Configuring the Active Directory Plug-in

Transcription

1 Wazza s QuickStart Configuring the Active Directory Plug-in Mac OS X Background Using the Mac OS X 10.3.x built-in Active Directory (AD) plug-in, Mac users can authenticate with a Windows Active Directory server, and mount their Windows home folder on their Mac desktop. With some further tweaking the Mac user s Home folder on the Windows server can be set as their default Home folder, populated with subfolders similar to those found in a regular Mac Home folder. Procedure 1. Check that: 1.1. Your Mac client has a valid IP address, and can access the network The primary DNS Server to which the Mac is pointed is the same as the DNS server address used by the Win AD server. (The DNS address may be provided by a DHCP server, and so will not be displayed in the Network Prefs). 2. Open Directory Access (Applications > Utilities). 3. Click the padlock icon, to allow changes to be made to the settings. 4. Tick to enable Active Directory plug-in. Disable the LDAPv3 plugin

2 5. With the Active Directory plug-in selected, click on the Configure button. 6. Enter the relevant AD Forest and AD Domain information for the Windows domain. Give the computer a unique ID name/number. 7. Click on the Bind button. 8. Enter your local admin password. Click on the OK button. 9. Enter your AD admin password. Click on the OK button. 10. Restart the computer. Configuring the OS X Active Directory Plug-in Page 2

3 11. Open Directory Access again. Click on the Authentication button at the top of the window. 12. Choose Custom Path from the popup menu. 13. You will see the following window Click on the Add button. 14. Select the Active Directory node from the available list. (If you don t see the AD node, you may need to restart the computer for the plug-in to bind to the AD server). Click on the Add button. Configuring the OS X Active Directory Plug-in Page 3

4 15. The Active Directory node will now be displayed in the Directory Access Authentication window. Click on Apply. 16. Close Directory Access. 17. Check that you have disabled Automatic Login in the Accounts System Preference, and select the Name and password option. 18. Restart the computer. 19. At the login screen enter your Windows login name and password. 20. A Home folder will be added to the Dock. Clicking on this folder will take you to your Home folder on the Windows server. Configuring the OS X Active Directory Plug-in Page 4

5 21. A Windows server volume, containing your Home folder, will also be mounted on the Desktop. You can navigate to locate your Home folder on the Windows network volume. Some other (advanced) tweaking Administrator Authentication In the AD plugin configuration, click on the Show Advanced Options button Tick Allow Administration by..., and enter an AD admin username If you are an AD Administrator you will now also be an admin user on the local Mac. 2. Laptop and other off-network use Tick the Cache last user logon for offline operation option The last user of the computer will be able to logon to the computer with their Windows AD password, and a local Home folder will be maintained on the Mac When you next connect to the network, you will be able to transfer the files you have saved in the Home folder on the local hard disk to the AD Home folder on the Windows volume, which is mounted on the desktop However, using this setup will preclude using the non-local Home folder setup described in the next section! Configuring the OS X Active Directory Plug-in Page 5

6 3. Home Folder Setup. If you follow the process described in this document, when you log on to the Windows server as an AD user, a local Home folder is also created on your Mac. As this can be a little confusing for users, it may be worthwhile to disable the local Home folder and force the Home folder to be located on the server Login to the Mac client as the Root user Open Terminal and type: dsconfigad show 3.3. You will see the line: Force Local Home is Enabled 3.4. Type: dsconfigad -localhome disable 3.5. You will be advised: Settings changed successfully 3.6. You can check that the settings have in fact been changed by typing again. Type: dsconfigad show 3.7. You will see that the Force Local Home is Enabled option, in the Advanced Options, is no longer displayed. The Mac user s Home folder is now located on the Windows server The mounted volume, and the Home folder dock icon will no longer be displayed. Users access their Home folder through Go > Home, or via the Sidebar Quit Terminal, logout as Root Restart the computer Log in as an AD user. Your Mac Home folder will be created or added to the Windows server. This includes Documents, Movies, Library, folders etc. Your browser bookmarks, iphoto library, Desktop pictures, etc, will now be available at any Mac that you log into on the network A local folder, with read/write permissions for Everyone, should be created on the client Mac, so that students can save imovies and other large files locally, rather than on the server ( or use the generic Shared folder in the Users folder). Configuring the OS X Active Directory Plug-in Page 6

7 4. User Template Each time a new AD user logs onto a Mac they will be setup with a default Dock, which may not include the various applications that you need, or may include others that you don t need The default Dock settings are stored in the System > Library > User Template > English.lproj folder on the local hard disk Log on to the computer as a local Admin user Create a new Student user. Setup the new user s Dock exactly as you want each user s Dock to appear. (You can also do this for default Browser home page, Image capture defaults, etc, etc.) 4.4. Log off as the new user Log on as the Root user Copy (Option-drag) the new user s Library folder to replace the Library folder in the User Template > English.lproj folder Use NetRestore to clone the HD to each of the other computers which will be connecting to the AD server The User Template you have setup will be used to create the default settings for each user the first time they login. Once the user s initial Library folder is created, their settings will be stored on the AD server. Configuring the OS X Active Directory Plug-in Page 7