-party tools, it makes sense to talk about some of the "missing features" from Apple's offerings. Get ready for some three-letter acronyms:

GPO

GPOs, or Group Policy Objects, are used by Active Directory administrators to help manage their Windows clients. They can be used to manage security policies, software installation, login scripts, folder redirection, and some application settings. They are similar in concept to MCX settings in managed OS X environments. Some organizations would like to be able to define GPO settings to manage Macs along with their Windows machines. Apple's AD plug-in doesn't support Active Directory GPOs.

MCX

MCX is Apple's client management framework. Out-of-the box, there is no support for MCX settings in Active Directory. Some MCX options include extending the AD schema to include MCX attributes, deploying a dual-directory infrastructure where MCX records are stored in a secondary directory, or using a third-party replacement for Apple's AD plug-in.

DFS

DFS, or Microsoft's Distributed File System (sometimes written "Dfs") is a method of making shared filesystems available via a network. This is typically used to provide fault-tolerance and/or redundancy, and to insulate users from having to know on which fileserver a given resource is located. It is roughly equivalent to automounted NFS shares where a resource can be accessed by a specific path, no matter which actual fileserver hosts it. While this is not really a function of the AD plug-in, Apple's built in SMB/CIFS client does not support Microsoft's DFS.

This is not an exhaustive list - certainly there are other features of Active Directory and Windows file services that are not supported by Apple's tools, or with which Apple's tools have difficulty.

Select Third-party tools

ADmitMac

Thursby Software has been providing tools to help Macs connect to Windows for many years. ADmitMac, currently at version 4, is a complete replacement for both Apple's AD plugin and the built-in SMB client. Some key features:

Requires no Active Directory schema changes

Supports DFS, even for home directories

Support for Active Directory shared printers

Support for MCX client management

More information is available at http://www.thursby.com/products/admitmac.html

DAVE

Another product from Thursby Software is DAVE. It implements a subset of the features in ADmitMac. It operates as a replacement for Apple's SMB client, but provides less integration with Active Directory. See http://www.thursby.com/products/dave.html to learn more.

DirectControl

DirectControl from Centrify is also an Active Directory plug-in replacement. Besides the obligatory support for Active Directory authentication, a major feature of interest is support for GPOs: Windows administrators can use standard Windows tools to define GPOs for Mac clients that can specify certain management settings for user and computers. The ability to use a single set of tools to manage users, groups, and manage computers, no matter the OS is an important one for some organizations. Centrify also offers DirectControl for Linux and UNIX, which offers the possibility of using Active Directory to authenticate and manage all your platforms. More information on the Mac product is available at http://www.centrify.com/directcontrol/mac_os_x.asp

Likewise Enterprise

Likewise Enterprise is yet another replacement for Apple's Active Directory plug-in. A unique feature of this product is the ability to store MCX data in Active Directory without extending the schema. This is similar in concept to what Centrify's DirectControl does, but with two important differences:

Administrators can not only define Group Policy Objects using the Microsoft Management Console, but they can also use Apple's Workgroup Manager application to define Mac-specific management settings

Because actual MCX data can be stored in AD, a wider range of management settings are supported.

Likewise Enterprise is also available for Linux and UNIX, again making it possible to use a single directory service for all your platforms. Additionally, Likewise offers an Active Directory management console that runs on Mac OS X and Linux. Visit http://www.likewise.com/products/likewise_enterprise/ for more information on this product.

ExtremeZ-IP

ExtremeZ-IP is a product from GroupLogic that provides Apple File Protocol services and printing services from Windows servers. Implementing ExtremeZ-IP on your Windows file servers allows Mac clients to connect via the native AFP client instead of the SMB/CIFS client. Since this is a server-based file sharing solution, it might seem odd to include it in this list of third-party tools. But GroupLogic has announced that Extreme-IP 6, due this year, will provide support for Microsoft DFS. With ExtremeZ-IP 6, Leopard (and later) clients will be able to use AFP to connect to Microsoft DFS shares. As a server-based solution, it can be used in conjunction with many of the client-based solutions mentioned above. You can find out more about ExtremeZ-IP at http://www.grouplogic.com/products/extremeZ-IP/

Active Directory Integration Cheat Sheet

To wrap things up for this overview, the table below lists the solutions mentioned in this article with a matrix of some of the features not directly supported by Apple's built-in tools. If Apple's bundled solutions for Active Directory and Windows file server integration don't meet all your needs, you have some additional options to explore!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

CrossOver 14.1.3 - Run Windows apps on y...
CrossOver can get your Windows productivity applications and PC games up and running on your Mac quickly and easily. CrossOver runs the Windows software that you need on Mac at home, in the office,... Read more
Little Snitch 3.5.3 - Alerts you about o...
Little Snitch gives you control over your private outgoing data. Track background activity As soon as your computer connects to the Internet, applications often have permission to send any... Read more
OmniGraffle Pro 6.2.3 - Create diagrams,...
OmniGraffle Pro helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use... Read more
OmniFocus 2.2 - GTD task manager with iO...
OmniFocus helps you manage your tasks the way that you want, freeing you to focus your attention on the things that matter to you most. Capturing tasks and ideas is always a keyboard shortcut away in... Read more
Cocktail 8.4 - General maintenance and o...
Cocktail is a general purpose utility for OS X that lets you clean, repair and optimize your Mac. It is a powerful digital toolset that helps hundreds of thousands of Mac users around the world get... Read more
PDFKey Pro 4.3 - Edit and print password...
PDFKey Pro can unlock PDF documents protected for printing and copying when you've forgotten your password. It can now also protect your PDF files with a password to prevent unauthorized access and/... Read more
Kodi 15.0.beta1 - Powerful media center...
Kodi (was XBMC) is an award-winning free and open-source (GPL) software media player and entertainment hub that can be installed on Linux, OS X, Windows, iOS, and Android, featuring a 10-foot user... Read more
DiskCatalogMaker 6.4.12 - Catalog your d...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast. Finder-like intuitive look and feel. Super-fast search algorithm. Can compress catalog data... Read more
Macs Fan Control 1.3.0.0 - Monitor and c...
Macs Fan Control allows you to monitor and control almost any aspect of your computer's fans, with support for controlling fan speed, temperature sensors pane, menu-bar icon, and autostart with... Read more
Lyn 1.5.11 - Lightweight image browser a...
Lyn is a lightweight and fast image browser and viewer designed for photographers, graphic artists and Web designers. Featuring an extremely versatile and aesthetically pleasing interface, it... Read more

Battle of Gods: Ascension (Games)
Battle of Gods: Ascension 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: TURN-BASED TACTICAL COMBATFight tactical battles against the forces of Hades! In Battle of Gods: Ascension you play... | Read more »
Shadowmatic's Latest Update Adds a...
Shadowmatic's shadowy shadow-ness is getting a little shadowy-er thanks to a recent update that adds an Arcade Mode. [Read more] | Read more »
Sunrise Calendar and Slack Have Assimila...
Wunderlist is perhaps one of the most populat and beloved productivity apps on the App Store - and now it's gone and incorporated itself into other useful services like Sunrise Calendar and Slack. [Read more] | Read more »
Crossy Road Devs Hipster Whale are Bring...
Hipster Whale, the minds behind the rather popular (and rather great) Crossy Road, have teamed-up with Bandai Namco to create PAC-MAN 256: an absolutely bonkers looking maze runner chaser thing. | Read more »
Meet the New Spotify Music
Spotify Music  has a lot going on. They're introducing 3 new modes to serve all your musical needs, with the "Now" start page  gives you curated playlists based on your particular tastes. As you listen the app will learn more about your tastes and... | Read more »
What the Apple Watch Gets Right, and Wha...
| Read more »
Celebrate PAC-MAN's 35th Birthday W...
BANDAI NAMCO Entertainment America is celebrating PAC-MAN's 35th anniversary by releasing updates for PAC-MAN and PAC-MAN Lite for iOS. [Read more] | Read more »
Strike Wing Episode 2 has Landed on the...
Strike Wing: Raptor Rising is an exciting space combat simulator by Crescent Moon Games, which was recently updated to continue the story with Episode 2. [Read more] | Read more »
Kiqplan Expands its Interactive Coaching...
The makers of Fitbug have been hard at work on their Kiqplan lineup, and have added four new summer themed plans to help you get the most out of your workout. [Read more] | Read more »
Make a Photobook in Minutes with Pictyea...
What happens when you can't stop taking photos and have an urge to create a photobook? Pictyear saves the day. [Read more] | Read more »

Price Scanner via MacPrices.net

What Would the ideal Apple Productivity Platf...
For the past four years I’ve kept a foot in both the Mac and iPad camps respectively. my daily computing hours divided about 50/50 between the two devices with remarkable consistency. However, there’... Read more
PageMeUp 1.2.1 Ten Dollar Page Layout Applica...
Paris, France-based Softobe, an OS X software development company, has announced that their PageMeUp v. 1.2.1, is available on the Mac App Store for $9.99. The license can be installed on up to 5... Read more
Eight New Products For USB Type-C Application...
Fresco Logic, specialists in advanced connectivity technologies and ICs, has introduced two new product families targeting the Type-C connector recently introduced across a number of consumer... Read more
Scripps National Spelling Bee Launches Buzzwo...
Scripps National Spelling Bee fans can monitor the action at the 2015 Spelling Bee with the new Buzzworthy app for iOS, Android and Windows mobile devices. The free Buzzworthy app provides friendly... Read more
13-inch 2.5GHz MacBook Pro on sale for $120 o...
B&H Photo has the 13″ 2.5GHz MacBook Pro on sale for $979 including free shipping plus NY sales tax only. Their price is $120 off MSRP, and it’s the lowest price for this model (except for Apple’... Read more
27-inch 3.3GHz 5K iMac on sale for $1899, $10...
B&H Photo has the new 27″ 3.3GHz 5K iMac on sale for $1899.99 including free shipping plus NY tax only. Their price is $100 off MSRP. Read more
Save up to $50 on iPad Air 2, NY tax only, fr...
B&H Photo has iPad Air 2s on sale for up to $50 off MSRP including free shipping plus NY sales tax only: - 16GB iPad Air 2 WiFi: $469 $30 off - 64GB iPad Air 2 WiFi: $549.99 $50 off - 128GB iPad... Read more
Updated Mac Price Trackers
We’ve updated our Mac Price Trackers with the latest information on prices, bundles, and availability on systems from Apple’s authorized internet/catalog resellers: - 15″ MacBook Pros - 13″ MacBook... Read more
New 13-inch 2.9GHz Retina MacBook Pro on sale...
B&H Photo has the 13″ 2.9GHz/512GB Retina MacBook Pro on sale for $1699.99 including free shipping plus NY tax only. Their price is $100 off MSRP, and it’s the lowest price for this model from... Read more
Apple refurbished 2014 MacBook Airs available...
The Apple Store has Apple Certified Refurbished 2014 MacBook Airs available starting at $679. An Apple one-year warranty is included with each MacBook, and shipping is free: - 11″ 1.4GHz/128GB... Read more

Jobs Board

Senior Software Engineer - *Apple* SIM - Ap...
Changing the world is all in a day039s work at Apple . If you love innovation, here039s your chance to make a career of it. You039ll work hard. But the job comes with Read more
Lead *Apple* Solutions Consultant - Retail...
**Job Summary** Job Summary The Lead ASC is an Apple employee who serves as the Apple business manager and influencer in a hyper-business critical Reseller's store Read more
Architect / Senior Software Engineer, *Apple...
Changing the world is all in a day039s work at Apple . If you love innovation, here039s your chance to make a career of it. You039ll work hard. But the job comes with Read more
*Apple* Pay Support Readiness Project Manage...
Changing the world is all in a day039s work at Apple . If you love innovation, here039s your chance to make a career of it. You039ll work hard. But the job comes with Read more
Hardware Design Validation Engineer - *Apple...
**Job Summary** The Apple Watch team is looking for a Hardware Design Validation Engineer. This person will be part of the Apple Watch hardware team with Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.