AD/OD pre-configuration questions

[cm103]

Hi all,

I’ve been tasked with setting up a management solution for the mac clients at the university I work at. I’ll list some of the general points of what I’m dealing with at this point. I’ve already met with our sales rep who flew down to talk with us a bit more on the integration project.

We have an enterprise AD domain containing users and 2 Xserves slated for OD master and OD replica which are not yet set up. They came with OS X 10.4.

– Windows Admin team won’t do schema changes so thats out

– Can I set it up so that AD domain manages windows clients, OD manages macs with users from AD ie. mac users can login to their machines using their AD credentials but the OD domain only manages the mac clients? If possible I’d only like the mac client machines to show up in OD and be able to apply policies to them and not only the users

– Is it possible to pull the Machine and User Groups from AD to OD? How about applying login scripts to OD Groups or is it just users?

– AD domain still uses kix32 for logins scripts (yes I know it’s old but those guys haven’t gotten around to migrating that part yet). Has anyone ever mirrored windows login scripts to be able to automount the same shares as the pc clients? If not then I’ll just automount the common shares to all clients.

– Joining mac clients to OD domain and what type of access will the desktop support guys need to do this. Will password changes also replicate back to the AD domain?

– Script to create software update server failover. If clients can’t connect to local software update then they default to apple’s update service. The rep told me its one or the other but it can be scripted to do this by possibly pinging the local update server to see if it can find it first then defaulting to the apple update server if the client can’t connect to the local update.

– Managing Filevault and turning it on by default with master password set from the enterprise side. Rep also told me that was possible since Filevault uses a local certificate which can be replaced by one issued from enterprise.

I’ve been reading some of the integration whitepapers on here and also some on the apple.com/server/documentation site but it’s a lot of info to sift through to get to directly what I need. The opinions of the guys who have done this before is greatly appreciated. The first few points/questions above are the most important to me at this time.

[cm103]

Thanks for the reply Joel. I have a couple questions about your responses.

Our environment contains over 1000 macs, probably double that and they won’t be joining all at the same time. Creating all the machine accounts manually could be tedious.

We’re also restricting who can join machines to the domain so that’s why a user/pass combo, kinda like joining windows clients to AD would be preferred.

If you do find that article on enterprise management of FileVault then I would really appreciate if you share the link for it. I’ll email my Apple rep and ask if they have any documentation on that as well.

Thanks again man.

[Author]

Posts