Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A company is about to hire me to be their I.T. Admin. (They currently have no Admin). In the interview, they stated one of the things they want me to do is put in a MS Domain Controller. The thing is, they are a graphic design company with about 100 Mac Clients and maybe 5 Windows Clients. So other than login-credentials and network shares, what is the benefit of this? Should I just tell them to use the OSX equivalent of AD? How hard is it to learn whatever OSX's AD is?

share|improve this question

You're probably better off taking a "Golden Triangle" approach here. That means having Open Directory on some OS X servers, Active Directory on Windows ones, and configuring Kerberos to forward auth requests from the OD servers to the AD ones.

This way, you get authentication and authorization centralized on a Windows platform, and you can still use Apple specific tools like WGM (think Group Policy, but lacking) for the OS X machines, since they'll be bound to both directories.

With only 5 Windows clients, you might even just want to do OD and skip AD all together until your number of Windows clients grows.

Products like ADmitMac also exist to help ease this management burden (nightmare), though it's more meant for integrating Macs into a largely Windows environment - which is the opposite of what you're doing.

One final option is to run some Apple-specific schema updates on your Domain Controllers, which will let you use WGM to manage OS X clients without the need for Open Directory at all. Some people do this, and have no problem. Other people are really really scared to run a schema update from Apple in a production forest - I'm one of those people, so I've never tried this.

share|improve this answer
Although, given that there's no current AD forest (it seems), and he'd be building new, I'd be less hesitant about trying an Apple schema update. It's not like there's any possibility of it hosing the current forest, so worst-case, it doesn't work before you roll it to production, and you rebuild the forest without the Apple bits. – HopelessN00b Dec 12 '12 at 17:05
@HopelessN00b While this is true, the support nightmare if a future schema update fails when upgrading DCs, plus Apple's shaky history of Windows interoperability makes me really really hesitant to ever encourage anyone to go down that route. – MDMarra Dec 12 '12 at 17:06
I once had an LDIF file COMPLETELY fubar my AD schema. Unless the schema extensions come from Microsoft or Apple directly, I wouldn't touch them. – SpacemanSpiff Dec 12 '12 at 17:26

Apple's inconsistency with their AD client is a nightmare. Every version of OSX changes their approach and it's hard to maintain a consistent design. The best solution I ever found is/was called LikeWise Enterprise. It allows for complement management from the AD side of things. There is a free version that provides just user authentication and single-sign on, and the paid for version gets you support and policies.

This is the company that bought likewise and continues to develop the software. The golden triangle approach is still workable, but in my experience has been a nightmare to manage.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.