Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to integrate a Snow Leopard server and a number of client machines into my AD network and I'm wondering if I can update the schema on a DC running Server 2003 (NOT R2) to support mac systems? Or do I need R2?

share|improve this question
up vote 1 down vote accepted

Why do you think you need to update the schema at all to support mac clients? I've got several clients bound perfectly happily to a Windows 2003-based AD and have had this working since OS X 10.3 days without too much bother and certainly with no schema extensions.

You can bind a mac client (or server for that matter) to AD without needing to do anything special - you only need to change the AD schema if you are trying to solve a specific additional problem that specifically requires a schema extension...

On a mac go to system preferences, accounts, login options, find network account server and click 'join', type in the FQDN of the Windows domain you are joining (e.g. '', not '') and if that fails then your problem is not because you haven't extended the schema.

share|improve this answer
I've bound my Macs to both AD and OD Mac server. I'd like to manage client preferences on the Macs via Workgroup Manager. I was told the way to do this was via modifying the schema. It is a university lab environment, so I would like to have it fairly locked down. – Christopher at CMU Jul 13 '10 at 17:28
We've not needed to do that, nor have the mac server consultants we called in to give us a hand ever suggested that. In my experience the way to do that is via Open Directory on the Mac server. This is what we do and it works fine. At no time do you need to alter AD. – RobM Jul 13 '10 at 17:54
If you want to manage preferences for AD users on Mac clients, you need to EITHER extend the AD schema (starting frem 2003 R3 or later), OR bind the clients to both AD and an Apple OD domain (a setup known as dual directory or magic triangle) -- doing both is redundant. In a magic triangle, you put your AD users into OD groups, and manage preferences for the OD groups (and you can also do OD computer and computer groups prefs management). – Gordon Davisson Jul 13 '10 at 19:55
Ah, I was told I needed to do both the magic triangle AND extend the AD schema because I get an error when saving preferences in WM saying, "The directory system schema does not support storing Managed Desktop settings." Which gives me a "DirServices [dsAddAttribute] error: -14140" in the console. So if I don't need to do both, then I guess I have another problem to look into. Thanks guys. – Christopher at CMU Jul 14 '10 at 15:25
Hi Christopher, If you're applying mac preferences to machines, you can do this directly in OD. If you want to apply them to users then as Gordon says, create a group in OD, add the AD users (IIRC you can just add an AD group, such as domain users, for example), and apply the settings to the group. If you're still getting an error and that is what you are doing then something odd is going on. Which sadly, as much as I like the mac platform, is not a great surprise to me. – RobM Jul 14 '10 at 19:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.