Active Directory integration issues

Hello all,

I’m hoping that someone can shed some light on some issues I’m having with a new AD integration project. I’ve had much success with previous deployments but this one is getting a little hairy, and despite much investigation I’m not happy with the available options.

In essence we have a Windows 2000 Server hosting Active Directory, with a Mac OS X Server 10.3.6 bound to it using the AD Plug-In. The Mac OS X Server is currently in standalone mode, to help stop the AD Plug-In from going wacky (and additionally, OD functionality is not yet necessary). The Mac OS X Server is bound to AD to allow users to access the shares hosted from the OSXS/Xserve RAID using their AD credentials. All good so far (although we’ll all be a lot happier when ACL’s are introduced in 10.4!). The client machines for the most part include 700-800 iBooks running a Mac OS X 10.3.6 SOE. These iBooks are not bound to any directory services, and simply have local home dirs for the users.

This is where things get interesting. We would like to offer the functionality of a network home folder on the OSXS/Xserve RAID to all AD users for the purpose of data backups (not for network homes). Ideally we would like implement and manage this via Workgroup Manager, so as to leverage its ease-of-use. Additionally, in trying to keep things as simple as possible, I’d like to not have to bind all of the workstations to any directories.

Mactroll’s excellent AD-OD whitepaper has shed some light on using a script and a standard share to provide similar functionality, but setting home folder quotas for users is a pain (even via Webmin!), and the ongoing requirements for adding new users manually through the shell script doesn’t sit well with me or the client.

Is my only option to look at binding my clients to both AD & OD? Or can I simply rely on binding from the Mac OS X Server to AD to deliver what I need? Will extending the AD schema help with this at all? If I need to bind the clients to the AD via the AD Plug-in, will the offline caching successfully work for local homes?

Over the next week we’ll also be adding an additional Xserve/Xserve RAID (and Xsan when we finally get it!) unit for load balancing and failover, so this could always be used to help out with the final solution.

If anyone has any info or suggestions they could reply with it would be very much appreciated.

And cheers to the guys @ AFP548 for providing such excellent information!