I am familiar with and have successfully implemented the “magic triangle” in a test environment. In my production environment, I already have 13,000 Open Directory accounts and an NT 4 domain controller for about 100 people. I would like to get rid of the NT 4 and possibly upgrade to AD. But I want the opposite of what I’ve seen so far.

I would like to have all user accounts in OD and have AD manage preferences and group policies for the computers. I’ve looked into pGina but this seems to only deal with authentication for logon purposes. It does not seem to be capable of allowing me to add users to windows based groups for security controls on services. I’ve read information on linking Kerberos for cross-realm authentication but it seems that it still requires a user accounts to exist within the AD domain (though I could have misinterpreted what I read – haven’t tested it yet).

Any insight would be great.

I’m not even going to try to go down the path of having OD try to do group policies for WIndows machines. I want to run AD and OD side-by-side, each system managing their own computers. My issue is where the user accounts reside. There’s tons of information about how to have OD pull and authenticate users existing in AD. I can find very little on how to have AD pull and authenticate users existing in OD.

[QUOTE][u]Quote by: dewats7[/u][p]I’m not even going to try to go down the path of having OD try to do group policies for WIndows machines. I want to run AD and OD side-by-side, each system managing their own computers. My issue is where the user accounts reside. There’s tons of information about how to have OD pull and authenticate users existing in AD. I can find very little on how to have AD pull and authenticate users existing in OD.[/p][/QUOTE] Just wanted to echo this. I am fortunate enough to admin an all-Mac office, but we are headed to dual-platform. I want to have AD handle management of the Windows users but pull accounts, etc. from OD. I’m starting to read the white paper now, but if anyone can point me to some more good info it would be much appreciated!

[QUOTE][u]Quote by: macshome[/u][p]Grab our OD/AD whitepaper. It has everything you need to setup a magic triangle system like this.[/p][/QUOTE]

Is there an updated version of the white paper for 10.5 yet? I’m having a hell of a time trying to get my OD and AD to talk together so that I can manage the mac users. I had it working in 10.4, but server crashed, and rebuilt it from a clean 10.5.

Well, OK, Ive implemented and AD-OD magic triangle using Mike Bombich’s insructions. I have a 2003 SBS AD and a 10.4 OD Master.
I have a group called ADusers witch holds the users from AD.
I need to have Network Home Folders for these users (Macintosh machines) into the 10.4 Server with login-logout sync.
Ive created the home folders’ share into the 10.4 Server.

I cannot set a user from the “Active Directory All Domains” to have a Network Home folder into the Tiger Server.

Thanks

Kostas

Hi, I’ve been trying to get the magic triangle to work for while now. I’ve got as far as integrating the users from AD in to OD, AD users can now login to our OS X client machines and can be managed in workgroup manager. I am able to set a home directory in windows for the users using “Active Directory users and computers” to the OS X server we are running to host the home directories and using GPO am able to redirect my documents etc. Where it is all falling apart is when the users login to a OS X client machine using AD as authentication their home directory isn’t there, it isn’t even created where it should be on the server! I’ve been struggling with this for days now any help would be really good. We are running OS X server 10.5 and Windows 2003 server.

Many Thanks

Phil