How To Integrate Modern Macs To A Windows Network

A walk through of the steps needed to join an OS X 10.3 or 10.4 client to a Windows 2000 or Windows 2003 domain.

Any time you see a Star [*] symbol in the text, this is a link to a screenshot of what is being discussed.

1. Setup (on the Windows DC)
2. Open Active Directory Users and Computers (ADUC)[*] and decide on a location for the Apple Mac’s computer account. Best practice suggests creating an OU for Apple computer accounts.
3. Create a computer account, giving it the name that you want to use for the Apple computer on your network – do not assign a GUID to make it a ‘managed’ account.
4. Close ADUC

Setup (on the OS X client)

1. Login with an account that has admin access to the computer.
2. Open System Preferences and open the Sharing tab.
3. Check that the computer’s name is the same as the one we just used in ADUC. [*]
4. Click Show All
5. Click Network. Select your active connection, and click on TCP/IP
6. (If you are using DHCP then some or all of this information is possibly already delivered by your DHCP server – check with the DHCP admin)
7. Type in a suitable IP address, subnet mask, router address.
8. Type in a DNS server address – ENSURE that at least the first DNS server in the list corresponds to an Active Directory DNS server.
9. Click on Search Domains, Fill in your active directory domain.
10. Click Apply Now.[*]
11. Click Accounts, then click Login Options, authenticating with your LOCAL admin account if asked.
12. “Under Display Login Window As” select “Name and Password”.[*]
13. Close System Preferences.

Testing that the client computer can “see” the network.

1. Open the finder, and navigate to the utilities folder inside applications.[*]
2. Open the terminal, and ping domain controllers by NETWORK NAME to ensure that DNS resolution is working properly within your domain.
3. Ensure that name and IP are resolved correctly and that the ping actually works. [*]
4. Stop the ping and close the terminal when done.

DO NOT TRY TO PROCEED IF THE ABOVE STEP DOES NOT WORK!

Binding the Mac client to the Windows Domain

1. Run the directory access tool, which is also in the utilities folder.
2. Tick “Active Directory”, then click Configure. [*]
3. Fill in the Fully Qualified Domain Name of the Active Directory namespace (note, NOT the Active Directory Domain Controller!).
4. Fill in the Computer name of the Mac. This should be the same as the one we setup earlier in ADUC on the Windows Server, and configured the mac to use in system properties. [*]
5. Click BIND. Authenticate with your local Admin password if asked to do so.
6. Next, fill in the details of a Windows User Account with permission to add computers to the domain. Typically this will be an admin’s account.
7. IF you DID NOT pre-create a computer account for the Apple Mac, then fill in the Computer OU with the details of where you’d like the account to be created, using standard LDAP notation.
8. If you HAVE pre-created a computer account, then leave this as it is.
9. Ensure that both tickboxes are ticked.
10. Click OK [*]

The client will now attempt to bind to AD and join the domain.

1. If you HAVE pre-created a computer account then you should be asked if you wish to use an existing computer account. Click OK, because that is exactly what we’re trying to do. [*]
2. When the operation is finished, you can close Directory Access by clicking OK.
3. At this time you can also click Advanced Options to inspect and configure custom settings. I strongly suggest leaving these alone if you don’t know what they mean or why you would want to change them. [*]
4. Logout.

If all goes well you should now be greeted with a login window that expects you to type in your username and password [*] instead of selecting from a list.

You should now be able to log in with an Active Directory account by typing in the username and password in the traditional manner, and you can also login with a local account by specifying their username and password in the same way.