TweetFollow Us on Twitter

MacEnterprise: Integrating with Active Directory

Volume Number: 25
Issue Number: 04
Column Tag: MacEnterprise

MacEnterprise: Integrating with Active Directory

A look at third-party tools for leveraging your AD infrastructure

By Greg Neagle, MacEnterprise.org

Introduction

In enterprise environments, Microsoft's Active Directory is possibly the single-most common directory service. It's well suited to large companies with geographically separated locations, and scales very well to tens and even hundreds of thousands of users. In any organization that has many Windows computers, or any company that uses Exchange, it is the obvious and maybe unavoidable choice for a directory service. For these reasons and more, Active Directory is the 500-pound gorilla of directory services. Questions about integrating Mac OS X with Active Directory are among the most common questions on the MacEnterprise mailing list (http://www.macenterprise.org/mailing-list).

Given the ubiquity of Active Directory in enterprise environments, it's not surprising that Apple offers a solution for AD integration: the Active Directory plug-in for Directory Services. This plug-in has been covered well here and elsewhere: Michael Bartosh wrote an excellent article for the November 2004 issue of MacTech covering the AD plug-in that shipped with Panther. You can find it in MacTech's online archives - much of what it covers is still relevant. In October 2007, Philip Reinhart covered a few more tricks with using the AD plug-in and the dsconfigad command-line tool. And of this writing, Apple has an excellent whitepaper on integrating Mac OS X with Active Directory available here: http://images.apple.com/business/solutions/it/docs/Best_Practices_Active_Directory.pdf

Still, Apple's built-in solution does not meet every possible need you might have when integrating Macs into an existing Active Directory infrastructure. Fortunately, there are third-party tools that can be used to supplement or even replace Apple's tools. We'll look at a few in this article. While not intended to be a in-depth examination, we'll briefly touch on the main features of some of the third-party solutions.

What's missing?

Before we look at third-party tools, it makes sense to talk about some of the "missing features" from Apple's offerings. Get ready for some three-letter acronyms:

GPO

GPOs, or Group Policy Objects, are used by Active Directory administrators to help manage their Windows clients. They can be used to manage security policies, software installation, login scripts, folder redirection, and some application settings. They are similar in concept to MCX settings in managed OS X environments. Some organizations would like to be able to define GPO settings to manage Macs along with their Windows machines. Apple's AD plug-in doesn't support Active Directory GPOs.

MCX

MCX is Apple's client management framework. Out-of-the box, there is no support for MCX settings in Active Directory. Some MCX options include extending the AD schema to include MCX attributes, deploying a dual-directory infrastructure where MCX records are stored in a secondary directory, or using a third-party replacement for Apple's AD plug-in.

DFS

DFS, or Microsoft's Distributed File System (sometimes written "Dfs") is a method of making shared filesystems available via a network. This is typically used to provide fault-tolerance and/or redundancy, and to insulate users from having to know on which fileserver a given resource is located. It is roughly equivalent to automounted NFS shares where a resource can be accessed by a specific path, no matter which actual fileserver hosts it. While this is not really a function of the AD plug-in, Apple's built in SMB/CIFS client does not support Microsoft's DFS.

This is not an exhaustive list - certainly there are other features of Active Directory and Windows file services that are not supported by Apple's tools, or with which Apple's tools have difficulty.

Select Third-party tools

ADmitMac

Thursby Software has been providing tools to help Macs connect to Windows for many years. ADmitMac, currently at version 4, is a complete replacement for both Apple's AD plugin and the built-in SMB client. Some key features:

Requires no Active Directory schema changes

Supports DFS, even for home directories

Support for Active Directory shared printers

Support for MCX client management

More information is available at http://www.thursby.com/products/admitmac.html

DAVE

Another product from Thursby Software is DAVE. It implements a subset of the features in ADmitMac. It operates as a replacement for Apple's SMB client, but provides less integration with Active Directory. See http://www.thursby.com/products/dave.html to learn more.

DirectControl

DirectControl from Centrify is also an Active Directory plug-in replacement. Besides the obligatory support for Active Directory authentication, a major feature of interest is support for GPOs: Windows administrators can use standard Windows tools to define GPOs for Mac clients that can specify certain management settings for user and computers. The ability to use a single set of tools to manage users, groups, and manage computers, no matter the OS is an important one for some organizations. Centrify also offers DirectControl for Linux and UNIX, which offers the possibility of using Active Directory to authenticate and manage all your platforms. More information on the Mac product is available at http://www.centrify.com/directcontrol/mac_os_x.asp

Likewise Enterprise

Likewise Enterprise is yet another replacement for Apple's Active Directory plug-in. A unique feature of this product is the ability to store MCX data in Active Directory without extending the schema. This is similar in concept to what Centrify's DirectControl does, but with two important differences:

Administrators can not only define Group Policy Objects using the Microsoft Management Console, but they can also use Apple's Workgroup Manager application to define Mac-specific management settings

Because actual MCX data can be stored in AD, a wider range of management settings are supported.

Likewise Enterprise is also available for Linux and UNIX, again making it possible to use a single directory service for all your platforms. Additionally, Likewise offers an Active Directory management console that runs on Mac OS X and Linux. Visit http://www.likewise.com/products/likewise_enterprise/ for more information on this product.

ExtremeZ-IP

ExtremeZ-IP is a product from GroupLogic that provides Apple File Protocol services and printing services from Windows servers. Implementing ExtremeZ-IP on your Windows file servers allows Mac clients to connect via the native AFP client instead of the SMB/CIFS client. Since this is a server-based file sharing solution, it might seem odd to include it in this list of third-party tools. But GroupLogic has announced that Extreme-IP 6, due this year, will provide support for Microsoft DFS. With ExtremeZ-IP 6, Leopard (and later) clients will be able to use AFP to connect to Microsoft DFS shares. As a server-based solution, it can be used in conjunction with many of the client-based solutions mentioned above. You can find out more about ExtremeZ-IP at http://www.grouplogic.com/products/extremeZ-IP/

Active Directory Integration Cheat Sheet

To wrap things up for this overview, the table below lists the solutions mentioned in this article with a matrix of some of the features not directly supported by Apple's built-in tools. If Apple's bundled solutions for Active Directory and Windows file server integration don't meet all your needs, you have some additional options to explore!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Dash 3.0.2 - Instant search and offline...
Dash is an API Documentation Browser and Code Snippet Manager. Dash helps you store snippets of code, as well as instantly search and browse documentation for almost any API you might use (for a full... Read more
FontExplorer X Pro 5.0 - Font management...
FontExplorer X Pro is optimized for professional use; it's the solution that gives you the power you need to manage all your fonts. Now you can more easily manage, activate and organize your... Read more
Typinator 6.6 - Speedy and reliable text...
Typinator turbo-charges your typing productivity. Type a little. Typinator does the rest. We've all faced projects that require repetitive typing tasks. With Typinator, you can store commonly used... Read more
Arq 4.12.1 - Online backup to Google Dri...
Arq is super-easy online backup for the Mac. Back up to your own Google Drive storage (15GB free storage), your own Amazon Glacier ($.01/GB per month storage) or S3, or any SFTP server. Arq backs up... Read more
Gutenprint 5.2.11-pre1 - Quality drivers...
Gutenprint is a suite of printer drivers that may be used with most common UNIX print spooling systems, including CUPS, lpr, LPRng, or others. Gutenprint currently supports over 2000 printer models.... Read more
Dropbox 3.6.8 - Cloud backup and synchro...
Dropbox is an application that creates a special Finder folder that automatically syncs online and between your computers. It allows you to both backup files and keep them up-to-date between systems... Read more
Evernote 6.0.15 - Create searchable note...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
MacUpdate Desktop 6.0.7 - Search and ins...
MacUpdate Desktop 6 brings seamless 1-click installs and version updates to your Mac. With a free MacUpdate account and MacUpdate Desktop 6, Mac users can now install almost any Mac app on macupdate.... Read more
Freeway Pro 7.0.4 - Drag-and-drop Web de...
Freeway Pro lets you design and build sophisticated responsive websites code free. With its user-oriented drag-and-drop interface, Freeway Pro helps you piece together the website of your dreams. Add... Read more
VueScan 9.5.18 - Scanner software with a...
VueScan is a scanning program that works with most high-quality flatbed and film scanners to produce scans that have excellent color fidelity and color balance. VueScan is easy to use, and has... Read more

This Week at 148Apps:June 22-26, 2015
June's Summer Journey Continues With 148Apps How do you know what apps are worth your time and money? Just look to the review team at 148Apps. We sort through the chaos and find the apps you're looking for. The ones we love become Editor’s Choice,... | Read more »
LEGO® Minifigures Online (Games)
LEGO® Minifigures Online 1.0.1 Device: iOS iPhone Category: Games Price: $4.99, Version: 1.0.1 (iTunes) Description: | Read more »
World of Tanks Blitz celebrates its firs...
Today marks the first anniversary of the launch of World of Tanks Blitz, the mobile version of the PC tank battler, World of Tanks. World of Tanks Blitz launched on iOS and Android on June 26th last year and to celebrate, Wargaming is giving all... | Read more »
Heroes and Castles 2 Has its Own Standal...
Heroes and Castles 2 is a third-person castle defense game from the same team behind Block Fortress and Bug Heroes. It's cool, it's fun, and now it has its very own free version. [Read more] | Read more »
Formula Cartoon All-Stars Lets You Race...
Ever want to pit your favorite characters from shows like Steven Universe, Adventure Time, and Regular Show against each other in a not quite death race? Well once upon a time you could, but Formula All Stars Touch N' Go doesn't exist anymore. Hope... | Read more »
Retype - Typography Photo Editor (Photo...
Retype - Typography Photo Editor 1.0 Device: iOS Universal Category: Photography Price: $2.99, Version: 1.0 (iTunes) Description: Retype is built out of passion for great typography and it's all about adding text to photo with style... | Read more »
Hungry Shark Evolution Celebrates Shark...
Shark Week is almost here, as is Independence Day, so naturally Hungry Shark Evolution is going to get in on the action. Yes, even the fireworks. [Read more] | Read more »
The New Trivia Crack Will Feature a Musi...
It's official: iHeartMedia (you may know them from iHeartRadio) will be in charge of providing music-related questions for Trivia Crack's upcoming sequel. Also Trivia Crack is getting a sequel. [Read more] | Read more »
Toca Life: City (Education)
Toca Life: City 1.0 Device: iOS Universal Category: Education Price: $2.99, Version: 1.0 (iTunes) Description: Welcome to Toca Life: City, a metropolis filled with everyday fun! Customize characters, explore exciting locations and... | Read more »
Ironkill's Big New Update is Big an...
The other popular robot fighting game on the App Store, Ironkill, has received a pretty substantial update today. We're talking new bots, new rewards, graphical tweaks; the works. [Read more] | Read more »

Price Scanner via MacPrices.net

MacBook Airs on sale for up to $75 off MSRP
Save up to $75 on the purchase of a new 2015 13″ or 11″ 1.6GHz MacBook Air at the following resellers. Shipping is free with each model: 11" 128GB MSRP $899 11" 256GB... Read more
Apple’s Education discount saves up to $300 o...
Purchase a new Mac or iPad at The Apple Store for Education and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free,... Read more
Save up to $600 with Apple refurbished Mac Pr...
The Apple Store has Apple Certified Refurbished Mac Pros available for up to $600 off the cost of new models. An Apple one-year warranty is included with each Mac Pro, and shipping is free. The... Read more
Mac Pros on sale for up to $260 off MSRP
B&H Photo has Mac Pros on sale for up to $260 off MSRP. Shipping is free, and B&H charges sales tax in NY only: - 3.7GHz 4-core Mac Pro: $2799, $200 off MSRP - 3.5GHz 6-core Mac Pro: $3719.99... Read more
Save up to $400 on 2014 15-inch Retina MacBoo...
B&H Photo has previous-generation 2014 15″ Retina MacBook Pros on sale for up to $400 off original MSRP. Shipping is free, and B&H charges NY sales tax only: - 15″ 2.2GHz Retina MacBook Pro... Read more
15-inch Retina MacBook Pros on sale for up to...
B&H Photo has new 2015 15″ Retina MacBook Pros on sale for up to $125 off MSRP including free shipping plus NY sales tax only: - 15″ 2.2GHz Retina MacBook Pro: $1899.99 $100 off - 15″ 2.5GHz... Read more
College Student Deals: Additional $100 off Ma...
Take an additional $100 off all MacBooks and iMacs at Best Buy Online with their College Students Deals Savings, valid through July 11, 2015. Anyone with a valid .EDU email address can take advantage... Read more
Apple refurbished Time Capsules available for...
The Apple Store has certified refurbished Time Capsules available for $100 off MSRP. Apple’s one-year warranty is included with each Time Capsule, and shipping is free: - 2TB Time Capsule: $199, $100... Read more
Newsweek Launches iPhone App
The venerable weekly news magazine Newsweek, owned by IBT Media, has announced the launch of its first iPhone app. The new app is available through Apple’s App Store and will allow consumers to read... Read more
New Initiative Covering 80 Million Homes Will...
Today, Internet service providers, equipment suppliers and retail equipment manufacturers joined the Consumer Electronics Association (CEA) and the National Cable & Telecommunications Association... Read more

Jobs Board

Architect / Senior Software Engineer, *Apple...
**Job Summary** Apple Pay is already changing our pay-habit in a deeper and fundamental level. We are looking for a software engineer with a passion for large scale inte Read more
Project Manager, *Apple* Retail New Store O...
**Job Summary** An Apple Retail New Store Openings & Remodels Project Manager is responsible for successfully managing the openings, remodels, and small works of Read more
*Apple* Solutions Consultant - Retail Sales...
**Job Summary** As an Apple Solutions Consultant (ASC) you are the link between our customers and our products. Your role is to drive the Apple business in a retail Read more
Program Manger, WW *Apple* Direct Fulfillme...
**Job Summary** We are seeking a business analyst to work within our Worldwide Apple Direct Fulfillment Operations team. This role will work closely with related program Read more
Hardware Design Validation Engineer - *Apple...
**Job Summary** The Apple Watch team is looking for a Hardware Design Validation Engineer. This person will be part of the Apple Watch hardware team with Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.